[Tue Nov 11 01:51:23.983882 2025] [:error] [pid 24225:tid 24244] [client 94.131.118.169:54626] [client 94.131.118.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.131.118.169, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRImG52rrdiHvhXEioV8bQAAAks"]
[Tue Nov 11 01:51:24.021160 2025] [proxy_fcgi:error] [pid 24225:tid 24244] [client 94.131.118.169:54626] AH01071: Got error 'Primary script unknown'
[Tue Nov 11 01:51:30.479476 2025] [:error] [pid 41978:tid 42010] [client 219.76.135.188:40078] [client 219.76.135.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 219.76.135.188, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRImIpTXUiwDnS4PcJ9M0wAAANA"]
[Tue Nov 11 01:51:30.491400 2025] [proxy_fcgi:error] [pid 41978:tid 42010] [client 219.76.135.188:40078] AH01071: Got error 'Primary script unknown'
[Tue Nov 11 01:54:01.276818 2025] [:error] [pid 24225:tid 24234] [client 43.133.187.11:52600] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRImuZ2rrdiHvhXEioV9kgAAAkE"]
[Tue Nov 11 02:52:54.292671 2025] [:error] [pid 24103:tid 24117] [client 222.79.104.23:41938] [client 222.79.104.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRI0hrmrGVWhZHx4njJKuAAAAgs"]
[Tue Nov 11 08:53:03.127461 2025] [:error] [pid 43301:tid 43336] [client 36.111.67.189:36255] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRKI73Sao-Xtv99nRAZldAAAAEI"]
[Tue Nov 11 16:04:46.857757 2025] [:error] [pid 22314:tid 22334] [client 109.248.129.246:42097] [client 109.248.129.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.248.129.246, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRLuHpvbUgp3MCb2GYQNxQAAAFE"]
[Tue Nov 11 16:04:46.868576 2025] [proxy_fcgi:error] [pid 22314:tid 22334] [client 109.248.129.246:42097] AH01071: Got error 'Primary script unknown'
[Tue Nov 11 16:39:47.147194 2025] [:error] [pid 43205:tid 43227] [client 161.35.178.94:35324] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRL2U748SbhIkX6TjwNGfgAAARM"]
[Tue Nov 11 16:39:48.015875 2025] [:error] [pid 36579:tid 36624] [client 161.35.178.94:33232] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRL2VOmuedRSntjwLw5V_QAAAA0"]
[Tue Nov 11 17:19:25.485721 2025] [:error] [pid 36580:tid 36645] [client 161.35.178.94:44654] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRL_nZaaFQZGE3H9yOGpwwAAAEc"]
[Tue Nov 11 17:19:26.570666 2025] [:error] [pid 43205:tid 43227] [client 161.35.178.94:56986] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRL_nr48SbhIkX6TjwNSDQAAARM"]
[Tue Nov 11 19:01:52.542616 2025] [:error] [pid 36578:tid 36592] [client 161.35.178.94:46922] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRMXoEMi03XeylcOo5XIPwAAAMk"]
[Tue Nov 11 19:01:56.747926 2025] [:error] [pid 36579:tid 36623] [client 161.35.178.94:43756] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRMXpOmuedRSntjwLw55AQAAAAw"]
[Tue Nov 11 21:18:31.219324 2025] [:error] [pid 36579:tid 36630] [client 43.130.16.212:54752] [client 43.130.16.212] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRM3p-muedRSntjwLw6Y4gAAABM"]
[Tue Nov 11 23:02:28.708942 2025] [:error] [pid 47964:tid 47968] [client 161.35.178.94:49876] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRNQBF6CQC3ebUS5pkQawwAAAYE"]
[Tue Nov 11 23:02:33.519006 2025] [:error] [pid 47860:tid 47896] [client 161.35.178.94:36378] [client 161.35.178.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRNQCaPe6bkmJWx80CzmBwAAAEU"]
[Tue Nov 11 23:02:50.017372 2025] [:error] [pid 49628:tid 49653] [client 103.81.92.238:16565] [client 103.81.92.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.81.92.238, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRNQGr82AgnfnwL7V2ZPMQAAAJc"]
[Tue Nov 11 23:02:50.031757 2025] [proxy_fcgi:error] [pid 49628:tid 49653] [client 103.81.92.238:16565] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 00:10:18.755180 2025] [:error] [pid 49628:tid 49632] [client 188.130.128.192:47011] [client 188.130.128.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.130.128.192, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRNf6r82AgnfnwL7V2ZuvQAAAII"]
[Wed Nov 12 00:10:18.770269 2025] [proxy_fcgi:error] [pid 49628:tid 49632] [client 188.130.128.192:47011] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 02:41:05.416276 2025] [:error] [pid 40745:tid 40765] [client 173.239.218.216:24413] [client 173.239.218.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.216, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRODQcdgIR-a_T0XcdAiNwAAAA8"]
[Wed Nov 12 02:41:05.425851 2025] [proxy_fcgi:error] [pid 40745:tid 40765] [client 173.239.218.216:24413] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 03:54:46.622411 2025] [:error] [pid 11808:tid 11891] [client 98.159.37.168:57837] [client 98.159.37.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.168, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aROUht2oLKYfZ2VS0VRvLAAAAIQ"]
[Wed Nov 12 03:54:46.632709 2025] [proxy_fcgi:error] [pid 11808:tid 11891] [client 98.159.37.168:57837] AH01071: Got error 'Primary script unknown'
2025/11/12 08:53:48 [error] 24800#24800: *3073 connect() failed (111: Connection refused) while connecting to upstream, client: 35.205.236.220, server: switchcreative.net, request: "GET / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "www.switchcreative.net"
2025/11/12 09:21:47 [error] 23000#23000: *26 openat() "/home/switchcreative/public_html/ios/Login เว็บสล็อต รองรับ true wallet.html" failed (2: No such file or directory), client: 66.249.70.167, server: switchcreative.net, request: "GET /ios/Login%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%A3%E0%B8%AD%E0%B8%87%E0%B8%A3%E0%B8%B1%E0%B8%9A%20true%20wallet.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:21:49 [error] 23000#23000: *26 openat() "/home/switchcreative/public_html/bonus/Login โปรแกรมฟุตบอลไทยลีก.html" failed (2: No such file or directory), client: 66.249.70.167, server: switchcreative.net, request: "GET /bonus/Login%20%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B9%81%E0%B8%81%E0%B8%A3%E0%B8%A1%E0%B8%9F%E0%B8%B8%E0%B8%95%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%A5%E0%B8%B5%E0%B8%81.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:21:59 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/sitemap/Login บอล วันนี้ สด.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /sitemap/Login%20%E0%B8%9A%E0%B8%AD%E0%B8%A5%20%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89%20%E0%B8%AA%E0%B8%94.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:04 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/xoso/Login ตารางคะแนนบาส nba.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /xoso/Login%20%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%84%E0%B8%B0%E0%B9%81%E0%B8%99%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%AA%20nba.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:11 [error] 23000#23000: *26 openat() "/home/switchcreative/public_html/cash/สลอตทดลองใหม่ล่าสุด 2023.html" failed (2: No such file or directory), client: 66.249.70.167, server: switchcreative.net, request: "GET /cash/%E0%B8%AA%E0%B8%A5%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%202023.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:17 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/fishing/เว็บ สล็อต อันดับ 1 ฟรีเครดิต.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /fishing/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%AD%E0%B8%B1%E0%B8%99%E0%B8%94%E0%B8%B1%E0%B8%9A%201%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:18 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/app/Slot สล็อตm168.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /app/Slot%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95m168.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:22 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/video/เว็บตรงไม่ผ่านเอเย่นต์ แตกง่าย.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /video/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%A2%E0%B9%88%E0%B8%99%E0%B8%95%E0%B9%8C%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:24 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/fishing/เว็บ รวมสล็อตทุกค่าย ฝาก10รับ100.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /fishing/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%81%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:25 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/games/Login สล็อต z.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /games/Login%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20z.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:29 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/cash/Daftar โปรแกรมเตะเชลซี.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /cash/Daftar%20%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B9%81%E0%B8%81%E0%B8%A3%E0%B8%A1%E0%B9%80%E0%B8%95%E0%B8%B0%E0%B9%80%E0%B8%8A%E0%B8%A5%E0%B8%8B%E0%B8%B5.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:30 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/video/ดูบอลสด 99 ฟรี ไม่มีโฆษณา.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /video/%E0%B8%94%E0%B8%B9%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B8%AA%E0%B8%94%2099%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B9%82%E0%B8%86%E0%B8%A9%E0%B8%93%E0%B8%B2.html HTTP/1.1", host: "switchcreative.net"
2025/11/12 09:22:30 [error] 23001#23001: *101 openat() "/home/switchcreative/public_html/ios/Slot ทีเด็ดบอลรองวันนี้.html" failed (2: No such file or directory), client: 66.249.70.166, server: switchcreative.net, request: "GET /ios/Slot%20%E0%B8%97%E0%B8%B5%E0%B9%80%E0%B8%94%E0%B9%87%E0%B8%94%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B8%A3%E0%B8%AD%E0%B8%87%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.html HTTP/1.1", host: "switchcreative.net"
[Wed Nov 12 14:12:59.191146 2025] [:error] [pid 60405:tid 60415] [client 220.196.191.58:42294] [client 220.196.191.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aRQla3MGv_mlVi6mf5qrzQAAAAc"]
[Wed Nov 12 14:13:00.276132 2025] [:error] [pid 60097:tid 60176] [client 220.196.191.58:42488] [client 220.196.191.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "aRQlbMdT5oio_TbWpi8wewAAANc"]
[Wed Nov 12 14:13:01.276893 2025] [:error] [pid 60095:tid 60122] [client 220.196.191.58:42678] [client 220.196.191.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/env/.env"] [unique_id "aRQlbXlw2elroagFF1rvdAAAAFc"]
[Wed Nov 12 19:05:08.894472 2025] [:error] [pid 60097:tid 60173] [client 182.10.161.124:27415] [client 182.10.161.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.161.124, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRRp5MdT5oio_TbWpi9_DwAAANQ"]
[Wed Nov 12 19:05:08.895314 2025] [:error] [pid 12744:tid 12755] [client 182.10.161.124:27419] [client 182.10.161.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.161.124, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRRp5J1cp_ouUvkFj0VflwAAAQc"]
[Wed Nov 12 19:05:08.908485 2025] [proxy_fcgi:error] [pid 12744:tid 12755] [client 182.10.161.124:27419] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 19:05:08.908902 2025] [proxy_fcgi:error] [pid 60097:tid 60173] [client 182.10.161.124:27415] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 19:48:24.850173 2025] [:error] [pid 23737:tid 23762] [client 94.247.172.129:34354] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRR0CBQUsVVfOZWgW_W4PwAAAY0"]
[Thu Nov 13 05:43:34.274661 2025] [:error] [pid 22224:tid 22302] [client 182.42.105.85:39450] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRT_hruEVuTj3a_UBfD_jAAAAJY"]
[Thu Nov 13 13:38:43.571851 2025] [:error] [pid 62303:tid 62308] [client 45.153.34.41:43554] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRVu47-hlFTtVrZw8jCMbAAAAIE"]
[Thu Nov 13 15:04:39.119199 2025] [:error] [pid 62216:tid 62254] [client 122.171.17.211:28200] [client 122.171.17.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.171.17.211, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRWDB-pyFB9M2aVQhwMInQAAAAc"]
[Thu Nov 13 15:04:39.130779 2025] [proxy_fcgi:error] [pid 62216:tid 62254] [client 122.171.17.211:28200] AH01071: Got error 'Primary script unknown'
[Thu Nov 13 15:06:23.062261 2025] [:error] [pid 62303:tid 62322] [client 45.153.34.41:51784] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRWDb7-hlFTtVrZw8jC0bQAAAI8"]
[Thu Nov 13 17:55:44.561881 2025] [:error] [pid 62303:tid 62331] [client 150.241.107.255:56712] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRWrIL-hlFTtVrZw8jDoIgAAAJg"]
[Thu Nov 13 17:55:45.112236 2025] [:error] [pid 62216:tid 62255] [client 150.241.107.255:56925] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRWrIepyFB9M2aVQhwM0rQAAAAg"]
[Thu Nov 13 17:55:45.658195 2025] [:error] [pid 62216:tid 62258] [client 150.241.107.255:57362] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIepyFB9M2aVQhwM0tAAAAAs"]
[Thu Nov 13 22:49:17.837650 2025] [:error] [pid 19872:tid 19897] [client 43.130.60.195:35054] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRXv7cusrN1b6ZJ_vbsnyQAAAFQ"]
[Fri Nov 14 01:09:11.374507 2025] [:error] [pid 56497:tid 56562] [client 182.44.10.67:44408] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRYQt3satOTNIa5GK3tSyQAAAIc"]
[Fri Nov 14 06:57:09.974563 2025] [:error] [pid 47155:tid 47201] [client 194.32.229.244:38743] [client 194.32.229.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.32.229.244, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRZiRZipxRXMZJH8hmgLmgAAAE8"]
[Fri Nov 14 06:57:09.987988 2025] [proxy_fcgi:error] [pid 47155:tid 47201] [client 194.32.229.244:38743] AH01071: Got error 'Primary script unknown'
[Fri Nov 14 07:10:35.819631 2025] [:error] [pid 47155:tid 47197] [client 113.141.91.58:46169] [client 113.141.91.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRZla5ipxRXMZJH8hmgQEAAAAEs"]
[Fri Nov 14 08:16:56.311754 2025] [:error] [pid 47154:tid 47178] [client 193.178.186.148:37206] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.save"] [unique_id "aRZ0-EijA13A3g3ATrKdzgAAABM"]
[Fri Nov 14 08:16:56.390635 2025] [:error] [pid 47156:tid 47217] [client 193.178.186.148:37184] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aRZ0-NjrQX_P-kC7M_4wVwAAAIM"]
[Fri Nov 14 08:16:56.510346 2025] [:error] [pid 47630:tid 47650] [client 193.178.186.148:37192] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/core/.env"] [unique_id "aRZ0-MxXXNBfWgpfVJ5ptgAAARI"]
[Fri Nov 14 08:16:56.674709 2025] [:error] [pid 47154:tid 47167] [client 193.178.186.148:37180] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "aRZ0-EijA13A3g3ATrKd0AAAAAg"]
[Fri Nov 14 08:16:56.676290 2025] [:error] [pid 47156:tid 47222] [client 193.178.186.148:37222] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/bot/.env"] [unique_id "aRZ0-NjrQX_P-kC7M_4wWAAAAIg"]
[Fri Nov 14 08:16:56.741803 2025] [:error] [pid 47630:tid 47632] [client 193.178.186.148:37220] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "aRZ0-MxXXNBfWgpfVJ5ptwAAAQA"]
[Fri Nov 14 08:16:57.523809 2025] [:error] [pid 47156:tid 47236] [client 193.178.186.148:37296] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/bot/.env"] [unique_id "aRZ0-djrQX_P-kC7M_4wXQAAAJU"]
[Fri Nov 14 08:16:57.645140 2025] [:error] [pid 47154:tid 47175] [client 193.178.186.148:37288] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env"] [unique_id "aRZ0-UijA13A3g3ATrKd0gAAABA"]
[Fri Nov 14 08:16:57.676632 2025] [:error] [pid 47242:tid 47246] [client 193.178.186.148:37260] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/core/.env"] [unique_id "aRZ0-VPNnvrux3OMagy-CgAAAME"]
[Fri Nov 14 08:16:57.774354 2025] [:error] [pid 47154:tid 47183] [client 193.178.186.148:37272] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.save"] [unique_id "aRZ0-UijA13A3g3ATrKd0wAAABg"]
[Fri Nov 14 08:16:57.808642 2025] [:error] [pid 59105:tid 59111] [client 193.178.186.148:37236] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/api/.env"] [unique_id "aRZ0-bd-anP1JpNfuSKiRQAAAUQ"]
[Fri Nov 14 08:16:57.825650 2025] [:error] [pid 59105:tid 59130] [client 193.178.186.148:37252] [client 193.178.186.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "aRZ0-bd-anP1JpNfuSKiRgAAAVc"]
[Fri Nov 14 09:20:28.653790 2025] [:error] [pid 47156:tid 47236] [client 66.249.70.166:50216] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoso/Situs%20Slot%20Terpercaya.html"] [unique_id "aRaD3NjrQX_P-kC7M_5TgwAAAJU"]
[Fri Nov 14 09:20:34.736206 2025] [:error] [pid 47242:tid 47264] [client 66.249.70.166:53815] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoso/Slot%20%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%84%E0%B8%B0%E0%B9%81%E0%B8%99%E0%B8%99%E0%B8%81%E0%B8%B1%E0%B8%A5%E0%B9%82%E0%B8%8A%E0%B9%88%20%E0%B9%80%E0%B8%8B%E0%B9%80%E0%B8%A3%E0%B8%B5%E0%B8%A2%E0%B8%9A%E0%B8%B5.html"] [unique_id "aRaD4lPNnvrux3OMagzUdAAAANM"]
[Fri Nov 14 09:21:18.484462 2025] [:error] [pid 47155:tid 47204] [client 66.249.70.166:65121] [client 66.249.70.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fishing/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9Aufa.html"] [unique_id "aRaEDpipxRXMZJH8hmg5eAAAAFI"]
[Fri Nov 14 10:06:43.013887 2025] [:error] [pid 47242:tid 47255] [client 179.178.162.26:55019] [client 179.178.162.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.178.162.26, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRaOs1PNnvrux3OMagzmIAAAAMo"]
[Fri Nov 14 10:06:43.026786 2025] [proxy_fcgi:error] [pid 47242:tid 47255] [client 179.178.162.26:55019] AH01071: Got error 'Primary script unknown'
[Fri Nov 14 10:58:58.899229 2025] [:error] [pid 47242:tid 47248] [client 43.159.149.56:33042] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRaa8lPNnvrux3OMagz8ggAAAMM"]
[Fri Nov 14 13:58:37.423858 2025] [:error] [pid 16671:tid 16681] [client 66.249.70.166:48890] [client 66.249.70.166] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "216.244.66.229_d148ee61c6349470587340ea10e25b0af643bcb4"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/casino/\\xe0\\xb9\\x81\\xe0\\xb8\\xab\\xe0\\xb8\\xa5\\xe0\\xb9\\x88\\xe0\\xb8\\x87\\xe0\\xb8\\x97\\xe0\\xb8\\x94\\xe0\\xb8\\xa5\\xe0\\xb8\\xad\\xe0\\xb8\\x87\\xe0\\xb9\\x80\\xe0\\xb8\\xa7\\xe0\\xb9\\x87\\xe0\\xb8\\x9a\\xe0\\xb8\\xaa\\xe0\\xb8\\xa5\\xe0\\xb9\\x87\\xe0\\xb8\\xad\\xe0\\xb8\\x95 \\xe0\\xb8\\x9f\\xe0\\xb8\\xa3\\xe0\\xb8\\xb5 \\xe0\\xb8\\xaa\\xe0\\xb8\\x84\\xe0\\xb8\\xa3\\xe0\\xb8\\xb5\\xe0\\xb8\\x99.html"] [unique_id "aRbFCzsoHwEAmeIzZXD4SgAAAQQ"]
[Fri Nov 14 14:47:42.671570 2025] [:error] [pid 16709:tid 16718] [client 49.51.233.95:40864] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRbQjqNdzfVNC4oipLUEBwAAAUc"]
[Fri Nov 14 15:31:38.868952 2025] [:error] [pid 16575:tid 16655] [client 101.32.52.164:42898] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRba2u6qT670YxigvbBVYgAAANU"]
[Fri Nov 14 19:27:59.103024 2025] [proxy_fcgi:error] [pid 16574:tid 16607] [client 145.239.10.137:59003] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/natural.php
[Sat Nov 15 00:33:45.294623 2025] [:error] [pid 45909:tid 45985] [client 43.155.129.131:36632] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRdZ6cZqItrYybG86kiGUQAAAdQ"]
[Sat Nov 15 04:25:54.040470 2025] [:error] [pid 27909:tid 27923] [client 177.192.9.209:12090] [client 177.192.9.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.192.9.209, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aReQUiTfZ6B57n8HepVxrwAAAAo"]
[Sat Nov 15 04:25:54.054279 2025] [proxy_fcgi:error] [pid 27909:tid 27923] [client 177.192.9.209:12090] AH01071: Got error 'Primary script unknown'
[Sat Nov 15 04:26:01.997564 2025] [:error] [pid 27911:tid 27990] [client 170.0.49.198:56596] [client 170.0.49.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.0.49.198, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aReQWcGzUdrhGBIfiKSkqgAAAJY"]
[Sat Nov 15 04:26:02.003957 2025] [proxy_fcgi:error] [pid 27911:tid 27990] [client 170.0.49.198:56596] AH01071: Got error 'Primary script unknown'
[Sat Nov 15 06:21:51.503089 2025] [:error] [pid 37318:tid 37382] [client 54.169.218.131:56290] [client 54.169.218.131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRerf-gM1rHoEAqoQDc6mAAAARQ"]
[Sat Nov 15 11:25:36.846258 2025] [:error] [pid 27911:tid 27978] [client 43.152.72.247:56536] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRfysMGzUdrhGBIfiKQe0QAAAIo"]
[Sat Nov 15 12:09:26.349850 2025] [:error] [pid 20654:tid 20662] [client 138.197.23.42:64619] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRf89ncS7eC8vO76_ydtdQAAA4U"]
[Sat Nov 15 12:09:26.766641 2025] [:error] [pid 20313:tid 20324] [client 138.197.23.42:64779] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRf89hI9DXIgPadBLUZSKQAAAsg"]
[Sat Nov 15 12:09:27.195594 2025] [:error] [pid 20313:tid 20318] [client 138.197.23.42:64927] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRf89xI9DXIgPadBLUZSMQAAAsI"]
[Sat Nov 15 12:09:27.625165 2025] [:error] [pid 22765:tid 22778] [client 138.197.23.42:65101] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRf896brQzjuZmPIWDafMQAAAog"]
[Sat Nov 15 12:09:28.057635 2025] [:error] [pid 20346:tid 20370] [client 138.197.23.42:65266] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRf8-J7hsydZdIoVTlvNAAAAAxU"]
[Sat Nov 15 15:10:13.664318 2025] [:error] [pid 20654:tid 20666] [client 101.91.148.219:42610] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRgnVXcS7eC8vO76_yerVwAAA4k"]
[Sat Nov 15 17:23:07.545004 2025] [autoindex:error] [pid 27909:tid 27930] [client 20.2.83.141:54157] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 15 21:48:06.686290 2025] [:error] [pid 22613:tid 22634] [client 36.111.67.189:53695] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRiElioyR3cDsIRGPRndgwAAAhM"]
[Sun Nov 16 01:41:05.093516 2025] [:error] [pid 20346:tid 20357] [client 43.153.19.83:56080] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRi7MZ7hsydZdIoVTluFewAAAwg"]
[Sun Nov 16 02:38:50.823960 2025] [proxy_fcgi:error] [pid 27997:tid 28008] [client 34.93.78.120:42232] AH01071: Got error 'Primary script unknown'
[Sun Nov 16 18:58:08.276025 2025] [autoindex:error] [pid 34227:tid 34248] [client 155.94.163.116:54325] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 17 01:00:20.927408 2025] [:error] [pid 55745:tid 55759] [client 43.166.134.114:36128] [client 43.166.134.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRoDJIZk0eT801XQsatyVgAAAEw"]
[Mon Nov 17 05:43:24.638227 2025] [:error] [pid 39450:tid 39500] [client 103.65.236.149:57750] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "aRpFfOoZqPB4_7vNEDSXxgAAAFM"]
[Mon Nov 17 11:14:00.813320 2025] [proxy_fcgi:error] [pid 39449:tid 39478] [client 141.98.10.107:60287] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 11:14:03.526161 2025] [proxy_fcgi:error] [pid 39537:tid 39564] [client 141.98.10.107:60934] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 15:31:50.082834 2025] [:error] [pid 39449:tid 39466] [client 150.109.230.210:40114] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRrPZqUCymTA3MDfzLMcvgAAAAw"]
[Mon Nov 17 20:28:02.967308 2025] [:error] [pid 39449:tid 39460] [client 182.42.111.213:51951] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRsU0qUCymTA3MDfzLNhdAAAAAY"]
[Mon Nov 17 21:11:40.167520 2025] [:error] [pid 31419:tid 31444] [client 110.54.167.236:23471] [client 110.54.167.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.54.167.236, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRsfDAHQ5Sbp7elmDZikVgAAApc"]
[Mon Nov 17 21:11:40.179054 2025] [proxy_fcgi:error] [pid 31419:tid 31444] [client 110.54.167.236:23471] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 21:25:15.444612 2025] [:error] [pid 30801:tid 30814] [client 171.61.174.246:22512] [client 171.61.174.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.61.174.246, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRsiOzbGAU49DhMTBD76rgAAAks"]
[Mon Nov 17 21:25:15.454837 2025] [proxy_fcgi:error] [pid 30801:tid 30814] [client 171.61.174.246:22512] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 21:25:15.984566 2025] [proxy_fcgi:error] [pid 31419:tid 31441] [client 171.61.174.246:18950] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 21:25:35.119680 2025] [:error] [pid 39451:tid 39526] [client 51.15.15.12:55682] [client 51.15.15.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.15.15.12, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRsiT-fgkqXTS0SO3fAsZwAAAJI"]
[Mon Nov 17 21:25:35.130224 2025] [proxy_fcgi:error] [pid 39451:tid 39526] [client 51.15.15.12:55682] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 21:25:37.336399 2025] [proxy_fcgi:error] [pid 20913:tid 20921] [client 192.42.116.192:55176] AH01071: Got error 'Primary script unknown'
[Mon Nov 17 22:03:59.908566 2025] [:error] [pid 32753:tid 32780] [client 129.226.213.145:45936] [client 129.226.213.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRsrT06YNqI5vkht922grQAAA9g"]
[Tue Nov 18 05:57:07.189443 2025] [:error] [pid 61482:tid 61492] [client 43.166.250.187:51412] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRuaM_tNHsWZClVWav5HUAAAAMU"]
[Tue Nov 18 13:27:18.493170 2025] [:error] [pid 44560:tid 44571] [client 34.100.172.116:53024] [client 34.100.172.116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aRwDtgnbP7etF3q5-5sqcwAAAMA"]
[Tue Nov 18 13:27:23.802346 2025] [proxy_fcgi:error] [pid 44471:tid 44525] [client 34.100.172.116:38626] AH01071: Got error 'Primary script unknown'
[Tue Nov 18 13:27:23.960384 2025] [proxy_fcgi:error] [pid 44471:tid 44509] [client 34.100.172.116:38626] AH01071: Got error 'Primary script unknown'
[Tue Nov 18 13:27:24.120567 2025] [proxy_fcgi:error] [pid 44471:tid 44510] [client 34.100.172.116:38626] AH01071: Got error 'Primary script unknown'
[Tue Nov 18 15:51:17.079545 2025] [:error] [pid 1387:tid 1408] [client 221.229.106.25:41596] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRwldUzBvalKyx3hMvUqAQAAAA8"]
[Tue Nov 18 17:15:25.723492 2025] [:error] [pid 44471:tid 44521] [client 41.65.122.34:50539] [client 41.65.122.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.65.122.34, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRw5Le_6m0bQO14XwtM8fQAAARE"]
[Tue Nov 18 17:15:25.737017 2025] [proxy_fcgi:error] [pid 44471:tid 44521] [client 41.65.122.34:50539] AH01071: Got error 'Primary script unknown'
[Tue Nov 18 17:56:42.696152 2025] [autoindex:error] [pid 44471:tid 44525] [client 84.247.191.22:64788] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 18 21:37:31.305167 2025] [:error] [pid 3500:tid 3521] [client 45.134.79.103:53027] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRx2m_CbRC7k2D7mjbSTvgAAAdM"]
[Tue Nov 18 21:37:31.952153 2025] [:error] [pid 44472:tid 44536] [client 45.134.79.103:62650] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRx2m4KhGwkiLjv8BQwfAAAAAUU"]
[Tue Nov 18 21:37:32.622216 2025] [:error] [pid 1387:tid 1393] [client 45.134.79.103:54766] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nEzBvalKyx3hMvWexQAAAAQ"]
[Tue Nov 18 21:48:33.723220 2025] [:error] [pid 3500:tid 3505] [client 43.166.244.251:46052] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRx5MfCbRC7k2D7mjbSZjAAAAcM"]
[Tue Nov 18 22:17:49.763524 2025] [:error] [pid 3500:tid 3510] [client 117.33.163.216:48676] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aRyADfCbRC7k2D7mjbSqzgAAAcg"]
[Wed Nov 19 02:50:10.324986 2025] [:error] [pid 44063:tid 44141] [client 43.157.95.131:54624] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aRy_4kVOSC7H33BBqQ0WMwAAAJg"]
[Wed Nov 19 04:54:55.444331 2025] [proxy_fcgi:error] [pid 6556:tid 6618] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Wed Nov 19 04:54:55.642685 2025] [proxy_fcgi:error] [pid 6556:tid 6629] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Wed Nov 19 04:54:55.815859 2025] [proxy_fcgi:error] [pid 6556:tid 6623] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Wed Nov 19 04:54:55.998607 2025] [proxy_fcgi:error] [pid 6556:tid 6640] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Wed Nov 19 04:54:56.207447 2025] [proxy_fcgi:error] [pid 6556:tid 6636] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:54:57.912264 2025] [proxy_fcgi:error] [pid 6556:tid 6625] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:54:58.075790 2025] [proxy_fcgi:error] [pid 6556:tid 6626] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Wed Nov 19 04:54:58.260411 2025] [:error] [pid 6556:tid 6633] [client 20.25.163.76:58813] [client 20.25.163.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.25.163.76, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aRzdIpuL7hhgrmdM1ms_NAAAAI8"], referer: https://www.bing.com/
[Wed Nov 19 04:54:58.265916 2025] [proxy_fcgi:error] [pid 6556:tid 6633] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:54:58.626476 2025] [proxy_fcgi:error] [pid 6556:tid 6639] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Wed Nov 19 04:54:58.788846 2025] [proxy_fcgi:error] [pid 6556:tid 6630] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:54:59.147233 2025] [proxy_fcgi:error] [pid 6556:tid 6618] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:54:59.313753 2025] [proxy_fcgi:error] [pid 6556:tid 6629] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:54:59.528434 2025] [proxy_fcgi:error] [pid 6556:tid 6623] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Wed Nov 19 04:54:59.690817 2025] [proxy_fcgi:error] [pid 6556:tid 6640] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:54:59.869013 2025] [proxy_fcgi:error] [pid 6556:tid 6634] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:55:00.035805 2025] [proxy_fcgi:error] [pid 6556:tid 6624] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Wed Nov 19 04:55:00.200512 2025] [proxy_fcgi:error] [pid 6556:tid 6628] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:55:00.381776 2025] [proxy_fcgi:error] [pid 6556:tid 6642] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Wed Nov 19 04:55:00.545649 2025] [proxy_fcgi:error] [pid 6556:tid 6641] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:55:00.719692 2025] [proxy_fcgi:error] [pid 6556:tid 6636] [client 20.25.163.76:58813] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Wed Nov 19 04:55:00.877793 2025] [:error] [pid 6556:tid 6637] [client 20.25.163.76:58813] [client 20.25.163.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "aRzdJJuL7hhgrmdM1ms_RAAAAJM"], referer: https://www.bing.com/
[Wed Nov 19 04:55:06.007635 2025] [proxy_fcgi:error] [pid 6555:tid 6601] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Wed Nov 19 04:55:07.498864 2025] [proxy_fcgi:error] [pid 6555:tid 6600] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:55:07.661099 2025] [proxy_fcgi:error] [pid 6555:tid 6604] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Wed Nov 19 04:55:08.033403 2025] [proxy_fcgi:error] [pid 6555:tid 6606] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Wed Nov 19 04:55:08.194251 2025] [proxy_fcgi:error] [pid 6555:tid 6610] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Wed Nov 19 04:55:08.416742 2025] [proxy_fcgi:error] [pid 6555:tid 6594] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:55:08.586176 2025] [proxy_fcgi:error] [pid 6555:tid 6592] [client 20.25.163.76:58775] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:55:09.272867 2025] [:error] [pid 6555:tid 6599] [client 20.25.163.76:58775] [client 20.25.163.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aRzdLUbVJm8eMsGMTCNUJgAAAEg"], referer: https://www.bing.com/
[Wed Nov 19 04:55:10.665050 2025] [proxy_fcgi:error] [pid 6919:tid 6937] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:55:11.378406 2025] [proxy_fcgi:error] [pid 6919:tid 6936] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:55:13.313702 2025] [proxy_fcgi:error] [pid 6919:tid 6928] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Wed Nov 19 04:55:13.477093 2025] [proxy_fcgi:error] [pid 6919:tid 6930] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Wed Nov 19 04:55:13.640171 2025] [proxy_fcgi:error] [pid 6919:tid 6937] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Wed Nov 19 04:55:14.508654 2025] [proxy_fcgi:error] [pid 6919:tid 6942] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:55:14.675921 2025] [proxy_fcgi:error] [pid 6919:tid 6936] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Wed Nov 19 04:55:17.833514 2025] [proxy_fcgi:error] [pid 6919:tid 6942] [client 20.25.163.76:58797] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Wed Nov 19 04:55:18.530985 2025] [:error] [pid 6919:tid 6926] [client 20.25.163.76:58797] [client 20.25.163.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRzdNkYFdN1s_9xJVUlXDgAAAQQ"], referer: https://duckduckgo.com/
[Wed Nov 19 06:09:11.241331 2025] [:error] [pid 6644:tid 6662] [client 216.24.219.16:34483] [client 216.24.219.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.16, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aRzuh00i6Rf788MB6sa2jgAAANA"]
[Wed Nov 19 06:09:11.255569 2025] [proxy_fcgi:error] [pid 6644:tid 6662] [client 216.24.219.16:34483] AH01071: Got error 'Primary script unknown'
[Wed Nov 19 07:30:38.918634 2025] [:error] [pid 6554:tid 6580] [client 18.191.165.250:56573] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR0Bnt8rvPWLafJFqmVW2gAAABQ"]
[Wed Nov 19 07:30:39.315599 2025] [:error] [pid 6554:tid 6570] [client 18.191.165.250:56710] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR0Bn98rvPWLafJFqmVW4gAAAAo"]
[Wed Nov 19 07:30:39.707268 2025] [:error] [pid 6919:tid 6940] [client 18.191.165.250:56786] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrPQAAARI"]
[Wed Nov 19 07:30:40.104645 2025] [:error] [pid 6555:tid 6615] [client 18.191.165.250:56869] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR0BoEbVJm8eMsGMTCON2AAAAFg"]
[Wed Nov 19 07:30:40.499657 2025] [:error] [pid 26664:tid 26668] [client 18.191.165.250:57002] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR0BoIpWc1yoj2P7MeASHgAAAUE"]
[Wed Nov 19 13:22:42.517731 2025] [:error] [pid 26664:tid 26675] [client 49.205.128.16:53821] [client 49.205.128.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.128.16, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aR1UIopWc1yoj2P7MeC62QAAAUg"]
[Wed Nov 19 13:22:42.532206 2025] [proxy_fcgi:error] [pid 26664:tid 26675] [client 49.205.128.16:53821] AH01071: Got error 'Primary script unknown'
[Wed Nov 19 14:40:47.934811 2025] [:error] [pid 6644:tid 6663] [client 85.8.130.63:35129] [client 85.8.130.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.63, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aR1mb00i6Rf788MB6sZlogAAANE"]
[Wed Nov 19 14:40:47.946082 2025] [proxy_fcgi:error] [pid 6644:tid 6663] [client 85.8.130.63:35129] AH01071: Got error 'Primary script unknown'
[Wed Nov 19 17:55:31.676610 2025] [:error] [pid 12673:tid 12725] [client 173.239.254.70:50721] [client 173.239.254.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.70, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aR2UE8ab1F0fb062dH1I7QAAAhU"]
[Wed Nov 19 17:55:31.688354 2025] [proxy_fcgi:error] [pid 12673:tid 12725] [client 173.239.254.70:50721] AH01071: Got error 'Primary script unknown'
[Wed Nov 19 18:25:52.327010 2025] [:error] [pid 6554:tid 6566] [client 41.248.195.37:49827] [client 41.248.195.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aR2bMN8rvPWLafJFqmXligAAAAc"]
[Wed Nov 19 20:35:58.003713 2025] [:error] [pid 6919:tid 6934] [client 104.196.176.201:58244] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "aR25rkYFdN1s_9xJVUmBiQAAAQw"]
[Thu Nov 20 01:58:42.079949 2025] [:error] [pid 50475:tid 50531] [client 62.228.36.250:59616] [client 62.228.36.250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aR4FUlzRy2BTBjqrUmkxJgAAAQk"]
[Thu Nov 20 01:58:43.329830 2025] [:error] [pid 45115:tid 45134] [client 62.228.36.250:47780] [client 62.228.36.250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aR4FUwGi_fIGlZjI1V5HBQAAANE"]
[Thu Nov 20 07:04:37.790903 2025] [:error] [pid 55343:tid 55412] [client 171.250.163.114:30448] [client 171.250.163.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.163.114, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aR5NBVWlO3EnyVMV7w4LiwAAAI0"]
[Thu Nov 20 07:04:37.802465 2025] [proxy_fcgi:error] [pid 55343:tid 55412] [client 171.250.163.114:30448] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 10:11:17.735303 2025] [:error] [pid 55430:tid 55449] [client 43.167.157.80:50822] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aR54xfPZXaIMEU4pE7uCaAAAANA"]
[Thu Nov 20 10:38:58.157736 2025] [:error] [pid 34444:tid 34456] [client 45.64.163.155:35296] [client 45.64.163.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.64.163.155, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aR5_QlNEol4jlmmA_GPeLAAAAUo"]
[Thu Nov 20 10:38:58.170059 2025] [proxy_fcgi:error] [pid 34444:tid 34456] [client 45.64.163.155:35296] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 10:38:58.700519 2025] [proxy_fcgi:error] [pid 34405:tid 34426] [client 45.64.163.155:43254] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 10:40:00.766903 2025] [proxy_fcgi:error] [pid 34444:tid 34448] [client 193.189.100.206:49636] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 12:10:22.464743 2025] [:error] [pid 55430:tid 55433] [client 98.81.111.26:55104] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6UrvPZXaIMEU4pE7ugwQAAAMA"]
[Thu Nov 20 12:10:22.871069 2025] [:error] [pid 34405:tid 34416] [client 98.81.111.26:50369] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6UrjFpvu8oRK7ATfvJSgAAAQk"]
[Thu Nov 20 12:10:23.279398 2025] [:error] [pid 55342:tid 55395] [client 98.81.111.26:58643] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6Ur7g6x32Tvk7fIG-MFQAAAFc"]
[Thu Nov 20 12:10:23.710183 2025] [:error] [pid 34405:tid 34430] [client 98.81.111.26:51415] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJbQAAARc"]
[Thu Nov 20 12:10:24.119921 2025] [:error] [pid 55430:tid 55447] [client 98.81.111.26:63066] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6UsPPZXaIMEU4pE7uhOgAAAM4"]
[Thu Nov 20 12:15:52.456522 2025] [:error] [pid 34405:tid 34420] [client 98.81.111.26:62374] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6V-DFpvu8oRK7ATfvNIQAAAQ0"]
[Thu Nov 20 12:15:52.866027 2025] [:error] [pid 34444:tid 34458] [client 98.81.111.26:64628] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6V-FNEol4jlmmA_GP0ngAAAUw"]
[Thu Nov 20 12:15:53.275913 2025] [:error] [pid 55342:tid 55374] [client 98.81.111.26:50321] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6V-bg6x32Tvk7fIG-PUgAAAEI"]
[Thu Nov 20 12:15:53.684641 2025] [:error] [pid 34405:tid 34424] [client 98.81.111.26:52433] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6V-TFpvu8oRK7ATfvNPwAAARE"]
[Thu Nov 20 12:15:54.099332 2025] [:error] [pid 34405:tid 34412] [client 98.81.111.26:54838] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR6V-jFpvu8oRK7ATfvNSgAAAQU"]
[Thu Nov 20 17:07:38.396650 2025] [proxy_fcgi:error] [pid 40537:tid 40551] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:38.514533 2025] [proxy_fcgi:error] [pid 40537:tid 40558] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:39.901115 2025] [proxy_fcgi:error] [pid 40537:tid 40545] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.020867 2025] [proxy_fcgi:error] [pid 40537:tid 40546] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.148650 2025] [proxy_fcgi:error] [pid 40537:tid 40544] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.266390 2025] [proxy_fcgi:error] [pid 40537:tid 40563] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.406252 2025] [proxy_fcgi:error] [pid 40537:tid 40564] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.525646 2025] [proxy_fcgi:error] [pid 40537:tid 40543] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.659229 2025] [proxy_fcgi:error] [pid 40537:tid 40565] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.778324 2025] [proxy_fcgi:error] [pid 40537:tid 40556] [client 20.27.30.201:35788] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:07:40.997418 2025] [:error] [pid 40537:tid 40548] [client 20.27.30.201:35788] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kki.php"] [unique_id "aR7aXKKlsL5kxTa3c1zQxwAAAsc"]
[Thu Nov 20 17:07:41.677418 2025] [:error] [pid 55343:tid 55415] [client 20.27.30.201:35729] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kki.php"] [unique_id "aR7aXVWlO3EnyVMV7w6gXgAAAJA"]
[Thu Nov 20 17:07:42.557365 2025] [:error] [pid 55430:tid 55448] [client 20.27.30.201:35799] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kki.php"] [unique_id "aR7aXvPZXaIMEU4pE7vtoQAAAM8"]
[Thu Nov 20 17:07:43.077581 2025] [:error] [pid 40415:tid 40433] [client 20.27.30.201:35793] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kki.php"] [unique_id "aR7aX6hjIyLSv09svwOQIwAAAc8"]
[Thu Nov 20 17:07:43.610869 2025] [:error] [pid 40636:tid 40650] [client 20.27.30.201:35837] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js.php"] [unique_id "aR7aXwK8BWUoW3xq0HD7oQAAA4o"]
[Thu Nov 20 17:07:44.271569 2025] [:error] [pid 55343:tid 55404] [client 20.27.30.201:35832] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js.php"] [unique_id "aR7aYFWlO3EnyVMV7w6gYQAAAIU"]
[Thu Nov 20 17:07:45.179146 2025] [:error] [pid 40508:tid 40524] [client 20.27.30.201:35727] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js.php"] [unique_id "aR7aYaxXNVCMW_ksxPuDwgAAAo4"]
[Thu Nov 20 17:07:45.908816 2025] [:error] [pid 55430:tid 55440] [client 20.27.30.201:35723] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js.php"] [unique_id "aR7aYfPZXaIMEU4pE7vtogAAAMc"]
[Thu Nov 20 17:07:47.198532 2025] [:error] [pid 55430:tid 55449] [client 20.27.30.201:35714] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "aR7aY_PZXaIMEU4pE7vtowAAANA"]
[Thu Nov 20 17:07:48.646332 2025] [:error] [pid 40537:tid 40553] [client 20.27.30.201:35800] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "aR7aZKKlsL5kxTa3c1zQzQAAAsw"]
[Thu Nov 20 17:07:49.365252 2025] [:error] [pid 55430:tid 55433] [client 20.27.30.201:35782] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "aR7aZfPZXaIMEU4pE7vtpQAAAMA"]
[Thu Nov 20 17:07:50.042851 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35824] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "aR7aZrg6x32Tvk7fIG_H9wAAAFg"]
[Thu Nov 20 17:07:50.528688 2025] [:error] [pid 34405:tid 34409] [client 20.27.30.201:35839] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wso.php"] [unique_id "aR7aZjFpvu8oRK7ATfsFjAAAAQI"]
[Thu Nov 20 17:07:51.189118 2025] [:error] [pid 55343:tid 55406] [client 20.27.30.201:35715] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wso.php"] [unique_id "aR7aZ1WlO3EnyVMV7w6gYwAAAIc"]
[Thu Nov 20 17:07:52.463387 2025] [:error] [pid 55342:tid 55382] [client 20.27.30.201:35796] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wso.php"] [unique_id "aR7aaLg6x32Tvk7fIG_H-QAAAEo"]
[Thu Nov 20 17:07:52.908754 2025] [:error] [pid 40508:tid 40534] [client 20.27.30.201:35778] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wso.php"] [unique_id "aR7aaKxXNVCMW_ksxPuDzAAAApg"]
[Thu Nov 20 17:07:53.956140 2025] [:error] [pid 55342:tid 55388] [client 20.27.30.201:35804] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aR7aabg6x32Tvk7fIG_H-wAAAFA"]
[Thu Nov 20 17:07:54.925035 2025] [:error] [pid 34405:tid 34431] [client 20.27.30.201:35728] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aR7aajFpvu8oRK7ATfsFjgAAARg"]
[Thu Nov 20 17:07:55.843170 2025] [:error] [pid 55342:tid 55375] [client 20.27.30.201:35672] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aR7aa7g6x32Tvk7fIG_H_QAAAEM"]
[Thu Nov 20 17:07:57.864698 2025] [:error] [pid 40445:tid 40489] [client 20.27.30.201:35833] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aR7abVH-MuFcoWRjXpY7kwAAAk4"]
[Thu Nov 20 17:07:58.369495 2025] [:error] [pid 55342:tid 55394] [client 20.27.30.201:35820] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mans.php"] [unique_id "aR7abrg6x32Tvk7fIG_H_gAAAFY"]
[Thu Nov 20 17:07:59.371275 2025] [:error] [pid 40508:tid 40521] [client 20.27.30.201:35812] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mans.php"] [unique_id "aR7ab6xXNVCMW_ksxPuDzgAAAos"]
[Thu Nov 20 17:08:01.286392 2025] [:error] [pid 55342:tid 55390] [client 20.27.30.201:35805] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mans.php"] [unique_id "aR7acbg6x32Tvk7fIG_H_wAAAFI"]
[Thu Nov 20 17:08:01.908696 2025] [:error] [pid 55340:tid 55363] [client 20.27.30.201:35761] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mans.php"] [unique_id "aR7acfOxD-NeMydTybCK6QAAABI"]
[Thu Nov 20 17:08:02.849129 2025] [:error] [pid 55340:tid 55350] [client 20.27.30.201:35777] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aR7acvOxD-NeMydTybCK7AAAAAU"]
[Thu Nov 20 17:08:03.986720 2025] [:error] [pid 55342:tid 55376] [client 20.27.30.201:35798] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aR7ac7g6x32Tvk7fIG_IAAAAAEQ"]
[Thu Nov 20 17:08:05.735541 2025] [:error] [pid 55342:tid 55377] [client 20.27.30.201:35783] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aR7adbg6x32Tvk7fIG_IAQAAAEU"]
[Thu Nov 20 17:08:08.221961 2025] [:error] [pid 55342:tid 55389] [client 20.27.30.201:35779] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aR7aeLg6x32Tvk7fIG_IAwAAAFE"]
[Thu Nov 20 17:08:08.607961 2025] [:error] [pid 40537:tid 40563] [client 20.27.30.201:35809] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aR7aeKKlsL5kxTa3c1zQ0wAAAtY"]
[Thu Nov 20 17:08:09.516019 2025] [:error] [pid 40445:tid 40487] [client 20.27.30.201:35650] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aR7aeVH-MuFcoWRjXpY7lgAAAkw"]
[Thu Nov 20 17:08:10.558427 2025] [:error] [pid 55343:tid 55418] [client 20.27.30.201:35795] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aR7aelWlO3EnyVMV7w6gagAAAJM"]
[Thu Nov 20 17:08:11.272742 2025] [:error] [pid 55343:tid 55400] [client 20.27.30.201:35752] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aR7ae1WlO3EnyVMV7w6gbAAAAIE"]
[Thu Nov 20 17:08:12.350405 2025] [:error] [pid 40636:tid 40641] [client 20.27.30.201:35822] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4yps5d.php"] [unique_id "aR7afAK8BWUoW3xq0HD7rwAAA4E"]
[Thu Nov 20 17:08:12.880391 2025] [:error] [pid 40636:tid 40664] [client 20.27.30.201:35713] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4yps5d.php"] [unique_id "aR7afAK8BWUoW3xq0HD7sAAAA5g"]
[Thu Nov 20 17:08:13.376751 2025] [:error] [pid 40508:tid 40516] [client 20.27.30.201:35764] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4yps5d.php"] [unique_id "aR7afaxXNVCMW_ksxPuD5QAAAoY"]
[Thu Nov 20 17:08:14.280481 2025] [:error] [pid 40445:tid 40498] [client 20.27.30.201:35838] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4yps5d.php"] [unique_id "aR7aflH-MuFcoWRjXpY7mwAAAlc"]
[Thu Nov 20 17:08:14.816870 2025] [:error] [pid 34405:tid 34427] [client 20.27.30.201:35654] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "aR7afjFpvu8oRK7ATfsFnAAAARQ"]
[Thu Nov 20 17:08:15.345304 2025] [:error] [pid 40445:tid 40485] [client 20.27.30.201:35829] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "aR7af1H-MuFcoWRjXpY7nQAAAko"]
[Thu Nov 20 17:08:15.860001 2025] [:error] [pid 55340:tid 55357] [client 20.27.30.201:35717] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "aR7af_OxD-NeMydTybCK8AAAAAw"]
[Thu Nov 20 17:08:16.583479 2025] [:error] [pid 55340:tid 55348] [client 20.27.30.201:35719] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "aR7agPOxD-NeMydTybCK8gAAAAM"]
[Thu Nov 20 17:08:18.515704 2025] [:error] [pid 40415:tid 40425] [client 20.27.30.201:35731] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "aR7agqhjIyLSv09svwOQRAAAAcc"]
[Thu Nov 20 17:08:19.812391 2025] [:error] [pid 40636:tid 40640] [client 20.27.30.201:35721] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "aR7agwK8BWUoW3xq0HD7tAAAA4A"]
[Thu Nov 20 17:08:20.505857 2025] [:error] [pid 40636:tid 40659] [client 20.27.30.201:35718] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "aR7ahAK8BWUoW3xq0HD7tQAAA5M"]
[Thu Nov 20 17:08:21.369504 2025] [:error] [pid 55342:tid 55381] [client 20.27.30.201:35763] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "aR7ahbg6x32Tvk7fIG_IBgAAAEk"]
[Thu Nov 20 17:08:21.948318 2025] [:error] [pid 40636:tid 40649] [client 20.27.30.201:35794] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/habhan.php"] [unique_id "aR7ahQK8BWUoW3xq0HD7tgAAA4k"]
[Thu Nov 20 17:08:23.136279 2025] [:error] [pid 40508:tid 40526] [client 20.27.30.201:35742] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/habhan.php"] [unique_id "aR7ah6xXNVCMW_ksxPuD6wAAApA"]
[Thu Nov 20 17:08:24.544278 2025] [:error] [pid 40508:tid 40531] [client 20.27.30.201:35807] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/habhan.php"] [unique_id "aR7aiKxXNVCMW_ksxPuD7wAAApU"]
[Thu Nov 20 17:08:25.398135 2025] [:error] [pid 55343:tid 55401] [client 20.27.30.201:35802] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/habhan.php"] [unique_id "aR7aiVWlO3EnyVMV7w6gcgAAAII"]
[Thu Nov 20 17:08:26.424229 2025] [:error] [pid 55340:tid 55363] [client 20.27.30.201:35768] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "aR7aivOxD-NeMydTybCK-QAAABI"]
[Thu Nov 20 17:08:27.020852 2025] [:error] [pid 40636:tid 40642] [client 20.27.30.201:35815] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "aR7aiwK8BWUoW3xq0HD7twAAA4I"]
[Thu Nov 20 17:08:27.559899 2025] [:error] [pid 40508:tid 40516] [client 20.27.30.201:35780] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "aR7ai6xXNVCMW_ksxPuEBAAAAoY"]
[Thu Nov 20 17:08:28.342771 2025] [:error] [pid 55340:tid 55345] [client 20.27.30.201:35808] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "aR7ajPOxD-NeMydTybCK_wAAAAA"]
[Thu Nov 20 17:08:29.023795 2025] [:error] [pid 40508:tid 40520] [client 20.27.30.201:35825] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bi1f.php"] [unique_id "aR7ajaxXNVCMW_ksxPuEEAAAAoo"]
[Thu Nov 20 17:08:29.451088 2025] [:error] [pid 40445:tid 40476] [client 20.27.30.201:35830] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bi1f.php"] [unique_id "aR7ajVH-MuFcoWRjXpY7pQAAAkE"]
[Thu Nov 20 17:08:30.325529 2025] [:error] [pid 40508:tid 40523] [client 20.27.30.201:35773] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bi1f.php"] [unique_id "aR7ajqxXNVCMW_ksxPuEFgAAAo0"]
[Thu Nov 20 17:08:30.831195 2025] [:error] [pid 40445:tid 40488] [client 20.27.30.201:35821] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bi1f.php"] [unique_id "aR7ajlH-MuFcoWRjXpY7qwAAAk0"]
[Thu Nov 20 17:08:31.242481 2025] [:error] [pid 55340:tid 55369] [client 20.27.30.201:35835] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aR7aj_OxD-NeMydTybCLAgAAABg"]
[Thu Nov 20 17:08:33.535457 2025] [:error] [pid 55342:tid 55389] [client 20.27.30.201:35826] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aR7akbg6x32Tvk7fIG_IEwAAAFE"]
[Thu Nov 20 17:08:34.802823 2025] [:error] [pid 40445:tid 40477] [client 20.27.30.201:35730] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aR7aklH-MuFcoWRjXpY7rgAAAkI"]
[Thu Nov 20 17:08:35.311325 2025] [:error] [pid 34405:tid 34417] [client 20.27.30.201:35726] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aR7akzFpvu8oRK7ATfsFsgAAAQo"]
[Thu Nov 20 17:08:35.718597 2025] [:error] [pid 40445:tid 40497] [client 20.27.30.201:35722] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/luxe.php"] [unique_id "aR7ak1H-MuFcoWRjXpY7sQAAAlY"]
[Thu Nov 20 17:08:36.741183 2025] [:error] [pid 40508:tid 40530] [client 20.27.30.201:35769] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/luxe.php"] [unique_id "aR7alKxXNVCMW_ksxPuEMwAAApQ"]
[Thu Nov 20 17:08:37.206005 2025] [:error] [pid 40445:tid 40493] [client 20.27.30.201:35801] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/luxe.php"] [unique_id "aR7alVH-MuFcoWRjXpY7swAAAlI"]
[Thu Nov 20 17:08:37.632523 2025] [:error] [pid 55340:tid 55366] [client 20.27.30.201:35660] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/luxe.php"] [unique_id "aR7alfOxD-NeMydTybCLAwAAABU"]
[Thu Nov 20 17:08:38.534193 2025] [:error] [pid 40445:tid 40489] [client 20.27.30.201:35810] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aR7allH-MuFcoWRjXpY7tAAAAk4"]
[Thu Nov 20 17:08:39.078456 2025] [:error] [pid 34405:tid 34426] [client 20.27.30.201:35657] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aR7alzFpvu8oRK7ATfsFtAAAARM"]
[Thu Nov 20 17:08:39.528486 2025] [:error] [pid 34405:tid 34409] [client 20.27.30.201:35720] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aR7alzFpvu8oRK7ATfsFtwAAAQI"]
[Thu Nov 20 17:08:40.892019 2025] [proxy_fcgi:error] [pid 55430:tid 55434] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.016958 2025] [proxy_fcgi:error] [pid 55430:tid 55452] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.137370 2025] [proxy_fcgi:error] [pid 55430:tid 55441] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.280940 2025] [proxy_fcgi:error] [pid 55430:tid 55455] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.638821 2025] [proxy_fcgi:error] [pid 55430:tid 55446] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.765483 2025] [proxy_fcgi:error] [pid 55430:tid 55454] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:41.890806 2025] [proxy_fcgi:error] [pid 55430:tid 55445] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:42.007122 2025] [proxy_fcgi:error] [pid 55430:tid 55440] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:42.130486 2025] [proxy_fcgi:error] [pid 55430:tid 55438] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:42.249745 2025] [proxy_fcgi:error] [pid 55430:tid 55435] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:42.517996 2025] [proxy_fcgi:error] [pid 55430:tid 55449] [client 20.27.30.201:35656] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:08:42.632792 2025] [:error] [pid 55430:tid 55451] [client 20.27.30.201:35656] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "aR7amvPZXaIMEU4pE7vt5gAAANI"]
[Thu Nov 20 17:08:43.161076 2025] [:error] [pid 34405:tid 34428] [client 20.27.30.201:35664] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "aR7amzFpvu8oRK7ATfsFuAAAARU"]
[Thu Nov 20 17:08:44.284451 2025] [:error] [pid 55340:tid 55356] [client 20.27.30.201:35716] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "aR7anPOxD-NeMydTybCLBwAAAAs"]
[Thu Nov 20 17:08:45.375321 2025] [:error] [pid 55430:tid 55443] [client 20.27.30.201:35818] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "aR7anfPZXaIMEU4pE7vt6AAAAMo"]
[Thu Nov 20 17:08:46.407801 2025] [:error] [pid 40537:tid 40557] [client 20.27.30.201:35690] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aR7anqKlsL5kxTa3c1zQ2AAAAtA"]
[Thu Nov 20 17:08:46.905285 2025] [:error] [pid 34405:tid 34425] [client 20.27.30.201:35831] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aR7anjFpvu8oRK7ATfsFwQAAARI"]
[Thu Nov 20 17:08:47.440821 2025] [:error] [pid 40415:tid 40430] [client 20.27.30.201:35762] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aR7an6hjIyLSv09svwOQXwAAAcw"]
[Thu Nov 20 17:08:48.040139 2025] [:error] [pid 34405:tid 34416] [client 20.27.30.201:35598] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aR7aoDFpvu8oRK7ATfsFxAAAAQk"]
[Thu Nov 20 17:08:48.497169 2025] [:error] [pid 55343:tid 55407] [client 20.27.30.201:35667] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "aR7aoFWlO3EnyVMV7w6ggwAAAIg"]
[Thu Nov 20 17:08:49.176492 2025] [:error] [pid 55343:tid 55403] [client 20.27.30.201:35658] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "aR7aoVWlO3EnyVMV7w6ghQAAAIQ"]
[Thu Nov 20 17:08:49.741957 2025] [:error] [pid 40508:tid 40527] [client 20.27.30.201:35755] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "aR7aoaxXNVCMW_ksxPuERgAAApE"]
[Thu Nov 20 17:08:50.420040 2025] [:error] [pid 40508:tid 40531] [client 20.27.30.201:35748] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "aR7aoqxXNVCMW_ksxPuESAAAApU"]
[Thu Nov 20 17:08:51.119154 2025] [:error] [pid 40508:tid 40512] [client 20.27.30.201:35803] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aR7ao6xXNVCMW_ksxPuESwAAAoI"]
[Thu Nov 20 17:08:51.672282 2025] [:error] [pid 40508:tid 40525] [client 20.27.30.201:35724] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aR7ao6xXNVCMW_ksxPuETQAAAo8"]
[Thu Nov 20 17:08:52.126233 2025] [:error] [pid 55430:tid 55452] [client 20.27.30.201:35775] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aR7apPPZXaIMEU4pE7vt8QAAANM"]
[Thu Nov 20 17:08:52.550938 2025] [:error] [pid 55342:tid 55395] [client 20.27.30.201:35673] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aR7apLg6x32Tvk7fIG_ILQAAAFc"]
[Thu Nov 20 17:08:53.384721 2025] [:error] [pid 40508:tid 40530] [client 20.27.30.201:35749] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gif.php"] [unique_id "aR7apaxXNVCMW_ksxPuEbAAAApQ"]
[Thu Nov 20 17:08:54.200762 2025] [:error] [pid 40445:tid 40497] [client 20.27.30.201:35706] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gif.php"] [unique_id "aR7aplH-MuFcoWRjXpY71AAAAlY"]
[Thu Nov 20 17:08:55.310648 2025] [:error] [pid 40445:tid 40482] [client 20.27.30.201:35814] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gif.php"] [unique_id "aR7ap1H-MuFcoWRjXpY74QAAAkc"]
[Thu Nov 20 17:08:55.756931 2025] [:error] [pid 55342:tid 55393] [client 20.27.30.201:35750] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gif.php"] [unique_id "aR7ap7g6x32Tvk7fIG_IMgAAAFU"]
[Thu Nov 20 17:08:56.893474 2025] [:error] [pid 55430:tid 55445] [client 20.27.30.201:35649] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aR7aqPPZXaIMEU4pE7vt9gAAAMw"]
[Thu Nov 20 17:08:57.967934 2025] [:error] [pid 40415:tid 40432] [client 20.27.30.201:35662] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aR7aqahjIyLSv09svwOQaAAAAc4"]
[Thu Nov 20 17:08:58.738215 2025] [:error] [pid 55340:tid 55363] [client 20.27.30.201:35679] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aR7aqvOxD-NeMydTybCLCwAAABI"]
[Thu Nov 20 17:08:59.480391 2025] [:error] [pid 55343:tid 55420] [client 20.27.30.201:35770] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aR7aq1WlO3EnyVMV7w6gnAAAAJU"]
[Thu Nov 20 17:09:00.024631 2025] [:error] [pid 55430:tid 55435] [client 20.27.30.201:35717] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rrr.php"] [unique_id "aR7arPPZXaIMEU4pE7vt-QAAAMI"]
[Thu Nov 20 17:09:01.624116 2025] [:error] [pid 40415:tid 40419] [client 20.27.30.201:35751] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rrr.php"] [unique_id "aR7arahjIyLSv09svwOQawAAAcE"]
[Thu Nov 20 17:09:01.986966 2025] [:error] [pid 55340:tid 55367] [client 20.27.30.201:35736] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rrr.php"] [unique_id "aR7arfOxD-NeMydTybCLDAAAABY"]
[Thu Nov 20 17:09:02.598939 2025] [:error] [pid 55342:tid 55379] [client 20.27.30.201:35705] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rrr.php"] [unique_id "aR7arrg6x32Tvk7fIG_INAAAAEc"]
[Thu Nov 20 17:09:04.055642 2025] [:error] [pid 40415:tid 40420] [client 20.27.30.201:35771] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tj.php"] [unique_id "aR7asKhjIyLSv09svwOQbQAAAcI"]
[Thu Nov 20 17:09:04.598460 2025] [:error] [pid 55343:tid 55419] [client 20.27.30.201:35741] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tj.php"] [unique_id "aR7asFWlO3EnyVMV7w6gnwAAAJQ"]
[Thu Nov 20 17:09:05.172509 2025] [:error] [pid 40415:tid 40425] [client 20.27.30.201:35757] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tj.php"] [unique_id "aR7asahjIyLSv09svwOQbwAAAcc"]
[Thu Nov 20 17:09:06.253424 2025] [:error] [pid 40415:tid 40426] [client 20.27.30.201:35781] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tj.php"] [unique_id "aR7asqhjIyLSv09svwOQcQAAAcg"]
[Thu Nov 20 17:09:06.744079 2025] [:error] [pid 40415:tid 40440] [client 20.27.30.201:35797] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vansec.php"] [unique_id "aR7asqhjIyLSv09svwOQcgAAAdY"]
[Thu Nov 20 17:09:07.344169 2025] [:error] [pid 55430:tid 55433] [client 20.27.30.201:35687] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vansec.php"] [unique_id "aR7as_PZXaIMEU4pE7vt_AAAAMA"]
[Thu Nov 20 17:09:07.927186 2025] [:error] [pid 40445:tid 40483] [client 20.27.30.201:35733] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vansec.php"] [unique_id "aR7as1H-MuFcoWRjXpY75QAAAkg"]
[Thu Nov 20 17:09:08.478041 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35813] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vansec.php"] [unique_id "aR7atFH-MuFcoWRjXpY75gAAAkQ"]
[Thu Nov 20 17:09:08.886886 2025] [:error] [pid 40508:tid 40512] [client 20.27.30.201:35791] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "aR7atKxXNVCMW_ksxPuEeQAAAoI"]
[Thu Nov 20 17:09:09.738506 2025] [:error] [pid 40537:tid 40545] [client 20.27.30.201:35760] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "aR7ataKlsL5kxTa3c1zQ6wAAAsQ"]
[Thu Nov 20 17:09:10.519215 2025] [:error] [pid 55342:tid 55387] [client 20.27.30.201:35806] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "aR7atrg6x32Tvk7fIG_INwAAAE8"]
[Thu Nov 20 17:09:11.414057 2025] [:error] [pid 55430:tid 55456] [client 20.27.30.201:35737] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "aR7at_PZXaIMEU4pE7vt_QAAANc"]
[Thu Nov 20 17:09:12.348492 2025] [:error] [pid 55342:tid 55385] [client 20.27.30.201:35732] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aR7auLg6x32Tvk7fIG_IOAAAAE0"]
[Thu Nov 20 17:09:13.092013 2025] [:error] [pid 55340:tid 55355] [client 20.27.30.201:35596] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aR7aufOxD-NeMydTybCLDwAAAAo"]
[Thu Nov 20 17:09:13.875712 2025] [:error] [pid 55340:tid 55357] [client 20.27.30.201:35834] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aR7aufOxD-NeMydTybCLEAAAAAw"]
[Thu Nov 20 17:09:14.229205 2025] [:error] [pid 40508:tid 40534] [client 20.27.30.201:35677] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aR7auqxXNVCMW_ksxPuEiAAAApg"]
[Thu Nov 20 17:09:16.063121 2025] [:error] [pid 55342:tid 55386] [client 20.27.30.201:35734] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-is.php"] [unique_id "aR7avLg6x32Tvk7fIG_IOQAAAE4"]
[Thu Nov 20 17:09:17.120486 2025] [:error] [pid 40445:tid 40490] [client 20.27.30.201:35683] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-is.php"] [unique_id "aR7avVH-MuFcoWRjXpY79AAAAk8"]
[Thu Nov 20 17:09:18.440533 2025] [:error] [pid 55430:tid 55450] [client 20.27.30.201:35743] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-is.php"] [unique_id "aR7avvPZXaIMEU4pE7vt_wAAANE"]
[Thu Nov 20 17:09:18.959429 2025] [:error] [pid 55340:tid 55358] [client 20.27.30.201:35787] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-is.php"] [unique_id "aR7avvOxD-NeMydTybCLIwAAAA0"]
[Thu Nov 20 17:09:19.372349 2025] [:error] [pid 40636:tid 40658] [client 20.27.30.201:35692] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jmfi2.php"] [unique_id "aR7avwK8BWUoW3xq0HD8CgAAA5I"]
[Thu Nov 20 17:09:20.039272 2025] [:error] [pid 55430:tid 55434] [client 20.27.30.201:35792] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jmfi2.php"] [unique_id "aR7awPPZXaIMEU4pE7vuAgAAAME"]
[Thu Nov 20 17:09:20.579484 2025] [:error] [pid 55343:tid 55418] [client 20.27.30.201:35767] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jmfi2.php"] [unique_id "aR7awFWlO3EnyVMV7w6gqQAAAJM"]
[Thu Nov 20 17:09:21.599282 2025] [:error] [pid 40415:tid 40435] [client 20.27.30.201:35685] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jmfi2.php"] [unique_id "aR7awahjIyLSv09svwOQjQAAAdE"]
[Thu Nov 20 17:09:22.481114 2025] [:error] [pid 40415:tid 40427] [client 20.27.30.201:35759] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scx.php7"] [unique_id "aR7awqhjIyLSv09svwOQkAAAAck"]
[Thu Nov 20 17:09:23.147801 2025] [:error] [pid 55342:tid 55374] [client 20.27.30.201:35754] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scx.php7"] [unique_id "aR7aw7g6x32Tvk7fIG_IVQAAAEI"]
[Thu Nov 20 17:09:23.667804 2025] [:error] [pid 40636:tid 40644] [client 20.27.30.201:35689] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scx.php7"] [unique_id "aR7awwK8BWUoW3xq0HD8EwAAA4Q"]
[Thu Nov 20 17:09:24.984309 2025] [:error] [pid 40537:tid 40549] [client 20.27.30.201:35823] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scx.php7"] [unique_id "aR7axKKlsL5kxTa3c1zQ8QAAAsg"]
[Thu Nov 20 17:09:25.426889 2025] [:error] [pid 55430:tid 55435] [client 20.27.30.201:35665] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/777.php"] [unique_id "aR7axfPZXaIMEU4pE7vuBwAAAMI"]
[Thu Nov 20 17:09:26.169870 2025] [:error] [pid 40508:tid 40515] [client 20.27.30.201:35595] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/777.php"] [unique_id "aR7axqxXNVCMW_ksxPuErAAAAoU"]
[Thu Nov 20 17:09:27.209017 2025] [:error] [pid 55343:tid 55404] [client 20.27.30.201:35772] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/777.php"] [unique_id "aR7ax1WlO3EnyVMV7w6grgAAAIU"]
[Thu Nov 20 17:09:27.994171 2025] [:error] [pid 55340:tid 55353] [client 20.27.30.201:35648] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/777.php"] [unique_id "aR7ax_OxD-NeMydTybCLKgAAAAg"]
[Thu Nov 20 17:09:29.418429 2025] [:error] [pid 34405:tid 34414] [client 20.27.30.201:35758] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aR7ayTFpvu8oRK7ATfsGCQAAAQc"]
[Thu Nov 20 17:09:30.300296 2025] [:error] [pid 40445:tid 40488] [client 20.27.30.201:35586] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aR7aylH-MuFcoWRjXpY7_gAAAk0"]
[Thu Nov 20 17:09:30.943114 2025] [:error] [pid 40636:tid 40649] [client 20.27.30.201:35601] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aR7aygK8BWUoW3xq0HD8FgAAA4k"]
[Thu Nov 20 17:09:31.535043 2025] [:error] [pid 55342:tid 55373] [client 20.27.30.201:35651] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aR7ay7g6x32Tvk7fIG_IXwAAAEE"]
[Thu Nov 20 17:09:32.477887 2025] [:error] [pid 40636:tid 40647] [client 20.27.30.201:35765] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aR7azAK8BWUoW3xq0HD8GAAAA4c"]
[Thu Nov 20 17:09:33.416466 2025] [:error] [pid 40508:tid 40513] [client 20.27.30.201:35699] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aR7azaxXNVCMW_ksxPuEtAAAAoM"]
[Thu Nov 20 17:09:34.655292 2025] [:error] [pid 55430:tid 55453] [client 20.27.30.201:35678] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aR7azvPZXaIMEU4pE7vuDwAAANQ"]
[Thu Nov 20 17:09:35.633746 2025] [:error] [pid 55430:tid 55434] [client 20.27.30.201:35693] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aR7az_PZXaIMEU4pE7vuEQAAAME"]
[Thu Nov 20 17:09:36.719488 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35747] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aR7a0Lg6x32Tvk7fIG_IYAAAAFg"]
[Thu Nov 20 17:09:37.268853 2025] [:error] [pid 40445:tid 40498] [client 20.27.30.201:35669] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aR7a0VH-MuFcoWRjXpY8BgAAAlc"]
[Thu Nov 20 17:09:38.217844 2025] [:error] [pid 40445:tid 40495] [client 20.27.30.201:35836] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aR7a0lH-MuFcoWRjXpY8CAAAAlQ"]
[Thu Nov 20 17:09:39.140607 2025] [:error] [pid 34405:tid 34407] [client 20.27.30.201:35738] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aR7a0zFpvu8oRK7ATfsGLwAAAQA"]
[Thu Nov 20 17:09:39.889302 2025] [:error] [pid 55430:tid 55446] [client 20.27.30.201:35703] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "aR7a0_PZXaIMEU4pE7vuEwAAAM0"]
[Thu Nov 20 17:09:40.462664 2025] [:error] [pid 40445:tid 40485] [client 20.27.30.201:35712] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "aR7a1FH-MuFcoWRjXpY8DQAAAko"]
[Thu Nov 20 17:09:41.090220 2025] [:error] [pid 55342:tid 55378] [client 20.27.30.201:35597] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "aR7a1bg6x32Tvk7fIG_IYQAAAEY"]
[Thu Nov 20 17:09:41.909887 2025] [:error] [pid 40508:tid 40522] [client 20.27.30.201:35670] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "aR7a1axXNVCMW_ksxPuEugAAAow"]
[Thu Nov 20 17:09:42.482343 2025] [proxy_fcgi:error] [pid 55343:tid 55405] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:42.601770 2025] [proxy_fcgi:error] [pid 55343:tid 55409] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:42.891989 2025] [proxy_fcgi:error] [pid 55343:tid 55410] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.059980 2025] [proxy_fcgi:error] [pid 55343:tid 55418] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.185659 2025] [proxy_fcgi:error] [pid 55343:tid 55407] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.310124 2025] [proxy_fcgi:error] [pid 55343:tid 55423] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.457799 2025] [proxy_fcgi:error] [pid 55343:tid 55415] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.581140 2025] [proxy_fcgi:error] [pid 55343:tid 55417] [client 20.27.30.201:35688] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:43.696502 2025] [:error] [pid 55343:tid 55414] [client 20.27.30.201:35688] [client 20.27.30.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aR7a11WlO3EnyVMV7w6guwAAAI8"]
[Thu Nov 20 17:09:44.747383 2025] [proxy_fcgi:error] [pid 40636:tid 40661] [client 20.27.30.201:35680] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:44.865565 2025] [proxy_fcgi:error] [pid 40636:tid 40646] [client 20.27.30.201:35680] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:44.993088 2025] [proxy_fcgi:error] [pid 40636:tid 40650] [client 20.27.30.201:35680] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:09:45.107624 2025] [:error] [pid 40636:tid 40648] [client 20.27.30.201:35680] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmpls.php"] [unique_id "aR7a2QK8BWUoW3xq0HD8HwAAA4g"]
[Thu Nov 20 17:09:46.108784 2025] [:error] [pid 55343:tid 55404] [client 20.27.30.201:35585] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmpls.php"] [unique_id "aR7a2lWlO3EnyVMV7w6gvgAAAIU"]
[Thu Nov 20 17:09:47.472851 2025] [:error] [pid 40508:tid 40514] [client 20.27.30.201:35608] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmpls.php"] [unique_id "aR7a26xXNVCMW_ksxPuEwwAAAoQ"]
[Thu Nov 20 17:09:48.354376 2025] [:error] [pid 55340:tid 55369] [client 20.27.30.201:35584] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmpls.php"] [unique_id "aR7a3POxD-NeMydTybCLPQAAABg"]
[Thu Nov 20 17:09:49.178392 2025] [:error] [pid 40537:tid 40559] [client 20.27.30.201:35587] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aR7a3aKlsL5kxTa3c1zQ-wAAAtI"]
[Thu Nov 20 17:09:50.060039 2025] [:error] [pid 55342:tid 55384] [client 20.27.30.201:35697] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aR7a3rg6x32Tvk7fIG_IZwAAAEw"]
[Thu Nov 20 17:09:50.924814 2025] [:error] [pid 55340:tid 55365] [client 20.27.30.201:35535] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aR7a3vOxD-NeMydTybCLQAAAABQ"]
[Thu Nov 20 17:09:52.247033 2025] [:error] [pid 40636:tid 40640] [client 20.27.30.201:35746] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aR7a4AK8BWUoW3xq0HD8IgAAA4A"]
[Thu Nov 20 17:09:53.071910 2025] [:error] [pid 40445:tid 40499] [client 20.27.30.201:35828] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ae.php"] [unique_id "aR7a4VH-MuFcoWRjXpY8HQAAAlg"]
[Thu Nov 20 17:09:53.692283 2025] [:error] [pid 55430:tid 55442] [client 20.27.30.201:35674] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ae.php"] [unique_id "aR7a4fPZXaIMEU4pE7vuIQAAAMk"]
[Thu Nov 20 17:09:55.958817 2025] [:error] [pid 55342:tid 55387] [client 20.27.30.201:35766] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ae.php"] [unique_id "aR7a47g6x32Tvk7fIG_IcAAAAE8"]
[Thu Nov 20 17:09:56.505597 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35691] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ae.php"] [unique_id "aR7a5FH-MuFcoWRjXpY8JgAAAkQ"]
[Thu Nov 20 17:09:57.034670 2025] [:error] [pid 55343:tid 55420] [client 20.27.30.201:35789] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/smpx.php"] [unique_id "aR7a5VWlO3EnyVMV7w6gyQAAAJU"]
[Thu Nov 20 17:09:57.649623 2025] [:error] [pid 40537:tid 40557] [client 20.27.30.201:35603] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/smpx.php"] [unique_id "aR7a5aKlsL5kxTa3c1zRAAAAAtA"]
[Thu Nov 20 17:09:58.643988 2025] [:error] [pid 55340:tid 55349] [client 20.27.30.201:35623] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/smpx.php"] [unique_id "aR7a5vOxD-NeMydTybCLXAAAAAQ"]
[Thu Nov 20 17:09:59.522060 2025] [:error] [pid 55430:tid 55435] [client 20.27.30.201:35811] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/smpx.php"] [unique_id "aR7a5_PZXaIMEU4pE7vuIgAAAMI"]
[Thu Nov 20 17:10:01.055425 2025] [:error] [pid 40445:tid 40487] [client 20.27.30.201:35534] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asd.php"] [unique_id "aR7a6VH-MuFcoWRjXpY8KAAAAkw"]
[Thu Nov 20 17:10:03.452053 2025] [:error] [pid 40508:tid 40522] [client 20.27.30.201:35745] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asd.php"] [unique_id "aR7a66xXNVCMW_ksxPuE-AAAAow"]
[Thu Nov 20 17:10:04.816981 2025] [:error] [pid 55343:tid 55413] [client 20.27.30.201:35659] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asd.php"] [unique_id "aR7a7FWlO3EnyVMV7w6g0gAAAI4"]
[Thu Nov 20 17:10:05.479023 2025] [:error] [pid 40537:tid 40558] [client 20.27.30.201:35522] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asd.php"] [unique_id "aR7a7aKlsL5kxTa3c1zRAgAAAtE"]
[Thu Nov 20 17:10:07.426179 2025] [:error] [pid 55430:tid 55456] [client 20.27.30.201:35756] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class5.php"] [unique_id "aR7a7_PZXaIMEU4pE7vuJwAAANc"]
[Thu Nov 20 17:10:09.363123 2025] [:error] [pid 55342:tid 55389] [client 20.27.30.201:35744] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class5.php"] [unique_id "aR7a8bg6x32Tvk7fIG_IegAAAFE"]
[Thu Nov 20 17:10:09.662972 2025] [:error] [pid 40415:tid 40429] [client 20.27.30.201:35604] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class5.php"] [unique_id "aR7a8ahjIyLSv09svwOQ3gAAAcs"]
[Thu Nov 20 17:10:10.007347 2025] [:error] [pid 40508:tid 40533] [client 20.27.30.201:35671] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class5.php"] [unique_id "aR7a8qxXNVCMW_ksxPuFCAAAApc"]
[Thu Nov 20 17:10:10.650934 2025] [:error] [pid 40508:tid 40517] [client 20.27.30.201:35588] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "aR7a8qxXNVCMW_ksxPuFCQAAAoc"]
[Thu Nov 20 17:10:11.542903 2025] [:error] [pid 40508:tid 40534] [client 20.27.30.201:35735] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "aR7a86xXNVCMW_ksxPuFCgAAApg"]
[Thu Nov 20 17:10:12.273880 2025] [:error] [pid 40508:tid 40518] [client 20.27.30.201:35786] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "aR7a9KxXNVCMW_ksxPuFCwAAAog"]
[Thu Nov 20 17:10:12.983376 2025] [:error] [pid 40508:tid 40522] [client 20.27.30.201:35652] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "aR7a9KxXNVCMW_ksxPuFDgAAAow"]
[Thu Nov 20 17:10:14.491872 2025] [:error] [pid 55343:tid 55406] [client 20.27.30.201:35655] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanki.php"] [unique_id "aR7a9lWlO3EnyVMV7w6g1wAAAIc"]
[Thu Nov 20 17:10:16.536114 2025] [:error] [pid 40636:tid 40652] [client 20.27.30.201:35592] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanki.php"] [unique_id "aR7a-AK8BWUoW3xq0HD8LwAAA4w"]
[Thu Nov 20 17:10:17.723294 2025] [:error] [pid 55342:tid 55391] [client 20.27.30.201:35661] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanki.php"] [unique_id "aR7a-bg6x32Tvk7fIG_IfwAAAFM"]
[Thu Nov 20 17:10:18.643673 2025] [:error] [pid 40508:tid 40512] [client 20.27.30.201:35790] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanki.php"] [unique_id "aR7a-qxXNVCMW_ksxPuFEwAAAoI"]
[Thu Nov 20 17:10:19.208375 2025] [:error] [pid 55430:tid 55440] [client 20.27.30.201:35698] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g7y.php"] [unique_id "aR7a-_PZXaIMEU4pE7vuLAAAAMc"]
[Thu Nov 20 17:10:19.931488 2025] [:error] [pid 40445:tid 40491] [client 20.27.30.201:35784] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g7y.php"] [unique_id "aR7a-1H-MuFcoWRjXpY8NwAAAlA"]
[Thu Nov 20 17:10:20.598178 2025] [:error] [pid 40537:tid 40548] [client 20.27.30.201:35704] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g7y.php"] [unique_id "aR7a_KKlsL5kxTa3c1zRBwAAAsc"]
[Thu Nov 20 17:10:22.794074 2025] [:error] [pid 40537:tid 40555] [client 20.27.30.201:35612] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g7y.php"] [unique_id "aR7a_qKlsL5kxTa3c1zRCAAAAs4"]
[Thu Nov 20 17:10:23.688347 2025] [:error] [pid 40508:tid 40524] [client 20.27.30.201:35676] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "aR7a_6xXNVCMW_ksxPuFGwAAAo4"]
[Thu Nov 20 17:10:25.800833 2025] [:error] [pid 55340:tid 55349] [client 20.27.30.201:35708] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "aR7bAfOxD-NeMydTybCLZwAAAAQ"]
[Thu Nov 20 17:10:26.765260 2025] [:error] [pid 55340:tid 55359] [client 20.27.30.201:35613] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "aR7bAvOxD-NeMydTybCLaQAAAA4"]
[Thu Nov 20 17:10:27.528050 2025] [:error] [pid 34405:tid 34416] [client 20.27.30.201:35629] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "aR7bAzFpvu8oRK7ATfsGVgAAAQk"]
[Thu Nov 20 17:10:28.429078 2025] [:error] [pid 40636:tid 40657] [client 20.27.30.201:35620] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasnu.php"] [unique_id "aR7bBAK8BWUoW3xq0HD8MwAAA5E"]
[Thu Nov 20 17:10:29.444150 2025] [:error] [pid 55430:tid 55433] [client 20.27.30.201:35611] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasnu.php"] [unique_id "aR7bBfPZXaIMEU4pE7vuMQAAAMA"]
[Thu Nov 20 17:10:30.144562 2025] [:error] [pid 55343:tid 55410] [client 20.27.30.201:35753] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasnu.php"] [unique_id "aR7bBlWlO3EnyVMV7w6g3AAAAIs"]
[Thu Nov 20 17:10:31.794536 2025] [:error] [pid 40415:tid 40425] [client 20.27.30.201:35589] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasnu.php"] [unique_id "aR7bB6hjIyLSv09svwORDwAAAcc"]
[Thu Nov 20 17:10:32.293567 2025] [:error] [pid 40508:tid 40516] [client 20.27.30.201:35711] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aR7bCKxXNVCMW_ksxPuFPgAAAoY"]
[Thu Nov 20 17:10:33.844939 2025] [:error] [pid 40508:tid 40524] [client 20.27.30.201:35739] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aR7bCaxXNVCMW_ksxPuFQAAAAo4"]
[Thu Nov 20 17:10:35.799192 2025] [:error] [pid 40415:tid 40420] [client 20.27.30.201:35653] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aR7bC6hjIyLSv09svwORFgAAAcI"]
[Thu Nov 20 17:10:36.943808 2025] [:error] [pid 40445:tid 40476] [client 20.27.30.201:35636] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aR7bDFH-MuFcoWRjXpY8aQAAAkE"]
[Thu Nov 20 17:10:38.178798 2025] [:error] [pid 40636:tid 40657] [client 20.27.30.201:35643] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wio.php"] [unique_id "aR7bDgK8BWUoW3xq0HD8QgAAA5E"]
[Thu Nov 20 17:10:38.837767 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35819] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wio.php"] [unique_id "aR7bDlH-MuFcoWRjXpY8agAAAkQ"]
[Thu Nov 20 17:10:40.682857 2025] [:error] [pid 40508:tid 40527] [client 20.27.30.201:35684] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wio.php"] [unique_id "aR7bEKxXNVCMW_ksxPuFWAAAApE"]
[Thu Nov 20 17:10:41.215714 2025] [:error] [pid 55342:tid 55381] [client 20.27.30.201:35625] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wio.php"] [unique_id "aR7bEbg6x32Tvk7fIG_IrwAAAEk"]
[Thu Nov 20 17:10:42.809772 2025] [:error] [pid 40508:tid 40522] [client 20.27.30.201:35646] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oswkk.php"] [unique_id "aR7bEqxXNVCMW_ksxPuFXwAAAow"]
[Thu Nov 20 17:10:44.271786 2025] [proxy_fcgi:error] [pid 55342:tid 55394] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:44.391837 2025] [proxy_fcgi:error] [pid 55342:tid 55376] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:44.509892 2025] [proxy_fcgi:error] [pid 55342:tid 55382] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:44.820278 2025] [proxy_fcgi:error] [pid 55342:tid 55374] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:44.959260 2025] [proxy_fcgi:error] [pid 55342:tid 55375] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.232204 2025] [proxy_fcgi:error] [pid 55342:tid 55386] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.349262 2025] [proxy_fcgi:error] [pid 55342:tid 55395] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.549679 2025] [proxy_fcgi:error] [pid 55342:tid 55389] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.668644 2025] [proxy_fcgi:error] [pid 55342:tid 55385] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.874641 2025] [proxy_fcgi:error] [pid 55342:tid 55372] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:45.992443 2025] [proxy_fcgi:error] [pid 55342:tid 55380] [client 20.27.30.201:35624] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:10:46.172281 2025] [:error] [pid 55342:tid 55387] [client 20.27.30.201:35624] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "aR7bFrg6x32Tvk7fIG_IwQAAAE8"]
[Thu Nov 20 17:10:46.874625 2025] [:error] [pid 55430:tid 55444] [client 20.27.30.201:35666] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "aR7bFvPZXaIMEU4pE7vuQQAAAMs"]
[Thu Nov 20 17:10:48.523891 2025] [:error] [pid 40508:tid 40512] [client 20.27.30.201:35591] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "aR7bGKxXNVCMW_ksxPuFZAAAAoI"]
[Thu Nov 20 17:10:50.021169 2025] [:error] [pid 55340:tid 55357] [client 20.27.30.201:35549] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "aR7bGvOxD-NeMydTybCLiwAAAAw"]
[Thu Nov 20 17:10:52.474511 2025] [:error] [pid 40636:tid 40659] [client 20.27.30.201:35816] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aR7bHAK8BWUoW3xq0HD8SQAAA5M"]
[Thu Nov 20 17:10:54.090329 2025] [:error] [pid 40508:tid 40534] [client 20.27.30.201:35607] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aR7bHqxXNVCMW_ksxPuFZQAAApg"]
[Thu Nov 20 17:10:54.881833 2025] [:error] [pid 40445:tid 40486] [client 20.27.30.201:35538] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aR7bHlH-MuFcoWRjXpY8eQAAAks"]
[Thu Nov 20 17:10:57.222184 2025] [:error] [pid 34405:tid 34411] [client 20.27.30.201:35702] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aR7bITFpvu8oRK7ATfsGbgAAAQQ"]
[Thu Nov 20 17:10:58.293861 2025] [:error] [pid 55340:tid 55346] [client 20.27.30.201:35639] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aR7bIvOxD-NeMydTybCLjAAAAAE"]
[Thu Nov 20 17:10:59.002038 2025] [:error] [pid 55343:tid 55403] [client 20.27.30.201:35560] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aR7bI1WlO3EnyVMV7w6g_QAAAIQ"]
[Thu Nov 20 17:11:00.499396 2025] [:error] [pid 40508:tid 40520] [client 20.27.30.201:35817] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aR7bJKxXNVCMW_ksxPuFcQAAAoo"]
[Thu Nov 20 17:11:01.758022 2025] [:error] [pid 40537:tid 40544] [client 20.27.30.201:35637] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aR7bJaKlsL5kxTa3c1zRGwAAAsM"]
[Thu Nov 20 17:11:03.483919 2025] [:error] [pid 40508:tid 40515] [client 20.27.30.201:35725] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7.php"] [unique_id "aR7bJ6xXNVCMW_ksxPuFdgAAAoU"]
[Thu Nov 20 17:11:04.744642 2025] [:error] [pid 55343:tid 55405] [client 20.27.30.201:35630] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7.php"] [unique_id "aR7bKFWlO3EnyVMV7w6g_gAAAIY"]
[Thu Nov 20 17:11:06.360721 2025] [:error] [pid 55430:tid 55445] [client 20.27.30.201:35544] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7.php"] [unique_id "aR7bKvPZXaIMEU4pE7vuRQAAAMw"]
[Thu Nov 20 17:11:07.132798 2025] [:error] [pid 40415:tid 40442] [client 20.27.30.201:35590] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7.php"] [unique_id "aR7bK6hjIyLSv09svwOROAAAAdg"]
[Thu Nov 20 17:11:09.708071 2025] [:error] [pid 55430:tid 55435] [client 20.27.30.201:35537] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zex.php"] [unique_id "aR7bLfPZXaIMEU4pE7vuRgAAAMI"]
[Thu Nov 20 17:11:11.026123 2025] [:error] [pid 40508:tid 40518] [client 20.27.30.201:35663] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zex.php"] [unique_id "aR7bL6xXNVCMW_ksxPuFgQAAAog"]
[Thu Nov 20 17:11:13.732539 2025] [:error] [pid 40445:tid 40496] [client 20.27.30.201:35709] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zex.php"] [unique_id "aR7bMVH-MuFcoWRjXpY8ggAAAlU"]
[Thu Nov 20 17:11:15.064789 2025] [:error] [pid 40508:tid 40518] [client 20.27.30.201:35682] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zex.php"] [unique_id "aR7bM6xXNVCMW_ksxPuFiQAAAog"]
[Thu Nov 20 17:11:16.637163 2025] [:error] [pid 55342:tid 55382] [client 20.27.30.201:35571] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zxin.php"] [unique_id "aR7bNLg6x32Tvk7fIG_I0QAAAEo"]
[Thu Nov 20 17:11:17.714290 2025] [:error] [pid 40445:tid 40477] [client 20.27.30.201:35695] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zxin.php"] [unique_id "aR7bNVH-MuFcoWRjXpY8gwAAAkI"]
[Thu Nov 20 17:11:19.919898 2025] [:error] [pid 40508:tid 40517] [client 20.27.30.201:35614] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zxin.php"] [unique_id "aR7bN6xXNVCMW_ksxPuFjgAAAoc"]
[Thu Nov 20 17:11:24.386193 2025] [:error] [pid 40508:tid 40526] [client 20.27.30.201:35543] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zxin.php"] [unique_id "aR7bPKxXNVCMW_ksxPuFkgAAApA"]
[Thu Nov 20 17:11:26.114035 2025] [:error] [pid 40445:tid 40482] [client 20.27.30.201:35580] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd67.php"] [unique_id "aR7bPlH-MuFcoWRjXpY8iQAAAkc"]
[Thu Nov 20 17:11:30.155013 2025] [:error] [pid 40508:tid 40519] [client 20.27.30.201:35615] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd67.php"] [unique_id "aR7bQqxXNVCMW_ksxPuFlgAAAok"]
[Thu Nov 20 17:11:32.062806 2025] [:error] [pid 40445:tid 40476] [client 20.27.30.201:35462] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd67.php"] [unique_id "aR7bRFH-MuFcoWRjXpY8iwAAAkE"]
[Thu Nov 20 17:11:33.781891 2025] [:error] [pid 34405:tid 34415] [client 20.27.30.201:35621] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd67.php"] [unique_id "aR7bRTFpvu8oRK7ATfsGgQAAAQg"]
[Thu Nov 20 17:11:34.538094 2025] [:error] [pid 40415:tid 40430] [client 20.27.30.201:35700] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "aR7bRqhjIyLSv09svwORSAAAAcw"]
[Thu Nov 20 17:11:36.120400 2025] [:error] [pid 55430:tid 55450] [client 20.27.30.201:35602] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "aR7bSPPZXaIMEU4pE7vuXQAAANE"]
[Thu Nov 20 17:11:36.698014 2025] [:error] [pid 40445:tid 40483] [client 20.27.30.201:35609] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "aR7bSFH-MuFcoWRjXpY8kwAAAkg"]
[Thu Nov 20 17:11:37.526424 2025] [:error] [pid 40445:tid 40490] [client 20.27.30.201:35531] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "aR7bSVH-MuFcoWRjXpY8lQAAAk8"]
[Thu Nov 20 17:11:39.313978 2025] [:error] [pid 40508:tid 40523] [client 20.27.30.201:35622] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aR7bS6xXNVCMW_ksxPuFoQAAAo0"]
[Thu Nov 20 17:11:40.798027 2025] [:error] [pid 55430:tid 55452] [client 20.27.30.201:35686] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aR7bTPPZXaIMEU4pE7vuXwAAANM"]
[Thu Nov 20 17:11:41.347452 2025] [:error] [pid 40445:tid 40476] [client 20.27.30.201:35707] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aR7bTVH-MuFcoWRjXpY8mAAAAkE"]
[Thu Nov 20 17:11:42.978651 2025] [:error] [pid 55342:tid 55388] [client 20.27.30.201:35576] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aR7bTrg6x32Tvk7fIG_I7QAAAFA"]
[Thu Nov 20 17:11:44.299063 2025] [:error] [pid 55342:tid 55382] [client 20.27.30.201:35532] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/enkkk.php"] [unique_id "aR7bULg6x32Tvk7fIG_I7wAAAEo"]
[Thu Nov 20 17:11:45.833014 2025] [proxy_fcgi:error] [pid 40415:tid 40419] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:45.952073 2025] [proxy_fcgi:error] [pid 40415:tid 40426] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.076772 2025] [proxy_fcgi:error] [pid 40415:tid 40432] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.202904 2025] [proxy_fcgi:error] [pid 40415:tid 40436] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.323579 2025] [proxy_fcgi:error] [pid 40415:tid 40434] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.450670 2025] [proxy_fcgi:error] [pid 40415:tid 40442] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.571466 2025] [proxy_fcgi:error] [pid 40415:tid 40418] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.693394 2025] [proxy_fcgi:error] [pid 40415:tid 40440] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:46.887994 2025] [proxy_fcgi:error] [pid 40415:tid 40423] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:47.149268 2025] [proxy_fcgi:error] [pid 40415:tid 40439] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:47.270953 2025] [proxy_fcgi:error] [pid 40415:tid 40438] [client 20.27.30.201:35525] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:11:47.384078 2025] [:error] [pid 40415:tid 40430] [client 20.27.30.201:35525] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bes.php"] [unique_id "aR7bU6hjIyLSv09svwORWQAAAcw"]
[Thu Nov 20 17:11:48.037200 2025] [:error] [pid 55342:tid 55391] [client 20.27.30.201:35536] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bes.php"] [unique_id "aR7bVLg6x32Tvk7fIG_I8wAAAFM"]
[Thu Nov 20 17:11:48.559413 2025] [:error] [pid 55342:tid 55384] [client 20.27.30.201:35668] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bes.php"] [unique_id "aR7bVLg6x32Tvk7fIG_I9AAAAEw"]
[Thu Nov 20 17:11:50.014341 2025] [:error] [pid 55340:tid 55363] [client 20.27.30.201:35644] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bes.php"] [unique_id "aR7bVvOxD-NeMydTybCLqwAAABI"]
[Thu Nov 20 17:11:50.582224 2025] [:error] [pid 40508:tid 40530] [client 20.27.30.201:35527] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-swa.php"] [unique_id "aR7bVqxXNVCMW_ksxPuFqgAAApQ"]
[Thu Nov 20 17:11:50.970325 2025] [:error] [pid 40415:tid 40441] [client 20.27.30.201:35548] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-swa.php"] [unique_id "aR7bVqhjIyLSv09svwORYAAAAdc"]
[Thu Nov 20 17:11:52.224754 2025] [:error] [pid 55343:tid 55403] [client 20.27.30.201:35694] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-swa.php"] [unique_id "aR7bWFWlO3EnyVMV7w6hGwAAAIQ"]
[Thu Nov 20 17:11:53.728335 2025] [:error] [pid 40415:tid 40442] [client 20.27.30.201:35582] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-swa.php"] [unique_id "aR7bWahjIyLSv09svwORZQAAAdg"]
[Thu Nov 20 17:11:54.423423 2025] [:error] [pid 55342:tid 55373] [client 20.27.30.201:35539] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/42u.php"] [unique_id "aR7bWrg6x32Tvk7fIG_I_AAAAEE"]
[Thu Nov 20 17:11:56.137008 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35567] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/42u.php"] [unique_id "aR7bXFH-MuFcoWRjXpY8oQAAAkQ"]
[Thu Nov 20 17:11:56.885777 2025] [:error] [pid 40445:tid 40478] [client 20.27.30.201:35799] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/42u.php"] [unique_id "aR7bXFH-MuFcoWRjXpY8pAAAAkM"]
[Thu Nov 20 17:11:58.233607 2025] [:error] [pid 55343:tid 55401] [client 20.27.30.201:35647] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/42u.php"] [unique_id "aR7bXlWlO3EnyVMV7w6hHwAAAII"]
[Thu Nov 20 17:11:59.731459 2025] [:error] [pid 55343:tid 55407] [client 20.27.30.201:35605] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lc.php"] [unique_id "aR7bX1WlO3EnyVMV7w6hIAAAAIg"]
[Thu Nov 20 17:12:00.964777 2025] [:error] [pid 40445:tid 40477] [client 20.27.30.201:35554] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lc.php"] [unique_id "aR7bYFH-MuFcoWRjXpY8qwAAAkI"]
[Thu Nov 20 17:12:01.750092 2025] [:error] [pid 40508:tid 40524] [client 20.27.30.201:35827] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lc.php"] [unique_id "aR7bYaxXNVCMW_ksxPuFugAAAo4"]
[Thu Nov 20 17:12:03.177171 2025] [:error] [pid 55343:tid 55402] [client 20.27.30.201:35714] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lc.php"] [unique_id "aR7bY1WlO3EnyVMV7w6hIQAAAIM"]
[Thu Nov 20 17:12:03.879247 2025] [:error] [pid 40636:tid 40659] [client 20.27.30.201:35578] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aR7bYwK8BWUoW3xq0HD8eQAAA5M"]
[Thu Nov 20 17:12:05.008311 2025] [:error] [pid 40508:tid 40531] [client 20.27.30.201:35718] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aR7bZaxXNVCMW_ksxPuFvAAAApU"]
[Thu Nov 20 17:12:06.254353 2025] [:error] [pid 40415:tid 40425] [client 20.27.30.201:35575] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aR7bZqhjIyLSv09svwORdgAAAcc"]
[Thu Nov 20 17:12:06.906252 2025] [:error] [pid 40415:tid 40423] [client 20.27.30.201:35594] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aR7bZqhjIyLSv09svwOReQAAAcU"]
[Thu Nov 20 17:12:07.416429 2025] [:error] [pid 34405:tid 34426] [client 20.27.30.201:35555] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aR7bZzFpvu8oRK7ATfsGnAAAARM"]
[Thu Nov 20 17:12:08.111630 2025] [:error] [pid 40415:tid 40439] [client 20.27.30.201:35715] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aR7baKhjIyLSv09svwORegAAAdU"]
[Thu Nov 20 17:12:09.122502 2025] [:error] [pid 40508:tid 40511] [client 20.27.30.201:35696] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aR7baaxXNVCMW_ksxPuFwAAAAoE"]
[Thu Nov 20 17:12:11.981330 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35552] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aR7ba7g6x32Tvk7fIG_JAAAAAFg"]
[Thu Nov 20 17:12:12.377221 2025] [:error] [pid 40508:tid 40510] [client 20.27.30.201:35547] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfile.php"] [unique_id "aR7bbKxXNVCMW_ksxPuFwwAAAoA"]
[Thu Nov 20 17:12:13.147028 2025] [:error] [pid 34405:tid 34427] [client 20.27.30.201:35510] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfile.php"] [unique_id "aR7bbTFpvu8oRK7ATfsGnwAAARQ"]
[Thu Nov 20 17:12:14.109434 2025] [:error] [pid 40636:tid 40648] [client 20.27.30.201:35570] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfile.php"] [unique_id "aR7bbgK8BWUoW3xq0HD8gAAAA4g"]
[Thu Nov 20 17:12:14.529571 2025] [:error] [pid 40636:tid 40653] [client 20.27.30.201:35606] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfile.php"] [unique_id "aR7bbgK8BWUoW3xq0HD8gQAAA40"]
[Thu Nov 20 17:12:15.557701 2025] [:error] [pid 40445:tid 40489] [client 20.27.30.201:35761] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aR7bb1H-MuFcoWRjXpY8rwAAAk4"]
[Thu Nov 20 17:12:16.185773 2025] [:error] [pid 40415:tid 40426] [client 20.27.30.201:35627] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aR7bcKhjIyLSv09svwORfgAAAcg"]
[Thu Nov 20 17:12:17.122972 2025] [:error] [pid 40508:tid 40530] [client 20.27.30.201:35675] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aR7bcaxXNVCMW_ksxPuFzQAAApQ"]
[Thu Nov 20 17:12:18.698969 2025] [:error] [pid 34405:tid 34425] [client 20.27.30.201:35579] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aR7bcjFpvu8oRK7ATfsGogAAARI"]
[Thu Nov 20 17:12:19.619885 2025] [:error] [pid 55342:tid 55376] [client 20.27.30.201:35561] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gold.php"] [unique_id "aR7bc7g6x32Tvk7fIG_JBgAAAEQ"]
[Thu Nov 20 17:12:20.031024 2025] [:error] [pid 55342:tid 55393] [client 20.27.30.201:35524] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gold.php"] [unique_id "aR7bdLg6x32Tvk7fIG_JBwAAAFU"]
[Thu Nov 20 17:12:20.656664 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35565] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gold.php"] [unique_id "aR7bdFH-MuFcoWRjXpY8tAAAAkQ"]
[Thu Nov 20 17:12:21.637372 2025] [:error] [pid 40445:tid 40488] [client 20.27.30.201:35723] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gold.php"] [unique_id "aR7bdVH-MuFcoWRjXpY8tQAAAk0"]
[Thu Nov 20 17:12:22.631520 2025] [:error] [pid 34405:tid 34415] [client 20.27.30.201:35832] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aR7bdjFpvu8oRK7ATfsGpQAAAQg"]
[Thu Nov 20 17:12:22.978069 2025] [:error] [pid 55343:tid 55407] [client 20.27.30.201:35776] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aR7bdlWlO3EnyVMV7w6hLAAAAIg"]
[Thu Nov 20 17:12:23.369930 2025] [:error] [pid 40636:tid 40660] [client 20.27.30.201:35492] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aR7bdwK8BWUoW3xq0HD8hgAAA5Q"]
[Thu Nov 20 17:12:24.189399 2025] [:error] [pid 40508:tid 40521] [client 20.27.30.201:35523] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aR7beKxXNVCMW_ksxPuF2QAAAos"]
[Thu Nov 20 17:12:25.138274 2025] [:error] [pid 55342:tid 55385] [client 20.27.30.201:35490] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "aR7bebg6x32Tvk7fIG_JCwAAAE0"]
[Thu Nov 20 17:12:26.092690 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35472] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "aR7berg6x32Tvk7fIG_JDQAAAFg"]
[Thu Nov 20 17:12:26.426574 2025] [:error] [pid 40636:tid 40663] [client 20.27.30.201:35638] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "aR7begK8BWUoW3xq0HD8hwAAA5c"]
[Thu Nov 20 17:12:27.005682 2025] [:error] [pid 40445:tid 40482] [client 20.27.30.201:35822] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "aR7be1H-MuFcoWRjXpY8twAAAkc"]
[Thu Nov 20 17:12:27.580823 2025] [:error] [pid 55430:tid 55453] [client 20.27.30.201:35795] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aR7be_PZXaIMEU4pE7vucgAAANQ"]
[Thu Nov 20 17:12:28.208405 2025] [:error] [pid 40415:tid 40423] [client 20.27.30.201:35805] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aR7bfKhjIyLSv09svwORhAAAAcU"]
[Thu Nov 20 17:12:29.266814 2025] [:error] [pid 40636:tid 40654] [client 20.27.30.201:35837] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aR7bfQK8BWUoW3xq0HD8iAAAA44"]
[Thu Nov 20 17:12:29.971955 2025] [:error] [pid 55430:tid 55447] [client 20.27.30.201:35483] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aR7bffPZXaIMEU4pE7vudQAAAM4"]
[Thu Nov 20 17:12:31.159044 2025] [:error] [pid 40415:tid 40431] [client 20.27.30.201:35731] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aua.php"] [unique_id "aR7bf6hjIyLSv09svwORiQAAAc0"]
[Thu Nov 20 17:12:33.271325 2025] [:error] [pid 40508:tid 40521] [client 20.27.30.201:35583] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aua.php"] [unique_id "aR7bgaxXNVCMW_ksxPuF5AAAAos"]
[Thu Nov 20 17:12:35.834976 2025] [:error] [pid 40636:tid 40664] [client 20.27.30.201:35812] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aua.php"] [unique_id "aR7bgwK8BWUoW3xq0HD8jQAAA5g"]
[Thu Nov 20 17:12:37.342790 2025] [:error] [pid 40508:tid 40526] [client 20.27.30.201:35764] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aua.php"] [unique_id "aR7bhaxXNVCMW_ksxPuF5QAAApA"]
[Thu Nov 20 17:12:38.088073 2025] [:error] [pid 34405:tid 34419] [client 20.27.30.201:35496] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aR7bhjFpvu8oRK7ATfsGswAAAQw"]
[Thu Nov 20 17:12:38.874674 2025] [:error] [pid 34405:tid 34428] [client 20.27.30.201:35774] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aR7bhjFpvu8oRK7ATfsGtQAAARU"]
[Thu Nov 20 17:12:40.057999 2025] [:error] [pid 40508:tid 40515] [client 20.27.30.201:35788] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aR7biKxXNVCMW_ksxPuF6AAAAoU"]
[Thu Nov 20 17:12:41.439040 2025] [:error] [pid 40508:tid 40513] [client 20.27.30.201:35719] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aR7biaxXNVCMW_ksxPuF6gAAAoM"]
[Thu Nov 20 17:12:42.221070 2025] [:error] [pid 40415:tid 40436] [client 20.27.30.201:35494] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/great.php"] [unique_id "aR7biqhjIyLSv09svwORjAAAAdI"]
[Thu Nov 20 17:12:42.879158 2025] [:error] [pid 55342:tid 55376] [client 20.27.30.201:35785] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/great.php"] [unique_id "aR7birg6x32Tvk7fIG_JEwAAAEQ"]
[Thu Nov 20 17:12:43.505003 2025] [:error] [pid 55342:tid 55393] [client 20.27.30.201:35740] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/great.php"] [unique_id "aR7bi7g6x32Tvk7fIG_JFAAAAFU"]
[Thu Nov 20 17:12:44.253737 2025] [:error] [pid 55340:tid 55346] [client 20.27.30.201:35833] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/great.php"] [unique_id "aR7bjPOxD-NeMydTybCLwgAAAAE"]
[Thu Nov 20 17:12:45.167238 2025] [:error] [pid 55342:tid 55379] [client 20.27.30.201:35469] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class9.php"] [unique_id "aR7bjbg6x32Tvk7fIG_JFgAAAEc"]
[Thu Nov 20 17:12:46.426220 2025] [:error] [pid 55430:tid 55439] [client 20.27.30.201:35794] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class9.php"] [unique_id "aR7bjvPZXaIMEU4pE7vuiAAAAMY"]
[Thu Nov 20 17:12:47.320979 2025] [proxy_fcgi:error] [pid 40508:tid 40521] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:47.440893 2025] [proxy_fcgi:error] [pid 40508:tid 40524] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:47.578862 2025] [proxy_fcgi:error] [pid 40508:tid 40517] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:47.702018 2025] [proxy_fcgi:error] [pid 40508:tid 40512] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:47.819599 2025] [proxy_fcgi:error] [pid 40508:tid 40510] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:47.937606 2025] [proxy_fcgi:error] [pid 40508:tid 40511] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:48.055660 2025] [proxy_fcgi:error] [pid 40508:tid 40515] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:48.193012 2025] [proxy_fcgi:error] [pid 40508:tid 40514] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:48.312215 2025] [proxy_fcgi:error] [pid 40508:tid 40513] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:48.625918 2025] [proxy_fcgi:error] [pid 40508:tid 40528] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:48.758081 2025] [proxy_fcgi:error] [pid 40508:tid 40531] [client 20.27.30.201:35726] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:12:49.008907 2025] [:error] [pid 40508:tid 40529] [client 20.27.30.201:35726] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxoby.php"] [unique_id "aR7bkaxXNVCMW_ksxPuGAgAAApM"]
[Thu Nov 20 17:12:49.656427 2025] [:error] [pid 40445:tid 40479] [client 20.27.30.201:35710] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxoby.php"] [unique_id "aR7bkVH-MuFcoWRjXpY8wAAAAkQ"]
[Thu Nov 20 17:12:50.664322 2025] [:error] [pid 40445:tid 40486] [client 20.27.30.201:35730] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxoby.php"] [unique_id "aR7bklH-MuFcoWRjXpY8wQAAAks"]
[Thu Nov 20 17:12:51.875316 2025] [:error] [pid 55343:tid 55409] [client 20.27.30.201:35820] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxoby.php"] [unique_id "aR7bk1WlO3EnyVMV7w6hTwAAAIo"]
[Thu Nov 20 17:12:53.121298 2025] [:error] [pid 34405:tid 34417] [client 20.27.30.201:35826] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error1.php"] [unique_id "aR7blTFpvu8oRK7ATfsG1QAAAQo"]
[Thu Nov 20 17:12:55.161865 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35660] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error1.php"] [unique_id "aR7bl7g6x32Tvk7fIG_JGwAAAFg"]
[Thu Nov 20 17:12:55.722690 2025] [:error] [pid 55430:tid 55440] [client 20.27.30.201:35809] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error1.php"] [unique_id "aR7bl_PZXaIMEU4pE7vukwAAAMc"]
[Thu Nov 20 17:12:56.582192 2025] [:error] [pid 55342:tid 55377] [client 20.27.30.201:35477] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error1.php"] [unique_id "aR7bmLg6x32Tvk7fIG_JHQAAAEU"]
[Thu Nov 20 17:12:57.418081 2025] [:error] [pid 55342:tid 55390] [client 20.27.30.201:35796] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aR7bmbg6x32Tvk7fIG_JHgAAAFI"]
[Thu Nov 20 17:12:58.686708 2025] [:error] [pid 40537:tid 40562] [client 20.27.30.201:35825] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aR7bmqKlsL5kxTa3c1zRWwAAAtU"]
[Thu Nov 20 17:12:59.394008 2025] [:error] [pid 40508:tid 40529] [client 20.27.30.201:35626] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aR7bm6xXNVCMW_ksxPuGHQAAApM"]
[Thu Nov 20 17:12:59.902054 2025] [:error] [pid 40415:tid 40421] [client 20.27.30.201:35667] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aR7bm6hjIyLSv09svwORlAAAAcM"]
[Thu Nov 20 17:13:01.457080 2025] [:error] [pid 55342:tid 55383] [client 20.27.30.201:35777] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aR7bnbg6x32Tvk7fIG_JIwAAAEs"]
[Thu Nov 20 17:13:02.646486 2025] [:error] [pid 40508:tid 40521] [client 20.27.30.201:35605] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aR7bnqxXNVCMW_ksxPuGHwAAAos"]
[Thu Nov 20 17:13:03.508994 2025] [:error] [pid 34405:tid 34407] [client 20.27.30.201:35475] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aR7bnzFpvu8oRK7ATfsG2QAAAQA"]
[Thu Nov 20 17:13:05.989126 2025] [:error] [pid 34405:tid 34430] [client 20.27.30.201:35802] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aR7boTFpvu8oRK7ATfsG2gAAARc"]
[Thu Nov 20 17:13:06.720447 2025] [:error] [pid 40415:tid 40425] [client 20.27.30.201:35716] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wcas.php"] [unique_id "aR7boqhjIyLSv09svwORmAAAAcc"]
[Thu Nov 20 17:13:07.758222 2025] [:error] [pid 40537:tid 40549] [client 20.27.30.201:35815] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wcas.php"] [unique_id "aR7bo6KlsL5kxTa3c1zRXAAAAsg"]
[Thu Nov 20 17:13:08.542922 2025] [:error] [pid 34405:tid 34411] [client 20.27.30.201:35810] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wcas.php"] [unique_id "aR7bpDFpvu8oRK7ATfsG2wAAAQQ"]
[Thu Nov 20 17:13:09.464654 2025] [:error] [pid 55340:tid 55352] [client 20.27.30.201:35559] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wcas.php"] [unique_id "aR7bpfOxD-NeMydTybCLzwAAAAc"]
[Thu Nov 20 17:13:11.993417 2025] [:error] [pid 40508:tid 40512] [client 20.27.30.201:35768] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "aR7bp6xXNVCMW_ksxPuGIgAAAoI"]
[Thu Nov 20 17:13:12.855412 2025] [:error] [pid 40537:tid 40558] [client 20.27.30.201:35773] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "aR7bqKKlsL5kxTa3c1zRXQAAAtE"]
[Thu Nov 20 17:13:13.898664 2025] [:error] [pid 55342:tid 55391] [client 20.27.30.201:35530] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "aR7bqbg6x32Tvk7fIG_JJwAAAFM"]
[Thu Nov 20 17:13:15.750061 2025] [:error] [pid 40445:tid 40492] [client 20.27.30.201:35775] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "aR7bq1H-MuFcoWRjXpY81QAAAlE"]
[Thu Nov 20 17:13:16.357155 2025] [:error] [pid 40537:tid 40564] [client 20.27.30.201:35783] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aR7brKKlsL5kxTa3c1zRYQAAAtc"]
[Thu Nov 20 17:13:17.817059 2025] [:error] [pid 34405:tid 34420] [client 20.27.30.201:35771] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aR7brTFpvu8oRK7ATfsHFAAAAQ0"]
[Thu Nov 20 17:13:20.463805 2025] [:error] [pid 55343:tid 55418] [client 20.27.30.201:35727] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aR7bsFWlO3EnyVMV7w6hWQAAAJM"]
[Thu Nov 20 17:13:22.039313 2025] [:error] [pid 40636:tid 40644] [client 20.27.30.201:35762] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aR7bsgK8BWUoW3xq0HD8nQAAA4Q"]
[Thu Nov 20 17:13:22.971818 2025] [:error] [pid 55342:tid 55396] [client 20.27.30.201:35780] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aR7bsrg6x32Tvk7fIG_JKQAAAFg"]
[Thu Nov 20 17:13:24.482997 2025] [:error] [pid 55430:tid 55443] [client 20.27.30.201:35649] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aR7btPPZXaIMEU4pE7vungAAAMo"]
[Thu Nov 20 17:13:25.574826 2025] [:error] [pid 55342:tid 55387] [client 20.27.30.201:35654] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aR7btbg6x32Tvk7fIG_JKgAAAE8"]
[Thu Nov 20 17:13:27.153791 2025] [:error] [pid 55343:tid 55413] [client 20.27.30.201:35634] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aR7bt1WlO3EnyVMV7w6hXgAAAI4"]
[Thu Nov 20 17:13:29.127429 2025] [:error] [pid 40508:tid 40518] [client 20.27.30.201:35763] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh77.php"] [unique_id "aR7buaxXNVCMW_ksxPuGNAAAAog"]
[Thu Nov 20 17:13:34.672200 2025] [:error] [pid 55340:tid 55367] [client 20.27.30.201:35798] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh77.php"] [unique_id "aR7bvvOxD-NeMydTybCL2gAAABY"]
[Thu Nov 20 17:13:37.085750 2025] [:error] [pid 40537:tid 40551] [client 20.27.30.201:35498] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh77.php"] [unique_id "aR7bwaKlsL5kxTa3c1zRmgAAAso"]
[Thu Nov 20 17:13:37.842751 2025] [:error] [pid 40636:tid 40652] [client 20.27.30.201:35807] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh77.php"] [unique_id "aR7bwQK8BWUoW3xq0HD8sgAAA4w"]
[Thu Nov 20 17:13:38.847049 2025] [:error] [pid 40636:tid 40657] [client 20.27.30.201:35720] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nax.php"] [unique_id "aR7bwgK8BWUoW3xq0HD8tAAAA5E"]
[Thu Nov 20 17:13:43.251058 2025] [:error] [pid 40415:tid 40427] [client 20.27.30.201:35732] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nax.php"] [unique_id "aR7bx6hjIyLSv09svwORqAAAAck"]
[Thu Nov 20 17:13:46.783513 2025] [:error] [pid 34405:tid 34425] [client 20.27.30.201:35673] [client 20.27.30.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nax.php"] [unique_id "aR7byjFpvu8oRK7ATfsHIgAAARI"]
[Thu Nov 20 17:13:48.584610 2025] [proxy_fcgi:error] [pid 40508:tid 40531] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:48.719410 2025] [proxy_fcgi:error] [pid 40508:tid 40516] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:48.836619 2025] [proxy_fcgi:error] [pid 40508:tid 40524] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:48.954263 2025] [proxy_fcgi:error] [pid 40508:tid 40517] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:49.227522 2025] [proxy_fcgi:error] [pid 40508:tid 40521] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:49.346620 2025] [proxy_fcgi:error] [pid 40508:tid 40533] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 17:13:49.655282 2025] [proxy_fcgi:error] [pid 40508:tid 40526] [client 20.27.30.201:35835] AH01071: Got error 'Primary script unknown'
[Thu Nov 20 20:50:51.285734 2025] [:error] [pid 40508:tid 40519] [client 144.126.210.23:50346] [client 144.126.210.23] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/ld+json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR8Oq6xXNVCMW_ksxPvQ-AAAAok"]
[Thu Nov 20 20:50:51.734505 2025] [:error] [pid 40508:tid 40526] [client 144.126.210.23:50346] [client 144.126.210.23] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/ld+json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR8Oq6xXNVCMW_ksxPvQ_AAAApA"]
[Fri Nov 21 02:16:27.980649 2025] [:error] [pid 28937:tid 28961] [client 223.233.73.182:9273] [client 223.233.73.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.73.182, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aR9a-_tbT10GL1y3DOaBkAAAANY"]
[Fri Nov 21 02:16:27.991401 2025] [proxy_fcgi:error] [pid 28937:tid 28961] [client 223.233.73.182:9273] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 07:55:01.162081 2025] [:error] [pid 13326:tid 13373] [client 58.49.233.126:56065] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aR-qVdh942-HkDIkOWoIpAAAAE8"]
[Fri Nov 21 16:29:42.651284 2025] [:error] [pid 25429:tid 25456] [client 2.50.51.95:58785] [client 2.50.51.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.50.51.95, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAi9j4rZbRSr7vu-NO2zgAAABc"]
[Fri Nov 21 16:29:42.665371 2025] [proxy_fcgi:error] [pid 25429:tid 25456] [client 2.50.51.95:58785] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 16:29:43.162567 2025] [proxy_fcgi:error] [pid 25429:tid 25449] [client 2.50.51.95:58807] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 16:29:47.421995 2025] [:error] [pid 46939:tid 46948] [client 185.241.208.71:38340] [client 185.241.208.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.241.208.71, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAi--0OmVoxD4VZ_ZmFhQAAAUY"]
[Fri Nov 21 16:29:47.426265 2025] [proxy_fcgi:error] [pid 46939:tid 46948] [client 185.241.208.71:38340] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 16:29:49.138899 2025] [proxy_fcgi:error] [pid 46939:tid 46958] [client 185.241.208.71:38348] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 16:52:38.583799 2025] [proxy_fcgi:error] [pid 46939:tid 46954] [client 145.239.10.137:55837] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/13k.php
[Fri Nov 21 17:19:07.240377 2025] [:error] [pid 25554:tid 25567] [client 188.126.94.239:40647] [client 188.126.94.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.126.94.239, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAuix-NtB-9AzFZrk5ydgAAAQk"]
[Fri Nov 21 17:19:07.250876 2025] [proxy_fcgi:error] [pid 25554:tid 25567] [client 188.126.94.239:40647] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 17:19:07.292024 2025] [:error] [pid 25554:tid 25582] [client 91.90.126.148:40683] [client 91.90.126.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.90.126.148, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "aSAuix-NtB-9AzFZrk5yeAAAARg"]
[Fri Nov 21 17:19:07.416097 2025] [:error] [pid 25554:tid 25559] [client 89.234.157.254:40500] [client 89.234.157.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.234.157.254, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/blog/wp-login.php"] [unique_id "aSAuix-NtB-9AzFZrk5yeQAAAQE"]
[Fri Nov 21 17:19:08.642776 2025] [:error] [pid 25521:tid 25525] [client 188.126.94.239:47107] [client 188.126.94.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.126.94.239, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAujPhXnBMilDddn3UFFAAAAMI"]
[Fri Nov 21 17:19:08.645434 2025] [proxy_fcgi:error] [pid 25521:tid 25525] [client 188.126.94.239:47107] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 17:19:08.885910 2025] [:error] [pid 25431:tid 25497] [client 91.90.126.148:38593] [client 91.90.126.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.90.126.148, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "aSAujMklhXxmoIExII1T2AAAAIo"]
[Fri Nov 21 17:19:09.108650 2025] [:error] [pid 25554:tid 25561] [client 80.94.92.135:51444] [client 80.94.92.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.94.92.135, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/blog/wp-login.php"] [unique_id "aSAujR-NtB-9AzFZrk5yewAAAQM"]
[Fri Nov 21 17:19:10.044283 2025] [:error] [pid 25431:tid 25489] [client 188.126.94.239:59917] [client 188.126.94.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.126.94.239, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAujsklhXxmoIExII1T2gAAAII"]
[Fri Nov 21 17:19:10.049130 2025] [proxy_fcgi:error] [pid 25431:tid 25489] [client 188.126.94.239:59917] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 17:19:10.478311 2025] [:error] [pid 25429:tid 25441] [client 91.90.126.148:53201] [client 91.90.126.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.90.126.148, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "aSAujj4rZbRSr7vu-NPDkgAAAAg"]
[Fri Nov 21 17:19:10.741748 2025] [:error] [pid 25554:tid 25580] [client 149.50.211.79:8985] [client 149.50.211.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.50.211.79, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/store/wp-login.php"] [unique_id "aSAujh-NtB-9AzFZrk5yfAAAARY"]
[Fri Nov 21 17:19:11.314529 2025] [:error] [pid 25554:tid 25563] [client 51.210.111.14:41793] [client 51.210.111.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.111.14, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSAujx-NtB-9AzFZrk5yfgAAAQU"]
[Fri Nov 21 17:19:11.319283 2025] [proxy_fcgi:error] [pid 25554:tid 25563] [client 51.210.111.14:41793] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 17:19:11.761585 2025] [:error] [pid 25554:tid 25581] [client 51.210.111.14:37089] [client 51.210.111.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.111.14, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "aSAujx-NtB-9AzFZrk5ygAAAARc"]
[Fri Nov 21 17:19:15.213256 2025] [:error] [pid 46939:tid 46963] [client 154.90.39.89:35167] [client 154.90.39.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.90.39.89, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/shop/wp-login.php"] [unique_id "aSAuk-0OmVoxD4VZ_ZmaiQAAAVU"]
[Fri Nov 21 17:19:15.969379 2025] [:error] [pid 46939:tid 46957] [client 149.50.211.79:31462] [client 149.50.211.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.50.211.79, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/store/wp-login.php"] [unique_id "aSAuk-0OmVoxD4VZ_ZmaiwAAAU8"]
[Fri Nov 21 17:19:17.663617 2025] [:error] [pid 46939:tid 46953] [client 192.42.116.216:43265] [client 192.42.116.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.42.116.216, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/blog/wp-login.php"] [unique_id "aSAule0OmVoxD4VZ_ZmajwAAAUs"]
[Fri Nov 21 17:19:18.171849 2025] [:error] [pid 25430:tid 25471] [client 149.50.211.79:46644] [client 149.50.211.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.50.211.79, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/store/wp-login.php"] [unique_id "aSAulqpnWJcWt_4foXldlAAAAEs"]
[Fri Nov 21 17:19:19.909211 2025] [:error] [pid 25554:tid 25570] [client 195.78.54.149:40449] [client 195.78.54.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.78.54.149, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/store/wp-login.php"] [unique_id "aSAulx-NtB-9AzFZrk5yhgAAAQw"]
[Fri Nov 21 17:19:25.888735 2025] [:error] [pid 25554:tid 25568] [client 154.90.39.89:35437] [client 154.90.39.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.90.39.89, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/shop/wp-login.php"] [unique_id "aSAunR-NtB-9AzFZrk5yigAAAQo"]
[Fri Nov 21 17:19:34.422432 2025] [:error] [pid 25521:tid 25538] [client 185.220.101.130:4471] [client 185.220.101.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.220.101.130, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/blog/wp-login.php"] [unique_id "aSAupvhXnBMilDddn3UFMAAAAM8"]
[Fri Nov 21 17:19:35.280019 2025] [:error] [pid 25521:tid 25525] [client 154.90.39.89:35553] [client 154.90.39.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.90.39.89, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/shop/wp-login.php"] [unique_id "aSAup_hXnBMilDddn3UFNgAAAMI"]
[Fri Nov 21 17:19:37.697178 2025] [:error] [pid 25554:tid 25566] [client 45.138.16.69:31414] [client 45.138.16.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.138.16.69, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/shop/wp-login.php"] [unique_id "aSAuqR-NtB-9AzFZrk5ylAAAAQg"]
[Fri Nov 21 17:25:54.895932 2025] [proxy_fcgi:error] [pid 25430:tid 25467] [client 141.98.11.16:63994] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 17:25:55.512354 2025] [proxy_fcgi:error] [pid 25429:tid 25446] [client 141.98.11.16:51247] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 18:06:43.843579 2025] [proxy_fcgi:error] [pid 46939:tid 46957] [client 66.249.70.166:39068] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 20:26:20.006504 2025] [:error] [pid 25554:tid 25580] [client 43.130.60.195:38754] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSBabB-NtB-9AzFZrk6lhAAAARY"]
[Sat Nov 22 01:43:38.682086 2025] [proxy_fcgi:error] [pid 49641:tid 49847] [client 74.176.58.69:35781] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:38.819366 2025] [proxy_fcgi:error] [pid 49641:tid 49834] [client 74.176.58.69:35781] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:38.949825 2025] [proxy_fcgi:error] [pid 49641:tid 49829] [client 74.176.58.69:35781] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:39.072252 2025] [proxy_fcgi:error] [pid 49641:tid 49841] [client 74.176.58.69:35781] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:39.190450 2025] [proxy_fcgi:error] [pid 49641:tid 49826] [client 74.176.58.69:35781] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:39.316409 2025] [:error] [pid 49641:tid 49845] [client 74.176.58.69:35781] [client 74.176.58.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSCky1nhuiDak938N_a_SgAAABY"]
[Sat Nov 22 01:43:40.332115 2025] [proxy_fcgi:error] [pid 49643:tid 49938] [client 74.176.58.69:35724] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:40.457279 2025] [proxy_fcgi:error] [pid 49643:tid 49926] [client 74.176.58.69:35724] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:40.578320 2025] [proxy_fcgi:error] [pid 49643:tid 49935] [client 74.176.58.69:35724] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:40.715617 2025] [proxy_fcgi:error] [pid 49643:tid 49925] [client 74.176.58.69:35724] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:40.838085 2025] [proxy_fcgi:error] [pid 49643:tid 49937] [client 74.176.58.69:35724] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:43:41.122824 2025] [:error] [pid 49643:tid 49940] [client 74.176.58.69:35724] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aSCkzZwUojIRHhF_fj-UfgAAANQ"]
[Sat Nov 22 01:43:41.936318 2025] [:error] [pid 49641:tid 49830] [client 74.176.58.69:35829] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aSCkzVnhuiDak938N_a_TwAAAAc"]
[Sat Nov 22 01:43:42.576226 2025] [:error] [pid 9180:tid 9184] [client 74.176.58.69:35800] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aSCkzrrk9msixUFV2i-dswAAAEI"]
[Sat Nov 22 01:43:43.055484 2025] [:error] [pid 50057:tid 50064] [client 74.176.58.69:35835] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aSCkz1b9j9fTBoI0sRVQuQAAAQU"]
[Sat Nov 22 01:43:43.428418 2025] [:error] [pid 49643:tid 49923] [client 74.176.58.69:35823] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file7.php"] [unique_id "aSCkz5wUojIRHhF_fj-UgAAAAMQ"]
[Sat Nov 22 01:43:43.729417 2025] [:error] [pid 50057:tid 50069] [client 74.176.58.69:35791] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file7.php"] [unique_id "aSCkz1b9j9fTBoI0sRVQuwAAAQo"]
[Sat Nov 22 01:43:44.695421 2025] [:error] [pid 49641:tid 49847] [client 74.176.58.69:35807] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file7.php"] [unique_id "aSCk0FnhuiDak938N_a_UwAAABg"]
[Sat Nov 22 01:43:45.937201 2025] [:error] [pid 49642:tid 49892] [client 74.176.58.69:35816] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file7.php"] [unique_id "aSCk0YOXTPSuQfgUUtWWRQAAAIE"]
[Sat Nov 22 01:43:46.982932 2025] [:error] [pid 49641:tid 49829] [client 74.176.58.69:35721] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSCk0lnhuiDak938N_a_VgAAAAY"]
[Sat Nov 22 01:43:48.127415 2025] [:error] [pid 49642:tid 49895] [client 74.176.58.69:35792] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSCk1IOXTPSuQfgUUtWWRgAAAIQ"]
[Sat Nov 22 01:43:48.534775 2025] [:error] [pid 49642:tid 49904] [client 74.176.58.69:35839] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSCk1IOXTPSuQfgUUtWWSAAAAI0"]
[Sat Nov 22 01:43:48.818370 2025] [:error] [pid 49643:tid 49938] [client 74.176.58.69:35730] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSCk1JwUojIRHhF_fj-UhQAAANI"]
[Sat Nov 22 01:43:49.624476 2025] [:error] [pid 9180:tid 9183] [client 74.176.58.69:35714] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless2.php"] [unique_id "aSCk1brk9msixUFV2i-dvgAAAEE"]
[Sat Nov 22 01:43:50.490472 2025] [:error] [pid 49643:tid 49935] [client 74.176.58.69:35809] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless2.php"] [unique_id "aSCk1pwUojIRHhF_fj-UhwAAAM8"]
[Sat Nov 22 01:43:51.332772 2025] [:error] [pid 50057:tid 50060] [client 74.176.58.69:35716] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless2.php"] [unique_id "aSCk11b9j9fTBoI0sRVQwgAAAQE"]
[Sat Nov 22 01:43:51.812245 2025] [:error] [pid 49641:tid 49823] [client 74.176.58.69:35822] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless2.php"] [unique_id "aSCk11nhuiDak938N_a_WgAAAAA"]
[Sat Nov 22 01:43:52.741041 2025] [:error] [pid 49642:tid 49908] [client 74.176.58.69:35717] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "aSCk2IOXTPSuQfgUUtWWSwAAAJE"]
[Sat Nov 22 01:43:53.294229 2025] [:error] [pid 49642:tid 49903] [client 74.176.58.69:35787] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "aSCk2YOXTPSuQfgUUtWWTAAAAIw"]
[Sat Nov 22 01:43:53.772389 2025] [:error] [pid 9180:tid 9203] [client 74.176.58.69:35825] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "aSCk2brk9msixUFV2i-dwwAAAFU"]
[Sat Nov 22 01:43:54.082928 2025] [:error] [pid 50057:tid 50070] [client 74.176.58.69:35831] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "aSCk2lb9j9fTBoI0sRVQyAAAAQs"]
[Sat Nov 22 01:43:55.450537 2025] [:error] [pid 50057:tid 50076] [client 74.176.58.69:35785] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aSCk21b9j9fTBoI0sRVQyQAAARE"]
[Sat Nov 22 01:43:55.896460 2025] [:error] [pid 49641:tid 49833] [client 74.176.58.69:35802] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aSCk21nhuiDak938N_a_XgAAAAo"]
[Sat Nov 22 01:43:57.446840 2025] [:error] [pid 49642:tid 49901] [client 74.176.58.69:35833] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aSCk3YOXTPSuQfgUUtWWUQAAAIo"]
[Sat Nov 22 01:43:58.046449 2025] [:error] [pid 9180:tid 9183] [client 74.176.58.69:35837] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aSCk3rrk9msixUFV2i-dygAAAEE"]
[Sat Nov 22 01:43:58.857585 2025] [:error] [pid 49643:tid 49927] [client 74.176.58.69:35719] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsa.php"] [unique_id "aSCk3pwUojIRHhF_fj-UkAAAAMg"]
[Sat Nov 22 01:44:00.173510 2025] [:error] [pid 50057:tid 50072] [client 74.176.58.69:35817] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsa.php"] [unique_id "aSCk4Fb9j9fTBoI0sRVQzwAAAQ0"]
[Sat Nov 22 01:44:00.619273 2025] [:error] [pid 49642:tid 49906] [client 74.176.58.69:35824] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsa.php"] [unique_id "aSCk4IOXTPSuQfgUUtWWUgAAAI8"]
[Sat Nov 22 01:44:02.028070 2025] [:error] [pid 50057:tid 50063] [client 74.176.58.69:35803] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsa.php"] [unique_id "aSCk4lb9j9fTBoI0sRVQ0AAAAQQ"]
[Sat Nov 22 01:44:02.695618 2025] [:error] [pid 50057:tid 50067] [client 74.176.58.69:35801] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "aSCk4lb9j9fTBoI0sRVQ1AAAAQg"]
[Sat Nov 22 01:44:04.241129 2025] [:error] [pid 50057:tid 50081] [client 74.176.58.69:35821] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "aSCk5Fb9j9fTBoI0sRVQ1gAAARY"]
[Sat Nov 22 01:44:05.323901 2025] [:error] [pid 49642:tid 49907] [client 74.176.58.69:35737] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "aSCk5YOXTPSuQfgUUtWWWwAAAJA"]
[Sat Nov 22 01:44:05.923359 2025] [:error] [pid 49642:tid 49892] [client 74.176.58.69:35743] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "aSCk5YOXTPSuQfgUUtWWXgAAAIE"]
[Sat Nov 22 01:44:06.327378 2025] [:error] [pid 9180:tid 9194] [client 74.176.58.69:35780] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aSCk5rrk9msixUFV2i-dzwAAAEw"]
[Sat Nov 22 01:44:06.733794 2025] [:error] [pid 50057:tid 50065] [client 74.176.58.69:35779] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aSCk5lb9j9fTBoI0sRVQ1wAAAQY"]
[Sat Nov 22 01:44:07.467696 2025] [:error] [pid 9180:tid 9203] [client 74.176.58.69:35782] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aSCk57rk9msixUFV2i-d0QAAAFU"]
[Sat Nov 22 01:44:08.171343 2025] [:error] [pid 9180:tid 9206] [client 74.176.58.69:35739] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aSCk6Lrk9msixUFV2i-d0wAAAFg"]
[Sat Nov 22 01:44:08.879972 2025] [:error] [pid 9180:tid 9200] [client 74.176.58.69:35726] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSCk6Lrk9msixUFV2i-d1AAAAFI"]
[Sat Nov 22 01:44:09.320881 2025] [:error] [pid 9180:tid 9191] [client 74.176.58.69:35728] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSCk6brk9msixUFV2i-d1wAAAEk"]
[Sat Nov 22 01:44:09.923854 2025] [:error] [pid 49643:tid 49926] [client 74.176.58.69:35796] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSCk6ZwUojIRHhF_fj-UlgAAAMc"]
[Sat Nov 22 01:44:10.398024 2025] [:error] [pid 49642:tid 49905] [client 74.176.58.69:35722] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSCk6oOXTPSuQfgUUtWWawAAAI4"]
[Sat Nov 22 01:44:10.882110 2025] [:error] [pid 49642:tid 49911] [client 74.176.58.69:35775] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dejavu.php"] [unique_id "aSCk6oOXTPSuQfgUUtWWbAAAAJQ"]
[Sat Nov 22 01:44:11.458175 2025] [:error] [pid 49643:tid 49940] [client 74.176.58.69:35819] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dejavu.php"] [unique_id "aSCk65wUojIRHhF_fj-UmQAAANQ"]
[Sat Nov 22 01:44:12.475457 2025] [:error] [pid 49641:tid 49841] [client 74.176.58.69:35789] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dejavu.php"] [unique_id "aSCk7FnhuiDak938N_a_ZQAAABI"]
[Sat Nov 22 01:44:12.777085 2025] [:error] [pid 9180:tid 9199] [client 74.176.58.69:35774] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dejavu.php"] [unique_id "aSCk7Lrk9msixUFV2i-d2AAAAFE"]
[Sat Nov 22 01:44:13.274012 2025] [:error] [pid 9180:tid 9204] [client 74.176.58.69:35657] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSCk7brk9msixUFV2i-d3gAAAFY"]
[Sat Nov 22 01:44:13.608037 2025] [:error] [pid 9180:tid 9203] [client 74.176.58.69:35672] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSCk7brk9msixUFV2i-d4gAAAFU"]
[Sat Nov 22 01:44:13.932991 2025] [:error] [pid 49641:tid 49842] [client 74.176.58.69:35748] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSCk7VnhuiDak938N_a_awAAABM"]
[Sat Nov 22 01:44:14.594734 2025] [:error] [pid 50057:tid 50066] [client 74.176.58.69:35649] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSCk7lb9j9fTBoI0sRVQ3wAAAQc"]
[Sat Nov 22 01:44:15.157181 2025] [:error] [pid 49641:tid 49824] [client 74.176.58.69:35738] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSCk71nhuiDak938N_a_cwAAAAE"]
[Sat Nov 22 01:44:15.686327 2025] [:error] [pid 50057:tid 50067] [client 74.176.58.69:35808] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSCk71b9j9fTBoI0sRVQ4QAAAQg"]
[Sat Nov 22 01:44:16.506807 2025] [:error] [pid 49641:tid 49845] [client 74.176.58.69:35731] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSCk8FnhuiDak938N_a_eAAAABY"]
[Sat Nov 22 01:44:16.906061 2025] [:error] [pid 49642:tid 49915] [client 74.176.58.69:35747] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSCk8IOXTPSuQfgUUtWWggAAAJg"]
[Sat Nov 22 01:44:17.548159 2025] [:error] [pid 50057:tid 50080] [client 74.176.58.69:35834] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSCk8Vb9j9fTBoI0sRVQ4gAAARU"]
[Sat Nov 22 01:44:18.061508 2025] [:error] [pid 49642:tid 49914] [client 74.176.58.69:35797] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSCk8oOXTPSuQfgUUtWWhgAAAJc"]
[Sat Nov 22 01:44:19.220665 2025] [:error] [pid 49641:tid 49846] [client 74.176.58.69:35827] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSCk81nhuiDak938N_a_eQAAABc"]
[Sat Nov 22 01:44:19.875742 2025] [:error] [pid 50057:tid 50072] [client 74.176.58.69:35754] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSCk81b9j9fTBoI0sRVQ5gAAAQ0"]
[Sat Nov 22 01:44:20.467788 2025] [:error] [pid 49641:tid 49828] [client 74.176.58.69:35740] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/past.php"] [unique_id "aSCk9FnhuiDak938N_a_ewAAAAU"]
[Sat Nov 22 01:44:21.431922 2025] [:error] [pid 9180:tid 9186] [client 74.176.58.69:35836] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/past.php"] [unique_id "aSCk9brk9msixUFV2i-d6QAAAEQ"]
[Sat Nov 22 01:44:21.757760 2025] [:error] [pid 49642:tid 49903] [client 74.176.58.69:35648] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/past.php"] [unique_id "aSCk9YOXTPSuQfgUUtWWiwAAAIw"]
[Sat Nov 22 01:44:22.146505 2025] [:error] [pid 49643:tid 49927] [client 74.176.58.69:35725] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/past.php"] [unique_id "aSCk9pwUojIRHhF_fj-UsQAAAMg"]
[Sat Nov 22 01:44:22.701888 2025] [:error] [pid 49642:tid 49902] [client 74.176.58.69:35663] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSCk9oOXTPSuQfgUUtWWjgAAAIs"]
[Sat Nov 22 01:44:23.147065 2025] [:error] [pid 9180:tid 9188] [client 74.176.58.69:35659] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSCk97rk9msixUFV2i-d6wAAAEY"]
[Sat Nov 22 01:44:23.953595 2025] [:error] [pid 50057:tid 50066] [client 74.176.58.69:35735] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSCk91b9j9fTBoI0sRVQ6AAAAQc"]
[Sat Nov 22 01:44:25.066086 2025] [:error] [pid 9180:tid 9202] [client 74.176.58.69:35679] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSCk-brk9msixUFV2i-d7AAAAFQ"]
[Sat Nov 22 01:44:25.928996 2025] [:error] [pid 9180:tid 9203] [client 74.176.58.69:35786] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aSCk-brk9msixUFV2i-d8AAAAFU"]
[Sat Nov 22 01:44:26.429085 2025] [:error] [pid 9180:tid 9187] [client 74.176.58.69:35780] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aSCk-rrk9msixUFV2i-d8QAAAEU"]
[Sat Nov 22 01:44:27.004291 2025] [:error] [pid 49642:tid 49913] [client 74.176.58.69:35799] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aSCk-4OXTPSuQfgUUtWWkwAAAJY"]
[Sat Nov 22 01:44:27.540412 2025] [:error] [pid 9180:tid 9206] [client 74.176.58.69:35795] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aSCk-7rk9msixUFV2i-d9QAAAFg"]
[Sat Nov 22 01:44:27.938456 2025] [:error] [pid 49642:tid 49893] [client 74.176.58.69:35752] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aSCk-4OXTPSuQfgUUtWWlQAAAII"]
[Sat Nov 22 01:44:28.537144 2025] [:error] [pid 9180:tid 9189] [client 74.176.58.69:35661] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aSCk_Lrk9msixUFV2i-d9gAAAEc"]
[Sat Nov 22 01:44:28.962535 2025] [:error] [pid 49642:tid 49914] [client 74.176.58.69:35772] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aSCk_IOXTPSuQfgUUtWWmQAAAJc"]
[Sat Nov 22 01:44:29.623242 2025] [:error] [pid 49642:tid 49900] [client 74.176.58.69:35828] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aSCk_YOXTPSuQfgUUtWWnAAAAIk"]
[Sat Nov 22 01:44:30.767424 2025] [:error] [pid 49641:tid 49842] [client 74.176.58.69:35815] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSCk_lnhuiDak938N_a_hgAAABM"]
[Sat Nov 22 01:44:31.161655 2025] [:error] [pid 9180:tid 9199] [client 74.176.58.69:35713] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSCk_7rk9msixUFV2i-d-wAAAFE"]
[Sat Nov 22 01:44:31.681936 2025] [:error] [pid 49641:tid 49825] [client 74.176.58.69:35677] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSCk_1nhuiDak938N_a_iQAAAAI"]
[Sat Nov 22 01:44:32.193052 2025] [:error] [pid 9180:tid 9190] [client 74.176.58.69:35736] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSClALrk9msixUFV2i-d_gAAAEg"]
[Sat Nov 22 01:44:32.868468 2025] [:error] [pid 9180:tid 9196] [client 74.176.58.69:35804] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aSClALrk9msixUFV2i-eAAAAAE4"]
[Sat Nov 22 01:44:33.177814 2025] [:error] [pid 49641:tid 49824] [client 74.176.58.69:35744] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aSClAVnhuiDak938N_a_iwAAAAE"]
[Sat Nov 22 01:44:33.921248 2025] [:error] [pid 9180:tid 9206] [client 74.176.58.69:35832] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aSClAbrk9msixUFV2i-eBAAAAFg"]
[Sat Nov 22 01:44:34.275370 2025] [:error] [pid 49641:tid 49830] [client 74.176.58.69:35755] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aSClAlnhuiDak938N_a_jQAAAAc"]
[Sat Nov 22 01:44:34.854171 2025] [:error] [pid 49641:tid 49841] [client 74.176.58.69:35733] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/build.php"] [unique_id "aSClAlnhuiDak938N_a_kAAAABI"]
[Sat Nov 22 01:44:35.284386 2025] [:error] [pid 9180:tid 9189] [client 74.176.58.69:35723] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/build.php"] [unique_id "aSClA7rk9msixUFV2i-eCgAAAEc"]
[Sat Nov 22 01:44:36.142032 2025] [:error] [pid 50057:tid 50060] [client 74.176.58.69:35667] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/build.php"] [unique_id "aSClBFb9j9fTBoI0sRVQ7gAAAQE"]
[Sat Nov 22 01:44:36.788937 2025] [:error] [pid 9180:tid 9188] [client 74.176.58.69:35830] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/build.php"] [unique_id "aSClBLrk9msixUFV2i-eEQAAAEY"]
[Sat Nov 22 01:44:37.336610 2025] [:error] [pid 49642:tid 49898] [client 74.176.58.69:35762] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ot.php"] [unique_id "aSClBYOXTPSuQfgUUtWWpwAAAIc"]
[Sat Nov 22 01:44:38.314708 2025] [:error] [pid 50057:tid 50068] [client 74.176.58.69:35784] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ot.php"] [unique_id "aSClBlb9j9fTBoI0sRVQ8QAAAQk"]
[Sat Nov 22 01:44:38.714059 2025] [:error] [pid 49642:tid 49906] [client 74.176.58.69:35759] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ot.php"] [unique_id "aSClBoOXTPSuQfgUUtWWqwAAAI8"]
[Sat Nov 22 01:44:39.385766 2025] [:error] [pid 9180:tid 9198] [client 74.176.58.69:35812] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ot.php"] [unique_id "aSClB7rk9msixUFV2i-eGQAAAFA"]
[Sat Nov 22 01:44:39.778638 2025] [:error] [pid 9180:tid 9191] [client 74.176.58.69:35820] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lc.php"] [unique_id "aSClB7rk9msixUFV2i-eGgAAAEk"]
[Sat Nov 22 01:44:40.140754 2025] [proxy_fcgi:error] [pid 49643:tid 49924] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.281416 2025] [proxy_fcgi:error] [pid 49643:tid 49936] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.427773 2025] [proxy_fcgi:error] [pid 49643:tid 49929] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.563958 2025] [proxy_fcgi:error] [pid 49643:tid 49931] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.693664 2025] [proxy_fcgi:error] [pid 49643:tid 49920] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.812282 2025] [proxy_fcgi:error] [pid 49643:tid 49942] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:40.941267 2025] [proxy_fcgi:error] [pid 49643:tid 49943] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:41.074636 2025] [proxy_fcgi:error] [pid 49643:tid 49932] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:41.252650 2025] [proxy_fcgi:error] [pid 49643:tid 49922] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:41.432791 2025] [proxy_fcgi:error] [pid 49643:tid 49938] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:41.559400 2025] [proxy_fcgi:error] [pid 49643:tid 49930] [client 74.176.58.69:35758] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 01:44:41.886771 2025] [:error] [pid 49643:tid 49926] [client 74.176.58.69:35758] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "aSClCZwUojIRHhF_fj-U0gAAAMc"]
[Sat Nov 22 01:44:43.030104 2025] [:error] [pid 49641:tid 49825] [client 74.176.58.69:35771] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "aSClC1nhuiDak938N_a_wQAAAAI"]
[Sat Nov 22 01:44:43.726320 2025] [:error] [pid 49641:tid 49839] [client 74.176.58.69:35777] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "aSClC1nhuiDak938N_a_wwAAABA"]
[Sat Nov 22 01:44:44.100926 2025] [:error] [pid 49643:tid 49943] [client 74.176.58.69:35813] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "aSClDJwUojIRHhF_fj-U2wAAANc"]
[Sat Nov 22 01:44:44.772128 2025] [:error] [pid 49642:tid 49898] [client 74.176.58.69:35749] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSClDIOXTPSuQfgUUtWWuAAAAIc"]
[Sat Nov 22 01:44:45.217900 2025] [:error] [pid 49643:tid 49927] [client 74.176.58.69:35718] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSClDZwUojIRHhF_fj-U4QAAAMg"]
[Sat Nov 22 01:44:45.587976 2025] [:error] [pid 49642:tid 49900] [client 74.176.58.69:35760] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSClDYOXTPSuQfgUUtWWuwAAAIk"]
[Sat Nov 22 01:44:46.170249 2025] [:error] [pid 49642:tid 49904] [client 74.176.58.69:35670] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSClDoOXTPSuQfgUUtWWvQAAAI0"]
[Sat Nov 22 01:44:46.586993 2025] [:error] [pid 49641:tid 49841] [client 74.176.58.69:35811] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "aSClDlnhuiDak938N_a_yQAAABI"]
[Sat Nov 22 01:44:47.667507 2025] [:error] [pid 49642:tid 49902] [client 74.176.58.69:35655] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "aSClD4OXTPSuQfgUUtWWwgAAAIs"]
[Sat Nov 22 01:44:48.160085 2025] [:error] [pid 49641:tid 49829] [client 74.176.58.69:35688] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "aSClEFnhuiDak938N_a_ywAAAAY"]
[Sat Nov 22 01:44:49.475049 2025] [:error] [pid 49641:tid 49823] [client 74.176.58.69:35658] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "aSClEVnhuiDak938N_a_zgAAAAA"]
[Sat Nov 22 01:44:50.699506 2025] [:error] [pid 9180:tid 9183] [client 74.176.58.69:35788] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aSClErrk9msixUFV2i-eMAAAAEE"]
[Sat Nov 22 01:44:51.339873 2025] [:error] [pid 50057:tid 50076] [client 74.176.58.69:35715] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aSClE1b9j9fTBoI0sRVRCAAAARE"]
[Sat Nov 22 01:44:52.092816 2025] [:error] [pid 9180:tid 9201] [client 74.176.58.69:35764] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aSClFLrk9msixUFV2i-eMwAAAFM"]
[Sat Nov 22 01:44:52.438848 2025] [:error] [pid 49642:tid 49894] [client 74.176.58.69:35595] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aSClFIOXTPSuQfgUUtWWzAAAAIM"]
[Sat Nov 22 01:44:52.770149 2025] [:error] [pid 9180:tid 9204] [client 74.176.58.69:35683] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/faq.php"] [unique_id "aSClFLrk9msixUFV2i-eNQAAAFY"]
[Sat Nov 22 01:44:53.308848 2025] [:error] [pid 49643:tid 49926] [client 74.176.58.69:35702] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/faq.php"] [unique_id "aSClFZwUojIRHhF_fj-U9AAAAMc"]
[Sat Nov 22 01:44:53.744985 2025] [:error] [pid 50057:tid 50061] [client 74.176.58.69:35729] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/faq.php"] [unique_id "aSClFVb9j9fTBoI0sRVRDAAAAQI"]
[Sat Nov 22 01:44:54.327623 2025] [:error] [pid 49643:tid 49934] [client 74.176.58.69:35746] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/faq.php"] [unique_id "aSClFpwUojIRHhF_fj-U9wAAAM4"]
[Sat Nov 22 01:44:54.624487 2025] [:error] [pid 9180:tid 9186] [client 74.176.58.69:35613] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSClFrrk9msixUFV2i-eOQAAAEQ"]
[Sat Nov 22 01:44:55.134181 2025] [:error] [pid 49642:tid 49908] [client 74.176.58.69:35665] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSClF4OXTPSuQfgUUtWW1AAAAJE"]
[Sat Nov 22 01:44:55.688209 2025] [:error] [pid 49643:tid 49936] [client 74.176.58.69:35810] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSClF5wUojIRHhF_fj-U-gAAANA"]
[Sat Nov 22 01:44:57.201898 2025] [:error] [pid 49641:tid 49845] [client 74.176.58.69:35720] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSClGVnhuiDak938N_a_2AAAABY"]
[Sat Nov 22 01:44:57.858281 2025] [:error] [pid 9180:tid 9201] [client 74.176.58.69:35675] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aSClGbrk9msixUFV2i-eSAAAAFM"]
[Sat Nov 22 01:44:58.374594 2025] [:error] [pid 49643:tid 49923] [client 74.176.58.69:35700] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aSClGpwUojIRHhF_fj-VAgAAAMQ"]
[Sat Nov 22 01:44:58.991243 2025] [:error] [pid 50057:tid 50080] [client 74.176.58.69:35711] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aSClGlb9j9fTBoI0sRVRIQAAARU"]
[Sat Nov 22 01:44:59.694915 2025] [:error] [pid 49643:tid 49927] [client 74.176.58.69:35622] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CLA.php"] [unique_id "aSClG5wUojIRHhF_fj-VBAAAAMg"]
[Sat Nov 22 01:45:00.753296 2025] [:error] [pid 9180:tid 9205] [client 74.176.58.69:35689] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSClHLrk9msixUFV2i-eTwAAAFc"]
[Sat Nov 22 01:45:01.090943 2025] [:error] [pid 50057:tid 50075] [client 74.176.58.69:35650] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSClHVb9j9fTBoI0sRVRJAAAARA"]
[Sat Nov 22 01:45:02.090615 2025] [:error] [pid 9180:tid 9192] [client 74.176.58.69:35676] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSClHrrk9msixUFV2i-eUgAAAEo"]
[Sat Nov 22 01:45:02.813915 2025] [:error] [pid 49641:tid 49835] [client 74.176.58.69:35660] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSClHlnhuiDak938N_a_4gAAAAw"]
[Sat Nov 22 01:45:03.481204 2025] [:error] [pid 9180:tid 9188] [client 74.176.58.69:35826] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "aSClH7rk9msixUFV2i-eVwAAAEY"]
[Sat Nov 22 01:45:03.871461 2025] [:error] [pid 50057:tid 50059] [client 74.176.58.69:35703] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "aSClH1b9j9fTBoI0sRVRKAAAAQA"]
[Sat Nov 22 01:45:04.207607 2025] [:error] [pid 49642:tid 49902] [client 74.176.58.69:35668] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "aSClIIOXTPSuQfgUUtWW4wAAAIs"]
[Sat Nov 22 01:45:04.672767 2025] [:error] [pid 50057:tid 50067] [client 74.176.58.69:35734] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "aSClIFb9j9fTBoI0sRVRKgAAAQg"]
[Sat Nov 22 01:45:05.132255 2025] [:error] [pid 9180:tid 9186] [client 74.176.58.69:35750] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aSClIbrk9msixUFV2i-eXAAAAEQ"]
[Sat Nov 22 01:45:06.180613 2025] [:error] [pid 9180:tid 9184] [client 74.176.58.69:35601] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aSClIrrk9msixUFV2i-eXwAAAEI"]
[Sat Nov 22 01:45:06.780972 2025] [:error] [pid 9180:tid 9187] [client 74.176.58.69:35674] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aSClIrrk9msixUFV2i-eYAAAAEU"]
[Sat Nov 22 01:45:08.089976 2025] [:error] [pid 49643:tid 49923] [client 74.176.58.69:35770] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "aSClJJwUojIRHhF_fj-VDgAAAMQ"]
[Sat Nov 22 01:45:08.663337 2025] [:error] [pid 50057:tid 50080] [client 74.176.58.69:35589] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-logiin.php"] [unique_id "aSClJFb9j9fTBoI0sRVRMQAAARU"]
[Sat Nov 22 01:45:09.111610 2025] [:error] [pid 49642:tid 49893] [client 74.176.58.69:35794] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-logiin.php"] [unique_id "aSClJYOXTPSuQfgUUtWW6gAAAII"]
[Sat Nov 22 01:45:11.784517 2025] [:error] [pid 49643:tid 49930] [client 74.176.58.69:35612] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-logiin.php"] [unique_id "aSClJ5wUojIRHhF_fj-VEwAAAMo"]
[Sat Nov 22 01:45:13.405012 2025] [:error] [pid 9180:tid 9196] [client 74.176.58.69:35549] [client 74.176.58.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-logiin.php"] [unique_id "aSClKbrk9msixUFV2i-eagAAAE4"]
[Sat Nov 22 03:53:11.268764 2025] [:error] [pid 53566:tid 53585] [client 103.167.150.158:60984] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "aSDDJ8bSHDBkRbwMbd7w5QAAANE"]
[Sat Nov 22 04:01:57.342748 2025] [proxy_fcgi:error] [pid 53479:tid 53548] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:57.463796 2025] [proxy_fcgi:error] [pid 53479:tid 53544] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:57.594838 2025] [proxy_fcgi:error] [pid 53479:tid 53543] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:57.734427 2025] [proxy_fcgi:error] [pid 53479:tid 53536] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.016037 2025] [proxy_fcgi:error] [pid 53479:tid 53559] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.135159 2025] [proxy_fcgi:error] [pid 53479:tid 53552] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.448829 2025] [proxy_fcgi:error] [pid 53479:tid 53541] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.585794 2025] [proxy_fcgi:error] [pid 53479:tid 53538] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.765997 2025] [proxy_fcgi:error] [pid 53479:tid 53556] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:58.895281 2025] [proxy_fcgi:error] [pid 53479:tid 53546] [client 48.210.84.77:22471] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:01:59.020969 2025] [:error] [pid 53479:tid 53554] [client 48.210.84.77:22471] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp7.php"] [unique_id "aSDFN26cicFF3Aas-oQ_GQAAAJI"]
[Sat Nov 22 04:02:01.031191 2025] [:error] [pid 53478:tid 53513] [client 48.210.84.77:22490] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp7.php"] [unique_id "aSDFOQhUYdXBbQswAdTXxgAAAEQ"]
[Sat Nov 22 04:02:02.919737 2025] [:error] [pid 53478:tid 53524] [client 48.210.84.77:22408] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp7.php"] [unique_id "aSDFOghUYdXBbQswAdTXzQAAAE8"]
[Sat Nov 22 04:02:06.950355 2025] [:error] [pid 53478:tid 53530] [client 48.210.84.77:22356] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp7.php"] [unique_id "aSDFPghUYdXBbQswAdTX0QAAAFU"]
[Sat Nov 22 04:02:09.390032 2025] [:error] [pid 53566:tid 53570] [client 48.210.84.77:22484] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSDFQcbSHDBkRbwMbd71EQAAAMI"]
[Sat Nov 22 04:02:11.667681 2025] [:error] [pid 53566:tid 53579] [client 48.210.84.77:22415] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSDFQ8bSHDBkRbwMbd71FAAAAMs"]
[Sat Nov 22 04:02:12.874983 2025] [:error] [pid 53479:tid 53551] [client 48.210.84.77:22468] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSDFRG6cicFF3Aas-oQ_JgAAAI8"]
[Sat Nov 22 04:02:14.637171 2025] [:error] [pid 53478:tid 53519] [client 48.210.84.77:22403] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSDFRghUYdXBbQswAdTX2AAAAEo"]
[Sat Nov 22 04:02:16.959026 2025] [:error] [pid 53478:tid 53533] [client 48.210.84.77:22479] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "aSDFSAhUYdXBbQswAdTX3QAAAFg"]
[Sat Nov 22 04:02:18.609869 2025] [:error] [pid 53479:tid 53560] [client 48.210.84.77:22476] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "aSDFSm6cicFF3Aas-oQ_LQAAAJg"]
[Sat Nov 22 04:02:19.513141 2025] [:error] [pid 53566:tid 53575] [client 48.210.84.77:22413] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "aSDFS8bSHDBkRbwMbd71GgAAAMc"]
[Sat Nov 22 04:02:21.028343 2025] [:error] [pid 53478:tid 53512] [client 48.210.84.77:22472] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "aSDFTQhUYdXBbQswAdTX3wAAAEM"]
[Sat Nov 22 04:02:21.583165 2025] [:error] [pid 53477:tid 53488] [client 48.210.84.77:22496] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unwattled.php"] [unique_id "aSDFTX7Lu30Ku9O40aKlsQAAAAc"]
[Sat Nov 22 04:02:27.523858 2025] [:error] [pid 53477:tid 53484] [client 48.210.84.77:22487] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unwattled.php"] [unique_id "aSDFU37Lu30Ku9O40aKltgAAAAM"]
[Sat Nov 22 04:02:29.815854 2025] [:error] [pid 53477:tid 53503] [client 48.210.84.77:22405] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unwattled.php"] [unique_id "aSDFVX7Lu30Ku9O40aKluQAAABY"]
[Sat Nov 22 04:02:33.189473 2025] [:error] [pid 53477:tid 53484] [client 48.210.84.77:22501] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unwattled.php"] [unique_id "aSDFWX7Lu30Ku9O40aKlwQAAAAM"]
[Sat Nov 22 04:02:33.837926 2025] [:error] [pid 53566:tid 53591] [client 48.210.84.77:22488] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSDFWcbSHDBkRbwMbd71KAAAANc"]
[Sat Nov 22 04:02:34.917619 2025] [:error] [pid 53566:tid 53578] [client 48.210.84.77:22411] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSDFWsbSHDBkRbwMbd71LQAAAMo"]
[Sat Nov 22 04:02:36.074071 2025] [:error] [pid 53479:tid 53558] [client 48.210.84.77:22436] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSDFXG6cicFF3Aas-oQ_QAAAAJY"]
[Sat Nov 22 04:02:37.713566 2025] [:error] [pid 53478:tid 53516] [client 48.210.84.77:22514] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSDFXQhUYdXBbQswAdTX7QAAAEc"]
[Sat Nov 22 04:02:40.448088 2025] [:error] [pid 53479:tid 53551] [client 48.210.84.77:22520] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-front.php"] [unique_id "aSDFYG6cicFF3Aas-oQ_RgAAAI8"]
[Sat Nov 22 04:02:41.278115 2025] [:error] [pid 53566:tid 53582] [client 48.210.84.77:22464] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-front.php"] [unique_id "aSDFYcbSHDBkRbwMbd71NAAAAM4"]
[Sat Nov 22 04:02:44.037444 2025] [:error] [pid 53479:tid 53545] [client 48.210.84.77:22419] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-front.php"] [unique_id "aSDFZG6cicFF3Aas-oQ_SQAAAIk"]
[Sat Nov 22 04:02:44.990357 2025] [:error] [pid 53479:tid 53542] [client 48.210.84.77:22510] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-front.php"] [unique_id "aSDFZG6cicFF3Aas-oQ_SwAAAIY"]
[Sat Nov 22 04:02:45.813363 2025] [:error] [pid 53566:tid 53575] [client 48.210.84.77:22465] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aSDFZcbSHDBkRbwMbd71OwAAAMc"]
[Sat Nov 22 04:02:47.077028 2025] [:error] [pid 53478:tid 53518] [client 48.210.84.77:22417] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aSDFZwhUYdXBbQswAdTX8gAAAEk"]
[Sat Nov 22 04:02:47.579098 2025] [:error] [pid 53566:tid 53582] [client 48.210.84.77:22483] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aSDFZ8bSHDBkRbwMbd71PwAAAM4"]
[Sat Nov 22 04:02:49.449938 2025] [:error] [pid 53566:tid 53584] [client 48.210.84.77:22402] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtt.php"] [unique_id "aSDFacbSHDBkRbwMbd71QQAAANA"]
[Sat Nov 22 04:02:51.101600 2025] [:error] [pid 53566:tid 53587] [client 48.210.84.77:22406] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSDFa8bSHDBkRbwMbd71QwAAANM"]
[Sat Nov 22 04:02:53.543109 2025] [:error] [pid 53566:tid 53577] [client 48.210.84.77:22506] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSDFbcbSHDBkRbwMbd71SgAAAMk"]
[Sat Nov 22 04:02:55.948791 2025] [:error] [pid 53566:tid 53592] [client 48.210.84.77:22414] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aSDFb8bSHDBkRbwMbd71TAAAANg"]
[Sat Nov 22 04:03:00.048702 2025] [proxy_fcgi:error] [pid 53477:tid 53505] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.175371 2025] [proxy_fcgi:error] [pid 53477:tid 53493] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.305638 2025] [proxy_fcgi:error] [pid 53477:tid 53504] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.425740 2025] [proxy_fcgi:error] [pid 53477:tid 53490] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.553833 2025] [proxy_fcgi:error] [pid 53477:tid 53499] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.671248 2025] [proxy_fcgi:error] [pid 53477:tid 53489] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.792181 2025] [proxy_fcgi:error] [pid 53477:tid 53484] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:00.920832 2025] [proxy_fcgi:error] [pid 53477:tid 53501] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:01.041765 2025] [proxy_fcgi:error] [pid 53477:tid 53497] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:01.162026 2025] [proxy_fcgi:error] [pid 53477:tid 53494] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:01.288655 2025] [proxy_fcgi:error] [pid 53477:tid 53488] [client 48.210.84.77:22504] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:03:01.446566 2025] [:error] [pid 53477:tid 53482] [client 48.210.84.77:22504] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hans.php"] [unique_id "aSDFdX7Lu30Ku9O40aKl4QAAAAE"]
[Sat Nov 22 04:03:02.650623 2025] [:error] [pid 53566:tid 53585] [client 48.210.84.77:22526] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hans.php"] [unique_id "aSDFdsbSHDBkRbwMbd71WgAAANE"]
[Sat Nov 22 04:03:03.207505 2025] [:error] [pid 53477:tid 53483] [client 48.210.84.77:22495] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hans.php"] [unique_id "aSDFd37Lu30Ku9O40aKl4wAAAAI"]
[Sat Nov 22 04:03:05.571999 2025] [:error] [pid 53478:tid 53512] [client 48.210.84.77:22470] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hans.php"] [unique_id "aSDFeQhUYdXBbQswAdTYAwAAAEM"]
[Sat Nov 22 04:03:08.265891 2025] [:error] [pid 53478:tid 53525] [client 48.210.84.77:22508] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/krypton.php"] [unique_id "aSDFfAhUYdXBbQswAdTYBQAAAFA"]
[Sat Nov 22 04:03:10.137639 2025] [:error] [pid 53479:tid 53536] [client 48.210.84.77:22502] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/krypton.php"] [unique_id "aSDFfm6cicFF3Aas-oQ_WwAAAIA"]
[Sat Nov 22 04:03:10.979269 2025] [:error] [pid 53566:tid 53577] [client 48.210.84.77:22420] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/krypton.php"] [unique_id "aSDFfsbSHDBkRbwMbd71ZAAAAMk"]
[Sat Nov 22 04:03:13.293881 2025] [:error] [pid 53479:tid 53550] [client 48.210.84.77:22486] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/krypton.php"] [unique_id "aSDFgW6cicFF3Aas-oQ_XwAAAI4"]
[Sat Nov 22 04:03:16.564766 2025] [:error] [pid 53477:tid 53497] [client 48.210.84.77:22358] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acholuria.php"] [unique_id "aSDFhH7Lu30Ku9O40aKl9gAAABA"]
[Sat Nov 22 04:03:19.913981 2025] [:error] [pid 53566:tid 53588] [client 48.210.84.77:22422] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acholuria.php"] [unique_id "aSDFh8bSHDBkRbwMbd71cQAAANQ"]
[Sat Nov 22 04:03:20.576112 2025] [:error] [pid 53478:tid 53520] [client 48.210.84.77:22517] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acholuria.php"] [unique_id "aSDFiAhUYdXBbQswAdTYDAAAAEs"]
[Sat Nov 22 04:03:22.236497 2025] [:error] [pid 53479:tid 53558] [client 48.210.84.77:22503] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acholuria.php"] [unique_id "aSDFim6cicFF3Aas-oQ_ZQAAAJY"]
[Sat Nov 22 04:03:23.588062 2025] [:error] [pid 53478:tid 53525] [client 48.210.84.77:22507] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSDFiwhUYdXBbQswAdTYEQAAAFA"]
[Sat Nov 22 04:03:25.244579 2025] [:error] [pid 53479:tid 53547] [client 48.210.84.77:22451] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSDFjW6cicFF3Aas-oQ_ZgAAAIs"]
[Sat Nov 22 04:03:28.190112 2025] [:error] [pid 53566:tid 53579] [client 48.210.84.77:22429] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSDFkMbSHDBkRbwMbd71eAAAAMs"]
[Sat Nov 22 04:03:34.435816 2025] [:error] [pid 53479:tid 53557] [client 48.210.84.77:22515] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSDFlm6cicFF3Aas-oQ_bgAAAJU"]
[Sat Nov 22 04:03:38.104805 2025] [:error] [pid 53566:tid 53571] [client 48.210.84.77:22410] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "aSDFmsbSHDBkRbwMbd71kgAAAMM"]
[Sat Nov 22 04:03:42.736201 2025] [:error] [pid 53477:tid 53499] [client 48.210.84.77:22524] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "aSDFnn7Lu30Ku9O40aKmEwAAABI"]
[Sat Nov 22 04:03:44.844152 2025] [:error] [pid 53478:tid 53511] [client 48.210.84.77:22481] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "aSDFoAhUYdXBbQswAdTYIAAAAEI"]
[Sat Nov 22 04:03:45.398851 2025] [:error] [pid 53478:tid 53528] [client 48.210.84.77:22449] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "aSDFoQhUYdXBbQswAdTYIQAAAFM"]
[Sat Nov 22 04:03:46.291033 2025] [:error] [pid 53478:tid 53522] [client 48.210.84.77:22400] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ghreshttryu.php"] [unique_id "aSDFoghUYdXBbQswAdTYIwAAAE0"]
[Sat Nov 22 04:03:46.952264 2025] [:error] [pid 53479:tid 53553] [client 48.210.84.77:22421] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ghreshttryu.php"] [unique_id "aSDFom6cicFF3Aas-oQ_fAAAAJE"]
[Sat Nov 22 04:03:48.740825 2025] [:error] [pid 53479:tid 53538] [client 48.210.84.77:22423] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ghreshttryu.php"] [unique_id "aSDFpG6cicFF3Aas-oQ_gQAAAII"]
[Sat Nov 22 04:03:49.810320 2025] [:error] [pid 53566:tid 53585] [client 48.210.84.77:22355] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ghreshttryu.php"] [unique_id "aSDFpcbSHDBkRbwMbd71pQAAANE"]
[Sat Nov 22 04:03:51.026476 2025] [:error] [pid 53566:tid 53590] [client 48.210.84.77:22430] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aporrhiegma.php"] [unique_id "aSDFp8bSHDBkRbwMbd71pwAAANY"]
[Sat Nov 22 04:03:51.930283 2025] [:error] [pid 53566:tid 53582] [client 48.210.84.77:22523] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aporrhiegma.php"] [unique_id "aSDFp8bSHDBkRbwMbd71rAAAAM4"]
[Sat Nov 22 04:03:56.733216 2025] [:error] [pid 53479:tid 53556] [client 48.210.84.77:22525] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aporrhiegma.php"] [unique_id "aSDFrG6cicFF3Aas-oQ_jAAAAJQ"]
[Sat Nov 22 04:03:58.716057 2025] [:error] [pid 53478:tid 53517] [client 48.210.84.77:22527] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aporrhiegma.php"] [unique_id "aSDFrghUYdXBbQswAdTYKwAAAEg"]
[Sat Nov 22 04:04:01.103806 2025] [proxy_fcgi:error] [pid 53478:tid 53532] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:01.224024 2025] [proxy_fcgi:error] [pid 53478:tid 53530] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:01.469747 2025] [proxy_fcgi:error] [pid 53478:tid 53522] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:01.604798 2025] [proxy_fcgi:error] [pid 53478:tid 53509] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:01.887105 2025] [proxy_fcgi:error] [pid 53478:tid 53513] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.172807 2025] [proxy_fcgi:error] [pid 53478:tid 53520] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.293204 2025] [proxy_fcgi:error] [pid 53478:tid 53515] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.410770 2025] [proxy_fcgi:error] [pid 53478:tid 53527] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.536849 2025] [proxy_fcgi:error] [pid 53478:tid 53518] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.654029 2025] [proxy_fcgi:error] [pid 53478:tid 53523] [client 48.210.84.77:22350] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:04:02.769833 2025] [:error] [pid 53478:tid 53525] [client 48.210.84.77:22350] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atex1.php"] [unique_id "aSDFsghUYdXBbQswAdTYOwAAAFA"]
[Sat Nov 22 04:04:04.548083 2025] [:error] [pid 53566:tid 53577] [client 48.210.84.77:22349] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atex1.php"] [unique_id "aSDFtMbSHDBkRbwMbd71wgAAAMk"]
[Sat Nov 22 04:04:08.057901 2025] [:error] [pid 53478:tid 53514] [client 48.210.84.77:22511] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atex1.php"] [unique_id "aSDFuAhUYdXBbQswAdTYPwAAAEU"]
[Sat Nov 22 04:04:11.377975 2025] [:error] [pid 53479:tid 53548] [client 48.210.84.77:22369] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atex1.php"] [unique_id "aSDFu26cicFF3Aas-oQ_nwAAAIw"]
[Sat Nov 22 04:04:14.801903 2025] [:error] [pid 53566:tid 53579] [client 48.210.84.77:22409] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/attaining.php"] [unique_id "aSDFvsbSHDBkRbwMbd710wAAAMs"]
[Sat Nov 22 04:04:20.235272 2025] [:error] [pid 53566:tid 53587] [client 48.210.84.77:22497] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/attaining.php"] [unique_id "aSDFxMbSHDBkRbwMbd713wAAANM"]
[Sat Nov 22 04:04:22.121783 2025] [:error] [pid 53478:tid 53516] [client 48.210.84.77:22456] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/attaining.php"] [unique_id "aSDFxghUYdXBbQswAdTYUAAAAEc"]
[Sat Nov 22 04:04:22.945975 2025] [:error] [pid 53477:tid 53492] [client 48.210.84.77:22364] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/attaining.php"] [unique_id "aSDFxn7Lu30Ku9O40aKmOAAAAAs"]
[Sat Nov 22 04:04:23.983169 2025] [:error] [pid 53566:tid 53577] [client 48.210.84.77:22513] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bunnies.php"] [unique_id "aSDFx8bSHDBkRbwMbd714wAAAMk"]
[Sat Nov 22 04:04:25.490848 2025] [:error] [pid 53566:tid 53571] [client 48.210.84.77:22446] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bunnies.php"] [unique_id "aSDFycbSHDBkRbwMbd715wAAAMM"]
[Sat Nov 22 04:04:32.879354 2025] [:error] [pid 53477:tid 53502] [client 48.210.84.77:22352] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bunnies.php"] [unique_id "aSDF0H7Lu30Ku9O40aKmQQAAABU"]
[Sat Nov 22 04:04:35.416006 2025] [:error] [pid 53478:tid 53532] [client 48.210.84.77:22433] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bunnies.php"] [unique_id "aSDF0whUYdXBbQswAdTYZAAAAFc"]
[Sat Nov 22 04:04:37.980281 2025] [:error] [pid 53479:tid 53547] [client 48.210.84.77:22351] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/frenchwomen.php"] [unique_id "aSDF1W6cicFF3Aas-oQ_vwAAAIs"]
[Sat Nov 22 04:04:40.206473 2025] [:error] [pid 53566:tid 53572] [client 48.210.84.77:22440] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/frenchwomen.php"] [unique_id "aSDF2MbSHDBkRbwMbd71-gAAAMQ"]
[Sat Nov 22 04:04:53.019611 2025] [:error] [pid 53477:tid 53505] [client 48.210.84.77:22426] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/glucosidase.php"] [unique_id "aSDF5X7Lu30Ku9O40aKmWwAAABg"]
[Sat Nov 22 04:05:01.933745 2025] [:error] [pid 53478:tid 53521] [client 48.210.84.77:22505] [client 48.210.84.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/glucosidase.php"] [unique_id "aSDF7QhUYdXBbQswAdTYbwAAAEw"]
[Sat Nov 22 04:05:12.352688 2025] [proxy_fcgi:error] [pid 53479:tid 53555] [client 48.210.84.77:22432] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:05:12.489318 2025] [proxy_fcgi:error] [pid 53479:tid 53551] [client 48.210.84.77:22432] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:05:12.607448 2025] [proxy_fcgi:error] [pid 53479:tid 53559] [client 48.210.84.77:22432] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:05:12.727052 2025] [proxy_fcgi:error] [pid 53479:tid 53540] [client 48.210.84.77:22432] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:05:12.858393 2025] [proxy_fcgi:error] [pid 53479:tid 53556] [client 48.210.84.77:22432] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:40:31.187447 2025] [:error] [pid 53566:tid 53590] [client 49.51.245.241:35592] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSDOP8bSHDBkRbwMbd4LCQAAANY"]
[Sat Nov 22 06:56:49.317699 2025] [:error] [pid 53566:tid 53573] [client 212.116.231.26:52612] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSDuMcbSHDBkRbwMbd5nuQAAAMU"]
[Sat Nov 22 06:56:50.154029 2025] [:error] [pid 9547:tid 9563] [client 212.116.231.26:45892] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSDuMtClOR5qk7DoMeGl6QAAAUo"]
[Sat Nov 22 06:56:50.986517 2025] [:error] [pid 9547:tid 9556] [client 212.116.231.26:46426] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSDuMtClOR5qk7DoMeGl-gAAAUM"]
[Sat Nov 22 06:56:51.821402 2025] [:error] [pid 53478:tid 53532] [client 212.116.231.26:46948] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSDuMwhUYdXBbQswAdRAcwAAAFc"]
[Sat Nov 22 06:56:52.635179 2025] [:error] [pid 53566:tid 53588] [client 212.116.231.26:47368] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSDuNMbSHDBkRbwMbd5n_QAAANQ"]
[Sat Nov 22 06:56:53.469537 2025] [:error] [pid 25856:tid 25859] [client 212.116.231.26:47824] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNRsTP0wy94zKUvHoFwAAAQE"]
[Sat Nov 22 06:56:54.293049 2025] [:error] [pid 53566:tid 53580] [client 212.116.231.26:48232] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNsbSHDBkRbwMbd5oCAAAAMw"]
[Sat Nov 22 06:56:55.125691 2025] [:error] [pid 25856:tid 25879] [client 212.116.231.26:48594] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuNxsTP0wy94zKUvHoJgAAARU"]
[Sat Nov 22 06:56:55.938843 2025] [:error] [pid 53477:tid 53494] [client 212.116.231.26:48898] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuN37Lu30Ku9O40aIHawAAAA0"]
[Sat Nov 22 06:56:56.772368 2025] [:error] [pid 25856:tid 25871] [client 212.116.231.26:49112] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOBsTP0wy94zKUvHoPgAAAQ0"]
[Sat Nov 22 10:56:52.053509 2025] [autoindex:error] [pid 9547:tid 9567] [client 139.59.37.180:50127] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 22 18:17:28.225946 2025] [proxy_fcgi:error] [pid 9547:tid 9576] [client 52.156.220.49:11653] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:17:28.484972 2025] [proxy_fcgi:error] [pid 9547:tid 9570] [client 52.156.220.49:11653] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:17:28.999294 2025] [proxy_fcgi:error] [pid 9547:tid 9577] [client 52.156.220.49:11653] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:17:29.255750 2025] [proxy_fcgi:error] [pid 9547:tid 9567] [client 52.156.220.49:11653] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:17:29.561700 2025] [proxy_fcgi:error] [pid 9547:tid 9575] [client 52.156.220.49:11653] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:17:29.832163 2025] [:error] [pid 9547:tid 9558] [client 52.156.220.49:11653] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/network.php"] [unique_id "aSGNudClOR5qk7DoMeGmRgAAAUU"]
[Sat Nov 22 18:17:31.199228 2025] [:error] [pid 44259:tid 44277] [client 52.156.220.49:11932] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aSGNu3Xe1xL-_YOdRmRk2AAAAY8"]
[Sat Nov 22 18:17:32.938262 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:11932] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSGNvHXe1xL-_YOdRmRk5AAAAZA"]
[Sat Nov 22 18:17:35.765132 2025] [:error] [pid 53566:tid 53587] [client 52.156.220.49:14640] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSGNv8bSHDBkRbwMbd4hKAAAANM"]
[Sat Nov 22 18:17:38.057838 2025] [:error] [pid 53566:tid 53582] [client 52.156.220.49:18113] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSGNwsbSHDBkRbwMbd4hLgAAAM4"]
[Sat Nov 22 18:17:38.925800 2025] [:error] [pid 53479:tid 53544] [client 52.156.220.49:4708] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSGNwm6cicFF3Aas-oSEwwAAAIg"]
[Sat Nov 22 18:17:46.172750 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:17722] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSGNynXe1xL-_YOdRmRlAAAAAZY"]
[Sat Nov 22 18:17:47.805787 2025] [:error] [pid 25856:tid 25865] [client 52.156.220.49:16690] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSGNyxsTP0wy94zKUvGxHQAAAQc"]
[Sat Nov 22 18:17:51.993617 2025] [:error] [pid 53477:tid 53500] [client 52.156.220.49:5703] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSGNz37Lu30Ku9O40aKxhQAAABM"]
[Sat Nov 22 18:17:53.484718 2025] [:error] [pid 25856:tid 25859] [client 52.156.220.49:9285] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSGN0RsTP0wy94zKUvGxHwAAAQE"]
[Sat Nov 22 18:18:02.851204 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:12086] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ty.php"] [unique_id "aSGN2nXe1xL-_YOdRmRlIgAAAZY"]
[Sat Nov 22 18:18:11.189667 2025] [:error] [pid 25856:tid 25882] [client 52.156.220.49:8586] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aSGN4xsTP0wy94zKUvGxLgAAARg"]
[Sat Nov 22 18:18:12.902018 2025] [:error] [pid 44259:tid 44276] [client 52.156.220.49:9323] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aSGN5HXe1xL-_YOdRmRlMQAAAY4"]
[Sat Nov 22 18:18:15.871417 2025] [:error] [pid 9547:tid 9555] [client 52.156.220.49:14044] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aSGN59ClOR5qk7DoMeGmfwAAAUI"]
[Sat Nov 22 18:18:18.105158 2025] [:error] [pid 53478:tid 53511] [client 52.156.220.49:4673] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aSGN6ghUYdXBbQswAdTvIAAAAEI"]
[Sat Nov 22 18:18:19.149244 2025] [:error] [pid 25856:tid 25881] [client 52.156.220.49:1133] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSGN6xsTP0wy94zKUvGxNgAAARc"]
[Sat Nov 22 18:18:21.041671 2025] [:error] [pid 53477:tid 53503] [client 52.156.220.49:18508] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGN7X7Lu30Ku9O40aKxrgAAABY"]
[Sat Nov 22 18:18:22.483050 2025] [:error] [pid 25856:tid 25879] [client 52.156.220.49:1924] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGN7hsTP0wy94zKUvGxOQAAARU"]
[Sat Nov 22 18:18:24.149118 2025] [:error] [pid 53478:tid 53523] [client 52.156.220.49:12652] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGN8AhUYdXBbQswAdTvJwAAAE4"]
[Sat Nov 22 18:18:49.398045 2025] [proxy_fcgi:error] [pid 44259:tid 44285] [client 52.156.220.49:20873] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:18:50.546241 2025] [proxy_fcgi:error] [pid 44259:tid 44273] [client 52.156.220.49:20873] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:18:50.804169 2025] [proxy_fcgi:error] [pid 44259:tid 44278] [client 52.156.220.49:20873] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:18:51.577061 2025] [proxy_fcgi:error] [pid 44259:tid 44281] [client 52.156.220.49:20873] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:18:51.828272 2025] [:error] [pid 44259:tid 44275] [client 52.156.220.49:20873] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSGOC3Xe1xL-_YOdRmRldAAAAY0"]
[Sat Nov 22 18:18:54.248701 2025] [:error] [pid 44259:tid 44270] [client 52.156.220.49:12376] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSGODnXe1xL-_YOdRmRlegAAAYg"]
[Sat Nov 22 18:19:18.236152 2025] [:error] [pid 9547:tid 9576] [client 52.156.220.49:12122] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/install.php"] [unique_id "aSGOJtClOR5qk7DoMeGnBwAAAVc"]
[Sat Nov 22 18:19:20.783379 2025] [:error] [pid 25856:tid 25862] [client 52.156.220.49:18910] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/install.php"] [unique_id "aSGOKBsTP0wy94zKUvGxbgAAAQQ"]
[Sat Nov 22 18:19:23.603523 2025] [:error] [pid 9547:tid 9556] [client 52.156.220.49:16907] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/install.php"] [unique_id "aSGOK9ClOR5qk7DoMeGnCQAAAUM"]
[Sat Nov 22 18:19:25.000415 2025] [:error] [pid 9547:tid 9569] [client 52.156.220.49:8618] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/install.php"] [unique_id "aSGOLNClOR5qk7DoMeGnDQAAAVA"]
[Sat Nov 22 18:19:29.468307 2025] [:error] [pid 53478:tid 53533] [client 52.156.220.49:7558] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/link.php"] [unique_id "aSGOMQhUYdXBbQswAdTvZAAAAFg"]
[Sat Nov 22 18:19:30.726155 2025] [:error] [pid 25856:tid 25872] [client 52.156.220.49:9266] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/link.php"] [unique_id "aSGOMhsTP0wy94zKUvGxeAAAAQ4"]
[Sat Nov 22 18:19:32.727245 2025] [:error] [pid 25856:tid 25866] [client 52.156.220.49:16906] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/link.php"] [unique_id "aSGONBsTP0wy94zKUvGxeQAAAQg"]
[Sat Nov 22 18:19:34.961310 2025] [:error] [pid 25856:tid 25862] [client 52.156.220.49:8626] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/link.php"] [unique_id "aSGONhsTP0wy94zKUvGxfQAAAQQ"]
[Sat Nov 22 18:19:37.235376 2025] [:error] [pid 53566:tid 53590] [client 52.156.220.49:19301] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "aSGOOcbSHDBkRbwMbd4iMQAAANY"]
[Sat Nov 22 18:19:38.489237 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:1206] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "aSGOOsbSHDBkRbwMbd4iMwAAAMo"]
[Sat Nov 22 18:19:39.720723 2025] [:error] [pid 53477:tid 53491] [client 52.156.220.49:16959] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "aSGOO37Lu30Ku9O40aKyBQAAAAo"]
[Sat Nov 22 18:19:42.739239 2025] [:error] [pid 53478:tid 53530] [client 52.156.220.49:18534] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "aSGOPghUYdXBbQswAdTvdgAAAFU"]
[Sat Nov 22 18:19:43.930223 2025] [:error] [pid 53479:tid 53559] [client 52.156.220.49:11910] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "aSGOP26cicFF3Aas-oSFnAAAAJc"]
[Sat Nov 22 18:19:45.471398 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:19320] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "aSGOQXXe1xL-_YOdRmRlzgAAAYA"]
[Sat Nov 22 18:19:53.406116 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:22864] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "aSGOSXXe1xL-_YOdRmRl2QAAAZI"]
[Sat Nov 22 18:19:55.507227 2025] [:error] [pid 9547:tid 9562] [client 52.156.220.49:11263] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "aSGOS9ClOR5qk7DoMeGnRQAAAUk"]
[Sat Nov 22 18:19:56.508954 2025] [:error] [pid 53566:tid 53590] [client 52.156.220.49:19722] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "aSGOTMbSHDBkRbwMbd4iTQAAANY"]
[Sat Nov 22 18:19:58.056188 2025] [:error] [pid 44259:tid 44269] [client 52.156.220.49:11720] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "aSGOTnXe1xL-_YOdRmRl4AAAAYc"]
[Sat Nov 22 18:19:59.019408 2025] [:error] [pid 53477:tid 53489] [client 52.156.220.49:15004] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "aSGOT37Lu30Ku9O40aKyNAAAAAg"]
[Sat Nov 22 18:20:01.232270 2025] [:error] [pid 53477:tid 53494] [client 52.156.220.49:15015] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "aSGOUX7Lu30Ku9O40aKyOAAAAA0"]
[Sat Nov 22 18:20:05.673112 2025] [:error] [pid 53477:tid 53483] [client 52.156.220.49:14613] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "aSGOVX7Lu30Ku9O40aKyRAAAAAI"]
[Sat Nov 22 18:20:19.345274 2025] [:error] [pid 44259:tid 44281] [client 52.156.220.49:14597] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aSGOY3Xe1xL-_YOdRmRl-AAAAZM"]
[Sat Nov 22 18:20:20.558713 2025] [:error] [pid 44259:tid 44277] [client 52.156.220.49:14597] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/preferences/index.php"] [unique_id "aSGOZHXe1xL-_YOdRmRl_gAAAY8"]
[Sat Nov 22 18:20:22.957529 2025] [:error] [pid 53479:tid 53539] [client 52.156.220.49:22885] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/index.php"] [unique_id "aSGOZm6cicFF3Aas-oSF7gAAAIM"]
[Sat Nov 22 18:20:30.147502 2025] [proxy_fcgi:error] [pid 53566:tid 53576] [client 52.156.220.49:9281] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:20:30.399658 2025] [:error] [pid 53566:tid 53580] [client 52.156.220.49:9281] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "aSGObsbSHDBkRbwMbd4iagAAAMw"]
[Sat Nov 22 18:20:31.702878 2025] [:error] [pid 25856:tid 25878] [client 52.156.220.49:20252] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/vuln.php"] [unique_id "aSGObxsTP0wy94zKUvGxogAAARQ"]
[Sat Nov 22 18:20:32.986861 2025] [:error] [pid 25856:tid 25859] [client 52.156.220.49:1538] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSGOcBsTP0wy94zKUvGxpAAAAQE"]
[Sat Nov 22 18:20:35.171481 2025] [:error] [pid 53479:tid 53560] [client 52.156.220.49:5658] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSGOc26cicFF3Aas-oSF-QAAAJg"]
[Sat Nov 22 18:20:38.394599 2025] [proxy_fcgi:error] [pid 44259:tid 44270] [client 52.156.220.49:10514] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:20:38.929119 2025] [proxy_fcgi:error] [pid 44259:tid 44262] [client 52.156.220.49:10514] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:20:39.215583 2025] [proxy_fcgi:error] [pid 44259:tid 44283] [client 52.156.220.49:10514] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:20:39.473031 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:10514] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSGOd3Xe1xL-_YOdRmRmFAAAAYI"]
[Sat Nov 22 18:20:40.977193 2025] [:error] [pid 53479:tid 53539] [client 52.156.220.49:9280] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSGOeG6cicFF3Aas-oSF-wAAAIM"]
[Sat Nov 22 18:20:43.114926 2025] [:error] [pid 9547:tid 9573] [client 52.156.220.49:6583] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSGOe9ClOR5qk7DoMeGnZwAAAVQ"]
[Sat Nov 22 18:20:44.056383 2025] [:error] [pid 25856:tid 25877] [client 52.156.220.49:10521] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSGOfBsTP0wy94zKUvGxqAAAARM"]
[Sat Nov 22 18:20:45.593562 2025] [:error] [pid 53478:tid 53517] [client 52.156.220.49:1784] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12wudscz.php"] [unique_id "aSGOfQhUYdXBbQswAdTv2AAAAEg"]
[Sat Nov 22 18:20:47.349223 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:9909] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12wudscz.php"] [unique_id "aSGOf3Xe1xL-_YOdRmRmHgAAAYA"]
[Sat Nov 22 18:20:49.450451 2025] [:error] [pid 44259:tid 44265] [client 52.156.220.49:19985] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12wudscz.php"] [unique_id "aSGOgXXe1xL-_YOdRmRmIwAAAYM"]
[Sat Nov 22 18:20:50.585957 2025] [:error] [pid 44259:tid 44263] [client 52.156.220.49:19211] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12wudscz.php"] [unique_id "aSGOgnXe1xL-_YOdRmRmKAAAAYE"]
[Sat Nov 22 18:20:51.946920 2025] [:error] [pid 53477:tid 53482] [client 52.156.220.49:9305] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aSGOg37Lu30Ku9O40aKymgAAAAE"]
[Sat Nov 22 18:20:55.100623 2025] [:error] [pid 53479:tid 53539] [client 52.156.220.49:19236] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aSGOh26cicFF3Aas-oSGCQAAAIM"]
[Sat Nov 22 18:20:59.410182 2025] [:error] [pid 53566:tid 53582] [client 52.156.220.49:9287] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aSGOi8bSHDBkRbwMbd4igwAAAM4"]
[Sat Nov 22 18:21:00.558873 2025] [:error] [pid 53477:tid 53498] [client 52.156.220.49:9316] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aSGOjH7Lu30Ku9O40aKyrQAAABE"]
[Sat Nov 22 18:21:03.703304 2025] [:error] [pid 53478:tid 53519] [client 52.156.220.49:8953] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSGOjwhUYdXBbQswAdTv8gAAAEo"]
[Sat Nov 22 18:21:08.792937 2025] [:error] [pid 44259:tid 44285] [client 52.156.220.49:8937] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aSGOlHXe1xL-_YOdRmRmTAAAAZc"]
[Sat Nov 22 18:21:13.767598 2025] [:error] [pid 25856:tid 25864] [client 52.156.220.49:9308] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aSGOmRsTP0wy94zKUvGx0wAAAQY"]
[Sat Nov 22 18:21:15.159436 2025] [:error] [pid 25856:tid 25882] [client 52.156.220.49:13968] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aSGOmxsTP0wy94zKUvGx1wAAARg"]
[Sat Nov 22 18:21:17.450529 2025] [:error] [pid 44259:tid 44269] [client 52.156.220.49:1239] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aSGOnXXe1xL-_YOdRmRmVQAAAYc"]
[Sat Nov 22 18:21:26.901820 2025] [:error] [pid 53477:tid 53489] [client 52.156.220.49:1516] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSGOpn7Lu30Ku9O40aKyygAAAAg"]
[Sat Nov 22 18:21:28.914510 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:6863] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSGOqG6cicFF3Aas-oSGQAAAAJM"]
[Sat Nov 22 18:21:30.318923 2025] [:error] [pid 53478:tid 53522] [client 52.156.220.49:15345] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSGOqghUYdXBbQswAdTwEAAAAE0"]
[Sat Nov 22 18:21:31.626683 2025] [:error] [pid 25856:tid 25871] [client 52.156.220.49:1570] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSGOqxsTP0wy94zKUvGx5gAAAQ0"]
[Sat Nov 22 18:21:37.721922 2025] [:error] [pid 44259:tid 44269] [client 52.156.220.49:12342] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/wp-login.php"] [unique_id "aSGOsXXe1xL-_YOdRmRmhgAAAYc"]
[Sat Nov 22 18:21:41.007784 2025] [:error] [pid 53566:tid 53587] [client 52.156.220.49:7894] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSGOtcbSHDBkRbwMbd4ivwAAANM"]
[Sat Nov 22 18:21:41.987921 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:1494] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aSGOtX7Lu30Ku9O40aKy5AAAAAs"]
[Sat Nov 22 18:21:44.559844 2025] [proxy_fcgi:error] [pid 53479:tid 53544] [client 52.156.220.49:15354] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:21:45.105242 2025] [proxy_fcgi:error] [pid 53479:tid 53542] [client 52.156.220.49:15354] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:21:46.696739 2025] [:error] [pid 53479:tid 53539] [client 52.156.220.49:15354] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/content.php"] [unique_id "aSGOum6cicFF3Aas-oSGawAAAIM"]
[Sat Nov 22 18:21:48.916740 2025] [:error] [pid 25856:tid 25859] [client 52.156.220.49:1851] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/wp-login.php"] [unique_id "aSGOvBsTP0wy94zKUvGyBAAAAQE"]
[Sat Nov 22 18:21:51.118283 2025] [proxy_fcgi:error] [pid 53566:tid 53586] [client 52.156.220.49:14383] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:21:51.369948 2025] [:error] [pid 53566:tid 53587] [client 52.156.220.49:14383] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/as.php"] [unique_id "aSGOv8bSHDBkRbwMbd4iywAAANM"]
[Sat Nov 22 18:21:55.224024 2025] [:error] [pid 25856:tid 25868] [client 52.156.220.49:11691] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/as.php"] [unique_id "aSGOwxsTP0wy94zKUvGyCgAAAQo"]
[Sat Nov 22 18:21:56.428522 2025] [:error] [pid 44259:tid 44266] [client 52.156.220.49:11696] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/as.php"] [unique_id "aSGOxHXe1xL-_YOdRmRmxgAAAYQ"]
[Sat Nov 22 18:22:01.813661 2025] [:error] [pid 53477:tid 53481] [client 52.156.220.49:8367] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/as.php"] [unique_id "aSGOyX7Lu30Ku9O40aKy-wAAAAA"]
[Sat Nov 22 18:22:03.738596 2025] [:error] [pid 53477:tid 53496] [client 52.156.220.49:17263] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/wp-login.php"] [unique_id "aSGOy37Lu30Ku9O40aKy_gAAAA8"]
[Sat Nov 22 18:22:08.821864 2025] [:error] [pid 53479:tid 53552] [client 52.156.220.49:12328] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/lv.php"] [unique_id "aSGO0G6cicFF3Aas-oSGkAAAAJA"]
[Sat Nov 22 18:22:14.490756 2025] [:error] [pid 53479:tid 53540] [client 52.156.220.49:12841] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/lv.php"] [unique_id "aSGO1m6cicFF3Aas-oSGlgAAAIQ"]
[Sat Nov 22 18:22:17.465155 2025] [:error] [pid 44259:tid 44275] [client 52.156.220.49:12838] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/lv.php"] [unique_id "aSGO2XXe1xL-_YOdRmRm-wAAAY0"]
[Sat Nov 22 18:22:19.484393 2025] [:error] [pid 44259:tid 44285] [client 52.156.220.49:18142] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aSGO23Xe1xL-_YOdRmRnAwAAAZc"]
[Sat Nov 22 18:22:21.050615 2025] [:error] [pid 53477:tid 53496] [client 52.156.220.49:6931] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aSGO3X7Lu30Ku9O40aKzCwAAAA8"]
[Sat Nov 22 18:22:24.427634 2025] [:error] [pid 9547:tid 9572] [client 52.156.220.49:6219] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aSGO4NClOR5qk7DoMeGn_gAAAVM"]
[Sat Nov 22 18:22:25.648285 2025] [:error] [pid 53477:tid 53487] [client 52.156.220.49:10561] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aSGO4X7Lu30Ku9O40aKzIgAAAAY"]
[Sat Nov 22 18:22:30.851966 2025] [:error] [pid 53566:tid 53574] [client 52.156.220.49:14052] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/duplicator/assets/about.php"] [unique_id "aSGO5sbSHDBkRbwMbd4jBAAAAMY"]
[Sat Nov 22 18:22:33.034431 2025] [:error] [pid 9547:tid 9556] [client 52.156.220.49:6231] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/duplicator/assets/about.php"] [unique_id "aSGO6dClOR5qk7DoMeGoJAAAAUM"]
[Sat Nov 22 18:22:47.309384 2025] [:error] [pid 53566:tid 53576] [client 52.156.220.49:14018] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/upfile.php"] [unique_id "aSGO98bSHDBkRbwMbd4jEgAAAMg"]
[Sat Nov 22 18:22:59.814335 2025] [:error] [pid 9547:tid 9560] [client 52.156.220.49:1025] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/about.php"] [unique_id "aSGPA9ClOR5qk7DoMeGoUQAAAUc"]
[Sat Nov 22 18:23:07.112180 2025] [proxy_fcgi:error] [pid 44259:tid 44273] [client 52.156.220.49:11975] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:23:07.363944 2025] [:error] [pid 44259:tid 44275] [client 52.156.220.49:11975] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/content.php"] [unique_id "aSGPC3Xe1xL-_YOdRmRniAAAAY0"]
[Sat Nov 22 18:23:08.941427 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:20969] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/admin.php"] [unique_id "aSGPDG6cicFF3Aas-oSG9QAAAJM"]
[Sat Nov 22 18:23:15.554871 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:1567] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSGPE9ClOR5qk7DoMeGoZgAAAUQ"]
[Sat Nov 22 18:23:17.713177 2025] [proxy_fcgi:error] [pid 53477:tid 53498] [client 52.156.220.49:12375] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:23:17.972861 2025] [:error] [pid 53477:tid 53497] [client 52.156.220.49:12375] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/about.php"] [unique_id "aSGPFX7Lu30Ku9O40aKzbQAAABA"]
[Sat Nov 22 18:23:19.789902 2025] [proxy_fcgi:error] [pid 53566:tid 53570] [client 52.156.220.49:12409] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:23:20.162220 2025] [:error] [pid 53566:tid 53571] [client 52.156.220.49:12409] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp.php"] [unique_id "aSGPGMbSHDBkRbwMbd4jLgAAAMM"]
[Sat Nov 22 18:23:22.490099 2025] [proxy_fcgi:error] [pid 53478:tid 53525] [client 52.156.220.49:1548] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:23:22.769702 2025] [:error] [pid 53478:tid 53510] [client 52.156.220.49:1548] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aSGPGghUYdXBbQswAdTwwgAAAEE"]
[Sat Nov 22 18:23:24.959792 2025] [:error] [pid 53478:tid 53518] [client 52.156.220.49:18921] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/chosen.php"] [unique_id "aSGPHAhUYdXBbQswAdTwzQAAAEk"]
[Sat Nov 22 18:23:27.009696 2025] [proxy_fcgi:error] [pid 53477:tid 53499] [client 52.156.220.49:22455] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:23:27.263887 2025] [:error] [pid 53477:tid 53496] [client 52.156.220.49:22455] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/Core32/Curve25519/Ge/about.php"] [unique_id "aSGPH37Lu30Ku9O40aKzkwAAAA8"]
[Sat Nov 22 18:23:33.579226 2025] [:error] [pid 53478:tid 53510] [client 52.156.220.49:9486] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGPJQhUYdXBbQswAdTw5AAAAEE"]
[Sat Nov 22 18:23:37.290028 2025] [:error] [pid 53566:tid 53574] [client 52.156.220.49:1584] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGPKcbSHDBkRbwMbd4jPgAAAMY"]
[Sat Nov 22 18:23:39.834968 2025] [:error] [pid 53566:tid 53589] [client 52.156.220.49:10951] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGPK8bSHDBkRbwMbd4jPwAAANU"]
[Sat Nov 22 18:23:40.990405 2025] [:error] [pid 25856:tid 25874] [client 52.156.220.49:7535] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSGPLBsTP0wy94zKUvGyrgAAARA"]
[Sat Nov 22 18:23:44.243672 2025] [:error] [pid 53566:tid 53573] [client 52.156.220.49:10985] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "aSGPMMbSHDBkRbwMbd4jRAAAAMU"]
[Sat Nov 22 18:23:45.124064 2025] [:error] [pid 53478:tid 53513] [client 52.156.220.49:1593] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "aSGPMQhUYdXBbQswAdTw_QAAAEQ"]
[Sat Nov 22 18:23:47.949407 2025] [:error] [pid 25856:tid 25875] [client 52.156.220.49:7567] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "aSGPMxsTP0wy94zKUvGysQAAARE"]
[Sat Nov 22 18:23:49.410853 2025] [:error] [pid 53477:tid 53502] [client 52.156.220.49:10998] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "aSGPNX7Lu30Ku9O40aKz3QAAABU"]
[Sat Nov 22 18:23:51.437175 2025] [:error] [pid 25856:tid 25870] [client 52.156.220.49:22196] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "aSGPNxsTP0wy94zKUvGytAAAAQw"]
[Sat Nov 22 18:23:53.674646 2025] [:error] [pid 9547:tid 9577] [client 52.156.220.49:22182] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "aSGPOdClOR5qk7DoMeGojQAAAVg"]
[Sat Nov 22 18:23:56.084137 2025] [:error] [pid 53478:tid 53531] [client 52.156.220.49:8578] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "aSGPPAhUYdXBbQswAdTxCQAAAFY"]
[Sat Nov 22 18:24:01.766746 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:19307] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "aSGPQXXe1xL-_YOdRmRn1QAAAZY"]
[Sat Nov 22 18:24:03.552001 2025] [:error] [pid 9547:tid 9555] [client 52.156.220.49:19267] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "aSGPQ9ClOR5qk7DoMeGongAAAUI"]
[Sat Nov 22 18:24:14.027665 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:1208] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "aSGPTnXe1xL-_YOdRmRn4AAAAZA"]
[Sat Nov 22 18:24:25.171614 2025] [:error] [pid 9547:tid 9577] [client 52.156.220.49:13612] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "aSGPWdClOR5qk7DoMeGoqwAAAVg"]
[Sat Nov 22 18:24:26.509907 2025] [:error] [pid 53566:tid 53577] [client 52.156.220.49:19274] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "aSGPWsbSHDBkRbwMbd4jbgAAAMk"]
[Sat Nov 22 18:24:28.482474 2025] [:error] [pid 53477:tid 53481] [client 52.156.220.49:19309] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "aSGPXH7Lu30Ku9O40aK0GQAAAAA"]
[Sat Nov 22 18:24:30.895503 2025] [:error] [pid 9547:tid 9566] [client 52.156.220.49:19291] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "aSGPXtClOR5qk7DoMeGosgAAAU0"]
[Sat Nov 22 18:24:32.524811 2025] [:error] [pid 53478:tid 53523] [client 52.156.220.49:1153] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/file.php"] [unique_id "aSGPYAhUYdXBbQswAdTxMAAAAE4"]
[Sat Nov 22 18:24:34.431238 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:14602] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "aSGPYnXe1xL-_YOdRmRn9QAAAZA"]
[Sat Nov 22 18:24:36.352565 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:20048] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aSGPZMbSHDBkRbwMbd4jdQAAAMo"]
[Sat Nov 22 18:24:39.367351 2025] [:error] [pid 25856:tid 25873] [client 52.156.220.49:19290] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "aSGPZxsTP0wy94zKUvGzOgAAAQ8"]
[Sat Nov 22 18:24:40.487431 2025] [proxy_fcgi:error] [pid 44259:tid 44274] [client 52.156.220.49:2008] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:24:40.842948 2025] [:error] [pid 44259:tid 44281] [client 52.156.220.49:2008] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/revslider/public/assets/assets/sources/wp-login.php"] [unique_id "aSGPaHXe1xL-_YOdRmRoCgAAAZM"]
[Sat Nov 22 18:24:41.226739 2025] [proxy_fcgi:error] [pid 44259:tid 44271] [client 52.156.220.49:2008] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:24:42.515055 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:2008] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/assets/images/wp-login.php"] [unique_id "aSGPanXe1xL-_YOdRmRoEQAAAZI"]
[Sat Nov 22 18:24:42.781353 2025] [:error] [pid 44259:tid 44272] [client 52.156.220.49:2008] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/xp.php"] [unique_id "aSGPanXe1xL-_YOdRmRoEgAAAYo"]
[Sat Nov 22 18:24:44.057286 2025] [:error] [pid 53478:tid 53526] [client 52.156.220.49:2018] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/xp.php"] [unique_id "aSGPbAhUYdXBbQswAdTxOQAAAFE"]
[Sat Nov 22 18:24:45.673342 2025] [:error] [pid 9547:tid 9559] [client 52.156.220.49:11503] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/xp.php"] [unique_id "aSGPbdClOR5qk7DoMeGowgAAAUY"]
[Sat Nov 22 18:24:48.090494 2025] [:error] [pid 53478:tid 53510] [client 52.156.220.49:1687] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/xp.php"] [unique_id "aSGPcAhUYdXBbQswAdTxPwAAAEE"]
[Sat Nov 22 18:24:50.037000 2025] [:error] [pid 53477:tid 53482] [client 52.156.220.49:20072] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/themes.php"] [unique_id "aSGPcn7Lu30Ku9O40aK0JwAAAAE"]
[Sat Nov 22 18:24:54.576312 2025] [:error] [pid 9547:tid 9559] [client 52.156.220.49:8593] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aSGPdtClOR5qk7DoMeGozAAAAUY"]
[Sat Nov 22 18:24:56.877959 2025] [:error] [pid 53477:tid 53503] [client 52.156.220.49:22867] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aSGPeH7Lu30Ku9O40aK0MAAAABY"]
[Sat Nov 22 18:25:08.137564 2025] [:error] [pid 44259:tid 44263] [client 52.156.220.49:22800] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/chosen.php"] [unique_id "aSGPhHXe1xL-_YOdRmRoIAAAAYE"]
[Sat Nov 22 18:25:11.271900 2025] [:error] [pid 44259:tid 44286] [client 52.156.220.49:20022] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/chosen.php"] [unique_id "aSGPh3Xe1xL-_YOdRmRoJAAAAZg"]
[Sat Nov 22 18:25:13.544860 2025] [:error] [pid 9547:tid 9573] [client 52.156.220.49:1760] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/chosen.php"] [unique_id "aSGPidClOR5qk7DoMeGo2AAAAVQ"]
[Sat Nov 22 18:25:14.796879 2025] [:error] [pid 44259:tid 44271] [client 52.156.220.49:8956] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/chosen.php"] [unique_id "aSGPinXe1xL-_YOdRmRoJgAAAYk"]
[Sat Nov 22 18:25:34.961827 2025] [:error] [pid 53477:tid 53482] [client 52.156.220.49:22512] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "aSGPnn7Lu30Ku9O40aK0TAAAAAE"]
[Sat Nov 22 18:25:36.334309 2025] [:error] [pid 53478:tid 53513] [client 52.156.220.49:16378] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/style.php"] [unique_id "aSGPoAhUYdXBbQswAdTxXwAAAEQ"]
[Sat Nov 22 18:25:38.325942 2025] [:error] [pid 9547:tid 9569] [client 52.156.220.49:18820] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/style.php"] [unique_id "aSGPotClOR5qk7DoMeGo_gAAAVA"]
[Sat Nov 22 18:25:40.754972 2025] [:error] [pid 53479:tid 53541] [client 52.156.220.49:16989] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/style.php"] [unique_id "aSGPpG6cicFF3Aas-oSINwAAAIU"]
[Sat Nov 22 18:25:44.165423 2025] [:error] [pid 53478:tid 53517] [client 52.156.220.49:9281] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSGPqAhUYdXBbQswAdTxbQAAAEg"]
[Sat Nov 22 18:25:44.435336 2025] [proxy_fcgi:error] [pid 53478:tid 53511] [client 52.156.220.49:9281] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:25:44.704837 2025] [:error] [pid 53478:tid 53512] [client 52.156.220.49:9281] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "aSGPqAhUYdXBbQswAdTxbwAAAEM"]
[Sat Nov 22 18:25:47.743140 2025] [:error] [pid 44259:tid 44276] [client 52.156.220.49:1258] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "aSGPq3Xe1xL-_YOdRmRoVgAAAY4"]
[Sat Nov 22 18:25:53.408323 2025] [proxy_fcgi:error] [pid 44259:tid 44269] [client 52.156.220.49:14000] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:25:53.660381 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:14000] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSGPsXXe1xL-_YOdRmRoYQAAAYI"]
[Sat Nov 22 18:25:54.624780 2025] [proxy_fcgi:error] [pid 25856:tid 25877] [client 52.156.220.49:13969] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:25:55.134879 2025] [proxy_fcgi:error] [pid 25856:tid 25874] [client 52.156.220.49:13969] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:25:56.980651 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:13969] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "aSGPtBsTP0wy94zKUvGzjQAAAQA"]
[Sat Nov 22 18:25:58.761289 2025] [:error] [pid 53478:tid 53529] [client 52.156.220.49:9313] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "aSGPtghUYdXBbQswAdTxeQAAAFQ"]
[Sat Nov 22 18:26:02.812026 2025] [:error] [pid 25856:tid 25863] [client 52.156.220.49:1272] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "aSGPuhsTP0wy94zKUvGzjgAAAQU"]
[Sat Nov 22 18:26:03.708718 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:4251] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "aSGPu3Xe1xL-_YOdRmRoeAAAAYA"]
[Sat Nov 22 18:26:06.082178 2025] [:error] [pid 53478:tid 53509] [client 52.156.220.49:15262] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "aSGPvghUYdXBbQswAdTxgQAAAEA"]
[Sat Nov 22 18:26:07.305262 2025] [:error] [pid 25856:tid 25876] [client 52.156.220.49:4224] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "aSGPvxsTP0wy94zKUvGzkQAAARI"]
[Sat Nov 22 18:26:08.738402 2025] [:error] [pid 53478:tid 53510] [client 52.156.220.49:14387] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "aSGPwAhUYdXBbQswAdTxhQAAAEE"]
[Sat Nov 22 18:26:10.197893 2025] [:error] [pid 53566:tid 53569] [client 52.156.220.49:14459] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "aSGPwsbSHDBkRbwMbd4j0wAAAME"]
[Sat Nov 22 18:26:11.114287 2025] [:error] [pid 9547:tid 9553] [client 52.156.220.49:14406] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/x.php"] [unique_id "aSGPw9ClOR5qk7DoMeGpNwAAAUA"]
[Sat Nov 22 18:26:20.770290 2025] [:error] [pid 25856:tid 25867] [client 52.156.220.49:14426] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/x.php"] [unique_id "aSGPzBsTP0wy94zKUvGznAAAAQk"]
[Sat Nov 22 18:26:21.804207 2025] [:error] [pid 25856:tid 25869] [client 52.156.220.49:1503] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/x.php"] [unique_id "aSGPzRsTP0wy94zKUvGzoAAAAQs"]
[Sat Nov 22 18:26:24.942337 2025] [:error] [pid 53477:tid 53487] [client 52.156.220.49:12869] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/x.php"] [unique_id "aSGP0H7Lu30Ku9O40aK0egAAAAY"]
[Sat Nov 22 18:26:32.172746 2025] [:error] [pid 44259:tid 44285] [client 52.156.220.49:4614] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/network.php"] [unique_id "aSGP2HXe1xL-_YOdRmRokQAAAZc"]
[Sat Nov 22 18:26:33.410255 2025] [:error] [pid 53478:tid 53521] [client 52.156.220.49:4669] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/.well-known/cc.php"] [unique_id "aSGP2QhUYdXBbQswAdTxsgAAAEw"]
[Sat Nov 22 18:26:34.752318 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:19776] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/.well-known/cc.php"] [unique_id "aSGP2nXe1xL-_YOdRmRomAAAAZI"]
[Sat Nov 22 18:26:42.682562 2025] [:error] [pid 25856:tid 25867] [client 52.156.220.49:12081] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/.well-known/cc.php"] [unique_id "aSGP4hsTP0wy94zKUvGztgAAAQk"]
[Sat Nov 22 18:26:47.022894 2025] [:error] [pid 53477:tid 53501] [client 52.156.220.49:4320] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/.well-known/cc.php"] [unique_id "aSGP537Lu30Ku9O40aK0kAAAABQ"]
[Sat Nov 22 18:26:51.121976 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:18120] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/chosen.php"] [unique_id "aSGP63Xe1xL-_YOdRmRovgAAAZA"]
[Sat Nov 22 18:26:58.761396 2025] [proxy_fcgi:error] [pid 44259:tid 44279] [client 52.156.220.49:20481] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:26:59.270074 2025] [:error] [pid 44259:tid 44270] [client 52.156.220.49:20481] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/shell.php"] [unique_id "aSGP83Xe1xL-_YOdRmRo0QAAAYg"]
[Sat Nov 22 18:27:01.386984 2025] [proxy_fcgi:error] [pid 44259:tid 44266] [client 52.156.220.49:10600] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:27:01.823993 2025] [:error] [pid 44259:tid 44279] [client 52.156.220.49:10600] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/variations.php"] [unique_id "aSGP9XXe1xL-_YOdRmRo2wAAAZE"]
[Sat Nov 22 18:27:12.170357 2025] [:error] [pid 53477:tid 53484] [client 52.156.220.49:1909] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/wp-login.php"] [unique_id "aSGQAH7Lu30Ku9O40aK0pQAAAAM"]
[Sat Nov 22 18:27:22.422177 2025] [proxy_fcgi:error] [pid 44259:tid 44269] [client 52.156.220.49:12601] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:27:23.307610 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:12601] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "aSGQC3Xe1xL-_YOdRmRo9AAAAZI"]
[Sat Nov 22 18:27:24.784799 2025] [proxy_fcgi:error] [pid 53479:tid 53553] [client 52.156.220.49:4673] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:27:25.056328 2025] [:error] [pid 53479:tid 53550] [client 52.156.220.49:4673] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "aSGQDW6cicFF3Aas-oSIzAAAAI4"]
[Sat Nov 22 18:27:26.224352 2025] [:error] [pid 53478:tid 53533] [client 52.156.220.49:8893] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/item.php"] [unique_id "aSGQDghUYdXBbQswAdTx4AAAAFg"]
[Sat Nov 22 18:27:58.292947 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:12134] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/link.php"] [unique_id "aSGQLnXe1xL-_YOdRmRpMgAAAYI"]
[Sat Nov 22 18:28:00.265070 2025] [:error] [pid 44259:tid 44283] [client 52.156.220.49:20960] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wlw/wp-login.php"] [unique_id "aSGQMHXe1xL-_YOdRmRpNAAAAZU"]
[Sat Nov 22 18:28:03.209829 2025] [:error] [pid 53479:tid 53556] [client 52.156.220.49:18900] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSGQM26cicFF3Aas-oSI-gAAAJQ"]
[Sat Nov 22 18:28:04.007925 2025] [:error] [pid 25856:tid 25873] [client 52.156.220.49:10121] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSGQNBsTP0wy94zKUvG0DwAAAQ8"]
[Sat Nov 22 18:28:15.199305 2025] [:error] [pid 44259:tid 44279] [client 52.156.220.49:1588] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSGQP3Xe1xL-_YOdRmRpTwAAAZE"]
[Sat Nov 22 18:28:17.209008 2025] [:error] [pid 53477:tid 53481] [client 52.156.220.49:8654] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/alfa-rex.php"] [unique_id "aSGQQX7Lu30Ku9O40aK06AAAAAA"]
[Sat Nov 22 18:28:21.402055 2025] [:error] [pid 53478:tid 53521] [client 52.156.220.49:9223] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/alfa-rex.php"] [unique_id "aSGQRQhUYdXBbQswAdTyFwAAAEw"]
[Sat Nov 22 18:28:27.729382 2025] [:error] [pid 9547:tid 9577] [client 52.156.220.49:11261] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/alfa-rex.php"] [unique_id "aSGQS9ClOR5qk7DoMeGqpgAAAVg"]
[Sat Nov 22 18:28:34.602007 2025] [:error] [pid 53566:tid 53570] [client 52.156.220.49:9949] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSGQUsbSHDBkRbwMbd4kkgAAAMI"]
[Sat Nov 22 18:28:36.945319 2025] [:error] [pid 44259:tid 44286] [client 52.156.220.49:16898] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSGQVHXe1xL-_YOdRmRpbgAAAZg"]
[Sat Nov 22 18:28:37.825438 2025] [:error] [pid 25856:tid 25877] [client 52.156.220.49:1385] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSGQVRsTP0wy94zKUvG0JwAAARM"]
[Sat Nov 22 18:28:39.424112 2025] [:error] [pid 44259:tid 44263] [client 52.156.220.49:11204] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSGQV3Xe1xL-_YOdRmRphQAAAYE"]
[Sat Nov 22 18:28:42.257316 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:7155] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/content.php"] [unique_id "aSGQWtClOR5qk7DoMeGq1QAAAUQ"]
[Sat Nov 22 18:28:45.183499 2025] [:error] [pid 53479:tid 53536] [client 52.156.220.49:7106] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/includeswp-conflg.php"] [unique_id "aSGQXW6cicFF3Aas-oSJJgAAAIA"]
[Sat Nov 22 18:28:46.727152 2025] [:error] [pid 53566:tid 53589] [client 52.156.220.49:9962] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/includeswp-conflg.php"] [unique_id "aSGQXsbSHDBkRbwMbd4krgAAANU"]
[Sat Nov 22 18:28:50.847688 2025] [:error] [pid 25856:tid 25876] [client 52.156.220.49:9925] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/includeswp-conflg.php"] [unique_id "aSGQYhsTP0wy94zKUvG0NgAAARI"]
[Sat Nov 22 18:28:52.798813 2025] [:error] [pid 25856:tid 25881] [client 52.156.220.49:13616] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/includeswp-conflg.php"] [unique_id "aSGQZBsTP0wy94zKUvG0PQAAARc"]
[Sat Nov 22 18:28:54.013176 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:13627] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/mah.php"] [unique_id "aSGQZnXe1xL-_YOdRmRpnwAAAZA"]
[Sat Nov 22 18:28:55.745757 2025] [:error] [pid 44259:tid 44275] [client 52.156.220.49:11907] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/mah.php"] [unique_id "aSGQZ3Xe1xL-_YOdRmRppAAAAY0"]
[Sat Nov 22 18:28:58.795853 2025] [:error] [pid 53479:tid 53554] [client 52.156.220.49:18070] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSGQam6cicFF3Aas-oSJRgAAAJI"]
[Sat Nov 22 18:28:59.065898 2025] [:error] [pid 53479:tid 53552] [client 52.156.220.49:18070] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSGQa26cicFF3Aas-oSJRwAAAJA"]
[Sat Nov 22 18:29:00.372219 2025] [:error] [pid 44259:tid 44279] [client 52.156.220.49:18096] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSGQbHXe1xL-_YOdRmRppwAAAZE"]
[Sat Nov 22 18:29:04.537690 2025] [proxy_fcgi:error] [pid 44259:tid 44265] [client 52.156.220.49:11517] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:29:04.788584 2025] [:error] [pid 44259:tid 44276] [client 52.156.220.49:11517] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/wp-login.php"] [unique_id "aSGQcHXe1xL-_YOdRmRprAAAAY4"]
[Sat Nov 22 18:29:07.087699 2025] [proxy_fcgi:error] [pid 53479:tid 53558] [client 52.156.220.49:14610] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:29:07.597229 2025] [proxy_fcgi:error] [pid 53479:tid 53551] [client 52.156.220.49:14610] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:29:07.862065 2025] [:error] [pid 53479:tid 53554] [client 52.156.220.49:14610] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/alfa-rex.php"] [unique_id "aSGQc26cicFF3Aas-oSJZQAAAJI"]
[Sat Nov 22 18:29:12.191849 2025] [:error] [pid 53479:tid 53536] [client 52.156.220.49:2031] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSGQeG6cicFF3Aas-oSJdQAAAIA"]
[Sat Nov 22 18:29:15.107092 2025] [:error] [pid 53477:tid 53504] [client 52.156.220.49:13589] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/3luaO.php"] [unique_id "aSGQe37Lu30Ku9O40aK1PgAAABc"]
[Sat Nov 22 18:29:18.266436 2025] [:error] [pid 53566:tid 53586] [client 52.156.220.49:11484] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/3luaO.php"] [unique_id "aSGQfsbSHDBkRbwMbd4k7gAAANI"]
[Sat Nov 22 18:29:19.452141 2025] [:error] [pid 53479:tid 53554] [client 52.156.220.49:20092] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/3luaO.php"] [unique_id "aSGQf26cicFF3Aas-oSJggAAAJI"]
[Sat Nov 22 18:29:20.931063 2025] [:error] [pid 53566:tid 53574] [client 52.156.220.49:7178] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/cay-van-phong/3luaO.php"] [unique_id "aSGQgMbSHDBkRbwMbd4k9AAAAMY"]
[Sat Nov 22 18:29:21.979310 2025] [:error] [pid 9547:tid 9574] [client 52.156.220.49:15010] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aSGQgdClOR5qk7DoMeGrFAAAAVU"]
[Sat Nov 22 18:29:23.772151 2025] [:error] [pid 9547:tid 9575] [client 52.156.220.49:2007] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSGQg9ClOR5qk7DoMeGrGQAAAVY"]
[Sat Nov 22 18:29:29.232029 2025] [:error] [pid 9547:tid 9574] [client 52.156.220.49:7176] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/info.php"] [unique_id "aSGQidClOR5qk7DoMeGrIAAAAVU"]
[Sat Nov 22 18:29:31.181246 2025] [:error] [pid 53566:tid 53575] [client 52.156.220.49:6204] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/info.php"] [unique_id "aSGQi8bSHDBkRbwMbd4k_AAAAMc"]
[Sat Nov 22 18:29:35.605527 2025] [:error] [pid 53566:tid 53590] [client 52.156.220.49:15065] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/info.php"] [unique_id "aSGQj8bSHDBkRbwMbd4lAAAAANY"]
[Sat Nov 22 18:29:36.446263 2025] [:error] [pid 53478:tid 53520] [client 52.156.220.49:1169] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/info.php"] [unique_id "aSGQkAhUYdXBbQswAdTyegAAAEs"]
[Sat Nov 22 18:29:37.685298 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:11462] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/images/slider/CUfcfoH.php"] [unique_id "aSGQkcbSHDBkRbwMbd4lBwAAAMo"]
[Sat Nov 22 18:29:42.337878 2025] [:error] [pid 53566:tid 53589] [client 52.156.220.49:1181] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/images/slider/CUfcfoH.php"] [unique_id "aSGQlsbSHDBkRbwMbd4lDgAAANU"]
[Sat Nov 22 18:29:46.329055 2025] [:error] [pid 9547:tid 9566] [client 52.156.220.49:1158] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/images/slider/CUfcfoH.php"] [unique_id "aSGQmtClOR5qk7DoMeGrQAAAAU0"]
[Sat Nov 22 18:29:54.767274 2025] [:error] [pid 53477:tid 53494] [client 52.156.220.49:20055] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSGQon7Lu30Ku9O40aK1YwAAAA0"]
[Sat Nov 22 18:29:55.813466 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:1155] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSGQo37Lu30Ku9O40aK1ZQAAAAs"]
[Sat Nov 22 18:30:01.389199 2025] [:error] [pid 44259:tid 44271] [client 52.156.220.49:19268] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSGQqXXe1xL-_YOdRmRqEQAAAYk"]
[Sat Nov 22 18:30:09.255907 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:6154] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/edit.php"] [unique_id "aSGQsX7Lu30Ku9O40aK1cAAAAAs"]
[Sat Nov 22 18:30:10.264219 2025] [:error] [pid 25856:tid 25878] [client 52.156.220.49:11459] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/lock.php"] [unique_id "aSGQshsTP0wy94zKUvG0sQAAARQ"]
[Sat Nov 22 18:30:20.482994 2025] [:error] [pid 25856:tid 25881] [client 52.156.220.49:10553] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/up.php"] [unique_id "aSGQvBsTP0wy94zKUvG01wAAARc"]
[Sat Nov 22 18:30:21.375812 2025] [:error] [pid 44259:tid 44282] [client 52.156.220.49:19292] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSGQvXXe1xL-_YOdRmRqWAAAAZQ"]
[Sat Nov 22 18:30:22.572409 2025] [proxy_fcgi:error] [pid 44259:tid 44264] [client 52.156.220.49:11507] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:30:23.080909 2025] [:error] [pid 44259:tid 44265] [client 52.156.220.49:11507] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/alfa-rex.php"] [unique_id "aSGQv3Xe1xL-_YOdRmRqYgAAAYM"]
[Sat Nov 22 18:30:28.124864 2025] [proxy_fcgi:error] [pid 53478:tid 53527] [client 52.156.220.49:20050] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:30:29.267959 2025] [:error] [pid 53478:tid 53531] [client 52.156.220.49:20050] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "aSGQxQhUYdXBbQswAdTyowAAAFY"]
[Sat Nov 22 18:30:32.752632 2025] [:error] [pid 44259:tid 44267] [client 52.156.220.49:19264] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/item.php"] [unique_id "aSGQyHXe1xL-_YOdRmRqdQAAAYU"]
[Sat Nov 22 18:30:34.762636 2025] [:error] [pid 53566:tid 53575] [client 52.156.220.49:19270] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/item.php"] [unique_id "aSGQysbSHDBkRbwMbd4lVQAAAMc"]
[Sat Nov 22 18:30:36.852143 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:15073] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/item.php"] [unique_id "aSGQzMbSHDBkRbwMbd4lWgAAAMo"]
[Sat Nov 22 18:30:42.747760 2025] [:error] [pid 53478:tid 53528] [client 52.156.220.49:11502] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/include/mail.php"] [unique_id "aSGQ0ghUYdXBbQswAdTyqAAAAFM"]
[Sat Nov 22 18:30:44.315643 2025] [:error] [pid 53479:tid 53539] [client 52.156.220.49:15061] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/include/mail.php"] [unique_id "aSGQ1G6cicFF3Aas-oSKDgAAAIM"]
[Sat Nov 22 18:30:48.936524 2025] [:error] [pid 25856:tid 25874] [client 52.156.220.49:7187] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/include/mail.php"] [unique_id "aSGQ2BsTP0wy94zKUvG09AAAARA"]
[Sat Nov 22 18:30:50.725661 2025] [:error] [pid 44259:tid 44285] [client 52.156.220.49:18070] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/include/mail.php"] [unique_id "aSGQ2nXe1xL-_YOdRmRqjAAAAZc"]
[Sat Nov 22 18:30:52.989618 2025] [:error] [pid 53479:tid 53547] [client 52.156.220.49:15061] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/admin.php"] [unique_id "aSGQ3G6cicFF3Aas-oSKHwAAAIs"]
[Sat Nov 22 18:30:58.910268 2025] [:error] [pid 25856:tid 25869] [client 52.156.220.49:7221] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/admin.php"] [unique_id "aSGQ4hsTP0wy94zKUvG1BgAAAQs"]
[Sat Nov 22 18:31:04.341668 2025] [:error] [pid 53478:tid 53524] [client 52.156.220.49:10515] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/admin.php"] [unique_id "aSGQ6AhUYdXBbQswAdTyugAAAE8"]
[Sat Nov 22 18:31:20.700289 2025] [:error] [pid 53566:tid 53590] [client 52.156.220.49:15036] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSGQ-MbSHDBkRbwMbd4lcgAAANY"]
[Sat Nov 22 18:31:22.165401 2025] [:error] [pid 53477:tid 53489] [client 52.156.220.49:10509] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSGQ-n7Lu30Ku9O40aK10gAAAAg"]
[Sat Nov 22 18:31:24.396256 2025] [:error] [pid 53478:tid 53528] [client 52.156.220.49:15003] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSGQ_AhUYdXBbQswAdTy3AAAAFM"]
[Sat Nov 22 18:31:27.671139 2025] [:error] [pid 53566:tid 53583] [client 52.156.220.49:19326] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSGQ_8bSHDBkRbwMbd4lfAAAAM8"]
[Sat Nov 22 18:31:31.031065 2025] [proxy_fcgi:error] [pid 53566:tid 53575] [client 52.156.220.49:10545] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:31:31.379069 2025] [:error] [pid 53566:tid 53590] [client 52.156.220.49:10545] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/wp-login.php"] [unique_id "aSGRA8bSHDBkRbwMbd4ligAAANY"]
[Sat Nov 22 18:31:33.010919 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:14976] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSGRBRsTP0wy94zKUvG1QAAAAQA"]
[Sat Nov 22 18:31:33.268411 2025] [:error] [pid 25856:tid 25865] [client 52.156.220.49:14976] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Decode/wp-login.php"] [unique_id "aSGRBRsTP0wy94zKUvG1QQAAAQc"]
[Sat Nov 22 18:31:35.633298 2025] [proxy_fcgi:error] [pid 53477:tid 53491] [client 52.156.220.49:14992] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:31:36.433330 2025] [:error] [pid 53477:tid 53490] [client 52.156.220.49:14992] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Cookie/wp-login.php"] [unique_id "aSGRCH7Lu30Ku9O40aK17wAAAAk"]
[Sat Nov 22 18:31:39.514718 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:19527] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/about.php"] [unique_id "aSGRC8bSHDBkRbwMbd4lkAAAAMo"]
[Sat Nov 22 18:31:42.000099 2025] [:error] [pid 53478:tid 53521] [client 52.156.220.49:9485] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/about.php"] [unique_id "aSGRDQhUYdXBbQswAdTy8gAAAEw"]
[Sat Nov 22 18:31:44.837575 2025] [:error] [pid 53479:tid 53545] [client 52.156.220.49:18492] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/about.php"] [unique_id "aSGREG6cicFF3Aas-oSKYwAAAIk"]
[Sat Nov 22 18:31:48.862532 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:4693] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/about.php"] [unique_id "aSGRFG6cicFF3Aas-oSKZwAAAJM"]
[Sat Nov 22 18:31:53.890625 2025] [:error] [pid 44259:tid 44285] [client 52.156.220.49:4627] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/phpThumb/404.php"] [unique_id "aSGRGXXe1xL-_YOdRmRrJAAAAZc"]
[Sat Nov 22 18:31:55.000830 2025] [:error] [pid 53477:tid 53500] [client 52.156.220.49:16730] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/phpThumb/404.php"] [unique_id "aSGRGn7Lu30Ku9O40aK1-gAAABM"]
[Sat Nov 22 18:31:59.262777 2025] [:error] [pid 44259:tid 44269] [client 52.156.220.49:15324] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/phpThumb/404.php"] [unique_id "aSGRH3Xe1xL-_YOdRmRrNwAAAYc"]
[Sat Nov 22 18:32:05.342115 2025] [:error] [pid 9547:tid 9563] [client 52.156.220.49:6880] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSGRJdClOR5qk7DoMeGsGwAAAUo"]
[Sat Nov 22 18:32:06.930996 2025] [:error] [pid 9547:tid 9564] [client 52.156.220.49:11701] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/elementor/about.php"] [unique_id "aSGRJtClOR5qk7DoMeGsIAAAAUs"]
[Sat Nov 22 18:32:07.889246 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:14441] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/elementor/about.php"] [unique_id "aSGRJxsTP0wy94zKUvG1WQAAAQA"]
[Sat Nov 22 18:32:09.008509 2025] [:error] [pid 25856:tid 25865] [client 52.156.220.49:9333] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/elementor/about.php"] [unique_id "aSGRKRsTP0wy94zKUvG1XAAAAQc"]
[Sat Nov 22 18:32:14.313614 2025] [:error] [pid 53479:tid 53558] [client 52.156.220.49:18821] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/elementor/about.php"] [unique_id "aSGRLm6cicFF3Aas-oSKjAAAAJY"]
[Sat Nov 22 18:32:15.588079 2025] [:error] [pid 44259:tid 44267] [client 52.156.220.49:16987] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-help/index.php"] [unique_id "aSGRL3Xe1xL-_YOdRmRrRgAAAYU"]
[Sat Nov 22 18:32:16.979344 2025] [:error] [pid 53479:tid 53559] [client 52.156.220.49:9296] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-help/index.php"] [unique_id "aSGRMG6cicFF3Aas-oSKkQAAAJc"]
[Sat Nov 22 18:32:19.919957 2025] [:error] [pid 53478:tid 53518] [client 52.156.220.49:19208] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-help/index.php"] [unique_id "aSGRMwhUYdXBbQswAdTzGgAAAEk"]
[Sat Nov 22 18:32:23.035496 2025] [:error] [pid 9547:tid 9568] [client 52.156.220.49:9301] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-help/index.php"] [unique_id "aSGRN9ClOR5qk7DoMeGsPgAAAU8"]
[Sat Nov 22 18:32:24.059167 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:9290] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/media.php"] [unique_id "aSGRONClOR5qk7DoMeGsRAAAAUQ"]
[Sat Nov 22 18:32:25.840066 2025] [:error] [pid 44259:tid 44281] [client 52.156.220.49:14014] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/media.php"] [unique_id "aSGROXXe1xL-_YOdRmRrWgAAAZM"]
[Sat Nov 22 18:32:34.268639 2025] [:error] [pid 25856:tid 25878] [client 52.156.220.49:13992] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/media.php"] [unique_id "aSGRQhsTP0wy94zKUvG1kAAAARQ"]
[Sat Nov 22 18:32:43.055564 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:4239] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSGRS37Lu30Ku9O40aK2TAAAAAs"]
[Sat Nov 22 18:32:45.323773 2025] [:error] [pid 53478:tid 53518] [client 52.156.220.49:22222] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "aSGRTQhUYdXBbQswAdTzRgAAAEk"]
[Sat Nov 22 18:32:46.795186 2025] [:error] [pid 25856:tid 25872] [client 52.156.220.49:8578] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSGRThsTP0wy94zKUvG1pAAAAQ4"]
[Sat Nov 22 18:32:50.135257 2025] [proxy_fcgi:error] [pid 9547:tid 9562] [client 52.156.220.49:18847] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:32:50.435027 2025] [proxy_fcgi:error] [pid 9547:tid 9559] [client 52.156.220.49:18847] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:32:50.689394 2025] [proxy_fcgi:error] [pid 9547:tid 9573] [client 52.156.220.49:18847] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:32:51.682806 2025] [proxy_fcgi:error] [pid 9547:tid 9565] [client 52.156.220.49:18847] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:32:52.007447 2025] [proxy_fcgi:error] [pid 9547:tid 9567] [client 52.156.220.49:18847] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:32:53.339397 2025] [:error] [pid 9547:tid 9553] [client 52.156.220.49:18847] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/system.php"] [unique_id "aSGRVdClOR5qk7DoMeGsiQAAAUA"]
[Sat Nov 22 18:32:55.273810 2025] [:error] [pid 44259:tid 44271] [client 52.156.220.49:1408] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/admin.php"] [unique_id "aSGRV3Xe1xL-_YOdRmRrdAAAAYk"]
[Sat Nov 22 18:32:58.701311 2025] [:error] [pid 9547:tid 9558] [client 52.156.220.49:16326] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/admin.php"] [unique_id "aSGRWtClOR5qk7DoMeGsnAAAAUU"]
[Sat Nov 22 18:33:00.117387 2025] [:error] [pid 53566:tid 53581] [client 52.156.220.49:20225] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/admin.php"] [unique_id "aSGRXMbSHDBkRbwMbd4l2wAAAM0"]
[Sat Nov 22 18:33:01.550123 2025] [:error] [pid 9547:tid 9561] [client 52.156.220.49:13991] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/admin.php"] [unique_id "aSGRXdClOR5qk7DoMeGsqAAAAUg"]
[Sat Nov 22 18:33:02.789343 2025] [:error] [pid 53478:tid 53510] [client 52.156.220.49:8845] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/alfa-rex.php"] [unique_id "aSGRXghUYdXBbQswAdTzbgAAAEE"]
[Sat Nov 22 18:33:07.580602 2025] [:error] [pid 44259:tid 44272] [client 52.156.220.49:8636] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSGRY3Xe1xL-_YOdRmRrnwAAAYo"]
[Sat Nov 22 18:33:15.818082 2025] [:error] [pid 44259:tid 44277] [client 52.156.220.49:8921] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/about.php"] [unique_id "aSGRa3Xe1xL-_YOdRmRrrQAAAY8"]
[Sat Nov 22 18:33:17.571083 2025] [:error] [pid 53478:tid 53511] [client 52.156.220.49:5677] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/about.php"] [unique_id "aSGRbQhUYdXBbQswAdTziwAAAEI"]
[Sat Nov 22 18:33:19.300427 2025] [:error] [pid 9547:tid 9564] [client 52.156.220.49:20574] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/about.php"] [unique_id "aSGRb9ClOR5qk7DoMeGsxwAAAUs"]
[Sat Nov 22 18:33:29.157069 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:22496] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "aSGReXXe1xL-_YOdRmRrwwAAAZY"]
[Sat Nov 22 18:33:31.625691 2025] [:error] [pid 53477:tid 53505] [client 52.156.220.49:19206] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "aSGRe37Lu30Ku9O40aK2hQAAABg"]
[Sat Nov 22 18:33:32.720995 2025] [:error] [pid 53478:tid 53512] [client 52.156.220.49:1306] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "aSGRfAhUYdXBbQswAdTzpAAAAEM"]
[Sat Nov 22 18:33:34.155945 2025] [:error] [pid 44259:tid 44286] [client 52.156.220.49:1694] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "aSGRfnXe1xL-_YOdRmRrywAAAZg"]
[Sat Nov 22 18:33:36.280356 2025] [:error] [pid 53478:tid 53531] [client 52.156.220.49:18888] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/blue.php"] [unique_id "aSGRgAhUYdXBbQswAdTzpwAAAFY"]
[Sat Nov 22 18:33:39.136937 2025] [:error] [pid 53478:tid 53515] [client 52.156.220.49:9333] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/blue.php"] [unique_id "aSGRgwhUYdXBbQswAdTzswAAAEY"]
[Sat Nov 22 18:33:48.085442 2025] [:error] [pid 44259:tid 44276] [client 52.156.220.49:1660] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/blue.php"] [unique_id "aSGRjHXe1xL-_YOdRmRr1wAAAY4"]
[Sat Nov 22 18:33:55.951503 2025] [proxy_fcgi:error] [pid 9547:tid 9560] [client 52.156.220.49:16970] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:33:56.476947 2025] [:error] [pid 9547:tid 9564] [client 52.156.220.49:16970] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/about.php"] [unique_id "aSGRlNClOR5qk7DoMeGtAwAAAUs"]
[Sat Nov 22 18:33:57.450436 2025] [proxy_fcgi:error] [pid 25856:tid 25871] [client 52.156.220.49:22519] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:33:57.990751 2025] [proxy_fcgi:error] [pid 25856:tid 25859] [client 52.156.220.49:22519] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:33:58.242059 2025] [:error] [pid 25856:tid 25882] [client 52.156.220.49:22519] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSGRlhsTP0wy94zKUvG14QAAARg"]
[Sat Nov 22 18:34:03.710095 2025] [:error] [pid 53566:tid 53570] [client 52.156.220.49:16977] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "aSGRm8bSHDBkRbwMbd4mNwAAAMI"]
[Sat Nov 22 18:34:10.290811 2025] [proxy_fcgi:error] [pid 53478:tid 53513] [client 52.156.220.49:19996] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:34:11.146117 2025] [:error] [pid 53478:tid 53521] [client 52.156.220.49:19996] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "aSGRowhUYdXBbQswAdTz6QAAAEw"]
[Sat Nov 22 18:34:20.869379 2025] [:error] [pid 53478:tid 53517] [client 52.156.220.49:16965] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "aSGRrAhUYdXBbQswAdTz-gAAAEg"]
[Sat Nov 22 18:34:24.318230 2025] [:error] [pid 53479:tid 53543] [client 52.156.220.49:17217] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "aSGRsG6cicFF3Aas-oSLkwAAAIc"]
[Sat Nov 22 18:34:27.835722 2025] [:error] [pid 44259:tid 44274] [client 52.156.220.49:22239] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gel4y.php"] [unique_id "aSGRs3Xe1xL-_YOdRmRsGAAAAYw"]
[Sat Nov 22 18:34:29.381819 2025] [:error] [pid 9547:tid 9553] [client 52.156.220.49:17252] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gel4y.php"] [unique_id "aSGRtdClOR5qk7DoMeGtWQAAAUA"]
[Sat Nov 22 18:34:31.927248 2025] [:error] [pid 53477:tid 53499] [client 52.156.220.49:16668] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gel4y.php"] [unique_id "aSGRt37Lu30Ku9O40aK2wAAAABI"]
[Sat Nov 22 18:34:33.555231 2025] [:error] [pid 53477:tid 53502] [client 52.156.220.49:1715] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gel4y.php"] [unique_id "aSGRuX7Lu30Ku9O40aK2wwAAABU"]
[Sat Nov 22 18:34:34.660209 2025] [:error] [pid 53566:tid 53576] [client 52.156.220.49:6912] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/blue.php"] [unique_id "aSGRusbSHDBkRbwMbd4mXQAAAMg"]
[Sat Nov 22 18:34:41.540990 2025] [:error] [pid 53566:tid 53586] [client 52.156.220.49:6582] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/wp-conflg.php"] [unique_id "aSGRwcbSHDBkRbwMbd4mZgAAANI"]
[Sat Nov 22 18:34:47.446089 2025] [:error] [pid 44259:tid 44270] [client 52.156.220.49:12086] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/wp-configs.php"] [unique_id "aSGRx3Xe1xL-_YOdRmRsRwAAAYg"]
[Sat Nov 22 18:34:48.693462 2025] [:error] [pid 53477:tid 53502] [client 52.156.220.49:1286] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/wp-configs.php"] [unique_id "aSGRyH7Lu30Ku9O40aK23AAAABU"]
[Sat Nov 22 18:34:49.730234 2025] [:error] [pid 53566:tid 53568] [client 52.156.220.49:16345] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/wp-configs.php"] [unique_id "aSGRycbSHDBkRbwMbd4mdgAAAMA"]
[Sat Nov 22 18:34:53.899357 2025] [:error] [pid 53478:tid 53528] [client 52.156.220.49:4640] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/wp-configs.php"] [unique_id "aSGRzQhUYdXBbQswAdT0GgAAAFM"]
[Sat Nov 22 18:34:56.440801 2025] [:error] [pid 25856:tid 25874] [client 52.156.220.49:13289] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "aSGR0BsTP0wy94zKUvG2LQAAARA"]
[Sat Nov 22 18:34:59.585072 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:8700] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "aSGR03Xe1xL-_YOdRmRshwAAAYI"]
[Sat Nov 22 18:35:06.979766 2025] [:error] [pid 53477:tid 53497] [client 52.156.220.49:8650] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "aSGR2n7Lu30Ku9O40aK26wAAABA"]
[Sat Nov 22 18:35:08.406453 2025] [:error] [pid 53479:tid 53554] [client 52.156.220.49:13678] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "aSGR3G6cicFF3Aas-oSL7gAAAJI"]
[Sat Nov 22 18:35:19.666178 2025] [proxy_fcgi:error] [pid 53566:tid 53586] [client 52.156.220.49:20255] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:35:20.031096 2025] [:error] [pid 53566:tid 53588] [client 52.156.220.49:20255] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Response/siteindex.php"] [unique_id "aSGR6MbSHDBkRbwMbd4msAAAANQ"]
[Sat Nov 22 18:35:34.842858 2025] [:error] [pid 53478:tid 53528] [client 52.156.220.49:1424] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/wp-conflg.php"] [unique_id "aSGR9ghUYdXBbQswAdT0WwAAAFM"]
[Sat Nov 22 18:35:38.949010 2025] [proxy_fcgi:error] [pid 53566:tid 53583] [client 52.156.220.49:18099] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:35:39.248028 2025] [:error] [pid 53566:tid 53571] [client 52.156.220.49:18099] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/mah.php"] [unique_id "aSGR-8bSHDBkRbwMbd4mxwAAAMM"]
[Sat Nov 22 18:35:41.886090 2025] [:error] [pid 25856:tid 25866] [client 52.156.220.49:8613] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/install.php"] [unique_id "aSGR_RsTP0wy94zKUvG2hwAAAQg"]
[Sat Nov 22 18:35:44.304308 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:16933] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/packed.php"] [unique_id "aSGSABsTP0wy94zKUvG2kQAAAQA"]
[Sat Nov 22 18:35:45.626208 2025] [proxy_fcgi:error] [pid 53478:tid 53515] [client 52.156.220.49:19287] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:35:46.145335 2025] [:error] [pid 53478:tid 53533] [client 52.156.220.49:19287] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/network.php"] [unique_id "aSGSAghUYdXBbQswAdT0ZQAAAFg"]
[Sat Nov 22 18:35:47.682250 2025] [:error] [pid 53566:tid 53572] [client 52.156.220.49:10521] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aSGSA8bSHDBkRbwMbd4m0QAAAMQ"]
[Sat Nov 22 18:35:50.469511 2025] [proxy_fcgi:error] [pid 53566:tid 53590] [client 52.156.220.49:16297] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:35:50.726859 2025] [proxy_fcgi:error] [pid 53566:tid 53569] [client 52.156.220.49:16297] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:35:51.626876 2025] [:error] [pid 53566:tid 53568] [client 52.156.220.49:16297] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "aSGSB8bSHDBkRbwMbd4m3AAAAMA"]
[Sat Nov 22 18:35:53.881144 2025] [:error] [pid 53479:tid 53552] [client 52.156.220.49:19301] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "aSGSCW6cicFF3Aas-oSMMgAAAJA"]
[Sat Nov 22 18:35:55.710756 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:11208] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "aSGSC3Xe1xL-_YOdRmRtIAAAAYY"]
[Sat Nov 22 18:36:08.558244 2025] [:error] [pid 53566:tid 53569] [client 52.156.220.49:12803] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "aSGSGMbSHDBkRbwMbd4m8gAAAME"]
[Sat Nov 22 18:36:12.215040 2025] [:error] [pid 9547:tid 9566] [client 52.156.220.49:20321] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "aSGSHNClOR5qk7DoMeGuGAAAAU0"]
[Sat Nov 22 18:36:31.857229 2025] [:error] [pid 53477:tid 53504] [client 52.156.220.49:1800] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSGSL37Lu30Ku9O40aK3YAAAABc"]
[Sat Nov 22 18:36:35.409138 2025] [:error] [pid 53566:tid 53591] [client 52.156.220.49:16688] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSGSM8bSHDBkRbwMbd4nBgAAANc"]
[Sat Nov 22 18:36:37.222420 2025] [:error] [pid 53478:tid 53527] [client 52.156.220.49:16656] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSGSNQhUYdXBbQswAdT0iQAAAFI"]
[Sat Nov 22 18:36:44.771612 2025] [:error] [pid 53566:tid 53582] [client 52.156.220.49:15282] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSGSPMbSHDBkRbwMbd4nHAAAAM4"]
[Sat Nov 22 18:36:47.677480 2025] [:error] [pid 53477:tid 53489] [client 52.156.220.49:11491] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "aSGSP37Lu30Ku9O40aK3gQAAAAg"]
[Sat Nov 22 18:36:49.673416 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:15347] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "aSGSQRsTP0wy94zKUvG28QAAAQA"]
[Sat Nov 22 18:36:50.587670 2025] [:error] [pid 44259:tid 44265] [client 52.156.220.49:1076] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "aSGSQnXe1xL-_YOdRmRtbwAAAYM"]
[Sat Nov 22 18:36:52.924395 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:16672] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aSGSRHXe1xL-_YOdRmRtdgAAAYA"]
[Sat Nov 22 18:36:57.225585 2025] [proxy_fcgi:error] [pid 53477:tid 53488] [client 52.156.220.49:11467] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:36:57.494929 2025] [proxy_fcgi:error] [pid 53477:tid 53492] [client 52.156.220.49:11467] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:36:57.744510 2025] [:error] [pid 53477:tid 53497] [client 52.156.220.49:11467] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aSGSSX7Lu30Ku9O40aK3lgAAABA"]
[Sat Nov 22 18:37:02.510489 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:1077] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "aSGSTnXe1xL-_YOdRmRt0wAAAZI"]
[Sat Nov 22 18:37:04.755683 2025] [:error] [pid 53478:tid 53516] [client 52.156.220.49:11484] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSGSUAhUYdXBbQswAdT0rAAAAEc"]
[Sat Nov 22 18:37:07.721438 2025] [proxy_fcgi:error] [pid 25856:tid 25863] [client 52.156.220.49:9282] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:37:07.976970 2025] [proxy_fcgi:error] [pid 25856:tid 25858] [client 52.156.220.49:9282] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:37:08.320130 2025] [:error] [pid 25856:tid 25865] [client 52.156.220.49:9282] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "aSGSVBsTP0wy94zKUvG3OQAAAQc"]
[Sat Nov 22 18:37:09.694409 2025] [:error] [pid 53478:tid 53523] [client 52.156.220.49:9294] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "aSGSVQhUYdXBbQswAdT0sAAAAE4"]
[Sat Nov 22 18:37:22.076459 2025] [:error] [pid 53478:tid 53513] [client 52.156.220.49:22454] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "aSGSYghUYdXBbQswAdT0ugAAAEQ"]
[Sat Nov 22 18:37:27.259500 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:22440] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/about.php"] [unique_id "aSGSZ3Xe1xL-_YOdRmRuYAAAAYI"]
[Sat Nov 22 18:37:28.449624 2025] [proxy_fcgi:error] [pid 53566:tid 53586] [client 52.156.220.49:10125] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:37:28.701280 2025] [:error] [pid 53566:tid 53588] [client 52.156.220.49:10125] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/about.php"] [unique_id "aSGSaMbSHDBkRbwMbd4nUAAAANQ"]
[Sat Nov 22 18:37:30.508009 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:15103] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/about.php"] [unique_id "aSGSam6cicFF3Aas-oSMzAAAAJM"]
[Sat Nov 22 18:37:37.383049 2025] [:error] [pid 53477:tid 53503] [client 52.156.220.49:11720] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/about.php"] [unique_id "aSGScX7Lu30Ku9O40aK31QAAABY"]
[Sat Nov 22 18:37:39.104795 2025] [:error] [pid 53566:tid 53582] [client 52.156.220.49:10138] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/about.php"] [unique_id "aSGSc8bSHDBkRbwMbd4nXAAAAM4"]
[Sat Nov 22 18:37:40.091620 2025] [:error] [pid 53566:tid 53575] [client 52.156.220.49:19522] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "aSGSdMbSHDBkRbwMbd4nXQAAAMc"]
[Sat Nov 22 18:37:43.423348 2025] [:error] [pid 25856:tid 25870] [client 52.156.220.49:9959] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "aSGSdxsTP0wy94zKUvG3WwAAAQw"]
[Sat Nov 22 18:37:45.900776 2025] [:error] [pid 9547:tid 9574] [client 52.156.220.49:12101] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "aSGSedClOR5qk7DoMeGu1wAAAVU"]
[Sat Nov 22 18:37:49.195491 2025] [:error] [pid 53478:tid 53525] [client 52.156.220.49:13974] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "aSGSfQhUYdXBbQswAdT1JwAAAFA"]
[Sat Nov 22 18:37:51.249364 2025] [:error] [pid 44259:tid 44282] [client 52.156.220.49:18935] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/class-config.php"] [unique_id "aSGSf3Xe1xL-_YOdRmRurAAAAZQ"]
[Sat Nov 22 18:37:55.923246 2025] [:error] [pid 53477:tid 53485] [client 52.156.220.49:13979] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/class-config.php"] [unique_id "aSGSg37Lu30Ku9O40aK37wAAAAQ"]
[Sat Nov 22 18:37:58.178146 2025] [:error] [pid 53477:tid 53505] [client 52.156.220.49:12139] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/class-config.php"] [unique_id "aSGShn7Lu30Ku9O40aK39wAAABg"]
[Sat Nov 22 18:37:59.758508 2025] [:error] [pid 53566:tid 53568] [client 52.156.220.49:13987] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php/wp-includes/ID3/class-config.php"] [unique_id "aSGSh8bSHDBkRbwMbd4neQAAAMA"]
[Sat Nov 22 18:38:03.199981 2025] [:error] [pid 53479:tid 53560] [client 52.156.220.49:10223] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSGSi26cicFF3Aas-oSM9gAAAJg"]
[Sat Nov 22 18:38:04.452596 2025] [:error] [pid 53566:tid 53569] [client 52.156.220.49:10937] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/cloud.php"] [unique_id "aSGSjMbSHDBkRbwMbd4ngAAAAME"]
[Sat Nov 22 18:38:07.373577 2025] [:error] [pid 53478:tid 53515] [client 52.156.220.49:7894] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-includes/alfa-rex.php"] [unique_id "aSGSjwhUYdXBbQswAdT1fgAAAEY"]
[Sat Nov 22 18:38:09.495985 2025] [:error] [pid 53479:tid 53537] [client 52.156.220.49:12384] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "aSGSkW6cicFF3Aas-oSM_QAAAIE"]
[Sat Nov 22 18:38:11.399234 2025] [:error] [pid 9547:tid 9565] [client 52.156.220.49:14060] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "aSGSk9ClOR5qk7DoMeGvCQAAAUw"]
[Sat Nov 22 18:38:19.792870 2025] [:error] [pid 25856:tid 25867] [client 52.156.220.49:1944] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "aSGSmxsTP0wy94zKUvG3iQAAAQk"]
[Sat Nov 22 18:38:21.656016 2025] [:error] [pid 9547:tid 9562] [client 52.156.220.49:10228] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "aSGSndClOR5qk7DoMeGvGgAAAUk"]
[Sat Nov 22 18:38:23.580781 2025] [:error] [pid 53566:tid 53582] [client 52.156.220.49:7927] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/classwithtostring.php"] [unique_id "aSGSn8bSHDBkRbwMbd4njwAAAM4"]
[Sat Nov 22 18:38:24.844727 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:14064] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/classwithtostring.php"] [unique_id "aSGSoHXe1xL-_YOdRmRvBAAAAYY"]
[Sat Nov 22 18:38:28.109661 2025] [proxy_fcgi:error] [pid 53479:tid 53550] [client 52.156.220.49:1945] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:28.361114 2025] [:error] [pid 53479:tid 53551] [client 52.156.220.49:1945] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/rk2.php"] [unique_id "aSGSpG6cicFF3Aas-oSNLAAAAI8"]
[Sat Nov 22 18:38:32.056714 2025] [proxy_fcgi:error] [pid 53566:tid 53590] [client 52.156.220.49:9487] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:33.834390 2025] [proxy_fcgi:error] [pid 53566:tid 53580] [client 52.156.220.49:9487] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:34.085530 2025] [:error] [pid 53566:tid 53574] [client 52.156.220.49:9487] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/shell.php"] [unique_id "aSGSqsbSHDBkRbwMbd4nowAAAMY"]
[Sat Nov 22 18:38:37.317069 2025] [proxy_fcgi:error] [pid 25856:tid 25875] [client 52.156.220.49:17250] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:37.570764 2025] [proxy_fcgi:error] [pid 25856:tid 25858] [client 52.156.220.49:17250] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:37.826029 2025] [proxy_fcgi:error] [pid 25856:tid 25871] [client 52.156.220.49:17250] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:38:38.076828 2025] [:error] [pid 25856:tid 25861] [client 52.156.220.49:17250] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/autoload_classmap.php"] [unique_id "aSGSrhsTP0wy94zKUvG3mwAAAQM"]
[Sat Nov 22 18:38:39.899290 2025] [:error] [pid 44259:tid 44282] [client 52.156.220.49:6220] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSGSr3Xe1xL-_YOdRmRvKQAAAZQ"]
[Sat Nov 22 18:38:41.255797 2025] [:error] [pid 9547:tid 9564] [client 52.156.220.49:11166] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "aSGSsdClOR5qk7DoMeGvNAAAAUs"]
[Sat Nov 22 18:38:43.148940 2025] [:error] [pid 9547:tid 9573] [client 52.156.220.49:6242] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aSGSs9ClOR5qk7DoMeGvNgAAAVQ"]
[Sat Nov 22 18:38:48.568576 2025] [:error] [pid 44259:tid 44282] [client 52.156.220.49:20542] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/text.php"] [unique_id "aSGSuHXe1xL-_YOdRmRvSwAAAZQ"]
[Sat Nov 22 18:38:50.463201 2025] [:error] [pid 44259:tid 44272] [client 52.156.220.49:10618] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/muse.php"] [unique_id "aSGSunXe1xL-_YOdRmRvUAAAAYo"]
[Sat Nov 22 18:38:52.974771 2025] [:error] [pid 25856:tid 25862] [client 52.156.220.49:5750] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "aSGSvBsTP0wy94zKUvG3xQAAAQQ"]
[Sat Nov 22 18:38:54.374262 2025] [:error] [pid 53477:tid 53495] [client 52.156.220.49:6559] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "aSGSvn7Lu30Ku9O40aK4agAAAA4"]
[Sat Nov 22 18:38:56.491270 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:10603] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "aSGSwHXe1xL-_YOdRmRvZgAAAZY"]
[Sat Nov 22 18:38:58.296413 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:5702] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSGSwtClOR5qk7DoMeGvbwAAAUQ"]
[Sat Nov 22 18:39:00.304001 2025] [:error] [pid 53478:tid 53532] [client 52.156.220.49:6530] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSGSxAhUYdXBbQswAdT1vgAAAFc"]
[Sat Nov 22 18:39:02.363590 2025] [:error] [pid 9547:tid 9555] [client 52.156.220.49:6543] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSGSxtClOR5qk7DoMeGvfwAAAUI"]
[Sat Nov 22 18:39:10.577061 2025] [:error] [pid 9547:tid 9564] [client 52.156.220.49:6913] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSGSztClOR5qk7DoMeGvuAAAAUs"]
[Sat Nov 22 18:39:15.675932 2025] [:error] [pid 25856:tid 25870] [client 52.156.220.49:12043] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/chosen.php"] [unique_id "aSGS0xsTP0wy94zKUvG4EgAAAQw"]
[Sat Nov 22 18:39:19.165478 2025] [:error] [pid 9547:tid 9554] [client 52.156.220.49:6931] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2022/update.php"] [unique_id "aSGS19ClOR5qk7DoMeGv4gAAAUE"]
[Sat Nov 22 18:39:29.777989 2025] [:error] [pid 9547:tid 9572] [client 52.156.220.49:6570] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2022/update.php"] [unique_id "aSGS4dClOR5qk7DoMeGv7wAAAVM"]
[Sat Nov 22 18:39:30.955784 2025] [:error] [pid 53566:tid 53571] [client 52.156.220.49:8327] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2022/update.php"] [unique_id "aSGS4sbSHDBkRbwMbd4n2AAAAMM"]
[Sat Nov 22 18:39:41.531557 2025] [:error] [pid 9547:tid 9559] [client 52.156.220.49:13268] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSGS7dClOR5qk7DoMeGwAQAAAUY"]
[Sat Nov 22 18:39:43.273756 2025] [:error] [pid 53479:tid 53541] [client 52.156.220.49:13294] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSGS726cicFF3Aas-oSNngAAAIU"]
[Sat Nov 22 18:39:45.153330 2025] [:error] [pid 53566:tid 53571] [client 52.156.220.49:7156] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSGS8cbSHDBkRbwMbd4n8QAAAMM"]
[Sat Nov 22 18:39:46.359398 2025] [:error] [pid 9547:tid 9561] [client 52.156.220.49:14596] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSGS8tClOR5qk7DoMeGwCwAAAUg"]
[Sat Nov 22 18:39:47.857974 2025] [:error] [pid 44259:tid 44271] [client 52.156.220.49:4624] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/astra/inc/network.php"] [unique_id "aSGS83Xe1xL-_YOdRmRvyAAAAYk"]
[Sat Nov 22 18:39:50.359644 2025] [proxy_fcgi:error] [pid 53479:tid 53543] [client 52.156.220.49:14602] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:39:51.761823 2025] [:error] [pid 53479:tid 53547] [client 52.156.220.49:14602] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSGS926cicFF3Aas-oSNvQAAAIs"]
[Sat Nov 22 18:40:03.590303 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:7162] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-includes/about.php"] [unique_id "aSGTA9ClOR5qk7DoMeGwHwAAAUQ"]
[Sat Nov 22 18:40:06.505467 2025] [:error] [pid 9547:tid 9574] [client 52.156.220.49:13591] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/uploads/media.php"] [unique_id "aSGTBtClOR5qk7DoMeGwKAAAAVU"]
[Sat Nov 22 18:40:07.534842 2025] [:error] [pid 53478:tid 53523] [client 52.156.220.49:18108] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/uploads/media.php"] [unique_id "aSGTBwhUYdXBbQswAdT2JwAAAE4"]
[Sat Nov 22 18:40:10.821652 2025] [:error] [pid 9547:tid 9565] [client 52.156.220.49:14597] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/uploads/media.php"] [unique_id "aSGTCtClOR5qk7DoMeGwMQAAAUw"]
[Sat Nov 22 18:40:12.923880 2025] [:error] [pid 9547:tid 9571] [client 52.156.220.49:13597] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/uploads/media.php"] [unique_id "aSGTDNClOR5qk7DoMeGwOQAAAVI"]
[Sat Nov 22 18:40:14.205011 2025] [:error] [pid 53479:tid 53538] [client 52.156.220.49:1546] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/index.php"] [unique_id "aSGTDm6cicFF3Aas-oSN3QAAAII"]
[Sat Nov 22 18:40:16.196202 2025] [:error] [pid 44259:tid 44263] [client 52.156.220.49:14645] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/index.php"] [unique_id "aSGTEHXe1xL-_YOdRmRv-wAAAYE"]
[Sat Nov 22 18:40:25.877280 2025] [:error] [pid 25856:tid 25871] [client 52.156.220.49:16941] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/index.php"] [unique_id "aSGTGRsTP0wy94zKUvG4XQAAAQ0"]
[Sat Nov 22 18:40:27.150210 2025] [:error] [pid 44259:tid 44264] [client 52.156.220.49:13590] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/index.php"] [unique_id "aSGTG3Xe1xL-_YOdRmRwEQAAAYI"]
[Sat Nov 22 18:40:29.149023 2025] [:error] [pid 53478:tid 53524] [client 52.156.220.49:7119] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "aSGTHQhUYdXBbQswAdT2RwAAAE8"]
[Sat Nov 22 18:40:33.341488 2025] [:error] [pid 53478:tid 53522] [client 52.156.220.49:19785] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "aSGTIQhUYdXBbQswAdT2UwAAAE0"]
[Sat Nov 22 18:40:34.573224 2025] [:error] [pid 53479:tid 53549] [client 52.156.220.49:13624] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "aSGTIm6cicFF3Aas-oSOHAAAAI0"]
[Sat Nov 22 18:40:36.515868 2025] [:error] [pid 53479:tid 53552] [client 52.156.220.49:16334] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/coffee/about.php"] [unique_id "aSGTJG6cicFF3Aas-oSOIQAAAJA"]
[Sat Nov 22 18:40:40.154798 2025] [:error] [pid 53477:tid 53505] [client 52.156.220.49:19826] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/browse.php"] [unique_id "aSGTKH7Lu30Ku9O40aK4-AAAABg"]
[Sat Nov 22 18:40:43.310998 2025] [:error] [pid 25856:tid 25872] [client 52.156.220.49:22146] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/browse.php"] [unique_id "aSGTKxsTP0wy94zKUvG4egAAAQ4"]
[Sat Nov 22 18:40:48.858495 2025] [:error] [pid 53566:tid 53583] [client 52.156.220.49:17251] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/browse.php"] [unique_id "aSGTMMbSHDBkRbwMbd4oNgAAAM8"]
[Sat Nov 22 18:41:14.510908 2025] [:error] [pid 9547:tid 9565] [client 52.156.220.49:1746] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSGTStClOR5qk7DoMeGxjAAAAUw"]
[Sat Nov 22 18:41:15.692821 2025] [:error] [pid 9547:tid 9566] [client 52.156.220.49:6940] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSGTS9ClOR5qk7DoMeGxkwAAAU0"]
[Sat Nov 22 18:41:20.342384 2025] [proxy_fcgi:error] [pid 53477:tid 53487] [client 52.156.220.49:1400] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:41:20.751759 2025] [:error] [pid 53477:tid 53482] [client 52.156.220.49:1400] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSGTUH7Lu30Ku9O40aK5GAAAAAE"]
[Sat Nov 22 18:41:29.406393 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:16663] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Utility/cc.php"] [unique_id "aSGTWXXe1xL-_YOdRmRwwAAAAYY"]
[Sat Nov 22 18:41:31.823163 2025] [:error] [pid 53477:tid 53498] [client 52.156.220.49:7192] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "aSGTW37Lu30Ku9O40aK5JgAAABE"]
[Sat Nov 22 18:41:33.735665 2025] [proxy_fcgi:error] [pid 53477:tid 53494] [client 52.156.220.49:7212] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:41:36.662307 2025] [:error] [pid 53477:tid 53495] [client 52.156.220.49:7212] [client 52.156.220.49] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "45.128.199.152_949e00c28fd9454b5d0e6b9d1f278414c6b0b6d9"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/wp-admin/update.php"] [unique_id "aSGTXX7Lu30Ku9O40aK5KAAAAA4"]
[Sat Nov 22 18:41:36.918427 2025] [:error] [pid 53477:tid 53501] [client 52.156.220.49:7212] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSGTYH7Lu30Ku9O40aK5LQAAABQ"]
[Sat Nov 22 18:41:40.735217 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:1622] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSGTZHXe1xL-_YOdRmRw6AAAAYY"]
[Sat Nov 22 18:41:42.456859 2025] [:error] [pid 53566:tid 53580] [client 52.156.220.49:14367] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSGTZsbSHDBkRbwMbd4oewAAAMw"]
[Sat Nov 22 18:41:45.711513 2025] [:error] [pid 53479:tid 53547] [client 52.156.220.49:16975] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSGTaW6cicFF3Aas-oSOZQAAAIs"]
[Sat Nov 22 18:41:47.075764 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:17004] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "aSGTa37Lu30Ku9O40aK5MQAAAAs"]
[Sat Nov 22 18:41:48.172386 2025] [:error] [pid 53477:tid 53486] [client 52.156.220.49:16980] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "aSGTbH7Lu30Ku9O40aK5NAAAAAU"]
[Sat Nov 22 18:42:02.758116 2025] [:error] [pid 9547:tid 9574] [client 52.156.220.49:22464] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "aSGTetClOR5qk7DoMeGyBQAAAVU"]
[Sat Nov 22 18:42:05.612895 2025] [:error] [pid 53566:tid 53584] [client 52.156.220.49:6909] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "aSGTfcbSHDBkRbwMbd4ojAAAANA"]
[Sat Nov 22 18:42:08.873264 2025] [:error] [pid 53566:tid 53573] [client 52.156.220.49:1481] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "aSGTgMbSHDBkRbwMbd4okQAAAMU"]
[Sat Nov 22 18:42:10.211604 2025] [:error] [pid 53479:tid 53550] [client 52.156.220.49:8917] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "aSGTgm6cicFF3Aas-oSOegAAAI4"]
[Sat Nov 22 18:42:11.930595 2025] [:error] [pid 53477:tid 53486] [client 52.156.220.49:1758] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSGTg37Lu30Ku9O40aK5UgAAAAU"]
[Sat Nov 22 18:42:14.321374 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:22868] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSGThtClOR5qk7DoMeGyJwAAAUQ"]
[Sat Nov 22 18:42:20.130348 2025] [:error] [pid 53477:tid 53492] [client 52.156.220.49:19261] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSGTjH7Lu30Ku9O40aK5ZQAAAAs"]
[Sat Nov 22 18:42:24.620499 2025] [:error] [pid 53566:tid 53570] [client 52.156.220.49:19524] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSGTkMbSHDBkRbwMbd4ooAAAAMI"]
[Sat Nov 22 18:42:25.917918 2025] [:error] [pid 53478:tid 53526] [client 52.156.220.49:19543] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aSGTkQhUYdXBbQswAdT3BAAAAFE"]
[Sat Nov 22 18:42:26.973977 2025] [:error] [pid 53566:tid 53583] [client 52.156.220.49:1059] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSGTksbSHDBkRbwMbd4opQAAAM8"]
[Sat Nov 22 18:42:34.845264 2025] [:error] [pid 44259:tid 44275] [client 52.156.220.49:12096] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSGTmnXe1xL-_YOdRmRxdQAAAY0"]
[Sat Nov 22 18:42:40.271341 2025] [proxy_fcgi:error] [pid 53479:tid 53550] [client 52.156.220.49:19495] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:42:40.534500 2025] [proxy_fcgi:error] [pid 53479:tid 53554] [client 52.156.220.49:19495] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:42:41.703755 2025] [:error] [pid 53479:tid 53553] [client 52.156.220.49:19495] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/alfa-rex.php"] [unique_id "aSGToW6cicFF3Aas-oSOrAAAAJE"]
[Sat Nov 22 18:42:46.864628 2025] [proxy_fcgi:error] [pid 53478:tid 53513] [client 52.156.220.49:20951] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:42:47.850780 2025] [:error] [pid 53478:tid 53531] [client 52.156.220.49:20951] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/shell.php"] [unique_id "aSGTpwhUYdXBbQswAdT3NgAAAFY"]
[Sat Nov 22 18:42:59.493607 2025] [proxy_fcgi:error] [pid 9547:tid 9564] [client 52.156.220.49:19489] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:42:59.768092 2025] [:error] [pid 9547:tid 9566] [client 52.156.220.49:19489] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/content.php"] [unique_id "aSGTs9ClOR5qk7DoMeGyXAAAAU0"]
[Sat Nov 22 18:43:01.879899 2025] [:error] [pid 9547:tid 9568] [client 52.156.220.49:20884] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/content.php"] [unique_id "aSGTtdClOR5qk7DoMeGyXQAAAU8"]
[Sat Nov 22 18:43:04.684664 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:7872] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/content.php"] [unique_id "aSGTuHXe1xL-_YOdRmRxrAAAAYA"]
[Sat Nov 22 18:43:06.545736 2025] [:error] [pid 25856:tid 25866] [client 52.156.220.49:1920] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/content.php"] [unique_id "aSGTuhsTP0wy94zKUvG5SgAAAQg"]
[Sat Nov 22 18:43:08.667697 2025] [:error] [pid 53566:tid 53570] [client 52.156.220.49:12376] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSGTvMbSHDBkRbwMbd4ozwAAAMI"]
[Sat Nov 22 18:43:14.325888 2025] [:error] [pid 9547:tid 9573] [client 52.156.220.49:7609] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSGTwtClOR5qk7DoMeGyawAAAVQ"]
[Sat Nov 22 18:43:18.919206 2025] [:error] [pid 9547:tid 9559] [client 52.156.220.49:12391] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSGTxtClOR5qk7DoMeGydgAAAUY"]
[Sat Nov 22 18:43:20.324430 2025] [:error] [pid 44259:tid 44262] [client 52.156.220.49:4673] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSGTyHXe1xL-_YOdRmRxxgAAAYA"]
[Sat Nov 22 18:43:21.390005 2025] [:error] [pid 53478:tid 53518] [client 52.156.220.49:20334] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Utility/alfa-rex.php"] [unique_id "aSGTyQhUYdXBbQswAdT3TwAAAEk"]
[Sat Nov 22 18:43:30.574100 2025] [:error] [pid 44259:tid 44276] [client 52.156.220.49:12352] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/ty.php"] [unique_id "aSGT0nXe1xL-_YOdRmRx2QAAAY4"]
[Sat Nov 22 18:43:36.989117 2025] [:error] [pid 53477:tid 53490] [client 52.156.220.49:8429] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/content.php"] [unique_id "aSGT2H7Lu30Ku9O40aK5ygAAAAk"]
[Sat Nov 22 18:43:42.871340 2025] [:error] [pid 53479:tid 53541] [client 52.156.220.49:8393] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/content.php"] [unique_id "aSGT3m6cicFF3Aas-oSO5QAAAIU"]
[Sat Nov 22 18:43:43.919219 2025] [:error] [pid 9547:tid 9555] [client 52.156.220.49:8838] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/content.php"] [unique_id "aSGT39ClOR5qk7DoMeGy6AAAAUI"]
[Sat Nov 22 18:43:46.652638 2025] [:error] [pid 53566:tid 53568] [client 52.156.220.49:8843] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/content.php"] [unique_id "aSGT4sbSHDBkRbwMbd4o7QAAAMA"]
[Sat Nov 22 18:43:51.300298 2025] [:error] [pid 53478:tid 53531] [client 52.156.220.49:9216] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/index.php"] [unique_id "aSGT5whUYdXBbQswAdT3ZgAAAFY"]
[Sat Nov 22 18:43:52.693439 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:12001] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/index.php"] [unique_id "aSGT6HXe1xL-_YOdRmRyFgAAAZY"]
[Sat Nov 22 18:43:53.570200 2025] [:error] [pid 53479:tid 53536] [client 52.156.220.49:12009] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/index.php"] [unique_id "aSGT6W6cicFF3Aas-oSO-wAAAIA"]
[Sat Nov 22 18:43:55.014134 2025] [:error] [pid 9547:tid 9560] [client 52.156.220.49:6548] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/index.php"] [unique_id "aSGT69ClOR5qk7DoMeGy-QAAAUc"]
[Sat Nov 22 18:43:57.077880 2025] [:error] [pid 53566:tid 53583] [client 52.156.220.49:10620] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSGT7cbSHDBkRbwMbd4o-gAAAM8"]
[Sat Nov 22 18:44:08.023243 2025] [:error] [pid 53477:tid 53481] [client 52.156.220.49:20535] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/alfa-rex.php"] [unique_id "aSGT-H7Lu30Ku9O40aK6GAAAAAA"]
[Sat Nov 22 18:44:12.234290 2025] [:error] [pid 25856:tid 25870] [client 52.156.220.49:8849] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "aSGT_BsTP0wy94zKUvG50gAAAQw"]
[Sat Nov 22 18:44:17.587262 2025] [:error] [pid 53566:tid 53592] [client 52.156.220.49:22171] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/wp-login.php"] [unique_id "aSGUAcbSHDBkRbwMbd4pFAAAANg"]
[Sat Nov 22 18:44:18.122708 2025] [:error] [pid 53566:tid 53587] [client 52.156.220.49:22171] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSGUAsbSHDBkRbwMbd4pFwAAANM"]
[Sat Nov 22 18:44:26.318831 2025] [:error] [pid 44259:tid 44281] [client 52.156.220.49:6538] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSGUCnXe1xL-_YOdRmRybwAAAZM"]
[Sat Nov 22 18:44:31.076500 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:5703] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aSGUD26cicFF3Aas-oSPTQAAAJM"]
[Sat Nov 22 18:44:37.683155 2025] [:error] [pid 53478:tid 53521] [client 52.156.220.49:4656] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSGUFQhUYdXBbQswAdT3jQAAAEw"]
[Sat Nov 22 18:44:38.826917 2025] [:error] [pid 53566:tid 53570] [client 52.156.220.49:6555] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aSGUFsbSHDBkRbwMbd4pLQAAAMI"]
[Sat Nov 22 18:44:41.649959 2025] [:error] [pid 25856:tid 25873] [client 52.156.220.49:16331] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aSGUGRsTP0wy94zKUvG55wAAAQ8"]
[Sat Nov 22 18:44:42.750872 2025] [:error] [pid 25856:tid 25866] [client 52.156.220.49:6238] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aSGUGhsTP0wy94zKUvG56QAAAQg"]
[Sat Nov 22 18:44:45.297790 2025] [:error] [pid 53478:tid 53525] [client 52.156.220.49:16917] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "aSGUHQhUYdXBbQswAdT3kwAAAFA"]
[Sat Nov 22 18:44:47.044728 2025] [:error] [pid 9547:tid 9571] [client 52.156.220.49:4654] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/about.php"] [unique_id "aSGUH9ClOR5qk7DoMeGzUQAAAVI"]
[Sat Nov 22 18:44:48.574455 2025] [:error] [pid 53478:tid 53517] [client 52.156.220.49:13628] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "aSGUIAhUYdXBbQswAdT3lAAAAEg"]
[Sat Nov 22 18:44:50.682265 2025] [:error] [pid 53477:tid 53487] [client 52.156.220.49:8702] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "aSGUIn7Lu30Ku9O40aK6LQAAAAY"]
[Sat Nov 22 18:44:54.665184 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:8360] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "aSGUJnXe1xL-_YOdRmRynQAAAZI"]
[Sat Nov 22 18:45:00.853888 2025] [:error] [pid 53479:tid 53555] [client 52.156.220.49:8377] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "aSGULG6cicFF3Aas-oSPfwAAAJM"]
[Sat Nov 22 18:45:03.841101 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:12039] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSGUL9ClOR5qk7DoMeGzXAAAAUQ"]
[Sat Nov 22 18:45:06.599215 2025] [:error] [pid 25856:tid 25859] [client 52.156.220.49:6971] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/plugins/jquery-file-upload/server/php/include.php"] [unique_id "aSGUMhsTP0wy94zKUvG5_QAAAQE"]
[Sat Nov 22 18:45:07.887186 2025] [:error] [pid 53478:tid 53529] [client 52.156.220.49:15359] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/plugins/jquery-file-upload/server/php/include.php"] [unique_id "aSGUMwhUYdXBbQswAdT3pAAAAFQ"]
[Sat Nov 22 18:45:10.962068 2025] [:error] [pid 53566:tid 53578] [client 52.156.220.49:6973] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/plugins/jquery-file-upload/server/php/include.php"] [unique_id "aSGUNsbSHDBkRbwMbd4pTAAAAMo"]
[Sat Nov 22 18:45:24.308406 2025] [proxy_fcgi:error] [pid 53477:tid 53494] [client 52.156.220.49:20087] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:45:25.102497 2025] [:error] [pid 53477:tid 53490] [client 52.156.220.49:20087] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/alfa-rex.php"] [unique_id "aSGURX7Lu30Ku9O40aK6SAAAAAk"]
[Sat Nov 22 18:45:27.255558 2025] [proxy_fcgi:error] [pid 9547:tid 9575] [client 52.156.220.49:7550] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:45:27.534783 2025] [proxy_fcgi:error] [pid 9547:tid 9559] [client 52.156.220.49:7550] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:45:28.351837 2025] [:error] [pid 9547:tid 9576] [client 52.156.220.49:7550] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSGUSNClOR5qk7DoMeGzdAAAAVc"]
[Sat Nov 22 18:45:29.351822 2025] [:error] [pid 53479:tid 53543] [client 52.156.220.49:7522] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/file.php"] [unique_id "aSGUSW6cicFF3Aas-oSPqwAAAIc"]
[Sat Nov 22 18:45:36.866431 2025] [:error] [pid 53566:tid 53576] [client 52.156.220.49:10540] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/parx.php"] [unique_id "aSGUUMbSHDBkRbwMbd4pdQAAAMg"]
[Sat Nov 22 18:45:48.149974 2025] [proxy_fcgi:error] [pid 25856:tid 25866] [client 52.156.220.49:19265] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:45:48.400263 2025] [:error] [pid 25856:tid 25861] [client 52.156.220.49:19265] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/wp-conflg.php"] [unique_id "aSGUXBsTP0wy94zKUvG6IwAAAQM"]
[Sat Nov 22 18:46:01.808072 2025] [:error] [pid 9547:tid 9563] [client 52.156.220.49:4719] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSGUadClOR5qk7DoMeGzrgAAAUo"]
[Sat Nov 22 18:46:04.089951 2025] [:error] [pid 9547:tid 9572] [client 52.156.220.49:17698] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/upfile.php"] [unique_id "aSGUbNClOR5qk7DoMeGztwAAAVM"]
[Sat Nov 22 18:46:06.421838 2025] [:error] [pid 53479:tid 53553] [client 52.156.220.49:10121] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/upfile.php"] [unique_id "aSGUbm6cicFF3Aas-oSQJAAAAJE"]
[Sat Nov 22 18:46:07.615041 2025] [:error] [pid 25856:tid 25869] [client 52.156.220.49:1179] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/upfile.php"] [unique_id "aSGUbxsTP0wy94zKUvG6VAAAAQs"]
[Sat Nov 22 18:46:11.096634 2025] [:error] [pid 53478:tid 53526] [client 52.156.220.49:1501] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/upfile.php"] [unique_id "aSGUcwhUYdXBbQswAdT4EQAAAFE"]
[Sat Nov 22 18:46:22.467151 2025] [:error] [pid 25856:tid 25878] [client 52.156.220.49:6254] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/wp-login.php"] [unique_id "aSGUfhsTP0wy94zKUvG6eAAAARQ"]
[Sat Nov 22 18:46:26.396455 2025] [:error] [pid 25856:tid 25860] [client 52.156.220.49:6216] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSGUghsTP0wy94zKUvG6ewAAAQI"]
[Sat Nov 22 18:46:34.791922 2025] [:error] [pid 53566:tid 53573] [client 52.156.220.49:22427] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSGUisbSHDBkRbwMbd4p0gAAAMU"]
[Sat Nov 22 18:46:40.911212 2025] [:error] [pid 9547:tid 9554] [client 52.156.220.49:1460] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSGUkNClOR5qk7DoMeG0LQAAAUE"]
[Sat Nov 22 18:46:43.476163 2025] [:error] [pid 25856:tid 25880] [client 52.156.220.49:18485] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSGUkxsTP0wy94zKUvG6ogAAARY"]
[Sat Nov 22 18:46:45.376684 2025] [:error] [pid 25856:tid 25873] [client 52.156.220.49:12922] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSGUlRsTP0wy94zKUvG6owAAAQ8"]
[Sat Nov 22 18:46:46.705163 2025] [:error] [pid 9547:tid 9560] [client 52.156.220.49:1029] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSGUltClOR5qk7DoMeG0RAAAAUc"]
[Sat Nov 22 18:46:54.197254 2025] [:error] [pid 53477:tid 53483] [client 52.156.220.49:19201] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aSGUnn7Lu30Ku9O40aK65AAAAAI"]
[Sat Nov 22 18:46:55.942963 2025] [:error] [pid 53478:tid 53530] [client 52.156.220.49:16722] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aSGUnwhUYdXBbQswAdT4VAAAAFU"]
[Sat Nov 22 18:46:59.993881 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:8615] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aSGUo3Xe1xL-_YOdRmRz1wAAAZI"]
[Sat Nov 22 18:47:10.400692 2025] [:error] [pid 53566:tid 53583] [client 52.156.220.49:18458] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSGUrsbSHDBkRbwMbd4p-wAAAM8"]
[Sat Nov 22 18:47:23.464820 2025] [proxy_fcgi:error] [pid 53477:tid 53490] [client 52.156.220.49:9598] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:47:23.717999 2025] [:error] [pid 53477:tid 53495] [client 52.156.220.49:9598] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSGUu37Lu30Ku9O40aK7GQAAAA4"]
[Sat Nov 22 18:47:30.956947 2025] [proxy_fcgi:error] [pid 44259:tid 44284] [client 52.156.220.49:20604] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:47:31.212994 2025] [proxy_fcgi:error] [pid 44259:tid 44285] [client 52.156.220.49:20604] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:47:31.463682 2025] [:error] [pid 44259:tid 44277] [client 52.156.220.49:20604] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/content.php"] [unique_id "aSGUw3Xe1xL-_YOdRmR0LQAAAY8"]
[Sat Nov 22 18:47:32.960411 2025] [:error] [pid 9547:tid 9563] [client 52.156.220.49:1358] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aSGUxNClOR5qk7DoMeG0zQAAAUo"]
[Sat Nov 22 18:47:45.058868 2025] [proxy_fcgi:error] [pid 44259:tid 44271] [client 52.156.220.49:10911] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:47:45.386297 2025] [:error] [pid 44259:tid 44278] [client 52.156.220.49:10911] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSGU0XXe1xL-_YOdRmR0XAAAAZA"]
[Sat Nov 22 18:47:46.435745 2025] [:error] [pid 25856:tid 25858] [client 52.156.220.49:1728] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSGU0hsTP0wy94zKUvG64wAAAQA"]
[Sat Nov 22 18:47:49.167191 2025] [:error] [pid 25856:tid 25870] [client 52.156.220.49:1379] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSGU1RsTP0wy94zKUvG65gAAAQw"]
[Sat Nov 22 18:47:58.089467 2025] [:error] [pid 53477:tid 53483] [client 52.156.220.49:1681] [client 52.156.220.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.156.220.49, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aSGU3n7Lu30Ku9O40aK7YQAAAAI"]
[Sat Nov 22 18:47:58.093939 2025] [proxy_fcgi:error] [pid 53477:tid 53483] [client 52.156.220.49:1681] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:47:58.607896 2025] [:error] [pid 53477:tid 53493] [client 52.156.220.49:1681] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-conflg.php/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSGU3n7Lu30Ku9O40aK7YwAAAAw"]
[Sat Nov 22 18:48:01.602231 2025] [proxy_fcgi:error] [pid 53478:tid 53524] [client 52.156.220.49:13634] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:48:02.889092 2025] [:error] [pid 53478:tid 53518] [client 52.156.220.49:13634] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "aSGU4ghUYdXBbQswAdT4ywAAAEk"]
[Sat Nov 22 18:48:07.798640 2025] [:error] [pid 25856:tid 25872] [client 52.156.220.49:7184] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/install.php"] [unique_id "aSGU5xsTP0wy94zKUvG6_AAAAQ4"]
[Sat Nov 22 18:48:10.873054 2025] [:error] [pid 53478:tid 53530] [client 52.156.220.49:22788] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "aSGU6ghUYdXBbQswAdT42AAAAFU"]
[Sat Nov 22 18:48:12.480078 2025] [:error] [pid 44259:tid 44265] [client 52.156.220.49:12310] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "aSGU7HXe1xL-_YOdRmR0iQAAAYM"]
[Sat Nov 22 18:48:13.989474 2025] [:error] [pid 53477:tid 53483] [client 52.156.220.49:13664] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "aSGU7X7Lu30Ku9O40aK7cAAAAAI"]
[Sat Nov 22 18:48:22.703293 2025] [:error] [pid 25856:tid 25882] [client 52.156.220.49:12560] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "aSGU9hsTP0wy94zKUvG7HwAAARg"]
[Sat Nov 22 18:48:23.638768 2025] [:error] [pid 44259:tid 44280] [client 52.156.220.49:14381] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "aSGU93Xe1xL-_YOdRmR0ogAAAZI"]
[Sat Nov 22 18:48:25.014832 2025] [:error] [pid 53479:tid 53544] [client 52.156.220.49:14384] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "aSGU-W6cicFF3Aas-oSRcQAAAIg"]
[Sat Nov 22 18:48:28.120401 2025] [:error] [pid 53566:tid 53572] [client 52.156.220.49:1144] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "aSGU_MbSHDBkRbwMbd4qTAAAAMQ"]
[Sat Nov 22 18:48:28.987299 2025] [:error] [pid 9547:tid 9573] [client 52.156.220.49:8880] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "aSGU_NClOR5qk7DoMeG1OgAAAVQ"]
[Sat Nov 22 18:48:33.844407 2025] [:error] [pid 53479:tid 53560] [client 52.156.220.49:4711] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "aSGVAW6cicFF3Aas-oSRfAAAAJg"]
[Sat Nov 22 18:48:39.232875 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:1267] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "aSGVB3Xe1xL-_YOdRmR0tgAAAYY"]
[Sat Nov 22 18:48:40.090098 2025] [:error] [pid 44259:tid 44274] [client 52.156.220.49:14373] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "aSGVCHXe1xL-_YOdRmR0uQAAAYw"]
[Sat Nov 22 18:48:46.873418 2025] [:error] [pid 44259:tid 44268] [client 52.156.220.49:12854] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/wp-login.php"] [unique_id "aSGVDnXe1xL-_YOdRmR0wgAAAYY"]
[Sat Nov 22 18:48:48.984147 2025] [:error] [pid 53477:tid 53485] [client 52.156.220.49:6175] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "aSGVEH7Lu30Ku9O40aK7mAAAAAQ"]
[Sat Nov 22 18:48:50.761663 2025] [:error] [pid 9547:tid 9571] [client 52.156.220.49:9244] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "aSGVEtClOR5qk7DoMeG1TwAAAVI"]
[Sat Nov 22 18:48:52.484521 2025] [:error] [pid 53479:tid 53544] [client 52.156.220.49:5706] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "aSGVFG6cicFF3Aas-oSRqAAAAIg"]
[Sat Nov 22 18:48:53.662287 2025] [:error] [pid 9547:tid 9557] [client 52.156.220.49:7957] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aSGVFdClOR5qk7DoMeG1UAAAAUQ"]
[Sat Nov 22 18:48:54.750984 2025] [:error] [pid 9547:tid 9575] [client 52.156.220.49:9229] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aSGVFtClOR5qk7DoMeG1UwAAAVY"]
[Sat Nov 22 18:48:56.939859 2025] [:error] [pid 44259:tid 44272] [client 52.156.220.49:11480] [client 52.156.220.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aSGVGHXe1xL-_YOdRmR09QAAAYo"]
[Sat Nov 22 18:49:02.343105 2025] [proxy_fcgi:error] [pid 25856:tid 25868] [client 52.156.220.49:16945] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 18:49:02.716726 2025] [:error] [pid 25856:tid 25875] [client 52.156.220.49:16945] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/alfa-rex.php"] [unique_id "aSGVHhsTP0wy94zKUvG7sAAAARE"]
[Sat Nov 22 18:49:04.112345 2025] [:error] [pid 44259:tid 44269] [client 52.156.220.49:8618] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSGVIHXe1xL-_YOdRmR0_AAAAYc"]
[Sat Nov 22 18:49:05.809627 2025] [:error] [pid 53477:tid 53487] [client 52.156.220.49:22844] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSGVIX7Lu30Ku9O40aK7qQAAAAY"]
[Sat Nov 22 18:49:08.130036 2025] [:error] [pid 53477:tid 53494] [client 52.156.220.49:1652] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/alfa-rex.php"] [unique_id "aSGVJH7Lu30Ku9O40aK7qwAAAA0"]
[Sat Nov 22 18:49:09.304955 2025] [:error] [pid 44259:tid 44284] [client 52.156.220.49:20495] [client 52.156.220.49] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "switchcreative.net"] [uri "/images/stories/admin-post.php"] [unique_id "aSGVJXXe1xL-_YOdRmR1BgAAAZY"]
[Sat Nov 22 22:45:55.643982 2025] [:error] [pid 53477:tid 53485] [client 121.229.185.160:36572] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSHMo37Lu30Ku9O40aIAmQAAAAQ"]
[Sun Nov 23 03:59:06.243476 2025] [proxy_fcgi:error] [pid 13598:tid 13606] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sun Nov 23 03:59:06.434960 2025] [proxy_fcgi:error] [pid 13598:tid 13612] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Sun Nov 23 03:59:06.627881 2025] [proxy_fcgi:error] [pid 13598:tid 13627] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Sun Nov 23 03:59:06.877069 2025] [proxy_fcgi:error] [pid 13598:tid 13607] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 03:59:07.123939 2025] [proxy_fcgi:error] [pid 13598:tid 13628] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Sun Nov 23 03:59:07.366015 2025] [proxy_fcgi:error] [pid 13598:tid 13617] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:07.846002 2025] [proxy_fcgi:error] [pid 13598:tid 13611] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Sun Nov 23 03:59:08.063032 2025] [proxy_fcgi:error] [pid 13598:tid 13625] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:08.255101 2025] [proxy_fcgi:error] [pid 13598:tid 13619] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Sun Nov 23 03:59:08.444659 2025] [proxy_fcgi:error] [pid 13598:tid 13622] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 03:59:08.634723 2025] [proxy_fcgi:error] [pid 13598:tid 13626] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Sun Nov 23 03:59:08.868794 2025] [proxy_fcgi:error] [pid 13598:tid 13624] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Sun Nov 23 03:59:09.064303 2025] [proxy_fcgi:error] [pid 13598:tid 13609] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 03:59:09.256288 2025] [proxy_fcgi:error] [pid 13598:tid 13608] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Sun Nov 23 03:59:09.779661 2025] [proxy_fcgi:error] [pid 13598:tid 13614] [client 132.196.92.11:61849] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:09.980323 2025] [:error] [pid 13598:tid 13620] [client 132.196.92.11:61849] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSIWDZ3OmqQ8OkmlvgzlFwAAAA4"], referer: https://www.google.co.uk/
[Sun Nov 23 03:59:10.644942 2025] [:error] [pid 13598:tid 13618] [client 132.196.92.11:52808] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSIWDp3OmqQ8OkmlvgzlGQAAAAw"], referer: https://duckduckgo.com/
[Sun Nov 23 03:59:11.914172 2025] [proxy_fcgi:error] [pid 13707:tid 13717] [client 132.196.92.11:61848] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:12.124986 2025] [proxy_fcgi:error] [pid 13707:tid 13711] [client 132.196.92.11:61848] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Sun Nov 23 03:59:12.543928 2025] [proxy_fcgi:error] [pid 13707:tid 13731] [client 132.196.92.11:61848] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:13.882734 2025] [:error] [pid 13707:tid 13715] [client 132.196.92.11:61848] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wso112233.php"] [unique_id "aSIWEQ09GWrQ980nwCgoUwAAAMU"], referer: https://www.google.de/
[Sun Nov 23 03:59:15.885519 2025] [proxy_fcgi:error] [pid 13707:tid 13710] [client 132.196.92.11:52848] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Sun Nov 23 03:59:16.088175 2025] [proxy_fcgi:error] [pid 13707:tid 13728] [client 132.196.92.11:52848] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sun Nov 23 03:59:16.474819 2025] [proxy_fcgi:error] [pid 13707:tid 13725] [client 132.196.92.11:52848] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 03:59:18.117854 2025] [:error] [pid 13707:tid 13716] [client 132.196.92.11:52848] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSIWFg09GWrQ980nwCgoYgAAAMY"], referer: https://www.google.fr/
[Sun Nov 23 03:59:20.411937 2025] [proxy_fcgi:error] [pid 13603:tid 13662] [client 132.196.92.11:52823] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Sun Nov 23 03:59:20.604151 2025] [proxy_fcgi:error] [pid 13603:tid 13683] [client 132.196.92.11:52823] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Sun Nov 23 03:59:21.111935 2025] [proxy_fcgi:error] [pid 13603:tid 13686] [client 132.196.92.11:52823] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sun Nov 23 03:59:22.270832 2025] [:error] [pid 13603:tid 13678] [client 132.196.92.11:52823] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/bala.php"] [unique_id "aSIWGsGmFEU5DL0QIG2j_wAAAJA"], referer: https://duckduckgo.com/
[Sun Nov 23 03:59:23.849672 2025] [proxy_fcgi:error] [pid 13707:tid 13732] [client 132.196.92.11:51902] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Sun Nov 23 03:59:24.230483 2025] [:error] [pid 13707:tid 13734] [client 132.196.92.11:51902] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/dropdown.php"] [unique_id "aSIWHA09GWrQ980nwCgobgAAANg"], referer: https://www.google.co.uk/
[Sun Nov 23 03:59:25.836567 2025] [proxy_fcgi:error] [pid 13598:tid 13620] [client 132.196.92.11:56738] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Sun Nov 23 03:59:27.350321 2025] [:error] [pid 13598:tid 13627] [client 132.196.92.11:56738] [client 132.196.92.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/repeater.php"] [unique_id "aSIWH53OmqQ8OkmlvgzlKAAAABU"], referer: https://www.google.de/
[Sun Nov 23 03:59:28.376750 2025] [proxy_fcgi:error] [pid 13599:tid 13653] [client 132.196.92.11:64480] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Sun Nov 23 03:59:28.573000 2025] [proxy_fcgi:error] [pid 13599:tid 13647] [client 132.196.92.11:64480] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Sun Nov 23 13:51:31.072369 2025] [:error] [pid 44652:tid 44729] [client 43.153.54.138:52944] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSKg49iQFwsyXQDhwyBaiwAAARc"]
[Sun Nov 23 14:58:41.205691 2025] [:error] [pid 38740:tid 38801] [client 43.173.1.57:36974] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSKwoQ13QPZSi6O8umVI8AAAAIU"]
[Sun Nov 23 15:38:27.156507 2025] [:error] [pid 38740:tid 38817] [client 176.65.132.18:42348] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSK58w13QPZSi6O8umVTwAAAAJU"]
[Sun Nov 23 16:45:53.895861 2025] [proxy_fcgi:error] [pid 38740:tid 38800] [client 140.99.1.18:37125] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:46:05.601706 2025] [proxy_fcgi:error] [pid 38740:tid 38798] [client 140.99.1.18:37125] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:46:41.399765 2025] [autoindex:error] [pid 38739:tid 38781] [client 140.99.1.6:41157] AH01276: Cannot serve directory /home/switchcreative/public_html/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:58:04.630181 2025] [:error] [pid 38739:tid 38787] [client 176.123.16.119:55081] [client 176.123.16.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.16.119, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aSME3AdvEgJm2n2cDmp3OAAAAFI"]
[Sun Nov 23 20:58:04.641980 2025] [proxy_fcgi:error] [pid 38739:tid 38787] [client 176.123.16.119:55081] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 21:52:05.131999 2025] [:error] [pid 44652:tid 44725] [client 43.157.38.131:47198] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSMRhdiQFwsyXQDhwyArMAAAARM"]
[Sun Nov 23 23:04:42.010531 2025] [:error] [pid 38738:tid 38761] [client 176.65.132.18:57936] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSMiigytc6TL9XavPmNfSQAAABM"]
[Sun Nov 23 23:49:48.551375 2025] [:error] [pid 17534:tid 17545] [client 176.65.132.18:34386] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSMtHHPX9nXBrhgM8syuvgAAAck"]
[Mon Nov 24 00:30:58.446282 2025] [:error] [pid 1453:tid 1504] [client 125.75.66.97:33491] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSM2whUBCt7LU0bO_GA9cwAAAJM"]
[Mon Nov 24 05:53:54.471446 2025] [:error] [pid 12911:tid 12945] [client 35.187.232.113:1024] [client 35.187.232.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSOCckDMbk9464jnIl7sfwAAAEM"]
[Mon Nov 24 06:34:22.304285 2025] [:error] [pid 53508:tid 53518] [client 176.65.132.18:58702] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSOL7m639qxbKCcL09zVLgAAAQg"]
[Mon Nov 24 06:34:23.443110 2025] [:error] [pid 53508:tid 53532] [client 176.65.132.18:58506] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSOL72639qxbKCcL09zVLwAAARY"]
[Mon Nov 24 06:53:07.254979 2025] [:error] [pid 12910:tid 12938] [client 221.229.106.25:39814] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSOQU2kWgvzAF2Nei2WK_QAAABc"]
[Mon Nov 24 08:23:07.767378 2025] [:error] [pid 49900:tid 49910] [client 103.65.237.124:65003] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "aSOlazCyPLrvg06aorln4wAAAAg"]
[Mon Nov 24 08:23:08.114450 2025] [:error] [pid 49900:tid 49903] [client 103.65.237.124:58776] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "aSOlbDCyPLrvg06aorln5wAAAAE"]
[Mon Nov 24 12:23:06.980844 2025] [:error] [pid 16549:tid 16561] [client 43.130.32.245:49690] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSPdqqeWW19A99PUw_cPXQAAAUk"]
[Mon Nov 24 15:47:29.716392 2025] [proxy_fcgi:error] [pid 48599:tid 48616] [client 172.174.112.224:1502] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Mon Nov 24 15:47:32.946454 2025] [proxy_fcgi:error] [pid 48601:tid 48662] [client 172.174.112.224:6970] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Mon Nov 24 16:40:11.255336 2025] [:error] [pid 16549:tid 16576] [client 65.111.14.143:33919] [client 65.111.14.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/HEAD"] [unique_id "aSQZ66eWW19A99PUw_czcQAAAVc"]
[Mon Nov 24 16:40:15.351803 2025] [:error] [pid 48601:tid 48667] [client 104.207.38.244:27267] [client 104.207.38.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "aSQZ74MM4MaVTk74-AarUgAAAgo"]
[Mon Nov 24 16:40:17.259628 2025] [:error] [pid 16441:tid 16453] [client 209.50.180.48:12445] [client 209.50.180.48] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.svn/wc.db"] [unique_id "aSQZ8Yq_bc5MOa9Hflkl_wAAAIk"]
[Mon Nov 24 20:23:41.172934 2025] [proxy_fcgi:error] [pid 48600:tid 48635] [client 185.194.178.76:24753] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:41.980724 2025] [proxy_fcgi:error] [pid 48600:tid 48632] [client 185.194.178.76:24753] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:42.458231 2025] [:error] [pid 48600:tid 48631] [client 185.194.178.76:24753] [client 185.194.178.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSROTvtOzSUAQvWVjBeWjwAAAcE"]
[Mon Nov 24 20:23:45.449686 2025] [proxy_fcgi:error] [pid 48599:tid 48606] [client 185.194.178.90:49201] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:45.873757 2025] [:error] [pid 48599:tid 48625] [client 185.194.178.90:49201] [client 185.194.178.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/bk/index.php"] [unique_id "aSROUZzvu6PDJiRKE3JDdgAAAZY"]
[Mon Nov 24 20:23:46.729745 2025] [proxy_fcgi:error] [pid 9630:tid 9655] [client 185.194.178.106:36433] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:47.943733 2025] [proxy_fcgi:error] [pid 9630:tid 9634] [client 185.194.178.106:36433] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:48.536490 2025] [proxy_fcgi:error] [pid 9630:tid 9647] [client 185.194.178.106:36433] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:48.975049 2025] [proxy_fcgi:error] [pid 9630:tid 9651] [client 185.194.178.106:36433] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:50.000910 2025] [:error] [pid 9630:tid 9644] [client 185.194.178.106:36433] [client 185.194.178.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSROVSrSgUgPGkizt2ojeQAAAEw"]
[Mon Nov 24 20:23:51.174496 2025] [proxy_fcgi:error] [pid 16441:tid 16452] [client 185.194.178.103:62905] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:51.692760 2025] [proxy_fcgi:error] [pid 16441:tid 16466] [client 185.194.178.103:62905] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:23:52.153771 2025] [:error] [pid 16441:tid 16453] [client 185.194.178.103:62905] [client 185.194.178.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSROWIq_bc5MOa9Hfll30wAAAIk"]
[Mon Nov 24 20:23:53.043094 2025] [:error] [pid 16593:tid 16604] [client 185.194.178.59:43311] [client 185.194.178.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSROWRVGznHBJI2LKpRd4gAAAok"]
[Mon Nov 24 20:23:54.018510 2025] [:error] [pid 9630:tid 9650] [client 185.194.178.56:34041] [client 185.194.178.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSROWirSgUgPGkizt2ojfgAAAFI"]
[Mon Nov 24 20:23:55.539479 2025] [:error] [pid 48688:tid 48709] [client 185.194.178.87:31041] [client 185.194.178.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSROWxm2q1FkzLam7A2_8wAAAlE"]
[Mon Nov 24 20:23:57.105547 2025] [:error] [pid 49900:tid 49907] [client 185.194.178.59:43935] [client 185.194.178.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSROXTCyPLrvg06aork4UgAAAAU"]
[Mon Nov 24 20:23:58.997151 2025] [proxy_fcgi:error] [pid 16549:tid 16558] [client 185.194.178.100:55183] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:00.518163 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.100:55183] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:00.972931 2025] [:error] [pid 16549:tid 16574] [client 185.194.178.100:55183] [client 185.194.178.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSROYKeWW19A99PUw_daOAAAAVU"]
[Mon Nov 24 20:24:03.567008 2025] [:error] [pid 16516:tid 16523] [client 185.194.178.105:36155] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSROY_qZbniwaNwL8Xn_4AAAAQQ"]
[Mon Nov 24 20:24:04.960631 2025] [proxy_fcgi:error] [pid 9630:tid 9635] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:05.400932 2025] [proxy_fcgi:error] [pid 9630:tid 9640] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:05.823503 2025] [proxy_fcgi:error] [pid 9630:tid 9648] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:06.345209 2025] [proxy_fcgi:error] [pid 9630:tid 9654] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:07.376515 2025] [proxy_fcgi:error] [pid 9630:tid 9633] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:07.791498 2025] [proxy_fcgi:error] [pid 9630:tid 9646] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:08.263217 2025] [proxy_fcgi:error] [pid 9630:tid 9636] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:08.831264 2025] [proxy_fcgi:error] [pid 9630:tid 9653] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:09.280946 2025] [proxy_fcgi:error] [pid 9630:tid 9637] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:09.701045 2025] [proxy_fcgi:error] [pid 9630:tid 9632] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:10.255704 2025] [proxy_fcgi:error] [pid 9630:tid 9643] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:10.869782 2025] [proxy_fcgi:error] [pid 9630:tid 9634] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:12.019649 2025] [proxy_fcgi:error] [pid 9630:tid 9651] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:12.560243 2025] [proxy_fcgi:error] [pid 9630:tid 9649] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:12.973882 2025] [proxy_fcgi:error] [pid 9630:tid 9652] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:13.532762 2025] [proxy_fcgi:error] [pid 9630:tid 9641] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:14.103328 2025] [proxy_fcgi:error] [pid 9630:tid 9642] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:14.605633 2025] [proxy_fcgi:error] [pid 9630:tid 9644] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:15.199260 2025] [proxy_fcgi:error] [pid 9630:tid 9645] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:15.846684 2025] [proxy_fcgi:error] [pid 9630:tid 9640] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:16.308305 2025] [proxy_fcgi:error] [pid 9630:tid 9646] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:17.134494 2025] [proxy_fcgi:error] [pid 9630:tid 9636] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:17.612305 2025] [proxy_fcgi:error] [pid 9630:tid 9650] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:18.054097 2025] [proxy_fcgi:error] [pid 9630:tid 9637] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:18.582877 2025] [proxy_fcgi:error] [pid 9630:tid 9643] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:19.074093 2025] [proxy_fcgi:error] [pid 9630:tid 9647] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:19.720827 2025] [proxy_fcgi:error] [pid 9630:tid 9649] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:20.165786 2025] [proxy_fcgi:error] [pid 9630:tid 9641] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:20.623002 2025] [proxy_fcgi:error] [pid 9630:tid 9642] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:21.174798 2025] [proxy_fcgi:error] [pid 9630:tid 9645] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:21.657596 2025] [proxy_fcgi:error] [pid 9630:tid 9638] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:22.362474 2025] [proxy_fcgi:error] [pid 9630:tid 9648] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:22.892225 2025] [proxy_fcgi:error] [pid 9630:tid 9633] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:23.573097 2025] [:error] [pid 9630:tid 9646] [client 185.194.178.64:33093] [client 185.194.178.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.64, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSROdyrSgUgPGkizt2ojsQAAAE4"]
[Mon Nov 24 20:24:23.577165 2025] [proxy_fcgi:error] [pid 9630:tid 9646] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:24.377384 2025] [proxy_fcgi:error] [pid 9630:tid 9656] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:24.807839 2025] [proxy_fcgi:error] [pid 9630:tid 9637] [client 185.194.178.64:33093] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:25.281328 2025] [:error] [pid 9630:tid 9653] [client 185.194.178.64:33093] [client 185.194.178.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/modules.php"] [unique_id "aSROeSrSgUgPGkizt2ojtQAAAFU"]
[Mon Nov 24 20:24:26.255412 2025] [proxy_fcgi:error] [pid 48599:tid 48611] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:26.695120 2025] [proxy_fcgi:error] [pid 48599:tid 48626] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:28.250528 2025] [proxy_fcgi:error] [pid 48599:tid 48615] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:28.681295 2025] [proxy_fcgi:error] [pid 48599:tid 48621] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:29.112066 2025] [proxy_fcgi:error] [pid 48599:tid 48624] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:29.540765 2025] [proxy_fcgi:error] [pid 48599:tid 48620] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:29.987390 2025] [proxy_fcgi:error] [pid 48599:tid 48622] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:30.471823 2025] [proxy_fcgi:error] [pid 48599:tid 48616] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:31.486559 2025] [proxy_fcgi:error] [pid 48599:tid 48610] [client 185.194.178.66:59579] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:33.088966 2025] [:error] [pid 48599:tid 48627] [client 185.194.178.66:59579] [client 185.194.178.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSROgZzvu6PDJiRKE3JDkQAAAZg"]
[Mon Nov 24 20:24:34.183843 2025] [proxy_fcgi:error] [pid 16549:tid 16575] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:34.676593 2025] [proxy_fcgi:error] [pid 16549:tid 16557] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:37.137433 2025] [proxy_fcgi:error] [pid 16549:tid 16554] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:37.998467 2025] [proxy_fcgi:error] [pid 16549:tid 16559] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:38.416499 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:38.975155 2025] [proxy_fcgi:error] [pid 16549:tid 16558] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:39.393604 2025] [proxy_fcgi:error] [pid 16549:tid 16562] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:40.763339 2025] [proxy_fcgi:error] [pid 16549:tid 16567] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:41.175225 2025] [proxy_fcgi:error] [pid 16549:tid 16565] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:41.681153 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:42.116473 2025] [proxy_fcgi:error] [pid 16549:tid 16576] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:42.526107 2025] [proxy_fcgi:error] [pid 16549:tid 16574] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:43.148421 2025] [proxy_fcgi:error] [pid 16549:tid 16561] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:43.691376 2025] [proxy_fcgi:error] [pid 16549:tid 16575] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:45.241417 2025] [proxy_fcgi:error] [pid 16549:tid 16572] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:45.660291 2025] [proxy_fcgi:error] [pid 16549:tid 16556] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:46.862958 2025] [proxy_fcgi:error] [pid 16549:tid 16564] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:47.376611 2025] [proxy_fcgi:error] [pid 16549:tid 16566] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:47.841699 2025] [proxy_fcgi:error] [pid 16549:tid 16577] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:48.319102 2025] [proxy_fcgi:error] [pid 16549:tid 16553] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:48.767577 2025] [proxy_fcgi:error] [pid 16549:tid 16571] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:49.284006 2025] [proxy_fcgi:error] [pid 16549:tid 16554] [client 185.194.178.59:42331] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:49.742042 2025] [:error] [pid 16549:tid 16568] [client 185.194.178.59:42331] [client 185.194.178.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/lx.php"] [unique_id "aSROkaeWW19A99PUw_daZQAAAVA"]
[Mon Nov 24 20:24:51.564288 2025] [proxy_fcgi:error] [pid 16593:tid 16602] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:51.987323 2025] [proxy_fcgi:error] [pid 16593:tid 16610] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:52.434257 2025] [proxy_fcgi:error] [pid 16593:tid 16619] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:52.968241 2025] [proxy_fcgi:error] [pid 16593:tid 16614] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:53.451490 2025] [proxy_fcgi:error] [pid 16593:tid 16604] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:53.928618 2025] [proxy_fcgi:error] [pid 16593:tid 16605] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:54.369967 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:55.484427 2025] [proxy_fcgi:error] [pid 16593:tid 16612] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:56.026914 2025] [proxy_fcgi:error] [pid 16593:tid 16615] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:56.480049 2025] [proxy_fcgi:error] [pid 16593:tid 16613] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:56.892014 2025] [proxy_fcgi:error] [pid 16593:tid 16616] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:57.391910 2025] [proxy_fcgi:error] [pid 16593:tid 16599] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:57.867532 2025] [proxy_fcgi:error] [pid 16593:tid 16609] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:58.281619 2025] [proxy_fcgi:error] [pid 16593:tid 16607] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:58.690535 2025] [proxy_fcgi:error] [pid 16593:tid 16606] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:59.276895 2025] [proxy_fcgi:error] [pid 16593:tid 16618] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:24:59.675666 2025] [proxy_fcgi:error] [pid 16593:tid 16602] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:00.110916 2025] [proxy_fcgi:error] [pid 16593:tid 16610] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:00.589394 2025] [proxy_fcgi:error] [pid 16593:tid 16619] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:01.278241 2025] [proxy_fcgi:error] [pid 16593:tid 16603] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:01.831755 2025] [proxy_fcgi:error] [pid 16593:tid 16604] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:03.974162 2025] [proxy_fcgi:error] [pid 16593:tid 16600] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:04.555288 2025] [proxy_fcgi:error] [pid 16593:tid 16601] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:05.310097 2025] [proxy_fcgi:error] [pid 16593:tid 16615] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:05.907128 2025] [proxy_fcgi:error] [pid 16593:tid 16616] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:06.565856 2025] [proxy_fcgi:error] [pid 16593:tid 16599] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:07.050649 2025] [proxy_fcgi:error] [pid 16593:tid 16611] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:08.044748 2025] [proxy_fcgi:error] [pid 16593:tid 16607] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:08.519183 2025] [proxy_fcgi:error] [pid 16593:tid 16606] [client 185.194.178.60:48215] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:20.729668 2025] [:error] [pid 16593:tid 16607] [client 185.194.178.60:48215] [client 185.194.178.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSROsBVGznHBJI2LKpReNQAAAow"]
[Mon Nov 24 20:25:22.165456 2025] [proxy_fcgi:error] [pid 48600:tid 48638] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:28.260098 2025] [proxy_fcgi:error] [pid 48600:tid 48630] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:28.686794 2025] [proxy_fcgi:error] [pid 48600:tid 48632] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:29.181763 2025] [proxy_fcgi:error] [pid 48600:tid 48642] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:31.824517 2025] [proxy_fcgi:error] [pid 48600:tid 48654] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:36.368264 2025] [proxy_fcgi:error] [pid 48600:tid 48638] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:36.805755 2025] [proxy_fcgi:error] [pid 48600:tid 48635] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:37.948619 2025] [proxy_fcgi:error] [pid 48600:tid 48631] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:38.587456 2025] [proxy_fcgi:error] [pid 48600:tid 48651] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:39.747724 2025] [proxy_fcgi:error] [pid 48600:tid 48647] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:40.175457 2025] [proxy_fcgi:error] [pid 48600:tid 48643] [client 185.194.178.54:59487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:41.262924 2025] [:error] [pid 48600:tid 48649] [client 185.194.178.54:59487] [client 185.194.178.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSROxftOzSUAQvWVjBeW5gAAAdM"]
[Mon Nov 24 20:25:42.401957 2025] [:error] [pid 49900:tid 49913] [client 185.194.178.102:24425] [client 185.194.178.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.194.178.102, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aSROxjCyPLrvg06aork4oAAAAAs"]
[Mon Nov 24 20:25:42.406918 2025] [proxy_fcgi:error] [pid 49900:tid 49913] [client 185.194.178.102:24425] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:42.860434 2025] [proxy_fcgi:error] [pid 49900:tid 49905] [client 185.194.178.102:24425] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:43.884235 2025] [:error] [pid 49900:tid 49910] [client 185.194.178.102:24425] [client 185.194.178.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSROxzCyPLrvg06aork4owAAAAg"]
[Mon Nov 24 20:25:46.523044 2025] [proxy_fcgi:error] [pid 48688:tid 48710] [client 185.194.178.54:58233] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:49.317585 2025] [proxy_fcgi:error] [pid 48688:tid 48702] [client 185.194.178.54:58233] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:50.235422 2025] [proxy_fcgi:error] [pid 48688:tid 48705] [client 185.194.178.54:58233] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:50.678747 2025] [:error] [pid 48688:tid 48708] [client 185.194.178.54:58233] [client 185.194.178.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSROzhm2q1FkzLam7A3AUQAAAlA"]
[Mon Nov 24 20:25:51.538119 2025] [proxy_fcgi:error] [pid 48599:tid 48623] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:52.066492 2025] [proxy_fcgi:error] [pid 48599:tid 48607] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:52.979012 2025] [proxy_fcgi:error] [pid 48599:tid 48625] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:54.837209 2025] [proxy_fcgi:error] [pid 48599:tid 48618] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:55.408678 2025] [proxy_fcgi:error] [pid 48599:tid 48608] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:55.974680 2025] [proxy_fcgi:error] [pid 48599:tid 48603] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:56.477823 2025] [proxy_fcgi:error] [pid 48599:tid 48621] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:58.798512 2025] [proxy_fcgi:error] [pid 48599:tid 48619] [client 185.194.178.102:23655] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:25:59.732694 2025] [:error] [pid 48599:tid 48624] [client 185.194.178.102:23655] [client 185.194.178.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "aSRO15zvu6PDJiRKE3JD4gAAAZU"]
[Mon Nov 24 20:26:00.778330 2025] [:error] [pid 48600:tid 48651] [client 185.194.178.91:30251] [client 185.194.178.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSRO2PtOzSUAQvWVjBeW8QAAAdU"]
[Mon Nov 24 20:26:02.535125 2025] [:error] [pid 48599:tid 48609] [client 185.194.178.55:37541] [client 185.194.178.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/about.php"] [unique_id "aSRO2pzvu6PDJiRKE3JD4wAAAYY"]
[Mon Nov 24 20:26:04.149973 2025] [:error] [pid 49900:tid 49921] [client 185.194.178.79:24021] [client 185.194.178.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "aSRO3DCyPLrvg06aork4uQAAABM"]
[Mon Nov 24 20:26:07.720245 2025] [proxy_fcgi:error] [pid 16549:tid 16552] [client 185.194.178.74:38919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:08.184079 2025] [proxy_fcgi:error] [pid 16549:tid 16571] [client 185.194.178.74:38919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:09.019956 2025] [:error] [pid 16549:tid 16558] [client 185.194.178.74:38919] [client 185.194.178.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.74, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSRO4aeWW19A99PUw_danAAAAUY"]
[Mon Nov 24 20:26:10.539322 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.74:38919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:12.244684 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.74:38919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:13.113886 2025] [proxy_fcgi:error] [pid 16549:tid 16574] [client 185.194.178.74:38919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:16.832582 2025] [:error] [pid 16549:tid 16552] [client 185.194.178.74:38919] [client 185.194.178.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSRO6KeWW19A99PUw_darQAAAUA"]
[Mon Nov 24 20:26:18.345166 2025] [proxy_fcgi:error] [pid 48600:tid 48646] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:19.768145 2025] [:error] [pid 48600:tid 48651] [client 185.194.178.105:49163] [client 185.194.178.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.105, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSRO6_tOzSUAQvWVjBeW_wAAAdU"]
[Mon Nov 24 20:26:20.209017 2025] [proxy_fcgi:error] [pid 48600:tid 48647] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:22.015920 2025] [proxy_fcgi:error] [pid 48600:tid 48643] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:22.614681 2025] [proxy_fcgi:error] [pid 48600:tid 48637] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:24.651617 2025] [proxy_fcgi:error] [pid 48600:tid 48640] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:25.193650 2025] [proxy_fcgi:error] [pid 48600:tid 48641] [client 185.194.178.105:49163] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:25.684726 2025] [:error] [pid 48600:tid 48636] [client 185.194.178.105:49163] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aSRO8ftOzSUAQvWVjBeXDAAAAcY"]
[Mon Nov 24 20:26:26.830250 2025] [:error] [pid 9630:tid 9647] [client 185.194.178.57:24779] [client 185.194.178.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/about.php"] [unique_id "aSRO8irSgUgPGkizt2okNQAAAE8"]
[Mon Nov 24 20:26:27.810821 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:28.952304 2025] [proxy_fcgi:error] [pid 16549:tid 16561] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:29.409356 2025] [proxy_fcgi:error] [pid 16549:tid 16557] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:29.821528 2025] [proxy_fcgi:error] [pid 16549:tid 16572] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:30.769922 2025] [proxy_fcgi:error] [pid 16549:tid 16560] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:32.924850 2025] [proxy_fcgi:error] [pid 16549:tid 16553] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:40.193281 2025] [proxy_fcgi:error] [pid 16549:tid 16562] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:40.602765 2025] [proxy_fcgi:error] [pid 16549:tid 16554] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:41.272633 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.63:47103] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:42.528066 2025] [:error] [pid 16549:tid 16561] [client 185.194.178.63:47103] [client 185.194.178.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSRPAqeWW19A99PUw_dazgAAAUk"]
[Mon Nov 24 20:26:47.066411 2025] [:error] [pid 16441:tid 16449] [client 185.194.178.82:54073] [client 185.194.178.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/bak.php"] [unique_id "aSRPB4q_bc5MOa9Hfll4kQAAAIU"]
[Mon Nov 24 20:26:48.189547 2025] [proxy_fcgi:error] [pid 48600:tid 48647] [client 185.194.178.56:22415] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:48.621162 2025] [:error] [pid 48600:tid 48638] [client 185.194.178.56:22415] [client 185.194.178.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSRPCPtOzSUAQvWVjBeXEAAAAcg"]
[Mon Nov 24 20:26:50.865916 2025] [proxy_fcgi:error] [pid 48601:tid 48680] [client 185.194.178.62:29019] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:51.785538 2025] [proxy_fcgi:error] [pid 48601:tid 48671] [client 185.194.178.62:29019] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:52.267567 2025] [:error] [pid 48601:tid 48658] [client 185.194.178.62:29019] [client 185.194.178.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSRPDIMM4MaVTk74-AbYGAAAAgE"]
[Mon Nov 24 20:26:54.544962 2025] [:error] [pid 48601:tid 48662] [client 185.194.178.99:24843] [client 185.194.178.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "aSRPDoMM4MaVTk74-AbYGgAAAgU"]
[Mon Nov 24 20:26:55.501282 2025] [:error] [pid 16516:tid 16520] [client 185.194.178.69:30445] [client 185.194.178.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.69, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aSRPD_qZbniwaNwL8XkAXAAAAQE"]
[Mon Nov 24 20:26:55.988530 2025] [proxy_fcgi:error] [pid 16516:tid 16526] [client 185.194.178.69:30445] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:57.070158 2025] [:error] [pid 16516:tid 16543] [client 185.194.178.69:30445] [client 185.194.178.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/themes.php"] [unique_id "aSRPEfqZbniwaNwL8XkAYgAAARg"]
[Mon Nov 24 20:26:57.953814 2025] [proxy_fcgi:error] [pid 16549:tid 16553] [client 185.194.178.94:58589] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:26:58.960511 2025] [proxy_fcgi:error] [pid 16549:tid 16566] [client 185.194.178.94:58589] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:01.962412 2025] [:error] [pid 16549:tid 16563] [client 185.194.178.94:58589] [client 185.194.178.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aSRPFaeWW19A99PUw_da7gAAAUs"]
[Mon Nov 24 20:27:03.015151 2025] [proxy_fcgi:error] [pid 16549:tid 16565] [client 185.194.178.102:29859] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:04.460441 2025] [:error] [pid 16549:tid 16567] [client 185.194.178.102:29859] [client 185.194.178.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/about.php"] [unique_id "aSRPGKeWW19A99PUw_da9AAAAU8"]
[Mon Nov 24 20:27:06.082052 2025] [proxy_fcgi:error] [pid 48601:tid 48664] [client 185.194.178.58:49663] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:06.582585 2025] [:error] [pid 48601:tid 48668] [client 185.194.178.58:49663] [client 185.194.178.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSRPGoMM4MaVTk74-AbYJAAAAgs"]
[Mon Nov 24 20:27:08.398846 2025] [proxy_fcgi:error] [pid 16549:tid 16569] [client 185.194.178.96:21559] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:10.022490 2025] [:error] [pid 16549:tid 16564] [client 185.194.178.96:21559] [client 185.194.178.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.96, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aSRPHqeWW19A99PUw_da-wAAAUw"]
[Mon Nov 24 20:27:12.020176 2025] [:error] [pid 16549:tid 16574] [client 185.194.178.96:21559] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSRPIKeWW19A99PUw_da_wAAAVU"]
[Mon Nov 24 20:27:13.221393 2025] [:error] [pid 16441:tid 16467] [client 185.194.178.106:30833] [client 185.194.178.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSRPIYq_bc5MOa9Hfll4pgAAAJc"]
[Mon Nov 24 20:27:15.377611 2025] [proxy_fcgi:error] [pid 16549:tid 16576] [client 185.194.178.84:54027] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:16.650298 2025] [proxy_fcgi:error] [pid 16549:tid 16555] [client 185.194.178.84:54027] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:19.014320 2025] [proxy_fcgi:error] [pid 16549:tid 16558] [client 185.194.178.84:54027] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:19.866637 2025] [proxy_fcgi:error] [pid 16549:tid 16563] [client 185.194.178.84:54027] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:20.336659 2025] [proxy_fcgi:error] [pid 16549:tid 16562] [client 185.194.178.84:54027] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:21.437714 2025] [:error] [pid 16549:tid 16565] [client 185.194.178.84:54027] [client 185.194.178.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSRPKaeWW19A99PUw_dbEAAAAU0"]
[Mon Nov 24 20:27:24.076187 2025] [:error] [pid 16516:tid 16521] [client 185.194.178.78:51891] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "aSRPLPqZbniwaNwL8XkAfQAAAQI"]
[Mon Nov 24 20:27:25.186704 2025] [:error] [pid 9630:tid 9636] [client 185.194.178.99:59017] [client 185.194.178.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/about.php"] [unique_id "aSRPLSrSgUgPGkizt2okZQAAAEQ"]
[Mon Nov 24 20:27:26.196763 2025] [:error] [pid 16441:tid 16452] [client 185.194.178.55:27413] [client 185.194.178.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aSRPLoq_bc5MOa9Hfll4uQAAAIg"]
[Mon Nov 24 20:27:27.115123 2025] [:error] [pid 16441:tid 16463] [client 185.194.178.75:65315] [client 185.194.178.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSRPL4q_bc5MOa9Hfll4uwAAAJM"]
[Mon Nov 24 20:27:29.928007 2025] [autoindex:error] [pid 48599:tid 48603] [client 185.194.178.89:41293] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 20:27:31.564228 2025] [proxy_fcgi:error] [pid 48599:tid 48624] [client 185.194.178.89:41293] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:32.735952 2025] [:error] [pid 48599:tid 48627] [client 185.194.178.89:41293] [client 185.194.178.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aSRPNJzvu6PDJiRKE3JECgAAAZg"]
[Mon Nov 24 20:27:33.769642 2025] [proxy_fcgi:error] [pid 48601:tid 48678] [client 185.194.178.83:24621] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:34.463394 2025] [proxy_fcgi:error] [pid 48601:tid 48676] [client 185.194.178.83:24621] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:34.917138 2025] [proxy_fcgi:error] [pid 48601:tid 48666] [client 185.194.178.83:24621] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:35.402637 2025] [:error] [pid 48601:tid 48677] [client 185.194.178.83:24621] [client 185.194.178.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSRPN4MM4MaVTk74-AbYQAAAAhQ"]
[Mon Nov 24 20:27:36.388997 2025] [proxy_fcgi:error] [pid 48599:tid 48607] [client 185.194.178.66:23925] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:36.804971 2025] [proxy_fcgi:error] [pid 48599:tid 48625] [client 185.194.178.66:23925] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:37.317450 2025] [:error] [pid 48599:tid 48618] [client 185.194.178.66:23925] [client 185.194.178.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSRPOZzvu6PDJiRKE3JEDwAAAY8"]
[Mon Nov 24 20:27:38.204939 2025] [proxy_fcgi:error] [pid 16441:tid 16465] [client 185.194.178.61:38807] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:38.764559 2025] [:error] [pid 16441:tid 16447] [client 185.194.178.61:38807] [client 185.194.178.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aSRPOoq_bc5MOa9Hfll4wwAAAIM"]
[Mon Nov 24 20:27:40.669736 2025] [proxy_fcgi:error] [pid 9630:tid 9634] [client 185.194.178.92:54987] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:41.076197 2025] [:error] [pid 9630:tid 9646] [client 185.194.178.92:54987] [client 185.194.178.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSRPPSrSgUgPGkizt2okdgAAAE4"]
[Mon Nov 24 20:27:41.956468 2025] [:error] [pid 49900:tid 49926] [client 185.194.178.100:46569] [client 185.194.178.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aSRPPTCyPLrvg06aork5AgAAABg"]
[Mon Nov 24 20:27:43.505738 2025] [:error] [pid 49900:tid 49923] [client 185.194.178.74:24755] [client 185.194.178.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSRPPzCyPLrvg06aork5BwAAABU"]
[Mon Nov 24 20:27:44.393886 2025] [proxy_fcgi:error] [pid 48600:tid 48633] [client 185.194.178.60:21627] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:45.373805 2025] [proxy_fcgi:error] [pid 48600:tid 48648] [client 185.194.178.60:21627] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:45.882338 2025] [:error] [pid 48600:tid 48644] [client 185.194.178.60:21627] [client 185.194.178.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.60, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/cgi-bin/wp-login.php"] [unique_id "aSRPQftOzSUAQvWVjBeXLwAAAc4"]
[Mon Nov 24 20:27:45.886401 2025] [proxy_fcgi:error] [pid 48600:tid 48644] [client 185.194.178.60:21627] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:46.793913 2025] [:error] [pid 48600:tid 48652] [client 185.194.178.60:21627] [client 185.194.178.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aSRPQvtOzSUAQvWVjBeXMQAAAdY"]
[Mon Nov 24 20:27:47.943298 2025] [:error] [pid 16549:tid 16569] [client 185.194.178.73:32211] [client 185.194.178.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSRPQ6eWW19A99PUw_dbGQAAAVE"]
[Mon Nov 24 20:27:49.239826 2025] [proxy_fcgi:error] [pid 49900:tid 49908] [client 185.194.178.76:25505] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:49.811114 2025] [proxy_fcgi:error] [pid 49900:tid 49902] [client 185.194.178.76:25505] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:52.373706 2025] [proxy_fcgi:error] [pid 49900:tid 49919] [client 185.194.178.76:25505] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:27:54.543611 2025] [:error] [pid 49900:tid 49912] [client 185.194.178.76:25505] [client 185.194.178.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.76, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSRPSjCyPLrvg06aork5EQAAAAo"]
[Mon Nov 24 20:27:54.985942 2025] [:error] [pid 49900:tid 49924] [client 185.194.178.76:25505] [client 185.194.178.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSRPSjCyPLrvg06aork5EwAAABY"]
[Mon Nov 24 20:27:55.888474 2025] [:error] [pid 49900:tid 49917] [client 185.194.178.73:35269] [client 185.194.178.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/network.php"] [unique_id "aSRPSzCyPLrvg06aork5FAAAAA8"]
[Mon Nov 24 20:27:56.751922 2025] [:error] [pid 16516:tid 16536] [client 185.194.178.83:21693] [client 185.194.178.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "aSRPTPqZbniwaNwL8XkAggAAARE"]
[Mon Nov 24 20:27:59.331081 2025] [proxy_fcgi:error] [pid 16549:tid 16567] [client 185.194.178.71:21861] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:00.686659 2025] [:error] [pid 16549:tid 16571] [client 185.194.178.71:21861] [client 185.194.178.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aSRPUKeWW19A99PUw_dbIwAAAVI"]
[Mon Nov 24 20:28:01.792988 2025] [proxy_fcgi:error] [pid 16441:tid 16454] [client 185.194.178.96:61491] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:04.861545 2025] [proxy_fcgi:error] [pid 16441:tid 16463] [client 185.194.178.96:61491] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:07.357411 2025] [proxy_fcgi:error] [pid 16441:tid 16467] [client 185.194.178.96:61491] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:07.874659 2025] [proxy_fcgi:error] [pid 16441:tid 16464] [client 185.194.178.96:61491] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:09.462473 2025] [proxy_fcgi:error] [pid 16441:tid 16449] [client 185.194.178.96:61491] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:10.016915 2025] [:error] [pid 16441:tid 16461] [client 185.194.178.96:61491] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSRPWoq_bc5MOa9Hfll4_wAAAJE"]
[Mon Nov 24 20:28:12.014162 2025] [proxy_fcgi:error] [pid 48601:tid 48658] [client 185.194.178.94:34257] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:13.065364 2025] [:error] [pid 48601:tid 48668] [client 185.194.178.94:34257] [client 185.194.178.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSRPXYMM4MaVTk74-AbYVwAAAgs"]
[Mon Nov 24 20:28:15.785283 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.58:33835] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:17.371633 2025] [:error] [pid 48688:tid 48706] [client 185.194.178.58:33835] [client 185.194.178.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSRPYRm2q1FkzLam7A3AsQAAAk4"]
[Mon Nov 24 20:28:19.864083 2025] [:error] [pid 16549:tid 16573] [client 185.194.178.63:25535] [client 185.194.178.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSRPY6eWW19A99PUw_dbLQAAAVQ"]
[Mon Nov 24 20:28:21.332282 2025] [:error] [pid 48601:tid 48660] [client 185.194.178.88:42489] [client 185.194.178.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "aSRPZYMM4MaVTk74-AbYXgAAAgM"]
[Mon Nov 24 20:28:25.221766 2025] [:error] [pid 48599:tid 48612] [client 185.194.178.64:56013] [client 185.194.178.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSRPaZzvu6PDJiRKE3JEMgAAAYk"]
[Mon Nov 24 20:28:26.958404 2025] [:error] [pid 49900:tid 49914] [client 185.194.178.81:32729] [client 185.194.178.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSRPajCyPLrvg06aork5LAAAAAw"]
[Mon Nov 24 20:28:30.152672 2025] [:error] [pid 16516:tid 16537] [client 185.194.178.56:31555] [client 185.194.178.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSRPbvqZbniwaNwL8XkAlAAAARI"]
[Mon Nov 24 20:28:31.794083 2025] [proxy_fcgi:error] [pid 16549:tid 16575] [client 185.194.178.69:45433] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:32.722786 2025] [:error] [pid 16549:tid 16563] [client 185.194.178.69:45433] [client 185.194.178.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSRPcKeWW19A99PUw_dbNQAAAUs"]
[Mon Nov 24 20:28:33.610987 2025] [proxy_fcgi:error] [pid 48601:tid 48662] [client 185.194.178.61:22719] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:34.296366 2025] [proxy_fcgi:error] [pid 48601:tid 48665] [client 185.194.178.61:22719] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:35.158547 2025] [proxy_fcgi:error] [pid 48601:tid 48660] [client 185.194.178.61:22719] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:36.696199 2025] [:error] [pid 48601:tid 48670] [client 185.194.178.61:22719] [client 185.194.178.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSRPdIMM4MaVTk74-AbYcgAAAg0"]
[Mon Nov 24 20:28:39.093656 2025] [:error] [pid 16516:tid 16525] [client 185.194.178.70:24349] [client 185.194.178.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSRPd_qZbniwaNwL8XkAnAAAAQY"]
[Mon Nov 24 20:28:40.187663 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.98:64417] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:41.717777 2025] [proxy_fcgi:error] [pid 16549:tid 16562] [client 185.194.178.98:64417] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:42.320393 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.98:64417] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:42.813367 2025] [proxy_fcgi:error] [pid 16549:tid 16561] [client 185.194.178.98:64417] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:43.228609 2025] [proxy_fcgi:error] [pid 16549:tid 16565] [client 185.194.178.98:64417] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:43.696044 2025] [:error] [pid 16549:tid 16556] [client 185.194.178.98:64417] [client 185.194.178.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aSRPe6eWW19A99PUw_dbQAAAAUQ"]
[Mon Nov 24 20:28:45.787187 2025] [proxy_fcgi:error] [pid 16441:tid 16468] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:47.181359 2025] [proxy_fcgi:error] [pid 16441:tid 16455] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:47.761655 2025] [proxy_fcgi:error] [pid 16441:tid 16466] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:49.321612 2025] [proxy_fcgi:error] [pid 16441:tid 16446] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:51.018502 2025] [proxy_fcgi:error] [pid 16441:tid 16463] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:52.501033 2025] [proxy_fcgi:error] [pid 16441:tid 16457] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:52.915790 2025] [proxy_fcgi:error] [pid 16441:tid 16444] [client 185.194.178.74:51841] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:53.312647 2025] [:error] [pid 16441:tid 16464] [client 185.194.178.74:51841] [client 185.194.178.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aSRPhYq_bc5MOa9Hfll5QgAAAJQ"]
[Mon Nov 24 20:28:54.125361 2025] [:error] [pid 16441:tid 16450] [client 185.194.178.87:46799] [client 185.194.178.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSRPhoq_bc5MOa9Hfll5RAAAAIY"]
[Mon Nov 24 20:28:55.025235 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.60:39341] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:56.244907 2025] [proxy_fcgi:error] [pid 48688:tid 48714] [client 185.194.178.60:39341] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:57.638582 2025] [proxy_fcgi:error] [pid 48688:tid 48709] [client 185.194.178.60:39341] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:28:58.217717 2025] [:error] [pid 48688:tid 48695] [client 185.194.178.60:39341] [client 185.194.178.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/index.php"] [unique_id "aSRPihm2q1FkzLam7A3A2AAAAkM"]
[Mon Nov 24 20:29:00.405418 2025] [:error] [pid 16441:tid 16453] [client 185.194.178.105:54781] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSRPjIq_bc5MOa9Hfll5RwAAAIk"]
[Mon Nov 24 20:29:01.561959 2025] [proxy_fcgi:error] [pid 48601:tid 48659] [client 185.194.178.105:21691] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:02.266431 2025] [:error] [pid 48601:tid 48678] [client 185.194.178.105:21691] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aSRPjoMM4MaVTk74-AbYigAAAhU"]
[Mon Nov 24 20:29:04.405359 2025] [proxy_fcgi:error] [pid 49900:tid 49908] [client 185.194.178.82:47653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:04.923256 2025] [proxy_fcgi:error] [pid 49900:tid 49910] [client 185.194.178.82:47653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:05.813407 2025] [proxy_fcgi:error] [pid 49900:tid 49905] [client 185.194.178.82:47653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:06.898251 2025] [proxy_fcgi:error] [pid 49900:tid 49914] [client 185.194.178.82:47653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:07.326611 2025] [proxy_fcgi:error] [pid 49900:tid 49919] [client 185.194.178.82:47653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:07.751177 2025] [:error] [pid 49900:tid 49918] [client 185.194.178.82:47653] [client 185.194.178.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSRPkzCyPLrvg06aork5SQAAABA"]
[Mon Nov 24 20:29:09.255720 2025] [:error] [pid 48600:tid 48633] [client 185.194.178.85:24105] [client 185.194.178.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.85, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "aSRPlftOzSUAQvWVjBeXhAAAAcM"]
[Mon Nov 24 20:29:09.666211 2025] [proxy_fcgi:error] [pid 48600:tid 48634] [client 185.194.178.85:24105] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:10.898631 2025] [:error] [pid 48600:tid 48647] [client 185.194.178.85:24105] [client 185.194.178.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSRPlvtOzSUAQvWVjBeXhgAAAdE"]
[Mon Nov 24 20:29:11.785767 2025] [:error] [pid 16516:tid 16538] [client 185.194.178.63:64091] [client 185.194.178.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "aSRPl_qZbniwaNwL8XkArQAAARM"]
[Mon Nov 24 20:29:13.856234 2025] [proxy_fcgi:error] [pid 49900:tid 49922] [client 185.194.178.87:50789] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:14.492099 2025] [proxy_fcgi:error] [pid 49900:tid 49915] [client 185.194.178.87:50789] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:15.070845 2025] [:error] [pid 49900:tid 49924] [client 185.194.178.87:50789] [client 185.194.178.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aSRPmzCyPLrvg06aork5YwAAABY"]
[Mon Nov 24 20:29:15.916001 2025] [proxy_fcgi:error] [pid 48601:tid 48672] [client 185.194.178.61:34251] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:16.956421 2025] [:error] [pid 48601:tid 48679] [client 185.194.178.61:34251] [client 185.194.178.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rk2.php"] [unique_id "aSRPnIMM4MaVTk74-AbYnAAAAhY"]
[Mon Nov 24 20:29:21.364075 2025] [proxy_fcgi:error] [pid 48600:tid 48646] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:21.808428 2025] [proxy_fcgi:error] [pid 48600:tid 48651] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:22.242807 2025] [proxy_fcgi:error] [pid 48600:tid 48638] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:22.703197 2025] [proxy_fcgi:error] [pid 48600:tid 48639] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:23.110158 2025] [proxy_fcgi:error] [pid 48600:tid 48640] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:24.376978 2025] [proxy_fcgi:error] [pid 48600:tid 48636] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:24.851417 2025] [proxy_fcgi:error] [pid 48600:tid 48631] [client 185.194.178.96:60783] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:26.208463 2025] [:error] [pid 48600:tid 48645] [client 185.194.178.96:60783] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugin.php"] [unique_id "aSRPpvtOzSUAQvWVjBeXmAAAAc8"]
[Mon Nov 24 20:29:27.175869 2025] [proxy_fcgi:error] [pid 16441:tid 16461] [client 185.194.178.80:36107] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:28.320293 2025] [proxy_fcgi:error] [pid 16441:tid 16465] [client 185.194.178.80:36107] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:28.773214 2025] [:error] [pid 16441:tid 16464] [client 185.194.178.80:36107] [client 185.194.178.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aSRPqIq_bc5MOa9Hfll5aQAAAJQ"]
[Mon Nov 24 20:29:29.698673 2025] [proxy_fcgi:error] [pid 48599:tid 48607] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:30.155643 2025] [proxy_fcgi:error] [pid 48599:tid 48615] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:30.684691 2025] [proxy_fcgi:error] [pid 48599:tid 48620] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:31.155820 2025] [:error] [pid 48599:tid 48611] [client 185.194.178.96:45883] [client 185.194.178.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.96, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSRPq5zvu6PDJiRKE3JEXwAAAYg"]
[Mon Nov 24 20:29:31.160647 2025] [proxy_fcgi:error] [pid 48599:tid 48611] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:33.177191 2025] [proxy_fcgi:error] [pid 48599:tid 48626] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:33.606418 2025] [proxy_fcgi:error] [pid 48599:tid 48624] [client 185.194.178.96:45883] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:35.127901 2025] [:error] [pid 48599:tid 48627] [client 185.194.178.96:45883] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/mah.php"] [unique_id "aSRPr5zvu6PDJiRKE3JEZwAAAZg"]
[Mon Nov 24 20:29:36.256714 2025] [:error] [pid 16593:tid 16607] [client 185.194.178.73:29715] [client 185.194.178.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.73, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aSRPsBVGznHBJI2LKpRfDQAAAow"]
[Mon Nov 24 20:29:36.747733 2025] [:error] [pid 16593:tid 16598] [client 185.194.178.73:29715] [client 185.194.178.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aSRPsBVGznHBJI2LKpRfFQAAAoM"]
[Mon Nov 24 20:29:41.146322 2025] [proxy_fcgi:error] [pid 16549:tid 16577] [client 185.194.178.85:39597] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:42.021171 2025] [proxy_fcgi:error] [pid 16549:tid 16563] [client 185.194.178.85:39597] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:42.569656 2025] [proxy_fcgi:error] [pid 16549:tid 16557] [client 185.194.178.85:39597] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:43.175459 2025] [proxy_fcgi:error] [pid 16549:tid 16569] [client 185.194.178.85:39597] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:44.355244 2025] [:error] [pid 16549:tid 16567] [client 185.194.178.85:39597] [client 185.194.178.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSRPuKeWW19A99PUw_dbeAAAAU8"]
[Mon Nov 24 20:29:45.346187 2025] [proxy_fcgi:error] [pid 9630:tid 9645] [client 185.194.178.60:59919] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:46.469916 2025] [:error] [pid 9630:tid 9646] [client 185.194.178.60:59919] [client 185.194.178.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/about.php"] [unique_id "aSRPuirSgUgPGkizt2olLgAAAE4"]
[Mon Nov 24 20:29:47.403584 2025] [proxy_fcgi:error] [pid 16441:tid 16461] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:47.853832 2025] [:error] [pid 16441:tid 16456] [client 185.194.178.81:51481] [client 185.194.178.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.81, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aSRPu4q_bc5MOa9Hfll5gQAAAIw"]
[Mon Nov 24 20:29:48.309371 2025] [proxy_fcgi:error] [pid 16441:tid 16459] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:49.311510 2025] [proxy_fcgi:error] [pid 16441:tid 16462] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:49.815486 2025] [proxy_fcgi:error] [pid 16441:tid 16446] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:51.369283 2025] [proxy_fcgi:error] [pid 16441:tid 16463] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:51.857544 2025] [proxy_fcgi:error] [pid 16441:tid 16449] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:52.271018 2025] [proxy_fcgi:error] [pid 16441:tid 16461] [client 185.194.178.81:51481] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:52.760479 2025] [:error] [pid 16441:tid 16454] [client 185.194.178.81:51481] [client 185.194.178.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aSRPwIq_bc5MOa9Hfll5lAAAAIo"]
[Mon Nov 24 20:29:54.563047 2025] [:error] [pid 16549:tid 16566] [client 185.194.178.81:31107] [client 185.194.178.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/packed.php"] [unique_id "aSRPwqeWW19A99PUw_dbewAAAU4"]
[Mon Nov 24 20:29:55.716599 2025] [proxy_fcgi:error] [pid 48599:tid 48607] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:56.132294 2025] [proxy_fcgi:error] [pid 48599:tid 48615] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:56.663401 2025] [proxy_fcgi:error] [pid 48599:tid 48611] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:57.685058 2025] [proxy_fcgi:error] [pid 48599:tid 48612] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:58.158204 2025] [proxy_fcgi:error] [pid 48599:tid 48606] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:58.568787 2025] [proxy_fcgi:error] [pid 48599:tid 48614] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:59.063255 2025] [proxy_fcgi:error] [pid 48599:tid 48623] [client 185.194.178.55:27283] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:29:59.480815 2025] [:error] [pid 48599:tid 48625] [client 185.194.178.55:27283] [client 185.194.178.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/file.php"] [unique_id "aSRPx5zvu6PDJiRKE3JEcQAAAZY"]
[Mon Nov 24 20:30:00.836003 2025] [:error] [pid 48601:tid 48669] [client 185.194.178.79:33659] [client 185.194.178.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSRPyIMM4MaVTk74-AbYvQAAAgw"]
[Mon Nov 24 20:30:04.609807 2025] [:error] [pid 49900:tid 49915] [client 185.194.178.78:60395] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aSRPzDCyPLrvg06aork5nAAAAA0"]
[Mon Nov 24 20:30:05.902047 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.61:49765] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:09.576637 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.61:49765] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:10.329389 2025] [:error] [pid 16549:tid 16571] [client 185.194.178.61:49765] [client 185.194.178.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.61, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSRP0qeWW19A99PUw_dbigAAAVI"]
[Mon Nov 24 20:30:10.905371 2025] [:error] [pid 16549:tid 16575] [client 185.194.178.61:49765] [client 185.194.178.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSRP0qeWW19A99PUw_dbiwAAAVY"]
[Mon Nov 24 20:30:14.572057 2025] [proxy_fcgi:error] [pid 49900:tid 49919] [client 185.194.178.69:29653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:16.121752 2025] [proxy_fcgi:error] [pid 49900:tid 49913] [client 185.194.178.69:29653] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:17.409802 2025] [:error] [pid 49900:tid 49904] [client 185.194.178.69:29653] [client 185.194.178.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSRP2TCyPLrvg06aork5qwAAAAI"]
[Mon Nov 24 20:30:18.594313 2025] [:error] [pid 48600:tid 48651] [client 185.194.178.96:33473] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSRP2vtOzSUAQvWVjBeXuwAAAdU"]
[Mon Nov 24 20:30:19.827594 2025] [proxy_fcgi:error] [pid 16516:tid 16538] [client 185.194.178.78:61017] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:20.394815 2025] [proxy_fcgi:error] [pid 16516:tid 16530] [client 185.194.178.78:61017] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:22.201652 2025] [proxy_fcgi:error] [pid 16516:tid 16534] [client 185.194.178.78:61017] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:22.800421 2025] [proxy_fcgi:error] [pid 16516:tid 16529] [client 185.194.178.78:61017] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:24.955950 2025] [proxy_fcgi:error] [pid 16516:tid 16543] [client 185.194.178.78:61017] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:26.168734 2025] [:error] [pid 16516:tid 16526] [client 185.194.178.78:61017] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "aSRP4vqZbniwaNwL8XkA1wAAAQc"]
[Mon Nov 24 20:30:27.024063 2025] [proxy_fcgi:error] [pid 49900:tid 49915] [client 185.194.178.78:48197] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:27.863436 2025] [proxy_fcgi:error] [pid 49900:tid 49923] [client 185.194.178.78:48197] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:28.776680 2025] [:error] [pid 49900:tid 49902] [client 185.194.178.78:48197] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/votes.php"] [unique_id "aSRP5DCyPLrvg06aork5xAAAAAA"]
[Mon Nov 24 20:30:34.042958 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.57:26695] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:35.076053 2025] [proxy_fcgi:error] [pid 48688:tid 48705] [client 185.194.178.57:26695] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:36.056756 2025] [:error] [pid 48688:tid 48701] [client 185.194.178.57:26695] [client 185.194.178.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/file.php"] [unique_id "aSRP7Bm2q1FkzLam7A3BIgAAAkk"]
[Mon Nov 24 20:30:36.943725 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.88:56067] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:37.936990 2025] [proxy_fcgi:error] [pid 16593:tid 16605] [client 185.194.178.88:56067] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:38.582636 2025] [proxy_fcgi:error] [pid 16593:tid 16609] [client 185.194.178.88:56067] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:39.101662 2025] [:error] [pid 16593:tid 16610] [client 185.194.178.88:56067] [client 185.194.178.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aSRP7xVGznHBJI2LKpRfVgAAAo8"]
[Mon Nov 24 20:30:40.210990 2025] [proxy_fcgi:error] [pid 49900:tid 49917] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:40.762263 2025] [proxy_fcgi:error] [pid 49900:tid 49915] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:43.163935 2025] [proxy_fcgi:error] [pid 49900:tid 49914] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:44.309800 2025] [proxy_fcgi:error] [pid 49900:tid 49907] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:44.952841 2025] [proxy_fcgi:error] [pid 49900:tid 49916] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:45.452375 2025] [proxy_fcgi:error] [pid 49900:tid 49903] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:45.988958 2025] [proxy_fcgi:error] [pid 49900:tid 49904] [client 185.194.178.63:22053] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:46.495854 2025] [:error] [pid 49900:tid 49925] [client 185.194.178.63:22053] [client 185.194.178.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aSRP9jCyPLrvg06aork53gAAABc"]
[Mon Nov 24 20:30:47.419183 2025] [proxy_fcgi:error] [pid 48688:tid 48707] [client 185.194.178.64:47959] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:47.989507 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.64:47959] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:50.246732 2025] [proxy_fcgi:error] [pid 48688:tid 48696] [client 185.194.178.64:47959] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:50.705782 2025] [:error] [pid 48688:tid 48711] [client 185.194.178.64:47959] [client 185.194.178.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSRP-hm2q1FkzLam7A3BLwAAAlM"]
[Mon Nov 24 20:30:51.613007 2025] [proxy_fcgi:error] [pid 16441:tid 16466] [client 185.194.178.87:57351] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:52.095937 2025] [proxy_fcgi:error] [pid 16441:tid 16450] [client 185.194.178.87:57351] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:53.176838 2025] [proxy_fcgi:error] [pid 16441:tid 16456] [client 185.194.178.87:57351] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:54.147635 2025] [proxy_fcgi:error] [pid 16441:tid 16459] [client 185.194.178.87:57351] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:30:56.108911 2025] [:error] [pid 16441:tid 16453] [client 185.194.178.87:57351] [client 185.194.178.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/item.php"] [unique_id "aSRQAIq_bc5MOa9Hfll53wAAAIk"]
[Mon Nov 24 20:31:00.402844 2025] [proxy_fcgi:error] [pid 16549:tid 16553] [client 185.194.178.99:28069] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:01.336617 2025] [:error] [pid 16549:tid 16560] [client 185.194.178.99:28069] [client 185.194.178.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.99, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aSRQBaeWW19A99PUw_dcKwAAAUg"]
[Mon Nov 24 20:31:01.343207 2025] [proxy_fcgi:error] [pid 16549:tid 16560] [client 185.194.178.99:28069] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:01.877652 2025] [:error] [pid 16549:tid 16558] [client 185.194.178.99:28069] [client 185.194.178.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.99, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSRQBaeWW19A99PUw_dcLAAAAUY"]
[Mon Nov 24 20:31:02.357336 2025] [:error] [pid 16549:tid 16569] [client 185.194.178.99:28069] [client 185.194.178.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/mani.php"] [unique_id "aSRQBqeWW19A99PUw_dcLQAAAVE"]
[Mon Nov 24 20:31:04.679797 2025] [proxy_fcgi:error] [pid 9630:tid 9650] [client 185.194.178.65:61311] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:05.168813 2025] [proxy_fcgi:error] [pid 9630:tid 9647] [client 185.194.178.65:61311] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:06.522684 2025] [proxy_fcgi:error] [pid 9630:tid 9649] [client 185.194.178.65:61311] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:08.666896 2025] [proxy_fcgi:error] [pid 9630:tid 9655] [client 185.194.178.65:61311] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:11.960033 2025] [:error] [pid 9630:tid 9635] [client 185.194.178.65:61311] [client 185.194.178.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/network.php"] [unique_id "aSRQDyrSgUgPGkizt2oliQAAAEM"]
[Mon Nov 24 20:31:13.024974 2025] [proxy_fcgi:error] [pid 48688:tid 48711] [client 185.194.178.96:28211] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:13.550164 2025] [proxy_fcgi:error] [pid 48688:tid 48714] [client 185.194.178.96:28211] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:14.065751 2025] [:error] [pid 48688:tid 48697] [client 185.194.178.96:28211] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "aSRQEhm2q1FkzLam7A3BPgAAAkU"]
[Mon Nov 24 20:31:16.514518 2025] [proxy_fcgi:error] [pid 16549:tid 16559] [client 185.194.178.56:28199] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:18.983241 2025] [proxy_fcgi:error] [pid 16549:tid 16557] [client 185.194.178.56:28199] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:19.510972 2025] [proxy_fcgi:error] [pid 16549:tid 16562] [client 185.194.178.56:28199] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:21.994267 2025] [proxy_fcgi:error] [pid 16549:tid 16571] [client 185.194.178.56:28199] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:24.002259 2025] [:error] [pid 16549:tid 16565] [client 185.194.178.56:28199] [client 185.194.178.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSRQHKeWW19A99PUw_dcRQAAAU0"]
[Mon Nov 24 20:31:24.977308 2025] [:error] [pid 48600:tid 48645] [client 185.194.178.107:62255] [client 185.194.178.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aSRQHPtOzSUAQvWVjBeX_wAAAc8"]
[Mon Nov 24 20:31:26.652789 2025] [proxy_fcgi:error] [pid 48599:tid 48616] [client 185.194.178.105:48343] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:27.981168 2025] [:error] [pid 48599:tid 48612] [client 185.194.178.105:48343] [client 185.194.178.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.105, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/wp-login.php"] [unique_id "aSRQH5zvu6PDJiRKE3JEzQAAAYk"]
[Mon Nov 24 20:31:28.412845 2025] [proxy_fcgi:error] [pid 48599:tid 48620] [client 185.194.178.105:48343] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:29.341622 2025] [proxy_fcgi:error] [pid 48599:tid 48625] [client 185.194.178.105:48343] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:29.765339 2025] [:error] [pid 48599:tid 48626] [client 185.194.178.105:48343] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aSRQIZzvu6PDJiRKE3JE0QAAAZc"]
[Mon Nov 24 20:31:32.047023 2025] [proxy_fcgi:error] [pid 49900:tid 49918] [client 185.194.178.83:54211] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:32.590516 2025] [:error] [pid 49900:tid 49914] [client 185.194.178.83:54211] [client 185.194.178.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aSRQJDCyPLrvg06aork6CQAAAAw"]
[Mon Nov 24 20:31:33.636396 2025] [:error] [pid 49900:tid 49912] [client 185.194.178.54:36775] [client 185.194.178.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSRQJTCyPLrvg06aork6DAAAAAo"]
[Mon Nov 24 20:31:36.475313 2025] [:error] [pid 48599:tid 48627] [client 185.194.178.57:64289] [client 185.194.178.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSRQKJzvu6PDJiRKE3JE1gAAAZg"]
[Mon Nov 24 20:31:37.448623 2025] [proxy_fcgi:error] [pid 16441:tid 16465] [client 185.194.178.95:53091] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:37.965640 2025] [proxy_fcgi:error] [pid 16441:tid 16447] [client 185.194.178.95:53091] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:40.669101 2025] [proxy_fcgi:error] [pid 16441:tid 16446] [client 185.194.178.95:53091] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:41.617830 2025] [:error] [pid 16441:tid 16468] [client 185.194.178.95:53091] [client 185.194.178.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aSRQLYq_bc5MOa9Hfll6JQAAAJg"]
[Mon Nov 24 20:31:42.533912 2025] [proxy_fcgi:error] [pid 48688:tid 48705] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:43.010487 2025] [proxy_fcgi:error] [pid 48688:tid 48701] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:43.562806 2025] [proxy_fcgi:error] [pid 48688:tid 48711] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:44.948818 2025] [proxy_fcgi:error] [pid 48688:tid 48714] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:45.425325 2025] [proxy_fcgi:error] [pid 48688:tid 48704] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:45.932026 2025] [proxy_fcgi:error] [pid 48688:tid 48713] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:46.535080 2025] [proxy_fcgi:error] [pid 48688:tid 48700] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:48.081838 2025] [proxy_fcgi:error] [pid 48688:tid 48708] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:48.986445 2025] [proxy_fcgi:error] [pid 48688:tid 48699] [client 185.194.178.70:59645] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:50.309776 2025] [:error] [pid 48688:tid 48694] [client 185.194.178.70:59645] [client 185.194.178.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/radio.php"] [unique_id "aSRQNhm2q1FkzLam7A3BYgAAAkI"]
[Mon Nov 24 20:31:51.885462 2025] [proxy_fcgi:error] [pid 48688:tid 48715] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:52.351946 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:52.830968 2025] [proxy_fcgi:error] [pid 48688:tid 48706] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:53.234084 2025] [proxy_fcgi:error] [pid 48688:tid 48712] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:54.204152 2025] [proxy_fcgi:error] [pid 48688:tid 48696] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:54.760467 2025] [proxy_fcgi:error] [pid 48688:tid 48698] [client 185.194.178.69:25591] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:31:55.776167 2025] [:error] [pid 48688:tid 48711] [client 185.194.178.69:25591] [client 185.194.178.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aSRQOxm2q1FkzLam7A3BbgAAAlM"]
[Mon Nov 24 20:32:01.400278 2025] [:error] [pid 48688:tid 48702] [client 185.194.178.79:48455] [client 185.194.178.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "aSRQQRm2q1FkzLam7A3BdQAAAko"]
[Mon Nov 24 20:32:03.193816 2025] [:error] [pid 48601:tid 48671] [client 185.194.178.61:24175] [client 185.194.178.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aSRQQ4MM4MaVTk74-AbZQQAAAg4"]
[Mon Nov 24 20:32:05.002308 2025] [proxy_fcgi:error] [pid 16593:tid 16599] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:06.495287 2025] [proxy_fcgi:error] [pid 16593:tid 16600] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:06.967048 2025] [proxy_fcgi:error] [pid 16593:tid 16603] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:08.497040 2025] [proxy_fcgi:error] [pid 16593:tid 16611] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:08.912337 2025] [proxy_fcgi:error] [pid 16593:tid 16595] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:09.469801 2025] [proxy_fcgi:error] [pid 16593:tid 16596] [client 185.194.178.96:36349] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:10.300254 2025] [:error] [pid 16593:tid 16612] [client 185.194.178.96:36349] [client 185.194.178.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aSRQShVGznHBJI2LKpRgFAAAApE"]
[Mon Nov 24 20:32:11.633944 2025] [:error] [pid 49900:tid 49905] [client 185.194.178.55:52917] [client 185.194.178.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSRQSzCyPLrvg06aork6IgAAAAM"]
[Mon Nov 24 20:32:14.880849 2025] [:error] [pid 16441:tid 16457] [client 185.194.178.83:42711] [client 185.194.178.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aSRQToq_bc5MOa9Hfll6WwAAAI0"]
[Mon Nov 24 20:32:18.495592 2025] [proxy_fcgi:error] [pid 48601:tid 48666] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:18.914023 2025] [proxy_fcgi:error] [pid 48601:tid 48677] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:19.490971 2025] [proxy_fcgi:error] [pid 48601:tid 48675] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:20.800714 2025] [proxy_fcgi:error] [pid 48601:tid 48679] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:21.304836 2025] [proxy_fcgi:error] [pid 48601:tid 48674] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:21.764367 2025] [proxy_fcgi:error] [pid 48601:tid 48657] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:22.270227 2025] [proxy_fcgi:error] [pid 48601:tid 48662] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:23.223039 2025] [proxy_fcgi:error] [pid 48601:tid 48668] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:23.711737 2025] [proxy_fcgi:error] [pid 48601:tid 48678] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:24.162450 2025] [proxy_fcgi:error] [pid 48601:tid 48676] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:24.685690 2025] [proxy_fcgi:error] [pid 48601:tid 48681] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:25.093641 2025] [proxy_fcgi:error] [pid 48601:tid 48675] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:25.513387 2025] [proxy_fcgi:error] [pid 48601:tid 48664] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:25.916560 2025] [proxy_fcgi:error] [pid 48601:tid 48679] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:26.386183 2025] [proxy_fcgi:error] [pid 48601:tid 48673] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:26.824139 2025] [proxy_fcgi:error] [pid 48601:tid 48672] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:27.424975 2025] [proxy_fcgi:error] [pid 48601:tid 48669] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:28.023193 2025] [proxy_fcgi:error] [pid 48601:tid 48674] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:28.529219 2025] [proxy_fcgi:error] [pid 48601:tid 48665] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:28.984545 2025] [proxy_fcgi:error] [pid 48601:tid 48668] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:29.464261 2025] [proxy_fcgi:error] [pid 48601:tid 48671] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:29.873538 2025] [proxy_fcgi:error] [pid 48601:tid 48681] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:31.555095 2025] [proxy_fcgi:error] [pid 48601:tid 48672] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:32.463018 2025] [proxy_fcgi:error] [pid 48601:tid 48666] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:32.899948 2025] [proxy_fcgi:error] [pid 48601:tid 48663] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:33.800213 2025] [proxy_fcgi:error] [pid 48601:tid 48667] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:34.213110 2025] [proxy_fcgi:error] [pid 48601:tid 48668] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:34.708606 2025] [proxy_fcgi:error] [pid 48601:tid 48680] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:35.194716 2025] [proxy_fcgi:error] [pid 48601:tid 48671] [client 185.194.178.88:36395] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:35.669674 2025] [:error] [pid 48601:tid 48657] [client 185.194.178.88:36395] [client 185.194.178.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/include.php"] [unique_id "aSRQY4MM4MaVTk74-AbZmQAAAgA"]
[Mon Nov 24 20:32:36.637993 2025] [proxy_fcgi:error] [pid 16593:tid 16603] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:37.087074 2025] [proxy_fcgi:error] [pid 16593:tid 16614] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:37.949497 2025] [proxy_fcgi:error] [pid 16593:tid 16598] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:38.452908 2025] [proxy_fcgi:error] [pid 16593:tid 16618] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:39.012280 2025] [proxy_fcgi:error] [pid 16593:tid 16610] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:39.521707 2025] [proxy_fcgi:error] [pid 16593:tid 16609] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:39.936140 2025] [proxy_fcgi:error] [pid 16593:tid 16617] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:40.395364 2025] [proxy_fcgi:error] [pid 16593:tid 16595] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:40.810945 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:42.005963 2025] [proxy_fcgi:error] [pid 16593:tid 16615] [client 185.194.178.93:38969] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:42.448022 2025] [:error] [pid 16593:tid 16607] [client 185.194.178.93:38969] [client 185.194.178.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/css.php"] [unique_id "aSRQahVGznHBJI2LKpRgPwAAAow"]
[Mon Nov 24 20:32:44.736854 2025] [proxy_fcgi:error] [pid 49900:tid 49912] [client 185.194.178.78:45487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:46.318788 2025] [proxy_fcgi:error] [pid 49900:tid 49920] [client 185.194.178.78:45487] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:50.404779 2025] [:error] [pid 49900:tid 49907] [client 185.194.178.78:45487] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wso112233.php"] [unique_id "aSRQcjCyPLrvg06aork6egAAAAU"]
[Mon Nov 24 20:32:51.479888 2025] [:error] [pid 16441:tid 16452] [client 185.194.178.78:47457] [client 185.194.178.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSRQc4q_bc5MOa9Hfll6wAAAAIg"]
[Mon Nov 24 20:32:53.095299 2025] [proxy_fcgi:error] [pid 48601:tid 48674] [client 185.194.178.95:51241] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:54.366121 2025] [:error] [pid 48601:tid 48660] [client 185.194.178.95:51241] [client 185.194.178.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/dropdown.php"] [unique_id "aSRQdoMM4MaVTk74-AbZrAAAAgM"]
[Mon Nov 24 20:32:55.788577 2025] [:error] [pid 16516:tid 16529] [client 185.194.178.105:24217] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/repeater.php"] [unique_id "aSRQd_qZbniwaNwL8XkBQwAAAQo"]
[Mon Nov 24 20:32:58.162581 2025] [proxy_fcgi:error] [pid 9630:tid 9655] [client 185.194.178.83:42951] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:58.633205 2025] [proxy_fcgi:error] [pid 9630:tid 9649] [client 185.194.178.83:42951] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:32:59.593439 2025] [proxy_fcgi:error] [pid 9630:tid 9654] [client 185.194.178.83:42951] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:05.761307 2025] [:error] [pid 9630:tid 9642] [client 185.194.178.83:42951] [client 185.194.178.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aSRQgSrSgUgPGkizt2omIAAAAEo"]
[Mon Nov 24 20:33:06.742639 2025] [:error] [pid 48599:tid 48612] [client 185.194.178.56:38307] [client 185.194.178.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aSRQgpzvu6PDJiRKE3JFFAAAAYk"]
[Mon Nov 24 20:33:07.749739 2025] [proxy_fcgi:error] [pid 16593:tid 16596] [client 185.194.178.106:28501] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:08.194384 2025] [:error] [pid 16593:tid 16597] [client 185.194.178.106:28501] [client 185.194.178.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/options.php"] [unique_id "aSRQhBVGznHBJI2LKpRgTgAAAoI"]
[Mon Nov 24 20:33:09.226929 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.87:56295] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:11.010487 2025] [:error] [pid 16549:tid 16576] [client 185.194.178.87:56295] [client 185.194.178.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aSRQh6eWW19A99PUw_dcrwAAAVc"]
[Mon Nov 24 20:33:12.031844 2025] [:error] [pid 49900:tid 49904] [client 185.194.178.76:59693] [client 185.194.178.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aSRQiDCyPLrvg06aork6hgAAAAI"]
[Mon Nov 24 20:33:14.262314 2025] [proxy_fcgi:error] [pid 49900:tid 49925] [client 185.194.178.69:37821] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:14.993376 2025] [:error] [pid 49900:tid 49905] [client 185.194.178.69:37821] [client 185.194.178.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.69, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/images/wp-login.php"] [unique_id "aSRQijCyPLrvg06aork6jAAAAAM"]
[Mon Nov 24 20:33:14.997588 2025] [proxy_fcgi:error] [pid 49900:tid 49905] [client 185.194.178.69:37821] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:16.473341 2025] [proxy_fcgi:error] [pid 49900:tid 49917] [client 185.194.178.69:37821] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:17.812811 2025] [:error] [pid 49900:tid 49919] [client 185.194.178.69:37821] [client 185.194.178.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aSRQjTCyPLrvg06aork6kgAAABE"]
[Mon Nov 24 20:33:18.738001 2025] [proxy_fcgi:error] [pid 48601:tid 48669] [client 185.194.178.68:28217] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:21.373185 2025] [:error] [pid 48601:tid 48668] [client 185.194.178.68:28217] [client 185.194.178.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aSRQkYMM4MaVTk74-AbZugAAAgs"]
[Mon Nov 24 20:33:22.264345 2025] [:error] [pid 16441:tid 16447] [client 185.194.178.105:57711] [client 185.194.178.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aSRQkoq_bc5MOa9Hfll61AAAAIM"]
[Mon Nov 24 20:33:23.359186 2025] [proxy_fcgi:error] [pid 16516:tid 16532] [client 185.194.178.90:24341] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:23.781745 2025] [:error] [pid 16516:tid 16531] [client 185.194.178.90:24341] [client 185.194.178.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.90, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aSRQk_qZbniwaNwL8XkBTQAAAQw"]
[Mon Nov 24 20:33:24.223029 2025] [proxy_fcgi:error] [pid 16516:tid 16529] [client 185.194.178.90:24341] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:24.659735 2025] [:error] [pid 16516:tid 16519] [client 185.194.178.90:24341] [client 185.194.178.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aSRQlPqZbniwaNwL8XkBTwAAAQA"]
[Mon Nov 24 20:33:26.114054 2025] [proxy_fcgi:error] [pid 48601:tid 48677] [client 185.194.178.92:57145] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:26.525908 2025] [proxy_fcgi:error] [pid 48601:tid 48678] [client 185.194.178.92:57145] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:27.817813 2025] [:error] [pid 48601:tid 48657] [client 185.194.178.92:57145] [client 185.194.178.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aSRQl4MM4MaVTk74-AbZwQAAAgA"]
[Mon Nov 24 20:33:28.706111 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:29.638636 2025] [proxy_fcgi:error] [pid 16593:tid 16616] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:30.062275 2025] [proxy_fcgi:error] [pid 16593:tid 16596] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:30.610681 2025] [proxy_fcgi:error] [pid 16593:tid 16619] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:31.073225 2025] [proxy_fcgi:error] [pid 16593:tid 16599] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:31.473701 2025] [proxy_fcgi:error] [pid 16593:tid 16613] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:31.906350 2025] [proxy_fcgi:error] [pid 16593:tid 16612] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:32.339577 2025] [proxy_fcgi:error] [pid 16593:tid 16600] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:32.778621 2025] [proxy_fcgi:error] [pid 16593:tid 16601] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:33.203065 2025] [proxy_fcgi:error] [pid 16593:tid 16614] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:33.770322 2025] [proxy_fcgi:error] [pid 16593:tid 16618] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:34.227159 2025] [proxy_fcgi:error] [pid 16593:tid 16611] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:34.761155 2025] [proxy_fcgi:error] [pid 16593:tid 16598] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:35.259398 2025] [proxy_fcgi:error] [pid 16593:tid 16609] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:35.722935 2025] [proxy_fcgi:error] [pid 16593:tid 16610] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:36.193765 2025] [proxy_fcgi:error] [pid 16593:tid 16617] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:36.594410 2025] [proxy_fcgi:error] [pid 16593:tid 16602] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:37.014715 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:37.446394 2025] [proxy_fcgi:error] [pid 16593:tid 16607] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:38.120436 2025] [proxy_fcgi:error] [pid 16593:tid 16596] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:39.628846 2025] [proxy_fcgi:error] [pid 16593:tid 16615] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:40.195723 2025] [proxy_fcgi:error] [pid 16593:tid 16599] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:40.639142 2025] [proxy_fcgi:error] [pid 16593:tid 16595] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:41.104994 2025] [proxy_fcgi:error] [pid 16593:tid 16606] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:41.510044 2025] [proxy_fcgi:error] [pid 16593:tid 16613] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:41.965831 2025] [proxy_fcgi:error] [pid 16593:tid 16597] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:42.398934 2025] [proxy_fcgi:error] [pid 16593:tid 16600] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:42.813078 2025] [proxy_fcgi:error] [pid 16593:tid 16604] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:43.348876 2025] [proxy_fcgi:error] [pid 16593:tid 16618] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:43.816993 2025] [proxy_fcgi:error] [pid 16593:tid 16609] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:44.241875 2025] [proxy_fcgi:error] [pid 16593:tid 16610] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:44.663775 2025] [proxy_fcgi:error] [pid 16593:tid 16617] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:45.111974 2025] [proxy_fcgi:error] [pid 16593:tid 16602] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:45.607051 2025] [proxy_fcgi:error] [pid 16593:tid 16608] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:47.171034 2025] [proxy_fcgi:error] [pid 16593:tid 16596] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:47.993859 2025] [proxy_fcgi:error] [pid 16593:tid 16595] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:50.826821 2025] [proxy_fcgi:error] [pid 16593:tid 16600] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:51.299960 2025] [:error] [pid 16593:tid 16605] [client 185.194.178.95:53941] [client 185.194.178.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.95, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSRQrxVGznHBJI2LKpRghgAAAoo"]
[Mon Nov 24 20:33:51.752100 2025] [proxy_fcgi:error] [pid 16593:tid 16601] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:53.056132 2025] [:error] [pid 16593:tid 16614] [client 185.194.178.95:53941] [client 185.194.178.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.95, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.tmb/wp-login.php"] [unique_id "aSRQsRVGznHBJI2LKpRgigAAApM"]
[Mon Nov 24 20:33:53.986360 2025] [proxy_fcgi:error] [pid 16593:tid 16611] [client 185.194.178.95:53941] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:33:54.410363 2025] [:error] [pid 16593:tid 16609] [client 185.194.178.95:53941] [client 185.194.178.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSRQshVGznHBJI2LKpRgjgAAAo4"]
[Mon Nov 24 20:33:55.630438 2025] [:error] [pid 9630:tid 9654] [client 185.194.178.85:30271] [client 185.194.178.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aSRQsyrSgUgPGkizt2omQQAAAFY"]
[Mon Nov 24 20:33:56.533082 2025] [:error] [pid 48599:tid 48619] [client 185.194.178.88:65517] [client 185.194.178.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/install.php"] [unique_id "aSRQtJzvu6PDJiRKE3JFJgAAAZA"]
[Mon Nov 24 20:33:57.511502 2025] [proxy_fcgi:error] [pid 16441:tid 16463] [client 185.194.178.102:39251] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:00.415774 2025] [proxy_fcgi:error] [pid 16441:tid 16466] [client 185.194.178.102:39251] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:00.813283 2025] [proxy_fcgi:error] [pid 16441:tid 16451] [client 185.194.178.102:39251] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:04.282121 2025] [:error] [pid 16441:tid 16463] [client 185.194.178.102:39251] [client 185.194.178.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.102, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aSRQvIq_bc5MOa9Hfll7DAAAAJM"]
[Mon Nov 24 20:34:04.740269 2025] [:error] [pid 16441:tid 16459] [client 185.194.178.102:39251] [client 185.194.178.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSRQvIq_bc5MOa9Hfll7DQAAAI8"]
[Mon Nov 24 20:34:06.161352 2025] [proxy_fcgi:error] [pid 48599:tid 48625] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:06.601860 2025] [:error] [pid 48599:tid 48620] [client 185.194.178.82:27493] [client 185.194.178.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.82, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSRQvpzvu6PDJiRKE3JFLQAAAZE"]
[Mon Nov 24 20:34:07.514800 2025] [proxy_fcgi:error] [pid 48599:tid 48626] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:09.219736 2025] [proxy_fcgi:error] [pid 48599:tid 48617] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:09.685942 2025] [proxy_fcgi:error] [pid 48599:tid 48615] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:10.190337 2025] [proxy_fcgi:error] [pid 48599:tid 48627] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:10.875377 2025] [proxy_fcgi:error] [pid 48599:tid 48616] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:11.539442 2025] [proxy_fcgi:error] [pid 48599:tid 48621] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:11.985615 2025] [proxy_fcgi:error] [pid 48599:tid 48613] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:12.472075 2025] [proxy_fcgi:error] [pid 48599:tid 48614] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:12.971142 2025] [proxy_fcgi:error] [pid 48599:tid 48607] [client 185.194.178.82:27493] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:14.951038 2025] [:error] [pid 48599:tid 48624] [client 185.194.178.82:27493] [client 185.194.178.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aSRQxpzvu6PDJiRKE3JFQAAAAZU"]
[Mon Nov 24 20:34:16.021210 2025] [proxy_fcgi:error] [pid 16549:tid 16563] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:16.466733 2025] [proxy_fcgi:error] [pid 16549:tid 16559] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:16.989154 2025] [proxy_fcgi:error] [pid 16549:tid 16556] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:17.429654 2025] [proxy_fcgi:error] [pid 16549:tid 16572] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:17.877418 2025] [proxy_fcgi:error] [pid 16549:tid 16557] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:18.385388 2025] [proxy_fcgi:error] [pid 16549:tid 16555] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:19.232148 2025] [proxy_fcgi:error] [pid 16549:tid 16573] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:19.974084 2025] [proxy_fcgi:error] [pid 16549:tid 16561] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:20.554944 2025] [proxy_fcgi:error] [pid 16549:tid 16569] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:21.008211 2025] [proxy_fcgi:error] [pid 16549:tid 16568] [client 185.194.178.63:31079] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:21.630932 2025] [:error] [pid 16549:tid 16567] [client 185.194.178.63:31079] [client 185.194.178.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSRQzaeWW19A99PUw_dc2QAAAU8"]
[Mon Nov 24 20:34:22.459231 2025] [proxy_fcgi:error] [pid 48688:tid 48702] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:24.584047 2025] [proxy_fcgi:error] [pid 48688:tid 48708] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:25.030291 2025] [proxy_fcgi:error] [pid 48688:tid 48697] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:25.472405 2025] [proxy_fcgi:error] [pid 48688:tid 48693] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:26.107850 2025] [proxy_fcgi:error] [pid 48688:tid 48706] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:26.729593 2025] [proxy_fcgi:error] [pid 48688:tid 48694] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:27.305158 2025] [proxy_fcgi:error] [pid 48688:tid 48707] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:27.705409 2025] [proxy_fcgi:error] [pid 48688:tid 48705] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:28.646706 2025] [proxy_fcgi:error] [pid 48688:tid 48712] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:29.079182 2025] [proxy_fcgi:error] [pid 48688:tid 48703] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:29.617596 2025] [:error] [pid 48688:tid 48711] [client 185.194.178.97:57587] [client 185.194.178.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.97, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSRQ1Rm2q1FkzLam7A3B5QAAAlM"]
[Mon Nov 24 20:34:30.111095 2025] [proxy_fcgi:error] [pid 48688:tid 48698] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:31.437782 2025] [proxy_fcgi:error] [pid 48688:tid 48709] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:31.938582 2025] [proxy_fcgi:error] [pid 48688:tid 48714] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:33.523732 2025] [proxy_fcgi:error] [pid 48688:tid 48695] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:37.883202 2025] [proxy_fcgi:error] [pid 48688:tid 48708] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:38.306840 2025] [proxy_fcgi:error] [pid 48688:tid 48697] [client 185.194.178.97:57587] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 20:34:39.234466 2025] [autoindex:error] [pid 48688:tid 48706] [client 185.194.178.97:57587] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 20:34:39.734521 2025] [autoindex:error] [pid 48688:tid 48694] [client 185.194.178.97:57587] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 20:34:40.183894 2025] [autoindex:error] [pid 48688:tid 48707] [client 185.194.178.97:57587] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 20:36:01.605923 2025] [autoindex:error] [pid 16441:tid 16454] [client 185.194.178.94:53759] AH01276: Cannot serve directory /home/switchcreative/public_html/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 21:45:38.755402 2025] [:error] [pid 16549:tid 16557] [client 193.32.126.212:54941] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSRhgqeWW19A99PUw_doBAAAAUU"]
[Mon Nov 24 21:45:39.250051 2025] [:error] [pid 16549:tid 16566] [client 193.32.126.212:55556] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSRhg6eWW19A99PUw_doDwAAAU4"]
[Mon Nov 24 21:45:39.741888 2025] [:error] [pid 48601:tid 48681] [client 193.32.126.212:55997] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhg4MM4MaVTk74-AbnJwAAAhg"]
[Tue Nov 25 00:10:37.125435 2025] [:error] [pid 16441:tid 16463] [client 43.157.43.147:52186] [client 43.157.43.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSSDfYq_bc5MOa9HflnGkwAAAJM"]
[Tue Nov 25 06:42:29.773260 2025] [:error] [pid 1103:tid 1126] [client 172.56.35.246:45642] [client 172.56.35.246] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aSTfVY0LETdqOlq63sQUVwAAAVE"], referer: https://www.google.com
[Tue Nov 25 06:42:35.133779 2025] [:error] [pid 14168:tid 14185] [client 172.56.35.246:28280] [client 172.56.35.246] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aSTfW_R-ZDU0QEgAIIuJxwAAAM4"]
[Tue Nov 25 06:42:35.134161 2025] [:error] [pid 14168:tid 14185] [client 172.56.35.246:28280] [client 172.56.35.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.56.35.246, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aSTfW_R-ZDU0QEgAIIuJxwAAAM4"]
[Tue Nov 25 06:42:35.147832 2025] [proxy_fcgi:error] [pid 14168:tid 14185] [client 172.56.35.246:28280] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 06:42:42.924149 2025] [:error] [pid 14078:tid 14141] [client 172.56.35.246:1979] [client 172.56.35.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.56.35.246, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSTfYtVXYbb0ii_rVoJeUQAAAIQ"], referer: https://www.google.com
[Tue Nov 25 06:42:42.931798 2025] [proxy_fcgi:error] [pid 14078:tid 14141] [client 172.56.35.246:1979] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Tue Nov 25 06:42:45.268836 2025] [:error] [pid 14078:tid 14154] [client 172.56.35.246:45833] [client 172.56.35.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.56.35.246, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSTfZdVXYbb0ii_rVoJeVQAAAJE"], referer: https://www.google.com
[Tue Nov 25 06:42:45.274216 2025] [proxy_fcgi:error] [pid 14078:tid 14154] [client 172.56.35.246:45833] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Tue Nov 25 09:42:48.835810 2025] [proxy_fcgi:error] [pid 14688:tid 14713] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Tue Nov 25 09:42:49.096643 2025] [proxy_fcgi:error] [pid 14688:tid 14703] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Tue Nov 25 09:42:49.352016 2025] [proxy_fcgi:error] [pid 14688:tid 14707] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Tue Nov 25 09:42:49.569268 2025] [proxy_fcgi:error] [pid 14688:tid 14698] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Tue Nov 25 09:42:49.781784 2025] [proxy_fcgi:error] [pid 14688:tid 14690] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Tue Nov 25 09:42:50.371167 2025] [proxy_fcgi:error] [pid 14688:tid 14706] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Tue Nov 25 09:42:50.824456 2025] [proxy_fcgi:error] [pid 14688:tid 14711] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Tue Nov 25 09:42:51.301050 2025] [proxy_fcgi:error] [pid 14688:tid 14714] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Tue Nov 25 09:42:51.520223 2025] [proxy_fcgi:error] [pid 14688:tid 14696] [client 128.24.70.128:27829] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Tue Nov 25 14:50:54.826192 2025] [:error] [pid 28842:tid 29018] [client 43.130.105.21:41630] [client 43.130.105.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSVRztNmoaPf6T4-6C0ynAAAA1E"]
[Tue Nov 25 15:54:57.675566 2025] [:error] [pid 28609:tid 28623] [client 159.89.14.121:55517] [client 159.89.14.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.14.121, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aSVg0SGGdT-nZJVs3x2U7wAAAYU"]
[Tue Nov 25 15:54:57.686893 2025] [proxy_fcgi:error] [pid 28609:tid 28623] [client 159.89.14.121:55517] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 18:53:14.143285 2025] [:error] [pid 2987:tid 3005] [client 138.199.60.187:54318] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSWKms-djEt-pTzPxnyUKwAAAVA"]
[Tue Nov 25 18:53:14.423833 2025] [:error] [pid 28842:tid 29023] [client 138.199.60.187:54456] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSWKmtNmoaPf6T4-6C2DyQAAA1U"]
[Tue Nov 25 18:53:15.687652 2025] [:error] [pid 28739:tid 28779] [client 138.199.60.187:55346] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSWKmxxGpKmlkG4FexRwdAAAAhE"]
[Tue Nov 25 18:53:15.958616 2025] [:error] [pid 28740:tid 28806] [client 138.199.60.187:55594] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSWKm1ppQCoYxWW6V0Vy7AAAAk8"]
[Tue Nov 25 18:53:16.239232 2025] [:error] [pid 14076:tid 14086] [client 138.199.60.187:55828] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/manager.php"] [unique_id "aSWKnHsB4Gz6Qw-pvBsKcwAAAAU"]
[Tue Nov 25 18:53:16.463195 2025] [:error] [pid 28740:tid 28793] [client 138.199.60.187:56028] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnFppQCoYxWW6V0VzCQAAAkI"]
[Tue Nov 25 18:53:16.714881 2025] [:error] [pid 28842:tid 28997] [client 138.199.60.187:56292] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnNNmoaPf6T4-6C2D_gAAA0c"]
[Tue Nov 25 18:53:18.010743 2025] [:error] [pid 28740:tid 28793] [client 138.199.60.187:53556] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnlppQCoYxWW6V0VzMgAAAkI"]
[Tue Nov 25 18:53:18.267023 2025] [:error] [pid 14077:tid 14113] [client 138.199.60.187:53624] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnhG9n7UHEkwDTyh-jQAAAEM"]
[Tue Nov 25 18:53:18.520801 2025] [:error] [pid 14076:tid 14101] [client 138.199.60.187:53684] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnnsB4Gz6Qw-pvBsKgwAAABQ"]
[Tue Nov 25 19:25:53.220338 2025] [:error] [pid 28739:tid 28783] [client 54.173.250.15:34166] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aSWSQRxGpKmlkG4FexR4lgAAAhU"]
[Tue Nov 25 21:59:15.570110 2025] [:error] [pid 14078:tid 14140] [client 223.244.35.77:50002] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSW2M9VXYbb0ii_rVoKJegAAAIM"]
[Wed Nov 26 00:04:39.248223 2025] [autoindex:error] [pid 14077:tid 14122] [client 139.59.30.253:64955] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 00:07:43.216451 2025] [proxy_fcgi:error] [pid 14168:tid 14190] [client 20.249.10.99:32864] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:07:43.374497 2025] [proxy_fcgi:error] [pid 14168:tid 14194] [client 20.249.10.99:32864] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:07:44.180742 2025] [proxy_fcgi:error] [pid 14168:tid 14175] [client 20.249.10.99:32864] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:07:44.335329 2025] [proxy_fcgi:error] [pid 14168:tid 14181] [client 20.249.10.99:32864] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:07:45.643442 2025] [proxy_fcgi:error] [pid 14168:tid 14192] [client 20.249.10.99:32864] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:07:45.791968 2025] [:error] [pid 14168:tid 14193] [client 20.249.10.99:32864] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/0.php"] [unique_id "aSXUUfR-ZDU0QEgAIIuyBgAAANY"]
[Wed Nov 26 00:07:46.124319 2025] [:error] [pid 43843:tid 43857] [client 20.249.10.99:33101] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.php"] [unique_id "aSXUUhhx4v3NUNdMKDMYSAAAAcw"]
[Wed Nov 26 00:07:46.449132 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:32891] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.php"] [unique_id "aSXUUtVXYbb0ii_rVoLDagAAAJM"]
[Wed Nov 26 00:07:47.194133 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:33096] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.php"] [unique_id "aSXUUxG9n7UHEkwDTyj2ugAAAE0"]
[Wed Nov 26 00:07:47.536760 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:32834] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.php"] [unique_id "aSXUU9VXYbb0ii_rVoLDbgAAAJg"]
[Wed Nov 26 00:07:48.029425 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:32842] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fwe.php"] [unique_id "aSXUVNVXYbb0ii_rVoLDcwAAAIM"]
[Wed Nov 26 00:07:48.498246 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:32881] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fwe.php"] [unique_id "aSXUVBxGpKmlkG4FexTj7AAAAgs"]
[Wed Nov 26 00:07:48.903733 2025] [:error] [pid 28609:tid 28619] [client 20.249.10.99:32844] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fwe.php"] [unique_id "aSXUVCGGdT-nZJVs3x0agwAAAYE"]
[Wed Nov 26 00:07:49.358102 2025] [:error] [pid 43843:tid 43854] [client 20.249.10.99:32894] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fwe.php"] [unique_id "aSXUVRhx4v3NUNdMKDMYSwAAAck"]
[Wed Nov 26 00:07:49.819198 2025] [:error] [pid 43843:tid 43847] [client 20.249.10.99:32859] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/cs.php"] [unique_id "aSXUVRhx4v3NUNdMKDMYTAAAAcI"]
[Wed Nov 26 00:07:50.218169 2025] [:error] [pid 14076:tid 14100] [client 20.249.10.99:32893] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wikindex.php"] [unique_id "aSXUVnsB4Gz6Qw-pvBtw7QAAABM"]
[Wed Nov 26 00:07:50.675989 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:33110] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wikindex.php"] [unique_id "aSXUVhhx4v3NUNdMKDMYTgAAAcQ"]
[Wed Nov 26 00:07:51.046996 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:32919] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wikindex.php"] [unique_id "aSXUVxG9n7UHEkwDTyj2vgAAAFg"]
[Wed Nov 26 00:07:51.388918 2025] [:error] [pid 43981:tid 43996] [client 20.249.10.99:33117] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/m.php"] [unique_id "aSXUVwgZn97m_qh_RaGOMgAAAw0"]
[Wed Nov 26 00:07:51.817839 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:32856] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/m.php"] [unique_id "aSXUV3sB4Gz6Qw-pvBtw8QAAABI"]
[Wed Nov 26 00:07:52.217752 2025] [:error] [pid 28836:tid 28962] [client 20.249.10.99:33106] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/m.php"] [unique_id "aSXUWJwNRsoxcLQGkTcQPwAAAsc"]
[Wed Nov 26 00:07:52.807455 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:32870] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/m.php"] [unique_id "aSXUWPR-ZDU0QEgAIIuyCAAAANI"]
[Wed Nov 26 00:07:53.420120 2025] [:error] [pid 14076:tid 14082] [client 20.249.10.99:32879] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/kses.php"] [unique_id "aSXUWXsB4Gz6Qw-pvBtw9gAAAAE"]
[Wed Nov 26 00:07:53.793017 2025] [:error] [pid 14076:tid 14094] [client 20.249.10.99:32867] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jagoan.php"] [unique_id "aSXUWXsB4Gz6Qw-pvBtw-QAAAA0"]
[Wed Nov 26 00:07:54.317696 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:32868] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jagoan.php"] [unique_id "aSXUWhxGpKmlkG4FexTj9wAAAhQ"]
[Wed Nov 26 00:07:54.876107 2025] [:error] [pid 28609:tid 28624] [client 20.249.10.99:32875] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jagoan.php"] [unique_id "aSXUWiGGdT-nZJVs3x0ajQAAAYY"]
[Wed Nov 26 00:07:55.322133 2025] [:error] [pid 28609:tid 28619] [client 20.249.10.99:32848] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jagoan.php"] [unique_id "aSXUWyGGdT-nZJVs3x0akAAAAYE"]
[Wed Nov 26 00:07:56.688248 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:33133] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/g3.php"] [unique_id "aSXUXCGGdT-nZJVs3x0alQAAAYs"]
[Wed Nov 26 00:07:57.124884 2025] [:error] [pid 28739:tid 28768] [client 20.249.10.99:33093] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/g3.php"] [unique_id "aSXUXRxGpKmlkG4FexTj-gAAAgY"]
[Wed Nov 26 00:07:57.721140 2025] [:error] [pid 28739:tid 28774] [client 20.249.10.99:32885] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/g3.php"] [unique_id "aSXUXRxGpKmlkG4FexTj_AAAAgw"]
[Wed Nov 26 00:07:58.372642 2025] [:error] [pid 28739:tid 28783] [client 20.249.10.99:32863] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/g3.php"] [unique_id "aSXUXhxGpKmlkG4FexTkAAAAAhU"]
[Wed Nov 26 00:07:58.740983 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:32865] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/zaza.php"] [unique_id "aSXUXhhx4v3NUNdMKDMYWgAAAc8"]
[Wed Nov 26 00:07:59.155973 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:33092] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/zaza.php"] [unique_id "aSXUX_R-ZDU0QEgAIIuyFwAAAMg"]
[Wed Nov 26 00:07:59.530585 2025] [:error] [pid 28739:tid 28770] [client 20.249.10.99:32841] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/zaza.php"] [unique_id "aSXUXxxGpKmlkG4FexTkCAAAAgg"]
[Wed Nov 26 00:08:00.119051 2025] [:error] [pid 28836:tid 29010] [client 20.249.10.99:33102] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/zaza.php"] [unique_id "aSXUYJwNRsoxcLQGkTcQVgAAAtQ"]
[Wed Nov 26 00:08:01.147534 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:32862] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSXUYdVXYbb0ii_rVoLDhQAAAIo"]
[Wed Nov 26 00:08:01.913311 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:33132] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSXUYSGGdT-nZJVs3x0aoQAAAYI"]
[Wed Nov 26 00:08:02.456935 2025] [:error] [pid 14078:tid 14155] [client 20.249.10.99:33138] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSXUYtVXYbb0ii_rVoLDiAAAAJI"]
[Wed Nov 26 00:08:02.897293 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:33098] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/myip.php"] [unique_id "aSXUYtVXYbb0ii_rVoLDiQAAAIs"]
[Wed Nov 26 00:08:03.691941 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:33105] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htaccess.php"] [unique_id "aSXUY_R-ZDU0QEgAIIuyGgAAANI"]
[Wed Nov 26 00:08:04.303253 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:33149] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htaccess.php"] [unique_id "aSXUZBhx4v3NUNdMKDMYYAAAAcQ"]
[Wed Nov 26 00:08:04.850810 2025] [:error] [pid 14076:tid 14092] [client 20.249.10.99:32840] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htaccess.php"] [unique_id "aSXUZHsB4Gz6Qw-pvBtxAQAAAAs"]
[Wed Nov 26 00:08:05.238922 2025] [:error] [pid 14078:tid 14144] [client 20.249.10.99:33100] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htaccess.php"] [unique_id "aSXUZdVXYbb0ii_rVoLDjwAAAIc"]
[Wed Nov 26 00:08:05.755693 2025] [:error] [pid 14168:tid 14180] [client 20.249.10.99:32846] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "aSXUZfR-ZDU0QEgAIIuyHAAAAMk"]
[Wed Nov 26 00:08:06.116103 2025] [:error] [pid 28609:tid 28622] [client 20.249.10.99:33099] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "aSXUZiGGdT-nZJVs3x0aogAAAYQ"]
[Wed Nov 26 00:08:06.525596 2025] [:error] [pid 14168:tid 14171] [client 20.249.10.99:32887] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "aSXUZvR-ZDU0QEgAIIuyHgAAAMA"]
[Wed Nov 26 00:08:07.150438 2025] [:error] [pid 14077:tid 14122] [client 20.249.10.99:32871] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "aSXUZxG9n7UHEkwDTyj2ywAAAEw"]
[Wed Nov 26 00:08:07.689844 2025] [:error] [pid 14078:tid 14151] [client 20.249.10.99:32849] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cok.php"] [unique_id "aSXUZ9VXYbb0ii_rVoLDlwAAAI4"]
[Wed Nov 26 00:08:08.446482 2025] [:error] [pid 28739:tid 28768] [client 20.249.10.99:33125] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cok.php"] [unique_id "aSXUaBxGpKmlkG4FexTkGAAAAgY"]
[Wed Nov 26 00:08:08.927512 2025] [:error] [pid 28739:tid 28774] [client 20.249.10.99:33104] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cok.php"] [unique_id "aSXUaBxGpKmlkG4FexTkGQAAAgw"]
[Wed Nov 26 00:08:09.325637 2025] [:error] [pid 43843:tid 43869] [client 20.249.10.99:33121] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cok.php"] [unique_id "aSXUaRhx4v3NUNdMKDMYZwAAAdg"]
[Wed Nov 26 00:08:10.032020 2025] [:error] [pid 14168:tid 14181] [client 20.249.10.99:32877] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hob.php"] [unique_id "aSXUavR-ZDU0QEgAIIuyIAAAAMo"]
[Wed Nov 26 00:08:10.703696 2025] [:error] [pid 43981:tid 43987] [client 20.249.10.99:32852] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hob.php"] [unique_id "aSXUaggZn97m_qh_RaGOPwAAAwQ"]
[Wed Nov 26 00:08:11.087144 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:32886] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hob.php"] [unique_id "aSXUa3sB4Gz6Qw-pvBtxBAAAABI"]
[Wed Nov 26 00:08:11.449777 2025] [:error] [pid 14076:tid 14104] [client 20.249.10.99:32861] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hob.php"] [unique_id "aSXUa3sB4Gz6Qw-pvBtxBwAAABc"]
[Wed Nov 26 00:08:11.793791 2025] [:error] [pid 14076:tid 14089] [client 20.249.10.99:32880] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kal.php"] [unique_id "aSXUa3sB4Gz6Qw-pvBtxCQAAAAg"]
[Wed Nov 26 00:08:12.428018 2025] [:error] [pid 14076:tid 14094] [client 20.249.10.99:32883] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kal.php"] [unique_id "aSXUbHsB4Gz6Qw-pvBtxDAAAAA0"]
[Wed Nov 26 00:08:13.125788 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:33109] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kal.php"] [unique_id "aSXUbRhx4v3NUNdMKDMYbQAAAcQ"]
[Wed Nov 26 00:08:13.863093 2025] [:error] [pid 14076:tid 14100] [client 20.249.10.99:33115] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kal.php"] [unique_id "aSXUbXsB4Gz6Qw-pvBtxDwAAABM"]
[Wed Nov 26 00:08:14.224141 2025] [:error] [pid 43981:tid 43994] [client 20.249.10.99:32839] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fv.php"] [unique_id "aSXUbggZn97m_qh_RaGORAAAAws"]
[Wed Nov 26 00:08:14.556742 2025] [:error] [pid 14078:tid 14140] [client 20.249.10.99:32857] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fv.php"] [unique_id "aSXUbtVXYbb0ii_rVoLDmgAAAIM"]
[Wed Nov 26 00:08:15.324047 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:32872] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fv.php"] [unique_id "aSXUb_R-ZDU0QEgAIIuyJwAAANM"]
[Wed Nov 26 00:08:15.781053 2025] [:error] [pid 28836:tid 28965] [client 20.249.10.99:32921] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fv.php"] [unique_id "aSXUb5wNRsoxcLQGkTcQXgAAAso"]
[Wed Nov 26 00:08:16.136289 2025] [:error] [pid 43843:tid 43855] [client 20.249.10.99:33147] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lx.php"] [unique_id "aSXUcBhx4v3NUNdMKDMYcAAAAco"]
[Wed Nov 26 00:08:16.651840 2025] [:error] [pid 14076:tid 14098] [client 20.249.10.99:33103] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lx.php"] [unique_id "aSXUcHsB4Gz6Qw-pvBtxFwAAABE"]
[Wed Nov 26 00:08:17.308243 2025] [:error] [pid 43843:tid 43853] [client 20.249.10.99:32888] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lx.php"] [unique_id "aSXUcRhx4v3NUNdMKDMYcwAAAcg"]
[Wed Nov 26 00:08:18.385915 2025] [:error] [pid 2987:tid 3003] [client 20.249.10.99:32884] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lx.php"] [unique_id "aSXUcs-djEt-pTzPxnzzVAAAAU4"]
[Wed Nov 26 00:08:18.752119 2025] [:error] [pid 2987:tid 3010] [client 20.249.10.99:33091] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w1w.php"] [unique_id "aSXUcs-djEt-pTzPxnzzVgAAAVU"]
[Wed Nov 26 00:08:19.169948 2025] [:error] [pid 28609:tid 28632] [client 20.249.10.99:33107] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w1w.php"] [unique_id "aSXUcyGGdT-nZJVs3x0aqQAAAY4"]
[Wed Nov 26 00:08:20.005628 2025] [:error] [pid 2987:tid 2995] [client 20.249.10.99:32895] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w1w.php"] [unique_id "aSXUdM-djEt-pTzPxnzzWAAAAUY"]
[Wed Nov 26 00:08:20.542422 2025] [:error] [pid 14076:tid 14088] [client 20.249.10.99:32892] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w1w.php"] [unique_id "aSXUdHsB4Gz6Qw-pvBtxIAAAAAc"]
[Wed Nov 26 00:08:21.064591 2025] [:error] [pid 2987:tid 3009] [client 20.249.10.99:32900] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Contrller.php"] [unique_id "aSXUdc-djEt-pTzPxnzzXAAAAVQ"]
[Wed Nov 26 00:08:21.580883 2025] [:error] [pid 43843:tid 43866] [client 20.249.10.99:33141] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Contrller.php"] [unique_id "aSXUdRhx4v3NUNdMKDMYdQAAAdU"]
[Wed Nov 26 00:08:21.961459 2025] [:error] [pid 14077:tid 14124] [client 20.249.10.99:33139] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Contrller.php"] [unique_id "aSXUdRG9n7UHEkwDTyj21gAAAE4"]
[Wed Nov 26 00:08:22.955021 2025] [:error] [pid 2987:tid 2989] [client 20.249.10.99:32832] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Contrller.php"] [unique_id "aSXUds-djEt-pTzPxnzzXwAAAUA"]
[Wed Nov 26 00:08:23.950559 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:33090] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cafe.php"] [unique_id "aSXUd9VXYbb0ii_rVoLDqwAAAJU"]
[Wed Nov 26 00:08:24.547531 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:33146] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cafe.php"] [unique_id "aSXUeCGGdT-nZJVs3x0asAAAAZg"]
[Wed Nov 26 00:08:25.329958 2025] [:error] [pid 28609:tid 28640] [client 20.249.10.99:32906] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cafe.php"] [unique_id "aSXUeSGGdT-nZJVs3x0aswAAAZY"]
[Wed Nov 26 00:08:25.965941 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:32873] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cafe.php"] [unique_id "aSXUedVXYbb0ii_rVoLDrgAAAIw"]
[Wed Nov 26 00:08:26.434906 2025] [:error] [pid 14078:tid 14152] [client 20.249.10.99:32890] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww2.php"] [unique_id "aSXUetVXYbb0ii_rVoLDrwAAAI8"]
[Wed Nov 26 00:08:27.025974 2025] [:error] [pid 14076:tid 14086] [client 20.249.10.99:32836] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww2.php"] [unique_id "aSXUe3sB4Gz6Qw-pvBtxKgAAAAU"]
[Wed Nov 26 00:08:27.468115 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:33151] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww2.php"] [unique_id "aSXUexG9n7UHEkwDTyj23AAAAFI"]
[Wed Nov 26 00:08:27.838928 2025] [:error] [pid 43981:tid 44007] [client 20.249.10.99:32833] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww2.php"] [unique_id "aSXUewgZn97m_qh_RaGOUQAAAxg"]
[Wed Nov 26 00:08:28.367244 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:32939] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww3.php"] [unique_id "aSXUfBG9n7UHEkwDTyj23wAAAEI"]
[Wed Nov 26 00:08:28.777299 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:33089] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww3.php"] [unique_id "aSXUfBG9n7UHEkwDTyj24QAAAFc"]
[Wed Nov 26 00:08:29.397905 2025] [:error] [pid 14077:tid 14129] [client 20.249.10.99:32908] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww3.php"] [unique_id "aSXUfRG9n7UHEkwDTyj24gAAAFM"]
[Wed Nov 26 00:08:30.032170 2025] [:error] [pid 14078:tid 14153] [client 20.249.10.99:32835] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww3.php"] [unique_id "aSXUftVXYbb0ii_rVoLDsgAAAJA"]
[Wed Nov 26 00:08:30.361812 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:32853] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSXUftVXYbb0ii_rVoLDtAAAAIk"]
[Wed Nov 26 00:08:30.884626 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:32874] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSXUfiGGdT-nZJVs3x0awgAAAZc"]
[Wed Nov 26 00:08:31.376148 2025] [:error] [pid 14078:tid 14154] [client 20.249.10.99:32838] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSXUf9VXYbb0ii_rVoLDuAAAAJE"]
[Wed Nov 26 00:08:31.921305 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:32918] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww4.php"] [unique_id "aSXUfyGGdT-nZJVs3x0aygAAAY8"]
[Wed Nov 26 00:08:32.350314 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:32936] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "aSXUgCGGdT-nZJVs3x0aywAAAYw"]
[Wed Nov 26 00:08:32.839062 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:33143] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "aSXUgNVXYbb0ii_rVoLDvAAAAJg"]
[Wed Nov 26 00:08:33.527404 2025] [:error] [pid 28609:tid 28631] [client 20.249.10.99:33113] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "aSXUgSGGdT-nZJVs3x0a0QAAAY0"]
[Wed Nov 26 00:08:34.002862 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:32938] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "aSXUgiGGdT-nZJVs3x0a0gAAAZE"]
[Wed Nov 26 00:08:34.404003 2025] [:error] [pid 43843:tid 43848] [client 20.249.10.99:32926] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aSXUghhx4v3NUNdMKDMYhAAAAcM"]
[Wed Nov 26 00:08:34.945912 2025] [:error] [pid 43843:tid 43847] [client 20.249.10.99:33097] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aSXUghhx4v3NUNdMKDMYhQAAAcI"]
[Wed Nov 26 00:08:35.369803 2025] [:error] [pid 28836:tid 29010] [client 20.249.10.99:33118] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aSXUg5wNRsoxcLQGkTcQaQAAAtQ"]
[Wed Nov 26 00:08:35.973317 2025] [:error] [pid 28609:tid 28623] [client 20.249.10.99:32854] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsd.php"] [unique_id "aSXUgyGGdT-nZJVs3x0a1QAAAYU"]
[Wed Nov 26 00:08:36.656955 2025] [:error] [pid 43843:tid 43852] [client 20.249.10.99:32904] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXUhBhx4v3NUNdMKDMYiAAAAcc"]
[Wed Nov 26 00:08:37.123367 2025] [:error] [pid 2987:tid 3009] [client 20.249.10.99:32920] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXUhc-djEt-pTzPxnzzZwAAAVQ"]
[Wed Nov 26 00:08:37.451216 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:32948] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXUhRhx4v3NUNdMKDMYiQAAAcQ"]
[Wed Nov 26 00:08:37.873636 2025] [:error] [pid 14078:tid 14139] [client 20.249.10.99:32876] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXUhdVXYbb0ii_rVoLDvgAAAII"]
[Wed Nov 26 00:08:38.372468 2025] [:error] [pid 28836:tid 28963] [client 20.249.10.99:32860] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/max.php"] [unique_id "aSXUhpwNRsoxcLQGkTcQbgAAAsg"]
[Wed Nov 26 00:08:38.870579 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:32850] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/max.php"] [unique_id "aSXUhvR-ZDU0QEgAIIuyQgAAAM0"]
[Wed Nov 26 00:08:39.647867 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:33094] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/max.php"] [unique_id "aSXUh9VXYbb0ii_rVoLDwwAAAIo"]
[Wed Nov 26 00:08:40.137958 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:32882] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/max.php"] [unique_id "aSXUiHsB4Gz6Qw-pvBtxQQAAAAI"]
[Wed Nov 26 00:08:40.718151 2025] [:error] [pid 14078:tid 14151] [client 20.249.10.99:32843] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/m.php"] [unique_id "aSXUiNVXYbb0ii_rVoLDxAAAAI4"]
[Wed Nov 26 00:08:41.164441 2025] [:error] [pid 2987:tid 2989] [client 20.249.10.99:32851] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/m.php"] [unique_id "aSXUic-djEt-pTzPxnzzaAAAAUA"]
[Wed Nov 26 00:08:41.748122 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:32914] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/m.php"] [unique_id "aSXUic-djEt-pTzPxnzzbAAAAUg"]
[Wed Nov 26 00:08:42.224017 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:32897] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/m.php"] [unique_id "aSXUitVXYbb0ii_rVoLDyAAAAIE"]
[Wed Nov 26 00:08:42.715823 2025] [:error] [pid 43843:tid 43847] [client 20.249.10.99:33129] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/post.php"] [unique_id "aSXUihhx4v3NUNdMKDMYmgAAAcI"]
[Wed Nov 26 00:08:43.137047 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:32905] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/post.php"] [unique_id "aSXUi5wNRsoxcLQGkTcQdwAAAsY"]
[Wed Nov 26 00:08:44.091112 2025] [:error] [pid 28609:tid 28622] [client 20.249.10.99:32951] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/post.php"] [unique_id "aSXUjCGGdT-nZJVs3x0a5QAAAYQ"]
[Wed Nov 26 00:08:44.594148 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:33148] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/post.php"] [unique_id "aSXUjNVXYbb0ii_rVoLD0QAAAJY"]
[Wed Nov 26 00:08:45.175858 2025] [proxy_fcgi:error] [pid 14076:tid 14081] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.094373 2025] [proxy_fcgi:error] [pid 14076:tid 14090] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.250126 2025] [proxy_fcgi:error] [pid 14076:tid 14102] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.401922 2025] [proxy_fcgi:error] [pid 14076:tid 14101] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.555791 2025] [proxy_fcgi:error] [pid 14076:tid 14084] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.710492 2025] [proxy_fcgi:error] [pid 14076:tid 14089] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:46.923591 2025] [proxy_fcgi:error] [pid 14076:tid 14105] [client 20.249.10.99:33123] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:08:47.142563 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:33123] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aSXUj3sB4Gz6Qw-pvBtxaQAAAAA"]
[Wed Nov 26 00:08:47.636412 2025] [:error] [pid 14077:tid 14133] [client 20.249.10.99:32910] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aSXUjxG9n7UHEkwDTyj27wAAAFc"]
[Wed Nov 26 00:08:48.141445 2025] [:error] [pid 28609:tid 28639] [client 20.249.10.99:33124] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aSXUkCGGdT-nZJVs3x0a6gAAAZU"]
[Wed Nov 26 00:08:48.817691 2025] [:error] [pid 43981:tid 43983] [client 20.249.10.99:33119] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aSXUkAgZn97m_qh_RaGOXwAAAwA"]
[Wed Nov 26 00:08:49.352129 2025] [:error] [pid 43981:tid 44003] [client 20.249.10.99:33122] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUkQgZn97m_qh_RaGOYQAAAxQ"]
[Wed Nov 26 00:08:49.956951 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:32869] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUkSGGdT-nZJVs3x0a8AAAAZg"]
[Wed Nov 26 00:08:50.622422 2025] [:error] [pid 28739:tid 28780] [client 20.249.10.99:32933] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUkhxGpKmlkG4FexTkNwAAAhI"]
[Wed Nov 26 00:08:51.136840 2025] [:error] [pid 14076:tid 14088] [client 20.249.10.99:32947] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUk3sB4Gz6Qw-pvBtxeAAAAAc"]
[Wed Nov 26 00:08:51.514119 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:33155] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSXUk3sB4Gz6Qw-pvBtxegAAAAA"]
[Wed Nov 26 00:08:51.864700 2025] [:error] [pid 14077:tid 14128] [client 20.249.10.99:33135] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSXUkxG9n7UHEkwDTyj2-gAAAFI"]
[Wed Nov 26 00:08:52.256337 2025] [:error] [pid 43843:tid 43865] [client 20.249.10.99:33116] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSXUlBhx4v3NUNdMKDMYnwAAAdQ"]
[Wed Nov 26 00:08:52.690774 2025] [:error] [pid 28836:tid 28962] [client 20.249.10.99:32845] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fw.php"] [unique_id "aSXUlJwNRsoxcLQGkTcQggAAAsc"]
[Wed Nov 26 00:08:53.153290 2025] [:error] [pid 28739:tid 28762] [client 20.249.10.99:32922] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSXUlRxGpKmlkG4FexTkOgAAAgA"]
[Wed Nov 26 00:08:53.539822 2025] [:error] [pid 28739:tid 28773] [client 20.249.10.99:32915] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSXUlRxGpKmlkG4FexTkPgAAAgs"]
[Wed Nov 26 00:08:54.312503 2025] [:error] [pid 28836:tid 28966] [client 20.249.10.99:33134] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSXUlpwNRsoxcLQGkTcQhQAAAss"]
[Wed Nov 26 00:08:54.889592 2025] [:error] [pid 28836:tid 28960] [client 20.249.10.99:32935] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aSXUlpwNRsoxcLQGkTcQhgAAAsU"]
[Wed Nov 26 00:08:55.296223 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:33142] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSXUlxxGpKmlkG4FexTkRAAAAgQ"]
[Wed Nov 26 00:08:55.791444 2025] [:error] [pid 28836:tid 29014] [client 20.249.10.99:32944] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/termps.php"] [unique_id "aSXUl5wNRsoxcLQGkTcQhwAAAtg"]
[Wed Nov 26 00:08:56.218344 2025] [:error] [pid 14168:tid 14187] [client 20.249.10.99:33127] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/termps.php"] [unique_id "aSXUmPR-ZDU0QEgAIIuyRgAAANA"]
[Wed Nov 26 00:08:56.738791 2025] [:error] [pid 14078:tid 14157] [client 20.249.10.99:33166] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/termps.php"] [unique_id "aSXUmNVXYbb0ii_rVoLD5wAAAJQ"]
[Wed Nov 26 00:08:57.087271 2025] [:error] [pid 43981:tid 43988] [client 20.249.10.99:32923] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aSXUmQgZn97m_qh_RaGOZwAAAwU"]
[Wed Nov 26 00:08:57.779852 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:33112] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aSXUmRxGpKmlkG4FexTkSgAAAhQ"]
[Wed Nov 26 00:08:58.222937 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:32950] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aSXUmpwNRsoxcLQGkTcQjAAAAtI"]
[Wed Nov 26 00:08:58.885250 2025] [:error] [pid 43981:tid 43994] [client 20.249.10.99:32916] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/co.php"] [unique_id "aSXUmggZn97m_qh_RaGOagAAAws"]
[Wed Nov 26 00:08:59.277838 2025] [:error] [pid 28836:tid 29010] [client 20.249.10.99:32928] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUm5wNRsoxcLQGkTcQjwAAAtQ"]
[Wed Nov 26 00:08:59.764170 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:33108] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUmxG9n7UHEkwDTyj3AAAAAEM"]
[Wed Nov 26 00:09:00.261172 2025] [:error] [pid 43981:tid 43983] [client 20.249.10.99:32911] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUnAgZn97m_qh_RaGObAAAAwA"]
[Wed Nov 26 00:09:00.590984 2025] [:error] [pid 43981:tid 43984] [client 20.249.10.99:33188] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cong.php"] [unique_id "aSXUnAgZn97m_qh_RaGObQAAAwE"]
[Wed Nov 26 00:09:01.043208 2025] [:error] [pid 43981:tid 44006] [client 20.249.10.99:33163] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSXUnQgZn97m_qh_RaGObwAAAxc"]
[Wed Nov 26 00:09:01.485049 2025] [:error] [pid 14078:tid 14154] [client 20.249.10.99:32898] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSXUndVXYbb0ii_rVoLD8AAAAJE"]
[Wed Nov 26 00:09:02.136668 2025] [:error] [pid 28739:tid 28784] [client 20.249.10.99:32929] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSXUnhxGpKmlkG4FexTkUAAAAhY"]
[Wed Nov 26 00:09:02.546496 2025] [:error] [pid 14077:tid 14131] [client 20.249.10.99:33144] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aSXUnhG9n7UHEkwDTyj3BgAAAFU"]
[Wed Nov 26 00:09:02.890220 2025] [:error] [pid 14168:tid 14192] [client 20.249.10.99:32927] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aSXUnvR-ZDU0QEgAIIuySgAAANU"]
[Wed Nov 26 00:09:03.255305 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:32909] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aSXUnyGGdT-nZJVs3x0a9wAAAYA"]
[Wed Nov 26 00:09:03.633828 2025] [:error] [pid 28836:tid 28965] [client 20.249.10.99:32959] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aSXUn5wNRsoxcLQGkTcQlAAAAso"]
[Wed Nov 26 00:09:04.181225 2025] [:error] [pid 28739:tid 28776] [client 20.249.10.99:32917] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aSXUoBxGpKmlkG4FexTkWAAAAg4"]
[Wed Nov 26 00:09:04.728263 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:33202] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSXUoNVXYbb0ii_rVoLD9QAAAIQ"]
[Wed Nov 26 00:09:05.130781 2025] [:error] [pid 28609:tid 28624] [client 20.249.10.99:33177] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSXUoSGGdT-nZJVs3x0a-wAAAYY"]
[Wed Nov 26 00:09:05.651288 2025] [:error] [pid 14078:tid 14152] [client 20.249.10.99:33153] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSXUodVXYbb0ii_rVoLD-QAAAI8"]
[Wed Nov 26 00:09:06.081247 2025] [:error] [pid 14078:tid 14139] [client 20.249.10.99:33157] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "aSXUotVXYbb0ii_rVoLD-wAAAII"]
[Wed Nov 26 00:09:06.530676 2025] [:error] [pid 28739:tid 28783] [client 20.249.10.99:33136] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aSXUohxGpKmlkG4FexTkYAAAAhU"]
[Wed Nov 26 00:09:06.888042 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:33159] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aSXUotVXYbb0ii_rVoLD_wAAAIs"]
[Wed Nov 26 00:09:07.227450 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:33111] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aSXUoxxGpKmlkG4FexTkYQAAAgM"]
[Wed Nov 26 00:09:07.908986 2025] [:error] [pid 43981:tid 43988] [client 20.249.10.99:32940] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aSXUowgZn97m_qh_RaGOcwAAAwU"]
[Wed Nov 26 00:09:08.306321 2025] [:error] [pid 43981:tid 44005] [client 20.249.10.99:32847] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/product.php"] [unique_id "aSXUpAgZn97m_qh_RaGOdQAAAxY"]
[Wed Nov 26 00:09:08.732000 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:32956] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/product.php"] [unique_id "aSXUpHsB4Gz6Qw-pvBtxhQAAABQ"]
[Wed Nov 26 00:09:09.143743 2025] [:error] [pid 43981:tid 44004] [client 20.249.10.99:32903] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/product.php"] [unique_id "aSXUpQgZn97m_qh_RaGOdwAAAxU"]
[Wed Nov 26 00:09:09.472566 2025] [:error] [pid 28739:tid 28784] [client 20.249.10.99:33114] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/product.php"] [unique_id "aSXUpRxGpKmlkG4FexTkagAAAhY"]
[Wed Nov 26 00:09:09.889270 2025] [:error] [pid 28739:tid 28785] [client 20.249.10.99:33088] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/function.php"] [unique_id "aSXUpRxGpKmlkG4FexTkbAAAAhc"]
[Wed Nov 26 00:09:10.262142 2025] [:error] [pid 14076:tid 14093] [client 20.249.10.99:32855] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/function.php"] [unique_id "aSXUpnsB4Gz6Qw-pvBtxigAAAAw"]
[Wed Nov 26 00:09:10.827339 2025] [:error] [pid 28836:tid 28967] [client 20.249.10.99:32946] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/function.php"] [unique_id "aSXUppwNRsoxcLQGkTcQpAAAAsw"]
[Wed Nov 26 00:09:11.239393 2025] [:error] [pid 2987:tid 3010] [client 20.249.10.99:32907] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/function.php"] [unique_id "aSXUp8-djEt-pTzPxnzzfwAAAVU"]
[Wed Nov 26 00:09:11.564082 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:32937] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUpxxGpKmlkG4FexTkcQAAAgE"]
[Wed Nov 26 00:09:11.953925 2025] [:error] [pid 14076:tid 14098] [client 20.249.10.99:32856] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUp3sB4Gz6Qw-pvBtxjQAAABE"]
[Wed Nov 26 00:09:12.329944 2025] [:error] [pid 43981:tid 43995] [client 20.249.10.99:32930] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUqAgZn97m_qh_RaGOegAAAww"]
[Wed Nov 26 00:09:12.822965 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:32949] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUqCGGdT-nZJVs3x0bCAAAAZE"]
[Wed Nov 26 00:09:13.325054 2025] [:error] [pid 28609:tid 28639] [client 20.249.10.99:33209] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSXUqSGGdT-nZJVs3x0bCgAAAZU"]
[Wed Nov 26 00:09:13.682986 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:32902] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSXUqXsB4Gz6Qw-pvBtxkgAAAAQ"]
[Wed Nov 26 00:09:14.044781 2025] [:error] [pid 2987:tid 3013] [client 20.249.10.99:33140] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSXUqs-djEt-pTzPxnzziwAAAVg"]
[Wed Nov 26 00:09:14.532071 2025] [:error] [pid 14077:tid 14131] [client 20.249.10.99:32942] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "aSXUqhG9n7UHEkwDTyj3KwAAAFU"]
[Wed Nov 26 00:09:14.902258 2025] [:error] [pid 14077:tid 14129] [client 20.249.10.99:32945] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aSXUqhG9n7UHEkwDTyj3LwAAAFM"]
[Wed Nov 26 00:09:15.346326 2025] [:error] [pid 14077:tid 14115] [client 20.249.10.99:33178] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aSXUqxG9n7UHEkwDTyj3MwAAAEU"]
[Wed Nov 26 00:09:15.692860 2025] [:error] [pid 14168:tid 14191] [client 20.249.10.99:33192] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aSXUq_R-ZDU0QEgAIIuyUQAAANQ"]
[Wed Nov 26 00:09:16.024278 2025] [:error] [pid 14078:tid 14160] [client 20.249.10.99:33122] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aSXUrNVXYbb0ii_rVoLEFQAAAJc"]
[Wed Nov 26 00:09:16.485848 2025] [:error] [pid 14168:tid 14180] [client 20.249.10.99:32896] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "aSXUrPR-ZDU0QEgAIIuyVAAAAMk"]
[Wed Nov 26 00:09:16.808256 2025] [:error] [pid 14168:tid 14172] [client 20.249.10.99:33197] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "aSXUrPR-ZDU0QEgAIIuyVgAAAME"]
[Wed Nov 26 00:09:17.170239 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:33173] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "aSXUrfR-ZDU0QEgAIIuyWQAAAMw"]
[Wed Nov 26 00:09:17.498191 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:33165] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "aSXUrRxGpKmlkG4FexTkdwAAAgE"]
[Wed Nov 26 00:09:17.923325 2025] [:error] [pid 14076:tid 14088] [client 20.249.10.99:33291] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXUrXsB4Gz6Qw-pvBtxmwAAAAc"]
[Wed Nov 26 00:09:18.423183 2025] [:error] [pid 43843:tid 43863] [client 20.249.10.99:32955] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXUrhhx4v3NUNdMKDMYtwAAAdI"]
[Wed Nov 26 00:09:18.883589 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:33179] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXUriGGdT-nZJVs3x0bEAAAAYw"]
[Wed Nov 26 00:09:19.308946 2025] [:error] [pid 14076:tid 14097] [client 20.249.10.99:33308] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXUr3sB4Gz6Qw-pvBtxogAAABA"]
[Wed Nov 26 00:09:19.618421 2025] [:error] [pid 14168:tid 14177] [client 20.249.10.99:32924] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSXUr_R-ZDU0QEgAIIuyXAAAAMY"]
[Wed Nov 26 00:09:19.945122 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:33210] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSXUrxxGpKmlkG4FexTkfQAAAhQ"]
[Wed Nov 26 00:09:20.333565 2025] [:error] [pid 2987:tid 3010] [client 20.249.10.99:32932] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSXUsM-djEt-pTzPxnzzjgAAAVU"]
[Wed Nov 26 00:09:20.785886 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:32913] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "aSXUsNVXYbb0ii_rVoLEGgAAAIQ"]
[Wed Nov 26 00:09:21.092480 2025] [:error] [pid 43843:tid 43865] [client 20.249.10.99:32931] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSXUsRhx4v3NUNdMKDMYuQAAAdQ"]
[Wed Nov 26 00:09:21.415306 2025] [:error] [pid 2987:tid 2996] [client 20.249.10.99:33175] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSXUsc-djEt-pTzPxnzzkAAAAUc"]
[Wed Nov 26 00:09:21.755890 2025] [:error] [pid 14078:tid 14150] [client 20.249.10.99:33126] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSXUsdVXYbb0ii_rVoLEHQAAAI0"]
[Wed Nov 26 00:09:22.061763 2025] [:error] [pid 14077:tid 14134] [client 20.249.10.99:33303] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSXUshG9n7UHEkwDTyj3PgAAAFg"]
[Wed Nov 26 00:09:22.363745 2025] [:error] [pid 43843:tid 43846] [client 20.249.10.99:33290] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSXUshhx4v3NUNdMKDMYvgAAAcE"]
[Wed Nov 26 00:09:22.707859 2025] [:error] [pid 43843:tid 43852] [client 20.249.10.99:33311] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSXUshhx4v3NUNdMKDMYwAAAAcc"]
[Wed Nov 26 00:09:23.662740 2025] [:error] [pid 43843:tid 43859] [client 20.249.10.99:33156] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSXUsxhx4v3NUNdMKDMYzAAAAc4"]
[Wed Nov 26 00:09:24.349193 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:33182] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aSXUtNVXYbb0ii_rVoLEHwAAAJg"]
[Wed Nov 26 00:09:24.788666 2025] [:error] [pid 28609:tid 28639] [client 20.249.10.99:33186] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSXUtCGGdT-nZJVs3x0bFgAAAZU"]
[Wed Nov 26 00:09:25.186005 2025] [:error] [pid 14078:tid 14160] [client 20.249.10.99:32934] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSXUtdVXYbb0ii_rVoLEIwAAAJc"]
[Wed Nov 26 00:09:25.516243 2025] [:error] [pid 43981:tid 44001] [client 20.249.10.99:33284] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSXUtQgZn97m_qh_RaGOgAAAAxI"]
[Wed Nov 26 00:09:26.107198 2025] [:error] [pid 14077:tid 14119] [client 20.249.10.99:33190] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aSXUthG9n7UHEkwDTyj3RAAAAEk"]
[Wed Nov 26 00:09:26.731869 2025] [:error] [pid 14077:tid 14111] [client 20.249.10.99:33479] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "aSXUthG9n7UHEkwDTyj3RQAAAEE"]
[Wed Nov 26 00:09:27.057509 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:32912] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "aSXUtxxGpKmlkG4FexTkgAAAAgQ"]
[Wed Nov 26 00:09:27.755248 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:33193] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "aSXUt9VXYbb0ii_rVoLEKgAAAIo"]
[Wed Nov 26 00:09:28.334708 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:33150] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "aSXUuNVXYbb0ii_rVoLELAAAAJY"]
[Wed Nov 26 00:09:28.675631 2025] [:error] [pid 28609:tid 28626] [client 20.249.10.99:33204] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUuCGGdT-nZJVs3x0bGQAAAYg"]
[Wed Nov 26 00:09:29.310614 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:33158] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUudVXYbb0ii_rVoLEMAAAAIE"]
[Wed Nov 26 00:09:30.028992 2025] [:error] [pid 14077:tid 14120] [client 20.249.10.99:33164] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUuhG9n7UHEkwDTyj3SwAAAEo"]
[Wed Nov 26 00:09:30.375284 2025] [:error] [pid 43843:tid 43869] [client 20.249.10.99:33184] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUuhhx4v3NUNdMKDMY3wAAAdg"]
[Wed Nov 26 00:09:30.700299 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:33174] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUutVXYbb0ii_rVoLEMwAAAIY"]
[Wed Nov 26 00:09:31.033107 2025] [:error] [pid 2987:tid 3008] [client 20.249.10.99:33180] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUu8-djEt-pTzPxnzzlAAAAVM"]
[Wed Nov 26 00:09:31.377926 2025] [:error] [pid 43843:tid 43854] [client 20.249.10.99:32943] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUuxhx4v3NUNdMKDMY4AAAAck"]
[Wed Nov 26 00:09:31.690663 2025] [:error] [pid 14168:tid 14193] [client 20.249.10.99:33137] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aSXUu_R-ZDU0QEgAIIuyYQAAANY"]
[Wed Nov 26 00:09:32.091687 2025] [:error] [pid 14168:tid 14178] [client 20.249.10.99:32878] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUvPR-ZDU0QEgAIIuyYgAAAMc"]
[Wed Nov 26 00:09:32.409230 2025] [:error] [pid 28609:tid 28638] [client 20.249.10.99:33495] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUvCGGdT-nZJVs3x0bHQAAAZQ"]
[Wed Nov 26 00:09:32.744739 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:33199] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUvNVXYbb0ii_rVoLENQAAAIQ"]
[Wed Nov 26 00:09:33.140461 2025] [:error] [pid 2987:tid 2997] [client 20.249.10.99:33207] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "aSXUvc-djEt-pTzPxnzzmwAAAUg"]
[Wed Nov 26 00:09:33.465194 2025] [:error] [pid 14168:tid 14190] [client 20.249.10.99:33145] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aSXUvfR-ZDU0QEgAIIuyZgAAANM"]
[Wed Nov 26 00:09:34.139339 2025] [:error] [pid 2987:tid 3001] [client 20.249.10.99:33171] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aSXUvs-djEt-pTzPxnzznwAAAUw"]
[Wed Nov 26 00:09:34.481833 2025] [:error] [pid 14168:tid 14173] [client 20.249.10.99:33301] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aSXUvvR-ZDU0QEgAIIuyaAAAAMI"]
[Wed Nov 26 00:09:34.871477 2025] [:error] [pid 2987:tid 3003] [client 20.249.10.99:33305] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "aSXUvs-djEt-pTzPxnzzoQAAAU4"]
[Wed Nov 26 00:09:35.360161 2025] [:error] [pid 14168:tid 14191] [client 20.249.10.99:33281] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aSXUv_R-ZDU0QEgAIIuyawAAANQ"]
[Wed Nov 26 00:09:35.699901 2025] [:error] [pid 28836:tid 29008] [client 20.249.10.99:33214] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aSXUv5wNRsoxcLQGkTcQuAAAAtI"]
[Wed Nov 26 00:09:36.003657 2025] [:error] [pid 14077:tid 14118] [client 20.249.10.99:33161] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aSXUwBG9n7UHEkwDTyj3WAAAAEg"]
[Wed Nov 26 00:09:36.311965 2025] [:error] [pid 14077:tid 14112] [client 20.249.10.99:33317] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aSXUwBG9n7UHEkwDTyj3WgAAAEI"]
[Wed Nov 26 00:09:36.649914 2025] [:error] [pid 43981:tid 44004] [client 20.249.10.99:33183] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSXUwAgZn97m_qh_RaGOlwAAAxU"]
[Wed Nov 26 00:09:37.039400 2025] [:error] [pid 43981:tid 44006] [client 20.249.10.99:33505] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSXUwQgZn97m_qh_RaGOmAAAAxc"]
[Wed Nov 26 00:09:37.408630 2025] [:error] [pid 43981:tid 43992] [client 20.249.10.99:32858] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSXUwQgZn97m_qh_RaGOmgAAAwk"]
[Wed Nov 26 00:09:37.940778 2025] [:error] [pid 43981:tid 43998] [client 20.249.10.99:33128] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "aSXUwQgZn97m_qh_RaGOnAAAAw8"]
[Wed Nov 26 00:09:38.303392 2025] [:error] [pid 14168:tid 14188] [client 20.249.10.99:32899] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSXUwvR-ZDU0QEgAIIuycgAAANE"]
[Wed Nov 26 00:09:38.691361 2025] [:error] [pid 28739:tid 28777] [client 20.249.10.99:33208] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSXUwhxGpKmlkG4FexTkiQAAAg8"]
[Wed Nov 26 00:09:39.026689 2025] [:error] [pid 43981:tid 44000] [client 20.249.10.99:33283] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSXUwwgZn97m_qh_RaGOoAAAAxE"]
[Wed Nov 26 00:09:39.396149 2025] [:error] [pid 2987:tid 2991] [client 20.249.10.99:32958] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aSXUw8-djEt-pTzPxnzzpgAAAUI"]
[Wed Nov 26 00:09:39.751902 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:33152] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSXUw5wNRsoxcLQGkTcQvAAAAtU"]
[Wed Nov 26 00:09:40.149492 2025] [:error] [pid 14168:tid 14175] [client 20.249.10.99:32889] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSXUxPR-ZDU0QEgAIIuydAAAAMQ"]
[Wed Nov 26 00:09:40.499929 2025] [:error] [pid 43981:tid 43988] [client 20.249.10.99:32957] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSXUxAgZn97m_qh_RaGOpAAAAwU"]
[Wed Nov 26 00:09:40.847375 2025] [:error] [pid 14077:tid 14125] [client 20.249.10.99:33189] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aSXUxBG9n7UHEkwDTyj3YAAAAE8"]
[Wed Nov 26 00:09:41.144609 2025] [:error] [pid 28836:tid 28956] [client 20.249.10.99:33332] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUxZwNRsoxcLQGkTcQvgAAAsE"]
[Wed Nov 26 00:09:41.449850 2025] [:error] [pid 28836:tid 28957] [client 20.249.10.99:32954] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUxZwNRsoxcLQGkTcQvwAAAsI"]
[Wed Nov 26 00:09:41.761056 2025] [:error] [pid 14076:tid 14081] [client 20.249.10.99:33169] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUxXsB4Gz6Qw-pvBtxuwAAAAA"]
[Wed Nov 26 00:09:42.129299 2025] [:error] [pid 2987:tid 2999] [client 20.249.10.99:33206] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUxs-djEt-pTzPxnzzpwAAAUo"]
[Wed Nov 26 00:09:42.543125 2025] [:error] [pid 43981:tid 44006] [client 20.249.10.99:33320] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "aSXUxggZn97m_qh_RaGOqAAAAxc"]
[Wed Nov 26 00:09:42.887046 2025] [:error] [pid 14077:tid 14113] [client 20.249.10.99:33285] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "aSXUxhG9n7UHEkwDTyj3ZQAAAEM"]
[Wed Nov 26 00:09:43.201171 2025] [:error] [pid 14077:tid 14111] [client 20.249.10.99:33473] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "aSXUxxG9n7UHEkwDTyj3ZwAAAEE"]
[Wed Nov 26 00:09:43.635964 2025] [:error] [pid 14078:tid 14139] [client 20.249.10.99:33167] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "aSXUx9VXYbb0ii_rVoLEOQAAAII"]
[Wed Nov 26 00:09:43.997136 2025] [:error] [pid 14078:tid 14154] [client 20.249.10.99:32952] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSXUx9VXYbb0ii_rVoLEOwAAAJE"]
[Wed Nov 26 00:09:44.356771 2025] [:error] [pid 43843:tid 43864] [client 20.249.10.99:33476] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSXUyBhx4v3NUNdMKDMY6QAAAdM"]
[Wed Nov 26 00:09:44.734099 2025] [:error] [pid 28836:tid 28967] [client 20.249.10.99:33294] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSXUyJwNRsoxcLQGkTcQyAAAAsw"]
[Wed Nov 26 00:09:45.125317 2025] [:error] [pid 14077:tid 14132] [client 20.249.10.99:32941] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSXUyRG9n7UHEkwDTyj3bwAAAFY"]
[Wed Nov 26 00:09:45.466287 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:33195] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSXUyRhx4v3NUNdMKDMY7AAAAcQ"]
[Wed Nov 26 00:09:45.792126 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:33198] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSXUydVXYbb0ii_rVoLERgAAAJM"]
[Wed Nov 26 00:09:46.581302 2025] [proxy_fcgi:error] [pid 14078:tid 14155] [client 20.249.10.99:33131] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:09:46.885916 2025] [proxy_fcgi:error] [pid 14078:tid 14149] [client 20.249.10.99:33131] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:09:47.203316 2025] [proxy_fcgi:error] [pid 14078:tid 14160] [client 20.249.10.99:33131] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:09:47.364356 2025] [proxy_fcgi:error] [pid 14078:tid 14144] [client 20.249.10.99:33131] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:09:47.670174 2025] [proxy_fcgi:error] [pid 14078:tid 14138] [client 20.249.10.99:33131] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:09:47.818871 2025] [:error] [pid 14078:tid 14137] [client 20.249.10.99:33131] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSXUy9VXYbb0ii_rVoLEVgAAAIA"]
[Wed Nov 26 00:09:48.173920 2025] [:error] [pid 14077:tid 14110] [client 20.249.10.99:33327] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSXUzBG9n7UHEkwDTyj3egAAAEA"]
[Wed Nov 26 00:09:48.585784 2025] [:error] [pid 28739:tid 28780] [client 20.249.10.99:33288] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSXUzBxGpKmlkG4FexTklgAAAhI"]
[Wed Nov 26 00:09:48.920897 2025] [:error] [pid 28609:tid 28636] [client 20.249.10.99:33215] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSXUzCGGdT-nZJVs3x0bLwAAAZI"]
[Wed Nov 26 00:09:49.465834 2025] [:error] [pid 14168:tid 14172] [client 20.249.10.99:33212] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/article.php"] [unique_id "aSXUzfR-ZDU0QEgAIIuyegAAAME"]
[Wed Nov 26 00:09:50.109624 2025] [:error] [pid 14168:tid 14195] [client 20.249.10.99:33286] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/article.php"] [unique_id "aSXUzvR-ZDU0QEgAIIuyewAAANg"]
[Wed Nov 26 00:09:50.499648 2025] [:error] [pid 14168:tid 14183] [client 20.249.10.99:33316] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/article.php"] [unique_id "aSXUzvR-ZDU0QEgAIIuyfwAAAMw"]
[Wed Nov 26 00:09:50.888522 2025] [:error] [pid 28739:tid 28767] [client 20.249.10.99:33299] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/article.php"] [unique_id "aSXUzhxGpKmlkG4FexTkmQAAAgU"]
[Wed Nov 26 00:09:51.325141 2025] [:error] [pid 28836:tid 28960] [client 20.249.10.99:33162] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUz5wNRsoxcLQGkTcQzwAAAsU"]
[Wed Nov 26 00:09:51.686070 2025] [:error] [pid 43981:tid 43999] [client 20.249.10.99:33300] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXUzwgZn97m_qh_RaGOrAAAAxA"]
[Wed Nov 26 00:09:52.071327 2025] [:error] [pid 28609:tid 28630] [client 20.249.10.99:33472] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXU0CGGdT-nZJVs3x0bNQAAAYw"]
[Wed Nov 26 00:09:52.542073 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:33187] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "aSXU0JwNRsoxcLQGkTcQ0wAAAsY"]
[Wed Nov 26 00:09:53.130848 2025] [:error] [pid 2987:tid 2989] [client 20.249.10.99:32866] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXU0c-djEt-pTzPxnzzswAAAUA"]
[Wed Nov 26 00:09:53.557292 2025] [:error] [pid 28739:tid 28765] [client 20.249.10.99:33504] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXU0RxGpKmlkG4FexTkmgAAAgM"]
[Wed Nov 26 00:09:53.933756 2025] [:error] [pid 14077:tid 14120] [client 20.249.10.99:32901] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXU0RG9n7UHEkwDTyj3hQAAAEo"]
[Wed Nov 26 00:09:54.526677 2025] [:error] [pid 43981:tid 44004] [client 20.249.10.99:33312] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aSXU0ggZn97m_qh_RaGOrgAAAxU"]
[Wed Nov 26 00:09:55.131996 2025] [:error] [pid 28739:tid 28769] [client 20.249.10.99:33181] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXU0xxGpKmlkG4FexTkmwAAAgc"]
[Wed Nov 26 00:09:55.449042 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:32837] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXU09VXYbb0ii_rVoLEZQAAAIQ"]
[Wed Nov 26 00:09:55.803421 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:33194] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXU0yGGdT-nZJVs3x0bPgAAAYM"]
[Wed Nov 26 00:09:56.223954 2025] [:error] [pid 28609:tid 28633] [client 20.249.10.99:32937] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "aSXU1CGGdT-nZJVs3x0bPwAAAY8"]
[Wed Nov 26 00:09:56.576506 2025] [:error] [pid 14077:tid 14114] [client 20.249.10.99:33321] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSXU1BG9n7UHEkwDTyj3iAAAAEQ"]
[Wed Nov 26 00:09:57.187494 2025] [:error] [pid 43843:tid 43847] [client 20.249.10.99:33322] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSXU1Rhx4v3NUNdMKDMY9AAAAcI"]
[Wed Nov 26 00:09:57.555972 2025] [:error] [pid 28836:tid 29013] [client 20.249.10.99:33120] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSXU1ZwNRsoxcLQGkTcQ2AAAAtc"]
[Wed Nov 26 00:09:58.029505 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:33309] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aSXU1tVXYbb0ii_rVoLEcAAAAIY"]
[Wed Nov 26 00:09:58.354824 2025] [:error] [pid 2987:tid 3000] [client 20.249.10.99:33341] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSXU1s-djEt-pTzPxnzztAAAAUs"]
[Wed Nov 26 00:09:58.671700 2025] [:error] [pid 28836:tid 28966] [client 20.249.10.99:33205] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSXU1pwNRsoxcLQGkTcQ3gAAAss"]
[Wed Nov 26 00:09:59.424353 2025] [:error] [pid 28609:tid 28627] [client 20.249.10.99:33200] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSXU1yGGdT-nZJVs3x0bQgAAAYk"]
[Wed Nov 26 00:09:59.859821 2025] [:error] [pid 14168:tid 14191] [client 20.249.10.99:33313] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "aSXU1_R-ZDU0QEgAIIuyhAAAANQ"]
[Wed Nov 26 00:10:00.155676 2025] [:error] [pid 28836:tid 28961] [client 20.249.10.99:33488] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "aSXU2JwNRsoxcLQGkTcQ4AAAAsY"]
[Wed Nov 26 00:10:00.526077 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:33323] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "aSXU2JwNRsoxcLQGkTcQ4gAAAtY"]
[Wed Nov 26 00:10:00.954886 2025] [:error] [pid 14078:tid 14159] [client 20.249.10.99:33339] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "aSXU2NVXYbb0ii_rVoLEgwAAAJY"]
[Wed Nov 26 00:10:01.316739 2025] [:error] [pid 14077:tid 14123] [client 20.249.10.99:33478] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "aSXU2RG9n7UHEkwDTyj3jgAAAE0"]
[Wed Nov 26 00:10:01.735482 2025] [:error] [pid 14078:tid 14161] [client 20.249.10.99:33292] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "aSXU2dVXYbb0ii_rVoLEhgAAAJg"]
[Wed Nov 26 00:10:02.080214 2025] [:error] [pid 14078:tid 14153] [client 20.249.10.99:33191] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "aSXU2tVXYbb0ii_rVoLEiAAAAJA"]
[Wed Nov 26 00:10:02.483997 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:33095] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "aSXU2tVXYbb0ii_rVoLEjAAAAIE"]
[Wed Nov 26 00:10:02.898620 2025] [:error] [pid 43981:tid 43991] [client 20.249.10.99:33502] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "aSXU2ggZn97m_qh_RaGOuQAAAwg"]
[Wed Nov 26 00:10:03.332055 2025] [:error] [pid 14077:tid 14127] [client 20.249.10.99:33296] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/index.php"] [unique_id "aSXU2xG9n7UHEkwDTyj3lQAAAFE"]
[Wed Nov 26 00:10:03.742308 2025] [:error] [pid 28609:tid 28628] [client 20.249.10.99:33340] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/index.php"] [unique_id "aSXU2yGGdT-nZJVs3x0bSwAAAYo"]
[Wed Nov 26 00:10:04.081524 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:33324] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/index.php"] [unique_id "aSXU3CGGdT-nZJVs3x0bTAAAAZc"]
[Wed Nov 26 00:10:04.506149 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:33494] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/index.php"] [unique_id "aSXU3PR-ZDU0QEgAIIuyigAAAMU"]
[Wed Nov 26 00:10:04.853690 2025] [:error] [pid 43981:tid 44004] [client 20.249.10.99:32925] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSXU3AgZn97m_qh_RaGOuwAAAxU"]
[Wed Nov 26 00:10:05.178438 2025] [:error] [pid 2987:tid 2996] [client 20.249.10.99:33358] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSXU3c-djEt-pTzPxnzzuwAAAUc"]
[Wed Nov 26 00:10:05.498893 2025] [:error] [pid 14077:tid 14121] [client 20.249.10.99:33196] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSXU3RG9n7UHEkwDTyj3nAAAAEs"]
[Wed Nov 26 00:10:05.838464 2025] [:error] [pid 43981:tid 44003] [client 20.249.10.99:33172] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSXU3QgZn97m_qh_RaGOvQAAAxQ"]
[Wed Nov 26 00:10:06.195241 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:33334] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSXU3vR-ZDU0QEgAIIuyjQAAAMg"]
[Wed Nov 26 00:10:06.511818 2025] [:error] [pid 43981:tid 43987] [client 20.249.10.99:33514] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSXU3ggZn97m_qh_RaGOwAAAAwQ"]
[Wed Nov 26 00:10:06.886357 2025] [:error] [pid 28609:tid 28639] [client 20.249.10.99:33342] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSXU3iGGdT-nZJVs3x0bVQAAAZU"]
[Wed Nov 26 00:10:07.266159 2025] [:error] [pid 14077:tid 14126] [client 20.249.10.99:33176] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "aSXU3xG9n7UHEkwDTyj3oAAAAFA"]
[Wed Nov 26 00:10:07.672416 2025] [:error] [pid 28836:tid 29011] [client 20.249.10.99:33325] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "aSXU35wNRsoxcLQGkTcQ5gAAAtU"]
[Wed Nov 26 00:10:08.100401 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:33201] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "aSXU4CGGdT-nZJVs3x0bWAAAAYM"]
[Wed Nov 26 00:10:08.403856 2025] [:error] [pid 14168:tid 14182] [client 20.249.10.99:33349] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "aSXU4PR-ZDU0QEgAIIuykwAAAMs"]
[Wed Nov 26 00:10:08.817484 2025] [:error] [pid 2987:tid 2998] [client 20.249.10.99:33302] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "aSXU4M-djEt-pTzPxnzzwQAAAUk"]
[Wed Nov 26 00:10:09.144706 2025] [:error] [pid 28739:tid 28782] [client 20.249.10.99:33293] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSXU4RxGpKmlkG4FexTkpgAAAhQ"]
[Wed Nov 26 00:10:09.582772 2025] [:error] [pid 28836:tid 29014] [client 20.249.10.99:33345] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSXU4ZwNRsoxcLQGkTcQ6AAAAtg"]
[Wed Nov 26 00:10:10.053365 2025] [:error] [pid 14168:tid 14191] [client 20.249.10.99:33503] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSXU4vR-ZDU0QEgAIIuymAAAANQ"]
[Wed Nov 26 00:10:10.425209 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:32925] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "aSXU4iGGdT-nZJVs3x0bXQAAAZM"]
[Wed Nov 26 00:10:10.808891 2025] [:error] [pid 43843:tid 43868] [client 20.249.10.99:33297] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSXU4hhx4v3NUNdMKDMZCAAAAdc"]
[Wed Nov 26 00:10:11.256441 2025] [:error] [pid 28836:tid 29009] [client 20.249.10.99:33489] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "aSXU45wNRsoxcLQGkTcQ7QAAAtM"]
[Wed Nov 26 00:10:11.688912 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:33298] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "aSXU4_R-ZDU0QEgAIIuymwAAAMU"]
[Wed Nov 26 00:10:12.181799 2025] [:error] [pid 43843:tid 43845] [client 20.249.10.99:33185] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "aSXU5Bhx4v3NUNdMKDMZCgAAAcA"]
[Wed Nov 26 00:10:12.660394 2025] [:error] [pid 14078:tid 14141] [client 20.249.10.99:33330] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSXU5NVXYbb0ii_rVoLElwAAAIQ"]
[Wed Nov 26 00:10:13.118685 2025] [:error] [pid 2987:tid 3000] [client 20.249.10.99:33315] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSXU5c-djEt-pTzPxnzzxwAAAUs"]
[Wed Nov 26 00:10:13.414876 2025] [:error] [pid 2987:tid 3001] [client 20.249.10.99:33485] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSXU5c-djEt-pTzPxnzzyAAAAUw"]
[Wed Nov 26 00:10:13.715953 2025] [:error] [pid 28739:tid 28785] [client 20.249.10.99:33160] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aSXU5RxGpKmlkG4FexTkqAAAAhc"]
[Wed Nov 26 00:10:14.051929 2025] [:error] [pid 14076:tid 14105] [client 20.249.10.99:33295] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSXU5nsB4Gz6Qw-pvBtx7gAAABg"]
[Wed Nov 26 00:10:14.385218 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:33499] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/about.php"] [unique_id "aSXU5hxGpKmlkG4FexTkqQAAAgQ"]
[Wed Nov 26 00:10:14.740121 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:33374] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/about.php"] [unique_id "aSXU5iGGdT-nZJVs3x0bZAAAAYA"]
[Wed Nov 26 00:10:15.245948 2025] [:error] [pid 28739:tid 28763] [client 20.249.10.99:33372] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/about.php"] [unique_id "aSXU5xxGpKmlkG4FexTkqgAAAgE"]
[Wed Nov 26 00:10:15.583352 2025] [:error] [pid 14076:tid 14095] [client 20.249.10.99:33203] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/about.php"] [unique_id "aSXU53sB4Gz6Qw-pvBtx7wAAAA4"]
[Wed Nov 26 00:10:16.226892 2025] [:error] [pid 28836:tid 29013] [client 20.249.10.99:33531] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filemanager/dialog.php"] [unique_id "aSXU6JwNRsoxcLQGkTcQ8wAAAtc"]
[Wed Nov 26 00:10:16.575272 2025] [:error] [pid 14078:tid 14157] [client 20.249.10.99:32953] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filemanager/dialog.php"] [unique_id "aSXU6NVXYbb0ii_rVoLEoAAAAJQ"]
[Wed Nov 26 00:10:17.193352 2025] [:error] [pid 14077:tid 14126] [client 20.249.10.99:33498] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filemanager/dialog.php"] [unique_id "aSXU6RG9n7UHEkwDTyj3rgAAAFA"]
[Wed Nov 26 00:10:17.537617 2025] [:error] [pid 28739:tid 28781] [client 20.249.10.99:33347] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filemanager/dialog.php"] [unique_id "aSXU6RxGpKmlkG4FexTkrQAAAhM"]
[Wed Nov 26 00:10:17.922896 2025] [:error] [pid 14076:tid 14100] [client 20.249.10.99:33480] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "aSXU6XsB4Gz6Qw-pvBtx9AAAABM"]
[Wed Nov 26 00:10:18.239439 2025] [:error] [pid 14076:tid 14101] [client 20.249.10.99:33333] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "aSXU6nsB4Gz6Qw-pvBtx9QAAABQ"]
[Wed Nov 26 00:10:18.872544 2025] [:error] [pid 14076:tid 14094] [client 20.249.10.99:33506] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "aSXU6nsB4Gz6Qw-pvBtx9gAAAA0"]
[Wed Nov 26 00:10:19.335176 2025] [:error] [pid 43981:tid 43989] [client 20.249.10.99:33366] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "aSXU6wgZn97m_qh_RaGOyQAAAwY"]
[Wed Nov 26 00:10:19.745042 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:33211] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aSXU65wNRsoxcLQGkTcQ9gAAAtY"]
[Wed Nov 26 00:10:20.222506 2025] [:error] [pid 28739:tid 28764] [client 20.249.10.99:33306] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/about.php"] [unique_id "aSXU7BxGpKmlkG4FexTkrwAAAgI"]
[Wed Nov 26 00:10:20.589636 2025] [:error] [pid 28836:tid 28960] [client 20.249.10.99:33130] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "aSXU7JwNRsoxcLQGkTcQ-AAAAsU"]
[Wed Nov 26 00:10:20.925836 2025] [:error] [pid 28609:tid 28642] [client 20.249.10.99:33534] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "aSXU7CGGdT-nZJVs3x0bbAAAAZg"]
[Wed Nov 26 00:10:21.409857 2025] [:error] [pid 14078:tid 14146] [client 20.249.10.99:33282] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "aSXU7dVXYbb0ii_rVoLEpAAAAIk"]
[Wed Nov 26 00:10:21.727268 2025] [:error] [pid 14168:tid 14179] [client 20.249.10.99:33522] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "aSXU7fR-ZDU0QEgAIIuyqAAAAMg"]
[Wed Nov 26 00:10:22.074656 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:33287] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSXU7iGGdT-nZJVs3x0bbwAAAYI"]
[Wed Nov 26 00:10:22.374252 2025] [:error] [pid 14168:tid 14178] [client 20.249.10.99:33318] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSXU7vR-ZDU0QEgAIIuyqwAAAMc"]
[Wed Nov 26 00:10:22.799368 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:33348] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSXU7tVXYbb0ii_rVoLEqAAAAIw"]
[Wed Nov 26 00:10:23.113944 2025] [:error] [pid 14168:tid 14193] [client 20.249.10.99:33168] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSXU7_R-ZDU0QEgAIIuyrgAAANY"]
[Wed Nov 26 00:10:23.432588 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:33483] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aSXU7yGGdT-nZJVs3x0bcwAAAZE"]
[Wed Nov 26 00:10:23.851785 2025] [:error] [pid 28836:tid 29014] [client 20.249.10.99:33744] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSXU75wNRsoxcLQGkTcRAQAAAtg"]
[Wed Nov 26 00:10:24.221482 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:33289] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSXU8HsB4Gz6Qw-pvBtx_wAAABI"]
[Wed Nov 26 00:10:24.538239 2025] [:error] [pid 28836:tid 29012] [client 20.249.10.99:33326] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSXU8JwNRsoxcLQGkTcRBQAAAtY"]
[Wed Nov 26 00:10:24.850933 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:33154] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSXU8HsB4Gz6Qw-pvBtyAgAAAAI"]
[Wed Nov 26 00:10:25.251800 2025] [:error] [pid 43981:tid 43999] [client 20.249.10.99:33336] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww1.php"] [unique_id "aSXU8QgZn97m_qh_RaGOywAAAxA"]
[Wed Nov 26 00:10:25.570884 2025] [:error] [pid 43981:tid 44001] [client 20.249.10.99:33484] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqq.php"] [unique_id "aSXU8QgZn97m_qh_RaGOzAAAAxI"]
[Wed Nov 26 00:10:25.882388 2025] [:error] [pid 14076:tid 14084] [client 20.249.10.99:33508] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqq.php"] [unique_id "aSXU8XsB4Gz6Qw-pvBtyBwAAAAM"]
[Wed Nov 26 00:10:26.359873 2025] [:error] [pid 28609:tid 28620] [client 20.249.10.99:33477] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqq.php"] [unique_id "aSXU8iGGdT-nZJVs3x0bfAAAAYI"]
[Wed Nov 26 00:10:26.717607 2025] [:error] [pid 14076:tid 14086] [client 20.249.10.99:33375] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqq.php"] [unique_id "aSXU8nsB4Gz6Qw-pvBtyDgAAAAU"]
[Wed Nov 26 00:10:27.083105 2025] [:error] [pid 28609:tid 28618] [client 20.249.10.99:33490] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/function.php"] [unique_id "aSXU8yGGdT-nZJVs3x0bgAAAAYA"]
[Wed Nov 26 00:10:27.621453 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:33520] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/function.php"] [unique_id "aSXU8xxGpKmlkG4FexTkxQAAAgQ"]
[Wed Nov 26 00:10:28.192983 2025] [:error] [pid 14168:tid 14184] [client 20.249.10.99:33482] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/function.php"] [unique_id "aSXU9PR-ZDU0QEgAIIuytgAAAM0"]
[Wed Nov 26 00:10:28.675847 2025] [:error] [pid 14076:tid 14099] [client 20.249.10.99:33170] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/function.php"] [unique_id "aSXU9HsB4Gz6Qw-pvBtyEQAAABI"]
[Wed Nov 26 00:10:29.111928 2025] [:error] [pid 14168:tid 14189] [client 20.249.10.99:33487] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSXU9fR-ZDU0QEgAIIuytwAAANI"]
[Wed Nov 26 00:10:29.411781 2025] [:error] [pid 14168:tid 14171] [client 20.249.10.99:33512] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/function.php"] [unique_id "aSXU9fR-ZDU0QEgAIIuyuAAAAMA"]
[Wed Nov 26 00:10:29.788302 2025] [:error] [pid 28836:tid 28968] [client 20.249.10.99:33525] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/function.php"] [unique_id "aSXU9ZwNRsoxcLQGkTcRCAAAAs0"]
[Wed Nov 26 00:10:30.216831 2025] [:error] [pid 28836:tid 28964] [client 20.249.10.99:33399] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/function.php"] [unique_id "aSXU9pwNRsoxcLQGkTcRCQAAAsk"]
[Wed Nov 26 00:10:30.592369 2025] [:error] [pid 14078:tid 14148] [client 20.249.10.99:33329] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSXU9tVXYbb0ii_rVoLEsgAAAIs"]
[Wed Nov 26 00:10:30.961882 2025] [:error] [pid 14168:tid 14176] [client 20.249.10.99:33343] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSXU9vR-ZDU0QEgAIIuyugAAAMU"]
[Wed Nov 26 00:10:31.359079 2025] [:error] [pid 28609:tid 28625] [client 20.249.10.99:33368] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSXU9yGGdT-nZJVs3x0bhgAAAYc"]
[Wed Nov 26 00:10:31.816400 2025] [:error] [pid 14076:tid 14103] [client 20.249.10.99:33361] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSXU93sB4Gz6Qw-pvBtyHAAAABY"]
[Wed Nov 26 00:10:32.327404 2025] [:error] [pid 28739:tid 28784] [client 20.249.10.99:33314] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/colors/blue/index.php"] [unique_id "aSXU-BxGpKmlkG4FexTkzgAAAhY"]
[Wed Nov 26 00:10:32.942405 2025] [:error] [pid 14077:tid 14131] [client 20.249.10.99:33509] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/colors/blue/index.php"] [unique_id "aSXU-BG9n7UHEkwDTyj3zQAAAFU"]
[Wed Nov 26 00:10:33.358401 2025] [:error] [pid 2987:tid 3010] [client 20.249.10.99:33743] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/colors/blue/index.php"] [unique_id "aSXU-c-djEt-pTzPxnzz8AAAAVU"]
[Wed Nov 26 00:10:33.797387 2025] [:error] [pid 2987:tid 2994] [client 20.249.10.99:33493] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/colors/blue/index.php"] [unique_id "aSXU-c-djEt-pTzPxnzz8gAAAUU"]
[Wed Nov 26 00:10:34.326390 2025] [:error] [pid 14076:tid 14096] [client 20.249.10.99:33492] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSXU-nsB4Gz6Qw-pvBtyHgAAAA8"]
[Wed Nov 26 00:10:35.185041 2025] [:error] [pid 2987:tid 2993] [client 20.249.10.99:33364] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSXU-8-djEt-pTzPxnzz9gAAAUQ"]
[Wed Nov 26 00:10:35.621141 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:33515] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSXU-yGGdT-nZJVs3x0bjgAAAZE"]
[Wed Nov 26 00:10:36.160069 2025] [:error] [pid 2987:tid 3004] [client 20.249.10.99:33337] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aSXU_M-djEt-pTzPxnzz-AAAAU8"]
[Wed Nov 26 00:10:36.863459 2025] [:error] [pid 43981:tid 44001] [client 20.249.10.99:33367] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSXU_AgZn97m_qh_RaGO1wAAAxI"]
[Wed Nov 26 00:10:37.555780 2025] [:error] [pid 28609:tid 28621] [client 20.249.10.99:33304] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSXU_SGGdT-nZJVs3x0blAAAAYM"]
[Wed Nov 26 00:10:38.364372 2025] [:error] [pid 43843:tid 43851] [client 20.249.10.99:33521] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSXU_hhx4v3NUNdMKDMZEgAAAcY"]
[Wed Nov 26 00:10:39.133888 2025] [:error] [pid 28609:tid 28637] [client 20.249.10.99:33365] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/setup-config.php"] [unique_id "aSXU_yGGdT-nZJVs3x0blwAAAZM"]
[Wed Nov 26 00:10:39.541248 2025] [:error] [pid 14078:tid 14143] [client 20.249.10.99:33328] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/about.php"] [unique_id "aSXU_9VXYbb0ii_rVoLEuQAAAIY"]
[Wed Nov 26 00:10:39.895805 2025] [:error] [pid 43843:tid 43849] [client 20.249.10.99:33398] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/about.php"] [unique_id "aSXU_xhx4v3NUNdMKDMZFQAAAcQ"]
[Wed Nov 26 00:10:40.268882 2025] [:error] [pid 14076:tid 14085] [client 20.249.10.99:33532] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/about.php"] [unique_id "aSXVAHsB4Gz6Qw-pvBtyPQAAAAQ"]
[Wed Nov 26 00:10:40.655729 2025] [:error] [pid 28609:tid 28629] [client 20.249.10.99:33746] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/about.php"] [unique_id "aSXVACGGdT-nZJVs3x0bmAAAAYs"]
[Wed Nov 26 00:10:41.203479 2025] [:error] [pid 14078:tid 14149] [client 20.249.10.99:33517] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aSXVAdVXYbb0ii_rVoLEwAAAAIw"]
[Wed Nov 26 00:10:41.844854 2025] [:error] [pid 28739:tid 28780] [client 20.249.10.99:33496] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aSXVARxGpKmlkG4FexTk2AAAAhI"]
[Wed Nov 26 00:10:42.586762 2025] [:error] [pid 43843:tid 43860] [client 20.249.10.99:33363] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aSXVAhhx4v3NUNdMKDMZFwAAAc8"]
[Wed Nov 26 00:10:43.383667 2025] [:error] [pid 14077:tid 14117] [client 20.249.10.99:33486] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aSXVAxG9n7UHEkwDTyj31AAAAEc"]
[Wed Nov 26 00:10:44.226582 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:33752] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSXVBNVXYbb0ii_rVoLExwAAAJU"]
[Wed Nov 26 00:10:44.890843 2025] [:error] [pid 28739:tid 28772] [client 20.249.10.99:33351] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSXVBBxGpKmlkG4FexTk3wAAAgo"]
[Wed Nov 26 00:10:45.986418 2025] [:error] [pid 43843:tid 43859] [client 20.249.10.99:33319] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSXVBRhx4v3NUNdMKDMZGgAAAc4"]
[Wed Nov 26 00:10:46.782899 2025] [:error] [pid 14077:tid 14116] [client 20.249.10.99:33376] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSXVBhG9n7UHEkwDTyj32wAAAEY"]
[Wed Nov 26 00:10:47.295849 2025] [:error] [pid 28609:tid 28625] [client 20.249.10.99:33386] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "aSXVByGGdT-nZJVs3x0boQAAAYc"]
[Wed Nov 26 00:10:48.202862 2025] [proxy_fcgi:error] [pid 43981:tid 43991] [client 20.249.10.99:33529] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:48.355407 2025] [proxy_fcgi:error] [pid 43981:tid 43988] [client 20.249.10.99:33529] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:48.998688 2025] [proxy_fcgi:error] [pid 43981:tid 43999] [client 20.249.10.99:33529] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:49.150924 2025] [proxy_fcgi:error] [pid 43981:tid 43985] [client 20.249.10.99:33529] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:49.304614 2025] [proxy_fcgi:error] [pid 43981:tid 43995] [client 20.249.10.99:33529] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:49.453404 2025] [:error] [pid 43981:tid 43986] [client 20.249.10.99:33529] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSXVCQgZn97m_qh_RaGO6wAAAwM"]
[Wed Nov 26 00:10:50.133019 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:33513] [client 20.249.10.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSXVCtVXYbb0ii_rVoLE1AAAAJU"]
[Wed Nov 26 00:10:50.863152 2025] [proxy_fcgi:error] [pid 28609:tid 28627] [client 20.249.10.99:33388] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 00:10:51.029100 2025] [:error] [pid 28609:tid 28635] [client 20.249.10.99:33388] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bge.php"] [unique_id "aSXVCyGGdT-nZJVs3x0bqAAAAZE"]
[Wed Nov 26 00:10:51.636314 2025] [:error] [pid 28739:tid 28766] [client 20.249.10.99:33491] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bge.php"] [unique_id "aSXVCxxGpKmlkG4FexTlCgAAAgQ"]
[Wed Nov 26 00:10:52.202509 2025] [:error] [pid 28836:tid 28969] [client 20.249.10.99:33500] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bge.php"] [unique_id "aSXVDJwNRsoxcLQGkTcRGgAAAs4"]
[Wed Nov 26 00:10:53.304842 2025] [:error] [pid 14078:tid 14156] [client 20.249.10.99:33519] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bge.php"] [unique_id "aSXVDdVXYbb0ii_rVoLE2AAAAJM"]
[Wed Nov 26 00:10:54.124302 2025] [:error] [pid 28609:tid 28623] [client 20.249.10.99:33354] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifm.php"] [unique_id "aSXVDiGGdT-nZJVs3x0bqgAAAYU"]
[Wed Nov 26 00:10:54.782040 2025] [:error] [pid 14077:tid 14130] [client 20.249.10.99:33729] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifm.php"] [unique_id "aSXVDhG9n7UHEkwDTyj34gAAAFQ"]
[Wed Nov 26 00:10:55.101820 2025] [:error] [pid 2987:tid 3001] [client 20.249.10.99:33518] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifm.php"] [unique_id "aSXVD8-djEt-pTzPxnz0AAAAAUw"]
[Wed Nov 26 00:10:55.483337 2025] [:error] [pid 43843:tid 43857] [client 20.249.10.99:33346] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifm.php"] [unique_id "aSXVDxhx4v3NUNdMKDMZLQAAAcw"]
[Wed Nov 26 00:10:55.809314 2025] [:error] [pid 28836:tid 28958] [client 20.249.10.99:33335] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww5.php"] [unique_id "aSXVD5wNRsoxcLQGkTcRHAAAAsM"]
[Wed Nov 26 00:10:56.217386 2025] [:error] [pid 28609:tid 28641] [client 20.249.10.99:33753] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww5.php"] [unique_id "aSXVECGGdT-nZJVs3x0bqwAAAZc"]
[Wed Nov 26 00:10:56.587971 2025] [:error] [pid 2987:tid 2998] [client 20.249.10.99:33353] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww5.php"] [unique_id "aSXVEM-djEt-pTzPxnz0AQAAAUk"]
[Wed Nov 26 00:10:57.059867 2025] [:error] [pid 14077:tid 14132] [client 20.249.10.99:33526] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww5.php"] [unique_id "aSXVERG9n7UHEkwDTyj35gAAAFY"]
[Wed Nov 26 00:10:57.364912 2025] [:error] [pid 28739:tid 28775] [client 20.249.10.99:33535] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/thxt.php"] [unique_id "aSXVERxGpKmlkG4FexTlEQAAAg0"]
[Wed Nov 26 00:10:57.869771 2025] [:error] [pid 28609:tid 28634] [client 20.249.10.99:33749] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/thxt.php"] [unique_id "aSXVESGGdT-nZJVs3x0brwAAAZA"]
[Wed Nov 26 00:10:58.276596 2025] [:error] [pid 14077:tid 14116] [client 20.249.10.99:33352] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/thxt.php"] [unique_id "aSXVEhG9n7UHEkwDTyj35wAAAEY"]
[Wed Nov 26 00:10:58.654755 2025] [:error] [pid 43981:tid 43983] [client 20.249.10.99:33516] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/thxt.php"] [unique_id "aSXVEggZn97m_qh_RaGO8gAAAwA"]
[Wed Nov 26 00:10:59.288965 2025] [:error] [pid 14076:tid 14083] [client 20.249.10.99:33371] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kairolin.php"] [unique_id "aSXVE3sB4Gz6Qw-pvBtyTwAAAAI"]
[Wed Nov 26 00:11:00.337460 2025] [:error] [pid 14078:tid 14138] [client 20.249.10.99:33381] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kairolin.php"] [unique_id "aSXVFNVXYbb0ii_rVoLE6AAAAIE"]
[Wed Nov 26 00:11:00.788617 2025] [:error] [pid 14078:tid 14158] [client 20.249.10.99:33736] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kairolin.php"] [unique_id "aSXVFNVXYbb0ii_rVoLE7gAAAJU"]
[Wed Nov 26 00:11:01.271414 2025] [:error] [pid 14168:tid 14171] [client 20.249.10.99:33761] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kairolin.php"] [unique_id "aSXVFfR-ZDU0QEgAIIuyxAAAAMA"]
[Wed Nov 26 00:11:01.692743 2025] [:error] [pid 28836:tid 29009] [client 20.249.10.99:33378] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aSXVFZwNRsoxcLQGkTcRIgAAAtM"]
[Wed Nov 26 00:11:02.609997 2025] [:error] [pid 43843:tid 43868] [client 20.249.10.99:33519] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aSXVFhhx4v3NUNdMKDMZMAAAAdc"]
[Wed Nov 26 00:11:02.948207 2025] [:error] [pid 14078:tid 14137] [client 20.249.10.99:33475] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aSXVFtVXYbb0ii_rVoLE-AAAAIA"]
[Wed Nov 26 00:11:03.448312 2025] [:error] [pid 14078:tid 14147] [client 20.249.10.99:33369] [client 20.249.10.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/siln.php"] [unique_id "aSXVF9VXYbb0ii_rVoLE-gAAAIo"]
[Wed Nov 26 00:14:00.291497 2025] [:error] [pid 2987:tid 3009] [client 35.245.49.241:47898] [client 35.245.49.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aSXVyM-djEt-pTzPxnz02gAAAVQ"]
[Wed Nov 26 04:17:52.049663 2025] [:error] [pid 3012:tid 3084] [client 117.62.235.53:48423] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSYO8Efo8Sm1Un9NK6gdhQAAAI8"]
[Wed Nov 26 04:33:53.648192 2025] [:error] [pid 3012:tid 3088] [client 54.173.250.15:42620] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aSYSsUfo8Sm1Un9NK6giewAAAJM"]
[Wed Nov 26 11:52:23.155145 2025] [:error] [pid 34742:tid 34765] [client 43.157.179.227:33914] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aSZ5d5SuLNwpQF_jzActKQAAAFE"]
[Wed Nov 26 13:17:53.526239 2025] [:error] [pid 34743:tid 34784] [client 169.150.203.195:55988] [client 169.150.203.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.195, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aSaNgQvyX7Q5oU7_mByXEAAAAUg"]
[Wed Nov 26 13:17:53.537771 2025] [proxy_fcgi:error] [pid 34743:tid 34784] [client 169.150.203.195:55988] AH01071: Got error 'Primary script unknown'
[Wed Nov 26 13:17:56.651719 2025] [:error] [pid 34743:tid 34795] [client 169.150.203.195:55988] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aSaNhAvyX7Q5oU7_mByXHAAAAVM"]
[Wed Nov 26 13:17:56.964081 2025] [:error] [pid 34744:tid 34818] [client 169.150.203.195:57930] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aSaNhEtgOvVbhyALkTT1MAAAAY8"]
[Wed Nov 26 13:17:57.277856 2025] [:error] [pid 10383:tid 10390] [client 169.150.203.195:57938] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aSaNha0RJ-zjhOVjD8_K1gAAAcQ"]
[Wed Nov 26 13:17:57.589959 2025] [:error] [pid 10383:tid 10389] [client 169.150.203.195:57952] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aSaNha0RJ-zjhOVjD8_K1wAAAcM"]
[Wed Nov 26 13:17:57.928992 2025] [:error] [pid 45836:tid 45853] [client 169.150.203.195:57956] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aSaNhZfrnOGqL-seZAw5AgAAAMc"]
[Wed Nov 26 13:17:58.246674 2025] [:error] [pid 34742:tid 34766] [client 169.150.203.195:57960] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aSaNhpSuLNwpQF_jzAc8YgAAAFI"]
[Wed Nov 26 13:17:58.558236 2025] [:error] [pid 34744:tid 34816] [client 169.150.203.195:57972] [client 169.150.203.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aSaNhktgOvVbhyALkTT1NQAAAY0"]
[Wed Nov 26 13:35:30.179055 2025] [autoindex:error] [pid 34743:tid 34796] [client 139.59.30.253:60714] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 23:48:38.779577 2025] [proxy_fcgi:error] [pid 20733:tid 20759] [client 145.239.10.137:39885] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/ww3.php
[Thu Nov 27 00:02:33.502962 2025] [:error] [pid 45683:tid 45689] [client 222.79.103.59:51220] [client 222.79.103.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aSckmRX1gQgNFW_222royAAAAUE"]
[Thu Nov 27 00:29:01.004328 2025] [proxy_fcgi:error] [pid 24814:tid 25094] [client 41.248.197.137:61283] AH01071: Got error 'Primary script unknown'
[Thu Nov 27 00:58:13.988175 2025] [:error] [pid 25262:tid 25339] [client 103.77.107.57:50240] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "aScxpU3p81VU3bYILBU-HQAAAhI"]
[Thu Nov 27 00:58:14.299722 2025] [:error] [pid 24826:tid 25117] [client 103.77.107.57:53440] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "aScxplEvPXLVl-nh-yLdngAAAQI"]
[Thu Nov 27 01:26:02.079250 2025] [:error] [pid 54723:tid 54751] [client 216.126.239.203:47278] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aSc4Kg2CEg7QoyDosdL7IwAAABU"]
[Thu Nov 27 02:24:25.960895 2025] [proxy_fcgi:error] [pid 8184:tid 8250] [client 35.232.250.106:54846] AH01071: Got error 'Primary script unknown'
[Thu Nov 27 02:24:28.535455 2025] [proxy_fcgi:error] [pid 24814:tid 25099] [client 35.232.250.106:53635] AH01071: Got error 'Primary script unknown'
[Thu Nov 27 02:24:33.715810 2025] [:error] [pid 8184:tid 8247] [client 35.232.250.106:52369] [client 35.232.250.106] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aSdF4b-M2IHkRYVrcbObcwAAAEo"]
[Thu Nov 27 02:24:38.832622 2025] [proxy_fcgi:error] [pid 24826:tid 25124] [client 35.232.250.106:50891] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 15:44:44.342642 2026] [:error] [pid 21400:tid 21405] [client 73.74.101.80:64009] [client 73.74.101.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 73.74.101.80, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aa_L7DCFYMzi4orNuEG7bQAAAMM"]
[Tue Mar 10 15:44:44.358038 2026] [proxy_fcgi:error] [pid 21400:tid 21405] [client 73.74.101.80:64009] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 15:46:07.460008 2026] [:error] [pid 21400:tid 21420] [client 45.249.87.111:17457] [client 45.249.87.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.249.87.111, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aa_MPzCFYMzi4orNuEG8BQAAANI"]
[Tue Mar 10 15:46:07.472370 2026] [proxy_fcgi:error] [pid 21400:tid 21420] [client 45.249.87.111:17457] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 15:46:44.984646 2026] [:error] [pid 21318:tid 21380] [client 103.206.97.141:51636] [client 103.206.97.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.206.97.141, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aa_MZBTTkPqKydpYiIJQDAAAAIY"]
[Tue Mar 10 15:46:44.997934 2026] [proxy_fcgi:error] [pid 21318:tid 21380] [client 103.206.97.141:51636] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 15:47:00.826983 2026] [:error] [pid 21318:tid 21386] [client 49.36.201.184:63399] [client 49.36.201.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.201.184, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aa_MdBTTkPqKydpYiIJQMQAAAIw"]
[Tue Mar 10 15:47:00.839183 2026] [proxy_fcgi:error] [pid 21318:tid 21386] [client 49.36.201.184:63399] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 16:12:43.312817 2026] [:error] [pid 21317:tid 21351] [client 170.106.11.6:33266] [client 170.106.11.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aa_Se1UUqcn7vK991D2LCQAAAEQ"]
[Tue Mar 10 18:38:40.667512 2026] [autoindex:error] [pid 14507:tid 14562] [client 139.59.32.166:39012] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 10 19:30:24.684522 2026] [:error] [pid 14627:tid 14660] [client 159.65.15.207:58758] [client 159.65.15.207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "abAA0INRj9158hP_6x__JgAAANc"]
2026/03/10 21:58:57 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20168.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20168.aspx", host: "switchcreative.net"
[Tue Mar 10 21:58:57.405612 2026] [:error] [pid 3873:tid 3912] [client 51.77.218.191:46616] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "abAjoS_mXXwyT3XINrottAAAAEA"]
[Tue Mar 10 21:58:59.090887 2026] [:error] [pid 3965:tid 3984] [client 51.77.218.191:46656] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "abAjo5N2nrVwtq9b0ra_ZgAAANE"]
2026/03/10 21:58:59 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20c4.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20c4.aspx", host: "switchcreative.net"
2026/03/10 21:59:00 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20c4.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20c4.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:00.820736 2026] [:error] [pid 3965:tid 3970] [client 51.77.218.191:46708] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "abAjpJN2nrVwtq9b0ra_cQAAAMM"]
2026/03/10 21:59:02 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20sa.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20sa.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:02.529210 2026] [:error] [pid 3965:tid 3974] [client 51.77.218.191:46742] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "abAjppN2nrVwtq9b0ra_eQAAAMc"]
2026/03/10 21:59:04 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20sa.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20sa.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:04.222534 2026] [:error] [pid 3874:tid 3948] [client 51.77.218.191:46788] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "abAjqOK9H96QUJV_mxY3fQAAAIk"]
2026/03/10 21:59:05 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20slot.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:05.937466 2026] [:error] [pid 3874:tid 3947] [client 51.77.218.191:46848] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "abAjqeK9H96QUJV_mxY3hwAAAIg"]
2026/03/10 21:59:07 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20vip.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:07.586601 2026] [:error] [pid 3873:tid 3917] [client 51.77.218.191:46876] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "abAjqy_mXXwyT3XINrotwwAAAEU"]
2026/03/10 21:59:09 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20vip.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20vip.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:09.441044 2026] [:error] [pid 3874:tid 3943] [client 51.77.218.191:46908] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "abAjreK9H96QUJV_mxY3kwAAAIQ"]
[Tue Mar 10 21:59:11.213161 2026] [:error] [pid 3965:tid 3969] [client 51.77.218.191:46948] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "abAjr5N2nrVwtq9b0ra_mQAAAMI"]
2026/03/10 21:59:11 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20wallet%20777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20wallet%20777.aspx", host: "switchcreative.net"
2026/03/10 21:59:13 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufa%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufa%20wallet.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:13.033923 2026] [:error] [pid 3965:tid 3981] [client 51.77.218.191:46978] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "abAjsZN2nrVwtq9b0ra_ngAAAM4"]
2026/03/10 21:59:14 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20100.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20100.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:14.860371 2026] [:error] [pid 3874:tid 3942] [client 51.77.218.191:47012] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "abAjsuK9H96QUJV_mxY3pAAAAIM"]
2026/03/10 21:59:16 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%201668.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%201668.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:16.563022 2026] [:error] [pid 3965:tid 3981] [client 51.77.218.191:47046] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "abAjtJN2nrVwtq9b0ra_rwAAAM4"]
2026/03/10 21:59:18 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%201668.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%201668.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:18.217329 2026] [:error] [pid 3965:tid 3979] [client 51.77.218.191:47084] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "abAjtpN2nrVwtq9b0ra_tAAAAMw"]
2026/03/10 21:59:19 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%207777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%207777.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:19.798737 2026] [:error] [pid 3873:tid 3916] [client 51.77.218.191:47110] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "abAjty_mXXwyT3XINrot0wAAAEQ"]
2026/03/10 21:59:21 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20auto%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20auto%20wallet.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:21.446947 2026] [:error] [pid 3965:tid 3976] [client 51.77.218.191:47142] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "abAjuZN2nrVwtq9b0ra_wQAAAMk"]
2026/03/10 21:59:23 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20auto.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20auto.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:23.121739 2026] [:error] [pid 3874:tid 3962] [client 51.77.218.191:47178] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "abAju-K9H96QUJV_mxY3vAAAAJc"]
2026/03/10 21:59:24 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20net.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20net.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:24.748573 2026] [:error] [pid 3872:tid 3900] [client 51.77.218.191:47208] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "abAjvNseKmNoS38Y-zvVQQAAABg"]
2026/03/10 21:59:26 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20wallet%20777.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20wallet%20777.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:26.387396 2026] [:error] [pid 3873:tid 3922] [client 51.77.218.191:47248] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "abAjvi_mXXwyT3XINrot3QAAAEo"]
[Tue Mar 10 21:59:28.023057 2026] [:error] [pid 3965:tid 3985] [client 51.77.218.191:47278] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "abAjwJN2nrVwtq9b0ra_4AAAANI"]
2026/03/10 21:59:28 [error] 3838#3838: *174140 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20wallet.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:29.808537 2026] [:error] [pid 3965:tid 3991] [client 51.77.218.191:47330] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "abAjwZN2nrVwtq9b0ra_6QAAANg"]
2026/03/10 21:59:29 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /ufabet%20wallet.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/ufabet%20wallet.aspx", host: "switchcreative.net"
2026/03/10 21:59:31 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /w69%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/w69%20slot.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:31.406826 2026] [:error] [pid 3874:tid 3947] [client 51.77.218.191:47356] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "abAjw-K9H96QUJV_mxY31wAAAIg"]
2026/03/10 21:59:33 [error] 3847#3847: *174417 upstream prematurely closed connection while reading response header from upstream, client: 51.77.218.191, server: switchcreative.net, request: "GET /we88%20slot.aspx HTTP/1.1", upstream: "http://103.4.122.14:8181/we88%20slot.aspx", host: "switchcreative.net"
[Tue Mar 10 21:59:33.150973 2026] [:error] [pid 3872:tid 3896] [client 51.77.218.191:47390] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "abAjxdseKmNoS38Y-zvVTQAAABQ"]
[Tue Mar 10 22:50:10.477590 2026] [:error] [pid 3965:tid 3972] [client 144.124.199.234:34794] [client 144.124.199.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abAvopN2nrVwtq9b0rbfKwAAAMU"]
[Tue Mar 10 22:50:10.492867 2026] [proxy_fcgi:error] [pid 3965:tid 3972] [client 144.124.199.234:34794] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 22:51:44.038509 2026] [:error] [pid 3874:tid 3940] [client 41.254.87.179:36012] [client 41.254.87.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abAwAOK9H96QUJV_mxZMLgAAAIE"]
[Tue Mar 10 22:51:44.051005 2026] [proxy_fcgi:error] [pid 3874:tid 3940] [client 41.254.87.179:36012] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 22:52:21.716114 2026] [:error] [pid 3873:tid 3926] [client 213.154.17.89:36454] [client 213.154.17.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abAwJS_mXXwyT3XINro7UQAAAE4"]
[Tue Mar 10 22:52:21.727144 2026] [proxy_fcgi:error] [pid 3873:tid 3926] [client 213.154.17.89:36454] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 22:52:56.997083 2026] [:error] [pid 3874:tid 3963] [client 106.214.2.116:36952] [client 106.214.2.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abAwSOK9H96QUJV_mxZMnQAAAJg"]
[Tue Mar 10 22:52:57.008150 2026] [proxy_fcgi:error] [pid 3874:tid 3963] [client 106.214.2.116:36952] AH01071: Got error 'Primary script unknown'
[Tue Mar 10 22:57:54.868445 2026] [:error] [pid 3965:tid 3982] [client 124.83.53.232:41154] [client 124.83.53.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abAxcpN2nrVwtq9b0rbjmAAAAM8"]
[Tue Mar 10 22:57:54.882924 2026] [proxy_fcgi:error] [pid 3965:tid 3982] [client 124.83.53.232:41154] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 00:18:53.756397 2026] [:error] [pid 3874:tid 3948] [client 139.47.117.84:52432] [client 139.47.117.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abBEbeK9H96QUJV_mxZlWAAAAIk"]
[Wed Mar 11 00:18:53.768985 2026] [proxy_fcgi:error] [pid 3874:tid 3948] [client 139.47.117.84:52432] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 02:41:10.449175 2026] [:error] [pid 6894:tid 7190] [client 142.91.98.217:58092] [client 142.91.98.217] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abBlxp4b1T0HQdoE97IBpwAAAIg"]
[Wed Mar 11 02:41:10.838946 2026] [:error] [pid 6893:tid 7172] [client 142.91.98.217:58100] [client 142.91.98.217] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abBlxjQs7J0yTt-T28khSQAAAFY"]
2026/03/11 04:55:33 [error] 3469#3469: *470798 access forbidden by rule, client: 68.183.151.56, server: switchcreative.net, request: "GET /.git/config HTTP/1.1", host: "www.switchcreative.net"
[Wed Mar 11 05:17:52.537785 2026] [:error] [pid 6119:tid 6209] [client 85.51.251.225:39830] [client 85.51.251.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abCKgG9mEGP4iomVkSYqHgAAAJI"]
[Wed Mar 11 05:17:52.550868 2026] [proxy_fcgi:error] [pid 6119:tid 6209] [client 85.51.251.225:39830] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 05:17:53.701297 2026] [proxy_fcgi:error] [pid 6119:tid 6199] [client 85.51.251.225:39854] AH01071: Got error 'Primary script unknown'
2026/03/11 07:48:18 [error] 3462#3462: *581314 access forbidden by rule, client: 159.65.188.29, server: cpanel.switchcreative.net, request: "GET /.git/config HTTP/1.1", host: "cpanel.switchcreative.net"
[Wed Mar 11 07:48:35.762464 2026] [:error] [pid 11796:tid 11808] [client 209.87.169.110:40354] [client 209.87.169.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abCt0wEDXoQrlStpO9AhUQAAAYo"]
[Wed Mar 11 07:48:35.784500 2026] [proxy_fcgi:error] [pid 11796:tid 11808] [client 209.87.169.110:40354] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:49.757611 2026] [proxy_fcgi:error] [pid 53954:tid 53992] [client 40.70.24.180:59240] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:50.019035 2026] [proxy_fcgi:error] [pid 53954:tid 54000] [client 40.70.24.180:59244] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:52.098159 2026] [proxy_fcgi:error] [pid 53954:tid 53994] [client 40.70.24.180:59280] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:52.367501 2026] [proxy_fcgi:error] [pid 53953:tid 53980] [client 40.70.24.180:59284] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:52.635725 2026] [proxy_fcgi:error] [pid 53953:tid 53970] [client 40.70.24.180:59286] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:52.899364 2026] [proxy_fcgi:error] [pid 54045:tid 54064] [client 40.70.24.180:59294] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:53.172609 2026] [proxy_fcgi:error] [pid 53953:tid 53960] [client 40.70.24.180:59298] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:53.435122 2026] [proxy_fcgi:error] [pid 53954:tid 53996] [client 40.70.24.180:59306] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:53.696320 2026] [proxy_fcgi:error] [pid 53955:tid 54029] [client 40.70.24.180:59312] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:53.961295 2026] [proxy_fcgi:error] [pid 53955:tid 54038] [client 40.70.24.180:59316] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 10:23:54.227888 2026] [:error] [pid 54045:tid 54066] [client 40.70.24.180:59320] [client 40.70.24.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/pridmag/js.php"] [unique_id "abDSOiRcKzQ1f-N8TgQNhQAAANM"]
2026/03/11 10:23:54 [error] 53947#53947: *665187 upstream prematurely closed connection while reading response header from upstream, client: 40.70.24.180, server: switchcreative.net, request: "GET /wp-content/themes/pridmag/js.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/themes/pridmag/js.php", host: "switchcreative.net"
[Wed Mar 11 10:23:54.483660 2026] [:error] [pid 53954:tid 53985] [client 40.70.24.180:59324] [client 40.70.24.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/pridmag/34.php"] [unique_id "abDSOrbD1J_Nhe6jce1vVQAAAEE"]
2026/03/11 10:23:54 [error] 53947#53947: *665187 upstream prematurely closed connection while reading response header from upstream, client: 40.70.24.180, server: switchcreative.net, request: "GET /wp-content/themes/pridmag/34.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/themes/pridmag/34.php", host: "switchcreative.net"
[Wed Mar 11 14:31:51.923916 2026] [:error] [pid 53955:tid 54025] [client 122.177.107.29:55964] [client 122.177.107.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abEMV9P1Uf6qBkbxZg-7wgAAAIY"]
[Wed Mar 11 14:31:51.937301 2026] [proxy_fcgi:error] [pid 53955:tid 54025] [client 122.177.107.29:55964] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 15:18:01.952021 2026] [:error] [pid 23482:tid 23497] [client 223.239.131.123:59016] [client 223.239.131.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abEXKcrYaTAnN_mLXymhngAAAQw"]
[Wed Mar 11 15:18:01.963474 2026] [proxy_fcgi:error] [pid 23482:tid 23497] [client 223.239.131.123:59016] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 15:32:09.162683 2026] [proxy_fcgi:error] [pid 53955:tid 54041] [client 145.239.10.137:42784] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/k.php
[Wed Mar 11 18:08:12.154249 2026] [proxy_fcgi:error] [pid 53955:tid 54029] [client 20.110.201.154:40234] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:13.414428 2026] [proxy_fcgi:error] [pid 53955:tid 54032] [client 20.110.201.154:40254] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:13.633169 2026] [proxy_fcgi:error] [pid 44995:tid 45019] [client 20.110.201.154:40264] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:14.116769 2026] [proxy_fcgi:error] [pid 54045:tid 54068] [client 20.110.201.154:40272] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:14.322364 2026] [proxy_fcgi:error] [pid 54045:tid 54056] [client 20.110.201.154:40274] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:14.530902 2026] [proxy_fcgi:error] [pid 45143:tid 45161] [client 20.110.201.154:40278] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:14.777993 2026] [proxy_fcgi:error] [pid 45143:tid 45152] [client 20.110.201.154:40282] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:14.982165 2026] [proxy_fcgi:error] [pid 45143:tid 45158] [client 20.110.201.154:40286] AH01071: Got error 'Primary script unknown'
[Wed Mar 11 18:08:15.186474 2026] [proxy_fcgi:error] [pid 44882:tid 44887] [client 20.110.201.154:40294] AH01071: Got error 'Primary script unknown'
2026/03/11 18:08:15 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /t.php HTTP/1.1", upstream: "http://103.4.122.14:8181/t.php", host: "switchcreative.net"
[Wed Mar 11 18:08:15.388360 2026] [:error] [pid 44800:tid 44816] [client 20.110.201.154:40302] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "abE_DzN8ZerbIEHTO2qV8AAAAc4"]
2026/03/11 18:08:15 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /bgymj.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bgymj.php", host: "switchcreative.net"
[Wed Mar 11 18:08:15.592961 2026] [:error] [pid 54045:tid 54048] [client 20.110.201.154:40308] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "abE_DyRcKzQ1f-N8TgSLHwAAAME"]
2026/03/11 18:08:15 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ms.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ms.php", host: "switchcreative.net"
[Wed Mar 11 18:08:15.858567 2026] [:error] [pid 54045:tid 54057] [client 20.110.201.154:40312] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms.php"] [unique_id "abE_DyRcKzQ1f-N8TgSLIAAAAMo"]
[Wed Mar 11 18:08:16.101398 2026] [:error] [pid 54045:tid 54061] [client 20.110.201.154:40320] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "abE_ECRcKzQ1f-N8TgSLIwAAAM4"]
2026/03/11 18:08:16 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ms-edit.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ms-edit.php", host: "switchcreative.net"
[Wed Mar 11 18:08:16.303897 2026] [:error] [pid 54045:tid 54066] [client 20.110.201.154:40322] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "abE_ECRcKzQ1f-N8TgSLJAAAANM"]
2026/03/11 18:08:16 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws49.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws49.php", host: "switchcreative.net"
2026/03/11 18:08:16 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ioxi-o.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ioxi-o.php", host: "switchcreative.net"
[Wed Mar 11 18:08:16.524025 2026] [:error] [pid 54045:tid 54060] [client 20.110.201.154:40326] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "abE_ECRcKzQ1f-N8TgSLJQAAAM0"]
2026/03/11 18:08:16 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /hots.php HTTP/1.1", upstream: "http://103.4.122.14:8181/hots.php", host: "switchcreative.net"
[Wed Mar 11 18:08:16.731717 2026] [:error] [pid 44882:tid 44906] [client 20.110.201.154:40332] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "abE_EFC06UlbDFYZNg3_PgAAAhY"]
2026/03/11 18:08:16 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /666.php HTTP/1.1", upstream: "http://103.4.122.14:8181/666.php", host: "switchcreative.net"
[Wed Mar 11 18:08:16.941914 2026] [:error] [pid 54045:tid 54051] [client 20.110.201.154:40340] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "abE_ECRcKzQ1f-N8TgSLKgAAAMQ"]
2026/03/11 18:08:17 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /hplfuns.php HTTP/1.1", upstream: "http://103.4.122.14:8181/hplfuns.php", host: "switchcreative.net"
[Wed Mar 11 18:08:17.149437 2026] [:error] [pid 44995:tid 45016] [client 20.110.201.154:40346] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "abE_EToOSr9ks_axo6OaQwAAAlM"]
2026/03/11 18:08:17 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wen.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wen.php", host: "switchcreative.net"
[Wed Mar 11 18:08:17.353320 2026] [:error] [pid 54045:tid 54048] [client 20.110.201.154:40348] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "abE_ESRcKzQ1f-N8TgSLLAAAAME"]
[Wed Mar 11 18:08:17.553791 2026] [:error] [pid 44882:tid 44884] [client 20.110.201.154:40352] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "abE_EVC06UlbDFYZNg3_QQAAAgA"]
2026/03/11 18:08:17 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /gifclass.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gifclass.php", host: "switchcreative.net"
2026/03/11 18:08:17 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ccs.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ccs.php", host: "switchcreative.net"
[Wed Mar 11 18:08:17.754813 2026] [:error] [pid 44800:tid 44813] [client 20.110.201.154:40358] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "abE_ETN8ZerbIEHTO2qV8QAAAcs"]
[Wed Mar 11 18:08:17.965938 2026] [:error] [pid 44995:tid 45015] [client 20.110.201.154:40360] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "abE_EToOSr9ks_axo6OaRwAAAlI"]
2026/03/11 18:08:17 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /a4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/a4.php", host: "switchcreative.net"
[Wed Mar 11 18:08:18.166903 2026] [:error] [pid 54045:tid 54050] [client 20.110.201.154:40366] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "abE_EiRcKzQ1f-N8TgSLLQAAAMM"]
2026/03/11 18:08:18 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /bnm.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bnm.php", host: "switchcreative.net"
2026/03/11 18:08:18 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /sid3.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sid3.php", host: "switchcreative.net"
[Wed Mar 11 18:08:18.381190 2026] [:error] [pid 53954:tid 53984] [client 20.110.201.154:40370] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "abE_ErbD1J_Nhe6jce2O7gAAAEA"]
[Wed Mar 11 18:08:18.598711 2026] [:error] [pid 54045:tid 54058] [client 20.110.201.154:40376] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "abE_EiRcKzQ1f-N8TgSLLwAAAMs"]
2026/03/11 18:08:18 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /tool.php HTTP/1.1", upstream: "http://103.4.122.14:8181/tool.php", host: "switchcreative.net"
2026/03/11 18:08:18 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /222.php HTTP/1.1", upstream: "http://103.4.122.14:8181/222.php", host: "switchcreative.net"
[Wed Mar 11 18:08:18.818426 2026] [:error] [pid 54045:tid 54059] [client 20.110.201.154:40382] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "abE_EiRcKzQ1f-N8TgSLMAAAAMw"]
2026/03/11 18:08:19 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws77.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws77.php", host: "switchcreative.net"
[Wed Mar 11 18:08:19.019169 2026] [:error] [pid 53955:tid 54041] [client 20.110.201.154:40384] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "abE_E9P1Uf6qBkbxZg_pJwAAAJY"]
2026/03/11 18:08:19 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /edit.php HTTP/1.1", upstream: "http://103.4.122.14:8181/edit.php", host: "switchcreative.net"
[Wed Mar 11 18:08:19.236173 2026] [:error] [pid 44995:tid 45000] [client 20.110.201.154:40390] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "abE_EzoOSr9ks_axo6OaSAAAAkM"]
2026/03/11 18:08:19 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-the.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-the.php", host: "switchcreative.net"
[Wed Mar 11 18:08:19.436928 2026] [:error] [pid 23512:tid 23519] [client 20.110.201.154:40396] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "abE_E6euPtNfm7KRzWXT5wAAAUQ"]
[Wed Mar 11 18:08:19.637002 2026] [:error] [pid 54045:tid 54063] [client 20.110.201.154:40402] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "abE_EyRcKzQ1f-N8TgSLMgAAANA"]
2026/03/11 18:08:19 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-blog.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-blog.php", host: "switchcreative.net"
2026/03/11 18:08:19 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-act.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-act.php", host: "switchcreative.net"
[Wed Mar 11 18:08:19.839117 2026] [:error] [pid 44995:tid 45017] [client 20.110.201.154:40404] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "abE_EzoOSr9ks_axo6OaSQAAAlQ"]
2026/03/11 18:08:20 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /1.php HTTP/1.1", upstream: "http://103.4.122.14:8181/1.php", host: "switchcreative.net"
[Wed Mar 11 18:08:20.039866 2026] [:error] [pid 53954:tid 54005] [client 20.110.201.154:40406] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "abE_FLbD1J_Nhe6jce2O8AAAAFI"]
2026/03/11 18:08:20 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /tfm.php HTTP/1.1", upstream: "http://103.4.122.14:8181/tfm.php", host: "switchcreative.net"
[Wed Mar 11 18:08:20.299386 2026] [:error] [pid 54045:tid 54060] [client 20.110.201.154:40418] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "abE_FCRcKzQ1f-N8TgSLNgAAAM0"]
2026/03/11 18:08:20 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /file.php HTTP/1.1", upstream: "http://103.4.122.14:8181/file.php", host: "switchcreative.net"
[Wed Mar 11 18:08:20.499469 2026] [:error] [pid 44995:tid 45012] [client 20.110.201.154:40420] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "abE_FDoOSr9ks_axo6OaTAAAAk8"]
2026/03/11 18:08:21 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET //tfm.php HTTP/1.1", upstream: "http://103.4.122.14:8181//tfm.php", host: "switchcreative.net"
[Wed Mar 11 18:08:21.027062 2026] [:error] [pid 54045:tid 54051] [client 20.110.201.154:40428] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "abE_FSRcKzQ1f-N8TgSLOQAAAMQ"]
[Wed Mar 11 18:08:21.407977 2026] [:error] [pid 44800:tid 44814] [client 20.110.201.154:40442] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "abE_FTN8ZerbIEHTO2qV8wAAAcw"]
2026/03/11 18:08:21 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /abc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/abc.php", host: "switchcreative.net"
2026/03/11 18:08:21 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /gettest.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gettest.php", host: "switchcreative.net"
[Wed Mar 11 18:08:21.608744 2026] [:error] [pid 23512:tid 23520] [client 20.110.201.154:40444] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "abE_FaeuPtNfm7KRzWXT6AAAAUU"]
[Wed Mar 11 18:08:21.809825 2026] [:error] [pid 23512:tid 23537] [client 20.110.201.154:40454] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "abE_FaeuPtNfm7KRzWXT6QAAAVY"]
2026/03/11 18:08:21 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /amp.php HTTP/1.1", upstream: "http://103.4.122.14:8181/amp.php", host: "switchcreative.net"
2026/03/11 18:08:22 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /kj.php HTTP/1.1", upstream: "http://103.4.122.14:8181/kj.php", host: "switchcreative.net"
[Wed Mar 11 18:08:22.023035 2026] [:error] [pid 44995:tid 45020] [client 20.110.201.154:40460] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "abE_FjoOSr9ks_axo6OaTQAAAlc"]
2026/03/11 18:08:22 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /xxw.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xxw.php", host: "switchcreative.net"
[Wed Mar 11 18:08:22.223665 2026] [:error] [pid 54045:tid 54059] [client 20.110.201.154:40466] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "abE_FiRcKzQ1f-N8TgSLPgAAAMw"]
2026/03/11 18:08:22 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /term.php HTTP/1.1", upstream: "http://103.4.122.14:8181/term.php", host: "switchcreative.net"
[Wed Mar 11 18:08:22.622464 2026] [:error] [pid 54045:tid 54069] [client 20.110.201.154:40486] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "abE_FiRcKzQ1f-N8TgSLRAAAANY"]
2026/03/11 18:08:22 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws60.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws60.php", host: "switchcreative.net"
[Wed Mar 11 18:08:22.838642 2026] [:error] [pid 54045:tid 54062] [client 20.110.201.154:40488] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "abE_FiRcKzQ1f-N8TgSLRQAAAM8"]
2026/03/11 18:08:23 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /gfd.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gfd.php", host: "switchcreative.net"
[Wed Mar 11 18:08:23.038783 2026] [:error] [pid 54045:tid 54053] [client 20.110.201.154:40492] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "abE_FyRcKzQ1f-N8TgSLRgAAAMY"]
[Wed Mar 11 18:08:23.448274 2026] [:error] [pid 54045:tid 54071] [client 20.110.201.154:40498] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "abE_FyRcKzQ1f-N8TgSLSAAAANg"]
2026/03/11 18:08:23 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /admin-footer.php HTTP/1.1", upstream: "http://103.4.122.14:8181/admin-footer.php", host: "switchcreative.net"
2026/03/11 18:08:23 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /166.php HTTP/1.1", upstream: "http://103.4.122.14:8181/166.php", host: "switchcreative.net"
[Wed Mar 11 18:08:23.648815 2026] [:error] [pid 54045:tid 54047] [client 20.110.201.154:40510] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "abE_FyRcKzQ1f-N8TgSLTQAAAMA"]
2026/03/11 18:08:23 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /jga.php HTTP/1.1", upstream: "http://103.4.122.14:8181/jga.php", host: "switchcreative.net"
[Wed Mar 11 18:08:23.849981 2026] [:error] [pid 54045:tid 54058] [client 20.110.201.154:40514] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "abE_FyRcKzQ1f-N8TgSLTwAAAMs"]
2026/03/11 18:08:24 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-p2r3q9c8k4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-p2r3q9c8k4.php", host: "switchcreative.net"
[Wed Mar 11 18:08:24.051150 2026] [:error] [pid 54045:tid 54069] [client 20.110.201.154:40522] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "abE_GCRcKzQ1f-N8TgSLUwAAANY"]
2026/03/11 18:08:24 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-admin/css/bolt.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-admin/css/bolt.php", host: "switchcreative.net"
[Wed Mar 11 18:08:24.251537 2026] [:error] [pid 53955:tid 54040] [client 20.110.201.154:40526] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "abE_GNP1Uf6qBkbxZg_pKwAAAJU"]
2026/03/11 18:08:24 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /myfile.php HTTP/1.1", upstream: "http://103.4.122.14:8181/myfile.php", host: "switchcreative.net"
[Wed Mar 11 18:08:24.591778 2026] [:error] [pid 44995:tid 45004] [client 20.110.201.154:40530] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "abE_GDoOSr9ks_axo6OaUQAAAkc"]
2026/03/11 18:08:24 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /sa.php7 HTTP/1.1", upstream: "http://103.4.122.14:8181/sa.php7", host: "switchcreative.net"
[Wed Mar 11 18:08:24.812728 2026] [:error] [pid 44995:tid 45007] [client 20.110.201.154:40536] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "abE_GDoOSr9ks_axo6OaUwAAAko"]
2026/03/11 18:08:25 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws75.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws75.php", host: "switchcreative.net"
[Wed Mar 11 18:08:25.182454 2026] [:error] [pid 44995:tid 45016] [client 20.110.201.154:40544] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "abE_GToOSr9ks_axo6OaVAAAAlM"]
[Wed Mar 11 18:08:25.383100 2026] [:error] [pid 54045:tid 54053] [client 20.110.201.154:40546] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "abE_GSRcKzQ1f-N8TgSLVQAAAMY"]
2026/03/11 18:08:25 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-access.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-access.php", host: "switchcreative.net"
2026/03/11 18:08:25 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /init.php HTTP/1.1", upstream: "http://103.4.122.14:8181/init.php", host: "switchcreative.net"
[Wed Mar 11 18:08:25.584745 2026] [:error] [pid 44995:tid 45021] [client 20.110.201.154:40550] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "abE_GToOSr9ks_axo6OaVgAAAlg"]
2026/03/11 18:08:25 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /public/ws49.php HTTP/1.1", upstream: "http://103.4.122.14:8181/public/ws49.php", host: "switchcreative.net"
[Wed Mar 11 18:08:25.923349 2026] [:error] [pid 44995:tid 45015] [client 20.110.201.154:40554] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "abE_GToOSr9ks_axo6OaWAAAAlI"]
2026/03/11 18:08:26 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /66.php HTTP/1.1", upstream: "http://103.4.122.14:8181/66.php", host: "switchcreative.net"
[Wed Mar 11 18:08:26.132204 2026] [:error] [pid 54045:tid 54047] [client 20.110.201.154:40562] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "abE_GiRcKzQ1f-N8TgSLWQAAAMA"]
[Wed Mar 11 18:08:26.335654 2026] [:error] [pid 54045:tid 54050] [client 20.110.201.154:40564] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "abE_GiRcKzQ1f-N8TgSLWgAAAMM"]
2026/03/11 18:08:26 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /b.php HTTP/1.1", upstream: "http://103.4.122.14:8181/b.php", host: "switchcreative.net"
2026/03/11 18:08:26 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp9.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp9.php", host: "switchcreative.net"
[Wed Mar 11 18:08:26.554829 2026] [:error] [pid 44995:tid 45000] [client 20.110.201.154:40568] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "abE_GjoOSr9ks_axo6OaWQAAAkM"]
2026/03/11 18:08:26 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /grsiuk.php HTTP/1.1", upstream: "http://103.4.122.14:8181/grsiuk.php", host: "switchcreative.net"
[Wed Mar 11 18:08:26.756139 2026] [:error] [pid 44995:tid 45017] [client 20.110.201.154:40572] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/grsiuk.php"] [unique_id "abE_GjoOSr9ks_axo6OaWgAAAlQ"]
[Wed Mar 11 18:08:26.977918 2026] [:error] [pid 44995:tid 45018] [client 20.110.201.154:40576] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "abE_GjoOSr9ks_axo6OaWwAAAlU"]
2026/03/11 18:08:26 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-content/radio.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/radio.php", host: "switchcreative.net"
2026/03/11 18:08:27 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /motu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/motu.php", host: "switchcreative.net"
[Wed Mar 11 18:08:27.177723 2026] [:error] [pid 44995:tid 45001] [client 20.110.201.154:40584] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "abE_GzoOSr9ks_axo6OaXQAAAkQ"]
2026/03/11 18:08:27 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /fs.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fs.php", host: "switchcreative.net"
[Wed Mar 11 18:08:27.394431 2026] [:error] [pid 44800:tid 44823] [client 20.110.201.154:40586] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "abE_GzN8ZerbIEHTO2qV-AAAAdU"]
2026/03/11 18:08:27 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ajax.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ajax.php", host: "switchcreative.net"
[Wed Mar 11 18:08:27.594918 2026] [:error] [pid 44995:tid 45008] [client 20.110.201.154:40590] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "abE_GzoOSr9ks_axo6OaXgAAAks"]
2026/03/11 18:08:27 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /tx78.php HTTP/1.1", upstream: "http://103.4.122.14:8181/tx78.php", host: "switchcreative.net"
[Wed Mar 11 18:08:27.810079 2026] [:error] [pid 54045:tid 54049] [client 20.110.201.154:40596] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "abE_GyRcKzQ1f-N8TgSLYQAAAMI"]
2026/03/11 18:08:28 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /jp.php HTTP/1.1", upstream: "http://103.4.122.14:8181/jp.php", host: "switchcreative.net"
[Wed Mar 11 18:08:28.017936 2026] [:error] [pid 45143:tid 45145] [client 20.110.201.154:40602] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "abE_HCEXSpYdWImkpzbSGgAAAYA"]
2026/03/11 18:08:28 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-blogs.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-blogs.php", host: "switchcreative.net"
[Wed Mar 11 18:08:28.233578 2026] [:error] [pid 54045:tid 54047] [client 20.110.201.154:40606] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "abE_HCRcKzQ1f-N8TgSLZQAAAMA"]
2026/03/11 18:08:28 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /edit-tags.php HTTP/1.1", upstream: "http://103.4.122.14:8181/edit-tags.php", host: "switchcreative.net"
[Wed Mar 11 18:08:28.435519 2026] [:error] [pid 45143:tid 45160] [client 20.110.201.154:40614] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "abE_HCEXSpYdWImkpzbSGwAAAY8"]
2026/03/11 18:08:28 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-png.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-png.php", host: "switchcreative.net"
[Wed Mar 11 18:08:28.635941 2026] [:error] [pid 53955:tid 54031] [client 20.110.201.154:40618] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "abE_HNP1Uf6qBkbxZg_pLQAAAIw"]
2026/03/11 18:08:28 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wpc2.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wpc2.php", host: "switchcreative.net"
[Wed Mar 11 18:08:28.836658 2026] [:error] [pid 23482:tid 23499] [client 20.110.201.154:40626] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpc2.php"] [unique_id "abE_HMrYaTAnN_mLXynQkwAAAQ4"]
[Wed Mar 11 18:08:29.036681 2026] [:error] [pid 44882:tid 44899] [client 20.110.201.154:40632] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/intall.php"] [unique_id "abE_HVC06UlbDFYZNg3_RgAAAg8"]
2026/03/11 18:08:29 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /intall.php HTTP/1.1", upstream: "http://103.4.122.14:8181/intall.php", host: "switchcreative.net"
2026/03/11 18:08:29 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /cu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/cu.php", host: "switchcreative.net"
[Wed Mar 11 18:08:29.253939 2026] [:error] [pid 44882:tid 44901] [client 20.110.201.154:40638] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "abE_HVC06UlbDFYZNg3_RwAAAhE"]
2026/03/11 18:08:29 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /callback.php HTTP/1.1", upstream: "http://103.4.122.14:8181/callback.php", host: "switchcreative.net"
[Wed Mar 11 18:08:29.467702 2026] [:error] [pid 44995:tid 45006] [client 20.110.201.154:40644] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "abE_HToOSr9ks_axo6OaYgAAAkk"]
2026/03/11 18:08:29 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /byypas.php HTTP/1.1", upstream: "http://103.4.122.14:8181/byypas.php", host: "switchcreative.net"
[Wed Mar 11 18:08:29.668333 2026] [:error] [pid 44995:tid 45002] [client 20.110.201.154:40650] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "abE_HToOSr9ks_axo6OaYwAAAkU"]
2026/03/11 18:08:29 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /abrand.php HTTP/1.1", upstream: "http://103.4.122.14:8181/abrand.php", host: "switchcreative.net"
[Wed Mar 11 18:08:29.868604 2026] [:error] [pid 44995:tid 45004] [client 20.110.201.154:40652] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "abE_HToOSr9ks_axo6OaZAAAAkc"]
2026/03/11 18:08:30 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /camara.php HTTP/1.1", upstream: "http://103.4.122.14:8181/camara.php", host: "switchcreative.net"
[Wed Mar 11 18:08:30.077612 2026] [:error] [pid 23482:tid 23489] [client 20.110.201.154:40660] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/camara.php"] [unique_id "abE_HsrYaTAnN_mLXynQlgAAAQQ"]
2026/03/11 18:08:30 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /assacc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/assacc.php", host: "switchcreative.net"
[Wed Mar 11 18:08:30.288148 2026] [:error] [pid 54045:tid 54056] [client 20.110.201.154:40664] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assacc.php"] [unique_id "abE_HiRcKzQ1f-N8TgSLaAAAAMk"]
2026/03/11 18:08:30 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws83.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws83.php", host: "switchcreative.net"
[Wed Mar 11 18:08:30.500546 2026] [:error] [pid 54045:tid 54064] [client 20.110.201.154:40668] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "abE_HiRcKzQ1f-N8TgSLagAAANE"]
2026/03/11 18:08:30 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-good.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-good.php", host: "switchcreative.net"
[Wed Mar 11 18:08:30.717813 2026] [:error] [pid 54045:tid 54052] [client 20.110.201.154:40672] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "abE_HiRcKzQ1f-N8TgSLbAAAAMU"]
[Wed Mar 11 18:08:30.918352 2026] [:error] [pid 54045:tid 54069] [client 20.110.201.154:40674] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/%E3%81%AE.php"] [unique_id "abE_HiRcKzQ1f-N8TgSLbQAAANY"]
2026/03/11 18:08:30 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /%E3%81%AE.php HTTP/1.1", upstream: "http://103.4.122.14:8181/%E3%81%AE.php", host: "switchcreative.net"
2026/03/11 18:08:31 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /xtsr.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xtsr.php", host: "switchcreative.net"
[Wed Mar 11 18:08:31.119079 2026] [:error] [pid 44995:tid 45019] [client 20.110.201.154:40678] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xtsr.php"] [unique_id "abE_HzoOSr9ks_axo6OaZwAAAlY"]
2026/03/11 18:08:31 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /zz8.php HTTP/1.1", upstream: "http://103.4.122.14:8181/zz8.php", host: "switchcreative.net"
[Wed Mar 11 18:08:31.319697 2026] [:error] [pid 54045:tid 54049] [client 20.110.201.154:40686] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "abE_HyRcKzQ1f-N8TgSLbwAAAMI"]
2026/03/11 18:08:31 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /mh.php HTTP/1.1", upstream: "http://103.4.122.14:8181/mh.php", host: "switchcreative.net"
[Wed Mar 11 18:08:31.533942 2026] [:error] [pid 54045:tid 54060] [client 20.110.201.154:40690] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "abE_HyRcKzQ1f-N8TgSLcAAAAM0"]
2026/03/11 18:08:31 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /a5.php HTTP/1.1", upstream: "http://103.4.122.14:8181/a5.php", host: "switchcreative.net"
[Wed Mar 11 18:08:31.752753 2026] [:error] [pid 44995:tid 45003] [client 20.110.201.154:40696] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "abE_HzoOSr9ks_axo6OaagAAAkY"]
[Wed Mar 11 18:08:31.969455 2026] [:error] [pid 53955:tid 54037] [client 20.110.201.154:40698] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "abE_H9P1Uf6qBkbxZg_pMAAAAJI"]
2026/03/11 18:08:31 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ai.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ai.php", host: "switchcreative.net"
[Wed Mar 11 18:08:32.170011 2026] [:error] [pid 44995:tid 45011] [client 20.110.201.154:40702] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "abE_IDoOSr9ks_axo6OaawAAAk4"]
2026/03/11 18:08:32 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /amwxl.php HTTP/1.1", upstream: "http://103.4.122.14:8181/amwxl.php", host: "switchcreative.net"
[Wed Mar 11 18:08:32.382616 2026] [:error] [pid 44995:tid 45015] [client 20.110.201.154:40706] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awdld.php"] [unique_id "abE_IDoOSr9ks_axo6OabAAAAlI"]
2026/03/11 18:08:32 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /awdld.php HTTP/1.1", upstream: "http://103.4.122.14:8181/awdld.php", host: "switchcreative.net"
2026/03/11 18:08:32 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /bkyac.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bkyac.php", host: "switchcreative.net"
[Wed Mar 11 18:08:32.584808 2026] [:error] [pid 23482:tid 23500] [client 20.110.201.154:40708] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "abE_IMrYaTAnN_mLXynQlwAAAQ8"]
2026/03/11 18:08:32 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /krntz.php HTTP/1.1", upstream: "http://103.4.122.14:8181/krntz.php", host: "switchcreative.net"
[Wed Mar 11 18:08:32.785183 2026] [:error] [pid 44995:tid 45000] [client 20.110.201.154:40714] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/krntz.php"] [unique_id "abE_IDoOSr9ks_axo6OabQAAAkM"]
2026/03/11 18:08:33 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /vhwwnrnmqc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/vhwwnrnmqc.php", host: "switchcreative.net"
[Wed Mar 11 18:08:33.001357 2026] [:error] [pid 44995:tid 45017] [client 20.110.201.154:40716] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vhwwnrnmqc.php"] [unique_id "abE_IDoOSr9ks_axo6OabgAAAlQ"]
2026/03/11 18:08:33 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /xenium4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xenium4.php", host: "switchcreative.net"
[Wed Mar 11 18:08:33.746346 2026] [:error] [pid 44995:tid 45008] [client 20.110.201.154:40728] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xenium4.php"] [unique_id "abE_IToOSr9ks_axo6OacQAAAks"]
[Wed Mar 11 18:08:33.961404 2026] [:error] [pid 54045:tid 54053] [client 20.110.201.154:40732] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "abE_ISRcKzQ1f-N8TgSLdAAAAMY"]
2026/03/11 18:08:33 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /vaza.php HTTP/1.1", upstream: "http://103.4.122.14:8181/vaza.php", host: "switchcreative.net"
[Wed Mar 11 18:08:34.162211 2026] [:error] [pid 54045:tid 54051] [client 20.110.201.154:40736] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "abE_IiRcKzQ1f-N8TgSLdQAAAMQ"]
2026/03/11 18:08:34 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /8573.php HTTP/1.1", upstream: "http://103.4.122.14:8181/8573.php", host: "switchcreative.net"
2026/03/11 18:08:34 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /rip.php HTTP/1.1", upstream: "http://103.4.122.14:8181/rip.php", host: "switchcreative.net"
[Wed Mar 11 18:08:34.362812 2026] [:error] [pid 44995:tid 45006] [client 20.110.201.154:40738] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "abE_IjoOSr9ks_axo6OacwAAAkk"]
2026/03/11 18:08:34 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /drhunthq.php HTTP/1.1", upstream: "http://103.4.122.14:8181/drhunthq.php", host: "switchcreative.net"
[Wed Mar 11 18:08:34.570815 2026] [:error] [pid 44995:tid 45009] [client 20.110.201.154:40740] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "abE_IjoOSr9ks_axo6OadAAAAkw"]
2026/03/11 18:08:34 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /sbhu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sbhu.php", host: "switchcreative.net"
[Wed Mar 11 18:08:34.771936 2026] [:error] [pid 54045:tid 54063] [client 20.110.201.154:40746] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "abE_IiRcKzQ1f-N8TgSLdgAAANA"]
[Wed Mar 11 18:08:34.973466 2026] [:error] [pid 54045:tid 54048] [client 20.110.201.154:40750] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "abE_IiRcKzQ1f-N8TgSLeAAAAME"]
2026/03/11 18:08:34 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /inege.php HTTP/1.1", upstream: "http://103.4.122.14:8181/inege.php", host: "switchcreative.net"
2026/03/11 18:08:35 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /ws84.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ws84.php", host: "switchcreative.net"
[Wed Mar 11 18:08:35.173644 2026] [:error] [pid 54045:tid 54055] [client 20.110.201.154:40754] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "abE_IyRcKzQ1f-N8TgSLeQAAAMg"]
2026/03/11 18:08:35 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /c4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/c4.php", host: "switchcreative.net"
[Wed Mar 11 18:08:35.374247 2026] [:error] [pid 54045:tid 54056] [client 20.110.201.154:40760] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c4.php"] [unique_id "abE_IyRcKzQ1f-N8TgSLfAAAAMk"]
2026/03/11 18:08:35 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /lclnqiii.php HTTP/1.1", upstream: "http://103.4.122.14:8181/lclnqiii.php", host: "switchcreative.net"
[Wed Mar 11 18:08:35.583404 2026] [:error] [pid 44995:tid 45014] [client 20.110.201.154:40762] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lclnqiii.php"] [unique_id "abE_IzoOSr9ks_axo6OaeAAAAlE"]
2026/03/11 18:08:35 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /goat.php HTTP/1.1", upstream: "http://103.4.122.14:8181/goat.php", host: "switchcreative.net"
[Wed Mar 11 18:08:35.784044 2026] [:error] [pid 44995:tid 45005] [client 20.110.201.154:40768] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat.php"] [unique_id "abE_IzoOSr9ks_axo6OaewAAAkg"]
2026/03/11 18:08:35 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-tot.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-tot.php", host: "switchcreative.net"
[Wed Mar 11 18:08:35.996677 2026] [:error] [pid 44995:tid 45015] [client 20.110.201.154:40770] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tot.php"] [unique_id "abE_IzoOSr9ks_axo6OafAAAAlI"]
[Wed Mar 11 18:08:36.215313 2026] [:error] [pid 23512:tid 23522] [client 20.110.201.154:40776] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tap.php"] [unique_id "abE_JKeuPtNfm7KRzWXT6wAAAUc"]
2026/03/11 18:08:36 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /wp-tap.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-tap.php", host: "switchcreative.net"
2026/03/11 18:08:36 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /vrhiw.php HTTP/1.1", upstream: "http://103.4.122.14:8181/vrhiw.php", host: "switchcreative.net"
[Wed Mar 11 18:08:36.416378 2026] [:error] [pid 53955:tid 54018] [client 20.110.201.154:40778] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vrhiw.php"] [unique_id "abE_JNP1Uf6qBkbxZg_pNAAAAIA"]
2026/03/11 18:08:36 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /qqjki.php HTTP/1.1", upstream: "http://103.4.122.14:8181/qqjki.php", host: "switchcreative.net"
[Wed Mar 11 18:08:36.630114 2026] [:error] [pid 44995:tid 45018] [client 20.110.201.154:40780] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqjki.php"] [unique_id "abE_JDoOSr9ks_axo6OafgAAAlU"]
2026/03/11 18:08:36 [error] 53945#53945: *969211 upstream prematurely closed connection while reading response header from upstream, client: 20.110.201.154, server: switchcreative.net, request: "GET /koiy.php HTTP/1.1", upstream: "http://103.4.122.14:8181/koiy.php", host: "switchcreative.net"
[Wed Mar 11 18:08:36.848145 2026] [:error] [pid 44882:tid 44908] [client 20.110.201.154:40788] [client 20.110.201.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "abE_JFC06UlbDFYZNg3_SgAAAhg"]
[Wed Mar 11 21:51:46.355390 2026] [:error] [pid 44995:tid 45000] [client 31.130.135.61:46784] [client 31.130.135.61] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abFzcjoOSr9ks_axo6PuugAAAkM"]
[Thu Mar 12 04:21:01.041577 2026] [:error] [pid 63256:tid 63264] [client 143.137.223.88:55088] [client 143.137.223.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abHOrQhgyalB3r3y_Tg5zwAAAMA"]
[Thu Mar 12 04:31:22.281103 2026] [:error] [pid 63149:tid 63219] [client 102.207.10.7:60052] [client 102.207.10.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abHRGno4UdkUSJRpS0wPbgAAAII"]
[Thu Mar 12 04:31:22.282325 2026] [:error] [pid 63256:tid 63275] [client 102.207.10.7:60054] [client 102.207.10.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abHRGghgyalB3r3y_Tg96QAAAMs"]
[Thu Mar 12 09:25:40.595751 2026] [:error] [pid 22063:tid 22083] [client 49.149.143.152:25436] [client 49.149.143.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "abIWFK0RUhS-MJyHWLRyPgAAAhI"]
[Thu Mar 12 11:09:48.376557 2026] [proxy_fcgi:error] [pid 51540:tid 51566] [client 66.249.77.99:61485] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 11:22:45.472647 2026] [:error] [pid 8249:tid 8265] [client 103.18.34.247:51268] [client 103.18.34.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.18.34.247, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abIxhSK5dL3-8Jdf0M0GewAAAQ4"]
[Thu Mar 12 11:22:45.484969 2026] [proxy_fcgi:error] [pid 8249:tid 8265] [client 103.18.34.247:51268] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 18:26:01.269284 2026] [:error] [pid 22063:tid 22076] [client 103.65.236.149:55305] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "abKUua0RUhS-MJyHWLQcegAAAgs"]
[Thu Mar 12 20:26:02.272045 2026] [proxy_fcgi:error] [pid 20528:tid 20543] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:02.498934 2026] [proxy_fcgi:error] [pid 20528:tid 20536] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:02.711247 2026] [proxy_fcgi:error] [pid 20528:tid 20548] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:02.921518 2026] [proxy_fcgi:error] [pid 20528:tid 20542] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:03.422922 2026] [proxy_fcgi:error] [pid 20528:tid 20554] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:03.633760 2026] [proxy_fcgi:error] [pid 20528:tid 20539] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:03.844284 2026] [proxy_fcgi:error] [pid 20528:tid 20547] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:04.054596 2026] [proxy_fcgi:error] [pid 20528:tid 20544] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:04.264887 2026] [proxy_fcgi:error] [pid 20528:tid 20540] [client 20.220.13.10:44650] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:26:04.483742 2026] [:error] [pid 20528:tid 20549] [client 20.220.13.10:44650] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "abKw3KnDNsf46-tKxqkQoQAAAw8"]
[Thu Mar 12 20:26:05.779098 2026] [:error] [pid 11986:tid 12028] [client 20.220.13.10:19293] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "abKw3TKqY2w-DVCrxTAOPQAAAco"]
[Thu Mar 12 20:26:07.751436 2026] [:error] [pid 51456:tid 51488] [client 20.220.13.10:21238] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "abKw3xXu8LzVixNGr0trxwAAAEE"]
[Thu Mar 12 20:26:08.955590 2026] [:error] [pid 8249:tid 8253] [client 20.220.13.10:32135] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "abKw4CK5dL3-8Jdf0M1JJQAAAQI"]
[Thu Mar 12 20:26:11.356193 2026] [:error] [pid 8249:tid 8268] [client 20.220.13.10:19275] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "abKw4yK5dL3-8Jdf0M1JLgAAARE"]
[Thu Mar 12 20:26:14.388791 2026] [:error] [pid 51456:tid 51491] [client 20.220.13.10:26875] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "abKw5hXu8LzVixNGr0trzwAAAEQ"]
[Thu Mar 12 20:26:17.288151 2026] [:error] [pid 51456:tid 51502] [client 20.220.13.10:44664] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "abKw6RXu8LzVixNGr0tr0AAAAE8"]
[Thu Mar 12 20:26:18.945555 2026] [:error] [pid 51457:tid 51527] [client 20.220.13.10:4650] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "abKw6ijknw2FvT4H3Da_VAAAAI0"]
[Thu Mar 12 20:26:20.378369 2026] [:error] [pid 8249:tid 8275] [client 20.220.13.10:19280] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "abKw7CK5dL3-8Jdf0M1JWQAAARg"]
[Thu Mar 12 20:26:21.385200 2026] [:error] [pid 8249:tid 8263] [client 20.220.13.10:32657] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "abKw7SK5dL3-8Jdf0M1JXgAAAQw"]
[Thu Mar 12 20:26:22.193380 2026] [:error] [pid 51456:tid 51493] [client 20.220.13.10:19269] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "abKw7hXu8LzVixNGr0tr1gAAAEY"]
[Thu Mar 12 20:26:23.380826 2026] [:error] [pid 8249:tid 8255] [client 20.220.13.10:17120] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "abKw7yK5dL3-8Jdf0M1JZQAAAQQ"]
[Thu Mar 12 20:26:24.472565 2026] [:error] [pid 51456:tid 51503] [client 20.220.13.10:25743] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fss.php"] [unique_id "abKw8BXu8LzVixNGr0tr3QAAAFA"]
[Thu Mar 12 20:26:25.623193 2026] [:error] [pid 11953:tid 11975] [client 20.220.13.10:32667] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fss.php"] [unique_id "abKw8Zudzqsnq3bvtDY4VwAAAVQ"]
[Thu Mar 12 20:26:26.171420 2026] [:error] [pid 11953:tid 11978] [client 20.220.13.10:19267] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fss.php"] [unique_id "abKw8pudzqsnq3bvtDY4WwAAAVc"]
[Thu Mar 12 20:26:26.964723 2026] [:error] [pid 11986:tid 12026] [client 20.220.13.10:17109] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fss.php"] [unique_id "abKw8jKqY2w-DVCrxTAOaQAAAcg"]
[Thu Mar 12 20:26:28.477750 2026] [:error] [pid 8249:tid 8264] [client 20.220.13.10:30806] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "abKw9CK5dL3-8Jdf0M1JcwAAAQ0"]
[Thu Mar 12 20:26:30.214052 2026] [:error] [pid 51456:tid 51497] [client 20.220.13.10:32661] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "abKw9hXu8LzVixNGr0tr4QAAAEo"]
[Thu Mar 12 20:26:31.569568 2026] [:error] [pid 51457:tid 51519] [client 20.220.13.10:32675] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "abKw9yjknw2FvT4H3Da_YQAAAIU"]
[Thu Mar 12 20:26:32.357553 2026] [:error] [pid 51457:tid 51517] [client 20.220.13.10:32673] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "abKw-Cjknw2FvT4H3Da_ZAAAAIM"]
[Thu Mar 12 20:26:33.136780 2026] [:error] [pid 11953:tid 11958] [client 20.220.13.10:25736] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/utky.php"] [unique_id "abKw-Zudzqsnq3bvtDY4aAAAAUM"]
[Thu Mar 12 20:26:33.862669 2026] [:error] [pid 20531:tid 20631] [client 20.220.13.10:21221] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/utky.php"] [unique_id "abKw-fvw-RvNQd9b3a-tsgAAA88"]
[Thu Mar 12 20:26:43.595011 2026] [:error] [pid 8249:tid 8264] [client 20.220.13.10:44615] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/utky.php"] [unique_id "abKxAyK5dL3-8Jdf0M1JlwAAAQ0"]
[Thu Mar 12 20:26:51.758917 2026] [:error] [pid 11986:tid 12038] [client 20.220.13.10:4608] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/utky.php"] [unique_id "abKxCzKqY2w-DVCrxTAOqAAAAdQ"]
[Thu Mar 12 20:27:02.400013 2026] [proxy_fcgi:error] [pid 11953:tid 11959] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:02.630007 2026] [proxy_fcgi:error] [pid 11953:tid 11973] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:02.843072 2026] [proxy_fcgi:error] [pid 11953:tid 11978] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:03.111833 2026] [proxy_fcgi:error] [pid 11953:tid 11974] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:03.357828 2026] [proxy_fcgi:error] [pid 11953:tid 11965] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:03.590575 2026] [proxy_fcgi:error] [pid 11953:tid 11979] [client 20.220.13.10:17116] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:03.810604 2026] [:error] [pid 11953:tid 11956] [client 20.220.13.10:17116] [client 20.220.13.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "abKxF5udzqsnq3bvtDY4ywAAAUE"]
[Thu Mar 12 20:27:17.493623 2026] [proxy_fcgi:error] [pid 11986:tid 12023] [client 20.220.13.10:44640] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:17.731763 2026] [proxy_fcgi:error] [pid 11986:tid 12036] [client 20.220.13.10:44640] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:17.961677 2026] [proxy_fcgi:error] [pid 11986:tid 12031] [client 20.220.13.10:44640] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:18.220173 2026] [proxy_fcgi:error] [pid 11986:tid 12026] [client 20.220.13.10:44640] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:18.476893 2026] [proxy_fcgi:error] [pid 11986:tid 12020] [client 20.220.13.10:44640] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:27:18.715336 2026] [:error] [pid 11986:tid 12035] [client 20.220.13.10:44640] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "abKxJjKqY2w-DVCrxTAOzgAAAdE"]
[Thu Mar 12 20:27:28.030582 2026] [:error] [pid 20530:tid 20611] [client 20.220.13.10:26853] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "abKxMAkNGxMzPO-s9qcJ8gAAA5Y"]
[Thu Mar 12 20:27:49.535803 2026] [:error] [pid 8249:tid 8263] [client 20.220.13.10:44616] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "abKxRSK5dL3-8Jdf0M1KUgAAAQw"]
[Thu Mar 12 20:28:00.800635 2026] [:error] [pid 20530:tid 20578] [client 20.220.13.10:19321] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "abKxUAkNGxMzPO-s9qcJ_gAAA4M"]
[Thu Mar 12 20:28:05.808071 2026] [:error] [pid 8249:tid 8269] [client 20.220.13.10:38975] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "abKxVSK5dL3-8Jdf0M1KiQAAARI"]
[Thu Mar 12 20:28:16.962691 2026] [:error] [pid 8249:tid 8274] [client 20.220.13.10:21207] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acjsn.php"] [unique_id "abKxYCK5dL3-8Jdf0M1LDgAAARc"]
[Thu Mar 12 20:28:26.058707 2026] [proxy_fcgi:error] [pid 11986:tid 12024] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:26.268466 2026] [proxy_fcgi:error] [pid 11986:tid 12034] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:26.506461 2026] [proxy_fcgi:error] [pid 11986:tid 12028] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:26.717383 2026] [proxy_fcgi:error] [pid 11986:tid 12037] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:26.958947 2026] [proxy_fcgi:error] [pid 11986:tid 12041] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:27.183478 2026] [proxy_fcgi:error] [pid 11986:tid 12038] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:27.444461 2026] [proxy_fcgi:error] [pid 11986:tid 12020] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:27.681089 2026] [proxy_fcgi:error] [pid 11986:tid 12019] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:27.899825 2026] [proxy_fcgi:error] [pid 11986:tid 12022] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:28.107659 2026] [proxy_fcgi:error] [pid 11986:tid 12032] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:28.325292 2026] [proxy_fcgi:error] [pid 11986:tid 12018] [client 20.220.13.10:25759] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:28:28.546011 2026] [:error] [pid 11986:tid 12024] [client 20.220.13.10:25759] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pu9.php"] [unique_id "abKxbDKqY2w-DVCrxTAPiwAAAcY"]
[Thu Mar 12 20:28:50.061882 2026] [:error] [pid 8249:tid 8260] [client 20.220.13.10:38941] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pu8.php"] [unique_id "abKxgiK5dL3-8Jdf0M1LWQAAAQk"]
[Thu Mar 12 20:29:07.086044 2026] [:error] [pid 51456:tid 51491] [client 20.220.13.10:38924] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pu8.php"] [unique_id "abKxkxXu8LzVixNGr0tsbgAAAEQ"]
[Thu Mar 12 20:29:44.658361 2026] [proxy_fcgi:error] [pid 20529:tid 20584] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:44.867568 2026] [proxy_fcgi:error] [pid 20529:tid 20563] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:45.077979 2026] [proxy_fcgi:error] [pid 20529:tid 20566] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:45.319840 2026] [proxy_fcgi:error] [pid 20529:tid 20565] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:45.532341 2026] [proxy_fcgi:error] [pid 20529:tid 20574] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:45.754521 2026] [proxy_fcgi:error] [pid 20529:tid 20568] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:46.609968 2026] [proxy_fcgi:error] [pid 20529:tid 20572] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:46.826909 2026] [proxy_fcgi:error] [pid 20529:tid 20601] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:47.043081 2026] [proxy_fcgi:error] [pid 20529:tid 20589] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:47.252952 2026] [proxy_fcgi:error] [pid 20529:tid 20564] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:47.467225 2026] [proxy_fcgi:error] [pid 20529:tid 20587] [client 20.220.13.10:32652] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:29:47.672904 2026] [:error] [pid 20529:tid 20580] [client 20.220.13.10:32652] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "abKxu24BhuYHZriajQ-BkAAAA00"]
[Thu Mar 12 20:29:48.502577 2026] [:error] [pid 11986:tid 12032] [client 20.220.13.10:26828] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "abKxvDKqY2w-DVCrxTAQQAAAAc4"]
[Thu Mar 12 20:29:49.923410 2026] [:error] [pid 51456:tid 51494] [client 20.220.13.10:16520] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "abKxvRXu8LzVixNGr0tslgAAAEc"]
[Thu Mar 12 20:29:52.609973 2026] [:error] [pid 8249:tid 8269] [client 20.220.13.10:4638] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "abKxwCK5dL3-8Jdf0M1L8wAAARI"]
[Thu Mar 12 20:29:55.463817 2026] [:error] [pid 8249:tid 8273] [client 20.220.13.10:32155] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "abKxwyK5dL3-8Jdf0M1L9gAAARY"]
[Thu Mar 12 20:29:57.673786 2026] [:error] [pid 11953:tid 11973] [client 20.220.13.10:26854] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "abKxxZudzqsnq3bvtDY5pgAAAVI"]
[Thu Mar 12 20:29:59.876625 2026] [:error] [pid 20528:tid 20548] [client 20.220.13.10:4633] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "abKxx6nDNsf46-tKxqkQ7wAAAw4"]
[Thu Mar 12 20:30:01.692840 2026] [:error] [pid 11986:tid 12034] [client 20.220.13.10:4665] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "abKxyTKqY2w-DVCrxTAQVQAAAdA"]
[Thu Mar 12 20:30:02.786365 2026] [:error] [pid 20467:tid 20490] [client 20.220.13.10:32161] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "abKxynJ3UvosyIqy8ayjTwAAApQ"]
[Thu Mar 12 20:30:03.732983 2026] [:error] [pid 11953:tid 11963] [client 20.220.13.10:21184] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "abKxy5udzqsnq3bvtDY5rgAAAUg"]
[Thu Mar 12 20:30:04.579861 2026] [:error] [pid 8249:tid 8264] [client 20.220.13.10:21234] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "abKxzCK5dL3-8Jdf0M1MAAAAAQ0"]
[Thu Mar 12 20:30:05.407566 2026] [:error] [pid 8249:tid 8254] [client 20.220.13.10:32130] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "abKxzSK5dL3-8Jdf0M1MCAAAAQM"]
[Thu Mar 12 20:30:07.366607 2026] [:error] [pid 11953:tid 11962] [client 20.220.13.10:32679] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hckpe.php"] [unique_id "abKxz5udzqsnq3bvtDY5sAAAAUc"]
[Thu Mar 12 20:30:08.196065 2026] [:error] [pid 51456:tid 51497] [client 20.220.13.10:4612] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hckpe.php"] [unique_id "abKx0BXu8LzVixNGr0tspQAAAEo"]
[Thu Mar 12 20:30:09.216607 2026] [:error] [pid 51457:tid 51531] [client 20.220.13.10:26839] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hckpe.php"] [unique_id "abKx0Sjknw2FvT4H3Da_8gAAAJE"]
[Thu Mar 12 20:30:09.833426 2026] [:error] [pid 20528:tid 20547] [client 20.220.13.10:21203] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hckpe.php"] [unique_id "abKx0anDNsf46-tKxqkQ8gAAAw0"]
[Thu Mar 12 20:30:10.484949 2026] [:error] [pid 8249:tid 8251] [client 20.220.13.10:21184] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ht.php"] [unique_id "abKx0iK5dL3-8Jdf0M1MIwAAAQA"]
[Thu Mar 12 20:30:11.866738 2026] [:error] [pid 20528:tid 20557] [client 20.220.13.10:32642] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ht.php"] [unique_id "abKx06nDNsf46-tKxqkQ8wAAAxc"]
[Thu Mar 12 20:30:13.403966 2026] [:error] [pid 8249:tid 8254] [client 20.220.13.10:17099] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ht.php"] [unique_id "abKx1SK5dL3-8Jdf0M1MLAAAAQM"]
[Thu Mar 12 20:30:15.207951 2026] [:error] [pid 51457:tid 51529] [client 20.220.13.10:19302] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ht.php"] [unique_id "abKx1yjknw2FvT4H3Da_-gAAAI8"]
[Thu Mar 12 20:30:16.042169 2026] [:error] [pid 51457:tid 51537] [client 20.220.13.10:16533] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "abKx2Cjknw2FvT4H3Da__gAAAJc"]
[Thu Mar 12 20:30:16.962761 2026] [:error] [pid 20528:tid 20545] [client 20.220.13.10:32136] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "abKx2KnDNsf46-tKxqkQ-gAAAws"]
[Thu Mar 12 20:30:17.856463 2026] [:error] [pid 11986:tid 12042] [client 20.220.13.10:21185] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "abKx2TKqY2w-DVCrxTAQWwAAAdg"]
[Thu Mar 12 20:30:18.378730 2026] [:error] [pid 8249:tid 8261] [client 20.220.13.10:32145] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "abKx2iK5dL3-8Jdf0M1MMQAAAQo"]
[Thu Mar 12 20:30:19.332676 2026] [:error] [pid 11986:tid 12041] [client 20.220.13.10:21195] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog.php"] [unique_id "abKx2zKqY2w-DVCrxTAQXgAAAdc"]
[Thu Mar 12 20:30:20.426906 2026] [:error] [pid 11986:tid 12022] [client 20.220.13.10:16541] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog.php"] [unique_id "abKx3DKqY2w-DVCrxTAQYQAAAcQ"]
[Thu Mar 12 20:30:21.317116 2026] [:error] [pid 11986:tid 12030] [client 20.220.13.10:38967] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog.php"] [unique_id "abKx3TKqY2w-DVCrxTAQZgAAAcw"]
[Thu Mar 12 20:30:22.335278 2026] [:error] [pid 11953:tid 11975] [client 20.220.13.10:21206] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog.php"] [unique_id "abKx3pudzqsnq3bvtDY5xwAAAVQ"]
[Thu Mar 12 20:30:23.214530 2026] [:error] [pid 20530:tid 20606] [client 20.220.13.10:44629] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "abKx3wkNGxMzPO-s9qcKMAAAA5E"]
[Thu Mar 12 20:30:24.142679 2026] [:error] [pid 11953:tid 11962] [client 20.220.13.10:38935] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "abKx4Judzqsnq3bvtDY5ygAAAUc"]
[Thu Mar 12 20:30:24.941777 2026] [:error] [pid 11986:tid 12019] [client 20.220.13.10:17129] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "abKx4DKqY2w-DVCrxTAQcAAAAcE"]
[Thu Mar 12 20:30:26.013402 2026] [:error] [pid 8249:tid 8260] [client 20.220.13.10:21201] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "abKx4iK5dL3-8Jdf0M1MOgAAAQk"]
[Thu Mar 12 20:30:28.205477 2026] [:error] [pid 11986:tid 12026] [client 20.220.13.10:38942] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abKx5DKqY2w-DVCrxTAQdQAAAcg"]
[Thu Mar 12 20:30:29.780049 2026] [:error] [pid 8249:tid 8260] [client 20.220.13.10:26830] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abKx5SK5dL3-8Jdf0M1MRwAAAQk"]
[Thu Mar 12 20:30:31.314049 2026] [:error] [pid 8249:tid 8271] [client 20.220.13.10:21241] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abKx5yK5dL3-8Jdf0M1MSwAAARQ"]
[Thu Mar 12 20:30:32.319473 2026] [:error] [pid 20531:tid 20618] [client 20.220.13.10:17115] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abKx6Pvw-RvNQd9b3a-t_QAAA8I"]
[Thu Mar 12 20:30:33.033172 2026] [:error] [pid 20529:tid 20591] [client 20.220.13.10:16535] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "abKx6W4BhuYHZriajQ-BnAAAA1M"]
[Thu Mar 12 20:30:33.993719 2026] [:error] [pid 20531:tid 20635] [client 20.220.13.10:55799] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "abKx6fvw-RvNQd9b3a-uAQAAA9M"]
[Thu Mar 12 20:30:35.151789 2026] [:error] [pid 20467:tid 20470] [client 20.220.13.10:26842] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "abKx63J3UvosyIqy8ayjXAAAAoA"]
[Thu Mar 12 20:30:36.211111 2026] [:error] [pid 11953:tid 11955] [client 20.220.13.10:38932] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "abKx7Judzqsnq3bvtDY5zAAAAUA"]
[Thu Mar 12 20:30:37.834684 2026] [:error] [pid 11986:tid 12022] [client 20.220.13.10:32644] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sqaoi.php"] [unique_id "abKx7TKqY2w-DVCrxTAQeAAAAcQ"]
[Thu Mar 12 20:30:41.045909 2026] [:error] [pid 11953:tid 11955] [client 20.220.13.10:44612] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sqaoi.php"] [unique_id "abKx8Zudzqsnq3bvtDY51wAAAUA"]
[Thu Mar 12 20:30:43.697577 2026] [:error] [pid 8249:tid 8275] [client 20.220.13.10:17110] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sqaoi.php"] [unique_id "abKx8yK5dL3-8Jdf0M1MawAAARg"]
[Thu Mar 12 20:30:44.878668 2026] [:error] [pid 11986:tid 12036] [client 20.220.13.10:38926] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sqaoi.php"] [unique_id "abKx9DKqY2w-DVCrxTAQgwAAAdI"]
[Thu Mar 12 20:30:45.971042 2026] [:error] [pid 11953:tid 11967] [client 20.220.13.10:44670] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "abKx9Zudzqsnq3bvtDY54AAAAUw"]
[Thu Mar 12 20:30:47.737002 2026] [proxy_fcgi:error] [pid 8249:tid 8258] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:47.948846 2026] [proxy_fcgi:error] [pid 8249:tid 8255] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:48.162689 2026] [proxy_fcgi:error] [pid 8249:tid 8266] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:48.403861 2026] [proxy_fcgi:error] [pid 8249:tid 8271] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:48.617873 2026] [proxy_fcgi:error] [pid 8249:tid 8275] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:48.826897 2026] [proxy_fcgi:error] [pid 8249:tid 8251] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:49.075764 2026] [proxy_fcgi:error] [pid 8249:tid 8273] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:49.295781 2026] [proxy_fcgi:error] [pid 8249:tid 8260] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:49.504501 2026] [proxy_fcgi:error] [pid 8249:tid 8257] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:49.713538 2026] [proxy_fcgi:error] [pid 8249:tid 8255] [client 20.220.13.10:22134] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:30:49.930672 2026] [:error] [pid 8249:tid 8256] [client 20.220.13.10:22134] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "abKx-SK5dL3-8Jdf0M1MhwAAAQU"]
[Thu Mar 12 20:30:51.468417 2026] [:error] [pid 8249:tid 8268] [client 20.220.13.10:19278] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "abKx-yK5dL3-8Jdf0M1MiwAAARE"]
[Thu Mar 12 20:30:52.201519 2026] [:error] [pid 8249:tid 8267] [client 20.220.13.10:38943] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "abKx_CK5dL3-8Jdf0M1MkgAAARA"]
[Thu Mar 12 20:30:53.063918 2026] [:error] [pid 11986:tid 12035] [client 20.220.13.10:22119] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "abKx_TKqY2w-DVCrxTAQiwAAAdE"]
[Thu Mar 12 20:30:54.380098 2026] [:error] [pid 8249:tid 8266] [client 20.220.13.10:38914] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "abKx_iK5dL3-8Jdf0M1MlgAAAQ8"]
[Thu Mar 12 20:30:55.399808 2026] [:error] [pid 8249:tid 8251] [client 20.220.13.10:4644] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "abKx_yK5dL3-8Jdf0M1MmwAAAQA"]
[Thu Mar 12 20:30:56.353115 2026] [:error] [pid 8249:tid 8270] [client 20.220.13.10:44633] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "abKyACK5dL3-8Jdf0M1MnwAAARM"]
[Thu Mar 12 20:30:57.206865 2026] [:error] [pid 8249:tid 8271] [client 20.220.13.10:17107] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "abKyASK5dL3-8Jdf0M1MowAAARQ"]
[Thu Mar 12 20:30:58.307714 2026] [:error] [pid 11986:tid 12035] [client 20.220.13.10:32642] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kllib.php"] [unique_id "abKyAjKqY2w-DVCrxTAQlgAAAdE"]
[Thu Mar 12 20:31:00.199842 2026] [:error] [pid 20530:tid 20607] [client 20.220.13.10:44667] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kllib.php"] [unique_id "abKyBAkNGxMzPO-s9qcKOQAAA5I"]
[Thu Mar 12 20:31:01.439731 2026] [:error] [pid 51457:tid 51515] [client 20.220.13.10:22099] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kllib.php"] [unique_id "abKyBSjknw2FvT4H3DbAOgAAAIE"]
[Thu Mar 12 20:31:02.474807 2026] [:error] [pid 8249:tid 8264] [client 20.220.13.10:19272] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kllib.php"] [unique_id "abKyBiK5dL3-8Jdf0M1MrwAAAQ0"]
[Thu Mar 12 20:31:03.886893 2026] [:error] [pid 8249:tid 8260] [client 20.220.13.10:38933] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aki.php"] [unique_id "abKyByK5dL3-8Jdf0M1MsgAAAQk"]
[Thu Mar 12 20:31:05.067608 2026] [:error] [pid 8249:tid 8252] [client 20.220.13.10:32661] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aki.php"] [unique_id "abKyCSK5dL3-8Jdf0M1MtAAAAQE"]
[Thu Mar 12 20:31:06.896887 2026] [:error] [pid 51457:tid 51533] [client 20.220.13.10:32184] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aki.php"] [unique_id "abKyCijknw2FvT4H3DbARgAAAJM"]
[Thu Mar 12 20:31:08.689423 2026] [:error] [pid 11986:tid 12020] [client 20.220.13.10:32178] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aki.php"] [unique_id "abKyDDKqY2w-DVCrxTAQqAAAAcI"]
[Thu Mar 12 20:31:10.325487 2026] [:error] [pid 8249:tid 8273] [client 20.220.13.10:26819] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "abKyDiK5dL3-8Jdf0M1MvAAAARY"]
[Thu Mar 12 20:31:11.594865 2026] [:error] [pid 11953:tid 11974] [client 20.220.13.10:16561] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "abKyD5udzqsnq3bvtDY6DgAAAVM"]
[Thu Mar 12 20:31:12.738413 2026] [:error] [pid 11953:tid 11968] [client 20.220.13.10:16539] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "abKyEJudzqsnq3bvtDY6EgAAAU0"]
[Thu Mar 12 20:31:13.784953 2026] [:error] [pid 8249:tid 8259] [client 20.220.13.10:26858] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "abKyESK5dL3-8Jdf0M1MxQAAAQg"]
[Thu Mar 12 20:31:16.174435 2026] [:error] [pid 8249:tid 8255] [client 20.220.13.10:26877] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "abKyFCK5dL3-8Jdf0M1MyQAAAQQ"]
[Thu Mar 12 20:31:19.273711 2026] [:error] [pid 11953:tid 11956] [client 20.220.13.10:21233] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "abKyF5udzqsnq3bvtDY6KQAAAUE"]
[Thu Mar 12 20:31:21.105705 2026] [:error] [pid 11953:tid 11955] [client 20.220.13.10:16567] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "abKyGZudzqsnq3bvtDY6MgAAAUA"]
[Thu Mar 12 20:31:22.985922 2026] [:error] [pid 20467:tid 20494] [client 20.220.13.10:4668] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "abKyGnJ3UvosyIqy8ayjbAAAApg"]
[Thu Mar 12 20:31:24.250588 2026] [:error] [pid 20467:tid 20484] [client 20.220.13.10:32162] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "abKyHHJ3UvosyIqy8ayjbQAAAo4"]
[Thu Mar 12 20:31:26.223789 2026] [:error] [pid 51456:tid 51507] [client 20.220.13.10:4619] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "abKyHhXu8LzVixNGr0ts2QAAAFQ"]
[Thu Mar 12 20:31:28.273688 2026] [:error] [pid 20529:tid 20597] [client 20.220.13.10:32646] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "abKyIG4BhuYHZriajQ-BowAAA1Y"]
[Thu Mar 12 20:31:30.138854 2026] [:error] [pid 11986:tid 12041] [client 20.220.13.10:19286] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "abKyIjKqY2w-DVCrxTAQxgAAAdc"]
[Thu Mar 12 20:31:32.061077 2026] [:error] [pid 11986:tid 12030] [client 20.220.13.10:38965] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "abKyJDKqY2w-DVCrxTAQygAAAcw"]
[Thu Mar 12 20:31:36.565900 2026] [:error] [pid 11953:tid 11969] [client 20.220.13.10:44664] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "abKyKJudzqsnq3bvtDY6OgAAAU4"]
[Thu Mar 12 20:31:38.005653 2026] [:error] [pid 11953:tid 11970] [client 20.220.13.10:19312] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "abKyKpudzqsnq3bvtDY6PQAAAU8"]
[Thu Mar 12 20:31:41.525539 2026] [:error] [pid 11953:tid 11972] [client 20.220.13.10:19325] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "abKyLZudzqsnq3bvtDY6VgAAAVE"]
[Thu Mar 12 20:31:46.545692 2026] [:error] [pid 20531:tid 20621] [client 20.220.13.10:19295] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/44.php"] [unique_id "abKyMvvw-RvNQd9b3a-uDwAAA8U"]
[Thu Mar 12 20:31:49.823042 2026] [proxy_fcgi:error] [pid 8249:tid 8267] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:50.069437 2026] [proxy_fcgi:error] [pid 8249:tid 8265] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:50.330149 2026] [proxy_fcgi:error] [pid 8249:tid 8254] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:50.566946 2026] [proxy_fcgi:error] [pid 8249:tid 8266] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:50.785830 2026] [proxy_fcgi:error] [pid 8249:tid 8256] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:51.034183 2026] [proxy_fcgi:error] [pid 8249:tid 8274] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:51.283507 2026] [proxy_fcgi:error] [pid 8249:tid 8260] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:51.504560 2026] [proxy_fcgi:error] [pid 8249:tid 8269] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:51.758850 2026] [proxy_fcgi:error] [pid 8249:tid 8267] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:52.004255 2026] [proxy_fcgi:error] [pid 8249:tid 8257] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:56.882914 2026] [proxy_fcgi:error] [pid 8249:tid 8260] [client 20.220.13.10:17133] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:31:57.090396 2026] [:error] [pid 8249:tid 8259] [client 20.220.13.10:17133] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_e76a.php"] [unique_id "abKyPSK5dL3-8Jdf0M1NBgAAAQg"]
[Thu Mar 12 20:32:12.865706 2026] [:error] [pid 51456:tid 51498] [client 20.220.13.10:38936] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_e76a.php"] [unique_id "abKyTBXu8LzVixNGr0ts-wAAAEs"]
[Thu Mar 12 20:32:25.749221 2026] [:error] [pid 8249:tid 8274] [client 20.220.13.10:26822] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_0cc5.php"] [unique_id "abKyWSK5dL3-8Jdf0M1NIQAAARc"]
[Thu Mar 12 20:32:46.611143 2026] [:error] [pid 8249:tid 8274] [client 20.220.13.10:17106] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "abKybiK5dL3-8Jdf0M1NhgAAARc"]
[Thu Mar 12 20:33:39.435214 2026] [proxy_fcgi:error] [pid 51457:tid 51523] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:39.644034 2026] [proxy_fcgi:error] [pid 51457:tid 51524] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:39.894866 2026] [proxy_fcgi:error] [pid 51457:tid 51528] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:40.132614 2026] [proxy_fcgi:error] [pid 51457:tid 51516] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:40.392660 2026] [proxy_fcgi:error] [pid 51457:tid 51518] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:40.638717 2026] [proxy_fcgi:error] [pid 51457:tid 51530] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:40.856031 2026] [proxy_fcgi:error] [pid 51457:tid 51533] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:41.106897 2026] [proxy_fcgi:error] [pid 51457:tid 51527] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:41.316889 2026] [proxy_fcgi:error] [pid 51457:tid 51536] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:41.531469 2026] [proxy_fcgi:error] [pid 51457:tid 51537] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:41.746131 2026] [proxy_fcgi:error] [pid 51457:tid 51529] [client 20.220.13.10:35676] AH01071: Got error 'Primary script unknown'
[Thu Mar 12 20:33:43.059532 2026] [:error] [pid 51457:tid 51526] [client 20.220.13.10:35676] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbmfx.php"] [unique_id "abKypyjknw2FvT4H3DbAzgAAAIw"]
[Thu Mar 12 20:33:45.069968 2026] [:error] [pid 11953:tid 11960] [client 20.220.13.10:16529] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbmfx.php"] [unique_id "abKyqZudzqsnq3bvtDY67gAAAUU"]
[Thu Mar 12 20:33:46.160129 2026] [:error] [pid 8249:tid 8262] [client 20.220.13.10:19273] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbmfx.php"] [unique_id "abKyqiK5dL3-8Jdf0M1OyAAAAQs"]
[Thu Mar 12 20:33:46.815671 2026] [:error] [pid 20529:tid 20582] [client 20.220.13.10:32670] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbmfx.php"] [unique_id "abKyqm4BhuYHZriajQ-B4gAAA04"]
[Thu Mar 12 20:33:47.439718 2026] [:error] [pid 20528:tid 20549] [client 20.220.13.10:17141] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rqiup.php"] [unique_id "abKyq6nDNsf46-tKxqkRZgAAAw8"]
[Thu Mar 12 20:33:48.401949 2026] [:error] [pid 20530:tid 20594] [client 20.220.13.10:19318] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rqiup.php"] [unique_id "abKyrAkNGxMzPO-s9qcKZgAAA4o"]
[Thu Mar 12 20:33:49.097801 2026] [:error] [pid 20529:tid 20565] [client 20.220.13.10:4629] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rqiup.php"] [unique_id "abKyrW4BhuYHZriajQ-B4wAAA0M"]
[Thu Mar 12 20:33:50.163652 2026] [:error] [pid 11953:tid 11958] [client 20.220.13.10:17144] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rqiup.php"] [unique_id "abKyrpudzqsnq3bvtDY7BgAAAUM"]
[Thu Mar 12 20:33:51.238294 2026] [:error] [pid 11986:tid 12036] [client 20.220.13.10:17114] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swqjx.php"] [unique_id "abKyrzKqY2w-DVCrxTASEgAAAdI"]
[Thu Mar 12 20:33:52.101638 2026] [:error] [pid 11953:tid 11971] [client 20.220.13.10:19266] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swqjx.php"] [unique_id "abKysJudzqsnq3bvtDY7EQAAAVA"]
[Thu Mar 12 20:33:52.775333 2026] [:error] [pid 11953:tid 11957] [client 20.220.13.10:44648] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swqjx.php"] [unique_id "abKysJudzqsnq3bvtDY7FwAAAUI"]
[Thu Mar 12 20:33:53.457881 2026] [:error] [pid 20530:tid 20606] [client 20.220.13.10:32146] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swqjx.php"] [unique_id "abKysQkNGxMzPO-s9qcKZwAAA5E"]
[Thu Mar 12 20:33:54.461195 2026] [:error] [pid 11953:tid 11975] [client 20.220.13.10:21192] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfv7ys.php"] [unique_id "abKyspudzqsnq3bvtDY7HQAAAVQ"]
[Thu Mar 12 20:33:55.320123 2026] [:error] [pid 11953:tid 11976] [client 20.220.13.10:32659] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfv7ys.php"] [unique_id "abKys5udzqsnq3bvtDY7IQAAAVU"]
[Thu Mar 12 20:33:56.363123 2026] [:error] [pid 20467:tid 20484] [client 20.220.13.10:4636] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfv7ys.php"] [unique_id "abKytHJ3UvosyIqy8ayjpgAAAo4"]
[Thu Mar 12 20:33:57.241763 2026] [:error] [pid 51457:tid 51524] [client 20.220.13.10:26847] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfv7ys.php"] [unique_id "abKytSjknw2FvT4H3DbA1wAAAIo"]
[Thu Mar 12 20:33:57.931970 2026] [:error] [pid 8249:tid 8259] [client 20.220.13.10:16550] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jxhre.php"] [unique_id "abKytSK5dL3-8Jdf0M1O6QAAAQg"]
[Thu Mar 12 20:33:58.872820 2026] [:error] [pid 20467:tid 20475] [client 20.220.13.10:19301] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jxhre.php"] [unique_id "abKytnJ3UvosyIqy8ayjqQAAAoU"]
[Thu Mar 12 20:33:59.616617 2026] [:error] [pid 20530:tid 20598] [client 20.220.13.10:55766] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jxhre.php"] [unique_id "abKytwkNGxMzPO-s9qcKcAAAA4w"]
[Thu Mar 12 20:34:00.481453 2026] [:error] [pid 8249:tid 8271] [client 20.220.13.10:44641] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jxhre.php"] [unique_id "abKyuCK5dL3-8Jdf0M1O7wAAARQ"]
[Thu Mar 12 20:34:01.374194 2026] [:error] [pid 11986:tid 12039] [client 20.220.13.10:32135] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjne.php"] [unique_id "abKyuTKqY2w-DVCrxTASIwAAAdU"]
[Thu Mar 12 20:34:02.178993 2026] [:error] [pid 11986:tid 12037] [client 20.220.13.10:26839] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjne.php"] [unique_id "abKyujKqY2w-DVCrxTASJQAAAdM"]
[Thu Mar 12 20:34:03.196834 2026] [:error] [pid 20530:tid 20605] [client 20.220.13.10:32660] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjne.php"] [unique_id "abKyuwkNGxMzPO-s9qcKdAAAA5A"]
[Thu Mar 12 20:34:04.414692 2026] [:error] [pid 11986:tid 12029] [client 20.220.13.10:55772] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjne.php"] [unique_id "abKyvDKqY2w-DVCrxTASMQAAAcs"]
[Thu Mar 12 20:34:05.725277 2026] [:error] [pid 51456:tid 51501] [client 20.220.13.10:4626] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvlje.php"] [unique_id "abKyvRXu8LzVixNGr0ttiAAAAE4"]
[Thu Mar 12 20:34:06.635176 2026] [:error] [pid 20531:tid 20619] [client 20.220.13.10:19294] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvlje.php"] [unique_id "abKyvvvw-RvNQd9b3a-uZQAAA8M"]
[Thu Mar 12 20:34:07.638714 2026] [:error] [pid 11986:tid 12041] [client 20.220.13.10:32675] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvlje.php"] [unique_id "abKyvzKqY2w-DVCrxTASNgAAAdc"]
[Thu Mar 12 20:34:09.314935 2026] [:error] [pid 8249:tid 8274] [client 20.220.13.10:22105] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvlje.php"] [unique_id "abKywSK5dL3-8Jdf0M1PDAAAARc"]
[Thu Mar 12 20:34:10.675274 2026] [:error] [pid 11953:tid 11970] [client 20.220.13.10:37878] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cqrrg.php"] [unique_id "abKywpudzqsnq3bvtDY7KQAAAU8"]
[Thu Mar 12 20:34:15.329961 2026] [:error] [pid 51457:tid 51515] [client 20.220.13.10:16564] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cqrrg.php"] [unique_id "abKyxyjknw2FvT4H3DbA5QAAAIE"]
[Thu Mar 12 20:34:20.751086 2026] [:error] [pid 11986:tid 12039] [client 20.220.13.10:19280] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cqrrg.php"] [unique_id "abKyzDKqY2w-DVCrxTASSAAAAdU"]
[Thu Mar 12 20:34:22.407855 2026] [:error] [pid 11986:tid 12036] [client 20.220.13.10:37856] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cqrrg.php"] [unique_id "abKyzjKqY2w-DVCrxTASTAAAAdI"]
[Thu Mar 12 20:34:23.745291 2026] [:error] [pid 11953:tid 11971] [client 20.220.13.10:21190] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/euhpb.php"] [unique_id "abKyz5udzqsnq3bvtDY7OQAAAVA"]
[Thu Mar 12 20:34:25.074478 2026] [:error] [pid 51457:tid 51519] [client 20.220.13.10:17108] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/euhpb.php"] [unique_id "abKy0Sjknw2FvT4H3DbA7AAAAIU"]
[Thu Mar 12 20:34:26.760893 2026] [:error] [pid 8249:tid 8270] [client 20.220.13.10:21204] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/euhpb.php"] [unique_id "abKy0iK5dL3-8Jdf0M1PNQAAARM"]
[Thu Mar 12 20:34:28.259766 2026] [:error] [pid 11986:tid 12025] [client 20.220.13.10:37861] [client 20.220.13.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/euhpb.php"] [unique_id "abKy1DKqY2w-DVCrxTASWAAAAcc"]
[Fri Mar 13 00:39:10.509943 2026] [:error] [pid 56003:tid 56022] [client 94.247.172.129:34480] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abLsLhQtM0oeMdFWe6VMhgAAANE"]
[Fri Mar 13 01:25:37.717792 2026] [:error] [pid 48029:tid 48037] [client 35.237.6.187:55972] [client 35.237.6.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "abL3EW7cFKMmtdGhPH_CgwAAAAY"]
[Fri Mar 13 04:48:16.000839 2026] [:error] [pid 61929:tid 62004] [client 43.156.232.190:53322] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abMmjzGGsow2jgUjLtw7LAAAAIA"]
[Fri Mar 13 05:13:39.557309 2026] [:error] [pid 62036:tid 62062] [client 34.82.4.253:55090] [client 34.82.4.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "abMsg7ce6g9kILuh_R7oAAAAANM"]
[Fri Mar 13 05:50:39.920878 2026] [:error] [pid 55077:tid 55080] [client 43.153.102.138:51110] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abM1L99Ul5ym4M-PlQLjmQAAAUE"]
[Fri Mar 13 07:26:34.522544 2026] [:error] [pid 44755:tid 44771] [client 195.208.50.116:50236] [client 195.208.50.116] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abNLqvONf1H0XrBFE4OT6QAAAQ4"]
[Fri Mar 13 08:13:26.478172 2026] [:error] [pid 44755:tid 44774] [client 110.166.71.39:46798] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abNWpvONf1H0XrBFE4Oe5AAAARE"]
[Fri Mar 13 08:16:11.205570 2026] [:error] [pid 61927:tid 61959] [client 45.184.68.139:29885] [client 45.184.68.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.184.68.139, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abNXS7LkK584eBa2J7XY9AAAAA0"]
[Fri Mar 13 08:16:11.221000 2026] [proxy_fcgi:error] [pid 61927:tid 61959] [client 45.184.68.139:29885] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 09:15:33.216454 2026] [:error] [pid 62036:tid 62055] [client 45.171.240.134:63591] [client 45.171.240.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.171.240.134, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abNlNbce6g9kILuh_R5BnQAAAMw"]
[Fri Mar 13 09:15:33.229338 2026] [proxy_fcgi:error] [pid 62036:tid 62055] [client 45.171.240.134:63591] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 09:50:27.577281 2026] [:error] [pid 55077:tid 55094] [client 45.131.195.117:46143] [client 45.131.195.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.117, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abNtY99Ul5ym4M-PlQJV4wAAAU8"]
[Fri Mar 13 09:50:27.601943 2026] [proxy_fcgi:error] [pid 55077:tid 55094] [client 45.131.195.117:46143] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 11:02:09.836014 2026] [:error] [pid 61929:tid 62028] [client 136.144.35.48:22843] [client 136.144.35.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.48, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abN-MTGGsow2jgUjLtyN0AAAAJg"]
[Fri Mar 13 11:02:09.848091 2026] [proxy_fcgi:error] [pid 61929:tid 62028] [client 136.144.35.48:22843] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 11:06:29.175614 2026] [:error] [pid 9309:tid 9331] [client 43.153.58.28:55780] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abN_Nao1KEMMghNWAN9lgQAAAgg"]
[Fri Mar 13 15:07:59.195098 2026] [:error] [pid 9309:tid 9324] [client 51.77.216.36:54352] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "abO3z6o1KEMMghNWAN_buwAAAgE"]
[Fri Mar 13 15:08:02.912808 2026] [:error] [pid 61929:tid 62013] [client 51.77.216.36:49216] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "abO30jGGsow2jgUjLtyb2gAAAIk"]
[Fri Mar 13 17:05:39.072248 2026] [:error] [pid 9311:tid 9365] [client 43.157.147.3:37764] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abPTY1TiCkU4QLmYwPkVPgAAAk4"]
[Fri Mar 13 20:51:43.838182 2026] [:error] [pid 61929:tid 62004] [client 180.153.236.85:54049] [client 180.153.236.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abQIXzGGsow2jgUjLtyz-AAAAIA"], referer: http://www.switchcreative.net/
[Fri Mar 13 22:36:08.846840 2026] [:error] [pid 9309:tid 9342] [client 167.17.66.82:51325] [client 167.17.66.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.17.66.82, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abQg2Ko1KEMMghNWAN9UqAAAAhM"]
[Fri Mar 13 22:36:08.859811 2026] [proxy_fcgi:error] [pid 9309:tid 9342] [client 167.17.66.82:51325] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 22:38:09.914643 2026] [:error] [pid 60436:tid 60482] [client 43.135.144.81:44888] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abQhUYI3PEddCArY1AanTwAAAw0"]
[Fri Mar 13 22:39:41.773849 2026] [:error] [pid 60497:tid 60556] [client 45.215.237.33:19620] [client 45.215.237.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.215.237.33, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abQhrRjNYgapWlkb4ljFOwAAA5g"]
[Fri Mar 13 22:39:41.785716 2026] [proxy_fcgi:error] [pid 60497:tid 60556] [client 45.215.237.33:19620] AH01071: Got error 'Primary script unknown'
[Fri Mar 13 23:37:36.077980 2026] [:error] [pid 9311:tid 9358] [client 43.157.22.57:57424] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abQvQFTiCkU4QLmYwPlExgAAAkc"]
[Sat Mar 14 00:58:05.867445 2026] [proxy_fcgi:error] [pid 47905:tid 48006] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:06.077811 2026] [proxy_fcgi:error] [pid 47905:tid 48001] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:06.289935 2026] [proxy_fcgi:error] [pid 47905:tid 48007] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:06.501529 2026] [proxy_fcgi:error] [pid 47905:tid 48017] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:06.711727 2026] [proxy_fcgi:error] [pid 47905:tid 48016] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:06.923731 2026] [proxy_fcgi:error] [pid 47905:tid 48013] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:07.134165 2026] [proxy_fcgi:error] [pid 47905:tid 47994] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:07.344724 2026] [proxy_fcgi:error] [pid 47905:tid 47999] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:07.554785 2026] [proxy_fcgi:error] [pid 47905:tid 48008] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:07.766162 2026] [proxy_fcgi:error] [pid 47905:tid 48012] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:07.979310 2026] [proxy_fcgi:error] [pid 47905:tid 48004] [client 20.151.4.179:35969] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 00:58:08.185723 2026] [:error] [pid 47905:tid 48006] [client 20.151.4.179:35969] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chati.php"] [unique_id "abRCIBaYZayP4o4wpJcVNgAAAU0"]
[Sat Mar 14 00:58:09.030971 2026] [:error] [pid 48070:tid 48090] [client 20.151.4.179:36017] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chati.php"] [unique_id "abRCIUIvrhMS5BVHxNkJDAAAABI"]
[Sat Mar 14 00:58:09.861737 2026] [:error] [pid 48070:tid 48077] [client 20.151.4.179:36009] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chati.php"] [unique_id "abRCIUIvrhMS5BVHxNkJEQAAAAU"]
[Sat Mar 14 00:58:10.690726 2026] [:error] [pid 48070:tid 48086] [client 20.151.4.179:36013] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chati.php"] [unique_id "abRCIkIvrhMS5BVHxNkJFQAAAA4"]
[Sat Mar 14 01:17:44.047069 2026] [proxy_fcgi:error] [pid 47905:tid 48016] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:44.264095 2026] [proxy_fcgi:error] [pid 47905:tid 48003] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:44.487622 2026] [proxy_fcgi:error] [pid 47905:tid 47994] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:44.726934 2026] [proxy_fcgi:error] [pid 47905:tid 48012] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:44.945063 2026] [proxy_fcgi:error] [pid 47905:tid 47999] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:45.157628 2026] [proxy_fcgi:error] [pid 47905:tid 48000] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:45.381828 2026] [proxy_fcgi:error] [pid 47905:tid 48001] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:45.590908 2026] [proxy_fcgi:error] [pid 47905:tid 48014] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:45.799973 2026] [proxy_fcgi:error] [pid 47905:tid 48016] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:46.015466 2026] [proxy_fcgi:error] [pid 47905:tid 48003] [client 4.204.197.4:18333] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:17:46.225476 2026] [:error] [pid 47905:tid 48007] [client 4.204.197.4:18333] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "abRGuhaYZayP4o4wpJce5gAAAU4"]
[Sat Mar 14 01:17:46.745123 2026] [:error] [pid 48070:tid 48074] [client 4.204.197.4:18351] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "abRGukIvrhMS5BVHxNkXDwAAAAI"]
[Sat Mar 14 01:17:47.160488 2026] [:error] [pid 47891:tid 47974] [client 4.204.197.4:18429] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "abRGu_chNnuMqi7I_WH0LgAAAIg"]
[Sat Mar 14 01:17:47.698801 2026] [:error] [pid 47891:tid 47970] [client 4.204.197.4:18393] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "abRGu_chNnuMqi7I_WH0MAAAAIQ"]
[Sat Mar 14 01:17:48.135613 2026] [:error] [pid 48070:tid 48089] [client 4.204.197.4:18246] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "abRGvEIvrhMS5BVHxNkXEgAAABE"]
[Sat Mar 14 01:17:48.612875 2026] [:error] [pid 47878:tid 47956] [client 4.204.197.4:18377] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "abRGvH8jymmmpr1jcBepnAAAAFE"]
[Sat Mar 14 01:17:49.054940 2026] [:error] [pid 47905:tid 47993] [client 4.204.197.4:18322] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "abRGvRaYZayP4o4wpJce-AAAAUA"]
[Sat Mar 14 01:17:49.512794 2026] [:error] [pid 47891:tid 47971] [client 4.204.197.4:18379] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "abRGvfchNnuMqi7I_WH0NwAAAIU"]
[Sat Mar 14 01:17:49.966956 2026] [:error] [pid 47878:tid 47947] [client 4.204.197.4:18417] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "abRGvX8jymmmpr1jcBepoQAAAEg"]
[Sat Mar 14 01:17:50.526039 2026] [:error] [pid 48070:tid 48083] [client 4.204.197.4:18404] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "abRGvkIvrhMS5BVHxNkXFgAAAAs"]
[Sat Mar 14 01:17:51.141029 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:18369] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "abRGv0IvrhMS5BVHxNkXGQAAABU"]
[Sat Mar 14 01:17:51.686647 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:18419] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "abRGv0IvrhMS5BVHxNkXIAAAAAY"]
[Sat Mar 14 01:17:52.294464 2026] [:error] [pid 47891:tid 47974] [client 4.204.197.4:18425] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "abRGwPchNnuMqi7I_WH0PAAAAIg"]
[Sat Mar 14 01:17:52.780262 2026] [:error] [pid 48070:tid 48088] [client 4.204.197.4:18332] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "abRGwEIvrhMS5BVHxNkXJAAAABA"]
[Sat Mar 14 01:17:53.263947 2026] [:error] [pid 48070:tid 48087] [client 4.204.197.4:18344] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "abRGwUIvrhMS5BVHxNkXKAAAAA8"]
[Sat Mar 14 01:17:53.709602 2026] [:error] [pid 47905:tid 48006] [client 4.204.197.4:18421] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "abRGwRaYZayP4o4wpJcfFQAAAU0"]
[Sat Mar 14 01:17:54.181956 2026] [:error] [pid 47905:tid 48007] [client 4.204.197.4:18405] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "abRGwhaYZayP4o4wpJcfGQAAAU4"]
[Sat Mar 14 01:17:54.662092 2026] [:error] [pid 47905:tid 48015] [client 4.204.197.4:18317] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "abRGwhaYZayP4o4wpJcfHQAAAVY"]
[Sat Mar 14 01:17:55.106937 2026] [:error] [pid 48070:tid 48075] [client 4.204.197.4:18431] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "abRGw0IvrhMS5BVHxNkXLwAAAAM"]
[Sat Mar 14 01:17:55.605448 2026] [:error] [pid 47878:tid 47962] [client 4.204.197.4:18350] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "abRGw38jymmmpr1jcBepqQAAAFc"]
[Sat Mar 14 01:17:56.244322 2026] [:error] [pid 48070:tid 48091] [client 4.204.197.4:18331] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "abRGxEIvrhMS5BVHxNkXMQAAABM"]
[Sat Mar 14 01:17:56.686117 2026] [:error] [pid 48070:tid 48085] [client 4.204.197.4:18365] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "abRGxEIvrhMS5BVHxNkXNAAAAA0"]
[Sat Mar 14 01:17:57.149217 2026] [:error] [pid 48070:tid 48089] [client 4.204.197.4:18346] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "abRGxUIvrhMS5BVHxNkXNwAAABE"]
[Sat Mar 14 01:17:57.613637 2026] [:error] [pid 47891:tid 47986] [client 4.204.197.4:18308] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "abRGxfchNnuMqi7I_WH0QQAAAJQ"]
[Sat Mar 14 01:17:58.058346 2026] [:error] [pid 47891:tid 47981] [client 4.204.197.4:18394] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "abRGxvchNnuMqi7I_WH0RQAAAI8"]
[Sat Mar 14 01:17:58.550483 2026] [:error] [pid 47878:tid 47944] [client 4.204.197.4:18323] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "abRGxn8jymmmpr1jcBeprQAAAEU"]
[Sat Mar 14 01:17:58.994559 2026] [:error] [pid 48070:tid 48080] [client 4.204.197.4:18188] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "abRGxkIvrhMS5BVHxNkXOQAAAAg"]
[Sat Mar 14 01:17:59.424934 2026] [:error] [pid 47878:tid 47945] [client 4.204.197.4:18387] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "abRGx38jymmmpr1jcBeprwAAAEY"]
[Sat Mar 14 01:17:59.841030 2026] [:error] [pid 47878:tid 47951] [client 4.204.197.4:18378] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRGx38jymmmpr1jcBepsAAAAEw"]
[Sat Mar 14 01:18:00.287487 2026] [:error] [pid 48070:tid 48073] [client 4.204.197.4:18384] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRGyEIvrhMS5BVHxNkXPgAAAAE"]
[Sat Mar 14 01:18:00.707847 2026] [:error] [pid 47878:tid 47943] [client 4.204.197.4:18327] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRGyH8jymmmpr1jcBepswAAAEQ"]
[Sat Mar 14 01:18:01.179651 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:18340] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRGyRaYZayP4o4wpJcfPgAAAVc"]
[Sat Mar 14 01:18:01.601754 2026] [:error] [pid 47905:tid 48004] [client 4.204.197.4:18418] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "abRGyRaYZayP4o4wpJcfQAAAAUs"]
[Sat Mar 14 01:18:02.020068 2026] [:error] [pid 47878:tid 47946] [client 4.204.197.4:18355] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "abRGyn8jymmmpr1jcBeptgAAAEc"]
[Sat Mar 14 01:18:02.456254 2026] [:error] [pid 47878:tid 47948] [client 4.204.197.4:18428] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "abRGyn8jymmmpr1jcBepuQAAAEk"]
[Sat Mar 14 01:18:02.871069 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:18252] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "abRGyn8jymmmpr1jcBepugAAAE0"]
[Sat Mar 14 01:18:03.322657 2026] [:error] [pid 47878:tid 47949] [client 4.204.197.4:18318] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/up.php"] [unique_id "abRGy38jymmmpr1jcBepuwAAAEo"]
[Sat Mar 14 01:18:03.751171 2026] [:error] [pid 47905:tid 48011] [client 4.204.197.4:18416] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/up.php"] [unique_id "abRGyxaYZayP4o4wpJcfRQAAAVI"]
[Sat Mar 14 01:18:04.176731 2026] [:error] [pid 47905:tid 48009] [client 4.204.197.4:18343] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/up.php"] [unique_id "abRGzBaYZayP4o4wpJcfRgAAAVA"]
[Sat Mar 14 01:18:04.611537 2026] [:error] [pid 47878:tid 47961] [client 4.204.197.4:18401] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/up.php"] [unique_id "abRGzH8jymmmpr1jcBepvwAAAFY"]
[Sat Mar 14 01:18:05.034244 2026] [:error] [pid 47878:tid 47945] [client 4.204.197.4:18399] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "abRGzX8jymmmpr1jcBepwAAAAEY"]
[Sat Mar 14 01:18:05.471824 2026] [:error] [pid 47891:tid 47978] [client 4.204.197.4:18335] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "abRGzfchNnuMqi7I_WH0YwAAAIw"]
[Sat Mar 14 01:18:05.965592 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:18336] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "abRGzRaYZayP4o4wpJcfSwAAAVc"]
[Sat Mar 14 01:18:06.467874 2026] [:error] [pid 48070:tid 48080] [client 4.204.197.4:18334] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "abRGzkIvrhMS5BVHxNkXRQAAAAg"]
[Sat Mar 14 01:58:32.013996 2026] [proxy_fcgi:error] [pid 47891:tid 47982] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:32.225665 2026] [proxy_fcgi:error] [pid 47891:tid 47988] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:32.437147 2026] [proxy_fcgi:error] [pid 47891:tid 47985] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:32.647256 2026] [proxy_fcgi:error] [pid 47891:tid 47966] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:34.168420 2026] [proxy_fcgi:error] [pid 47891:tid 47966] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:34.378705 2026] [proxy_fcgi:error] [pid 47891:tid 47981] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:34.589009 2026] [proxy_fcgi:error] [pid 47891:tid 47974] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:34.799086 2026] [proxy_fcgi:error] [pid 47891:tid 47968] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:35.223441 2026] [proxy_fcgi:error] [pid 47891:tid 47971] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:35.432623 2026] [proxy_fcgi:error] [pid 47891:tid 47985] [client 20.151.4.179:53066] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 01:58:35.638421 2026] [:error] [pid 47891:tid 47970] [client 20.151.4.179:53066] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "abRQS_chNnuMqi7I_WEFDgAAAIQ"]
[Sat Mar 14 01:58:36.465806 2026] [:error] [pid 47878:tid 47958] [client 20.151.4.179:52672] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "abRQTH8jymmmpr1jcBe0IQAAAFM"]
[Sat Mar 14 01:58:37.315033 2026] [:error] [pid 47878:tid 47951] [client 20.151.4.179:53099] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "abRQTX8jymmmpr1jcBe0IwAAAEw"]
[Sat Mar 14 01:58:38.147427 2026] [:error] [pid 47891:tid 47987] [client 20.151.4.179:53061] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "abRQTvchNnuMqi7I_WEFFgAAAJU"]
[Sat Mar 14 04:35:51.243294 2026] [:error] [pid 35801:tid 35805] [client 176.124.199.1:9046] [client 176.124.199.1] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/pdf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abR1J28tVFelXGsqbU-PsQAAAQE"]
[Sat Mar 14 04:55:08.201020 2026] [:error] [pid 3912:tid 3928] [client 106.119.167.146:39843] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abR5rMXFZBK-jpdCvTHBjQAAAAE"]
[Sat Mar 14 11:33:00.377079 2026] [:error] [pid 54132:tid 54161] [client 182.42.111.213:59486] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abTW7MMoWcZxtn8Rxy9JgAAAA1g"]
[Sat Mar 14 11:44:42.791833 2026] [:error] [pid 54017:tid 54027] [client 185.137.164.12:41731] [client 185.137.164.12] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/HEAD"] [unique_id "abTZqph88Lk5QZp0lWVz8QAAAkM"]
[Sat Mar 14 13:28:30.914001 2026] [:error] [pid 35801:tid 35818] [client 103.47.132.72:42473] [client 103.47.132.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.72, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abTx_m8tVFelXGsqbU_9DgAAAQ4"]
[Sat Mar 14 13:28:30.927262 2026] [proxy_fcgi:error] [pid 35801:tid 35818] [client 103.47.132.72:42473] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 14:53:38.675839 2026] [:error] [pid 61477:tid 61499] [client 202.141.55.232:59910] [client 202.141.55.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.141.55.232, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abUF8qcx6muYfIYRM7B08AAAAFI"]
[Sat Mar 14 14:53:38.691529 2026] [proxy_fcgi:error] [pid 61477:tid 61499] [client 202.141.55.232:59910] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 16:49:21.777604 2026] [:error] [pid 61384:tid 61462] [client 173.239.224.102:30355] [client 173.239.224.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.102, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abUhEfzibL2IYJprDHKdyQAAAdM"]
[Sat Mar 14 16:49:21.793848 2026] [proxy_fcgi:error] [pid 61384:tid 61462] [client 173.239.224.102:30355] AH01071: Got error 'Primary script unknown'
[Sat Mar 14 17:10:40.966451 2026] [:error] [pid 13151:tid 13153] [client 216.73.216.136:18161] [client 216.73.216.136] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||switchcreative.net|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "abUmENbXrXQxFzrsw40nRQAAAIA"]
[Sat Mar 14 18:34:03.270657 2026] [:error] [pid 13151:tid 13163] [client 36.41.75.167:40082] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abU5m9bXrXQxFzrsw41JVQAAAIo"]
[Sat Mar 14 22:49:57.980076 2026] [:error] [pid 58680:tid 58693] [client 49.51.47.100:37048] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abV1lZesvz6ml-XzsmVahgAAAUs"]
[Sat Mar 14 23:03:09.849650 2026] [:error] [pid 49351:tid 49374] [client 175.100.79.227:31597] [client 175.100.79.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.100.79.227, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abV4rRzAvuOUcwe0iz-B4AAAAxQ"]
[Sat Mar 14 23:03:09.865068 2026] [proxy_fcgi:error] [pid 49351:tid 49374] [client 175.100.79.227:31597] AH01071: Got error 'Primary script unknown'
[Sun Mar 15 02:03:34.420840 2026] [:error] [pid 19671:tid 19965] [client 147.45.173.79:35224] [client 147.45.173.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abWi9lu8gYYbnWVq3mUj7QAAAQA"]
[Sun Mar 15 05:06:00.457478 2026] [:error] [pid 38645:tid 38670] [client 81.213.243.19:18782] [client 81.213.243.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.213.243.19, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abXNuBFPHtsDUuVrWDZcEQAAANc"]
[Sun Mar 15 05:06:00.475398 2026] [proxy_fcgi:error] [pid 38645:tid 38670] [client 81.213.243.19:18782] AH01071: Got error 'Primary script unknown'
[Sun Mar 15 06:42:52.552590 2026] [:error] [pid 38541:tid 38615] [client 101.26.28.15:6473] [client 101.26.28.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abXkbHuOpex8jIO0jt7q4AAAAII"], referer: http://switchcreative.net/
[Sun Mar 15 07:59:48.547535 2026] [:error] [pid 38645:tid 38666] [client 122.51.236.174:44818] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abX2dBFPHtsDUuVrWDaEHwAAANM"]
[Sun Mar 15 08:13:42.995146 2026] [:error] [pid 38541:tid 38629] [client 1.204.52.35:7194] [client 1.204.52.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abX5tnuOpex8jIO0jt4GDQAAAJA"], referer: http://www.switchcreative.net/
[Sun Mar 15 10:22:19.033738 2026] [:error] [pid 38536:tid 38565] [client 209.87.169.96:45257] [client 209.87.169.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.96, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abYX2_pTEqkVJ0rBEWu_dQAAAAw"]
[Sun Mar 15 10:22:19.043163 2026] [proxy_fcgi:error] [pid 38536:tid 38565] [client 209.87.169.96:45257] AH01071: Got error 'Primary script unknown'
[Sun Mar 15 14:41:21.814102 2026] [:error] [pid 38645:tid 38651] [client 49.233.45.47:59180] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abZUkRFPHtsDUuVrWDY_XAAAAMQ"]
[Sun Mar 15 14:58:41.895858 2026] [:error] [pid 38645:tid 38649] [client 180.153.236.140:52373] [client 180.153.236.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abZYoRFPHtsDUuVrWDZHXQAAAMI"], referer: http://www.switchcreative.net/
[Sun Mar 15 16:13:18.893230 2026] [:error] [pid 45801:tid 45806] [client 104.234.53.58:50689] [client 104.234.53.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.58, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abZqHoaKHL9CTKoVzTAKYwAAAcM"]
[Sun Mar 15 16:13:18.904842 2026] [proxy_fcgi:error] [pid 45801:tid 45806] [client 104.234.53.58:50689] AH01071: Got error 'Primary script unknown'
[Sun Mar 15 19:10:07.410285 2026] [:error] [pid 45801:tid 45805] [client 43.130.102.223:43674] [client 43.130.102.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abaTj4aKHL9CTKoVzTA-DQAAAcI"]
[Sun Mar 15 21:37:11.771789 2026] [:error] [pid 38536:tid 38569] [client 192.144.148.122:45724] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aba2B_pTEqkVJ0rBEWsRkgAAABA"]
[Sun Mar 15 21:58:52.882487 2026] [:error] [pid 50986:tid 50990] [client 136.232.89.206:52362] [client 136.232.89.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.89.206, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aba7HCknK4c779bcQqHzeAAAAUI"]
[Sun Mar 15 21:58:52.893945 2026] [proxy_fcgi:error] [pid 50986:tid 50990] [client 136.232.89.206:52362] AH01071: Got error 'Primary script unknown'
[Mon Mar 16 00:08:56.069482 2026] [:error] [pid 9995:tid 10014] [client 104.28.214.113:16504] [client 104.28.214.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "abbZmAa8xkcaSmgTbwiyMwAAARA"]
[Mon Mar 16 00:08:56.498451 2026] [:error] [pid 38536:tid 38564] [client 104.28.246.112:15522] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/style.php"] [unique_id "abbZmPpTEqkVJ0rBEWseBQAAAAs"]
[Mon Mar 16 00:08:56.927513 2026] [:error] [pid 45801:tid 45812] [client 104.28.246.112:15529] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/themes/style.php"] [unique_id "abbZmIaKHL9CTKoVzTBzbAAAAck"]
[Mon Mar 16 00:08:58.551907 2026] [:error] [pid 50986:tid 50989] [client 104.28.246.112:15536] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/style.php"] [unique_id "abbZmiknK4c779bcQqEYwAAAAUE"]
[Mon Mar 16 00:09:06.261793 2026] [:error] [pid 50986:tid 51004] [client 104.28.214.113:43480] [client 104.28.214.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style.php"] [unique_id "abbZoiknK4c779bcQqEY8gAAAU8"]
[Mon Mar 16 00:09:06.972375 2026] [:error] [pid 38645:tid 38648] [client 104.28.246.112:26832] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "abbZohFPHtsDUuVrWDYOmgAAAME"]
[Mon Mar 16 02:08:49.250713 2026] [:error] [pid 60666:tid 60776] [client 189.85.172.12:34932] [client 189.85.172.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.85.172.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abb1sRLlrGpRCJDg8VLwxAAAABg"]
[Mon Mar 16 02:08:49.262697 2026] [proxy_fcgi:error] [pid 60666:tid 60776] [client 189.85.172.12:34932] AH01071: Got error 'Primary script unknown'
[Mon Mar 16 02:08:58.478676 2026] [:error] [pid 23458:tid 23462] [client 49.36.223.248:63090] [client 49.36.223.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.223.248, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abb1ug4cKIHVuOkxhhofXAAAAQI"]
[Mon Mar 16 02:08:58.484157 2026] [proxy_fcgi:error] [pid 23458:tid 23462] [client 49.36.223.248:63090] AH01071: Got error 'Primary script unknown'
[Mon Mar 16 04:25:49.885529 2026] [:error] [pid 62427:tid 62452] [client 36.111.67.189:39063] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abcVzcUPP8fzo6XzJCUCQgAAAAs"]
[Mon Mar 16 05:59:31.169470 2026] [:error] [pid 62428:tid 62491] [client 43.135.185.59:39546] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abcrw6rHSRXFZx1-aIHbMwAAAFY"]
[Mon Mar 16 07:02:28.742563 2026] [:error] [pid 62429:tid 62508] [client 203.188.168.28:56437] [client 203.188.168.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.28, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abc6hFewIPukhLCowEHdEgAAAIw"]
[Mon Mar 16 07:02:28.742635 2026] [:error] [pid 62429:tid 62508] [client 203.188.168.28:56437] [client 203.188.168.28] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 203.188.168.28 on wp-login.php, counter = 18"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abc6hFewIPukhLCowEHdEgAAAIw"]
[Mon Mar 16 08:29:10.720920 2026] [:error] [pid 52152:tid 52166] [client 103.65.237.124:56864] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "abdO1sA6rS_GLRd0NKWQ0AAAAQs"]
[Mon Mar 16 10:49:35.240671 2026] [:error] [pid 62119:tid 62125] [client 182.43.70.143:37894] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abdvvz-Co-Fir-PyAwfKuAAAAMM"]
[Mon Mar 16 11:05:11.313459 2026] [:error] [pid 62026:tid 62095] [client 173.239.236.107:55045] [client 173.239.236.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.239.236.107, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abdzZ-8oW52PUIYI2O4LKAAAAIk"]
[Mon Mar 16 11:05:11.359304 2026] [proxy_fcgi:error] [pid 62026:tid 62095] [client 173.239.236.107:55045] AH01071: Got error 'Primary script unknown'
[Mon Mar 16 11:05:12.153863 2026] [:error] [pid 62026:tid 62096] [client 173.239.236.107:55045] [client 173.239.236.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "abdzaO8oW52PUIYI2O4LTAAAAIo"]
[Mon Mar 16 12:12:39.121329 2026] [:error] [pid 62025:tid 62079] [client 43.153.73.200:41214] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abeDN-imBfLmKh7zLXMruwAAAFQ"]
[Mon Mar 16 13:40:11.473022 2026] [:error] [pid 62024:tid 62035] [client 157.51.79.143:62507] [client 157.51.79.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.51.79.143, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abeXu4k-5rtjYvjqC_qCZAAAAAY"]
[Mon Mar 16 13:40:11.484781 2026] [proxy_fcgi:error] [pid 62024:tid 62035] [client 157.51.79.143:62507] AH01071: Got error 'Primary script unknown'
[Mon Mar 16 15:37:08.639864 2026] [:error] [pid 9400:tid 9424] [client 95.182.110.57:4808] [client 95.182.110.57] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=image/png"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abezJASHzD8ZM8ddLEkZ5gAAAgg"]
[Mon Mar 16 15:37:10.836543 2026] [:error] [pid 9400:tid 9431] [client 95.182.110.57:4808] [client 95.182.110.57] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=image/png"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abezJgSHzD8ZM8ddLEkZ7gAAAg8"]
[Mon Mar 16 17:54:23.061628 2026] [:error] [pid 39154:tid 39169] [client 49.51.183.84:50956] [client 49.51.183.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfTTxgq1_qjm7J1LqvoVQAAAUw"]
[Mon Mar 16 18:47:47.582451 2026] [:error] [pid 39154:tid 39166] [client 49.51.195.195:53736] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abff0xgq1_qjm7J1LqsICgAAAUk"]
[Mon Mar 16 19:54:33.217280 2026] [:error] [pid 35838:tid 35843] [client 64.89.163.113:64172] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfveRroTe-x3JLtmo6WBAAAAAE"]
[Mon Mar 16 19:54:33.876057 2026] [:error] [pid 35838:tid 35853] [client 64.89.163.113:49775] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfveRroTe-x3JLtmo6WGwAAAAs"]
[Mon Mar 16 19:54:34.419033 2026] [:error] [pid 1871:tid 1889] [client 64.89.163.113:64711] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfvejinTnZ8uiUPekE6eAAAAZA"]
[Mon Mar 16 19:54:35.036722 2026] [:error] [pid 1871:tid 1883] [client 64.89.163.113:62792] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfvezinTnZ8uiUPekE6pgAAAYo"]
[Mon Mar 16 19:54:35.557843 2026] [:error] [pid 35839:tid 35893] [client 64.89.163.113:50530] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abfve6xyv6h8-aZrncsI-QAAAFc"]
[Mon Mar 16 22:02:43.181025 2026] [:error] [pid 36198:tid 36224] [client 172.70.248.141:12488] [client 172.70.248.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "abgNg-lL1GNckmsdWlNW6QAAARc"]
[Mon Mar 16 22:02:43.184569 2026] [:error] [pid 36198:tid 36214] [client 172.70.248.141:12484] [client 172.70.248.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "abgNg-lL1GNckmsdWlNW6gAAAQ0"]
[Mon Mar 16 22:02:43.244093 2026] [:error] [pid 36198:tid 36217] [client 172.70.248.140:10574] [client 172.70.248.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "abgNg-lL1GNckmsdWlNW7AAAARA"]
[Tue Mar 17 00:28:56.013310 2026] [:error] [pid 45652:tid 45676] [client 106.227.49.113:42592] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abgvyPeWZ4w4tc07R6ktJgAAANU"]
[Tue Mar 17 02:56:22.500308 2026] [:error] [pid 45424:tid 45563] [client 178.162.137.225:42402] [client 178.162.137.225] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/xhtml+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abhSVoBy2Qv_YY3oWK7JbwAAAFM"]
[Tue Mar 17 06:07:33.841256 2026] [:error] [pid 46020:tid 46023] [client 43.133.187.11:47510] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abh_JX-nCcd9BdzGdLf4oAAAAME"]
[Tue Mar 17 06:52:31.234431 2026] [:error] [pid 45917:tid 46005] [client 49.234.192.248:52410] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abiJrxMMhmeqL5fT_heY0QAAAJA"]
[Tue Mar 17 07:56:12.976495 2026] [:error] [pid 22541:tid 22552] [client 185.223.152.130:57573] [client 185.223.152.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.130, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abiYnKS6JNY1-CTsTA8fswAAAQY"]
[Tue Mar 17 07:56:13.017008 2026] [proxy_fcgi:error] [pid 22541:tid 22552] [client 185.223.152.130:57573] AH01071: Got error 'Primary script unknown'
[Tue Mar 17 09:18:48.836316 2026] [:error] [pid 15013:tid 15083] [client 183.171.242.202:55873] [client 183.171.242.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.171.242.202, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abir-FZc-p7DonmJmm2pogAAAgY"]
[Tue Mar 17 09:18:48.848530 2026] [proxy_fcgi:error] [pid 15013:tid 15083] [client 183.171.242.202:55873] AH01071: Got error 'Primary script unknown'
[Tue Mar 17 11:56:52.288770 2026] [:error] [pid 45916:tid 45977] [client 49.51.183.15:60264] [client 49.51.183.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abjRBLiS53PnClk_C9CZYAAAAE8"]
[Tue Mar 17 16:16:06.838112 2026] [:error] [pid 45916:tid 45973] [client 92.36.60.48:5045] [client 92.36.60.48] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abkNxriS53PnClk_C9A8NgAAAEs"]
[Tue Mar 17 16:16:07.164945 2026] [:error] [pid 45916:tid 45969] [client 92.36.60.48:5045] [client 92.36.60.48] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abkNx7iS53PnClk_C9A8OAAAAEc"]
[Tue Mar 17 17:33:19.956059 2026] [:error] [pid 45916:tid 45971] [client 43.159.143.139:58714] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abkf37iS53PnClk_C9BacAAAAEk"]
[Tue Mar 17 20:16:51.524164 2026] [:error] [pid 22541:tid 22547] [client 182.44.12.37:49440] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ablGM6S6JNY1-CTsTA8VOAAAAQE"]
[Tue Mar 17 22:59:00.964326 2026] [:error] [pid 15162:tid 15170] [client 49.51.253.83:54534] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ablsNLkCW4399PnBfYQS9QAAAkM"]
[Wed Mar 18 00:46:16.569312 2026] [:error] [pid 63412:tid 63417] [client 76.147.219.168:49417] [client 76.147.219.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 76.147.219.168, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abmFWDKUzzFOGoXRLQ-tCQAAAME"]
[Wed Mar 18 00:46:16.588366 2026] [proxy_fcgi:error] [pid 63412:tid 63417] [client 76.147.219.168:49417] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 03:08:29.814832 2026] [:error] [pid 63612:tid 63614] [client 43.138.68.113:44364] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abmmre7vPBSR8vo387Ne5gAAAYA"]
[Wed Mar 18 04:20:10.694067 2026] [:error] [pid 44966:tid 45049] [client 185.238.231.194:38643] [client 185.238.231.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.194, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abm3erHml2_01Zq4-12gPgAAAIw"]
[Wed Mar 18 04:20:10.703919 2026] [proxy_fcgi:error] [pid 44966:tid 45049] [client 185.238.231.194:38643] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 05:04:02.209591 2026] [:error] [pid 13716:tid 13735] [client 43.159.145.153:44314] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abnBwmWKzQVHkZkUHaTT8QAAAVE"]
[Wed Mar 18 05:10:27.789292 2026] [proxy_fcgi:error] [pid 13676:tid 13685] [client 20.116.1.191:27240] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 05:10:28.370018 2026] [:error] [pid 13676:tid 13684] [client 20.116.1.191:27240] [client 20.116.1.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.1.191, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abnDRGxDEHR5lvAEVIjXPwAAAQY"]
[Wed Mar 18 05:10:28.584850 2026] [proxy_fcgi:error] [pid 13676:tid 13682] [client 20.116.1.191:27240] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 05:10:29.551843 2026] [proxy_fcgi:error] [pid 13676:tid 13687] [client 20.116.1.191:27240] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 05:10:30.189930 2026] [proxy_fcgi:error] [pid 13676:tid 13690] [client 20.116.1.191:27240] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 05:10:30.398594 2026] [:error] [pid 13676:tid 13681] [client 20.116.1.191:27240] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "abnDRmxDEHR5lvAEVIjXTwAAAQM"]
[Wed Mar 18 05:10:35.627454 2026] [:error] [pid 13716:tid 13726] [client 20.116.1.191:27237] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "abnDS2WKzQVHkZkUHaTYaAAAAUg"]
[Wed Mar 18 05:10:43.759617 2026] [:error] [pid 13676:tid 13686] [client 20.116.1.191:26762] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "abnDU2xDEHR5lvAEVIjXaAAAAQg"]
[Wed Mar 18 05:10:45.111834 2026] [:error] [pid 13716:tid 13718] [client 20.116.1.191:27241] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "abnDVWWKzQVHkZkUHaTYigAAAUA"]
[Wed Mar 18 08:13:18.625054 2026] [:error] [pid 44964:tid 44987] [client 20.2.90.103:39530] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "abnuHsvMufm4ayzOOhBpSwAAAAk"]
[Wed Mar 18 08:39:02.450624 2026] [:error] [pid 30747:tid 30768] [client 124.106.31.166:17291] [client 124.106.31.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.106.31.166, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abn0JpKSa2XxvlvqKRuKVAAAAhM"]
[Wed Mar 18 08:39:03.144097 2026] [proxy_fcgi:error] [pid 30747:tid 30768] [client 124.106.31.166:17291] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 10:07:18.536131 2026] [:error] [pid 43009:tid 43034] [client 43.135.144.81:39420] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aboI1n8aUp4Sm6m3nmOLfgAAARc"]
[Wed Mar 18 11:03:55.033289 2026] [:error] [pid 43009:tid 43035] [client 43.157.67.70:54302] [client 43.157.67.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aboWG38aUp4Sm6m3nmPCCQAAARg"]
[Wed Mar 18 16:10:12.516132 2026] [:error] [pid 53755:tid 53778] [client 123.187.240.242:53457] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abpd5Kqw5ZSRshmIhWm--AAAAVU"]
[Wed Mar 18 19:14:38.408509 2026] [:error] [pid 42871:tid 42918] [client 113.201.88.229:8356] [client 113.201.88.229] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abqJHmPUS0lM1M9nUaJMcQAAAIQ"], referer: http://www.switchcreative.net/
[Wed Mar 18 19:38:31.273745 2026] [:error] [pid 31232:tid 31253] [client 212.227.251.90:55440] [client 212.227.251.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abqOt2X6HV7dqh3BQD3bwwAAAFI"]
[Wed Mar 18 21:42:59.097856 2026] [:error] [pid 31232:tid 31253] [client 150.109.230.210:53958] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abqr42X6HV7dqh3BQD0SLQAAAFI"]
[Wed Mar 18 22:16:33.878698 2026] [:error] [pid 43009:tid 43034] [client 45.80.158.167:34654] [client 45.80.158.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.80.158.167, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abqzwX8aUp4Sm6m3nmND_AAAARc"]
[Wed Mar 18 22:16:33.889400 2026] [proxy_fcgi:error] [pid 43009:tid 43034] [client 45.80.158.167:34654] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 23:02:12.573695 2026] [:error] [pid 42871:tid 42935] [client 195.231.47.218:48135] [client 195.231.47.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.231.47.218, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abq-dGPUS0lM1M9nUaKVLAAAAJU"]
[Wed Mar 18 23:02:12.585352 2026] [proxy_fcgi:error] [pid 42871:tid 42935] [client 195.231.47.218:48135] AH01071: Got error 'Primary script unknown'
[Wed Mar 18 23:03:14.253302 2026] [:error] [pid 31232:tid 31236] [client 115.96.48.194:60599] [client 115.96.48.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.96.48.194, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abq-smX6HV7dqh3BQD022AAAAEE"]
[Wed Mar 18 23:03:14.264139 2026] [proxy_fcgi:error] [pid 31232:tid 31236] [client 115.96.48.194:60599] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 01:59:06.252101 2026] [proxy_fcgi:error] [pid 41180:tid 41198] [client 145.239.10.137:37989] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/gfg.php
[Thu Mar 19 05:10:36.573249 2026] [:error] [pid 3278:tid 3288] [client 43.135.148.92:56566] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "absUzAC2T_lM6ZgvfcT8lAAAAQc"]
[Thu Mar 19 05:29:36.191307 2026] [autoindex:error] [pid 23884:tid 23967] [client 167.172.93.181:63384] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Mar 19 06:12:58.001512 2026] [:error] [pid 3278:tid 3296] [client 78.135.110.69:53998] [client 78.135.110.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.135.110.69, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "absjaQC2T_lM6ZgvfcQmJgAAAQ8"]
[Thu Mar 19 06:12:58.015156 2026] [proxy_fcgi:error] [pid 3278:tid 3296] [client 78.135.110.69:53998] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 06:12:59.135591 2026] [proxy_fcgi:error] [pid 23988:tid 24001] [client 78.135.110.69:54012] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 06:31:04.197382 2026] [:error] [pid 3278:tid 3282] [client 31.171.130.21:23883] [client 31.171.130.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.21, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "absnqAC2T_lM6ZgvfcQ0pQAAAQE"]
[Thu Mar 19 06:31:04.219800 2026] [proxy_fcgi:error] [pid 3278:tid 3282] [client 31.171.130.21:23883] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 08:04:08.094165 2026] [:error] [pid 23883:tid 23936] [client 35.173.201.178:58585] [client 35.173.201.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abs9eNNi-EnEAH4abz2FhwAAAEc"]
[Thu Mar 19 08:55:23.273419 2026] [proxy_fcgi:error] [pid 32226:tid 32239] [client 45.89.60.68:49841] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Thu Mar 19 08:55:31.547059 2026] [proxy_fcgi:error] [pid 31447:tid 31478] [client 45.89.60.68:49327] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Thu Mar 19 08:56:00.441084 2026] [proxy_fcgi:error] [pid 31735:tid 31760] [client 45.89.60.68:65394] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Thu Mar 19 08:56:26.247550 2026] [proxy_fcgi:error] [pid 31205:tid 31216] [client 45.89.60.68:62873] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Thu Mar 19 10:01:55.109280 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.61:48523] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:01:58.220309 2026] [proxy_fcgi:error] [pid 23882:tid 23912] [client 209.87.169.29:36803] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:03.526590 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:03.840191 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:04.155560 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:04.436326 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:04.716307 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:04.958047 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:05.250322 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:05.515311 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:06.095309 2026] [proxy_fcgi:error] [pid 32226:tid 32231] [client 45.131.195.237:46381] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:07.943351 2026] [proxy_fcgi:error] [pid 3278:tid 3302] [client 209.87.169.61:36103] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:08.930965 2026] [proxy_fcgi:error] [pid 3278:tid 3302] [client 209.87.169.214:60631] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:09.208437 2026] [proxy_fcgi:error] [pid 3278:tid 3304] [client 209.87.169.214:60631] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:09.467275 2026] [proxy_fcgi:error] [pid 3278:tid 3296] [client 209.87.169.214:60631] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:11.057337 2026] [proxy_fcgi:error] [pid 23882:tid 23919] [client 209.87.169.55:46565] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:11.793296 2026] [proxy_fcgi:error] [pid 31313:tid 31369] [client 209.87.169.32:58085] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:12.514362 2026] [proxy_fcgi:error] [pid 32226:tid 32235] [client 209.87.169.46:49109] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:13.933786 2026] [proxy_fcgi:error] [pid 25269:tid 25295] [client 209.87.169.51:41575] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:14.213297 2026] [proxy_fcgi:error] [pid 25269:tid 25285] [client 209.87.169.51:41575] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:14.466247 2026] [proxy_fcgi:error] [pid 25269:tid 25295] [client 209.87.169.51:41575] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:14.715300 2026] [proxy_fcgi:error] [pid 25269:tid 25285] [client 209.87.169.51:41575] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:14.967313 2026] [proxy_fcgi:error] [pid 25269:tid 25295] [client 209.87.169.51:41575] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:16.581307 2026] [proxy_fcgi:error] [pid 31735:tid 31745] [client 209.87.169.211:64231] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:20.008298 2026] [proxy_fcgi:error] [pid 31735:tid 31745] [client 209.87.169.211:64231] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:20.265164 2026] [:error] [pid 31735:tid 31745] [client 209.87.169.211:64231] [client 209.87.169.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "abtZLH-gyQbRQWJYccxHcwAAAoY"]
[Thu Mar 19 10:02:21.842660 2026] [proxy_fcgi:error] [pid 25044:tid 25049] [client 209.87.169.36:42651] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:22.319633 2026] [:error] [pid 25044:tid 25048] [client 209.87.169.36:42651] [client 209.87.169.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "abtZLtUUDKsY7wMywpo1twAAAsA"]
[Thu Mar 19 10:02:24.157302 2026] [proxy_fcgi:error] [pid 25135:tid 25159] [client 209.87.169.34:46905] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:26.654411 2026] [proxy_fcgi:error] [pid 31313:tid 31380] [client 209.87.169.215:52125] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:26.965667 2026] [proxy_fcgi:error] [pid 31313:tid 31380] [client 209.87.169.215:52125] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:29.055720 2026] [:error] [pid 23988:tid 24009] [client 209.87.169.213:37449] [client 209.87.169.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "abtZNWnlkSPXj2matr0yBgAAANI"]
[Thu Mar 19 10:02:29.721318 2026] [proxy_fcgi:error] [pid 3278:tid 3300] [client 209.87.169.55:54313] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:30.032300 2026] [proxy_fcgi:error] [pid 3278:tid 3300] [client 209.87.169.55:54313] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:31.169319 2026] [proxy_fcgi:error] [pid 32226:tid 32251] [client 209.87.169.49:28525] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:31.439932 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.49:28525] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:33.400124 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.49:28525] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:33.669356 2026] [proxy_fcgi:error] [pid 32226:tid 32251] [client 209.87.169.49:28525] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:34.434333 2026] [proxy_fcgi:error] [pid 25179:tid 25205] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:34.680116 2026] [proxy_fcgi:error] [pid 25179:tid 25198] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:34.972325 2026] [proxy_fcgi:error] [pid 25179:tid 25195] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:35.225299 2026] [proxy_fcgi:error] [pid 25179:tid 25195] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:35.482294 2026] [proxy_fcgi:error] [pid 25179:tid 25195] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:35.751454 2026] [proxy_fcgi:error] [pid 25179:tid 25195] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:36.432614 2026] [proxy_fcgi:error] [pid 25179:tid 25186] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:36.734303 2026] [proxy_fcgi:error] [pid 25179:tid 25203] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:36.981286 2026] [proxy_fcgi:error] [pid 25179:tid 25186] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:39.857338 2026] [proxy_fcgi:error] [pid 25179:tid 25205] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:40.106571 2026] [proxy_fcgi:error] [pid 25179:tid 25205] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:40.378306 2026] [proxy_fcgi:error] [pid 25179:tid 25186] [client 209.87.169.66:23543] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:41.137299 2026] [proxy_fcgi:error] [pid 31313:tid 31362] [client 209.87.169.234:34927] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:41.398295 2026] [proxy_fcgi:error] [pid 31313:tid 31382] [client 209.87.169.234:34927] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:41.969869 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:42.244811 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:42.493288 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:42.732357 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:43.000887 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:43.293296 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:43.532317 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:43.792308 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:44.047948 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:44.295289 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:44.549422 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:44.810288 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:45.152472 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:45.393307 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:45.662306 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:45.942104 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:46.197796 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:46.476608 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:46.740376 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:47.002301 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:47.291572 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:47.582532 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:47.885867 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:48.192388 2026] [proxy_fcgi:error] [pid 32226:tid 32236] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:48.472472 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:48.764387 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:49.039027 2026] [proxy_fcgi:error] [pid 32226:tid 32234] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:49.324416 2026] [proxy_fcgi:error] [pid 32226:tid 32250] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:49.595289 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:49.890250 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:50.148312 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:50.432343 2026] [proxy_fcgi:error] [pid 32226:tid 32244] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:50.676298 2026] [proxy_fcgi:error] [pid 32226:tid 32243] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:50.951552 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:51.289312 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:51.647343 2026] [proxy_fcgi:error] [pid 32226:tid 32244] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:51.932600 2026] [proxy_fcgi:error] [pid 32226:tid 32243] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:52.233769 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:52.476285 2026] [proxy_fcgi:error] [pid 32226:tid 32252] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:53.385405 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:53.638290 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:53.919455 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:54.198286 2026] [proxy_fcgi:error] [pid 32226:tid 32250] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:54.499354 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:54.769305 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:55.095730 2026] [proxy_fcgi:error] [pid 32226:tid 32243] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:55.379286 2026] [proxy_fcgi:error] [pid 32226:tid 32250] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:55.625306 2026] [proxy_fcgi:error] [pid 32226:tid 32243] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:55.891298 2026] [proxy_fcgi:error] [pid 32226:tid 32246] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:56.170308 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:56.434365 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:56.748293 2026] [proxy_fcgi:error] [pid 32226:tid 32252] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:57.096313 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:57.398308 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:57.667305 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:57.966428 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:58.222343 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:58.526974 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:58.804379 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:59.106311 2026] [proxy_fcgi:error] [pid 32226:tid 32236] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:59.418840 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:59.670305 2026] [proxy_fcgi:error] [pid 32226:tid 32249] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:02:59.944327 2026] [proxy_fcgi:error] [pid 32226:tid 32236] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:00.237300 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:00.541318 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:00.945321 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:01.194978 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:01.540296 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:01.834039 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:02.123452 2026] [proxy_fcgi:error] [pid 32226:tid 32252] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:02.401295 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:02.696293 2026] [proxy_fcgi:error] [pid 32226:tid 32241] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:03.208354 2026] [proxy_fcgi:error] [pid 32226:tid 32243] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:03.510337 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:03.827308 2026] [proxy_fcgi:error] [pid 32226:tid 32241] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:04.225384 2026] [proxy_fcgi:error] [pid 32226:tid 32244] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:04.541295 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:04.845330 2026] [proxy_fcgi:error] [pid 32226:tid 32246] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:05.133630 2026] [proxy_fcgi:error] [pid 32226:tid 32244] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:05.470298 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:05.715335 2026] [proxy_fcgi:error] [pid 32226:tid 32245] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:05.998341 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:06.291367 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:06.581890 2026] [proxy_fcgi:error] [pid 32226:tid 32247] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:06.861162 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:07.155285 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:07.458297 2026] [proxy_fcgi:error] [pid 32226:tid 32229] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:07.734418 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:08.033284 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:08.606295 2026] [proxy_fcgi:error] [pid 32226:tid 32237] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:09.484298 2026] [proxy_fcgi:error] [pid 32226:tid 32245] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:09.730756 2026] [proxy_fcgi:error] [pid 32226:tid 32240] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:10.016323 2026] [proxy_fcgi:error] [pid 32226:tid 32248] [client 209.87.169.225:56243] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:12.711967 2026] [proxy_fcgi:error] [pid 25269:tid 25289] [client 209.87.169.244:27653] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:18.482223 2026] [:error] [pid 25269:tid 25283] [client 209.87.169.244:27653] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abtZZsU9ntriqNcU-b6NPAAAA8s"]
[Thu Mar 19 10:03:19.918526 2026] [:error] [pid 24925:tid 24945] [client 209.87.169.63:29307] [client 209.87.169.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abtZZ_UZEHbnUgjEbWNByAAAAZA"]
[Thu Mar 19 10:03:21.477618 2026] [:error] [pid 25044:tid 25072] [client 209.87.169.248:31935] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "abtZadUUDKsY7wMywpo3DwAAAtg"]
[Thu Mar 19 10:03:22.036319 2026] [proxy_fcgi:error] [pid 25179:tid 25190] [client 209.87.169.73:63595] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:22.284499 2026] [:error] [pid 25179:tid 25194] [client 209.87.169.73:63595] [client 209.87.169.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "abtZamFzmTtmuBLc_LZV_AAAA40"]
[Thu Mar 19 10:03:24.120020 2026] [:error] [pid 25269:tid 25295] [client 45.131.195.236:49733] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abtZbMU9ntriqNcU-b6NfAAAA9c"]
[Thu Mar 19 10:03:24.660351 2026] [:error] [pid 25269:tid 25295] [client 209.87.169.224:28533] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "abtZbMU9ntriqNcU-b6NfwAAA9c"]
[Thu Mar 19 10:03:25.189569 2026] [:error] [pid 31205:tid 31218] [client 209.87.169.33:43823] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abtZbVu5gZKGrGz5P1FTnAAAAUI"]
[Thu Mar 19 10:03:25.705173 2026] [:error] [pid 25044:tid 25058] [client 209.87.169.248:44783] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "abtZbdUUDKsY7wMywpo3FwAAAso"]
[Thu Mar 19 10:03:26.213635 2026] [:error] [pid 25135:tid 25151] [client 209.87.169.237:62877] [client 209.87.169.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "abtZbqKtE0dzgMctjFWQuAAAA04"]
[Thu Mar 19 10:03:26.932546 2026] [:error] [pid 25135:tid 25157] [client 209.87.169.29:49133] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "abtZbqKtE0dzgMctjFWQyAAAA1Q"]
[Thu Mar 19 10:03:27.753325 2026] [proxy_fcgi:error] [pid 31447:tid 31466] [client 209.87.169.43:61835] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:28.052304 2026] [proxy_fcgi:error] [pid 31447:tid 31457] [client 209.87.169.43:61835] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:28.281208 2026] [:error] [pid 31447:tid 31474] [client 209.87.169.43:61835] [client 209.87.169.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "abtZcBmVNRDSLnGvghikOwAAAhM"]
[Thu Mar 19 10:03:30.404176 2026] [:error] [pid 31205:tid 31232] [client 209.87.169.37:28285] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abtZclu5gZKGrGz5P1FTyAAAAU8"]
[Thu Mar 19 10:03:31.205642 2026] [:error] [pid 31447:tid 31473] [client 209.87.169.35:51357] [client 209.87.169.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abtZcxmVNRDSLnGvghikRQAAAhI"]
[Thu Mar 19 10:03:34.613888 2026] [:error] [pid 25044:tid 25049] [client 209.87.169.40:39405] [client 209.87.169.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "abtZdtUUDKsY7wMywpo3QQAAAsE"]
[Thu Mar 19 10:03:35.151293 2026] [:error] [pid 23882:tid 23903] [client 209.87.169.67:50933] [client 209.87.169.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "abtZd7WnClbtbN12M78g-wAAAAE"]
[Thu Mar 19 10:03:35.987341 2026] [:error] [pid 23882:tid 23903] [client 209.87.169.30:41983] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "abtZd7WnClbtbN12M78hAwAAAAE"]
[Thu Mar 19 10:03:36.531335 2026] [proxy_fcgi:error] [pid 24925:tid 24946] [client 209.87.169.234:44379] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:36.788357 2026] [:error] [pid 24925:tid 24946] [client 209.87.169.234:44379] [client 209.87.169.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "abtZePUZEHbnUgjEbWNCTwAAAZE"]
[Thu Mar 19 10:03:37.931611 2026] [:error] [pid 24925:tid 24945] [client 209.87.169.229:39275] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abtZefUZEHbnUgjEbWNCYwAAAZA"]
[Thu Mar 19 10:03:38.803253 2026] [:error] [pid 25135:tid 25140] [client 209.87.169.243:47761] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "abtZeqKtE0dzgMctjFWRBwAAA0M"]
[Thu Mar 19 10:03:39.619365 2026] [:error] [pid 25044:tid 25055] [client 209.87.169.30:51595] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "abtZe9UUDKsY7wMywpo3YwAAAsc"]
[Thu Mar 19 10:03:40.153287 2026] [:error] [pid 25269:tid 25291] [client 209.87.169.234:55463] [client 209.87.169.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "abtZfMU9ntriqNcU-b6OHAAAA9M"]
[Thu Mar 19 10:03:41.469196 2026] [:error] [pid 25135:tid 25140] [client 45.131.195.236:37491] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "abtZfaKtE0dzgMctjFWRJQAAA0M"]
[Thu Mar 19 10:03:41.983163 2026] [:error] [pid 25135:tid 25157] [client 209.87.169.34:49869] [client 209.87.169.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "abtZfaKtE0dzgMctjFWRKgAAA1Q"]
[Thu Mar 19 10:03:42.488688 2026] [:error] [pid 25179:tid 25191] [client 209.87.169.219:30789] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "abtZfmFzmTtmuBLc_LZWygAAA4o"]
[Thu Mar 19 10:03:43.509500 2026] [proxy_fcgi:error] [pid 31313:tid 31380] [client 209.87.169.237:47451] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:43.792295 2026] [proxy_fcgi:error] [pid 31313:tid 31367] [client 209.87.169.237:47451] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:44.555043 2026] [:error] [pid 31313:tid 31382] [client 209.87.169.237:47451] [client 209.87.169.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "abtZgA9HuAbqf2tZOycjbQAAAdU"]
[Thu Mar 19 10:03:45.665044 2026] [:error] [pid 31205:tid 31219] [client 209.87.169.247:26709] [client 209.87.169.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.247, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "abtZgVu5gZKGrGz5P1FT9gAAAUM"]
[Thu Mar 19 10:03:47.242900 2026] [proxy_fcgi:error] [pid 31205:tid 31232] [client 209.87.169.247:26709] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:53.139436 2026] [:error] [pid 31205:tid 31237] [client 209.87.169.247:26709] [client 209.87.169.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "abtZiVu5gZKGrGz5P1FUEgAAAVQ"]
[Thu Mar 19 10:03:53.852993 2026] [:error] [pid 25135:tid 25154] [client 209.87.169.45:31291] [client 209.87.169.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.45, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "abtZiaKtE0dzgMctjFWRXwAAA1E"]
[Thu Mar 19 10:03:54.332589 2026] [:error] [pid 25135:tid 25138] [client 209.87.169.45:31291] [client 209.87.169.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "abtZiqKtE0dzgMctjFWRYwAAA0E"]
[Thu Mar 19 10:03:55.201299 2026] [proxy_fcgi:error] [pid 3278:tid 3297] [client 209.87.169.46:38443] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:03:56.475769 2026] [:error] [pid 3278:tid 3298] [client 209.87.169.46:38443] [client 209.87.169.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "abtZjAC2T_lM6ZgvfcRWNgAAARE"]
[Thu Mar 19 10:03:58.186252 2026] [:error] [pid 31735:tid 31756] [client 209.87.169.248:51829] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "abtZjn-gyQbRQWJYccxLkgAAApE"]
[Thu Mar 19 10:03:58.730485 2026] [:error] [pid 25044:tid 25065] [client 209.87.169.50:58201] [client 209.87.169.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "abtZjtUUDKsY7wMywpo4IAAAAtE"]
[Thu Mar 19 10:03:59.744650 2026] [:error] [pid 25044:tid 25057] [client 209.87.169.215:62559] [client 209.87.169.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.215, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "abtZj9UUDKsY7wMywpo4NAAAAsk"]
[Thu Mar 19 10:03:59.991252 2026] [:error] [pid 25044:tid 25065] [client 209.87.169.215:62559] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "abtZj9UUDKsY7wMywpo4OQAAAtE"]
[Thu Mar 19 10:04:03.297326 2026] [proxy_fcgi:error] [pid 23883:tid 23933] [client 209.87.169.73:37487] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:04.048317 2026] [proxy_fcgi:error] [pid 23883:tid 23942] [client 209.87.169.73:37487] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:04.534710 2026] [proxy_fcgi:error] [pid 23883:tid 23943] [client 209.87.169.73:37487] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:05.049317 2026] [proxy_fcgi:error] [pid 23883:tid 23931] [client 209.87.169.73:37487] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:05.311839 2026] [:error] [pid 23883:tid 23933] [client 209.87.169.73:37487] [client 209.87.169.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "abtZldNi-EnEAH4abz2XvwAAAEQ"]
[Thu Mar 19 10:04:15.245803 2026] [:error] [pid 3278:tid 3290] [client 209.87.169.220:39939] [client 209.87.169.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.220, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "abtZnwC2T_lM6ZgvfcRWyQAAAQk"]
[Thu Mar 19 10:04:15.836439 2026] [:error] [pid 3278:tid 3289] [client 209.87.169.220:39939] [client 209.87.169.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "abtZnwC2T_lM6ZgvfcRWywAAAQg"]
[Thu Mar 19 10:04:16.313895 2026] [:error] [pid 23883:tid 23943] [client 45.131.195.236:58881] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/infi.php"] [unique_id "abtZoNNi-EnEAH4abz2YFwAAAE4"]
[Thu Mar 19 10:04:17.032730 2026] [:error] [pid 31313:tid 31381] [client 45.131.195.237:28981] [client 45.131.195.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "abtZoQ9HuAbqf2tZOyckAwAAAdQ"]
[Thu Mar 19 10:04:17.529317 2026] [proxy_fcgi:error] [pid 23883:tid 23932] [client 209.87.169.213:52245] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:17.768297 2026] [:error] [pid 23883:tid 23938] [client 209.87.169.213:52245] [client 209.87.169.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "abtZodNi-EnEAH4abz2YIgAAAEk"]
[Thu Mar 19 10:04:18.213204 2026] [:error] [pid 31313:tid 31369] [client 209.87.169.55:27225] [client 209.87.169.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "abtZog9HuAbqf2tZOyckBgAAAcg"]
[Thu Mar 19 10:04:20.307781 2026] [:error] [pid 25044:tid 25065] [client 209.87.169.49:24261] [client 209.87.169.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "abtZpNUUDKsY7wMywpo49gAAAtE"]
[Thu Mar 19 10:04:21.009557 2026] [:error] [pid 23882:tid 23923] [client 209.87.169.217:41041] [client 209.87.169.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "abtZpbWnClbtbN12M78iIgAAABU"]
[Thu Mar 19 10:04:21.500397 2026] [proxy_fcgi:error] [pid 31447:tid 31471] [client 209.87.169.33:36639] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:22.248655 2026] [:error] [pid 31447:tid 31472] [client 209.87.169.33:36639] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit.php"] [unique_id "abtZphmVNRDSLnGvghilJQAAAhE"]
[Thu Mar 19 10:04:23.006562 2026] [:error] [pid 31313:tid 31365] [client 209.87.169.226:53257] [client 209.87.169.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "abtZpw9HuAbqf2tZOyckDAAAAcQ"]
[Thu Mar 19 10:04:23.698730 2026] [:error] [pid 31735:tid 31748] [client 45.131.195.237:57961] [client 45.131.195.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/click.php"] [unique_id "abtZp3-gyQbRQWJYccxL3QAAAok"]
[Thu Mar 19 10:04:24.198972 2026] [proxy_fcgi:error] [pid 31447:tid 31456] [client 209.87.169.42:57013] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:24.898919 2026] [:error] [pid 31447:tid 31478] [client 209.87.169.42:57013] [client 209.87.169.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "abtZqBmVNRDSLnGvghilMAAAAhc"]
[Thu Mar 19 10:04:25.859302 2026] [proxy_fcgi:error] [pid 31735:tid 31741] [client 209.87.169.45:44933] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:26.352693 2026] [:error] [pid 31735:tid 31751] [client 209.87.169.45:44933] [client 209.87.169.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "abtZqn-gyQbRQWJYccxL7QAAAow"]
[Thu Mar 19 10:04:26.791989 2026] [:error] [pid 25179:tid 25192] [client 209.87.169.64:30041] [client 209.87.169.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/xl2023.php"] [unique_id "abtZqmFzmTtmuBLc_LZXzAAAA4s"]
[Thu Mar 19 10:04:27.226664 2026] [:error] [pid 25179:tid 25189] [client 209.87.169.28:28123] [client 209.87.169.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "abtZq2FzmTtmuBLc_LZX0AAAA4g"]
[Thu Mar 19 10:04:27.673807 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.45:55909] [client 209.87.169.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "abtZq7Bb58lgPwqxC6rRhQAAAw0"]
[Thu Mar 19 10:04:28.136155 2026] [:error] [pid 25179:tid 25189] [client 209.87.169.214:57373] [client 209.87.169.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "abtZrGFzmTtmuBLc_LZX1gAAA4g"]
[Thu Mar 19 10:04:28.843179 2026] [:error] [pid 25179:tid 25198] [client 209.87.169.36:25911] [client 209.87.169.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "abtZrGFzmTtmuBLc_LZX2gAAA5E"]
[Thu Mar 19 10:04:29.309706 2026] [:error] [pid 23882:tid 23906] [client 209.87.169.236:32415] [client 209.87.169.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "abtZrbWnClbtbN12M78iLQAAAAQ"]
[Thu Mar 19 10:04:29.797434 2026] [:error] [pid 25269:tid 25282] [client 209.87.169.209:31643] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "abtZrcU9ntriqNcU-b6PvwAAA8o"]
[Thu Mar 19 10:04:30.311173 2026] [:error] [pid 25135:tid 25155] [client 209.87.169.220:32731] [client 209.87.169.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "abtZrqKtE0dzgMctjFWSCQAAA1I"]
[Thu Mar 19 10:04:32.707157 2026] [:error] [pid 32226:tid 32247] [client 209.87.169.53:42177] [client 209.87.169.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "abtZsLBb58lgPwqxC6rRmAAAAxM"]
[Thu Mar 19 10:04:33.676011 2026] [:error] [pid 31313:tid 31363] [client 209.87.169.230:24917] [client 209.87.169.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "abtZsQ9HuAbqf2tZOyckWQAAAcI"]
[Thu Mar 19 10:04:34.652336 2026] [:error] [pid 3278:tid 3288] [client 209.87.169.41:61755] [client 209.87.169.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "abtZsgC2T_lM6ZgvfcRXKQAAAQc"]
[Thu Mar 19 10:04:36.714297 2026] [proxy_fcgi:error] [pid 31447:tid 31477] [client 209.87.169.228:48213] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:37.919853 2026] [:error] [pid 31447:tid 31473] [client 209.87.169.228:48213] [client 209.87.169.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "abtZtRmVNRDSLnGvghilcAAAAhI"]
[Thu Mar 19 10:04:38.367100 2026] [proxy_fcgi:error] [pid 25135:tid 25147] [client 209.87.169.235:32771] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:39.053492 2026] [:error] [pid 25135:tid 25153] [client 209.87.169.235:32771] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "abtZt6KtE0dzgMctjFWSMQAAA1A"]
[Thu Mar 19 10:04:39.499053 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.33:31093] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "abtZt7Bb58lgPwqxC6rRygAAAwA"]
[Thu Mar 19 10:04:40.741588 2026] [:error] [pid 25044:tid 25072] [client 209.87.169.55:20155] [client 209.87.169.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "abtZuNUUDKsY7wMywpo5KgAAAtg"]
[Thu Mar 19 10:04:41.663932 2026] [proxy_fcgi:error] [pid 31735:tid 31739] [client 209.87.169.244:41807] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:41.897288 2026] [proxy_fcgi:error] [pid 31735:tid 31747] [client 209.87.169.244:41807] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:42.142306 2026] [proxy_fcgi:error] [pid 31735:tid 31753] [client 209.87.169.244:41807] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:43.403375 2026] [:error] [pid 31735:tid 31751] [client 209.87.169.244:41807] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "abtZu3-gyQbRQWJYccxMKwAAAow"]
[Thu Mar 19 10:04:43.850252 2026] [:error] [pid 25044:tid 25064] [client 209.87.169.42:43831] [client 209.87.169.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "abtZu9UUDKsY7wMywpo5MQAAAtA"]
[Thu Mar 19 10:04:45.394952 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.48:40143] [client 209.87.169.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "abtZvcU9ntriqNcU-b6QaQAAA8A"]
[Thu Mar 19 10:04:45.841452 2026] [:error] [pid 24971:tid 24987] [client 209.87.169.60:40091] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "abtZvfUcWA7YXQC7dRvTaAAAAkw"]
[Thu Mar 19 10:04:46.290339 2026] [:error] [pid 24925:tid 24930] [client 209.87.169.41:55075] [client 209.87.169.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "abtZvvUZEHbnUgjEbWNFawAAAYE"]
[Thu Mar 19 10:04:46.767485 2026] [:error] [pid 23988:tid 23991] [client 209.87.169.35:45867] [client 209.87.169.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "abtZvmnlkSPXj2matr01dAAAAMA"]
[Thu Mar 19 10:04:47.480012 2026] [:error] [pid 31447:tid 31461] [client 209.87.169.70:27745] [client 209.87.169.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "abtZvxmVNRDSLnGvghil0QAAAgY"]
[Thu Mar 19 10:04:47.956366 2026] [:error] [pid 25044:tid 25064] [client 209.87.169.62:27685] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "abtZv9UUDKsY7wMywpo5TgAAAtA"]
[Thu Mar 19 10:04:48.411477 2026] [:error] [pid 25179:tid 25192] [client 209.87.169.61:45553] [client 209.87.169.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "abtZwGFzmTtmuBLc_LZYPgAAA4s"]
[Thu Mar 19 10:04:48.874756 2026] [:error] [pid 31313:tid 31364] [client 209.87.169.237:20363] [client 209.87.169.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "abtZwA9HuAbqf2tZOyckrwAAAcM"]
[Thu Mar 19 10:04:50.203437 2026] [:error] [pid 25044:tid 25064] [client 209.87.169.28:64649] [client 209.87.169.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "abtZwtUUDKsY7wMywpo5YwAAAtA"]
[Thu Mar 19 10:04:50.914399 2026] [:error] [pid 25044:tid 25072] [client 209.87.169.233:36947] [client 209.87.169.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "abtZwtUUDKsY7wMywpo5bAAAAtg"]
[Thu Mar 19 10:04:51.623075 2026] [:error] [pid 24925:tid 24949] [client 45.131.195.236:34047] [client 45.131.195.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "abtZw_UZEHbnUgjEbWNFmQAAAZQ"]
[Thu Mar 19 10:04:52.601628 2026] [:error] [pid 25135:tid 25153] [client 209.87.169.243:27733] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "abtZxKKtE0dzgMctjFWShwAAA1A"]
[Thu Mar 19 10:04:53.138072 2026] [proxy_fcgi:error] [pid 25044:tid 25071] [client 45.131.195.236:49057] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:53.588284 2026] [proxy_fcgi:error] [pid 25044:tid 25071] [client 45.131.195.236:49057] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:04:59.087661 2026] [:error] [pid 31205:tid 31239] [client 209.87.169.252:37763] [client 209.87.169.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "abtZy1u5gZKGrGz5P1FUrQAAAVY"]
[Thu Mar 19 10:05:02.429026 2026] [:error] [pid 23883:tid 23950] [client 209.87.169.30:54409] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "abtZztNi-EnEAH4abz2ZMgAAAFU"]
[Thu Mar 19 10:05:05.370293 2026] [proxy_fcgi:error] [pid 25269:tid 25283] [client 209.87.169.240:26323] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:06.007841 2026] [:error] [pid 25269:tid 25273] [client 209.87.169.240:26323] [client 209.87.169.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "abtZ0sU9ntriqNcU-b6QsAAAA8E"]
[Thu Mar 19 10:05:08.721326 2026] [proxy_fcgi:error] [pid 25269:tid 25275] [client 209.87.169.248:46105] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:10.913547 2026] [proxy_fcgi:error] [pid 25269:tid 25290] [client 209.87.169.248:46105] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:11.721340 2026] [:error] [pid 25269:tid 25294] [client 209.87.169.248:46105] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "abtZ18U9ntriqNcU-b6Q4QAAA9Y"]
[Thu Mar 19 10:05:12.225533 2026] [:error] [pid 23883:tid 23941] [client 209.87.169.245:47577] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "abtZ2NNi-EnEAH4abz2ZZAAAAEw"]
[Thu Mar 19 10:05:12.767623 2026] [:error] [pid 25179:tid 25185] [client 209.87.169.219:65449] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "abtZ2GFzmTtmuBLc_LZYhAAAA4Q"]
[Thu Mar 19 10:05:13.503010 2026] [:error] [pid 25135:tid 25147] [client 209.87.169.229:53391] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "abtZ2aKtE0dzgMctjFWS5gAAA0o"]
[Thu Mar 19 10:05:13.961751 2026] [:error] [pid 24925:tid 24945] [client 209.87.169.232:49517] [client 209.87.169.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "abtZ2fUZEHbnUgjEbWNF5gAAAZA"]
[Thu Mar 19 10:05:15.545191 2026] [:error] [pid 31205:tid 31230] [client 209.87.169.222:22171] [client 209.87.169.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "abtZ21u5gZKGrGz5P1FU3gAAAU0"]
[Thu Mar 19 10:05:16.725890 2026] [:error] [pid 25179:tid 25190] [client 209.87.169.244:45817] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "abtZ3GFzmTtmuBLc_LZYjwAAA4k"]
[Thu Mar 19 10:05:17.418526 2026] [proxy_fcgi:error] [pid 25044:tid 25056] [client 209.87.169.69:40087] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:18.198090 2026] [:error] [pid 23883:tid 23951] [client 209.87.169.231:39179] [client 209.87.169.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "abtZ3tNi-EnEAH4abz2ZggAAAFY"]
[Thu Mar 19 10:05:18.650373 2026] [:error] [pid 25044:tid 25069] [client 209.87.169.253:64985] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugins.php"] [unique_id "abtZ3tUUDKsY7wMywpo5nwAAAtU"]
[Thu Mar 19 10:05:19.313985 2026] [:error] [pid 24925:tid 24936] [client 209.87.169.37:50013] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "abtZ3_UZEHbnUgjEbWNGLgAAAYc"]
[Thu Mar 19 10:05:19.744162 2026] [:error] [pid 32226:tid 32236] [client 209.87.169.55:56607] [client 209.87.169.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "abtZ37Bb58lgPwqxC6rSQwAAAwg"]
[Thu Mar 19 10:05:21.230691 2026] [:error] [pid 32226:tid 32237] [client 209.87.169.235:59795] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/atomlib.php"] [unique_id "abtZ4bBb58lgPwqxC6rSSQAAAwk"]
[Thu Mar 19 10:05:21.670729 2026] [:error] [pid 23882:tid 23923] [client 209.87.169.209:23387] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "abtZ4bWnClbtbN12M78imQAAABU"]
[Thu Mar 19 10:05:22.142293 2026] [proxy_fcgi:error] [pid 25044:tid 25070] [client 209.87.169.65:23077] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:22.421052 2026] [proxy_fcgi:error] [pid 25044:tid 25070] [client 209.87.169.65:23077] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:22.858368 2026] [:error] [pid 25044:tid 25070] [client 209.87.169.65:23077] [client 209.87.169.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "abtZ4tUUDKsY7wMywpo5sAAAAtY"]
[Thu Mar 19 10:05:23.431192 2026] [:error] [pid 23882:tid 23914] [client 209.87.169.44:45527] [client 209.87.169.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "abtZ47WnClbtbN12M78ioAAAAAw"]
[Thu Mar 19 10:05:24.029985 2026] [:error] [pid 23882:tid 23919] [client 209.87.169.215:42369] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "abtZ5LWnClbtbN12M78ioQAAABE"]
[Thu Mar 19 10:05:25.456089 2026] [:error] [pid 25269:tid 25294] [client 209.87.169.215:38221] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "abtZ5cU9ntriqNcU-b6RSAAAA9Y"]
[Thu Mar 19 10:05:26.954469 2026] [:error] [pid 3278:tid 3283] [client 209.87.169.221:26195] [client 209.87.169.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "abtZ5gC2T_lM6ZgvfcRYeQAAAQI"]
[Thu Mar 19 10:05:28.317540 2026] [:error] [pid 25269:tid 25277] [client 209.87.169.248:50267] [client 209.87.169.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.248, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/js/wp-login.php"] [unique_id "abtZ6MU9ntriqNcU-b6RXwAAA8U"]
[Thu Mar 19 10:05:28.791285 2026] [proxy_fcgi:error] [pid 25269:tid 25277] [client 209.87.169.248:50267] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:29.051322 2026] [:error] [pid 25269:tid 25277] [client 209.87.169.248:50267] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/bk/index.php"] [unique_id "abtZ6cU9ntriqNcU-b6RaQAAA8U"]
[Thu Mar 19 10:05:29.535249 2026] [:error] [pid 32226:tid 32233] [client 209.87.169.220:57129] [client 209.87.169.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.220, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "abtZ6bBb58lgPwqxC6rSbgAAAwU"]
[Thu Mar 19 10:05:29.816326 2026] [proxy_fcgi:error] [pid 32226:tid 32252] [client 209.87.169.220:57129] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:31.444673 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.220:57129] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:33.607289 2026] [proxy_fcgi:error] [pid 32226:tid 32228] [client 209.87.169.220:57129] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:34.065724 2026] [proxy_fcgi:error] [pid 32226:tid 32247] [client 209.87.169.220:57129] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:34.302336 2026] [:error] [pid 32226:tid 32250] [client 209.87.169.220:57129] [client 209.87.169.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/about.php"] [unique_id "abtZ7rBb58lgPwqxC6rSkwAAAxY"]
[Thu Mar 19 10:05:34.966435 2026] [proxy_fcgi:error] [pid 25269:tid 25282] [client 209.87.169.209:21765] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:35.229680 2026] [:error] [pid 25269:tid 25287] [client 209.87.169.209:21765] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "abtZ78U9ntriqNcU-b6RpQAAA88"]
[Thu Mar 19 10:05:35.976093 2026] [:error] [pid 25269:tid 25278] [client 209.87.169.234:38947] [client 209.87.169.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/atomlib.php"] [unique_id "abtZ78U9ntriqNcU-b6RswAAA8Y"]
[Thu Mar 19 10:05:37.111330 2026] [proxy_fcgi:error] [pid 3278:tid 3303] [client 209.87.169.62:21461] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:37.586363 2026] [:error] [pid 3278:tid 3293] [client 209.87.169.62:21461] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "abtZ8QC2T_lM6ZgvfcRYuQAAAQw"]
[Thu Mar 19 10:05:38.020997 2026] [:error] [pid 24925:tid 24940] [client 209.87.169.221:32061] [client 209.87.169.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abtZ8vUZEHbnUgjEbWNGugAAAYs"]
[Thu Mar 19 10:05:38.471145 2026] [:error] [pid 25135:tid 25152] [client 209.87.169.243:64941] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "abtZ8qKtE0dzgMctjFWTVgAAA08"]
[Thu Mar 19 10:05:39.168321 2026] [proxy_fcgi:error] [pid 23988:tid 23998] [client 209.87.169.36:24039] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:39.615310 2026] [proxy_fcgi:error] [pid 23988:tid 24014] [client 209.87.169.36:24039] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:39.855298 2026] [proxy_fcgi:error] [pid 23988:tid 23997] [client 209.87.169.36:24039] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:40.101271 2026] [:error] [pid 23988:tid 24014] [client 209.87.169.36:24039] [client 209.87.169.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "abtZ9GnlkSPXj2matr02dgAAANc"]
[Thu Mar 19 10:05:40.589582 2026] [:error] [pid 23882:tid 23926] [client 209.87.169.72:63461] [client 209.87.169.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "abtZ9LWnClbtbN12M78ixQAAABg"]
[Thu Mar 19 10:05:42.439952 2026] [:error] [pid 25044:tid 25052] [client 209.87.169.68:45815] [client 209.87.169.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/default.php"] [unique_id "abtZ9tUUDKsY7wMywpo50gAAAsQ"]
[Thu Mar 19 10:05:43.442986 2026] [:error] [pid 31205:tid 31218] [client 209.87.169.215:28447] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "abtZ91u5gZKGrGz5P1FVPAAAAUI"]
[Thu Mar 19 10:05:44.680470 2026] [:error] [pid 23882:tid 23907] [client 209.87.169.228:62615] [client 209.87.169.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "abtZ-LWnClbtbN12M78izAAAAAU"]
[Thu Mar 19 10:05:45.120304 2026] [proxy_fcgi:error] [pid 31205:tid 31229] [client 209.87.169.216:41937] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:46.286222 2026] [:error] [pid 23882:tid 23923] [client 209.87.169.224:48925] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "abtZ-rWnClbtbN12M78i0AAAABU"]
[Thu Mar 19 10:05:47.477858 2026] [proxy_fcgi:error] [pid 31205:tid 31222] [client 185.198.240.24:38651] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:47.920359 2026] [:error] [pid 31205:tid 31222] [client 185.198.240.24:38651] [client 185.198.240.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.24, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "abtZ-1u5gZKGrGz5P1FVaAAAAUY"]
[Thu Mar 19 10:05:48.429807 2026] [proxy_fcgi:error] [pid 31205:tid 31222] [client 185.198.240.24:38651] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:48.966629 2026] [proxy_fcgi:error] [pid 31205:tid 31222] [client 185.198.240.24:38651] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:49.221493 2026] [:error] [pid 31205:tid 31222] [client 185.198.240.24:38651] [client 185.198.240.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "abtZ_Vu5gZKGrGz5P1FVcgAAAUY"]
[Thu Mar 19 10:05:49.674437 2026] [:error] [pid 25179:tid 25188] [client 209.87.169.252:20015] [client 209.87.169.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "abtZ_WFzmTtmuBLc_LZYtAAAA4c"]
[Thu Mar 19 10:05:51.086577 2026] [:error] [pid 25179:tid 25182] [client 209.87.169.70:23727] [client 209.87.169.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "abtZ_2FzmTtmuBLc_LZYvAAAA4E"]
[Thu Mar 19 10:05:52.018389 2026] [:error] [pid 31205:tid 31234] [client 209.87.169.245:24857] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "abtaAFu5gZKGrGz5P1FVfgAAAVE"]
[Thu Mar 19 10:05:52.814563 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.43:57527] [client 209.87.169.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "abtaAMU9ntriqNcU-b6SSwAAA8A"]
[Thu Mar 19 10:05:53.555925 2026] [:error] [pid 25179:tid 25188] [client 209.87.169.210:27333] [client 209.87.169.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-feed-index.php"] [unique_id "abtaAWFzmTtmuBLc_LZYxgAAA4c"]
[Thu Mar 19 10:05:54.365546 2026] [proxy_fcgi:error] [pid 25179:tid 25188] [client 209.87.169.63:26533] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:05:54.603852 2026] [:error] [pid 25179:tid 25188] [client 209.87.169.63:26533] [client 209.87.169.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "abtaAmFzmTtmuBLc_LZYzgAAA4c"]
[Thu Mar 19 10:05:55.824533 2026] [:error] [pid 25179:tid 25181] [client 209.87.169.238:47797] [client 209.87.169.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/db.php"] [unique_id "abtaA2FzmTtmuBLc_LZY0gAAA4A"]
[Thu Mar 19 10:05:56.333254 2026] [:error] [pid 25269:tid 25295] [client 209.87.169.73:62203] [client 209.87.169.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "abtaBMU9ntriqNcU-b6SYAAAA9c"]
[Thu Mar 19 10:05:56.834720 2026] [:error] [pid 25269:tid 25295] [client 209.87.169.34:62253] [client 209.87.169.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abtaBMU9ntriqNcU-b6SZgAAA9c"]
[Thu Mar 19 10:05:57.325164 2026] [:error] [pid 25269:tid 25288] [client 209.87.169.31:50395] [client 209.87.169.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "abtaBcU9ntriqNcU-b6SbgAAA9A"]
[Thu Mar 19 10:05:57.801708 2026] [:error] [pid 23882:tid 23911] [client 209.87.169.252:48793] [client 209.87.169.252] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "abtaBbWnClbtbN12M78i3QAAAAk"]
[Thu Mar 19 10:05:58.276991 2026] [:error] [pid 25179:tid 25186] [client 209.87.169.33:29209] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "abtaBmFzmTtmuBLc_LZY1QAAA4U"]
[Thu Mar 19 10:06:00.872830 2026] [:error] [pid 25135:tid 25154] [client 209.87.169.237:40625] [client 209.87.169.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "abtaCKKtE0dzgMctjFWTyQAAA1E"]
[Thu Mar 19 10:06:01.346149 2026] [:error] [pid 25135:tid 25160] [client 209.87.169.62:41993] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "abtaCaKtE0dzgMctjFWTzwAAA1c"]
[Thu Mar 19 10:06:01.841834 2026] [:error] [pid 23988:tid 23991] [client 209.87.169.206:39019] [client 209.87.169.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "abtaCWnlkSPXj2matr024wAAAMA"]
[Thu Mar 19 10:06:02.682930 2026] [:error] [pid 31313:tid 31379] [client 209.87.169.60:33255] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "abtaCg9HuAbqf2tZOycljAAAAdI"]
[Thu Mar 19 10:06:03.245301 2026] [proxy_fcgi:error] [pid 31313:tid 31380] [client 209.87.169.235:42341] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:04.397848 2026] [:error] [pid 31313:tid 31373] [client 209.87.169.235:42341] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/options.php"] [unique_id "abtaDA9HuAbqf2tZOycllAAAAcw"]
[Thu Mar 19 10:06:04.881338 2026] [proxy_fcgi:error] [pid 32226:tid 32230] [client 209.87.169.248:36489] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:05.870471 2026] [:error] [pid 32226:tid 32228] [client 209.87.169.248:36489] [client 209.87.169.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.248, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "abtaDbBb58lgPwqxC6rSsgAAAwA"]
[Thu Mar 19 10:06:07.065692 2026] [proxy_fcgi:error] [pid 32226:tid 32235] [client 209.87.169.248:36489] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:07.305397 2026] [:error] [pid 32226:tid 32241] [client 209.87.169.248:36489] [client 209.87.169.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/feed-rsss.php"] [unique_id "abtaD7Bb58lgPwqxC6rSugAAAw0"]
[Thu Mar 19 10:06:07.747865 2026] [:error] [pid 31313:tid 31385] [client 209.87.169.229:56193] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/goto.php"] [unique_id "abtaDw9HuAbqf2tZOycloAAAAdg"]
[Thu Mar 19 10:06:10.169032 2026] [:error] [pid 23882:tid 23905] [client 209.87.169.57:45587] [client 209.87.169.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "abtaErWnClbtbN12M78jHwAAAAM"]
[Thu Mar 19 10:06:10.648090 2026] [:error] [pid 25044:tid 25058] [client 209.87.169.233:26253] [client 209.87.169.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "abtaEtUUDKsY7wMywpo6SAAAAso"]
[Thu Mar 19 10:06:11.175411 2026] [:error] [pid 31313:tid 31371] [client 209.87.169.60:35113] [client 209.87.169.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "abtaEw9HuAbqf2tZOyclrQAAAco"]
[Thu Mar 19 10:06:12.994771 2026] [:error] [pid 31313:tid 31375] [client 209.87.169.54:47625] [client 209.87.169.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "abtaFA9HuAbqf2tZOycltQAAAc4"]
[Thu Mar 19 10:06:13.498877 2026] [:error] [pid 31205:tid 31234] [client 209.87.169.209:58505] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "abtaFVu5gZKGrGz5P1FV-gAAAVE"]
[Thu Mar 19 10:06:13.985407 2026] [:error] [pid 31313:tid 31375] [client 209.87.169.243:44421] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "abtaFQ9HuAbqf2tZOycluAAAAc4"]
[Thu Mar 19 10:06:14.949898 2026] [:error] [pid 31313:tid 31375] [client 209.87.169.35:47389] [client 209.87.169.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "abtaFg9HuAbqf2tZOyclxAAAAc4"]
[Thu Mar 19 10:06:15.468857 2026] [:error] [pid 31313:tid 31375] [client 209.87.169.59:35311] [client 209.87.169.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "abtaFw9HuAbqf2tZOyclyQAAAc4"]
[Thu Mar 19 10:06:15.968829 2026] [proxy_fcgi:error] [pid 3278:tid 3302] [client 209.87.169.240:46003] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:17.796925 2026] [:error] [pid 3278:tid 3284] [client 209.87.169.240:46003] [client 209.87.169.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "abtaGQC2T_lM6ZgvfcRZ7AAAAQM"]
[Thu Mar 19 10:06:18.761116 2026] [proxy_fcgi:error] [pid 25044:tid 25057] [client 209.87.169.207:36395] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:19.247616 2026] [proxy_fcgi:error] [pid 25044:tid 25057] [client 209.87.169.207:36395] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:21.359636 2026] [:error] [pid 25044:tid 25057] [client 209.87.169.207:36395] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "abtaHdUUDKsY7wMywpo6zQAAAsk"]
[Thu Mar 19 10:06:22.062504 2026] [:error] [pid 23883:tid 23947] [client 209.87.169.247:49783] [client 209.87.169.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/about.php"] [unique_id "abtaHtNi-EnEAH4abz2apQAAAFI"]
[Thu Mar 19 10:06:24.297292 2026] [:error] [pid 23988:tid 24003] [client 209.87.169.51:38661] [client 209.87.169.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-http-ixr-client-view.php"] [unique_id "abtaIGnlkSPXj2matr03aAAAAMw"]
[Thu Mar 19 10:06:24.761364 2026] [proxy_fcgi:error] [pid 31735:tid 31741] [client 209.87.169.218:20115] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:25.016752 2026] [:error] [pid 31735:tid 31759] [client 209.87.169.218:20115] [client 209.87.169.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "abtaIX-gyQbRQWJYccxMkQAAApQ"]
[Thu Mar 19 10:06:25.825306 2026] [proxy_fcgi:error] [pid 24925:tid 24929] [client 185.198.240.182:53985] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:26.536420 2026] [:error] [pid 24925:tid 24947] [client 185.198.240.182:53985] [client 185.198.240.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "abtaIvUZEHbnUgjEbWNHVwAAAZI"]
[Thu Mar 19 10:06:28.049683 2026] [:error] [pid 24925:tid 24938] [client 209.87.169.51:60179] [client 209.87.169.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "abtaJPUZEHbnUgjEbWNHZQAAAYk"]
[Thu Mar 19 10:06:28.567782 2026] [proxy_fcgi:error] [pid 23882:tid 23914] [client 209.87.169.235:46037] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:28.833570 2026] [:error] [pid 23882:tid 23914] [client 209.87.169.235:46037] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "abtaJLWnClbtbN12M78jmQAAAAw"]
[Thu Mar 19 10:06:29.332409 2026] [:error] [pid 23882:tid 23922] [client 209.87.169.253:20103] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "abtaJbWnClbtbN12M78jnQAAABQ"]
[Thu Mar 19 10:06:30.669318 2026] [proxy_fcgi:error] [pid 23882:tid 23914] [client 209.87.169.230:25277] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:31.210498 2026] [:error] [pid 23882:tid 23914] [client 209.87.169.230:25277] [client 209.87.169.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "abtaJ7WnClbtbN12M78jrQAAAAw"]
[Thu Mar 19 10:06:31.761865 2026] [:error] [pid 24925:tid 24929] [client 209.87.169.229:26465] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine-session.php"] [unique_id "abtaJ_UZEHbnUgjEbWNHgAAAAYA"]
[Thu Mar 19 10:06:32.204362 2026] [:error] [pid 23988:tid 24010] [client 209.87.169.53:31889] [client 209.87.169.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "abtaKGnlkSPXj2matr03owAAANM"]
[Thu Mar 19 10:06:32.996368 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.215:41531] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "abtaKPUZEHbnUgjEbWNHjwAAAYM"]
[Thu Mar 19 10:06:33.457639 2026] [:error] [pid 25269:tid 25279] [client 209.87.169.63:63473] [client 209.87.169.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/install.php"] [unique_id "abtaKcU9ntriqNcU-b6SqQAAA8c"]
[Thu Mar 19 10:06:33.984649 2026] [:error] [pid 25179:tid 25198] [client 209.87.169.241:32301] [client 209.87.169.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "abtaKWFzmTtmuBLc_LZY9gAAA5E"]
[Thu Mar 19 10:06:35.202884 2026] [:error] [pid 31447:tid 31467] [client 209.87.169.216:35625] [client 209.87.169.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/db.php"] [unique_id "abtaKxmVNRDSLnGvghim1gAAAgw"]
[Thu Mar 19 10:06:35.649932 2026] [:error] [pid 25044:tid 25069] [client 209.87.169.37:47129] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/security.php"] [unique_id "abtaK9UUDKsY7wMywpo7JQAAAtU"]
[Thu Mar 19 10:06:36.392863 2026] [:error] [pid 25044:tid 25069] [client 209.87.169.235:31223] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "abtaLNUUDKsY7wMywpo7LAAAAtU"]
[Thu Mar 19 10:06:37.558978 2026] [:error] [pid 31205:tid 31217] [client 209.87.169.227:44057] [client 209.87.169.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "abtaLVu5gZKGrGz5P1FWcQAAAUE"]
[Thu Mar 19 10:06:38.327139 2026] [:error] [pid 31313:tid 31372] [client 209.87.169.49:59003] [client 209.87.169.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "abtaLg9HuAbqf2tZOycl9wAAAcs"]
[Thu Mar 19 10:06:39.058937 2026] [:error] [pid 31205:tid 31224] [client 209.87.169.29:31017] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "abtaL1u5gZKGrGz5P1FWfgAAAUc"]
[Thu Mar 19 10:06:40.324585 2026] [:error] [pid 25135:tid 25144] [client 209.87.169.233:61897] [client 209.87.169.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/as.php"] [unique_id "abtaMKKtE0dzgMctjFWUIQAAA0c"]
[Thu Mar 19 10:06:41.071480 2026] [:error] [pid 31313:tid 31368] [client 209.87.169.244:56207] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "abtaMQ9HuAbqf2tZOycmDQAAAcc"]
[Thu Mar 19 10:06:41.576928 2026] [:error] [pid 23988:tid 24015] [client 209.87.169.64:60195] [client 209.87.169.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/install.php"] [unique_id "abtaMWnlkSPXj2matr034AAAANg"]
[Thu Mar 19 10:06:42.023436 2026] [:error] [pid 25269:tid 25290] [client 209.87.169.253:27397] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/db.php"] [unique_id "abtaMsU9ntriqNcU-b6S0AAAA9I"]
[Thu Mar 19 10:06:42.809300 2026] [proxy_fcgi:error] [pid 25179:tid 25200] [client 209.87.169.207:63315] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:43.867570 2026] [:error] [pid 25179:tid 25200] [client 209.87.169.207:63315] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "abtaM2FzmTtmuBLc_LZZEAAAA5M"]
[Thu Mar 19 10:06:45.215230 2026] [:error] [pid 23883:tid 23944] [client 185.198.240.182:32855] [client 185.198.240.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rk2.php"] [unique_id "abtaNdNi-EnEAH4abz2a0QAAAE8"]
[Thu Mar 19 10:06:45.989061 2026] [:error] [pid 25135:tid 25159] [client 209.87.169.207:32421] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/past.php"] [unique_id "abtaNaKtE0dzgMctjFWUNwAAA1Y"]
[Thu Mar 19 10:06:46.979856 2026] [:error] [pid 23882:tid 23917] [client 209.87.169.215:57685] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit-tags.php"] [unique_id "abtaNrWnClbtbN12M78jzgAAAA8"]
[Thu Mar 19 10:06:48.394422 2026] [:error] [pid 31205:tid 31218] [client 209.87.169.221:26789] [client 209.87.169.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "abtaOFu5gZKGrGz5P1FWrQAAAUI"]
[Thu Mar 19 10:06:49.167229 2026] [:error] [pid 25135:tid 25156] [client 209.87.169.30:64963] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "abtaOaKtE0dzgMctjFWURAAAA1M"]
[Thu Mar 19 10:06:49.625009 2026] [:error] [pid 23882:tid 23914] [client 209.87.169.33:64809] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "abtaObWnClbtbN12M78j1AAAAAw"]
[Thu Mar 19 10:06:52.990290 2026] [proxy_fcgi:error] [pid 25135:tid 25141] [client 209.87.169.235:48343] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:53.225148 2026] [:error] [pid 25135:tid 25159] [client 209.87.169.235:48343] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "abtaPaKtE0dzgMctjFWUVwAAA1Y"]
[Thu Mar 19 10:06:54.485672 2026] [proxy_fcgi:error] [pid 25135:tid 25142] [client 209.87.169.219:41367] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:56.277970 2026] [:error] [pid 25135:tid 25156] [client 209.87.169.219:41367] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "abtaQKKtE0dzgMctjFWUcwAAA1M"]
[Thu Mar 19 10:06:56.728966 2026] [:error] [pid 3278:tid 3291] [client 209.87.169.62:51371] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "abtaQAC2T_lM6ZgvfcRahgAAAQo"]
[Thu Mar 19 10:06:57.753004 2026] [:error] [pid 31313:tid 31377] [client 209.87.169.72:57231] [client 209.87.169.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "abtaQQ9HuAbqf2tZOycmIgAAAdA"]
[Thu Mar 19 10:06:58.294848 2026] [:error] [pid 25269:tid 25295] [client 209.87.169.37:21153] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ms-file.php"] [unique_id "abtaQsU9ntriqNcU-b6S3wAAA9c"]
[Thu Mar 19 10:06:58.789428 2026] [:error] [pid 25179:tid 25188] [client 209.87.169.253:24737] [client 209.87.169.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.253, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "abtaQmFzmTtmuBLc_LZZPQAAA4c"]
[Thu Mar 19 10:06:58.796288 2026] [proxy_fcgi:error] [pid 25179:tid 25188] [client 209.87.169.253:24737] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:06:59.041910 2026] [:error] [pid 25179:tid 25188] [client 209.87.169.253:24737] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/av.php"] [unique_id "abtaQ2FzmTtmuBLc_LZZQAAAA4c"]
[Thu Mar 19 10:06:59.816393 2026] [:error] [pid 25044:tid 25070] [client 209.87.169.66:40125] [client 209.87.169.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "abtaQ9UUDKsY7wMywpo7XwAAAtY"]
[Thu Mar 19 10:07:00.289227 2026] [:error] [pid 25179:tid 25201] [client 209.87.169.235:56811] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/network.php"] [unique_id "abtaRGFzmTtmuBLc_LZZRwAAA5Q"]
[Thu Mar 19 10:07:02.155970 2026] [:error] [pid 31205:tid 31224] [client 209.87.169.56:59235] [client 209.87.169.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "abtaRlu5gZKGrGz5P1FW-wAAAUc"]
[Thu Mar 19 10:07:02.666903 2026] [:error] [pid 25135:tid 25152] [client 209.87.169.207:40643] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/item.php"] [unique_id "abtaRqKtE0dzgMctjFWUhwAAA08"]
[Thu Mar 19 10:07:03.448836 2026] [:error] [pid 31313:tid 31364] [client 209.87.169.209:64315] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "abtaRw9HuAbqf2tZOycmNgAAAcM"]
[Thu Mar 19 10:07:03.962208 2026] [:error] [pid 25044:tid 25049] [client 209.87.169.242:33443] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/install.php"] [unique_id "abtaR9UUDKsY7wMywpo7bAAAAsE"]
[Thu Mar 19 10:07:04.425225 2026] [proxy_fcgi:error] [pid 32226:tid 32242] [client 209.87.169.48:33827] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:04.667079 2026] [:error] [pid 32226:tid 32247] [client 209.87.169.48:33827] [client 209.87.169.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.48, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "abtaSLBb58lgPwqxC6rTewAAAxM"]
[Thu Mar 19 10:07:04.969300 2026] [proxy_fcgi:error] [pid 32226:tid 32250] [client 209.87.169.48:33827] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:05.246949 2026] [:error] [pid 32226:tid 32248] [client 209.87.169.48:33827] [client 209.87.169.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "abtaSbBb58lgPwqxC6rTfgAAAxQ"]
[Thu Mar 19 10:07:06.251003 2026] [:error] [pid 25044:tid 25062] [client 209.87.169.209:47925] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "abtaStUUDKsY7wMywpo7dgAAAs4"]
[Thu Mar 19 10:07:06.734814 2026] [:error] [pid 31313:tid 31384] [client 209.87.169.236:39223] [client 209.87.169.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/1.php"] [unique_id "abtaSg9HuAbqf2tZOycmPgAAAdc"]
[Thu Mar 19 10:07:07.253573 2026] [:error] [pid 31313:tid 31384] [client 209.87.169.245:45669] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "abtaSw9HuAbqf2tZOycmQQAAAdc"]
[Thu Mar 19 10:07:08.246101 2026] [:error] [pid 31205:tid 31228] [client 209.87.169.42:20197] [client 209.87.169.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "abtaTFu5gZKGrGz5P1FXJgAAAUs"]
[Thu Mar 19 10:07:09.248062 2026] [:error] [pid 31313:tid 31384] [client 209.87.169.246:44523] [client 209.87.169.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "abtaTQ9HuAbqf2tZOycmTwAAAdc"]
[Thu Mar 19 10:07:09.724716 2026] [:error] [pid 23988:tid 24000] [client 209.87.169.32:45585] [client 209.87.169.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "abtaTWnlkSPXj2matr04QgAAAMk"]
[Thu Mar 19 10:07:10.460601 2026] [proxy_fcgi:error] [pid 24925:tid 24943] [client 209.87.169.55:40227] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:10.947701 2026] [:error] [pid 24925:tid 24945] [client 209.87.169.55:40227] [client 209.87.169.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "abtaTvUZEHbnUgjEbWNIDwAAAZA"]
[Thu Mar 19 10:07:11.723363 2026] [:error] [pid 31205:tid 31228] [client 209.87.169.244:65153] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "switchcreative.net"] [uri "/images/stories/themes.php"] [unique_id "abtaT1u5gZKGrGz5P1FXQAAAAUs"]
[Thu Mar 19 10:07:11.987893 2026] [:error] [pid 31205:tid 31236] [client 209.87.169.244:65153] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "abtaT1u5gZKGrGz5P1FXQQAAAVM"]
[Thu Mar 19 10:07:12.770249 2026] [:error] [pid 25135:tid 25158] [client 209.87.169.250:61879] [client 209.87.169.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "abtaUKKtE0dzgMctjFWUnQAAA1U"]
[Thu Mar 19 10:07:13.311475 2026] [:error] [pid 23882:tid 23909] [client 209.87.169.249:53565] [client 209.87.169.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/vars-soap.php"] [unique_id "abtaUbWnClbtbN12M78kOQAAAAc"]
[Thu Mar 19 10:07:14.698485 2026] [:error] [pid 25135:tid 25137] [client 209.87.169.243:20263] [client 209.87.169.243] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "abtaUqKtE0dzgMctjFWUsQAAA0A"]
[Thu Mar 19 10:07:15.536382 2026] [:error] [pid 25135:tid 25150] [client 209.87.169.71:42697] [client 209.87.169.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "abtaU6KtE0dzgMctjFWUugAAA00"]
[Thu Mar 19 10:07:16.276327 2026] [:error] [pid 25135:tid 25150] [client 209.87.169.236:21797] [client 209.87.169.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "abtaVKKtE0dzgMctjFWUvgAAA00"]
[Thu Mar 19 10:07:17.922423 2026] [proxy_fcgi:error] [pid 31205:tid 31239] [client 209.87.169.45:30063] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:18.151650 2026] [:error] [pid 31205:tid 31219] [client 209.87.169.45:30063] [client 209.87.169.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "abtaVlu5gZKGrGz5P1FXYAAAAUM"]
[Thu Mar 19 10:07:18.918923 2026] [:error] [pid 31205:tid 31239] [client 209.87.169.224:31761] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/colour.php"] [unique_id "abtaVlu5gZKGrGz5P1FXdAAAAVY"]
[Thu Mar 19 10:07:19.450628 2026] [:error] [pid 25135:tid 25158] [client 209.87.169.245:34321] [client 209.87.169.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "abtaV6KtE0dzgMctjFWUzQAAA1U"]
[Thu Mar 19 10:07:19.933153 2026] [:error] [pid 25135:tid 25158] [client 209.87.169.242:41807] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/include.php"] [unique_id "abtaV6KtE0dzgMctjFWUzwAAA1U"]
[Thu Mar 19 10:07:20.930397 2026] [:error] [pid 23988:tid 23992] [client 209.87.169.223:33137] [client 209.87.169.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "abtaWGnlkSPXj2matr04YgAAAME"]
[Thu Mar 19 10:07:22.306257 2026] [:error] [pid 31313:tid 31380] [client 209.87.169.40:34205] [client 209.87.169.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "abtaWg9HuAbqf2tZOycmdwAAAdM"]
[Thu Mar 19 10:07:23.069305 2026] [proxy_fcgi:error] [pid 23882:tid 23923] [client 209.87.169.227:30343] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:23.321232 2026] [:error] [pid 23882:tid 23918] [client 209.87.169.227:30343] [client 209.87.169.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/db.php"] [unique_id "abtaW7WnClbtbN12M78kfgAAABA"]
[Thu Mar 19 10:07:23.809649 2026] [:error] [pid 25179:tid 25183] [client 209.87.169.229:34145] [client 209.87.169.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "abtaW2FzmTtmuBLc_LZZWAAAA4I"]
[Thu Mar 19 10:07:24.572792 2026] [:error] [pid 25044:tid 25057] [client 209.87.169.232:49153] [client 209.87.169.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "abtaXNUUDKsY7wMywpo7yQAAAsk"]
[Thu Mar 19 10:07:25.116039 2026] [:error] [pid 25269:tid 25296] [client 209.87.169.220:30493] [client 209.87.169.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "abtaXcU9ntriqNcU-b6TBgAAA9g"]
[Thu Mar 19 10:07:25.879047 2026] [:error] [pid 25179:tid 25196] [client 209.87.169.46:63087] [client 209.87.169.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "abtaXWFzmTtmuBLc_LZZYQAAA48"]
[Thu Mar 19 10:07:26.672709 2026] [:error] [pid 25135:tid 25150] [client 209.87.169.217:22311] [client 209.87.169.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "abtaXqKtE0dzgMctjFWU2wAAA00"]
[Thu Mar 19 10:07:27.395700 2026] [:error] [pid 25269:tid 25287] [client 209.87.169.217:52451] [client 209.87.169.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "abtaX8U9ntriqNcU-b6TCwAAA88"]
[Thu Mar 19 10:07:27.912791 2026] [:error] [pid 25044:tid 25057] [client 209.87.169.224:27463] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/about.php"] [unique_id "abtaX9UUDKsY7wMywpo70gAAAsk"]
[Thu Mar 19 10:07:28.673266 2026] [:error] [pid 25179:tid 25196] [client 209.87.169.65:29953] [client 209.87.169.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/about.php"] [unique_id "abtaYGFzmTtmuBLc_LZZaQAAA48"]
[Thu Mar 19 10:07:29.195486 2026] [:error] [pid 25179:tid 25190] [client 209.87.169.253:57497] [client 209.87.169.253] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/simi.php"] [unique_id "abtaYWFzmTtmuBLc_LZZagAAA4k"]
[Thu Mar 19 10:07:30.284064 2026] [:error] [pid 31313:tid 31372] [client 209.87.169.219:46573] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "abtaYg9HuAbqf2tZOycmmQAAAcs"]
[Thu Mar 19 10:07:31.136993 2026] [:error] [pid 25269:tid 25290] [client 209.87.169.44:54499] [client 209.87.169.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "abtaY8U9ntriqNcU-b6TFQAAA9I"]
[Thu Mar 19 10:07:31.669946 2026] [:error] [pid 25269:tid 25291] [client 209.87.169.244:25255] [client 209.87.169.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "abtaY8U9ntriqNcU-b6TGQAAA9M"]
[Thu Mar 19 10:07:32.158361 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.224:58089] [client 209.87.169.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "abtaZPUZEHbnUgjEbWNILgAAAYM"]
[Thu Mar 19 10:07:35.988218 2026] [:error] [pid 25135:tid 25153] [client 209.87.169.71:29919] [client 209.87.169.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "abtaZ6KtE0dzgMctjFWU6gAAA1A"]
[Thu Mar 19 10:07:36.971532 2026] [:error] [pid 23882:tid 23923] [client 209.87.169.213:50585] [client 209.87.169.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "abtaaLWnClbtbN12M78kvAAAABU"]
[Thu Mar 19 10:07:37.708177 2026] [:error] [pid 3278:tid 3290] [client 209.87.169.212:54081] [client 209.87.169.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "abtaaQC2T_lM6ZgvfcRbfQAAAQk"]
[Thu Mar 19 10:07:38.457589 2026] [:error] [pid 3278:tid 3291] [client 209.87.169.72:41561] [client 209.87.169.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/chosen.php"] [unique_id "abtaagC2T_lM6ZgvfcRblgAAAQo"]
[Thu Mar 19 10:07:40.812005 2026] [:error] [pid 31447:tid 31469] [client 209.87.169.211:42935] [client 209.87.169.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugin.php"] [unique_id "abtabBmVNRDSLnGvghinAQAAAg4"]
[Thu Mar 19 10:07:41.274589 2026] [:error] [pid 25135:tid 25153] [client 209.87.169.61:34565] [client 209.87.169.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "abtabaKtE0dzgMctjFWU_wAAA1A"]
[Thu Mar 19 10:07:42.031522 2026] [:error] [pid 25135:tid 25143] [client 209.87.169.236:23827] [client 209.87.169.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "abtabqKtE0dzgMctjFWVBQAAA0Y"]
[Thu Mar 19 10:07:43.021250 2026] [:error] [pid 31313:tid 31382] [client 209.87.169.40:41247] [client 209.87.169.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "abtabw9HuAbqf2tZOycnAQAAAdU"]
[Thu Mar 19 10:07:43.698935 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.52:21389] [client 209.87.169.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/litespeed.php"] [unique_id "abtab8U9ntriqNcU-b6TNQAAA8A"]
[Thu Mar 19 10:07:44.156027 2026] [proxy_fcgi:error] [pid 25269:tid 25272] [client 209.87.169.32:32449] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:44.633151 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.32:32449] [client 209.87.169.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "abtacMU9ntriqNcU-b6TPgAAA8A"]
[Thu Mar 19 10:07:45.193131 2026] [:error] [pid 25269:tid 25274] [client 209.87.169.37:53053] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "abtaccU9ntriqNcU-b6TQgAAA8I"]
[Thu Mar 19 10:07:45.638039 2026] [:error] [pid 25044:tid 25068] [client 209.87.169.39:56039] [client 209.87.169.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "abtacdUUDKsY7wMywpo8EQAAAtQ"]
[Thu Mar 19 10:07:46.595886 2026] [:error] [pid 25044:tid 25048] [client 209.87.169.233:54669] [client 209.87.169.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "abtactUUDKsY7wMywpo8GgAAAsA"]
[Thu Mar 19 10:07:47.826832 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.217:49717] [client 209.87.169.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "abtac8U9ntriqNcU-b6TTgAAA8A"]
[Thu Mar 19 10:07:48.334292 2026] [proxy_fcgi:error] [pid 23882:tid 23904] [client 209.87.169.65:43737] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:07:48.580099 2026] [:error] [pid 23882:tid 23918] [client 209.87.169.65:43737] [client 209.87.169.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/shell.php"] [unique_id "abtadLWnClbtbN12M78k2QAAABA"]
[Thu Mar 19 10:07:49.069584 2026] [:error] [pid 25269:tid 25295] [client 209.87.169.242:42165] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "abtadcU9ntriqNcU-b6TUwAAA9c"]
[Thu Mar 19 10:07:49.843999 2026] [:error] [pid 31313:tid 31373] [client 209.87.169.227:50699] [client 209.87.169.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "abtadQ9HuAbqf2tZOycnEwAAAcw"]
[Thu Mar 19 10:07:50.318552 2026] [:error] [pid 25269:tid 25272] [client 209.87.169.219:50183] [client 209.87.169.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "abtadsU9ntriqNcU-b6TYgAAA8A"]
[Thu Mar 19 10:07:52.449908 2026] [:error] [pid 31205:tid 31239] [client 209.87.169.72:40143] [client 209.87.169.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-2019.php"] [unique_id "abtaeFu5gZKGrGz5P1FYHAAAAVY"]
[Thu Mar 19 10:07:52.916683 2026] [:error] [pid 25269:tid 25286] [client 209.87.169.62:57649] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "abtaeMU9ntriqNcU-b6TdQAAA84"]
[Thu Mar 19 10:07:53.393882 2026] [:error] [pid 23882:tid 23924] [client 209.87.169.29:64443] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "abtaebWnClbtbN12M78k7wAAABY"]
[Thu Mar 19 10:07:53.915322 2026] [:error] [pid 31205:tid 31216] [client 209.87.169.35:46847] [client 209.87.169.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "abtaeVu5gZKGrGz5P1FYKwAAAUA"]
[Thu Mar 19 10:07:54.381645 2026] [:error] [pid 23882:tid 23924] [client 209.87.169.66:33491] [client 209.87.169.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/aw.php"] [unique_id "abtaerWnClbtbN12M78k9QAAABY"]
[Thu Mar 19 10:07:55.342630 2026] [:error] [pid 25269:tid 25280] [client 209.87.169.29:35735] [client 209.87.169.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/db.php"] [unique_id "abtae8U9ntriqNcU-b6TjQAAA8g"]
[Thu Mar 19 10:07:55.802535 2026] [:error] [pid 24925:tid 24937] [client 209.87.169.231:44157] [client 209.87.169.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/install.php"] [unique_id "abtae_UZEHbnUgjEbWNITgAAAYg"]
[Thu Mar 19 10:07:56.249588 2026] [:error] [pid 31313:tid 31381] [client 209.87.169.30:25053] [client 209.87.169.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/install.php"] [unique_id "abtafA9HuAbqf2tZOycnIgAAAdQ"]
[Thu Mar 19 10:07:56.714687 2026] [:error] [pid 23882:tid 23915] [client 209.87.169.207:53109] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "abtafLWnClbtbN12M78lBwAAAA0"]
[Thu Mar 19 10:07:57.702475 2026] [:error] [pid 23882:tid 23924] [client 209.87.169.40:54043] [client 209.87.169.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/template-less.php"] [unique_id "abtafbWnClbtbN12M78lEQAAABY"]
[Thu Mar 19 10:07:58.156734 2026] [:error] [pid 25269:tid 25287] [client 209.87.169.54:36747] [client 209.87.169.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "abtafsU9ntriqNcU-b6TnQAAA88"]
[Thu Mar 19 10:07:59.896584 2026] [:error] [pid 23882:tid 23925] [client 209.87.169.33:36693] [client 209.87.169.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/min.php"] [unique_id "abtaf7WnClbtbN12M78lJwAAABc"]
[Thu Mar 19 10:08:00.402967 2026] [:error] [pid 23882:tid 23910] [client 209.87.169.213:47485] [client 209.87.169.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-conflg.php"] [unique_id "abtagLWnClbtbN12M78lKwAAAAg"]
[Thu Mar 19 10:08:01.519748 2026] [:error] [pid 25135:tid 25158] [client 209.87.169.215:58763] [client 209.87.169.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/file.php"] [unique_id "abtagaKtE0dzgMctjFWVUgAAA1U"]
[Thu Mar 19 10:08:02.203160 2026] [:error] [pid 31313:tid 31383] [client 209.87.169.237:55167] [client 209.87.169.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "abtagg9HuAbqf2tZOycnQgAAAdY"]
[Thu Mar 19 10:08:02.663704 2026] [:error] [pid 25135:tid 25139] [client 209.87.169.249:36205] [client 209.87.169.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/load.php"] [unique_id "abtagqKtE0dzgMctjFWVVgAAA0I"]
[Thu Mar 19 10:08:03.123018 2026] [:error] [pid 23882:tid 23922] [client 209.87.169.73:46055] [client 209.87.169.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "abtag7WnClbtbN12M78lNgAAABQ"]
[Thu Mar 19 10:08:03.603207 2026] [:error] [pid 31205:tid 31217] [client 209.87.169.46:59995] [client 209.87.169.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "abtag1u5gZKGrGz5P1FYVQAAAUE"]
[Thu Mar 19 10:08:04.087808 2026] [proxy_fcgi:error] [pid 23882:tid 23909] [client 209.87.169.226:60893] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 10:08:05.276668 2026] [:error] [pid 25135:tid 25161] [client 209.87.169.44:49367] [client 209.87.169.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "abtahaKtE0dzgMctjFWVcwAAA1g"]
[Thu Mar 19 10:08:05.716803 2026] [:error] [pid 25135:tid 25141] [client 209.87.169.235:20041] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "abtahaKtE0dzgMctjFWVfgAAA0Q"]
[Thu Mar 19 10:08:06.586520 2026] [:error] [pid 25135:tid 25161] [client 209.87.169.208:41849] [client 209.87.169.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "abtahqKtE0dzgMctjFWVigAAA1g"]
[Thu Mar 19 10:08:07.178224 2026] [:error] [pid 31205:tid 31232] [client 209.87.169.48:33187] [client 209.87.169.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "abtah1u5gZKGrGz5P1FYWwAAAU8"]
[Thu Mar 19 10:08:07.622954 2026] [:error] [pid 25135:tid 25155] [client 209.87.169.206:46815] [client 209.87.169.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "abtah6KtE0dzgMctjFWVkwAAA1I"]
[Thu Mar 19 10:08:08.600652 2026] [:error] [pid 23988:tid 23995] [client 209.87.169.38:60519] [client 209.87.169.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/system.php"] [unique_id "abtaiGnlkSPXj2matr04qgAAAMQ"]
[Thu Mar 19 10:08:09.080419 2026] [:error] [pid 31205:tid 31227] [client 209.87.169.251:21469] [client 209.87.169.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-translations-library.php"] [unique_id "abtaiVu5gZKGrGz5P1FYaAAAAUo"]
[Thu Mar 19 10:08:09.524108 2026] [:error] [pid 31205:tid 31227] [client 209.87.169.62:56847] [client 209.87.169.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "abtaiVu5gZKGrGz5P1FYbAAAAUo"]
[Thu Mar 19 10:08:10.007843 2026] [:error] [pid 31205:tid 31227] [client 209.87.169.65:43709] [client 209.87.169.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "abtailu5gZKGrGz5P1FYbwAAAUo"]
[Thu Mar 19 10:08:10.473110 2026] [:error] [pid 31205:tid 31227] [client 185.198.240.24:35365] [client 185.198.240.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/simi.php"] [unique_id "abtailu5gZKGrGz5P1FYdQAAAUo"]
[Thu Mar 19 10:08:10.944189 2026] [:error] [pid 23988:tid 23998] [client 209.87.169.226:29841] [client 209.87.169.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "abtaimnlkSPXj2matr04rAAAAMc"]
[Thu Mar 19 10:09:42.977813 2026] [autoindex:error] [pid 31205:tid 31233] [client 209.87.169.57:53837] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:43.214307 2026] [autoindex:error] [pid 31205:tid 31224] [client 209.87.169.57:53837] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:09:43.942819 2026] [autoindex:error] [pid 31205:tid 31228] [client 209.87.169.57:53837] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:08.100482 2026] [:error] [pid 23883:tid 23950] [client 209.87.169.45:45687] [client 209.87.169.45] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "209.87.169.56_c32d869dd7fb09be3074c62348aafab920b3d240"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/dev/beijaflorstudio/wp-content/plugins/watch/"] [unique_id "abta-9Ni-EnEAH4abz2btAAAAFU"]
[Thu Mar 19 10:43:04.676958 2026] [:error] [pid 25135:tid 25144] [client 200.201.116.168:10001] [client 200.201.116.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.201.116.168, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abtiuKKtE0dzgMctjFWr3AAAA0c"]
[Thu Mar 19 10:43:04.691008 2026] [proxy_fcgi:error] [pid 25135:tid 25144] [client 200.201.116.168:10001] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 12:11:28.461635 2026] [:error] [pid 31205:tid 31240] [client 114.80.36.40:52338] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abt3cFu5gZKGrGz5P1GZ3wAAAVc"]
[Thu Mar 19 12:54:13.124730 2026] [:error] [pid 25135:tid 25157] [client 154.16.49.101:6496] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abuBdaKtE0dzgMctjFXtXAAAA1Q"]
[Thu Mar 19 12:54:13.618214 2026] [:error] [pid 24925:tid 24931] [client 154.16.49.101:6650] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBdfUZEHbnUgjEbWNmvgAAAYI"]
[Thu Mar 19 12:54:14.111635 2026] [:error] [pid 25135:tid 25141] [client 154.16.49.101:6826] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feed/"] [unique_id "abuBdqKtE0dzgMctjFXtYwAAA0Q"]
[Thu Mar 19 14:22:23.911698 2026] [:error] [pid 11016:tid 11083] [client 49.205.97.130:15964] [client 49.205.97.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.205.97.130, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abuWHxPK94J9G19C6uXfjAAAAQo"]
[Thu Mar 19 14:22:23.920736 2026] [proxy_fcgi:error] [pid 11016:tid 11083] [client 49.205.97.130:15964] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 14:22:28.310906 2026] [:error] [pid 11016:tid 11073] [client 112.202.124.20:28137] [client 112.202.124.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.124.20, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abuWJBPK94J9G19C6uXfuAAAAQA"]
[Thu Mar 19 14:22:28.317845 2026] [proxy_fcgi:error] [pid 11016:tid 11073] [client 112.202.124.20:28137] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 16:11:01.038941 2026] [:error] [pid 11015:tid 11050] [client 170.106.163.84:57384] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abuvlfPcMwFQZAVfzLQr2AAAAIQ"]
[Thu Mar 19 17:35:02.225196 2026] [:error] [pid 1247:tid 1268] [client 180.153.236.16:47354] [client 180.153.236.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abvDRg5tmeOr-yI4XNGE7AAAAdM"], referer: http://switchcreative.net/
[Thu Mar 19 18:04:14.698849 2026] [:error] [pid 11014:tid 11043] [client 157.22.73.252:37027] [client 157.22.73.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.22.73.252, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abvKHjBVizvrAl0DfCAGLwAAAFg"]
[Thu Mar 19 18:04:14.707530 2026] [proxy_fcgi:error] [pid 11014:tid 11043] [client 157.22.73.252:37027] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 19:01:45.918853 2026] [:error] [pid 1247:tid 1272] [client 37.66.176.50:27023] [client 37.66.176.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.66.176.50, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abvXmQ5tmeOr-yI4XNGlKgAAAdc"]
[Thu Mar 19 19:01:45.929136 2026] [proxy_fcgi:error] [pid 1247:tid 1272] [client 37.66.176.50:27023] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 19:03:22.807555 2026] [:error] [pid 1285:tid 1289] [client 182.75.216.230:64532] [client 182.75.216.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.75.216.230, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abvX-lE95r3zR75X1HoDjAAAAgI"]
[Thu Mar 19 19:03:22.818175 2026] [proxy_fcgi:error] [pid 1285:tid 1289] [client 182.75.216.230:64532] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 19:05:17.874924 2026] [:error] [pid 1285:tid 1291] [client 192.144.148.122:50828] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abvYbVE95r3zR75X1HoEzwAAAgQ"]
[Thu Mar 19 21:18:25.721627 2026] [:error] [pid 1247:tid 1261] [client 45.131.195.40:39703] [client 45.131.195.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.40, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "abv3oQ5tmeOr-yI4XNHliAAAAcw"]
[Thu Mar 19 21:18:25.731517 2026] [proxy_fcgi:error] [pid 1247:tid 1261] [client 45.131.195.40:39703] AH01071: Got error 'Primary script unknown'
[Thu Mar 19 21:55:20.708812 2026] [:error] [pid 1247:tid 1265] [client 43.133.253.253:50248] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abwASA5tmeOr-yI4XNH5RQAAAdA"]
[Thu Mar 19 22:38:27.633847 2026] [:error] [pid 1247:tid 1260] [client 180.153.236.79:25367] [client 180.153.236.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abwKYw5tmeOr-yI4XNESPwAAAcs"], referer: http://www.switchcreative.net/
[Fri Mar 20 00:12:29.883053 2026] [:error] [pid 11015:tid 11067] [client 196.75.166.22:57510] [client 196.75.166.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.75.166.22, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abwgbfPcMwFQZAVfzLSqwgAAAJU"]
[Fri Mar 20 00:12:29.894065 2026] [proxy_fcgi:error] [pid 11015:tid 11067] [client 196.75.166.22:57510] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 00:51:34.495744 2026] [:error] [pid 46264:tid 46296] [client 94.103.0.254:37912] [client 94.103.0.254] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abwplop3TruHFmWOt5HGWgAAAA0"]
[Fri Mar 20 01:14:32.577958 2026] [:error] [pid 46124:tid 46202] [client 209.97.171.56:55982] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abwu-EzMrlLOY6zyCjJ2awAAAFY"]
[Fri Mar 20 04:25:33.814343 2026] [:error] [pid 58125:tid 58144] [client 94.156.152.43:58746] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "abxbvfKqkvJQoqsQGeVOjAAAAAA"]
[Fri Mar 20 04:25:34.493781 2026] [:error] [pid 58127:tid 58204] [client 94.156.152.43:61996] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/style.php"] [unique_id "abxbvrQ_HbYy8C6I_EHR-QAAAIU"]
[Fri Mar 20 04:25:35.131446 2026] [:error] [pid 58127:tid 58221] [client 94.156.152.43:55303] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/themes/style.php"] [unique_id "abxbv7Q_HbYy8C6I_EHR-wAAAJY"]
[Fri Mar 20 04:25:35.811939 2026] [:error] [pid 58230:tid 58239] [client 94.156.152.43:62261] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/style.php"] [unique_id "abxbv_eBObYxbmHTzfqZ3gAAAMY"]
[Fri Mar 20 04:25:36.451320 2026] [:error] [pid 58230:tid 58253] [client 94.156.152.43:60319] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style.php"] [unique_id "abxbwPeBObYxbmHTzfqZ4QAAANQ"]
[Fri Mar 20 04:25:37.087816 2026] [:error] [pid 58230:tid 58249] [client 94.156.152.43:65271] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "abxbwfeBObYxbmHTzfqZ5AAAANA"]
[Fri Mar 20 04:25:37.723359 2026] [:error] [pid 58230:tid 58241] [client 94.156.152.43:58088] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "abxbwfeBObYxbmHTzfqZ5wAAAMg"]
[Fri Mar 20 04:25:38.360852 2026] [:error] [pid 58230:tid 58235] [client 94.156.152.43:55201] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/flower.php"] [unique_id "abxbwveBObYxbmHTzfqZ7AAAAMI"]
[Fri Mar 20 04:25:39.037152 2026] [:error] [pid 58230:tid 58248] [client 94.156.152.43:52115] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "abxbw_eBObYxbmHTzfqZ8QAAAM8"]
[Fri Mar 20 04:25:39.670563 2026] [:error] [pid 58230:tid 58252] [client 94.156.152.43:62932] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "abxbw_eBObYxbmHTzfqZ9AAAANM"]
[Fri Mar 20 04:25:40.346754 2026] [:error] [pid 58127:tid 58217] [client 94.156.152.43:51911] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "abxbxLQ_HbYy8C6I_EHR_wAAAJI"]
[Fri Mar 20 04:25:41.024867 2026] [:error] [pid 58230:tid 58237] [client 94.156.152.43:53726] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/blurbs.php"] [unique_id "abxbxfeBObYxbmHTzfqZ_AAAAMQ"]
[Fri Mar 20 04:25:41.661834 2026] [:error] [pid 58230:tid 58255] [client 94.156.152.43:64085] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "abxbxfeBObYxbmHTzfqZ_gAAANY"]
[Fri Mar 20 04:25:42.300490 2026] [:error] [pid 58230:tid 58238] [client 94.156.152.43:58040] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "abxbxveBObYxbmHTzfqaAAAAAMU"]
[Fri Mar 20 04:25:42.977800 2026] [:error] [pid 58127:tid 58199] [client 94.156.152.43:63102] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "abxbxrQ_HbYy8C6I_EHSOgAAAIA"]
[Fri Mar 20 04:25:43.654555 2026] [:error] [pid 58230:tid 58247] [client 94.156.152.43:63960] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/cord.php"] [unique_id "abxbx_eBObYxbmHTzfqaBwAAAM4"]
[Fri Mar 20 04:25:44.338052 2026] [:error] [pid 58127:tid 58205] [client 94.156.152.43:51248] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/dex.php"] [unique_id "abxbyLQ_HbYy8C6I_EHSOwAAAIY"]
[Fri Mar 20 04:25:45.016763 2026] [:error] [pid 58127:tid 58211] [client 94.156.152.43:59412] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/admin-ajax.php"] [unique_id "abxbybQ_HbYy8C6I_EHSPQAAAIw"]
[Fri Mar 20 04:25:45.695789 2026] [:error] [pid 58126:tid 58175] [client 94.156.152.43:54081] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "abxbyaKAmdXQSS0Y5KA-XQAAAEM"]
[Fri Mar 20 04:25:46.331021 2026] [:error] [pid 58126:tid 58181] [client 94.156.152.43:50390] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "abxbyqKAmdXQSS0Y5KA-YAAAAEk"]
[Fri Mar 20 04:25:47.009429 2026] [:error] [pid 58127:tid 58201] [client 94.156.152.43:63624] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/zwso.php"] [unique_id "abxby7Q_HbYy8C6I_EHSQQAAAII"]
[Fri Mar 20 04:25:47.691506 2026] [:error] [pid 58126:tid 58178] [client 94.156.152.43:63759] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "abxby6KAmdXQSS0Y5KA-ZgAAAEY"]
[Fri Mar 20 04:25:48.337249 2026] [:error] [pid 58230:tid 58237] [client 94.156.152.43:60403] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "abxbzPeBObYxbmHTzfqaDwAAAMQ"]
[Fri Mar 20 04:25:49.019378 2026] [:error] [pid 58127:tid 58218] [client 94.156.152.43:60378] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "abxbzbQ_HbYy8C6I_EHSRwAAAJM"]
[Fri Mar 20 04:25:49.700460 2026] [:error] [pid 58126:tid 58186] [client 94.156.152.43:51242] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "abxbzaKAmdXQSS0Y5KA-bgAAAE4"]
[Fri Mar 20 04:25:50.382704 2026] [:error] [pid 58126:tid 58179] [client 94.156.152.43:64321] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "abxbzqKAmdXQSS0Y5KA-cgAAAEc"]
[Fri Mar 20 04:25:51.020610 2026] [:error] [pid 58230:tid 58253] [client 94.156.152.43:58095] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/php8.php"] [unique_id "abxbz_eBObYxbmHTzfqaFAAAANQ"]
[Fri Mar 20 04:25:51.656852 2026] [:error] [pid 58127:tid 58221] [client 94.156.152.43:51313] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/lufix1.php"] [unique_id "abxbz7Q_HbYy8C6I_EHSSgAAAJY"]
[Fri Mar 20 04:25:52.338063 2026] [:error] [pid 58127:tid 58202] [client 94.156.152.43:57052] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/witmm.php"] [unique_id "abxb0LQ_HbYy8C6I_EHSTAAAAIM"]
[Fri Mar 20 04:25:53.017710 2026] [:error] [pid 58126:tid 58173] [client 94.156.152.43:56233] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/css/index.php"] [unique_id "abxb0aKAmdXQSS0Y5KA-egAAAEE"]
[Fri Mar 20 04:25:53.696193 2026] [:error] [pid 58126:tid 58183] [client 94.156.152.43:52271] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "abxb0aKAmdXQSS0Y5KA-ewAAAEs"]
[Fri Mar 20 04:25:54.335758 2026] [:error] [pid 58125:tid 58159] [client 94.156.152.43:63187] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "abxb0vKqkvJQoqsQGeVO-gAAAA8"]
[Fri Mar 20 04:25:54.977526 2026] [:error] [pid 58127:tid 58201] [client 94.156.152.43:50510] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "abxb0rQ_HbYy8C6I_EHSVgAAAII"]
[Fri Mar 20 04:25:55.618067 2026] [:error] [pid 58126:tid 58179] [client 94.156.152.43:61554] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "abxb06KAmdXQSS0Y5KA-fQAAAEc"]
[Fri Mar 20 04:25:56.258520 2026] [:error] [pid 58127:tid 58223] [client 94.156.152.43:64372] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/files.php"] [unique_id "abxb1LQ_HbYy8C6I_EHSXAAAAJg"]
[Fri Mar 20 04:25:56.896472 2026] [:error] [pid 58126:tid 58181] [client 94.156.152.43:57719] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-editor.php"] [unique_id "abxb1KKAmdXQSS0Y5KA-fgAAAEk"]
[Fri Mar 20 04:25:57.536632 2026] [:error] [pid 58126:tid 58176] [client 94.156.152.43:61781] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "abxb1aKAmdXQSS0Y5KA-fwAAAEQ"]
[Fri Mar 20 04:25:58.216982 2026] [:error] [pid 58230:tid 58243] [client 94.156.152.43:50658] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/txets.php"] [unique_id "abxb1veBObYxbmHTzfqaJgAAAMo"]
[Fri Mar 20 04:25:58.852493 2026] [:error] [pid 58126:tid 58192] [client 94.156.152.43:61374] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/txets.php"] [unique_id "abxb1qKAmdXQSS0Y5KA-hAAAAFQ"]
[Fri Mar 20 04:25:59.531945 2026] [:error] [pid 58230:tid 58238] [client 94.156.152.43:49379] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/postnews.php"] [unique_id "abxb1_eBObYxbmHTzfqaKwAAAMU"]
[Fri Mar 20 04:26:00.175047 2026] [:error] [pid 58127:tid 58219] [client 94.156.152.43:64829] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/postnews.php"] [unique_id "abxb2LQ_HbYy8C6I_EHSYwAAAJQ"]
[Fri Mar 20 04:26:00.818749 2026] [:error] [pid 58127:tid 58206] [client 94.156.152.43:60232] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/postnews.php"] [unique_id "abxb2LQ_HbYy8C6I_EHSZQAAAIc"]
[Fri Mar 20 10:22:35.282671 2026] [:error] [pid 49080:tid 49105] [client 43.130.131.18:56224] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abyva4k5CHi4V0A3ttjuYgAAAFM"]
[Fri Mar 20 12:07:00.807995 2026] [core:error] [pid 49082:tid 49146] [client 80.68.13.190:40389] AH00135: Invalid method in request POSTPOST / HTTP/1.1
[Fri Mar 20 13:51:08.472992 2026] [:error] [pid 49081:tid 49131] [client 67.220.80.110:45048] [client 67.220.80.110] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=image/png"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "abzgTBo1LBAUhfhYPR2o5gAAARA"]
[Fri Mar 20 15:16:40.435168 2026] [:error] [pid 49170:tid 49180] [client 45.113.251.111:50083] [client 45.113.251.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.113.251.111, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "abz0WM-c8ctLVDCqUJUsMgAAAAY"]
[Fri Mar 20 15:16:40.447495 2026] [proxy_fcgi:error] [pid 49170:tid 49180] [client 45.113.251.111:50083] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 15:49:18.996376 2026] [:error] [pid 49080:tid 49103] [client 125.94.144.102:34289] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "abz7_ok5CHi4V0A3ttiSagAAAFE"]
[Fri Mar 20 16:25:50.426918 2026] [autoindex:error] [pid 27302:tid 27327] [client 141.98.11.17:64069] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 20 17:12:14.807262 2026] [:error] [pid 49080:tid 49096] [client 43.133.139.6:36784] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab0Pbok5CHi4V0A3tti8CAAAAEo"]
[Fri Mar 20 18:57:21.509838 2026] [:error] [pid 27302:tid 27327] [client 146.19.44.139:20535] [client 146.19.44.139] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab0oEbDKiUve17xv6yFlHgAAANc"]
[Fri Mar 20 18:57:21.510174 2026] [:error] [pid 27302:tid 27327] [client 146.19.44.139:20535] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.19.44.139, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab0oEbDKiUve17xv6yFlHgAAANc"]
[Fri Mar 20 18:57:21.520131 2026] [proxy_fcgi:error] [pid 27302:tid 27327] [client 146.19.44.139:20535] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 18:57:23.858060 2026] [:error] [pid 51714:tid 51725] [client 146.19.44.139:55475] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.19.44.139, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab0oEzWI82pxvQ0gksvTrgAAAIk"], referer: https://www.google.com
[Fri Mar 20 18:57:23.862079 2026] [proxy_fcgi:error] [pid 51714:tid 51725] [client 146.19.44.139:55475] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 18:57:26.429313 2026] [:error] [pid 49081:tid 49133] [client 146.19.44.139:48323] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.19.44.139, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab0oFho1LBAUhfhYPR1vhQAAARI"], referer: https://www.google.com
[Fri Mar 20 18:57:26.434440 2026] [proxy_fcgi:error] [pid 49081:tid 49133] [client 146.19.44.139:48323] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 18:57:28.517368 2026] [proxy_fcgi:error] [pid 49081:tid 49128] [client 146.19.44.139:20667] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 18:57:31.570302 2026] [:error] [pid 49082:tid 49143] [client 146.19.44.139:58751] [client 146.19.44.139] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ab0oG6pllYJI1LUIdL-q-wAAAUE"], referer: https://www.google.com
[Fri Mar 20 18:57:35.810078 2026] [:error] [pid 49081:tid 49135] [client 146.19.44.139:32025] [client 146.19.44.139] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab0oHxo1LBAUhfhYPR1vqAAAARQ"]
[Fri Mar 20 18:57:35.810304 2026] [:error] [pid 49081:tid 49135] [client 146.19.44.139:32025] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.19.44.139, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab0oHxo1LBAUhfhYPR1vqAAAARQ"]
[Fri Mar 20 18:57:35.813550 2026] [proxy_fcgi:error] [pid 49081:tid 49135] [client 146.19.44.139:32025] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 18:57:40.351695 2026] [:error] [pid 27302:tid 27306] [client 146.19.44.139:18423] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.19.44.139, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab0oJLDKiUve17xv6yFlPgAAAMI"], referer: https://www.google.com
[Fri Mar 20 18:57:40.357287 2026] [proxy_fcgi:error] [pid 27302:tid 27306] [client 146.19.44.139:18423] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 18:57:41.723522 2026] [:error] [pid 49081:tid 49134] [client 146.19.44.139:24547] [client 146.19.44.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.19.44.139, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab0oJRo1LBAUhfhYPR1vtgAAARM"], referer: https://www.google.com
[Fri Mar 20 18:57:41.727819 2026] [proxy_fcgi:error] [pid 49081:tid 49134] [client 146.19.44.139:24547] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 18:57:45.204696 2026] [proxy_fcgi:error] [pid 49081:tid 49118] [client 146.19.44.139:10813] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Mar 20 20:08:05.394639 2026] [:error] [pid 49170:tid 49183] [client 118.100.181.226:52339] [client 118.100.181.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.100.181.226, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab04pc-c8ctLVDCqUJV8lAAAAAk"]
[Fri Mar 20 20:08:05.406836 2026] [proxy_fcgi:error] [pid 49170:tid 49183] [client 118.100.181.226:52339] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 20:13:29.998644 2026] [:error] [pid 49081:tid 49121] [client 216.24.212.17:40861] [client 216.24.212.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.17, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab056Ro1LBAUhfhYPR2MzwAAAQY"]
[Fri Mar 20 20:13:30.025329 2026] [proxy_fcgi:error] [pid 49081:tid 49121] [client 216.24.212.17:40861] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 22:53:25.269413 2026] [:error] [pid 49082:tid 49143] [client 43.167.239.66:50722] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab1fZapllYJI1LUIdL_5MwAAAUE"]
[Fri Mar 20 23:11:03.518868 2026] [:error] [pid 49081:tid 49132] [client 182.44.12.37:42668] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab1jhxo1LBAUhfhYPR2bJwAAARE"]
[Sat Mar 21 06:18:48.654707 2026] [:error] [pid 49170:tid 49177] [client 182.42.111.156:44242] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab3HyL1KUC-QISS0eWogbgAAAQU"]
[Sat Mar 21 09:55:03.407324 2026] [:error] [pid 1489:tid 1508] [client 183.228.241.139:11357] [client 183.228.241.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab36d1RvnvBO_DG9kxszPwAAAAU"], referer: http://switchcreative.net/
[Sat Mar 21 13:21:54.566778 2026] [:error] [pid 1490:tid 1536] [client 182.42.105.144:47947] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab4q8mSWhIPTatyxDeDrKgAAAEM"]
[Sat Mar 21 18:31:15.555596 2026] [:error] [pid 1489:tid 1523] [client 14.97.73.106:50782] [client 14.97.73.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.97.73.106, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab5zc1RvnvBO_DG9kxvnQAAAABM"]
[Sat Mar 21 18:31:15.566120 2026] [proxy_fcgi:error] [pid 1489:tid 1523] [client 14.97.73.106:50782] AH01071: Got error 'Primary script unknown'
[Sat Mar 21 20:41:49.189435 2026] [:error] [pid 43052:tid 43066] [client 223.244.35.77:52261] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab6SDV5fjm-AiInC1hIlbQAAA4w"]
[Sat Mar 21 22:34:44.856961 2026] [:error] [pid 43052:tid 43067] [client 43.157.147.3:38050] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab6shF5fjm-AiInC1hJJ6gAAA40"]
[Sat Mar 21 22:43:18.485883 2026] [:error] [pid 1490:tid 1551] [client 157.22.75.229:22197] [client 157.22.75.229] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ab6uhmSWhIPTatyxDeByDwAAAFA"], referer: https://www.google.com
[Sat Mar 21 22:43:28.177886 2026] [:error] [pid 1489:tid 1521] [client 157.22.75.229:26847] [client 157.22.75.229] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab6ukFRvnvBO_DG9kxsoXQAAABE"]
[Sat Mar 21 22:43:28.178334 2026] [:error] [pid 1489:tid 1521] [client 157.22.75.229:26847] [client 157.22.75.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.22.75.229, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab6ukFRvnvBO_DG9kxsoXQAAABE"]
[Sat Mar 21 22:43:28.189200 2026] [proxy_fcgi:error] [pid 1489:tid 1521] [client 157.22.75.229:26847] AH01071: Got error 'Primary script unknown'
[Sat Mar 21 22:43:34.780326 2026] [:error] [pid 1490:tid 1557] [client 157.22.75.229:31581] [client 157.22.75.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.22.75.229, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab6ulmSWhIPTatyxDeByIQAAAFU"], referer: https://www.google.com
[Sat Mar 21 22:43:34.785288 2026] [proxy_fcgi:error] [pid 1490:tid 1557] [client 157.22.75.229:31581] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Sat Mar 21 22:43:36.377373 2026] [:error] [pid 33584:tid 33600] [client 157.22.75.229:43781] [client 157.22.75.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.22.75.229, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ab6umOATEQBBo5z2HkmqRwAAAc4"], referer: https://www.google.com
[Sat Mar 21 22:43:36.381228 2026] [proxy_fcgi:error] [pid 33584:tid 33600] [client 157.22.75.229:43781] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Sun Mar 22 02:06:17.650054 2026] [:error] [pid 40780:tid 40961] [client 5.75.201.222:36930] [client 5.75.201.222] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/ogg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab7eGSZDsmYIjKpJe4NjSAAAAA0"]
[Sun Mar 22 05:33:11.051612 2026] [proxy_fcgi:error] [pid 51362:tid 51401] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:11.261374 2026] [proxy_fcgi:error] [pid 51362:tid 51413] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:11.471361 2026] [proxy_fcgi:error] [pid 51362:tid 51408] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:11.680589 2026] [proxy_fcgi:error] [pid 51362:tid 51411] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:11.894415 2026] [proxy_fcgi:error] [pid 51362:tid 51415] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:12.313810 2026] [proxy_fcgi:error] [pid 51362:tid 51420] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:12.523186 2026] [proxy_fcgi:error] [pid 51362:tid 51405] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:14.393109 2026] [proxy_fcgi:error] [pid 51362:tid 51422] [client 52.138.39.105:9789] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 05:33:14.809567 2026] [:error] [pid 51362:tid 51404] [client 52.138.39.105:9789] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8OmsOwPm3DXzTDjUerbAAAAEM"]
[Sun Mar 22 05:33:15.635897 2026] [:error] [pid 40039:tid 40047] [client 52.138.39.105:28380] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8Omx3aDgUJfBYishnqKgAAAQY"]
[Sun Mar 22 05:33:16.471140 2026] [:error] [pid 40039:tid 40044] [client 52.138.39.105:28394] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8OnB3aDgUJfBYishnqMgAAAQM"]
[Sun Mar 22 05:33:17.295988 2026] [:error] [pid 51363:tid 51438] [client 52.138.39.105:25769] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ab8OnVwa9x6OCTRkhl1KVAAAAIk"]
[Sun Mar 22 10:05:59.061956 2026] [:error] [pid 51363:tid 51446] [client 198.98.49.140:54142] [client 198.98.49.140] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/qwik-json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab9Oh1wa9x6OCTRkhl2fagAAAJA"]
[Sun Mar 22 12:43:09.388570 2026] [:error] [pid 40039:tid 40041] [client 43.157.181.189:58946] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab9zXR3aDgUJfBYishkPfQAAAQA"]
[Sun Mar 22 13:11:25.654933 2026] [:error] [pid 51468:tid 51476] [client 180.191.49.124:65166] [client 180.191.49.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.49.124, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab95_U2TppSvA8W5CBRiKgAAAMA"]
[Sun Mar 22 13:11:25.666285 2026] [proxy_fcgi:error] [pid 51468:tid 51476] [client 180.191.49.124:65166] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 14:01:27.107984 2026] [:error] [pid 51468:tid 51477] [client 43.166.239.145:52826] [client 43.166.239.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab-Ft02TppSvA8W5CBSA9wAAAME"]
[Sun Mar 22 14:31:44.515540 2026] [:error] [pid 51468:tid 51487] [client 49.14.156.30:13221] [client 49.14.156.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.14.156.30, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab-M0E2TppSvA8W5CBSTPQAAAMs"]
[Sun Mar 22 14:31:44.531324 2026] [proxy_fcgi:error] [pid 51468:tid 51487] [client 49.14.156.30:13221] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:18:34.088504 2026] [:error] [pid 30166:tid 30198] [client 43.135.134.127:58518] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ab_QCrm4_26jKMD0zy3TiAAAAVU"]
[Sun Mar 22 19:30:31.255822 2026] [proxy_fcgi:error] [pid 51363:tid 51442] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:31.519532 2026] [proxy_fcgi:error] [pid 51363:tid 51443] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:31.786435 2026] [proxy_fcgi:error] [pid 51363:tid 51448] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:32.050056 2026] [proxy_fcgi:error] [pid 51363:tid 51434] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:32.312767 2026] [proxy_fcgi:error] [pid 51363:tid 51436] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:32.575898 2026] [proxy_fcgi:error] [pid 51363:tid 51432] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:32.838195 2026] [proxy_fcgi:error] [pid 51363:tid 51451] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:33.101385 2026] [proxy_fcgi:error] [pid 51363:tid 51439] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:33.365766 2026] [proxy_fcgi:error] [pid 51363:tid 51437] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:33.629896 2026] [proxy_fcgi:error] [pid 51363:tid 51429] [client 51.120.72.165:64382] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:30:33.890315 2026] [:error] [pid 51363:tid 51449] [client 51.120.72.165:64382] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ab_S2Vwa9x6OCTRkhl2aSAAAAJM"]
[Sun Mar 22 19:30:34.430155 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:64958] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ab_S2lwa9x6OCTRkhl2aSQAAAIw"]
[Sun Mar 22 19:30:34.952282 2026] [:error] [pid 40039:tid 40046] [client 51.120.72.165:64977] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ab_S2h3aDgUJfBYishmokwAAAQU"]
[Sun Mar 22 19:30:35.486583 2026] [:error] [pid 51363:tid 51453] [client 51.120.72.165:38591] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ab_S21wa9x6OCTRkhl2aTwAAAJc"]
[Sun Mar 22 19:30:36.012601 2026] [:error] [pid 51362:tid 51415] [client 51.120.72.165:64341] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ab_S3MOwPm3DXzTDjUepiQAAAE4"]
[Sun Mar 22 19:30:36.534088 2026] [:error] [pid 51362:tid 51419] [client 51.120.72.165:38529] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ab_S3MOwPm3DXzTDjUepjQAAAFI"]
[Sun Mar 22 19:30:37.078676 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:64967] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ab_S3bm4_26jKMD0zy3XxgAAAU4"]
[Sun Mar 22 19:30:37.597164 2026] [:error] [pid 51363:tid 51437] [client 51.120.72.165:64354] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ab_S3Vwa9x6OCTRkhl2aVQAAAIg"]
[Sun Mar 22 19:30:38.135498 2026] [:error] [pid 51363:tid 51438] [client 51.120.72.165:65022] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "ab_S3lwa9x6OCTRkhl2aVgAAAIk"]
[Sun Mar 22 19:30:38.665414 2026] [:error] [pid 51363:tid 51428] [client 51.120.72.165:38584] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "ab_S3lwa9x6OCTRkhl2aWwAAAIA"]
[Sun Mar 22 19:30:39.204642 2026] [:error] [pid 51363:tid 51449] [client 51.120.72.165:64261] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "ab_S31wa9x6OCTRkhl2aXgAAAJM"]
[Sun Mar 22 19:30:39.733999 2026] [:error] [pid 51363:tid 51434] [client 51.120.72.165:64343] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "ab_S31wa9x6OCTRkhl2aYAAAAIY"]
[Sun Mar 22 19:30:40.263952 2026] [:error] [pid 51362:tid 51423] [client 51.120.72.165:64920] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_S4MOwPm3DXzTDjUeplAAAAFY"]
[Sun Mar 22 19:30:40.792740 2026] [:error] [pid 51363:tid 51433] [client 51.120.72.165:38576] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_S4Fwa9x6OCTRkhl2aYwAAAIU"]
[Sun Mar 22 19:30:41.322731 2026] [:error] [pid 40039:tid 40056] [client 51.120.72.165:38589] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_S4R3aDgUJfBYishmolAAAAQ8"]
[Sun Mar 22 19:30:41.854416 2026] [:error] [pid 51362:tid 51413] [client 51.120.72.165:64320] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ab_S4cOwPm3DXzTDjUepmgAAAEw"]
[Sun Mar 22 19:30:42.379666 2026] [:error] [pid 51362:tid 51424] [client 51.120.72.165:64950] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ab_S4sOwPm3DXzTDjUepnQAAAFc"]
[Sun Mar 22 19:30:42.914341 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:38572] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ab_S4sOwPm3DXzTDjUepoAAAAFM"]
[Sun Mar 22 19:30:43.438820 2026] [:error] [pid 40039:tid 40042] [client 51.120.72.165:64319] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ab_S4x3aDgUJfBYishmolgAAAQE"]
[Sun Mar 22 19:30:44.000873 2026] [:error] [pid 30166:tid 30193] [client 51.120.72.165:38542] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ab_S47m4_26jKMD0zy3XzAAAAVI"]
[Sun Mar 22 19:30:44.554403 2026] [:error] [pid 40039:tid 40041] [client 51.120.72.165:64366] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ab_S5B3aDgUJfBYishmonAAAAQA"]
[Sun Mar 22 19:30:45.118415 2026] [:error] [pid 51468:tid 51480] [client 51.120.72.165:64921] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ab_S5U2TppSvA8W5CBRGLQAAAMQ"]
[Sun Mar 22 19:30:45.646697 2026] [:error] [pid 51362:tid 51406] [client 51.120.72.165:64349] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ab_S5cOwPm3DXzTDjUepowAAAEU"]
[Sun Mar 22 19:30:46.198059 2026] [:error] [pid 30166:tid 30192] [client 51.120.72.165:64269] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ab_S5rm4_26jKMD0zy3XzgAAAVE"]
[Sun Mar 22 19:30:46.788149 2026] [:error] [pid 51468:tid 51496] [client 51.120.72.165:64334] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ab_S5k2TppSvA8W5CBRGMQAAANQ"]
[Sun Mar 22 19:30:47.358794 2026] [:error] [pid 51363:tid 51432] [client 51.120.72.165:65003] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ab_S51wa9x6OCTRkhl2aawAAAIQ"]
[Sun Mar 22 19:30:47.890288 2026] [:error] [pid 40039:tid 40050] [client 51.120.72.165:64381] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ab_S5x3aDgUJfBYishmooAAAAQk"]
[Sun Mar 22 19:30:48.419803 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64912] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ab_S6MOwPm3DXzTDjUeppgAAAFU"]
[Sun Mar 22 19:30:48.957102 2026] [:error] [pid 51468:tid 51477] [client 51.120.72.165:64353] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ab_S6E2TppSvA8W5CBRGMgAAAME"]
[Sun Mar 22 19:30:49.479950 2026] [:error] [pid 40039:tid 40043] [client 51.120.72.165:64368] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ab_S6R3aDgUJfBYishmopgAAAQI"]
[Sun Mar 22 19:30:50.017559 2026] [:error] [pid 51362:tid 51405] [client 51.120.72.165:64375] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ab_S6sOwPm3DXzTDjUepqQAAAEQ"]
[Sun Mar 22 19:30:50.537356 2026] [:error] [pid 40039:tid 40048] [client 51.120.72.165:64358] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ab_S6h3aDgUJfBYishmopwAAAQc"]
[Sun Mar 22 19:30:51.061951 2026] [:error] [pid 40039:tid 40062] [client 51.120.72.165:64903] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ab_S6x3aDgUJfBYishmoqgAAARU"]
[Sun Mar 22 19:30:51.598270 2026] [:error] [pid 51363:tid 51446] [client 51.120.72.165:64930] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ab_S61wa9x6OCTRkhl2acAAAAJA"]
[Sun Mar 22 19:30:52.145477 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:64265] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ab_S7MOwPm3DXzTDjUeptQAAAEY"]
[Sun Mar 22 19:30:52.673493 2026] [:error] [pid 30166:tid 30177] [client 51.120.72.165:38578] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ab_S7Lm4_26jKMD0zy3X1QAAAUY"]
[Sun Mar 22 19:30:53.212665 2026] [:error] [pid 51363:tid 51443] [client 51.120.72.165:38582] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ab_S7Vwa9x6OCTRkhl2adAAAAI4"]
[Sun Mar 22 19:30:53.755208 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64896] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ab_S7cOwPm3DXzTDjUeptwAAAFU"]
[Sun Mar 22 19:30:54.308876 2026] [:error] [pid 30166:tid 30173] [client 51.120.72.165:63711] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ab_S7rm4_26jKMD0zy3X1gAAAUI"]
[Sun Mar 22 19:30:54.831658 2026] [:error] [pid 40039:tid 40043] [client 51.120.72.165:64915] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ab_S7h3aDgUJfBYishmotAAAAQI"]
[Sun Mar 22 19:30:55.357502 2026] [:error] [pid 40039:tid 40064] [client 51.120.72.165:64373] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ab_S7x3aDgUJfBYishmotwAAARc"]
[Sun Mar 22 19:30:55.882009 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:64995] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ab_S78OwPm3DXzTDjUepvgAAAEg"]
[Sun Mar 22 19:30:56.412310 2026] [:error] [pid 40039:tid 40063] [client 51.120.72.165:64371] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ab_S8B3aDgUJfBYishmouQAAARY"]
[Sun Mar 22 19:30:56.944821 2026] [:error] [pid 51362:tid 51404] [client 51.120.72.165:65021] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ab_S8MOwPm3DXzTDjUepwgAAAEM"]
[Sun Mar 22 19:30:57.477607 2026] [:error] [pid 30166:tid 30198] [client 51.120.72.165:64981] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ab_S8bm4_26jKMD0zy3X2AAAAVU"]
[Sun Mar 22 19:30:58.002646 2026] [:error] [pid 40039:tid 40055] [client 51.120.72.165:64953] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ab_S8h3aDgUJfBYishmougAAAQ4"]
[Sun Mar 22 19:30:58.536876 2026] [:error] [pid 51468:tid 51482] [client 51.120.72.165:38564] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ab_S8k2TppSvA8W5CBRGOAAAAMY"]
[Sun Mar 22 19:30:59.087817 2026] [:error] [pid 30166:tid 30186] [client 51.120.72.165:64959] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ab_S87m4_26jKMD0zy3X2gAAAUs"]
[Sun Mar 22 19:30:59.633269 2026] [:error] [pid 51363:tid 51447] [client 51.120.72.165:64931] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ab_S81wa9x6OCTRkhl2aeQAAAJE"]
[Sun Mar 22 19:31:00.177119 2026] [:error] [pid 30166:tid 30175] [client 51.120.72.165:64957] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ab_S9Lm4_26jKMD0zy3X3wAAAUQ"]
[Sun Mar 22 19:31:00.743335 2026] [:error] [pid 51363:tid 51439] [client 51.120.72.165:63655] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ab_S9Fwa9x6OCTRkhl2afQAAAIo"]
[Sun Mar 22 19:31:01.269871 2026] [:error] [pid 51361:tid 51379] [client 51.120.72.165:64367] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ab_S9RXYUsdvKC9YWpXX1QAAAAg"]
[Sun Mar 22 19:31:01.814702 2026] [:error] [pid 51362:tid 51425] [client 51.120.72.165:64962] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ab_S9cOwPm3DXzTDjUepxwAAAFg"]
[Sun Mar 22 19:31:02.346689 2026] [:error] [pid 51362:tid 51405] [client 51.120.72.165:64312] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ab_S9sOwPm3DXzTDjUepyAAAAEQ"]
[Sun Mar 22 19:31:02.902395 2026] [:error] [pid 51362:tid 51419] [client 51.120.72.165:64980] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ab_S9sOwPm3DXzTDjUepywAAAFI"]
[Sun Mar 22 19:31:03.427663 2026] [:error] [pid 51363:tid 51453] [client 51.120.72.165:64330] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ab_S91wa9x6OCTRkhl2ahAAAAJc"]
[Sun Mar 22 19:31:03.967747 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:63323] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ab_S98OwPm3DXzTDjUepzQAAAEg"]
[Sun Mar 22 19:31:04.497568 2026] [:error] [pid 30166:tid 30196] [client 51.120.72.165:63671] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ab_S-Lm4_26jKMD0zy3X4AAAAVM"]
[Sun Mar 22 19:31:05.024149 2026] [:error] [pid 51363:tid 51451] [client 51.120.72.165:64955] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ab_S-Vwa9x6OCTRkhl2aiQAAAJU"]
[Sun Mar 22 19:31:05.547766 2026] [:error] [pid 51362:tid 51404] [client 51.120.72.165:64899] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ab_S-cOwPm3DXzTDjUep0wAAAEM"]
[Sun Mar 22 19:31:06.098175 2026] [:error] [pid 51362:tid 51410] [client 51.120.72.165:64914] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ab_S-sOwPm3DXzTDjUep1QAAAEk"]
[Sun Mar 22 19:31:06.625852 2026] [:error] [pid 51362:tid 51415] [client 51.120.72.165:65008] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ab_S-sOwPm3DXzTDjUep2QAAAE4"]
[Sun Mar 22 19:31:07.173819 2026] [:error] [pid 51363:tid 51438] [client 51.120.72.165:64340] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ab_S-1wa9x6OCTRkhl2akgAAAIk"]
[Sun Mar 22 19:31:07.705079 2026] [:error] [pid 51468:tid 51495] [client 51.120.72.165:38580] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ab_S-02TppSvA8W5CBRGPgAAANM"]
[Sun Mar 22 19:31:08.239379 2026] [:error] [pid 51468:tid 51477] [client 51.120.72.165:64346] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ab_S_E2TppSvA8W5CBRGQAAAAME"]
[Sun Mar 22 19:31:08.769697 2026] [:error] [pid 51362:tid 51418] [client 51.120.72.165:38560] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ab_S_MOwPm3DXzTDjUep4QAAAFE"]
[Sun Mar 22 19:31:09.302918 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:64383] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ab_S_cOwPm3DXzTDjUep4wAAAFM"]
[Sun Mar 22 19:31:09.832890 2026] [:error] [pid 30166:tid 30186] [client 51.120.72.165:63721] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ab_S_bm4_26jKMD0zy3X5QAAAUs"]
[Sun Mar 22 19:31:10.356185 2026] [:error] [pid 51361:tid 51372] [client 51.120.72.165:64909] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ab_S_hXYUsdvKC9YWpXX3gAAAAE"]
[Sun Mar 22 19:31:10.879582 2026] [:error] [pid 51361:tid 51389] [client 51.120.72.165:65007] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ab_S_hXYUsdvKC9YWpXX3wAAABE"]
[Sun Mar 22 19:31:11.443714 2026] [:error] [pid 40039:tid 40041] [client 51.120.72.165:64945] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ab_S_x3aDgUJfBYishmoyAAAAQA"]
[Sun Mar 22 19:31:11.974342 2026] [:error] [pid 40039:tid 40045] [client 51.120.72.165:65020] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ab_S_x3aDgUJfBYishmoywAAAQQ"]
[Sun Mar 22 19:31:12.498597 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:64969] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ab_TAMOwPm3DXzTDjUep6QAAAEY"]
[Sun Mar 22 19:31:13.025791 2026] [:error] [pid 51468:tid 51476] [client 51.120.72.165:63730] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ab_TAU2TppSvA8W5CBRGQwAAAMA"]
[Sun Mar 22 19:31:13.564826 2026] [:error] [pid 51362:tid 51408] [client 51.120.72.165:38563] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ab_TAcOwPm3DXzTDjUep7QAAAEc"]
[Sun Mar 22 19:31:14.095573 2026] [:error] [pid 51468:tid 51494] [client 51.120.72.165:63717] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ab_TAk2TppSvA8W5CBRGRQAAANI"]
[Sun Mar 22 19:31:14.658175 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:64976] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ab_TAsOwPm3DXzTDjUep8AAAAEg"]
[Sun Mar 22 19:31:15.182210 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:64339] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ab_TA8OwPm3DXzTDjUep9AAAAFM"]
[Sun Mar 22 19:31:15.741819 2026] [:error] [pid 30166:tid 30187] [client 51.120.72.165:64291] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ab_TA7m4_26jKMD0zy3X8QAAAUw"]
[Sun Mar 22 19:31:16.267736 2026] [:error] [pid 51468:tid 51493] [client 51.120.72.165:64276] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ab_TBE2TppSvA8W5CBRGRgAAANE"]
[Sun Mar 22 19:31:16.802895 2026] [:error] [pid 40039:tid 40058] [client 51.120.72.165:63637] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ab_TBB3aDgUJfBYishmo0QAAARE"]
[Sun Mar 22 19:31:17.327599 2026] [:error] [pid 40039:tid 40061] [client 51.120.72.165:65014] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ab_TBR3aDgUJfBYishmo0gAAARQ"]
[Sun Mar 22 19:31:17.883730 2026] [:error] [pid 40039:tid 40048] [client 51.120.72.165:64993] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ab_TBR3aDgUJfBYishmo0wAAAQc"]
[Sun Mar 22 19:31:18.408334 2026] [:error] [pid 51361:tid 51380] [client 51.120.72.165:38552] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ab_TBhXYUsdvKC9YWpXX5gAAAAk"]
[Sun Mar 22 19:31:18.939831 2026] [:error] [pid 51362:tid 51425] [client 51.120.72.165:63729] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ab_TBsOwPm3DXzTDjUep-gAAAFg"]
[Sun Mar 22 19:31:19.485319 2026] [:error] [pid 40039:tid 40059] [client 51.120.72.165:64377] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ab_TBx3aDgUJfBYishmo1wAAARI"]
[Sun Mar 22 19:31:20.017072 2026] [:error] [pid 51361:tid 51373] [client 51.120.72.165:64926] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ab_TCBXYUsdvKC9YWpXX6AAAAAI"]
[Sun Mar 22 19:31:20.537010 2026] [:error] [pid 40039:tid 40047] [client 51.120.72.165:38553] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ab_TCB3aDgUJfBYishmo2wAAAQY"]
[Sun Mar 22 19:31:21.079202 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:64901] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ab_TCbm4_26jKMD0zy3X_QAAAU4"]
[Sun Mar 22 19:31:21.620914 2026] [:error] [pid 30166:tid 30183] [client 51.120.72.165:63659] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ab_TCbm4_26jKMD0zy3X_gAAAUg"]
[Sun Mar 22 19:31:22.163880 2026] [:error] [pid 51362:tid 51421] [client 51.120.72.165:64898] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ab_TCsOwPm3DXzTDjUep_QAAAFQ"]
[Sun Mar 22 19:31:22.693441 2026] [:error] [pid 51363:tid 51450] [client 51.120.72.165:64940] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ab_TClwa9x6OCTRkhl2anQAAAJQ"]
[Sun Mar 22 19:31:23.256164 2026] [:error] [pid 51363:tid 51452] [client 51.120.72.165:38581] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ab_TC1wa9x6OCTRkhl2aoAAAAJY"]
[Sun Mar 22 19:31:23.786207 2026] [:error] [pid 51361:tid 51385] [client 51.120.72.165:64299] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ab_TCxXYUsdvKC9YWpXX7QAAAA4"]
[Sun Mar 22 19:31:24.311462 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:64900] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ab_TDMOwPm3DXzTDjUeqBQAAAFM"]
[Sun Mar 22 19:31:24.837087 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:63627] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ab_TDMOwPm3DXzTDjUeqCAAAAEY"]
[Sun Mar 22 19:31:25.363691 2026] [:error] [pid 51362:tid 51419] [client 51.120.72.165:64365] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ab_TDcOwPm3DXzTDjUeqDgAAAFI"]
[Sun Mar 22 19:31:25.891356 2026] [:error] [pid 51362:tid 51418] [client 51.120.72.165:38588] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ab_TDcOwPm3DXzTDjUeqEwAAAFE"]
[Sun Mar 22 19:31:26.437484 2026] [:error] [pid 51363:tid 51446] [client 51.120.72.165:38565] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ab_TDlwa9x6OCTRkhl2aoQAAAJA"]
[Sun Mar 22 19:31:26.966741 2026] [:error] [pid 51363:tid 51428] [client 51.120.72.165:38549] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ab_TDlwa9x6OCTRkhl2apAAAAIA"]
[Sun Mar 22 19:31:27.504794 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:65016] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ab_TD8OwPm3DXzTDjUeqHAAAAEg"]
[Sun Mar 22 19:31:28.054459 2026] [:error] [pid 51362:tid 51418] [client 51.120.72.165:38590] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ab_TEMOwPm3DXzTDjUeqIgAAAFE"]
[Sun Mar 22 19:31:28.574333 2026] [:error] [pid 30166:tid 30174] [client 51.120.72.165:65000] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ab_TELm4_26jKMD0zy3YBwAAAUM"]
[Sun Mar 22 19:31:29.102125 2026] [:error] [pid 30166:tid 30187] [client 51.120.72.165:64263] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ab_TEbm4_26jKMD0zy3YCQAAAUw"]
[Sun Mar 22 19:31:29.623271 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:38547] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ab_TEcOwPm3DXzTDjUeqKwAAAEg"]
[Sun Mar 22 19:31:30.160704 2026] [:error] [pid 51362:tid 51421] [client 51.120.72.165:64971] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ab_TEsOwPm3DXzTDjUeqLQAAAFQ"]
[Sun Mar 22 19:31:30.693326 2026] [:error] [pid 51362:tid 51418] [client 51.120.72.165:63697] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ab_TEsOwPm3DXzTDjUeqLwAAAFE"]
[Sun Mar 22 19:31:31.222888 2026] [:error] [pid 30166:tid 30201] [client 51.120.72.165:38566] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ab_TE7m4_26jKMD0zy3YEAAAAVg"]
[Sun Mar 22 19:31:31.754063 2026] [:error] [pid 30166:tid 30188] [client 51.120.72.165:64304] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ab_TE7m4_26jKMD0zy3YEgAAAU0"]
[Sun Mar 22 19:31:32.283138 2026] [:error] [pid 30166:tid 30192] [client 51.120.72.165:65017] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ab_TFLm4_26jKMD0zy3YFgAAAVE"]
[Sun Mar 22 19:31:32.809640 2026] [:error] [pid 30166:tid 30196] [client 51.120.72.165:64913] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ab_TFLm4_26jKMD0zy3YGwAAAVM"]
[Sun Mar 22 19:31:33.348817 2026] [proxy_fcgi:error] [pid 51362:tid 51414] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:33.612756 2026] [proxy_fcgi:error] [pid 51362:tid 51404] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:33.888531 2026] [proxy_fcgi:error] [pid 51362:tid 51411] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:34.417594 2026] [proxy_fcgi:error] [pid 51362:tid 51406] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:34.681825 2026] [proxy_fcgi:error] [pid 51362:tid 51408] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:34.945818 2026] [proxy_fcgi:error] [pid 51362:tid 51405] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:35.209532 2026] [proxy_fcgi:error] [pid 51362:tid 51409] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:35.473620 2026] [proxy_fcgi:error] [pid 51362:tid 51422] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:36.638842 2026] [proxy_fcgi:error] [pid 51362:tid 51412] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:36.906223 2026] [proxy_fcgi:error] [pid 51362:tid 51423] [client 51.120.72.165:38531] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:31:37.167038 2026] [:error] [pid 51362:tid 51400] [client 51.120.72.165:38531] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ab_TGcOwPm3DXzTDjUeqRgAAAEA"]
[Sun Mar 22 19:31:37.688756 2026] [:error] [pid 40039:tid 40062] [client 51.120.72.165:64948] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ab_TGR3aDgUJfBYishmo5AAAARU"]
[Sun Mar 22 19:31:38.216900 2026] [:error] [pid 51361:tid 51372] [client 51.120.72.165:63620] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ab_TGhXYUsdvKC9YWpXX-AAAAAE"]
[Sun Mar 22 19:31:38.789877 2026] [:error] [pid 51362:tid 51402] [client 51.120.72.165:64357] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ab_TGsOwPm3DXzTDjUeqTgAAAEI"]
[Sun Mar 22 19:31:39.331910 2026] [:error] [pid 40039:tid 40044] [client 51.120.72.165:64972] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ab_TGx3aDgUJfBYishmo5wAAAQM"]
[Sun Mar 22 19:31:39.859698 2026] [:error] [pid 51363:tid 51448] [client 51.120.72.165:64984] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ab_TG1wa9x6OCTRkhl2aqAAAAJI"]
[Sun Mar 22 19:31:40.393839 2026] [:error] [pid 51468:tid 51495] [client 51.120.72.165:38551] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ab_THE2TppSvA8W5CBRGXQAAANM"]
[Sun Mar 22 19:31:41.012439 2026] [:error] [pid 51363:tid 51434] [client 51.120.72.165:63683] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ab_THVwa9x6OCTRkhl2aqwAAAIY"]
[Sun Mar 22 19:31:41.547109 2026] [:error] [pid 51361:tid 51377] [client 51.120.72.165:64975] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ab_THRXYUsdvKC9YWpXYBQAAAAY"]
[Sun Mar 22 19:31:42.185357 2026] [:error] [pid 51361:tid 51391] [client 51.120.72.165:64907] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ab_THhXYUsdvKC9YWpXYBwAAABM"]
[Sun Mar 22 19:31:42.728447 2026] [:error] [pid 51468:tid 51489] [client 51.120.72.165:65013] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ab_THk2TppSvA8W5CBRGYgAAAM0"]
[Sun Mar 22 19:31:43.543863 2026] [:error] [pid 40039:tid 40046] [client 51.120.72.165:64998] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ab_THx3aDgUJfBYishmo7AAAAQU"]
[Sun Mar 22 19:31:44.185022 2026] [:error] [pid 51468:tid 51484] [client 51.120.72.165:63733] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ab_TIE2TppSvA8W5CBRGZQAAAMg"]
[Sun Mar 22 19:31:44.768278 2026] [:error] [pid 51363:tid 51433] [client 51.120.72.165:38543] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ab_TIFwa9x6OCTRkhl2arQAAAIU"]
[Sun Mar 22 19:31:45.329032 2026] [:error] [pid 51363:tid 51450] [client 51.120.72.165:64908] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ab_TIVwa9x6OCTRkhl2argAAAJQ"]
[Sun Mar 22 19:31:45.893894 2026] [:error] [pid 51363:tid 51439] [client 51.120.72.165:38545] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ab_TIVwa9x6OCTRkhl2asAAAAIo"]
[Sun Mar 22 19:31:46.464634 2026] [:error] [pid 40039:tid 40064] [client 51.120.72.165:38550] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_TIh3aDgUJfBYishmo8gAAARc"]
[Sun Mar 22 19:31:47.054716 2026] [:error] [pid 30166:tid 30175] [client 51.120.72.165:64348] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_TI7m4_26jKMD0zy3YJgAAAUQ"]
[Sun Mar 22 19:31:47.586025 2026] [:error] [pid 40039:tid 40063] [client 51.120.72.165:38556] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_TIx3aDgUJfBYishmo9QAAARY"]
[Sun Mar 22 19:31:48.115809 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64279] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ab_TJMOwPm3DXzTDjUeqXwAAAFU"]
[Sun Mar 22 19:31:48.664954 2026] [:error] [pid 51362:tid 51412] [client 51.120.72.165:64313] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ab_TJMOwPm3DXzTDjUeqYAAAAEs"]
[Sun Mar 22 19:31:49.199274 2026] [:error] [pid 51363:tid 51428] [client 51.120.72.165:64256] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ab_TJVwa9x6OCTRkhl2aswAAAIA"]
[Sun Mar 22 19:31:49.727047 2026] [:error] [pid 51362:tid 51404] [client 51.120.72.165:64966] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ab_TJcOwPm3DXzTDjUeqYwAAAEM"]
[Sun Mar 22 19:31:50.274214 2026] [:error] [pid 51468:tid 51494] [client 51.120.72.165:38567] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ab_TJk2TppSvA8W5CBRGbQAAANI"]
[Sun Mar 22 19:31:50.848475 2026] [:error] [pid 51362:tid 51413] [client 51.120.72.165:64910] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ab_TJsOwPm3DXzTDjUeqZwAAAEw"]
[Sun Mar 22 19:31:51.386526 2026] [:error] [pid 51361:tid 51388] [client 51.120.72.165:63636] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ab_TJxXYUsdvKC9YWpXYDgAAABA"]
[Sun Mar 22 19:31:51.926520 2026] [:error] [pid 51363:tid 51442] [client 51.120.72.165:38558] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ab_TJ1wa9x6OCTRkhl2atQAAAI0"]
[Sun Mar 22 19:31:52.463544 2026] [:error] [pid 51363:tid 51448] [client 51.120.72.165:64902] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ab_TKFwa9x6OCTRkhl2auQAAAJI"]
[Sun Mar 22 19:31:53.034368 2026] [:error] [pid 40039:tid 40047] [client 51.120.72.165:65004] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ab_TKR3aDgUJfBYishmo-AAAAQY"]
[Sun Mar 22 19:31:53.561086 2026] [:error] [pid 51468:tid 51485] [client 51.120.72.165:65010] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ab_TKU2TppSvA8W5CBRGcQAAAMk"]
[Sun Mar 22 19:31:54.082655 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:38579] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ab_TKrm4_26jKMD0zy3YLwAAAU4"]
[Sun Mar 22 19:31:54.614761 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:64904] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ab_TKsOwPm3DXzTDjUeqagAAAEg"]
[Sun Mar 22 19:31:55.143051 2026] [:error] [pid 51363:tid 51451] [client 51.120.72.165:63684] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ab_TK1wa9x6OCTRkhl2avAAAAJU"]
[Sun Mar 22 19:31:55.675028 2026] [:error] [pid 51363:tid 51429] [client 51.120.72.165:64264] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ab_TK1wa9x6OCTRkhl2awQAAAIE"]
[Sun Mar 22 19:31:56.202854 2026] [:error] [pid 51468:tid 51490] [client 51.120.72.165:64897] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ab_TLE2TppSvA8W5CBRGcwAAAM4"]
[Sun Mar 22 19:31:56.728578 2026] [:error] [pid 40039:tid 40061] [client 51.120.72.165:64374] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ab_TLB3aDgUJfBYishmo_wAAARQ"]
[Sun Mar 22 19:31:57.251057 2026] [:error] [pid 40039:tid 40048] [client 51.120.72.165:64985] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ab_TLR3aDgUJfBYishmpAwAAAQc"]
[Sun Mar 22 19:31:57.777518 2026] [:error] [pid 51361:tid 51383] [client 51.120.72.165:64268] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ab_TLRXYUsdvKC9YWpXYFwAAAAw"]
[Sun Mar 22 19:31:58.302773 2026] [:error] [pid 40039:tid 40065] [client 51.120.72.165:64278] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ab_TLh3aDgUJfBYishmpCAAAARg"]
[Sun Mar 22 19:31:58.857589 2026] [:error] [pid 51362:tid 51421] [client 51.120.72.165:64379] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ab_TLsOwPm3DXzTDjUeqbQAAAFQ"]
[Sun Mar 22 19:31:59.381410 2026] [:error] [pid 51468:tid 51496] [client 51.120.72.165:65023] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ab_TL02TppSvA8W5CBRGdAAAANQ"]
[Sun Mar 22 19:31:59.923588 2026] [:error] [pid 51363:tid 51436] [client 51.120.72.165:64352] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ab_TL1wa9x6OCTRkhl2aygAAAIc"]
[Sun Mar 22 19:32:00.478005 2026] [:error] [pid 51363:tid 51430] [client 51.120.72.165:38539] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ab_TMFwa9x6OCTRkhl2azQAAAII"]
[Sun Mar 22 19:32:01.011879 2026] [:error] [pid 40039:tid 40064] [client 51.120.72.165:63297] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ab_TMR3aDgUJfBYishmpDAAAARc"]
[Sun Mar 22 19:32:01.557199 2026] [:error] [pid 30166:tid 30176] [client 51.120.72.165:63741] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "ab_TMbm4_26jKMD0zy3YNgAAAUU"]
[Sun Mar 22 19:32:02.080363 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64328] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "ab_TMsOwPm3DXzTDjUeqcQAAAFU"]
[Sun Mar 22 19:32:02.621553 2026] [:error] [pid 30166:tid 30186] [client 51.120.72.165:64996] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "ab_TMrm4_26jKMD0zy3YOAAAAUs"]
[Sun Mar 22 19:32:03.157456 2026] [:error] [pid 51468:tid 51499] [client 51.120.72.165:64378] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "ab_TM02TppSvA8W5CBRGdgAAANc"]
[Sun Mar 22 19:32:03.680514 2026] [:error] [pid 51361:tid 51382] [client 51.120.72.165:64965] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ab_TMxXYUsdvKC9YWpXYHAAAAAs"]
[Sun Mar 22 19:32:04.215698 2026] [:error] [pid 51468:tid 51483] [client 51.120.72.165:38538] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ab_TNE2TppSvA8W5CBRGeAAAAMc"]
[Sun Mar 22 19:32:04.739847 2026] [:error] [pid 51362:tid 51406] [client 51.120.72.165:64961] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ab_TNMOwPm3DXzTDjUeqdQAAAEU"]
[Sun Mar 22 19:32:05.277122 2026] [:error] [pid 40039:tid 40060] [client 51.120.72.165:64303] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ab_TNR3aDgUJfBYishmpEwAAARM"]
[Sun Mar 22 19:32:05.830144 2026] [:error] [pid 40039:tid 40046] [client 51.120.72.165:64277] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ab_TNR3aDgUJfBYishmpFgAAAQU"]
[Sun Mar 22 19:32:06.367810 2026] [:error] [pid 51361:tid 51376] [client 51.120.72.165:64978] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ab_TNhXYUsdvKC9YWpXYHwAAAAU"]
[Sun Mar 22 19:32:06.898202 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:38537] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ab_TNsOwPm3DXzTDjUeqeAAAAEg"]
[Sun Mar 22 19:32:07.421864 2026] [:error] [pid 51468:tid 51493] [client 51.120.72.165:64329] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ab_TN02TppSvA8W5CBRGegAAANE"]
[Sun Mar 22 19:32:07.943934 2026] [:error] [pid 30166:tid 30196] [client 51.120.72.165:64982] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ab_TN7m4_26jKMD0zy3YPwAAAVM"]
[Sun Mar 22 19:32:08.461105 2026] [:error] [pid 51468:tid 51489] [client 51.120.72.165:64954] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ab_TOE2TppSvA8W5CBRGewAAAM0"]
[Sun Mar 22 19:32:08.988618 2026] [:error] [pid 40039:tid 40045] [client 51.120.72.165:63624] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ab_TOB3aDgUJfBYishmpHwAAAQQ"]
[Sun Mar 22 19:32:09.520282 2026] [:error] [pid 51361:tid 51389] [client 51.120.72.165:64963] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ab_TORXYUsdvKC9YWpXYIwAAABE"]
[Sun Mar 22 19:32:10.055645 2026] [:error] [pid 30166:tid 30184] [client 51.120.72.165:64273] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "ab_TOrm4_26jKMD0zy3YSAAAAUk"]
[Sun Mar 22 19:32:10.571928 2026] [:error] [pid 51468:tid 51486] [client 51.120.72.165:64937] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "ab_TOk2TppSvA8W5CBRGfAAAAMo"]
[Sun Mar 22 19:32:11.117784 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:63714] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "ab_TO1wa9x6OCTRkhl2a0wAAAIw"]
[Sun Mar 22 19:32:11.641703 2026] [:error] [pid 51363:tid 51449] [client 51.120.72.165:38575] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "ab_TO1wa9x6OCTRkhl2a1QAAAJM"]
[Sun Mar 22 19:32:12.164538 2026] [:error] [pid 51363:tid 51448] [client 51.120.72.165:64289] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "ab_TPFwa9x6OCTRkhl2a1wAAAJI"]
[Sun Mar 22 19:32:12.687943 2026] [:error] [pid 30166:tid 30173] [client 51.120.72.165:64336] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "ab_TPLm4_26jKMD0zy3YWgAAAUI"]
[Sun Mar 22 19:32:13.214310 2026] [:error] [pid 40039:tid 40061] [client 51.120.72.165:64260] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "ab_TPR3aDgUJfBYishmpJAAAARQ"]
[Sun Mar 22 19:32:13.751327 2026] [:error] [pid 51363:tid 51431] [client 51.120.72.165:65006] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "ab_TPVwa9x6OCTRkhl2a3wAAAIM"]
[Sun Mar 22 19:32:14.299462 2026] [:error] [pid 51363:tid 51442] [client 51.120.72.165:64363] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "ab_TPlwa9x6OCTRkhl2a4wAAAI0"]
[Sun Mar 22 19:32:14.824192 2026] [:error] [pid 51362:tid 51405] [client 51.120.72.165:63676] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "ab_TPsOwPm3DXzTDjUeqfQAAAEQ"]
[Sun Mar 22 19:32:15.347192 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64989] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "ab_TP8OwPm3DXzTDjUeqfwAAAFU"]
[Sun Mar 22 19:32:15.874082 2026] [:error] [pid 51363:tid 51452] [client 51.120.72.165:63680] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "ab_TP1wa9x6OCTRkhl2a6AAAAJY"]
[Sun Mar 22 19:32:16.409446 2026] [:error] [pid 51363:tid 51447] [client 51.120.72.165:64973] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ab_TQFwa9x6OCTRkhl2a6gAAAJE"]
[Sun Mar 22 19:32:16.938845 2026] [:error] [pid 51362:tid 51411] [client 51.120.72.165:64311] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ab_TQMOwPm3DXzTDjUeqhwAAAEo"]
[Sun Mar 22 19:32:17.462415 2026] [:error] [pid 51363:tid 51434] [client 51.120.72.165:64326] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ab_TQVwa9x6OCTRkhl2a7QAAAIY"]
[Sun Mar 22 19:32:17.993102 2026] [:error] [pid 51362:tid 51404] [client 51.120.72.165:38587] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ab_TQcOwPm3DXzTDjUeqkAAAAEM"]
[Sun Mar 22 19:32:18.530352 2026] [:error] [pid 51362:tid 51413] [client 51.120.72.165:63713] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ab_TQsOwPm3DXzTDjUeqkgAAAEw"]
[Sun Mar 22 19:32:19.053166 2026] [:error] [pid 51362:tid 51410] [client 51.120.72.165:63641] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ab_TQ8OwPm3DXzTDjUeqlAAAAEk"]
[Sun Mar 22 19:32:19.633726 2026] [:error] [pid 51362:tid 51423] [client 51.120.72.165:64309] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ab_TQ8OwPm3DXzTDjUeqlwAAAFY"]
[Sun Mar 22 19:32:20.162086 2026] [:error] [pid 51362:tid 51401] [client 51.120.72.165:64956] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ab_TRMOwPm3DXzTDjUeqmwAAAEE"]
[Sun Mar 22 19:32:20.690319 2026] [:error] [pid 30166:tid 30188] [client 51.120.72.165:64337] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ab_TRLm4_26jKMD0zy3YYQAAAU0"]
[Sun Mar 22 19:32:21.220299 2026] [:error] [pid 51361:tid 51379] [client 51.120.72.165:64350] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ab_TRRXYUsdvKC9YWpXYJQAAAAg"]
[Sun Mar 22 19:32:21.744269 2026] [:error] [pid 51361:tid 51375] [client 51.120.72.165:64285] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ab_TRRXYUsdvKC9YWpXYJwAAAAQ"]
[Sun Mar 22 19:32:22.288080 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:64935] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ab_TRrm4_26jKMD0zy3YYwAAAU4"]
[Sun Mar 22 19:32:22.835401 2026] [:error] [pid 51362:tid 51417] [client 51.120.72.165:63662] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ab_TRsOwPm3DXzTDjUeqoAAAAFA"]
[Sun Mar 22 19:32:23.356044 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:64286] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ab_TR8OwPm3DXzTDjUeqogAAAEg"]
[Sun Mar 22 19:32:23.908395 2026] [:error] [pid 51363:tid 51446] [client 51.120.72.165:64376] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ab_TR1wa9x6OCTRkhl2a_gAAAJA"]
[Sun Mar 22 19:32:24.445960 2026] [:error] [pid 51363:tid 51431] [client 51.120.72.165:64355] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ab_TSFwa9x6OCTRkhl2a_wAAAIM"]
[Sun Mar 22 19:32:24.974676 2026] [:error] [pid 30166:tid 30182] [client 51.120.72.165:64332] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ab_TSLm4_26jKMD0zy3YawAAAUc"]
[Sun Mar 22 19:32:25.533727 2026] [:error] [pid 30166:tid 30199] [client 51.120.72.165:64323] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ab_TSbm4_26jKMD0zy3YbwAAAVY"]
[Sun Mar 22 19:32:26.056625 2026] [:error] [pid 51363:tid 51429] [client 51.120.72.165:64960] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ab_TSlwa9x6OCTRkhl2bBAAAAIE"]
[Sun Mar 22 19:32:26.587688 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:64951] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ab_TSsOwPm3DXzTDjUeqpwAAAFM"]
[Sun Mar 22 19:32:27.127158 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:64295] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ab_TS7m4_26jKMD0zy3YcwAAAU4"]
[Sun Mar 22 19:32:27.651662 2026] [:error] [pid 51468:tid 51480] [client 51.120.72.165:64347] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ab_TS02TppSvA8W5CBRGkgAAAMQ"]
[Sun Mar 22 19:32:28.193462 2026] [:error] [pid 51361:tid 51384] [client 51.120.72.165:64947] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ab_TTBXYUsdvKC9YWpXYKAAAAA0"]
[Sun Mar 22 19:32:28.728027 2026] [:error] [pid 51468:tid 51492] [client 51.120.72.165:64306] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ab_TTE2TppSvA8W5CBRGlQAAANA"]
[Sun Mar 22 19:32:29.277827 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:65019] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ab_TTcOwPm3DXzTDjUeqsgAAAEg"]
[Sun Mar 22 19:32:29.801737 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:64301] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ab_TTcOwPm3DXzTDjUeqtwAAAFU"]
[Sun Mar 22 19:32:30.325210 2026] [:error] [pid 51362:tid 51402] [client 51.120.72.165:63634] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ab_TTsOwPm3DXzTDjUequQAAAEI"]
[Sun Mar 22 19:32:30.851286 2026] [:error] [pid 51362:tid 51408] [client 51.120.72.165:64257] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ab_TTsOwPm3DXzTDjUeqvgAAAEc"]
[Sun Mar 22 19:32:31.378149 2026] [:error] [pid 51468:tid 51479] [client 51.120.72.165:64949] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ab_TT02TppSvA8W5CBRGmAAAAMM"]
[Sun Mar 22 19:32:31.921523 2026] [:error] [pid 51468:tid 51493] [client 51.120.72.165:65009] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ab_TT02TppSvA8W5CBRGmwAAANE"]
[Sun Mar 22 19:32:32.483480 2026] [:error] [pid 40039:tid 40062] [client 51.120.72.165:65012] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ab_TUB3aDgUJfBYishmpNwAAARU"]
[Sun Mar 22 19:32:33.063229 2026] [:error] [pid 51468:tid 51497] [client 51.120.72.165:38568] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ab_TUU2TppSvA8W5CBRGnQAAANU"]
[Sun Mar 22 19:32:33.614858 2026] [:error] [pid 40039:tid 40052] [client 51.120.72.165:63315] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ab_TUR3aDgUJfBYishmpOgAAAQs"]
[Sun Mar 22 19:32:34.148714 2026] [:error] [pid 51361:tid 51393] [client 51.120.72.165:63647] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ab_TUhXYUsdvKC9YWpXYLAAAABU"]
[Sun Mar 22 19:32:34.673593 2026] [:error] [pid 51468:tid 51490] [client 51.120.72.165:63644] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ab_TUk2TppSvA8W5CBRGowAAAM4"]
[Sun Mar 22 19:32:35.201352 2026] [:error] [pid 40039:tid 40046] [client 51.120.72.165:64370] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ab_TUx3aDgUJfBYishmpPQAAAQU"]
[Sun Mar 22 19:32:35.721528 2026] [:error] [pid 30166:tid 30183] [client 51.120.72.165:64928] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "ab_TU7m4_26jKMD0zy3YgwAAAUg"]
[Sun Mar 22 19:32:36.289423 2026] [proxy_fcgi:error] [pid 51363:tid 51450] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:36.564955 2026] [proxy_fcgi:error] [pid 51363:tid 51444] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:36.828391 2026] [proxy_fcgi:error] [pid 51363:tid 51432] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:37.092204 2026] [proxy_fcgi:error] [pid 51363:tid 51436] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:37.357782 2026] [proxy_fcgi:error] [pid 51363:tid 51447] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:37.620814 2026] [proxy_fcgi:error] [pid 51363:tid 51451] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:37.885957 2026] [proxy_fcgi:error] [pid 51363:tid 51453] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:38.159958 2026] [proxy_fcgi:error] [pid 51363:tid 51431] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:38.472192 2026] [proxy_fcgi:error] [pid 51363:tid 51443] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:38.736165 2026] [proxy_fcgi:error] [pid 51363:tid 51432] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:39.000403 2026] [proxy_fcgi:error] [pid 51363:tid 51436] [client 51.120.72.165:63306] AH01071: Got error 'Primary script unknown'
[Sun Mar 22 19:32:39.260141 2026] [:error] [pid 51363:tid 51449] [client 51.120.72.165:63306] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ab_TV1wa9x6OCTRkhl2bKwAAAJM"]
[Sun Mar 22 19:32:39.818842 2026] [:error] [pid 51361:tid 51389] [client 51.120.72.165:63658] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ab_TVxXYUsdvKC9YWpXYMgAAABE"]
[Sun Mar 22 19:32:40.340306 2026] [:error] [pid 51363:tid 51433] [client 51.120.72.165:38556] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ab_TWFwa9x6OCTRkhl2bLwAAAIU"]
[Sun Mar 22 19:32:40.866071 2026] [:error] [pid 30166:tid 30175] [client 51.120.72.165:64372] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ab_TWLm4_26jKMD0zy3YhAAAAUQ"]
[Sun Mar 22 19:32:41.396572 2026] [:error] [pid 51362:tid 51405] [client 51.120.72.165:38534] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ab_TWcOwPm3DXzTDjUeq1gAAAEQ"]
[Sun Mar 22 19:32:41.930852 2026] [:error] [pid 51362:tid 51418] [client 51.120.72.165:64917] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ab_TWcOwPm3DXzTDjUeq2gAAAFE"]
[Sun Mar 22 19:32:42.472035 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:64270] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ab_TWsOwPm3DXzTDjUeq3QAAAEY"]
[Sun Mar 22 19:32:42.993908 2026] [:error] [pid 40039:tid 40064] [client 51.120.72.165:63334] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ab_TWh3aDgUJfBYishmpQwAAARc"]
[Sun Mar 22 19:32:43.529339 2026] [:error] [pid 51361:tid 51379] [client 51.120.72.165:64929] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ab_TWxXYUsdvKC9YWpXYNwAAAAg"]
[Sun Mar 22 19:32:44.068132 2026] [:error] [pid 30166:tid 30193] [client 51.120.72.165:64944] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ab_TXLm4_26jKMD0zy3YiAAAAVI"]
[Sun Mar 22 19:32:44.599343 2026] [:error] [pid 51362:tid 51405] [client 51.120.72.165:64911] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ab_TXMOwPm3DXzTDjUeq5wAAAEQ"]
[Sun Mar 22 19:32:45.138763 2026] [:error] [pid 40039:tid 40059] [client 51.120.72.165:64936] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ab_TXR3aDgUJfBYishmpRwAAARI"]
[Sun Mar 22 19:32:45.671443 2026] [:error] [pid 51468:tid 51497] [client 51.120.72.165:65011] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "ab_TXU2TppSvA8W5CBRGrQAAANU"]
[Sun Mar 22 19:32:46.202184 2026] [:error] [pid 51468:tid 51491] [client 51.120.72.165:38574] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "ab_TXk2TppSvA8W5CBRGrgAAAM8"]
[Sun Mar 22 19:32:46.726454 2026] [:error] [pid 40039:tid 40050] [client 51.120.72.165:64999] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "ab_TXh3aDgUJfBYishmpTgAAAQk"]
[Sun Mar 22 19:32:47.246020 2026] [:error] [pid 51468:tid 51481] [client 51.120.72.165:64906] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "ab_TX02TppSvA8W5CBRGsQAAAMU"]
[Sun Mar 22 19:32:47.770124 2026] [:error] [pid 30166:tid 30198] [client 51.120.72.165:64990] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "ab_TX7m4_26jKMD0zy3YkAAAAVU"]
[Sun Mar 22 19:32:48.292125 2026] [:error] [pid 40039:tid 40048] [client 51.120.72.165:63691] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "ab_TYB3aDgUJfBYishmpUQAAAQc"]
[Sun Mar 22 19:32:48.814509 2026] [:error] [pid 51363:tid 51432] [client 51.120.72.165:64939] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "ab_TYFwa9x6OCTRkhl2bOwAAAIQ"]
[Sun Mar 22 19:32:49.344585 2026] [:error] [pid 51361:tid 51389] [client 51.120.72.165:64335] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "ab_TYRXYUsdvKC9YWpXYQgAAABE"]
[Sun Mar 22 19:32:49.882206 2026] [:error] [pid 51361:tid 51383] [client 51.120.72.165:63699] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ab_TYRXYUsdvKC9YWpXYRgAAAAw"]
[Sun Mar 22 19:32:50.407647 2026] [:error] [pid 51363:tid 51440] [client 51.120.72.165:63690] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ab_TYlwa9x6OCTRkhl2bPAAAAIs"]
[Sun Mar 22 19:32:50.932020 2026] [:error] [pid 51362:tid 51416] [client 51.120.72.165:64983] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ab_TYsOwPm3DXzTDjUeq9QAAAE8"]
[Sun Mar 22 19:32:51.459851 2026] [:error] [pid 51361:tid 51381] [client 51.120.72.165:63303] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ab_TYxXYUsdvKC9YWpXYSQAAAAo"]
[Sun Mar 22 19:32:51.990201 2026] [:error] [pid 51362:tid 51425] [client 51.120.72.165:64952] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "ab_TY8OwPm3DXzTDjUeq-QAAAFg"]
[Sun Mar 22 19:32:52.530427 2026] [:error] [pid 51363:tid 51433] [client 51.120.72.165:64331] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "ab_TZFwa9x6OCTRkhl2bQgAAAIU"]
[Sun Mar 22 19:32:53.060253 2026] [:error] [pid 51362:tid 51404] [client 51.120.72.165:64918] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "ab_TZcOwPm3DXzTDjUeq-wAAAEM"]
[Sun Mar 22 19:32:53.604939 2026] [:error] [pid 51468:tid 51494] [client 51.120.72.165:64305] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "ab_TZU2TppSvA8W5CBRGugAAANI"]
[Sun Mar 22 19:32:54.128733 2026] [:error] [pid 30166:tid 30187] [client 51.120.72.165:64941] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "ab_TZrm4_26jKMD0zy3YpgAAAUw"]
[Sun Mar 22 19:32:54.665448 2026] [:error] [pid 40039:tid 40062] [client 51.120.72.165:64924] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "ab_TZh3aDgUJfBYishmpVwAAARU"]
[Sun Mar 22 19:32:55.195434 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:64333] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "ab_TZ8OwPm3DXzTDjUeq_gAAAEg"]
[Sun Mar 22 19:32:55.715499 2026] [:error] [pid 40039:tid 40058] [client 51.120.72.165:63703] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "ab_TZx3aDgUJfBYishmpWgAAARE"]
[Sun Mar 22 19:32:56.242063 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:63705] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ab_TaFwa9x6OCTRkhl2bSQAAAIw"]
[Sun Mar 22 19:32:56.817325 2026] [:error] [pid 51362:tid 51415] [client 51.120.72.165:64994] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ab_TaMOwPm3DXzTDjUerAQAAAE4"]
[Sun Mar 22 19:32:57.348619 2026] [:error] [pid 51363:tid 51436] [client 51.120.72.165:64351] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ab_TaVwa9x6OCTRkhl2bTgAAAIc"]
[Sun Mar 22 19:32:57.887168 2026] [:error] [pid 30166:tid 30189] [client 51.120.72.165:63309] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ab_Tabm4_26jKMD0zy3YrwAAAU4"]
[Sun Mar 22 19:32:58.443164 2026] [:error] [pid 51362:tid 51425] [client 51.120.72.165:63720] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "ab_TasOwPm3DXzTDjUerCAAAAFg"]
[Sun Mar 22 19:32:58.987354 2026] [:error] [pid 51362:tid 51422] [client 51.120.72.165:63275] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "ab_TasOwPm3DXzTDjUerDAAAAFU"]
[Sun Mar 22 19:32:59.514311 2026] [:error] [pid 51362:tid 51411] [client 51.120.72.165:65018] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "ab_Ta8OwPm3DXzTDjUerEQAAAEo"]
[Sun Mar 22 19:33:00.045101 2026] [:error] [pid 51363:tid 51454] [client 51.120.72.165:63701] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "ab_TbFwa9x6OCTRkhl2bUQAAAJg"]
[Sun Mar 22 19:33:00.589639 2026] [:error] [pid 51361:tid 51371] [client 51.120.72.165:63736] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ab_TbBXYUsdvKC9YWpXYVQAAAAA"]
[Sun Mar 22 19:33:01.122197 2026] [:error] [pid 51363:tid 51428] [client 51.120.72.165:63698] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ab_TbVwa9x6OCTRkhl2bVQAAAIA"]
[Sun Mar 22 19:33:01.670204 2026] [:error] [pid 51363:tid 51434] [client 51.120.72.165:64979] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ab_TbVwa9x6OCTRkhl2bWAAAAIY"]
[Sun Mar 22 19:33:02.254951 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:64380] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ab_Tblwa9x6OCTRkhl2bWwAAAIw"]
[Sun Mar 22 19:33:02.840424 2026] [:error] [pid 51363:tid 51442] [client 51.120.72.165:64338] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "ab_Tblwa9x6OCTRkhl2bXgAAAI0"]
[Sun Mar 22 19:33:03.362736 2026] [:error] [pid 51361:tid 51381] [client 51.120.72.165:64927] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "ab_TbxXYUsdvKC9YWpXYVwAAAAo"]
[Sun Mar 22 19:33:03.942564 2026] [:error] [pid 51361:tid 51388] [client 51.120.72.165:64362] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "ab_TbxXYUsdvKC9YWpXYWgAAABA"]
[Sun Mar 22 19:33:04.503665 2026] [:error] [pid 51363:tid 51437] [client 51.120.72.165:63686] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "ab_TcFwa9x6OCTRkhl2bZAAAAIg"]
[Sun Mar 22 19:33:05.062651 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:63237] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "ab_TcVwa9x6OCTRkhl2bawAAAIw"]
[Sun Mar 22 19:33:05.617537 2026] [:error] [pid 51361:tid 51384] [client 51.120.72.165:64287] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "ab_TcRXYUsdvKC9YWpXYWwAAAA0"]
[Sun Mar 22 19:33:06.170225 2026] [:error] [pid 51361:tid 51380] [client 51.120.72.165:38528] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "ab_TchXYUsdvKC9YWpXYXQAAAAk"]
[Sun Mar 22 19:33:06.728224 2026] [:error] [pid 51362:tid 51412] [client 51.120.72.165:63355] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "ab_TcsOwPm3DXzTDjUerGgAAAEs"]
[Sun Mar 22 19:33:07.277994 2026] [:error] [pid 30166:tid 30196] [client 51.120.72.165:63734] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "ab_Tc7m4_26jKMD0zy3YuAAAAVM"]
[Sun Mar 22 19:33:07.828179 2026] [:error] [pid 51361:tid 51391] [client 51.120.72.165:63244] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "ab_TcxXYUsdvKC9YWpXYYQAAABM"]
[Sun Mar 22 19:33:08.377384 2026] [:error] [pid 51361:tid 51389] [client 51.120.72.165:63693] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "ab_TdBXYUsdvKC9YWpXYYwAAABE"]
[Sun Mar 22 19:33:08.903283 2026] [:error] [pid 51362:tid 51401] [client 51.120.72.165:64933] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "ab_TdMOwPm3DXzTDjUerIAAAAEE"]
[Sun Mar 22 19:33:09.429350 2026] [:error] [pid 51468:tid 51495] [client 51.120.72.165:64360] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "ab_TdU2TppSvA8W5CBRGxQAAANM"]
[Sun Mar 22 19:33:09.953189 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:64292] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "ab_TdcOwPm3DXzTDjUerIwAAAEY"]
[Sun Mar 22 19:33:10.526284 2026] [:error] [pid 51363:tid 51437] [client 51.120.72.165:63631] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "ab_Tdlwa9x6OCTRkhl2bcwAAAIg"]
[Sun Mar 22 19:33:11.056455 2026] [:error] [pid 51362:tid 51409] [client 51.120.72.165:63643] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "ab_Td8OwPm3DXzTDjUerKQAAAEg"]
[Sun Mar 22 19:33:11.585391 2026] [:error] [pid 51363:tid 51438] [client 51.120.72.165:63708] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "ab_Td1wa9x6OCTRkhl2begAAAIk"]
[Sun Mar 22 19:33:12.110021 2026] [:error] [pid 30166:tid 30190] [client 51.120.72.165:63352] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "ab_TeLm4_26jKMD0zy3YvAAAAU8"]
[Sun Mar 22 19:33:12.645819 2026] [:error] [pid 30166:tid 30186] [client 51.120.72.165:64364] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "ab_TeLm4_26jKMD0zy3YvQAAAUs"]
[Sun Mar 22 19:33:13.194571 2026] [:error] [pid 30166:tid 30184] [client 51.120.72.165:38533] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "ab_Tebm4_26jKMD0zy3YvgAAAUk"]
[Sun Mar 22 19:33:13.721937 2026] [:error] [pid 51363:tid 51432] [client 51.120.72.165:64318] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "ab_TeVwa9x6OCTRkhl2bjwAAAIQ"]
[Sun Mar 22 19:33:14.327786 2026] [:error] [pid 51363:tid 51441] [client 51.120.72.165:62593] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "ab_Telwa9x6OCTRkhl2bkwAAAIw"]
[Sun Mar 22 19:33:14.869161 2026] [:error] [pid 30166:tid 30192] [client 51.120.72.165:63623] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "ab_Term4_26jKMD0zy3YxwAAAVE"]
[Sun Mar 22 19:33:15.402802 2026] [:error] [pid 30166:tid 30199] [client 51.120.72.165:63642] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "ab_Te7m4_26jKMD0zy3YyAAAAVY"]
[Sun Mar 22 19:33:15.944856 2026] [:error] [pid 51361:tid 51388] [client 51.120.72.165:62672] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "ab_TexXYUsdvKC9YWpXYaQAAABA"]
[Sun Mar 22 19:33:16.478225 2026] [:error] [pid 51468:tid 51476] [client 51.120.72.165:64258] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "ab_TfE2TppSvA8W5CBRGywAAAMA"]
[Sun Mar 22 19:33:17.032435 2026] [:error] [pid 51361:tid 51380] [client 51.120.72.165:63263] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "ab_TfRXYUsdvKC9YWpXYbAAAAAk"]
[Sun Mar 22 19:33:17.550691 2026] [:error] [pid 40039:tid 40045] [client 51.120.72.165:63675] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "ab_TfR3aDgUJfBYishmpaQAAAQQ"]
[Sun Mar 22 19:33:18.097578 2026] [:error] [pid 51362:tid 51402] [client 51.120.72.165:64970] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "ab_TfsOwPm3DXzTDjUerKwAAAEI"]
[Sun Mar 22 19:33:18.632850 2026] [:error] [pid 51362:tid 51424] [client 51.120.72.165:63665] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "ab_TfsOwPm3DXzTDjUerLwAAAFc"]
[Sun Mar 22 19:33:19.175287 2026] [:error] [pid 51468:tid 51484] [client 51.120.72.165:64288] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "ab_Tf02TppSvA8W5CBRG0QAAAMg"]
[Sun Mar 22 19:33:19.728157 2026] [:error] [pid 51468:tid 51490] [client 51.120.72.165:63321] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "ab_Tf02TppSvA8W5CBRG1gAAAM4"]
[Sun Mar 22 19:33:20.281732 2026] [:error] [pid 51363:tid 51430] [client 51.120.72.165:38557] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "ab_TgFwa9x6OCTRkhl2bogAAAII"]
[Sun Mar 22 19:33:20.825761 2026] [:error] [pid 51363:tid 51433] [client 51.120.72.165:63632] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "ab_TgFwa9x6OCTRkhl2bpgAAAIU"]
[Sun Mar 22 19:33:21.353957 2026] [:error] [pid 51362:tid 51423] [client 51.120.72.165:63337] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "ab_TgcOwPm3DXzTDjUerMgAAAFY"]
[Sun Mar 22 19:33:21.882440 2026] [:error] [pid 40039:tid 40052] [client 51.120.72.165:38583] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "ab_TgR3aDgUJfBYishmpbAAAAQs"]
[Sun Mar 22 19:33:22.513744 2026] [:error] [pid 51468:tid 51476] [client 51.120.72.165:64327] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "ab_Tgk2TppSvA8W5CBRG2gAAAMA"]
[Sun Mar 22 19:33:23.037540 2026] [:error] [pid 40039:tid 40065] [client 51.120.72.165:63319] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "ab_Tgx3aDgUJfBYishmpcAAAARg"]
[Sun Mar 22 19:33:23.568365 2026] [:error] [pid 51362:tid 51411] [client 51.120.72.165:65005] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "ab_Tg8OwPm3DXzTDjUerNwAAAEo"]
[Sun Mar 22 19:33:24.099298 2026] [:error] [pid 51362:tid 51420] [client 51.120.72.165:64359] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "ab_ThMOwPm3DXzTDjUerOgAAAFM"]
[Sun Mar 22 19:33:24.648460 2026] [:error] [pid 51362:tid 51401] [client 51.120.72.165:64262] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "ab_ThMOwPm3DXzTDjUerPwAAAEE"]
[Sun Mar 22 19:33:25.178338 2026] [:error] [pid 51362:tid 51407] [client 51.120.72.165:63670] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "ab_ThcOwPm3DXzTDjUerQQAAAEY"]
[Sun Mar 22 19:33:25.820166 2026] [:error] [pid 51363:tid 51450] [client 51.120.72.165:63618] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "ab_ThVwa9x6OCTRkhl2btAAAAJQ"]
[Sun Mar 22 19:33:26.352561 2026] [:error] [pid 51363:tid 51451] [client 51.120.72.165:63689] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "ab_Thlwa9x6OCTRkhl2btgAAAJU"]
[Sun Mar 22 19:33:26.882559 2026] [:error] [pid 51363:tid 51448] [client 51.120.72.165:64943] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "ab_Thlwa9x6OCTRkhl2bugAAAJI"]
[Sun Mar 22 19:33:27.413402 2026] [:error] [pid 51468:tid 51499] [client 51.120.72.165:63743] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "ab_Th02TppSvA8W5CBRG3QAAANc"]
[Sun Mar 22 19:33:28.001800 2026] [:error] [pid 30166:tid 30186] [client 51.120.72.165:62662] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "ab_TiLm4_26jKMD0zy3Y3QAAAUs"]
[Sun Mar 22 19:33:28.534224 2026] [:error] [pid 51361:tid 51376] [client 51.120.72.165:63645] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "ab_TiBXYUsdvKC9YWpXYcQAAAAU"]
[Sun Mar 22 19:33:29.095119 2026] [:error] [pid 30166:tid 30191] [client 51.120.72.165:64991] [client 51.120.72.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "ab_Tibm4_26jKMD0zy3Y4gAAAVA"]
[Sun Mar 22 19:33:29.626760 2026] [:error] [pid 30166:tid 30183] [client 51.120.72.165:63629] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_Tibm4_26jKMD0zy3Y5wAAAUg"]
[Sun Mar 22 19:33:30.159641 2026] [:error] [pid 51468:tid 51477] [client 51.120.72.165:63632] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_Tik2TppSvA8W5CBRG4wAAAME"]
[Sun Mar 22 19:33:30.688738 2026] [:error] [pid 30166:tid 30173] [client 51.120.72.165:62636] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_Tirm4_26jKMD0zy3Y7QAAAUI"]
[Sun Mar 22 19:33:31.246635 2026] [:error] [pid 51468:tid 51494] [client 51.120.72.165:63344] [client 51.120.72.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ab_Ti02TppSvA8W5CBRG5gAAANI"]
[Sun Mar 22 20:10:38.854725 2026] [:error] [pid 51468:tid 51490] [client 182.98.2.215:34015] [client 182.98.2.215] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab_cPk2TppSvA8W5CBRQ7wAAAM4"], referer: http://www.switchcreative.net/
[Sun Mar 22 20:16:44.047444 2026] [:error] [pid 51361:tid 51375] [client 43.166.240.231:53434] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ab_drBXYUsdvKC9YWpXeiAAAAAQ"]
[Sun Mar 22 21:48:32.678397 2026] [:error] [pid 51362:tid 51419] [client 117.102.63.1:34955] [client 117.102.63.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.102.63.1, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ab_zMMOwPm3DXzTDjUfiLgAAAFI"]
[Sun Mar 22 21:48:32.694270 2026] [proxy_fcgi:error] [pid 51362:tid 51419] [client 117.102.63.1:34955] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:08.764060 2026] [proxy_fcgi:error] [pid 27776:tid 27867] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:09.526299 2026] [proxy_fcgi:error] [pid 27776:tid 27858] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:10.045664 2026] [proxy_fcgi:error] [pid 27776:tid 27861] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:10.169585 2026] [proxy_fcgi:error] [pid 27776:tid 27872] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:10.422848 2026] [proxy_fcgi:error] [pid 27776:tid 27848] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:10.543419 2026] [proxy_fcgi:error] [pid 27776:tid 27847] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:10.955272 2026] [proxy_fcgi:error] [pid 27776:tid 27852] [client 4.241.228.159:2912] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:05:11.069197 2026] [:error] [pid 27776:tid 27857] [client 4.241.228.159:2912] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "acAhR43Eaq7IZ5L-4XU4lwAAAQo"]
[Mon Mar 23 01:05:12.028224 2026] [:error] [pid 20856:tid 20940] [client 4.241.228.159:2890] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "acAhSMxFtXFVNE-X2-KI6gAAANU"]
[Mon Mar 23 01:05:12.618654 2026] [:error] [pid 20587:tid 20649] [client 4.241.228.159:2880] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "acAhSIByf8r3QAk4VXPlPAAAAIY"]
[Mon Mar 23 01:05:12.963224 2026] [:error] [pid 27776:tid 27858] [client 4.241.228.159:2939] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "acAhSI3Eaq7IZ5L-4XU4nQAAAQs"]
[Mon Mar 23 01:05:13.223946 2026] [:error] [pid 27776:tid 27850] [client 4.241.228.159:2913] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "acAhSY3Eaq7IZ5L-4XU4ngAAAQQ"]
[Mon Mar 23 01:05:13.465925 2026] [:error] [pid 20574:tid 20610] [client 4.241.228.159:2886] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "acAhSddMXEnEZrwyzJn9PwAAABU"]
[Mon Mar 23 01:05:13.703331 2026] [:error] [pid 20856:tid 20943] [client 4.241.228.159:2247] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "acAhScxFtXFVNE-X2-KI9AAAANg"]
[Mon Mar 23 01:05:14.086981 2026] [:error] [pid 20574:tid 20598] [client 4.241.228.159:2267] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "acAhStdMXEnEZrwyzJn9QgAAAAk"]
[Mon Mar 23 01:05:14.454704 2026] [:error] [pid 20574:tid 20613] [client 4.241.228.159:2887] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "acAhStdMXEnEZrwyzJn9RQAAABg"]
[Mon Mar 23 01:05:14.795503 2026] [:error] [pid 27776:tid 27866] [client 4.241.228.159:2259] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "acAhSo3Eaq7IZ5L-4XU4pAAAARM"]
[Mon Mar 23 01:05:15.142612 2026] [:error] [pid 27776:tid 27867] [client 4.241.228.159:2884] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "acAhS43Eaq7IZ5L-4XU4pgAAARQ"]
[Mon Mar 23 01:05:15.626113 2026] [:error] [pid 27776:tid 27870] [client 4.241.228.159:2251] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "acAhS43Eaq7IZ5L-4XU4qwAAARY"]
[Mon Mar 23 01:05:15.920336 2026] [:error] [pid 27776:tid 27850] [client 4.241.228.159:2933] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "acAhS43Eaq7IZ5L-4XU4rwAAAQQ"]
[Mon Mar 23 01:05:16.170302 2026] [:error] [pid 27776:tid 27849] [client 4.241.228.159:2246] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "acAhTI3Eaq7IZ5L-4XU4sQAAAQM"]
[Mon Mar 23 01:05:16.412735 2026] [:error] [pid 27776:tid 27852] [client 4.241.228.159:2907] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "acAhTI3Eaq7IZ5L-4XU4swAAAQY"]
[Mon Mar 23 01:05:16.689353 2026] [:error] [pid 20856:tid 20920] [client 4.241.228.159:2118] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "acAhTMxFtXFVNE-X2-KI-QAAAME"]
[Mon Mar 23 01:05:17.036408 2026] [:error] [pid 27776:tid 27859] [client 4.241.228.159:2898] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "acAhTY3Eaq7IZ5L-4XU4uAAAAQw"]
[Mon Mar 23 01:05:17.381397 2026] [:error] [pid 27776:tid 27872] [client 4.241.228.159:2888] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "acAhTY3Eaq7IZ5L-4XU4vwAAARg"]
[Mon Mar 23 01:05:17.759559 2026] [:error] [pid 27776:tid 27853] [client 4.241.228.159:2909] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "acAhTY3Eaq7IZ5L-4XU4wQAAAQc"]
[Mon Mar 23 01:05:17.997049 2026] [:error] [pid 20574:tid 20599] [client 4.241.228.159:2928] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/index.php"] [unique_id "acAhTddMXEnEZrwyzJn9SwAAAAo"]
[Mon Mar 23 01:05:18.241812 2026] [:error] [pid 20587:tid 20664] [client 4.241.228.159:2923] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conf.php"] [unique_id "acAhToByf8r3QAk4VXPlRQAAAJU"]
[Mon Mar 23 01:05:18.531807 2026] [:error] [pid 27776:tid 27861] [client 4.241.228.159:2891] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conf.php"] [unique_id "acAhTo3Eaq7IZ5L-4XU4xgAAAQ4"]
[Mon Mar 23 01:05:18.834206 2026] [:error] [pid 20584:tid 20620] [client 4.241.228.159:2910] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conf.php"] [unique_id "acAhTiWzr-bD_t6AP_TDHQAAAEQ"]
[Mon Mar 23 01:05:19.179787 2026] [:error] [pid 27776:tid 27855] [client 4.241.228.159:2903] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conf.php"] [unique_id "acAhT43Eaq7IZ5L-4XU4zgAAAQk"]
[Mon Mar 23 01:05:19.472559 2026] [:error] [pid 27776:tid 27847] [client 4.241.228.159:2243] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "acAhT43Eaq7IZ5L-4XU4zwAAAQE"]
[Mon Mar 23 01:05:19.764286 2026] [:error] [pid 27776:tid 27870] [client 4.241.228.159:2908] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "acAhT43Eaq7IZ5L-4XU40gAAARY"]
[Mon Mar 23 01:05:20.063490 2026] [:error] [pid 20856:tid 20927] [client 4.241.228.159:2253] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "acAhUMxFtXFVNE-X2-KJAAAAAMg"]
[Mon Mar 23 01:05:20.338416 2026] [:error] [pid 20856:tid 20922] [client 4.241.228.159:2255] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "acAhUMxFtXFVNE-X2-KJAgAAAMM"]
[Mon Mar 23 01:05:20.613193 2026] [:error] [pid 20574:tid 20589] [client 4.241.228.159:2258] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acAhUNdMXEnEZrwyzJn9UgAAAAA"]
[Mon Mar 23 01:05:20.896686 2026] [:error] [pid 20856:tid 20940] [client 4.241.228.159:2248] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acAhUMxFtXFVNE-X2-KJBwAAANU"]
[Mon Mar 23 01:05:21.182559 2026] [:error] [pid 20856:tid 20942] [client 4.241.228.159:2932] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acAhUcxFtXFVNE-X2-KJCAAAANc"]
[Mon Mar 23 01:05:21.453693 2026] [:error] [pid 20856:tid 20924] [client 4.241.228.159:2240] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acAhUcxFtXFVNE-X2-KJCgAAAMU"]
[Mon Mar 23 01:05:21.850008 2026] [:error] [pid 27776:tid 27855] [client 4.241.228.159:2885] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "acAhUY3Eaq7IZ5L-4XU42gAAAQk"]
[Mon Mar 23 01:05:22.135594 2026] [:error] [pid 20856:tid 20919] [client 4.241.228.159:2881] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "acAhUsxFtXFVNE-X2-KJDQAAAMA"]
[Mon Mar 23 01:05:22.521668 2026] [:error] [pid 27776:tid 27860] [client 4.241.228.159:2926] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "acAhUo3Eaq7IZ5L-4XU43wAAAQ0"]
[Mon Mar 23 01:05:22.803394 2026] [:error] [pid 20574:tid 20599] [client 4.241.228.159:2266] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "acAhUtdMXEnEZrwyzJn9YQAAAAo"]
[Mon Mar 23 01:05:23.118719 2026] [:error] [pid 20574:tid 20602] [client 4.241.228.159:2920] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "acAhU9dMXEnEZrwyzJn9YwAAAA0"]
[Mon Mar 23 01:05:23.380023 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2124] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "acAhU8xFtXFVNE-X2-KJEQAAAMo"]
[Mon Mar 23 01:05:23.673375 2026] [:error] [pid 27776:tid 27862] [client 4.241.228.159:2152] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "acAhU43Eaq7IZ5L-4XU44QAAAQ8"]
[Mon Mar 23 01:05:23.973287 2026] [:error] [pid 27776:tid 27849] [client 4.241.228.159:2882] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "acAhU43Eaq7IZ5L-4XU45AAAAQM"]
[Mon Mar 23 01:05:24.289460 2026] [:error] [pid 20574:tid 20589] [client 4.241.228.159:2901] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acAhVNdMXEnEZrwyzJn9ZQAAAAA"]
[Mon Mar 23 01:05:24.569316 2026] [:error] [pid 27776:tid 27862] [client 4.241.228.159:2936] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acAhVI3Eaq7IZ5L-4XU48QAAAQ8"]
[Mon Mar 23 01:05:24.806714 2026] [:error] [pid 27776:tid 27863] [client 4.241.228.159:2285] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acAhVI3Eaq7IZ5L-4XU48gAAARA"]
[Mon Mar 23 01:05:25.100366 2026] [:error] [pid 27776:tid 27853] [client 4.241.228.159:2129] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acAhVY3Eaq7IZ5L-4XU49AAAAQc"]
[Mon Mar 23 01:05:25.355112 2026] [:error] [pid 27776:tid 27868] [client 4.241.228.159:2914] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "acAhVY3Eaq7IZ5L-4XU49QAAARU"]
[Mon Mar 23 01:05:25.607485 2026] [:error] [pid 20574:tid 20594] [client 4.241.228.159:2127] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "acAhVddMXEnEZrwyzJn9ZwAAAAU"]
[Mon Mar 23 01:05:25.867138 2026] [:error] [pid 20574:tid 20591] [client 4.241.228.159:2942] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "acAhVddMXEnEZrwyzJn9aQAAAAI"]
[Mon Mar 23 01:05:26.212511 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2260] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "acAhVo3Eaq7IZ5L-4XU4_AAAARE"]
[Mon Mar 23 01:05:26.440733 2026] [:error] [pid 20574:tid 20590] [client 4.241.228.159:2896] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhVtdMXEnEZrwyzJn9bQAAAAE"]
[Mon Mar 23 01:05:26.674588 2026] [:error] [pid 20574:tid 20610] [client 4.241.228.159:2916] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhVtdMXEnEZrwyzJn9bwAAABU"]
[Mon Mar 23 01:05:26.906756 2026] [:error] [pid 20587:tid 20651] [client 4.241.228.159:2286] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhVoByf8r3QAk4VXPlTgAAAIg"]
[Mon Mar 23 01:05:27.343103 2026] [:error] [pid 20856:tid 20930] [client 4.241.228.159:2245] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhV8xFtXFVNE-X2-KJGAAAAMs"]
[Mon Mar 23 01:05:27.591985 2026] [:error] [pid 20856:tid 20937] [client 4.241.228.159:2289] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhV8xFtXFVNE-X2-KJGwAAANI"]
[Mon Mar 23 01:05:27.847206 2026] [:error] [pid 20584:tid 20639] [client 4.241.228.159:2288] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhVyWzr-bD_t6AP_TDIwAAAFc"]
[Mon Mar 23 01:05:28.183393 2026] [:error] [pid 20584:tid 20636] [client 4.241.228.159:2917] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhWCWzr-bD_t6AP_TDJAAAAFQ"]
[Mon Mar 23 01:05:28.480885 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2893] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhWMxFtXFVNE-X2-KJHgAAAMo"]
[Mon Mar 23 01:05:28.777121 2026] [:error] [pid 20574:tid 20605] [client 4.241.228.159:2934] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "acAhWNdMXEnEZrwyzJn9dgAAABA"]
[Mon Mar 23 01:05:29.040759 2026] [:error] [pid 27776:tid 27870] [client 4.241.228.159:2298] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "acAhWY3Eaq7IZ5L-4XU5AQAAARY"]
[Mon Mar 23 01:05:29.350186 2026] [:error] [pid 27776:tid 27868] [client 4.241.228.159:2292] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "acAhWY3Eaq7IZ5L-4XU5BAAAARU"]
[Mon Mar 23 01:05:29.578372 2026] [:error] [pid 20574:tid 20601] [client 4.241.228.159:2250] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "acAhWddMXEnEZrwyzJn9dwAAAAw"]
[Mon Mar 23 01:05:29.829790 2026] [:error] [pid 27776:tid 27859] [client 4.241.228.159:2167] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhWY3Eaq7IZ5L-4XU5CAAAAQw"]
[Mon Mar 23 01:05:30.221432 2026] [:error] [pid 27776:tid 27872] [client 4.241.228.159:2929] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhWo3Eaq7IZ5L-4XU5DgAAARg"]
[Mon Mar 23 01:05:30.450218 2026] [:error] [pid 20856:tid 20942] [client 4.241.228.159:2904] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhWsxFtXFVNE-X2-KJIQAAANc"]
[Mon Mar 23 01:05:30.717730 2026] [:error] [pid 20574:tid 20593] [client 4.241.228.159:2120] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhWtdMXEnEZrwyzJn9eAAAAAQ"]
[Mon Mar 23 01:05:30.968420 2026] [:error] [pid 20574:tid 20596] [client 4.241.228.159:2244] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acAhWtdMXEnEZrwyzJn9ewAAAAc"]
[Mon Mar 23 01:05:31.324071 2026] [:error] [pid 20856:tid 20931] [client 4.241.228.159:2150] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acAhW8xFtXFVNE-X2-KJJQAAAMw"]
[Mon Mar 23 01:05:31.586954 2026] [:error] [pid 20856:tid 20923] [client 4.241.228.159:2930] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acAhW8xFtXFVNE-X2-KJKAAAAMQ"]
[Mon Mar 23 01:05:31.912655 2026] [:error] [pid 20856:tid 20941] [client 4.241.228.159:2116] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acAhW8xFtXFVNE-X2-KJKQAAANY"]
[Mon Mar 23 01:05:32.152809 2026] [:error] [pid 20587:tid 20666] [client 4.241.228.159:2115] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "acAhXIByf8r3QAk4VXPlVwAAAJc"]
[Mon Mar 23 01:05:32.654451 2026] [:error] [pid 20856:tid 20926] [client 4.241.228.159:2299] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "acAhXMxFtXFVNE-X2-KJKwAAAMc"]
[Mon Mar 23 01:05:32.891770 2026] [:error] [pid 20587:tid 20659] [client 4.241.228.159:2283] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "acAhXIByf8r3QAk4VXPlWgAAAJA"]
[Mon Mar 23 01:05:33.187546 2026] [:error] [pid 20856:tid 20922] [client 4.241.228.159:2135] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "acAhXcxFtXFVNE-X2-KJLQAAAMM"]
[Mon Mar 23 01:05:33.504572 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2889] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "acAhXY3Eaq7IZ5L-4XU5GAAAARE"]
[Mon Mar 23 01:05:34.043494 2026] [:error] [pid 20856:tid 20940] [client 4.241.228.159:2911] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "acAhXsxFtXFVNE-X2-KJMAAAANU"]
[Mon Mar 23 01:05:34.379512 2026] [:error] [pid 27776:tid 27852] [client 4.241.228.159:2273] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "acAhXo3Eaq7IZ5L-4XU5IAAAAQY"]
[Mon Mar 23 01:05:34.674615 2026] [:error] [pid 27776:tid 27847] [client 4.241.228.159:2147] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "acAhXo3Eaq7IZ5L-4XU5IwAAAQE"]
[Mon Mar 23 01:05:35.163824 2026] [:error] [pid 20574:tid 20597] [client 4.241.228.159:2119] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "acAhX9dMXEnEZrwyzJn9lAAAAAg"]
[Mon Mar 23 01:05:35.511851 2026] [:error] [pid 20856:tid 20924] [client 4.241.228.159:2134] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "acAhX8xFtXFVNE-X2-KJNAAAAMU"]
[Mon Mar 23 01:05:35.803128 2026] [:error] [pid 20856:tid 20931] [client 4.241.228.159:2114] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "acAhX8xFtXFVNE-X2-KJNgAAAMw"]
[Mon Mar 23 01:05:36.345170 2026] [:error] [pid 20856:tid 20921] [client 4.241.228.159:2249] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "acAhYMxFtXFVNE-X2-KJOwAAAMI"]
[Mon Mar 23 01:05:36.702665 2026] [:error] [pid 20856:tid 20926] [client 4.241.228.159:2123] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "acAhYMxFtXFVNE-X2-KJPQAAAMc"]
[Mon Mar 23 01:05:37.078491 2026] [:error] [pid 20856:tid 20919] [client 4.241.228.159:2883] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "acAhYcxFtXFVNE-X2-KJQAAAAMA"]
[Mon Mar 23 01:05:37.400183 2026] [:error] [pid 20856:tid 20940] [client 4.241.228.159:2133] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "acAhYcxFtXFVNE-X2-KJQgAAANU"]
[Mon Mar 23 01:05:37.811127 2026] [:error] [pid 20574:tid 20606] [client 4.241.228.159:2242] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "acAhYddMXEnEZrwyzJn9mgAAABE"]
[Mon Mar 23 01:05:38.563990 2026] [:error] [pid 20574:tid 20603] [client 4.241.228.159:2938] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "acAhYtdMXEnEZrwyzJn9nQAAAA4"]
[Mon Mar 23 01:05:39.673915 2026] [:error] [pid 20574:tid 20602] [client 4.241.228.159:2905] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "acAhY9dMXEnEZrwyzJn9ogAAAA0"]
[Mon Mar 23 01:05:40.175102 2026] [:error] [pid 20574:tid 20590] [client 4.241.228.159:2925] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "acAhZNdMXEnEZrwyzJn9pwAAAAE"]
[Mon Mar 23 01:05:40.618351 2026] [:error] [pid 20856:tid 20924] [client 4.241.228.159:2166] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autoload_classmap.php"] [unique_id "acAhZMxFtXFVNE-X2-KJRwAAAMU"]
[Mon Mar 23 01:05:40.912679 2026] [:error] [pid 20584:tid 20623] [client 4.241.228.159:2290] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "acAhZCWzr-bD_t6AP_TDPgAAAEc"]
[Mon Mar 23 01:05:41.171965 2026] [:error] [pid 27776:tid 27872] [client 4.241.228.159:2921] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "acAhZY3Eaq7IZ5L-4XU5MQAAARg"]
[Mon Mar 23 01:05:41.588728 2026] [:error] [pid 20584:tid 20627] [client 4.241.228.159:2136] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "acAhZSWzr-bD_t6AP_TDQAAAAEs"]
[Mon Mar 23 01:05:41.855464 2026] [:error] [pid 20584:tid 20638] [client 4.241.228.159:2284] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "acAhZSWzr-bD_t6AP_TDQgAAAFY"]
[Mon Mar 23 01:05:42.222533 2026] [:error] [pid 27776:tid 27871] [client 4.241.228.159:2257] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhZo3Eaq7IZ5L-4XU5NQAAARc"]
[Mon Mar 23 01:05:42.568746 2026] [:error] [pid 27776:tid 27848] [client 4.241.228.159:2894] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhZo3Eaq7IZ5L-4XU5NgAAAQI"]
[Mon Mar 23 01:05:42.868874 2026] [:error] [pid 20574:tid 20593] [client 4.241.228.159:2943] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhZtdMXEnEZrwyzJn9rgAAAAQ"]
[Mon Mar 23 01:05:43.131119 2026] [:error] [pid 27776:tid 27870] [client 4.241.228.159:2294] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhZ43Eaq7IZ5L-4XU5OgAAARY"]
[Mon Mar 23 01:05:43.415429 2026] [:error] [pid 27776:tid 27857] [client 4.241.228.159:2262] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "acAhZ43Eaq7IZ5L-4XU5PAAAAQo"]
[Mon Mar 23 01:05:43.662291 2026] [:error] [pid 20574:tid 20602] [client 4.241.228.159:2125] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "acAhZ9dMXEnEZrwyzJn9sAAAAA0"]
[Mon Mar 23 01:05:43.987385 2026] [:error] [pid 20574:tid 20600] [client 4.241.228.159:2940] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "acAhZ9dMXEnEZrwyzJn9sgAAAAs"]
[Mon Mar 23 01:05:44.261877 2026] [:error] [pid 20574:tid 20596] [client 4.241.228.159:2277] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "acAhaNdMXEnEZrwyzJn9tAAAAAc"]
[Mon Mar 23 01:05:44.649095 2026] [:error] [pid 20587:tid 20650] [client 4.241.228.159:2121] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "acAhaIByf8r3QAk4VXPlXwAAAIc"]
[Mon Mar 23 01:05:44.881611 2026] [:error] [pid 27776:tid 27848] [client 4.241.228.159:2112] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "acAhaI3Eaq7IZ5L-4XU5QwAAAQI"]
[Mon Mar 23 01:05:45.158347 2026] [:error] [pid 20587:tid 20666] [client 4.241.228.159:2892] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "acAhaYByf8r3QAk4VXPlYAAAAJc"]
[Mon Mar 23 01:05:45.617989 2026] [:error] [pid 27776:tid 27865] [client 4.241.228.159:2915] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "acAhaY3Eaq7IZ5L-4XU5SAAAARI"]
[Mon Mar 23 01:05:45.847453 2026] [:error] [pid 27776:tid 27866] [client 4.241.228.159:2263] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/"] [unique_id "acAhaY3Eaq7IZ5L-4XU5SgAAARM"]
[Mon Mar 23 01:05:46.147844 2026] [:error] [pid 20856:tid 20938] [client 4.241.228.159:2297] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/"] [unique_id "acAhasxFtXFVNE-X2-KJTAAAANM"]
[Mon Mar 23 01:05:46.618197 2026] [:error] [pid 27776:tid 27871] [client 4.241.228.159:2256] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/"] [unique_id "acAhao3Eaq7IZ5L-4XU5TwAAARc"]
[Mon Mar 23 01:05:46.985803 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2897] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/"] [unique_id "acAhao3Eaq7IZ5L-4XU5UgAAARE"]
[Mon Mar 23 01:05:47.288519 2026] [:error] [pid 27776:tid 27857] [client 4.241.228.159:2278] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "acAha43Eaq7IZ5L-4XU5VAAAAQo"]
[Mon Mar 23 01:05:47.731135 2026] [:error] [pid 27776:tid 27863] [client 4.241.228.159:2919] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "acAha43Eaq7IZ5L-4XU5VgAAARA"]
[Mon Mar 23 01:05:48.023709 2026] [:error] [pid 20584:tid 20625] [client 4.241.228.159:2252] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "acAhbCWzr-bD_t6AP_TDRgAAAEk"]
[Mon Mar 23 01:05:48.360673 2026] [:error] [pid 20856:tid 20919] [client 4.241.228.159:2902] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "acAhbMxFtXFVNE-X2-KJUQAAAMA"]
[Mon Mar 23 01:05:48.912392 2026] [:error] [pid 20856:tid 20925] [client 4.241.228.159:2160] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/"] [unique_id "acAhbMxFtXFVNE-X2-KJVAAAAMY"]
[Mon Mar 23 01:05:49.227017 2026] [:error] [pid 20856:tid 20936] [client 4.241.228.159:2254] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/"] [unique_id "acAhbcxFtXFVNE-X2-KJVwAAANE"]
[Mon Mar 23 01:05:49.463573 2026] [:error] [pid 20587:tid 20658] [client 4.241.228.159:2918] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/"] [unique_id "acAhbYByf8r3QAk4VXPlYQAAAI8"]
[Mon Mar 23 01:05:49.807498 2026] [:error] [pid 20574:tid 20603] [client 4.241.228.159:2271] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/"] [unique_id "acAhbddMXEnEZrwyzJn9ugAAAA4"]
[Mon Mar 23 01:05:50.221444 2026] [:error] [pid 20584:tid 20640] [client 4.241.228.159:2941] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/"] [unique_id "acAhbiWzr-bD_t6AP_TDSAAAAFg"]
[Mon Mar 23 01:05:50.672508 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2261] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/"] [unique_id "acAhbo3Eaq7IZ5L-4XU5XwAAARE"]
[Mon Mar 23 01:05:51.186738 2026] [:error] [pid 20856:tid 20923] [client 4.241.228.159:2132] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/"] [unique_id "acAhb8xFtXFVNE-X2-KJXAAAAMQ"]
[Mon Mar 23 01:05:51.449783 2026] [:error] [pid 20856:tid 20938] [client 4.241.228.159:2279] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uploads/"] [unique_id "acAhb8xFtXFVNE-X2-KJXQAAANM"]
[Mon Mar 23 01:05:51.758275 2026] [:error] [pid 27776:tid 27863] [client 4.241.228.159:2820] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/"] [unique_id "acAhb43Eaq7IZ5L-4XU5ZAAAARA"]
[Mon Mar 23 01:05:52.085346 2026] [:error] [pid 20856:tid 20941] [client 4.241.228.159:2276] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/"] [unique_id "acAhcMxFtXFVNE-X2-KJYQAAANY"]
[Mon Mar 23 01:05:52.477991 2026] [:error] [pid 20574:tid 20593] [client 4.241.228.159:2130] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/"] [unique_id "acAhcNdMXEnEZrwyzJn9vwAAAAQ"]
[Mon Mar 23 01:05:52.815431 2026] [:error] [pid 20574:tid 20602] [client 4.241.228.159:2922] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/"] [unique_id "acAhcNdMXEnEZrwyzJn9wAAAAA0"]
[Mon Mar 23 01:05:53.127339 2026] [:error] [pid 20584:tid 20620] [client 4.241.228.159:2280] [client 4.241.228.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "acAhcSWzr-bD_t6AP_TDSgAAAEQ"]
[Mon Mar 23 01:05:53.516716 2026] [:error] [pid 20587:tid 20660] [client 4.241.228.159:2924] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/"] [unique_id "acAhcYByf8r3QAk4VXPlZQAAAJE"]
[Mon Mar 23 01:05:53.828862 2026] [:error] [pid 27776:tid 27850] [client 4.241.228.159:2157] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/"] [unique_id "acAhcY3Eaq7IZ5L-4XU5aQAAAQQ"]
[Mon Mar 23 01:05:54.234182 2026] [:error] [pid 27776:tid 27871] [client 4.241.228.159:2274] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/"] [unique_id "acAhco3Eaq7IZ5L-4XU5bgAAARc"]
[Mon Mar 23 01:05:54.498764 2026] [:error] [pid 20856:tid 20939] [client 4.241.228.159:2272] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/"] [unique_id "acAhcsxFtXFVNE-X2-KJZQAAANQ"]
[Mon Mar 23 01:05:54.823319 2026] [:error] [pid 27776:tid 27859] [client 4.241.228.159:2281] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "acAhco3Eaq7IZ5L-4XU5bwAAAQw"]
[Mon Mar 23 01:05:55.222518 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2899] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "acAhc8xFtXFVNE-X2-KJaQAAAMo"]
[Mon Mar 23 01:05:55.589085 2026] [:error] [pid 27776:tid 27851] [client 4.241.228.159:2168] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "acAhc43Eaq7IZ5L-4XU5cQAAAQU"]
[Mon Mar 23 01:05:55.816041 2026] [:error] [pid 27776:tid 27847] [client 4.241.228.159:2131] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "acAhc43Eaq7IZ5L-4XU5dAAAAQE"]
[Mon Mar 23 01:05:56.128962 2026] [:error] [pid 20856:tid 20941] [client 4.241.228.159:2935] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "acAhdMxFtXFVNE-X2-KJbAAAANY"]
[Mon Mar 23 01:05:56.438781 2026] [:error] [pid 20856:tid 20920] [client 4.241.228.159:2842] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "acAhdMxFtXFVNE-X2-KJcAAAAME"]
[Mon Mar 23 01:05:57.060226 2026] [:error] [pid 27776:tid 27854] [client 4.241.228.159:2137] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "acAhdY3Eaq7IZ5L-4XU5eQAAAQg"]
[Mon Mar 23 01:05:57.655795 2026] [:error] [pid 27776:tid 27866] [client 4.241.228.159:2845] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "acAhdY3Eaq7IZ5L-4XU5fgAAARM"]
[Mon Mar 23 01:05:57.902829 2026] [:error] [pid 20584:tid 20639] [client 4.241.228.159:2151] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "acAhdSWzr-bD_t6AP_TDTQAAAFc"]
[Mon Mar 23 01:05:58.224973 2026] [:error] [pid 20584:tid 20628] [client 4.241.228.159:2122] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "acAhdiWzr-bD_t6AP_TDTgAAAEw"]
[Mon Mar 23 01:05:58.474927 2026] [:error] [pid 20587:tid 20648] [client 4.241.228.159:2275] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "acAhdoByf8r3QAk4VXPlagAAAIU"]
[Mon Mar 23 01:05:58.798724 2026] [:error] [pid 20584:tid 20634] [client 4.241.228.159:2835] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "acAhdiWzr-bD_t6AP_TDTwAAAFI"]
[Mon Mar 23 01:05:59.089404 2026] [:error] [pid 27776:tid 27846] [client 4.241.228.159:2141] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "acAhd43Eaq7IZ5L-4XU5ggAAAQA"]
[Mon Mar 23 01:05:59.498581 2026] [:error] [pid 20574:tid 20607] [client 4.241.228.159:2142] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "acAhd9dMXEnEZrwyzJn9ywAAABI"]
[Mon Mar 23 01:05:59.965638 2026] [:error] [pid 20574:tid 20608] [client 4.241.228.159:2264] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "acAhd9dMXEnEZrwyzJn9zQAAABM"]
[Mon Mar 23 01:06:00.326402 2026] [:error] [pid 20856:tid 20928] [client 4.241.228.159:2138] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "acAheMxFtXFVNE-X2-KJdwAAAMk"]
[Mon Mar 23 01:06:00.667325 2026] [:error] [pid 20856:tid 20926] [client 4.241.228.159:2302] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "acAheMxFtXFVNE-X2-KJewAAAMc"]
[Mon Mar 23 01:06:00.987227 2026] [:error] [pid 20856:tid 20942] [client 4.241.228.159:2158] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "acAheMxFtXFVNE-X2-KJfAAAANc"]
[Mon Mar 23 01:06:01.246020 2026] [:error] [pid 27776:tid 27854] [client 4.241.228.159:2155] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "acAheY3Eaq7IZ5L-4XU5hwAAAQg"]
[Mon Mar 23 01:06:01.508541 2026] [:error] [pid 20856:tid 20927] [client 4.241.228.159:2296] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "acAhecxFtXFVNE-X2-KJfgAAAMg"]
[Mon Mar 23 01:06:01.830845 2026] [:error] [pid 27776:tid 27857] [client 4.241.228.159:2268] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acAheY3Eaq7IZ5L-4XU5igAAAQo"]
[Mon Mar 23 01:06:02.156556 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2823] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acAheo3Eaq7IZ5L-4XU5jAAAARE"]
[Mon Mar 23 01:06:02.494798 2026] [:error] [pid 20584:tid 20626] [client 4.241.228.159:2270] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acAheiWzr-bD_t6AP_TDUQAAAEo"]
[Mon Mar 23 01:06:02.989104 2026] [:error] [pid 20574:tid 20606] [client 4.241.228.159:2163] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acAhetdMXEnEZrwyzJn90gAAABE"]
[Mon Mar 23 01:06:03.339085 2026] [:error] [pid 20856:tid 20922] [client 4.241.228.159:2126] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "acAhe8xFtXFVNE-X2-KJgQAAAMM"]
[Mon Mar 23 01:06:03.723599 2026] [:error] [pid 20587:tid 20650] [client 4.241.228.159:2827] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "acAhe4Byf8r3QAk4VXPlbgAAAIc"]
[Mon Mar 23 01:06:04.008735 2026] [:error] [pid 20584:tid 20618] [client 4.241.228.159:2241] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "acAhfCWzr-bD_t6AP_TDVQAAAEI"]
[Mon Mar 23 01:06:04.314831 2026] [:error] [pid 20856:tid 20935] [client 4.241.228.159:2937] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "acAhfMxFtXFVNE-X2-KJggAAANA"]
[Mon Mar 23 01:06:04.560676 2026] [:error] [pid 20856:tid 20936] [client 4.241.228.159:2149] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "acAhfMxFtXFVNE-X2-KJgwAAANE"]
[Mon Mar 23 01:06:04.810980 2026] [:error] [pid 27776:tid 27863] [client 4.241.228.159:2265] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "acAhfI3Eaq7IZ5L-4XU5lgAAARA"]
[Mon Mar 23 01:06:05.169866 2026] [:error] [pid 27776:tid 27862] [client 4.241.228.159:2113] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "acAhfY3Eaq7IZ5L-4XU5mwAAAQ8"]
[Mon Mar 23 01:06:05.451201 2026] [:error] [pid 27776:tid 27861] [client 4.241.228.159:2117] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "acAhfY3Eaq7IZ5L-4XU5ngAAAQ4"]
[Mon Mar 23 01:06:05.733245 2026] [:error] [pid 27776:tid 27871] [client 4.241.228.159:2826] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "acAhfY3Eaq7IZ5L-4XU5oAAAARc"]
[Mon Mar 23 01:06:06.103434 2026] [:error] [pid 27776:tid 27857] [client 4.241.228.159:2839] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "acAhfo3Eaq7IZ5L-4XU5ogAAAQo"]
[Mon Mar 23 01:06:06.395831 2026] [:error] [pid 20856:tid 20933] [client 4.241.228.159:2852] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "acAhfsxFtXFVNE-X2-KJhAAAAM4"]
[Mon Mar 23 01:06:06.676525 2026] [:error] [pid 20856:tid 20937] [client 4.241.228.159:2850] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "acAhfsxFtXFVNE-X2-KJhQAAANI"]
[Mon Mar 23 01:06:06.966376 2026] [:error] [pid 20574:tid 20605] [client 4.241.228.159:2847] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhftdMXEnEZrwyzJn93AAAABA"]
[Mon Mar 23 01:06:07.340748 2026] [:error] [pid 20856:tid 20928] [client 4.241.228.159:2145] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhf8xFtXFVNE-X2-KJhwAAAMk"]
[Mon Mar 23 01:06:07.593841 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2824] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhf8xFtXFVNE-X2-KJiQAAAMo"]
[Mon Mar 23 01:06:07.916083 2026] [:error] [pid 20574:tid 20597] [client 4.241.228.159:2856] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acAhf9dMXEnEZrwyzJn93gAAAAg"]
[Mon Mar 23 01:06:08.144629 2026] [:error] [pid 27776:tid 27848] [client 4.241.228.159:2144] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhgI3Eaq7IZ5L-4XU5sAAAAQI"]
[Mon Mar 23 01:06:08.482665 2026] [:error] [pid 27776:tid 27859] [client 4.241.228.159:2834] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhgI3Eaq7IZ5L-4XU5tAAAAQw"]
[Mon Mar 23 01:06:08.867592 2026] [:error] [pid 27776:tid 27858] [client 4.241.228.159:2282] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhgI3Eaq7IZ5L-4XU5vAAAAQs"]
[Mon Mar 23 01:06:09.202556 2026] [:error] [pid 27776:tid 27855] [client 4.241.228.159:2846] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acAhgY3Eaq7IZ5L-4XU5vwAAAQk"]
[Mon Mar 23 01:06:09.557432 2026] [:error] [pid 27776:tid 27872] [client 4.241.228.159:2140] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "acAhgY3Eaq7IZ5L-4XU5xQAAARg"]
[Mon Mar 23 01:06:09.864319 2026] [:error] [pid 27776:tid 27859] [client 4.241.228.159:2300] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "acAhgY3Eaq7IZ5L-4XU5yQAAAQw"]
[Mon Mar 23 01:06:10.274302 2026] [proxy_fcgi:error] [pid 20856:tid 20919] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:10.392304 2026] [proxy_fcgi:error] [pid 20856:tid 20940] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:10.510307 2026] [proxy_fcgi:error] [pid 20856:tid 20925] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:10.629742 2026] [proxy_fcgi:error] [pid 20856:tid 20927] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:10.907115 2026] [proxy_fcgi:error] [pid 20856:tid 20931] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.063031 2026] [proxy_fcgi:error] [pid 20856:tid 20936] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.181986 2026] [proxy_fcgi:error] [pid 20856:tid 20937] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.308703 2026] [proxy_fcgi:error] [pid 20856:tid 20924] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.435052 2026] [proxy_fcgi:error] [pid 20856:tid 20923] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.554608 2026] [proxy_fcgi:error] [pid 20856:tid 20943] [client 4.241.228.159:2128] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 01:06:11.676379 2026] [:error] [pid 20856:tid 20928] [client 4.241.228.159:2128] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aw.php"] [unique_id "acAhg8xFtXFVNE-X2-KJmQAAAMk"]
[Mon Mar 23 01:06:12.053698 2026] [:error] [pid 20574:tid 20612] [client 4.241.228.159:2829] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aw.php"] [unique_id "acAhhNdMXEnEZrwyzJn95AAAABc"]
[Mon Mar 23 01:06:12.388470 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2169] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aw.php"] [unique_id "acAhhMxFtXFVNE-X2-KJmgAAAMo"]
[Mon Mar 23 01:06:12.645910 2026] [:error] [pid 20856:tid 20941] [client 4.241.228.159:2836] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aw.php"] [unique_id "acAhhMxFtXFVNE-X2-KJnAAAANY"]
[Mon Mar 23 01:06:12.882764 2026] [:error] [pid 20856:tid 20932] [client 4.241.228.159:2867] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bb.php"] [unique_id "acAhhMxFtXFVNE-X2-KJngAAAM0"]
[Mon Mar 23 01:06:13.115841 2026] [:error] [pid 27776:tid 27853] [client 4.241.228.159:2291] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bb.php"] [unique_id "acAhhY3Eaq7IZ5L-4XU52gAAAQc"]
[Mon Mar 23 01:06:13.353951 2026] [:error] [pid 20856:tid 20925] [client 4.241.228.159:2287] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bb.php"] [unique_id "acAhhcxFtXFVNE-X2-KJogAAAMY"]
[Mon Mar 23 01:06:13.589396 2026] [:error] [pid 20856:tid 20930] [client 4.241.228.159:2830] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bb.php"] [unique_id "acAhhcxFtXFVNE-X2-KJowAAAMs"]
[Mon Mar 23 01:06:13.831672 2026] [:error] [pid 20856:tid 20931] [client 4.241.228.159:2154] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhhcxFtXFVNE-X2-KJpQAAAMw"]
[Mon Mar 23 01:06:14.147283 2026] [:error] [pid 20584:tid 20621] [client 4.241.228.159:2868] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhhiWzr-bD_t6AP_TDWwAAAEU"]
[Mon Mar 23 01:06:14.374870 2026] [:error] [pid 20856:tid 20936] [client 4.241.228.159:2927] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhhsxFtXFVNE-X2-KJpwAAANE"]
[Mon Mar 23 01:06:14.673523 2026] [:error] [pid 20856:tid 20923] [client 4.241.228.159:2906] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acAhhsxFtXFVNE-X2-KJqQAAAMQ"]
[Mon Mar 23 01:06:14.907306 2026] [:error] [pid 20584:tid 20628] [client 4.241.228.159:2879] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acAhhiWzr-bD_t6AP_TDXAAAAEw"]
[Mon Mar 23 01:06:15.156655 2026] [:error] [pid 27776:tid 27849] [client 4.241.228.159:2293] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acAhh43Eaq7IZ5L-4XU53AAAAQM"]
[Mon Mar 23 01:06:15.394611 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2159] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acAhh8xFtXFVNE-X2-KJqwAAAMo"]
[Mon Mar 23 01:06:15.634013 2026] [:error] [pid 20584:tid 20636] [client 4.241.228.159:2170] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acAhhyWzr-bD_t6AP_TDXwAAAFQ"]
[Mon Mar 23 01:06:15.872282 2026] [:error] [pid 20856:tid 20941] [client 4.241.228.159:2164] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "acAhh8xFtXFVNE-X2-KJrQAAANY"]
[Mon Mar 23 01:06:16.130142 2026] [:error] [pid 20584:tid 20635] [client 4.241.228.159:2822] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "acAhiCWzr-bD_t6AP_TDYgAAAFM"]
[Mon Mar 23 01:06:16.379178 2026] [:error] [pid 20856:tid 20932] [client 4.241.228.159:2171] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "acAhiMxFtXFVNE-X2-KJrwAAAM0"]
[Mon Mar 23 01:06:16.729462 2026] [:error] [pid 20856:tid 20920] [client 4.241.228.159:2619] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "acAhiMxFtXFVNE-X2-KJsAAAAME"]
[Mon Mar 23 01:06:16.969358 2026] [:error] [pid 20587:tid 20651] [client 4.241.228.159:2876] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhiIByf8r3QAk4VXPldAAAAIg"]
[Mon Mar 23 01:06:17.234398 2026] [:error] [pid 20574:tid 20613] [client 4.241.228.159:2148] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhiddMXEnEZrwyzJn96QAAABg"]
[Mon Mar 23 01:06:17.492065 2026] [:error] [pid 20574:tid 20609] [client 4.241.228.159:2855] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhiddMXEnEZrwyzJn97AAAABQ"]
[Mon Mar 23 01:06:17.781692 2026] [:error] [pid 27776:tid 27862] [client 4.241.228.159:2566] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "acAhiY3Eaq7IZ5L-4XU55gAAAQ8"]
[Mon Mar 23 01:06:18.200836 2026] [:error] [pid 20587:tid 20646] [client 4.241.228.159:2583] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/autoload_classmap.php"] [unique_id "acAhioByf8r3QAk4VXPldgAAAIM"]
[Mon Mar 23 01:06:18.501157 2026] [:error] [pid 20856:tid 20940] [client 4.241.228.159:2819] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/autoload_classmap.php"] [unique_id "acAhisxFtXFVNE-X2-KJtQAAANU"]
[Mon Mar 23 01:06:18.761673 2026] [:error] [pid 20587:tid 20656] [client 4.241.228.159:2825] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/autoload_classmap.php"] [unique_id "acAhioByf8r3QAk4VXPleQAAAI0"]
[Mon Mar 23 01:06:19.023127 2026] [:error] [pid 27776:tid 27849] [client 4.241.228.159:2816] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/autoload_classmap.php"] [unique_id "acAhi43Eaq7IZ5L-4XU56wAAAQM"]
[Mon Mar 23 01:06:19.342678 2026] [:error] [pid 20574:tid 20608] [client 4.241.228.159:2143] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fx.php"] [unique_id "acAhi9dMXEnEZrwyzJn97wAAABM"]
[Mon Mar 23 01:06:19.626112 2026] [:error] [pid 27776:tid 27854] [client 4.241.228.159:2175] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fx.php"] [unique_id "acAhi43Eaq7IZ5L-4XU57AAAAQg"]
[Mon Mar 23 01:06:19.999096 2026] [:error] [pid 27776:tid 27863] [client 4.241.228.159:2817] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fx.php"] [unique_id "acAhi43Eaq7IZ5L-4XU58AAAARA"]
[Mon Mar 23 01:06:20.263438 2026] [:error] [pid 27776:tid 27860] [client 4.241.228.159:2843] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fx.php"] [unique_id "acAhjI3Eaq7IZ5L-4XU58wAAAQ0"]
[Mon Mar 23 01:06:20.664935 2026] [:error] [pid 20856:tid 20923] [client 4.241.228.159:2853] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelay.php"] [unique_id "acAhjMxFtXFVNE-X2-KJuQAAAMQ"]
[Mon Mar 23 01:06:20.901607 2026] [:error] [pid 20856:tid 20928] [client 4.241.228.159:2570] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelay.php"] [unique_id "acAhjMxFtXFVNE-X2-KJugAAAMk"]
[Mon Mar 23 01:06:21.142199 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2858] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelay.php"] [unique_id "acAhjcxFtXFVNE-X2-KJuwAAAMo"]
[Mon Mar 23 01:06:21.369522 2026] [:error] [pid 20584:tid 20623] [client 4.241.228.159:2828] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelay.php"] [unique_id "acAhjSWzr-bD_t6AP_TDagAAAEc"]
[Mon Mar 23 01:06:21.760990 2026] [:error] [pid 20587:tid 20661] [client 4.241.228.159:2818] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/god4m.php"] [unique_id "acAhjYByf8r3QAk4VXPlfwAAAJI"]
[Mon Mar 23 01:06:21.991436 2026] [:error] [pid 20574:tid 20593] [client 4.241.228.159:2505] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/god4m.php"] [unique_id "acAhjddMXEnEZrwyzJn98QAAAAQ"]
[Mon Mar 23 01:06:22.253104 2026] [:error] [pid 20584:tid 20634] [client 4.241.228.159:2607] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/god4m.php"] [unique_id "acAhjiWzr-bD_t6AP_TDbQAAAFI"]
[Mon Mar 23 01:06:22.511023 2026] [:error] [pid 20574:tid 20595] [client 4.241.228.159:2522] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/god4m.php"] [unique_id "acAhjtdMXEnEZrwyzJn98wAAAAY"]
[Mon Mar 23 01:06:22.744212 2026] [:error] [pid 20856:tid 20919] [client 4.241.228.159:2561] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mari.php"] [unique_id "acAhjsxFtXFVNE-X2-KJwgAAAMA"]
[Mon Mar 23 01:06:23.136324 2026] [:error] [pid 27776:tid 27846] [client 4.241.228.159:2837] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mari.php"] [unique_id "acAhj43Eaq7IZ5L-4XU5-QAAAQA"]
[Mon Mar 23 01:06:23.445177 2026] [:error] [pid 20574:tid 20598] [client 4.241.228.159:2172] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mari.php"] [unique_id "acAhj9dMXEnEZrwyzJn99gAAAAk"]
[Mon Mar 23 01:06:23.854943 2026] [:error] [pid 27776:tid 27847] [client 4.241.228.159:2572] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mari.php"] [unique_id "acAhj43Eaq7IZ5L-4XU5_gAAAQE"]
[Mon Mar 23 01:06:24.137311 2026] [:error] [pid 27776:tid 27853] [client 4.241.228.159:2562] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "acAhkI3Eaq7IZ5L-4XU6AgAAAQc"]
[Mon Mar 23 01:06:24.500658 2026] [:error] [pid 27776:tid 27860] [client 4.241.228.159:2563] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "acAhkI3Eaq7IZ5L-4XU6BAAAAQ0"]
[Mon Mar 23 01:06:24.760111 2026] [:error] [pid 20856:tid 20931] [client 4.241.228.159:2869] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "acAhkMxFtXFVNE-X2-KJxAAAAMw"]
[Mon Mar 23 01:06:25.003127 2026] [:error] [pid 20856:tid 20939] [client 4.241.228.159:2618] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moon.php"] [unique_id "acAhkcxFtXFVNE-X2-KJxwAAANQ"]
[Mon Mar 23 01:06:25.314795 2026] [:error] [pid 20587:tid 20651] [client 4.241.228.159:2597] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "acAhkYByf8r3QAk4VXPlggAAAIg"]
[Mon Mar 23 01:06:25.659580 2026] [:error] [pid 20574:tid 20604] [client 4.241.228.159:2568] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "acAhkddMXEnEZrwyzJn9-QAAAA8"]
[Mon Mar 23 01:06:26.005696 2026] [:error] [pid 20574:tid 20599] [client 4.241.228.159:2609] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "acAhktdMXEnEZrwyzJn9-gAAAAo"]
[Mon Mar 23 01:06:26.480187 2026] [:error] [pid 20574:tid 20609] [client 4.241.228.159:2861] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "acAhktdMXEnEZrwyzJn9_AAAABQ"]
[Mon Mar 23 01:06:26.876266 2026] [:error] [pid 20574:tid 20608] [client 4.241.228.159:2875] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmp.php"] [unique_id "acAhktdMXEnEZrwyzJn-AAAAABM"]
[Mon Mar 23 01:06:27.215069 2026] [:error] [pid 20856:tid 20923] [client 4.241.228.159:2604] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmp.php"] [unique_id "acAhk8xFtXFVNE-X2-KJygAAAMQ"]
[Mon Mar 23 01:06:27.497521 2026] [:error] [pid 20856:tid 20929] [client 4.241.228.159:2866] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmp.php"] [unique_id "acAhk8xFtXFVNE-X2-KJywAAAMo"]
[Mon Mar 23 01:06:27.740401 2026] [:error] [pid 20587:tid 20667] [client 4.241.228.159:2863] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmp.php"] [unique_id "acAhk4Byf8r3QAk4VXPlhAAAAJg"]
[Mon Mar 23 01:06:28.016686 2026] [:error] [pid 20574:tid 20607] [client 4.241.228.159:2161] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "acAhlNdMXEnEZrwyzJn-AwAAABI"]
[Mon Mar 23 01:06:28.303822 2026] [:error] [pid 20587:tid 20662] [client 4.241.228.159:2613] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "acAhlIByf8r3QAk4VXPlhQAAAJM"]
[Mon Mar 23 01:06:28.591840 2026] [:error] [pid 20584:tid 20617] [client 4.241.228.159:2578] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "acAhlCWzr-bD_t6AP_TDdQAAAEE"]
[Mon Mar 23 01:06:28.913319 2026] [:error] [pid 20574:tid 20600] [client 4.241.228.159:2584] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "acAhlNdMXEnEZrwyzJn-BQAAAAs"]
[Mon Mar 23 01:06:29.189011 2026] [:error] [pid 20574:tid 20598] [client 4.241.228.159:2878] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/a.php"] [unique_id "acAhlddMXEnEZrwyzJn-BgAAAAk"]
[Mon Mar 23 01:06:29.481149 2026] [:error] [pid 20574:tid 20601] [client 4.241.228.159:2900] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/a.php"] [unique_id "acAhlddMXEnEZrwyzJn-CAAAAAw"]
[Mon Mar 23 01:06:29.712788 2026] [:error] [pid 27776:tid 27849] [client 4.241.228.159:2605] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/a.php"] [unique_id "acAhlY3Eaq7IZ5L-4XU6DAAAAQM"]
[Mon Mar 23 01:06:29.957761 2026] [:error] [pid 27776:tid 27861] [client 4.241.228.159:2567] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/a.php"] [unique_id "acAhlY3Eaq7IZ5L-4XU6DQAAAQ4"]
[Mon Mar 23 01:06:30.265853 2026] [:error] [pid 27776:tid 27868] [client 4.241.228.159:2587] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/alfa.php"] [unique_id "acAhlo3Eaq7IZ5L-4XU6EQAAARU"]
[Mon Mar 23 01:06:30.567011 2026] [:error] [pid 27776:tid 27851] [client 4.241.228.159:2573] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/alfa.php"] [unique_id "acAhlo3Eaq7IZ5L-4XU6EwAAAQU"]
[Mon Mar 23 01:06:30.794905 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2854] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/alfa.php"] [unique_id "acAhlo3Eaq7IZ5L-4XU6FQAAARE"]
[Mon Mar 23 01:06:31.105650 2026] [:error] [pid 20587:tid 20652] [client 4.241.228.159:2153] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/alfa.php"] [unique_id "acAhl4Byf8r3QAk4VXPligAAAIk"]
[Mon Mar 23 01:06:31.380200 2026] [:error] [pid 20587:tid 20664] [client 4.241.228.159:2585] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors"] [unique_id "acAhl4Byf8r3QAk4VXPljAAAAJU"]
[Mon Mar 23 01:06:31.695044 2026] [:error] [pid 20574:tid 20604] [client 4.241.228.159:2146] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors"] [unique_id "acAhl9dMXEnEZrwyzJn-CgAAAA8"]
[Mon Mar 23 01:06:31.928872 2026] [:error] [pid 20574:tid 20602] [client 4.241.228.159:2303] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors"] [unique_id "acAhl9dMXEnEZrwyzJn-CwAAAA0"]
[Mon Mar 23 01:06:32.224522 2026] [:error] [pid 20856:tid 20933] [client 4.241.228.159:2301] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors"] [unique_id "acAhmMxFtXFVNE-X2-KJ0QAAAM4"]
[Mon Mar 23 01:06:32.454121 2026] [:error] [pid 20856:tid 20925] [client 4.241.228.159:2504] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "acAhmMxFtXFVNE-X2-KJ0gAAAMY"]
[Mon Mar 23 01:06:32.697406 2026] [:error] [pid 20587:tid 20649] [client 4.241.228.159:2844] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "acAhmIByf8r3QAk4VXPlkAAAAIY"]
[Mon Mar 23 01:06:32.937548 2026] [:error] [pid 20587:tid 20654] [client 4.241.228.159:2580] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "acAhmIByf8r3QAk4VXPlkgAAAIs"]
[Mon Mar 23 01:06:33.164451 2026] [:error] [pid 20587:tid 20657] [client 4.241.228.159:2510] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "acAhmYByf8r3QAk4VXPlkwAAAI4"]
[Mon Mar 23 01:06:33.443720 2026] [:error] [pid 20587:tid 20660] [client 4.241.228.159:2876] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "acAhmYByf8r3QAk4VXPllQAAAJE"]
[Mon Mar 23 01:06:33.698675 2026] [:error] [pid 20587:tid 20645] [client 4.241.228.159:2846] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "acAhmYByf8r3QAk4VXPllwAAAII"]
[Mon Mar 23 01:06:33.994776 2026] [:error] [pid 20587:tid 20648] [client 4.241.228.159:2596] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "acAhmYByf8r3QAk4VXPlmQAAAIU"]
[Mon Mar 23 01:06:34.241686 2026] [:error] [pid 20587:tid 20646] [client 4.241.228.159:2862] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "acAhmoByf8r3QAk4VXPlmgAAAIM"]
[Mon Mar 23 01:06:34.470216 2026] [:error] [pid 27776:tid 27855] [client 4.241.228.159:2821] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "acAhmo3Eaq7IZ5L-4XU6GgAAAQk"]
[Mon Mar 23 01:06:34.714911 2026] [:error] [pid 27776:tid 27853] [client 4.241.228.159:2295] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "acAhmo3Eaq7IZ5L-4XU6HQAAAQc"]
[Mon Mar 23 01:06:34.942198 2026] [:error] [pid 27776:tid 27868] [client 4.241.228.159:2174] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "acAhmo3Eaq7IZ5L-4XU6HwAAARU"]
[Mon Mar 23 01:06:35.171816 2026] [:error] [pid 27776:tid 27854] [client 4.241.228.159:2521] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "acAhm43Eaq7IZ5L-4XU6IQAAAQg"]
[Mon Mar 23 01:06:35.473343 2026] [:error] [pid 27776:tid 27867] [client 4.241.228.159:2616] [client 4.241.228.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/test1.php"] [unique_id "acAhm43Eaq7IZ5L-4XU6IgAAARQ"]
[Mon Mar 23 01:06:35.721186 2026] [:error] [pid 20584:tid 20636] [client 4.241.228.159:2851] [client 4.241.228.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "acAhmyWzr-bD_t6AP_TDfgAAAFQ"]
[Mon Mar 23 01:06:35.950228 2026] [:error] [pid 27776:tid 27864] [client 4.241.228.159:2576] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "acAhm43Eaq7IZ5L-4XU6JQAAARE"]
[Mon Mar 23 01:06:36.189597 2026] [:error] [pid 27776:tid 27871] [client 4.241.228.159:2564] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "acAhnI3Eaq7IZ5L-4XU6KAAAARc"]
[Mon Mar 23 01:06:36.424651 2026] [:error] [pid 27776:tid 27848] [client 4.241.228.159:2595] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "acAhnI3Eaq7IZ5L-4XU6KQAAAQI"]
[Mon Mar 23 01:06:36.739822 2026] [:error] [pid 27776:tid 27855] [client 4.241.228.159:2592] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/"] [unique_id "acAhnI3Eaq7IZ5L-4XU6LAAAAQk"]
[Mon Mar 23 01:06:36.970988 2026] [:error] [pid 27776:tid 27852] [client 4.241.228.159:2581] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/"] [unique_id "acAhnI3Eaq7IZ5L-4XU6LgAAAQY"]
[Mon Mar 23 01:06:37.201735 2026] [:error] [pid 27776:tid 27861] [client 4.241.228.159:2842] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/"] [unique_id "acAhnY3Eaq7IZ5L-4XU6MQAAAQ4"]
[Mon Mar 23 01:06:37.447044 2026] [:error] [pid 27776:tid 27851] [client 4.241.228.159:2139] [client 4.241.228.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/"] [unique_id "acAhnY3Eaq7IZ5L-4XU6MgAAAQU"]
[Mon Mar 23 01:37:38.081695 2026] [:error] [pid 27776:tid 27857] [client 182.42.111.213:54698] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acAo4o3Eaq7IZ5L-4XVLzgAAAQo"]
[Mon Mar 23 02:05:18.857557 2026] [:error] [pid 20587:tid 20664] [client 43.159.136.201:49164] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acAvXoByf8r3QAk4VXPxuQAAAJU"]
[Mon Mar 23 04:45:08.345318 2026] [proxy_fcgi:error] [pid 57265:tid 57285] [client 20.220.145.74:50176] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 04:45:08.766944 2026] [:error] [pid 57265:tid 57284] [client 20.220.145.74:50176] [client 20.220.145.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.145.74, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acBU1GNLjPJJkhuqCsiUVQAAARE"]
[Mon Mar 23 04:45:08.980787 2026] [proxy_fcgi:error] [pid 57265:tid 57269] [client 20.220.145.74:50176] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 04:45:09.838973 2026] [proxy_fcgi:error] [pid 57265:tid 57288] [client 20.220.145.74:50176] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 04:45:10.495372 2026] [proxy_fcgi:error] [pid 57265:tid 57274] [client 20.220.145.74:50176] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 04:45:10.703633 2026] [:error] [pid 57265:tid 57268] [client 20.220.145.74:50176] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "acBU1mNLjPJJkhuqCsiUawAAAQE"]
[Mon Mar 23 04:45:11.569804 2026] [:error] [pid 57265:tid 57286] [client 20.220.145.74:50236] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "acBU12NLjPJJkhuqCsiUbwAAARM"]
[Mon Mar 23 04:45:12.405296 2026] [:error] [pid 23441:tid 23520] [client 20.220.145.74:50214] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "acBU2Bq7S-oOqSXZEr5ELAAAAJE"]
[Mon Mar 23 04:45:13.252907 2026] [:error] [pid 23539:tid 23572] [client 20.220.145.74:50235] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "acBU2X7Dh3qWGSpIAZUqeAAAANg"]
[Mon Mar 23 05:06:39.461762 2026] [:error] [pid 23539:tid 23555] [client 14.144.15.71:2060] [client 14.144.15.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acBZ337Dh3qWGSpIAZUzWQAAAMc"], referer: http://switchcreative.net/
[Mon Mar 23 05:12:42.627315 2026] [:error] [pid 57265:tid 57287] [client 176.122.109.176:59624] [client 176.122.109.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.122.109.176, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acBbSmNLjPJJkhuqCsijFwAAARQ"]
[Mon Mar 23 05:12:42.639094 2026] [proxy_fcgi:error] [pid 57265:tid 57287] [client 176.122.109.176:59624] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 05:33:44.641853 2026] [:error] [pid 57265:tid 57267] [client 187.106.42.12:19283] [client 187.106.42.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.42.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acBgOGNLjPJJkhuqCsitdAAAAQA"]
[Mon Mar 23 05:33:44.655050 2026] [proxy_fcgi:error] [pid 57265:tid 57267] [client 187.106.42.12:19283] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 12:31:06.576780 2026] [:error] [pid 14573:tid 14584] [client 5.188.119.156:39524] [client 5.188.119.156] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=multipart/alternative"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acDCCu-oSmHn3q4_J1FDPgAAAUk"]
[Mon Mar 23 13:40:15.778670 2026] [:error] [pid 23539:tid 23572] [client 43.166.129.247:56514] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acDSP37Dh3qWGSpIAZXcfgAAANg"]
[Mon Mar 23 14:34:12.557418 2026] [:error] [pid 57265:tid 57286] [client 43.167.239.66:33792] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acDe5GNLjPJJkhuqCsixmgAAARM"]
[Mon Mar 23 16:10:20.929271 2026] [:error] [pid 57265:tid 57286] [client 23.251.35.39:53900] [client 23.251.35.39] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=multipart/alternative"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acD1bGNLjPJJkhuqCsjpNAAAARM"]
[Mon Mar 23 17:30:22.975739 2026] [:error] [pid 23539:tid 23549] [client 82.198.236.94:41614] [client 82.198.236.94] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "acEILn7Dh3qWGSpIAZUPowAAAME"]
[Mon Mar 23 20:01:52.951555 2026] [proxy_fcgi:error] [pid 14573:tid 14588] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:53.165673 2026] [proxy_fcgi:error] [pid 14573:tid 14590] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:53.384554 2026] [proxy_fcgi:error] [pid 14573:tid 14581] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:53.611899 2026] [proxy_fcgi:error] [pid 14573:tid 14594] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:53.841906 2026] [proxy_fcgi:error] [pid 14573:tid 14586] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:54.052515 2026] [proxy_fcgi:error] [pid 14573:tid 14575] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:54.442332 2026] [proxy_fcgi:error] [pid 14573:tid 14587] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:54.652796 2026] [proxy_fcgi:error] [pid 14573:tid 14578] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:54.863743 2026] [proxy_fcgi:error] [pid 14573:tid 14599] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:55.074167 2026] [proxy_fcgi:error] [pid 14573:tid 14598] [client 40.85.246.124:60669] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:01:55.281221 2026] [:error] [pid 14573:tid 14589] [client 40.85.246.124:60669] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acErs--oSmHn3q4_J1HvTAAAAU4"]
[Mon Mar 23 20:01:56.048337 2026] [:error] [pid 35165:tid 35189] [client 40.85.246.124:59976] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acErtM6udpN6Esk7JKvWNgAAAZU"]
[Mon Mar 23 20:01:57.123217 2026] [:error] [pid 14573:tid 14585] [client 40.85.246.124:57894] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acErte-oSmHn3q4_J1HvUQAAAUo"]
[Mon Mar 23 20:01:57.653284 2026] [:error] [pid 57265:tid 57285] [client 40.85.246.124:45273] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acErtWNLjPJJkhuqCsh15gAAARI"]
[Mon Mar 23 20:01:58.259251 2026] [:error] [pid 23441:tid 23513] [client 40.85.246.124:59995] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/path.php"] [unique_id "acErthq7S-oOqSXZEr7udAAAAIo"]
[Mon Mar 23 20:01:58.827722 2026] [:error] [pid 23440:tid 23479] [client 40.85.246.124:53521] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/path.php"] [unique_id "acErtj49_8n8h_ttcUpBhAAAAEM"]
[Mon Mar 23 20:01:59.424248 2026] [:error] [pid 57265:tid 57268] [client 40.85.246.124:62634] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/path.php"] [unique_id "acErt2NLjPJJkhuqCsh16QAAAQE"]
[Mon Mar 23 20:01:59.988734 2026] [:error] [pid 57265:tid 57282] [client 40.85.246.124:52458] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/path.php"] [unique_id "acErt2NLjPJJkhuqCsh17AAAAQ8"]
[Mon Mar 23 20:02:00.622761 2026] [:error] [pid 23539:tid 23566] [client 40.85.246.124:62649] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "acEruH7Dh3qWGSpIAZU2hwAAANI"]
[Mon Mar 23 20:02:01.527428 2026] [:error] [pid 23441:tid 23523] [client 40.85.246.124:59969] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "acEruRq7S-oOqSXZEr7udwAAAJQ"]
[Mon Mar 23 20:02:04.050042 2026] [:error] [pid 35165:tid 35192] [client 40.85.246.124:53513] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "acErvM6udpN6Esk7JKvWPAAAAZg"]
[Mon Mar 23 20:02:05.250847 2026] [:error] [pid 23441:tid 23506] [client 40.85.246.124:53563] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "acErvRq7S-oOqSXZEr7ueAAAAIM"]
[Mon Mar 23 20:02:06.208072 2026] [:error] [pid 35165:tid 35178] [client 40.85.246.124:53538] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fleen.php"] [unique_id "acErvs6udpN6Esk7JKvWPwAAAYo"]
[Mon Mar 23 20:02:07.557663 2026] [:error] [pid 23539:tid 23561] [client 40.85.246.124:44112] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fleen.php"] [unique_id "acErv37Dh3qWGSpIAZU2lAAAAM0"]
[Mon Mar 23 20:02:13.793180 2026] [:error] [pid 35165:tid 35177] [client 40.85.246.124:55208] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fleen.php"] [unique_id "acErxc6udpN6Esk7JKvWSwAAAYk"]
[Mon Mar 23 20:02:16.480557 2026] [:error] [pid 23439:tid 23455] [client 40.85.246.124:57021] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fleen.php"] [unique_id "acEryKZv8XIzUKdgaMecSQAAAAY"]
[Mon Mar 23 20:02:18.127735 2026] [:error] [pid 57265:tid 57267] [client 40.85.246.124:62911] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "acErymNLjPJJkhuqCsh1-AAAAQA"]
[Mon Mar 23 20:02:19.203763 2026] [:error] [pid 35165:tid 35174] [client 40.85.246.124:58904] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "acEry86udpN6Esk7JKvWXAAAAYY"]
[Mon Mar 23 20:02:20.078309 2026] [:error] [pid 23539:tid 23551] [client 40.85.246.124:2754] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "acErzH7Dh3qWGSpIAZU2owAAAMM"]
[Mon Mar 23 20:02:21.635111 2026] [:error] [pid 14573:tid 14584] [client 40.85.246.124:2777] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "acErze-oSmHn3q4_J1HvZwAAAUk"]
[Mon Mar 23 20:02:23.022387 2026] [:error] [pid 23539:tid 23550] [client 40.85.246.124:2162] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av6m.php"] [unique_id "acErz37Dh3qWGSpIAZU2pwAAAMI"]
[Mon Mar 23 20:02:24.079888 2026] [:error] [pid 14573:tid 14585] [client 40.85.246.124:61386] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av6m.php"] [unique_id "acEr0O-oSmHn3q4_J1HvaQAAAUo"]
[Mon Mar 23 20:02:24.841821 2026] [:error] [pid 23440:tid 23488] [client 40.85.246.124:59813] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av6m.php"] [unique_id "acEr0D49_8n8h_ttcUpBlgAAAEw"]
[Mon Mar 23 20:02:25.820450 2026] [:error] [pid 57265:tid 57286] [client 40.85.246.124:2167] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av6m.php"] [unique_id "acEr0WNLjPJJkhuqCsh1_wAAARM"]
[Mon Mar 23 20:02:27.003935 2026] [:error] [pid 57265:tid 57270] [client 40.85.246.124:56913] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autogooey.php"] [unique_id "acEr02NLjPJJkhuqCsh2BQAAAQM"]
[Mon Mar 23 20:02:28.528816 2026] [:error] [pid 57265:tid 57280] [client 40.85.246.124:56158] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autogooey.php"] [unique_id "acEr1GNLjPJJkhuqCsh2CwAAAQ0"]
[Mon Mar 23 20:02:30.869848 2026] [:error] [pid 35165:tid 35178] [client 40.85.246.124:59818] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autogooey.php"] [unique_id "acEr1s6udpN6Esk7JKvWagAAAYo"]
[Mon Mar 23 20:02:35.115435 2026] [:error] [pid 23539:tid 23564] [client 40.85.246.124:58355] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/autogooey.php"] [unique_id "acEr237Dh3qWGSpIAZU2wAAAANA"]
[Mon Mar 23 20:02:38.838617 2026] [:error] [pid 57265:tid 57284] [client 40.85.246.124:58553] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "acEr3mNLjPJJkhuqCsh2EQAAARE"]
[Mon Mar 23 20:02:44.042712 2026] [:error] [pid 14573:tid 14585] [client 40.85.246.124:59118] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "acEr5O-oSmHn3q4_J1HvdQAAAUo"]
[Mon Mar 23 20:02:45.265812 2026] [:error] [pid 14573:tid 14599] [client 40.85.246.124:59100] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "acEr5e-oSmHn3q4_J1HveAAAAVg"]
[Mon Mar 23 20:02:46.076604 2026] [:error] [pid 23440:tid 23500] [client 40.85.246.124:62151] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "acEr5j49_8n8h_ttcUpBpgAAAFg"]
[Mon Mar 23 20:02:46.882294 2026] [:error] [pid 35165:tid 35168] [client 40.85.246.124:2270] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "acEr5s6udpN6Esk7JKvWcQAAAYA"]
[Mon Mar 23 20:02:48.146258 2026] [:error] [pid 35165:tid 35174] [client 40.85.246.124:62192] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "acEr6M6udpN6Esk7JKvWdwAAAYY"]
[Mon Mar 23 20:02:49.465438 2026] [:error] [pid 23539:tid 23566] [client 40.85.246.124:59769] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "acEr6X7Dh3qWGSpIAZU20QAAANI"]
[Mon Mar 23 20:02:50.079869 2026] [:error] [pid 23539:tid 23559] [client 40.85.246.124:59867] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "acEr6n7Dh3qWGSpIAZU20wAAAMs"]
[Mon Mar 23 20:02:50.967441 2026] [:error] [pid 23539:tid 23558] [client 40.85.246.124:59192] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "acEr6n7Dh3qWGSpIAZU21gAAAMo"]
[Mon Mar 23 20:02:51.688868 2026] [:error] [pid 23441:tid 23519] [client 40.85.246.124:54155] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "acEr6xq7S-oOqSXZEr7ulgAAAJA"]
[Mon Mar 23 20:02:52.225410 2026] [:error] [pid 14573:tid 14593] [client 40.85.246.124:63245] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "acEr7O-oSmHn3q4_J1HvfwAAAVI"]
[Mon Mar 23 20:02:52.772937 2026] [:error] [pid 23441:tid 23508] [client 40.85.246.124:45215] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "acEr7Bq7S-oOqSXZEr7ulwAAAIU"]
[Mon Mar 23 20:02:53.414501 2026] [:error] [pid 14573:tid 14588] [client 40.85.246.124:59872] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "acEr7e-oSmHn3q4_J1HvgwAAAU0"]
[Mon Mar 23 20:02:54.067204 2026] [:error] [pid 23440:tid 23487] [client 40.85.246.124:62200] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "acEr7j49_8n8h_ttcUpBqQAAAEs"]
[Mon Mar 23 20:02:55.112884 2026] [proxy_fcgi:error] [pid 57265:tid 57289] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:55.329056 2026] [proxy_fcgi:error] [pid 57265:tid 57280] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:55.539429 2026] [proxy_fcgi:error] [pid 57265:tid 57271] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:55.748251 2026] [proxy_fcgi:error] [pid 57265:tid 57268] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:55.957868 2026] [proxy_fcgi:error] [pid 57265:tid 57288] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:56.167740 2026] [proxy_fcgi:error] [pid 57265:tid 57282] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:56.599689 2026] [proxy_fcgi:error] [pid 57265:tid 57281] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:57.021362 2026] [proxy_fcgi:error] [pid 57265:tid 57283] [client 40.85.246.124:61036] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 20:02:57.235704 2026] [:error] [pid 57265:tid 57290] [client 40.85.246.124:61036] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "acEr8WNLjPJJkhuqCsh2LQAAARc"]
[Mon Mar 23 20:02:58.081078 2026] [:error] [pid 35165:tid 35188] [client 40.85.246.124:62107] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acEr8s6udpN6Esk7JKvWhAAAAZQ"]
[Mon Mar 23 20:02:58.818989 2026] [:error] [pid 57265:tid 57280] [client 40.85.246.124:62198] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acEr8mNLjPJJkhuqCsh2MgAAAQ0"]
[Mon Mar 23 20:02:59.533357 2026] [:error] [pid 57265:tid 57287] [client 40.85.246.124:59178] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acEr82NLjPJJkhuqCsh2NwAAARQ"]
[Mon Mar 23 20:03:00.118805 2026] [:error] [pid 57265:tid 57284] [client 40.85.246.124:60189] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acEr9GNLjPJJkhuqCsh2OQAAARE"]
[Mon Mar 23 20:03:00.684061 2026] [:error] [pid 14573:tid 14596] [client 40.85.246.124:59181] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "acEr9O-oSmHn3q4_J1HvnQAAAVU"]
[Mon Mar 23 20:03:02.100393 2026] [:error] [pid 14573:tid 14576] [client 40.85.246.124:57788] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "acEr9u-oSmHn3q4_J1HvogAAAUE"]
[Mon Mar 23 20:03:03.150307 2026] [:error] [pid 57265:tid 57289] [client 40.85.246.124:55015] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "acEr92NLjPJJkhuqCsh2RQAAARY"]
[Mon Mar 23 20:03:03.743770 2026] [:error] [pid 57265:tid 57281] [client 40.85.246.124:57758] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "acEr92NLjPJJkhuqCsh2SwAAAQ4"]
[Mon Mar 23 21:51:48.177072 2026] [:error] [pid 38178:tid 38246] [client 103.16.62.83:2080] [client 103.16.62.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.62.83, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acFFdA0axWfXsVvR9udHKQAAAIQ"]
[Mon Mar 23 21:51:48.187691 2026] [proxy_fcgi:error] [pid 38178:tid 38246] [client 103.16.62.83:2080] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:51:49.860020 2026] [:error] [pid 38176:tid 38205] [client 182.10.129.206:61639] [client 182.10.129.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.129.206, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acFFdUtG4qlh1gvNjuJE5gAAABI"]
[Mon Mar 23 21:51:49.865794 2026] [proxy_fcgi:error] [pid 38176:tid 38205] [client 182.10.129.206:61639] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:52.021164 2026] [proxy_fcgi:error] [pid 52341:tid 52362] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:52.283500 2026] [proxy_fcgi:error] [pid 52341:tid 52350] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:52.546185 2026] [proxy_fcgi:error] [pid 52341:tid 52353] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:52.805225 2026] [proxy_fcgi:error] [pid 52341:tid 52359] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:53.065483 2026] [proxy_fcgi:error] [pid 52341:tid 52364] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:53.326734 2026] [proxy_fcgi:error] [pid 52341:tid 52346] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:53.591292 2026] [proxy_fcgi:error] [pid 52341:tid 52358] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:53.852986 2026] [proxy_fcgi:error] [pid 52341:tid 52355] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:54.120004 2026] [proxy_fcgi:error] [pid 52341:tid 52367] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:54.380650 2026] [proxy_fcgi:error] [pid 52341:tid 52363] [client 20.215.241.7:46832] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:54:54.636858 2026] [:error] [pid 52341:tid 52354] [client 20.215.241.7:46832] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acFGLqPKTBDR2u47Gb3mbwAAAUs"]
[Mon Mar 23 21:54:55.223666 2026] [:error] [pid 52341:tid 52350] [client 20.215.241.7:34565] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acFGL6PKTBDR2u47Gb3mcQAAAUc"]
[Mon Mar 23 21:54:55.783778 2026] [:error] [pid 38306:tid 38331] [client 20.215.241.7:46821] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acFGLzkL8qwu-hHc6Bir5QAAARc"]
[Mon Mar 23 21:54:56.303296 2026] [:error] [pid 52341:tid 52356] [client 20.215.241.7:50517] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acFGMKPKTBDR2u47Gb3mdAAAAU0"]
[Mon Mar 23 21:54:56.825629 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:52354] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "acFGMEtG4qlh1gvNjuJFngAAABI"]
[Mon Mar 23 21:54:57.361370 2026] [:error] [pid 38178:tid 38261] [client 20.215.241.7:4419] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "acFGMQ0axWfXsVvR9udHwAAAAJM"]
[Mon Mar 23 21:54:57.911927 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:50596] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "acFGMXsYW-_HCI66Mun4LwAAAFY"]
[Mon Mar 23 21:54:58.439377 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:4460] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "acFGMktG4qlh1gvNjuJFoQAAAAQ"]
[Mon Mar 23 21:54:58.955641 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:4128] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "acFGMktG4qlh1gvNjuJFogAAABE"]
[Mon Mar 23 21:54:59.472556 2026] [:error] [pid 52341:tid 52358] [client 20.215.241.7:52382] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "acFGM6PKTBDR2u47Gb3meAAAAU8"]
[Mon Mar 23 21:55:00.012871 2026] [:error] [pid 38176:tid 38201] [client 20.215.241.7:63641] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "acFGNEtG4qlh1gvNjuJFpAAAAA4"]
[Mon Mar 23 21:55:00.535989 2026] [:error] [pid 38176:tid 38196] [client 20.215.241.7:63619] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bywaf.php"] [unique_id "acFGNEtG4qlh1gvNjuJFpgAAAAk"]
[Mon Mar 23 21:55:01.050932 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:4151] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acFGNTkL8qwu-hHc6Bir7QAAARE"]
[Mon Mar 23 21:55:01.604060 2026] [:error] [pid 38276:tid 38287] [client 20.215.241.7:4176] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acFGNZoKGiI-a7oME3L_LAAAAMg"]
[Mon Mar 23 21:55:02.150452 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:4108] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acFGNjkL8qwu-hHc6Bir8QAAARg"]
[Mon Mar 23 21:55:02.714717 2026] [:error] [pid 38177:tid 38239] [client 20.215.241.7:34575] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acFGNnsYW-_HCI66Mun4MwAAAFg"]
[Mon Mar 23 21:55:03.256406 2026] [:error] [pid 38178:tid 38266] [client 20.215.241.7:4195] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acFGNw0axWfXsVvR9udHxAAAAJg"]
[Mon Mar 23 21:55:03.797340 2026] [:error] [pid 52341:tid 52347] [client 20.215.241.7:40582] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acFGN6PKTBDR2u47Gb3mhQAAAUQ"]
[Mon Mar 23 21:55:04.343009 2026] [:error] [pid 52341:tid 52355] [client 20.215.241.7:50557] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acFGOKPKTBDR2u47Gb3miAAAAUw"]
[Mon Mar 23 21:55:04.876374 2026] [:error] [pid 38178:tid 38246] [client 20.215.241.7:4181] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acFGOA0axWfXsVvR9udHxQAAAIQ"]
[Mon Mar 23 21:55:05.403613 2026] [:error] [pid 38178:tid 38251] [client 20.215.241.7:34607] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acFGOQ0axWfXsVvR9udHyAAAAIk"]
[Mon Mar 23 21:55:05.930948 2026] [:error] [pid 38178:tid 38261] [client 20.215.241.7:46313] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acFGOQ0axWfXsVvR9udHzAAAAJM"]
[Mon Mar 23 21:55:06.459050 2026] [:error] [pid 52341:tid 52360] [client 20.215.241.7:50543] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acFGOqPKTBDR2u47Gb3miwAAAVE"]
[Mon Mar 23 21:55:06.987587 2026] [:error] [pid 38178:tid 38252] [client 20.215.241.7:50619] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acFGOg0axWfXsVvR9udH1AAAAIo"]
[Mon Mar 23 21:55:07.514611 2026] [:error] [pid 38176:tid 38209] [client 20.215.241.7:34615] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "acFGO0tG4qlh1gvNjuJFqgAAABY"]
[Mon Mar 23 21:55:08.027845 2026] [:error] [pid 38276:tid 38291] [client 20.215.241.7:46288] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "acFGPJoKGiI-a7oME3L_MAAAAMw"]
[Mon Mar 23 21:55:08.595026 2026] [:error] [pid 52341:tid 52353] [client 20.215.241.7:34598] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "acFGPKPKTBDR2u47Gb3mjgAAAUo"]
[Mon Mar 23 21:55:09.111571 2026] [:error] [pid 38178:tid 38251] [client 20.215.241.7:34569] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "acFGPQ0axWfXsVvR9udH2AAAAIk"]
[Mon Mar 23 21:55:09.648096 2026] [:error] [pid 52341:tid 52346] [client 20.215.241.7:52368] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acFGPaPKTBDR2u47Gb3mkwAAAUM"]
[Mon Mar 23 21:55:10.217848 2026] [:error] [pid 38276:tid 38292] [client 20.215.241.7:50582] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acFGPpoKGiI-a7oME3L_MgAAAM0"]
[Mon Mar 23 21:55:10.844468 2026] [:error] [pid 52341:tid 52345] [client 20.215.241.7:34620] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acFGPqPKTBDR2u47Gb3mmgAAAUI"]
[Mon Mar 23 21:55:11.412204 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:4221] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acFGP0tG4qlh1gvNjuJFsQAAAAQ"]
[Mon Mar 23 21:55:11.978387 2026] [:error] [pid 52341:tid 52365] [client 20.215.241.7:34606] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acFGP6PKTBDR2u47Gb3mngAAAVY"]
[Mon Mar 23 21:55:12.508573 2026] [:error] [pid 52341:tid 52357] [client 20.215.241.7:46791] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acFGQKPKTBDR2u47Gb3moQAAAU4"]
[Mon Mar 23 21:55:13.022357 2026] [:error] [pid 52341:tid 52364] [client 20.215.241.7:52403] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acFGQaPKTBDR2u47Gb3mpAAAAVU"]
[Mon Mar 23 21:55:13.579486 2026] [:error] [pid 38306:tid 38330] [client 20.215.241.7:40617] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acFGQTkL8qwu-hHc6Bir-QAAARY"]
[Mon Mar 23 21:55:14.117983 2026] [:error] [pid 38276:tid 38289] [client 20.215.241.7:4196] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acFGQpoKGiI-a7oME3L_NAAAAMo"]
[Mon Mar 23 21:55:14.647973 2026] [:error] [pid 38177:tid 38216] [client 20.215.241.7:50573] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acFGQnsYW-_HCI66Mun4PAAAAEE"]
[Mon Mar 23 21:55:15.213319 2026] [:error] [pid 38306:tid 38314] [client 20.215.241.7:50580] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acFGQzkL8qwu-hHc6Bir_wAAAQY"]
[Mon Mar 23 21:55:15.746449 2026] [:error] [pid 52341:tid 52355] [client 20.215.241.7:46311] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acFGQ6PKTBDR2u47Gb3mqQAAAUw"]
[Mon Mar 23 21:55:16.327363 2026] [:error] [pid 52341:tid 52366] [client 20.215.241.7:4103] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acFGRKPKTBDR2u47Gb3mqwAAAVc"]
[Mon Mar 23 21:55:16.843184 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:50542] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acFGRKPKTBDR2u47Gb3mrQAAAUA"]
[Mon Mar 23 21:55:17.423478 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:46823] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acFGRXsYW-_HCI66Mun4PgAAAFY"]
[Mon Mar 23 21:55:18.001734 2026] [:error] [pid 52341:tid 52344] [client 20.215.241.7:40624] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acFGRqPKTBDR2u47Gb3msgAAAUE"]
[Mon Mar 23 21:55:18.535122 2026] [:error] [pid 52341:tid 52364] [client 20.215.241.7:50592] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "acFGRqPKTBDR2u47Gb3mtAAAAVU"]
[Mon Mar 23 21:55:19.054634 2026] [:error] [pid 52341:tid 52352] [client 20.215.241.7:4213] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "acFGR6PKTBDR2u47Gb3mtgAAAUk"]
[Mon Mar 23 21:55:19.667949 2026] [:error] [pid 38177:tid 38224] [client 20.215.241.7:4114] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "acFGR3sYW-_HCI66Mun4QAAAAEk"]
[Mon Mar 23 21:55:20.217130 2026] [:error] [pid 52341:tid 52358] [client 20.215.241.7:50605] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "acFGSKPKTBDR2u47Gb3muAAAAU8"]
[Mon Mar 23 21:55:20.732273 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:47541] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "acFGSDkL8qwu-hHc6BisBgAAARQ"]
[Mon Mar 23 21:55:21.263285 2026] [:error] [pid 38177:tid 38218] [client 20.215.241.7:50528] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "acFGSXsYW-_HCI66Mun4RAAAAEM"]
[Mon Mar 23 21:55:21.846634 2026] [:error] [pid 38177:tid 38228] [client 20.215.241.7:4442] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "acFGSXsYW-_HCI66Mun4RgAAAE0"]
[Mon Mar 23 21:55:22.405401 2026] [:error] [pid 38177:tid 38238] [client 20.215.241.7:4105] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "acFGSnsYW-_HCI66Mun4SQAAAFc"]
[Mon Mar 23 21:55:22.948667 2026] [:error] [pid 52341:tid 52344] [client 20.215.241.7:46286] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "acFGSqPKTBDR2u47Gb3mvgAAAUE"]
[Mon Mar 23 21:55:23.493701 2026] [:error] [pid 38177:tid 38235] [client 20.215.241.7:47538] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "acFGS3sYW-_HCI66Mun4TgAAAFQ"]
[Mon Mar 23 21:55:24.042361 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:46834] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "acFGTHsYW-_HCI66Mun4UAAAAFE"]
[Mon Mar 23 21:55:24.631121 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:4441] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "acFGTDkL8qwu-hHc6BisBwAAARE"]
[Mon Mar 23 21:55:25.257174 2026] [:error] [pid 38177:tid 38220] [client 20.215.241.7:46320] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acFGTXsYW-_HCI66Mun4VAAAAEU"]
[Mon Mar 23 21:55:25.800367 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:50553] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acFGTTkL8qwu-hHc6BisCgAAAQo"]
[Mon Mar 23 21:55:26.353360 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:47441] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acFGTnsYW-_HCI66Mun4WQAAAEs"]
[Mon Mar 23 21:55:26.917902 2026] [:error] [pid 38276:tid 38296] [client 20.215.241.7:47447] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acFGTpoKGiI-a7oME3L_NwAAANE"]
[Mon Mar 23 21:55:27.486724 2026] [:error] [pid 38276:tid 38286] [client 20.215.241.7:4350] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acFGT5oKGiI-a7oME3L_OAAAAMc"]
[Mon Mar 23 21:55:28.043079 2026] [:error] [pid 52341:tid 52363] [client 20.215.241.7:4186] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acFGUKPKTBDR2u47Gb3myQAAAVQ"]
[Mon Mar 23 21:55:28.588436 2026] [:error] [pid 52341:tid 52366] [client 20.215.241.7:47482] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acFGUKPKTBDR2u47Gb3mywAAAVc"]
[Mon Mar 23 21:55:29.176132 2026] [:error] [pid 38176:tid 38193] [client 20.215.241.7:52365] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acFGUUtG4qlh1gvNjuJFyQAAAAY"]
[Mon Mar 23 21:55:29.734981 2026] [:error] [pid 38177:tid 38227] [client 20.215.241.7:4295] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acFGUXsYW-_HCI66Mun4WgAAAEw"]
[Mon Mar 23 21:55:30.295059 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:50600] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acFGUjkL8qwu-hHc6BisEgAAAQw"]
[Mon Mar 23 21:55:30.854474 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:50538] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acFGUnsYW-_HCI66Mun4WwAAAFY"]
[Mon Mar 23 21:55:31.422741 2026] [:error] [pid 52341:tid 52345] [client 20.215.241.7:34564] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acFGU6PKTBDR2u47Gb3m0QAAAUI"]
[Mon Mar 23 21:55:32.026383 2026] [:error] [pid 38306:tid 38332] [client 20.215.241.7:52408] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "acFGVDkL8qwu-hHc6BisFQAAARg"]
[Mon Mar 23 21:55:32.632852 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:47472] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "acFGVHsYW-_HCI66Mun4XQAAAFE"]
[Mon Mar 23 21:55:33.238001 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:4323] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "acFGVaPKTBDR2u47Gb3m1QAAAUA"]
[Mon Mar 23 21:55:33.834680 2026] [:error] [pid 38306:tid 38331] [client 20.215.241.7:46291] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "acFGVTkL8qwu-hHc6BisHAAAARc"]
[Mon Mar 23 21:55:34.444666 2026] [:error] [pid 38176:tid 38197] [client 20.215.241.7:47497] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acFGVktG4qlh1gvNjuJFzAAAAAo"]
[Mon Mar 23 21:55:35.004307 2026] [:error] [pid 38178:tid 38262] [client 20.215.241.7:4294] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acFGVw0axWfXsVvR9udH4QAAAJQ"]
[Mon Mar 23 21:55:35.548831 2026] [:error] [pid 52341:tid 52348] [client 20.215.241.7:4331] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acFGV6PKTBDR2u47Gb3m4AAAAUU"]
[Mon Mar 23 21:55:36.145349 2026] [:error] [pid 52341:tid 52355] [client 20.215.241.7:52413] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acFGWKPKTBDR2u47Gb3m4gAAAUw"]
[Mon Mar 23 21:55:36.752339 2026] [:error] [pid 38177:tid 38220] [client 20.215.241.7:46292] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acFGWHsYW-_HCI66Mun4YQAAAEU"]
[Mon Mar 23 21:55:37.304983 2026] [:error] [pid 38178:tid 38245] [client 20.215.241.7:47536] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acFGWQ0axWfXsVvR9udH6AAAAIM"]
[Mon Mar 23 21:55:37.865494 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:47484] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acFGWQ0axWfXsVvR9udH6wAAAJE"]
[Mon Mar 23 21:55:38.440266 2026] [:error] [pid 38176:tid 38192] [client 20.215.241.7:48128] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acFGWktG4qlh1gvNjuJF1AAAAAU"]
[Mon Mar 23 21:55:39.070576 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:52402] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acFGW0tG4qlh1gvNjuJF1QAAAAg"]
[Mon Mar 23 21:55:39.631846 2026] [:error] [pid 38306:tid 38314] [client 20.215.241.7:4427] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acFGWzkL8qwu-hHc6BisKAAAAQY"]
[Mon Mar 23 21:55:40.229526 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:4429] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acFGXKPKTBDR2u47Gb3m5QAAAUA"]
[Mon Mar 23 21:55:40.796728 2026] [:error] [pid 38276:tid 38303] [client 20.215.241.7:40589] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acFGXJoKGiI-a7oME3L_PgAAANg"]
[Mon Mar 23 21:55:41.395951 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:47426] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acFGXTkL8qwu-hHc6BisKQAAARM"]
[Mon Mar 23 21:55:41.986522 2026] [:error] [pid 38306:tid 38331] [client 20.215.241.7:46806] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acFGXTkL8qwu-hHc6BisLAAAARc"]
[Mon Mar 23 21:55:42.524251 2026] [:error] [pid 52341:tid 52362] [client 20.215.241.7:47438] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acFGXqPKTBDR2u47Gb3m6AAAAVM"]
[Mon Mar 23 21:55:43.037790 2026] [:error] [pid 38276:tid 38294] [client 20.215.241.7:52367] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acFGX5oKGiI-a7oME3L_QAAAAM8"]
[Mon Mar 23 21:55:43.611930 2026] [:error] [pid 52341:tid 52353] [client 20.215.241.7:52391] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acFGX6PKTBDR2u47Gb3m6wAAAUo"]
[Mon Mar 23 21:55:44.184327 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:52414] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acFGYHsYW-_HCI66Mun4bgAAAFE"]
[Mon Mar 23 21:55:44.744362 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:50563] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acFGYDkL8qwu-hHc6BisMQAAAQw"]
[Mon Mar 23 21:55:45.295184 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:63649] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acFGYUtG4qlh1gvNjuJF3wAAABE"]
[Mon Mar 23 21:55:45.818455 2026] [:error] [pid 38177:tid 38221] [client 20.215.241.7:46820] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acFGYXsYW-_HCI66Mun4cQAAAEY"]
[Mon Mar 23 21:55:46.369736 2026] [:error] [pid 38276:tid 38291] [client 20.215.241.7:34581] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acFGYpoKGiI-a7oME3L_QwAAAMw"]
[Mon Mar 23 21:55:47.022039 2026] [:error] [pid 38177:tid 38218] [client 20.215.241.7:52406] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acFGY3sYW-_HCI66Mun4cwAAAEM"]
[Mon Mar 23 21:55:47.546905 2026] [:error] [pid 38177:tid 38233] [client 20.215.241.7:48162] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acFGY3sYW-_HCI66Mun4dQAAAFI"]
[Mon Mar 23 21:55:48.078703 2026] [:error] [pid 38176:tid 38193] [client 20.215.241.7:48137] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acFGZEtG4qlh1gvNjuJF5wAAAAY"]
[Mon Mar 23 21:55:48.611006 2026] [:error] [pid 52341:tid 52365] [client 20.215.241.7:48188] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acFGZKPKTBDR2u47Gb3m7QAAAVY"]
[Mon Mar 23 21:55:49.673617 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:46279] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acFGZTkL8qwu-hHc6BisNgAAAQA"]
[Mon Mar 23 21:55:50.206780 2026] [:error] [pid 52341:tid 52361] [client 20.215.241.7:4420] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acFGZqPKTBDR2u47Gb3m7wAAAVI"]
[Mon Mar 23 21:55:50.746392 2026] [:error] [pid 52341:tid 52352] [client 20.215.241.7:47476] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "acFGZqPKTBDR2u47Gb3m8AAAAUk"]
[Mon Mar 23 21:55:51.272711 2026] [:error] [pid 38176:tid 38200] [client 20.215.241.7:39617] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "acFGZ0tG4qlh1gvNjuJF6wAAAA0"]
[Mon Mar 23 21:55:51.819188 2026] [:error] [pid 38178:tid 38242] [client 20.215.241.7:48184] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "acFGZw0axWfXsVvR9udH-gAAAIA"]
[Mon Mar 23 21:55:52.334655 2026] [:error] [pid 38178:tid 38257] [client 20.215.241.7:4326] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "acFGaA0axWfXsVvR9udH_wAAAI8"]
[Mon Mar 23 21:55:52.851807 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:50587] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acFGaEtG4qlh1gvNjuJF7wAAABc"]
[Mon Mar 23 21:55:53.381743 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:46792] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acFGaTkL8qwu-hHc6BisPAAAAQ4"]
[Mon Mar 23 21:55:53.914497 2026] [:error] [pid 52341:tid 52363] [client 20.215.241.7:5101] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acFGaaPKTBDR2u47Gb3m9QAAAVQ"]
[Mon Mar 23 21:55:54.465664 2026] [proxy_fcgi:error] [pid 52341:tid 52355] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:54.726357 2026] [proxy_fcgi:error] [pid 52341:tid 52354] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:54.986565 2026] [proxy_fcgi:error] [pid 52341:tid 52366] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:55.251510 2026] [proxy_fcgi:error] [pid 52341:tid 52356] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:55.775618 2026] [proxy_fcgi:error] [pid 52341:tid 52347] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:56.041711 2026] [proxy_fcgi:error] [pid 52341:tid 52365] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:56.302144 2026] [proxy_fcgi:error] [pid 52341:tid 52364] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:56.562486 2026] [proxy_fcgi:error] [pid 52341:tid 52361] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:56.822629 2026] [proxy_fcgi:error] [pid 52341:tid 52350] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:57.085009 2026] [proxy_fcgi:error] [pid 52341:tid 52349] [client 20.215.241.7:50521] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:55:57.345501 2026] [:error] [pid 52341:tid 52345] [client 20.215.241.7:50521] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acFGbaPKTBDR2u47Gb3nCgAAAUI"]
[Mon Mar 23 21:55:57.881865 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:47434] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acFGbUtG4qlh1gvNjuJF9gAAAAQ"]
[Mon Mar 23 21:55:58.407568 2026] [:error] [pid 38176:tid 38187] [client 20.215.241.7:39651] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acFGbktG4qlh1gvNjuJF9wAAAAA"]
[Mon Mar 23 21:55:58.954849 2026] [:error] [pid 52341:tid 52366] [client 20.215.241.7:5077] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acFGbqPKTBDR2u47Gb3nDAAAAVc"]
[Mon Mar 23 21:55:59.497375 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:38872] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acFGb6PKTBDR2u47Gb3nEAAAAVA"]
[Mon Mar 23 21:56:00.017025 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:38869] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acFGcEtG4qlh1gvNjuJF-AAAAAs"]
[Mon Mar 23 21:56:00.533804 2026] [:error] [pid 52341:tid 52348] [client 20.215.241.7:47540] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acFGcKPKTBDR2u47Gb3nFgAAAUU"]
[Mon Mar 23 21:56:01.044581 2026] [:error] [pid 52341:tid 52363] [client 20.215.241.7:52369] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acFGcaPKTBDR2u47Gb3nGAAAAVQ"]
[Mon Mar 23 21:56:01.567609 2026] [:error] [pid 52341:tid 52355] [client 20.215.241.7:4342] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acFGcaPKTBDR2u47Gb3nHQAAAUw"]
[Mon Mar 23 21:56:02.083129 2026] [:error] [pid 38276:tid 38281] [client 20.215.241.7:46329] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acFGcpoKGiI-a7oME3L_TgAAAMI"]
[Mon Mar 23 21:56:02.615082 2026] [:error] [pid 52341:tid 52360] [client 20.215.241.7:52361] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acFGcqPKTBDR2u47Gb3nIAAAAVE"]
[Mon Mar 23 21:56:03.147013 2026] [:error] [pid 52341:tid 52357] [client 20.215.241.7:38867] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acFGc6PKTBDR2u47Gb3nIgAAAU4"]
[Mon Mar 23 21:56:03.657468 2026] [:error] [pid 52341:tid 52346] [client 20.215.241.7:4458] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acFGc6PKTBDR2u47Gb3nKQAAAUM"]
[Mon Mar 23 21:56:04.178068 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:47467] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acFGdHsYW-_HCI66Mun4fAAAAEs"]
[Mon Mar 23 21:56:04.715925 2026] [:error] [pid 52341:tid 52347] [client 20.215.241.7:50535] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acFGdKPKTBDR2u47Gb3nMwAAAUQ"]
[Mon Mar 23 21:56:05.237997 2026] [:error] [pid 52341:tid 52363] [client 20.215.241.7:50559] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acFGdaPKTBDR2u47Gb3nNwAAAVQ"]
[Mon Mar 23 21:56:05.784033 2026] [:error] [pid 52341:tid 52354] [client 20.215.241.7:38902] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acFGdaPKTBDR2u47Gb3nOgAAAUs"]
[Mon Mar 23 21:56:06.323339 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:46319] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acFGdqPKTBDR2u47Gb3nPAAAAVA"]
[Mon Mar 23 21:56:06.862403 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:46838] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acFGdjkL8qwu-hHc6BisRQAAAQo"]
[Mon Mar 23 21:56:07.419051 2026] [:error] [pid 52341:tid 52346] [client 20.215.241.7:52390] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acFGd6PKTBDR2u47Gb3nRAAAAUM"]
[Mon Mar 23 21:56:07.978911 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:50534] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acFGd6PKTBDR2u47Gb3nRwAAAVA"]
[Mon Mar 23 21:56:08.538398 2026] [:error] [pid 38306:tid 38331] [client 20.215.241.7:51878] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acFGeDkL8qwu-hHc6BisSQAAARc"]
[Mon Mar 23 21:56:09.049652 2026] [:error] [pid 38276:tid 38288] [client 20.215.241.7:50556] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acFGeZoKGiI-a7oME3L_UAAAAMk"]
[Mon Mar 23 21:56:09.589923 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:48175] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acFGeTkL8qwu-hHc6BisTgAAAQw"]
[Mon Mar 23 21:56:10.115149 2026] [:error] [pid 38306:tid 38323] [client 20.215.241.7:63644] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acFGejkL8qwu-hHc6BisUAAAAQ8"]
[Mon Mar 23 21:56:10.763004 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:40620] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acFGejkL8qwu-hHc6BisUgAAARE"]
[Mon Mar 23 21:56:11.367860 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:4312] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acFGezkL8qwu-hHc6BisVQAAAQo"]
[Mon Mar 23 21:56:12.289508 2026] [:error] [pid 38276:tid 38279] [client 20.215.241.7:47534] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acFGfJoKGiI-a7oME3L_VAAAAMA"]
[Mon Mar 23 21:56:12.886294 2026] [:error] [pid 38178:tid 38250] [client 20.215.241.7:50526] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acFGfA0axWfXsVvR9udIJgAAAIg"]
[Mon Mar 23 21:56:13.449127 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:46831] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acFGfTkL8qwu-hHc6BisWwAAARM"]
[Mon Mar 23 21:56:14.032531 2026] [:error] [pid 52341:tid 52361] [client 20.215.241.7:47514] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acFGfqPKTBDR2u47Gb3nSwAAAVI"]
[Mon Mar 23 21:56:14.647525 2026] [:error] [pid 38176:tid 38189] [client 20.215.241.7:39656] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acFGfktG4qlh1gvNjuJF_AAAAAI"]
[Mon Mar 23 21:56:15.362359 2026] [:error] [pid 38176:tid 38207] [client 20.215.241.7:39636] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acFGf0tG4qlh1gvNjuJF_wAAABQ"]
[Mon Mar 23 21:56:15.911182 2026] [:error] [pid 38176:tid 38209] [client 20.215.241.7:47445] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acFGf0tG4qlh1gvNjuJGAQAAABY"]
[Mon Mar 23 21:56:16.532671 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:38857] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acFGgKPKTBDR2u47Gb3nUgAAAVA"]
[Mon Mar 23 21:56:17.117632 2026] [:error] [pid 38177:tid 38229] [client 20.215.241.7:47443] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acFGgXsYW-_HCI66Mun4hAAAAE4"]
[Mon Mar 23 21:56:17.774905 2026] [:error] [pid 38176:tid 38197] [client 20.215.241.7:38851] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acFGgUtG4qlh1gvNjuJGAwAAAAo"]
[Mon Mar 23 21:56:18.351248 2026] [:error] [pid 52341:tid 52346] [client 20.215.241.7:5078] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acFGgqPKTBDR2u47Gb3nWwAAAUM"]
[Mon Mar 23 21:56:18.957977 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:37161] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acFGgktG4qlh1gvNjuJGBAAAABg"]
[Mon Mar 23 21:56:19.684053 2026] [:error] [pid 38176:tid 38201] [client 20.215.241.7:48189] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acFGg0tG4qlh1gvNjuJGBgAAAA4"]
[Mon Mar 23 21:56:20.242144 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:5091] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acFGhEtG4qlh1gvNjuJGCQAAABE"]
[Mon Mar 23 21:56:20.873793 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:46316] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acFGhKPKTBDR2u47Gb3nYQAAAVA"]
[Mon Mar 23 21:56:21.398381 2026] [:error] [pid 38176:tid 38193] [client 20.215.241.7:37144] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acFGhUtG4qlh1gvNjuJGDAAAAAY"]
[Mon Mar 23 21:56:22.030738 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:51891] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acFGhktG4qlh1gvNjuJGDgAAAAw"]
[Mon Mar 23 21:56:23.205600 2026] [:error] [pid 38178:tid 38254] [client 20.215.241.7:46273] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acFGhw0axWfXsVvR9udILQAAAIw"]
[Mon Mar 23 21:56:23.785223 2026] [:error] [pid 38176:tid 38192] [client 20.215.241.7:5114] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acFGh0tG4qlh1gvNjuJGFAAAAAU"]
[Mon Mar 23 21:56:24.380085 2026] [:error] [pid 38306:tid 38309] [client 20.215.241.7:38905] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acFGiDkL8qwu-hHc6BisYgAAAQE"]
[Mon Mar 23 21:56:24.950438 2026] [:error] [pid 52341:tid 52358] [client 20.215.241.7:47473] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acFGiKPKTBDR2u47Gb3nZQAAAU8"]
[Mon Mar 23 21:56:25.560766 2026] [:error] [pid 52341:tid 52367] [client 20.215.241.7:48174] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acFGiaPKTBDR2u47Gb3nZwAAAVg"]
[Mon Mar 23 21:56:26.314984 2026] [:error] [pid 38276:tid 38297] [client 20.215.241.7:51860] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acFGipoKGiI-a7oME3L_XAAAANI"]
[Mon Mar 23 21:56:27.110420 2026] [:error] [pid 38276:tid 38295] [client 20.215.241.7:5067] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acFGi5oKGiI-a7oME3L_XQAAANA"]
[Mon Mar 23 21:56:28.138841 2026] [:error] [pid 38276:tid 38287] [client 20.215.241.7:51840] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acFGjJoKGiI-a7oME3L_YAAAAMg"]
[Mon Mar 23 21:56:28.857518 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:5119] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acFGjEtG4qlh1gvNjuJGGAAAABI"]
[Mon Mar 23 21:56:29.639517 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:4291] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acFGjTkL8qwu-hHc6BisbQAAARM"]
[Mon Mar 23 21:56:30.438456 2026] [:error] [pid 38306:tid 38328] [client 20.215.241.7:47428] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acFGjjkL8qwu-hHc6BisbgAAARQ"]
[Mon Mar 23 21:56:31.053924 2026] [:error] [pid 52341:tid 52345] [client 20.215.241.7:61611] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acFGj6PKTBDR2u47Gb3nbAAAAUI"]
[Mon Mar 23 21:56:31.608167 2026] [:error] [pid 38306:tid 38311] [client 20.215.241.7:5081] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acFGjzkL8qwu-hHc6BisbwAAAQM"]
[Mon Mar 23 21:56:32.417069 2026] [:error] [pid 38306:tid 38322] [client 20.215.241.7:62087] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acFGkDkL8qwu-hHc6BisdAAAAQ4"]
[Mon Mar 23 21:56:32.995548 2026] [:error] [pid 38177:tid 38231] [client 20.215.241.7:63700] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acFGkHsYW-_HCI66Mun4jAAAAFA"]
[Mon Mar 23 21:56:33.722048 2026] [:error] [pid 38306:tid 38315] [client 20.215.241.7:4948] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acFGkTkL8qwu-hHc6BiseAAAAQc"]
[Mon Mar 23 21:56:34.283335 2026] [:error] [pid 38276:tid 38302] [client 20.215.241.7:4935] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acFGkpoKGiI-a7oME3L_bAAAANc"]
[Mon Mar 23 21:56:34.949639 2026] [:error] [pid 38178:tid 38262] [client 20.215.241.7:44061] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acFGkg0axWfXsVvR9udIMAAAAJQ"]
[Mon Mar 23 21:56:35.685292 2026] [:error] [pid 38276:tid 38295] [client 20.215.241.7:63194] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acFGk5oKGiI-a7oME3L_bgAAANA"]
[Mon Mar 23 21:56:36.261952 2026] [:error] [pid 38276:tid 38285] [client 20.215.241.7:49354] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acFGlJoKGiI-a7oME3L_bwAAAMY"]
[Mon Mar 23 21:56:36.882386 2026] [:error] [pid 52341:tid 52347] [client 20.215.241.7:63721] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acFGlKPKTBDR2u47Gb3nggAAAUQ"]
[Mon Mar 23 21:56:37.492536 2026] [:error] [pid 52341:tid 52357] [client 20.215.241.7:49367] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acFGlaPKTBDR2u47Gb3nhgAAAU4"]
[Mon Mar 23 21:56:38.044100 2026] [:error] [pid 38178:tid 38266] [client 20.215.241.7:44088] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acFGlg0axWfXsVvR9udIMQAAAJg"]
[Mon Mar 23 21:56:38.648480 2026] [:error] [pid 52341:tid 52351] [client 20.215.241.7:34039] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acFGlqPKTBDR2u47Gb3njAAAAUg"]
[Mon Mar 23 21:56:39.399343 2026] [:error] [pid 52341:tid 52366] [client 20.215.241.7:35844] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acFGl6PKTBDR2u47Gb3nkQAAAVc"]
[Mon Mar 23 21:56:40.100110 2026] [:error] [pid 38178:tid 38247] [client 20.215.241.7:4985] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acFGmA0axWfXsVvR9udINAAAAIU"]
[Mon Mar 23 21:56:40.632544 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:34684] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acFGmHsYW-_HCI66Mun4kwAAAFE"]
[Mon Mar 23 21:56:41.279741 2026] [:error] [pid 52341:tid 52361] [client 20.215.241.7:63183] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acFGmaPKTBDR2u47Gb3nlQAAAVI"]
[Mon Mar 23 21:56:41.974776 2026] [:error] [pid 38177:tid 38236] [client 20.215.241.7:34675] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acFGmXsYW-_HCI66Mun4lQAAAFU"]
[Mon Mar 23 21:56:42.574207 2026] [:error] [pid 38178:tid 38251] [client 20.215.241.7:31605] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acFGmg0axWfXsVvR9udINwAAAIk"]
[Mon Mar 23 21:56:43.142607 2026] [:error] [pid 38178:tid 38263] [client 20.215.241.7:53659] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acFGmw0axWfXsVvR9udIOgAAAJU"]
[Mon Mar 23 21:56:43.903055 2026] [:error] [pid 52341:tid 52351] [client 20.215.241.7:49383] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acFGm6PKTBDR2u47Gb3nmQAAAUg"]
[Mon Mar 23 21:56:44.635543 2026] [:error] [pid 52341:tid 52367] [client 20.215.241.7:63121] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acFGnKPKTBDR2u47Gb3nmgAAAVg"]
[Mon Mar 23 21:56:45.284819 2026] [:error] [pid 38178:tid 38261] [client 20.215.241.7:63126] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acFGnQ0axWfXsVvR9udIPAAAAJM"]
[Mon Mar 23 21:56:45.881034 2026] [:error] [pid 38178:tid 38245] [client 20.215.241.7:35842] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acFGnQ0axWfXsVvR9udIPQAAAIM"]
[Mon Mar 23 21:56:46.592299 2026] [:error] [pid 52341:tid 52353] [client 20.215.241.7:35886] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acFGnqPKTBDR2u47Gb3nnwAAAUo"]
[Mon Mar 23 21:56:47.183895 2026] [:error] [pid 38306:tid 38321] [client 20.215.241.7:63138] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acFGnzkL8qwu-hHc6BisjAAAAQ0"]
[Mon Mar 23 21:56:47.887739 2026] [:error] [pid 38176:tid 38203] [client 20.215.241.7:30877] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acFGn0tG4qlh1gvNjuJGLQAAABA"]
[Mon Mar 23 21:56:48.542561 2026] [:error] [pid 38306:tid 38309] [client 20.215.241.7:54397] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acFGoDkL8qwu-hHc6BisjQAAAQE"]
[Mon Mar 23 21:56:49.104800 2026] [:error] [pid 52341:tid 52357] [client 20.215.241.7:60608] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acFGoaPKTBDR2u47Gb3npQAAAU4"]
[Mon Mar 23 21:56:49.693462 2026] [:error] [pid 52341:tid 52363] [client 20.215.241.7:4533] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acFGoaPKTBDR2u47Gb3nqwAAAVQ"]
[Mon Mar 23 21:56:50.490520 2026] [:error] [pid 38176:tid 38202] [client 20.215.241.7:48780] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acFGoktG4qlh1gvNjuJGMAAAAA8"]
[Mon Mar 23 21:56:51.084829 2026] [:error] [pid 52341:tid 52358] [client 20.215.241.7:4839] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acFGo6PKTBDR2u47Gb3nrQAAAU8"]
[Mon Mar 23 21:56:51.627460 2026] [:error] [pid 52341:tid 52365] [client 20.215.241.7:4482] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acFGo6PKTBDR2u47Gb3nrgAAAVY"]
[Mon Mar 23 21:56:52.319859 2026] [:error] [pid 38306:tid 38325] [client 20.215.241.7:38292] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acFGpDkL8qwu-hHc6BislAAAARE"]
[Mon Mar 23 21:56:52.920524 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:49449] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acFGpDkL8qwu-hHc6BislwAAAQA"]
[Mon Mar 23 21:56:53.458931 2026] [:error] [pid 38306:tid 38320] [client 20.215.241.7:60620] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acFGpTkL8qwu-hHc6BismgAAAQw"]
[Mon Mar 23 21:56:54.124968 2026] [:error] [pid 38306:tid 38309] [client 20.215.241.7:31596] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acFGpjkL8qwu-hHc6BisngAAAQE"]
[Mon Mar 23 21:56:54.716142 2026] [:error] [pid 38177:tid 38220] [client 20.215.241.7:49357] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acFGpnsYW-_HCI66Mun4mQAAAEU"]
[Mon Mar 23 21:56:55.426070 2026] [:error] [pid 38178:tid 38254] [client 20.215.241.7:63111] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acFGpw0axWfXsVvR9udIQwAAAIw"]
[Mon Mar 23 21:56:56.033447 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:63112] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acFGqKPKTBDR2u47Gb3ntAAAAVA"]
[Mon Mar 23 21:56:56.788710 2026] [:error] [pid 38176:tid 38199] [client 20.215.241.7:49398] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acFGqEtG4qlh1gvNjuJGMwAAAAw"]
[Mon Mar 23 21:56:57.477148 2026] [proxy_fcgi:error] [pid 52341:tid 52357] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:57.741015 2026] [proxy_fcgi:error] [pid 52341:tid 52356] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:58.001738 2026] [proxy_fcgi:error] [pid 52341:tid 52362] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:58.261168 2026] [proxy_fcgi:error] [pid 52341:tid 52354] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:58.519776 2026] [proxy_fcgi:error] [pid 52341:tid 52360] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:58.781765 2026] [proxy_fcgi:error] [pid 52341:tid 52349] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:59.045968 2026] [proxy_fcgi:error] [pid 52341:tid 52363] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:59.313037 2026] [proxy_fcgi:error] [pid 52341:tid 52351] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:59.579569 2026] [proxy_fcgi:error] [pid 52341:tid 52367] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:56:59.838643 2026] [proxy_fcgi:error] [pid 52341:tid 52358] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:57:00.100570 2026] [proxy_fcgi:error] [pid 52341:tid 52345] [client 20.215.241.7:31552] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:57:00.355695 2026] [:error] [pid 52341:tid 52352] [client 20.215.241.7:31552] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "acFGrKPKTBDR2u47Gb3nxQAAAUk"]
[Mon Mar 23 21:57:00.928617 2026] [:error] [pid 38178:tid 38262] [client 20.215.241.7:4954] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "acFGrA0axWfXsVvR9udIRwAAAJQ"]
[Mon Mar 23 21:57:01.611143 2026] [:error] [pid 38306:tid 38326] [client 20.215.241.7:63185] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "acFGrTkL8qwu-hHc6BispAAAARI"]
[Mon Mar 23 21:57:02.265490 2026] [:error] [pid 52341:tid 52365] [client 20.215.241.7:34011] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "acFGrqPKTBDR2u47Gb3nyAAAAVY"]
[Mon Mar 23 21:57:02.999380 2026] [:error] [pid 52341:tid 52344] [client 20.215.241.7:4964] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acFGrqPKTBDR2u47Gb3nywAAAUE"]
[Mon Mar 23 21:57:03.665543 2026] [:error] [pid 38276:tid 38283] [client 20.215.241.7:58250] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acFGr5oKGiI-a7oME3L_eQAAAMQ"]
[Mon Mar 23 21:57:04.247138 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:58252] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acFGsEtG4qlh1gvNjuJGPgAAABI"]
[Mon Mar 23 21:57:04.866603 2026] [:error] [pid 38176:tid 38202] [client 20.215.241.7:58288] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acFGsEtG4qlh1gvNjuJGQAAAAA8"]
[Mon Mar 23 21:57:05.483019 2026] [:error] [pid 38306:tid 38308] [client 20.215.241.7:35848] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acFGsTkL8qwu-hHc6BispwAAAQA"]
[Mon Mar 23 21:57:06.135194 2026] [:error] [pid 38306:tid 38311] [client 20.215.241.7:49375] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acFGsjkL8qwu-hHc6BisqAAAAQM"]
[Mon Mar 23 21:57:06.728641 2026] [:error] [pid 38306:tid 38329] [client 20.215.241.7:35865] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acFGsjkL8qwu-hHc6BisqQAAARU"]
[Mon Mar 23 21:57:07.388816 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:58273] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acFGs0tG4qlh1gvNjuJGRQAAABE"]
[Mon Mar 23 21:57:07.968559 2026] [:error] [pid 38177:tid 38232] [client 20.215.241.7:62104] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acFGs3sYW-_HCI66Mun4pQAAAFE"]
[Mon Mar 23 21:57:08.512372 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:49381] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acFGtKPKTBDR2u47Gb3n4AAAAVA"]
[Mon Mar 23 21:57:09.131227 2026] [:error] [pid 52341:tid 52356] [client 20.215.241.7:44046] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acFGtaPKTBDR2u47Gb3n4QAAAU0"]
[Mon Mar 23 21:57:09.707953 2026] [:error] [pid 38177:tid 38236] [client 20.215.241.7:31595] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acFGtXsYW-_HCI66Mun4pwAAAFU"]
[Mon Mar 23 21:57:10.246193 2026] [:error] [pid 38276:tid 38293] [client 20.215.241.7:58299] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acFGtpoKGiI-a7oME3L_fAAAAM4"]
[Mon Mar 23 21:57:10.940119 2026] [:error] [pid 38276:tid 38284] [client 20.215.241.7:62099] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acFGtpoKGiI-a7oME3L_fgAAAMU"]
[Mon Mar 23 21:57:11.630734 2026] [:error] [pid 38276:tid 38285] [client 20.215.241.7:63176] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acFGt5oKGiI-a7oME3L_fwAAAMY"]
[Mon Mar 23 21:57:12.271404 2026] [:error] [pid 38178:tid 38254] [client 20.215.241.7:31589] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acFGuA0axWfXsVvR9udIUgAAAIw"]
[Mon Mar 23 21:57:12.938077 2026] [:error] [pid 38276:tid 38298] [client 20.215.241.7:31573] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acFGuJoKGiI-a7oME3L_gQAAANM"]
[Mon Mar 23 21:57:13.583011 2026] [:error] [pid 38276:tid 38299] [client 20.215.241.7:60084] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acFGuZoKGiI-a7oME3L_gwAAANQ"]
[Mon Mar 23 21:57:14.214281 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:49360] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acFGuktG4qlh1gvNjuJGTAAAABI"]
[Mon Mar 23 21:57:14.857960 2026] [:error] [pid 52341:tid 52344] [client 20.215.241.7:31589] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acFGuqPKTBDR2u47Gb3n7gAAAUE"]
[Mon Mar 23 21:57:15.636827 2026] [:error] [pid 38176:tid 38196] [client 20.215.241.7:4953] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acFGu0tG4qlh1gvNjuJGUAAAAAk"]
[Mon Mar 23 21:57:16.195852 2026] [:error] [pid 38178:tid 38255] [client 20.215.241.7:60063] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acFGvA0axWfXsVvR9udIWwAAAI0"]
[Mon Mar 23 21:57:16.779419 2026] [:error] [pid 52341:tid 52359] [client 20.215.241.7:4938] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acFGvKPKTBDR2u47Gb3oAAAAAVA"]
[Mon Mar 23 21:57:17.425419 2026] [:error] [pid 52341:tid 52367] [client 20.215.241.7:63133] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acFGvaPKTBDR2u47Gb3oAQAAAVg"]
[Mon Mar 23 21:57:17.986774 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:53683] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acFGvZoKGiI-a7oME3L_hgAAAMs"]
[Mon Mar 23 21:57:18.641163 2026] [:error] [pid 38176:tid 38208] [client 20.215.241.7:60055] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acFGvktG4qlh1gvNjuJGVAAAABU"]
[Mon Mar 23 21:57:19.350168 2026] [:error] [pid 52341:tid 52366] [client 20.215.241.7:44034] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acFGv6PKTBDR2u47Gb3oEwAAAVc"]
[Mon Mar 23 21:57:19.926902 2026] [:error] [pid 38177:tid 38229] [client 20.215.241.7:34029] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acFGv3sYW-_HCI66Mun4rQAAAE4"]
[Mon Mar 23 21:57:20.566662 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:31587] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acFGwEtG4qlh1gvNjuJGXAAAABg"]
[Mon Mar 23 21:57:21.194266 2026] [:error] [pid 52341:tid 52353] [client 20.215.241.7:31609] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acFGwaPKTBDR2u47Gb3oHgAAAUo"]
[Mon Mar 23 21:57:21.739694 2026] [:error] [pid 38177:tid 38230] [client 20.215.241.7:60040] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acFGwXsYW-_HCI66Mun4sQAAAE8"]
[Mon Mar 23 21:57:22.437449 2026] [:error] [pid 38306:tid 38323] [client 20.215.241.7:35212] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acFGwjkL8qwu-hHc6BisugAAAQ8"]
[Mon Mar 23 21:57:23.175495 2026] [:error] [pid 38176:tid 38210] [client 20.215.241.7:60073] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acFGw0tG4qlh1gvNjuJGZQAAABc"]
[Mon Mar 23 21:57:23.729544 2026] [:error] [pid 52341:tid 52367] [client 20.215.241.7:53650] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acFGw6PKTBDR2u47Gb3oJQAAAVg"]
[Mon Mar 23 21:57:24.354909 2026] [:error] [pid 38176:tid 38197] [client 20.215.241.7:4484] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acFGxEtG4qlh1gvNjuJGaQAAAAo"]
[Mon Mar 23 21:57:24.924391 2026] [:error] [pid 52341:tid 52348] [client 20.215.241.7:44045] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acFGxKPKTBDR2u47Gb3oJwAAAUU"]
[Mon Mar 23 21:57:25.570901 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:35211] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acFGxUtG4qlh1gvNjuJGbgAAABg"]
[Mon Mar 23 21:57:26.147289 2026] [:error] [pid 38176:tid 38204] [client 20.215.241.7:4990] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acFGxktG4qlh1gvNjuJGcAAAABE"]
[Mon Mar 23 21:57:26.669101 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:31614] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acFGxqPKTBDR2u47Gb3oKgAAAUA"]
[Mon Mar 23 21:57:27.206626 2026] [:error] [pid 52341:tid 52351] [client 20.215.241.7:44041] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acFGx6PKTBDR2u47Gb3oLgAAAUg"]
[Mon Mar 23 21:57:27.912050 2026] [:error] [pid 38276:tid 38282] [client 20.215.241.7:31604] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acFGx5oKGiI-a7oME3L_jQAAAMM"]
[Mon Mar 23 21:57:28.432004 2026] [:error] [pid 52341:tid 52367] [client 20.215.241.7:31565] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acFGyKPKTBDR2u47Gb3oNAAAAVg"]
[Mon Mar 23 21:57:28.972244 2026] [:error] [pid 38177:tid 38220] [client 20.215.241.7:60086] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acFGyHsYW-_HCI66Mun4uwAAAEU"]
[Mon Mar 23 21:57:29.618827 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:53667] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acFGyQ0axWfXsVvR9udIbQAAAJE"]
[Mon Mar 23 21:57:30.209811 2026] [:error] [pid 38178:tid 38262] [client 20.215.241.7:53669] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acFGyg0axWfXsVvR9udIbgAAAJQ"]
[Mon Mar 23 21:57:30.737444 2026] [:error] [pid 38176:tid 38211] [client 20.215.241.7:63222] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acFGyktG4qlh1gvNjuJGewAAABg"]
[Mon Mar 23 21:57:31.398174 2026] [:error] [pid 52341:tid 52351] [client 20.215.241.7:34004] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acFGy6PKTBDR2u47Gb3oPgAAAUg"]
[Mon Mar 23 21:57:32.015652 2026] [:error] [pid 52341:tid 52364] [client 20.215.241.7:34025] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acFGzKPKTBDR2u47Gb3oQgAAAVU"]
[Mon Mar 23 21:57:32.752317 2026] [:error] [pid 52341:tid 52354] [client 20.215.241.7:63202] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "acFGzKPKTBDR2u47Gb3oRAAAAUs"]
[Mon Mar 23 21:57:33.426812 2026] [:error] [pid 38306:tid 38317] [client 20.215.241.7:31608] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "acFGzTkL8qwu-hHc6BisyAAAAQk"]
[Mon Mar 23 21:57:33.952632 2026] [:error] [pid 52341:tid 52362] [client 20.215.241.7:35217] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "acFGzaPKTBDR2u47Gb3oSAAAAVM"]
[Mon Mar 23 21:57:34.559158 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:4963] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/save.php"] [unique_id "acFGzqPKTBDR2u47Gb3oUAAAAUA"]
[Mon Mar 23 21:57:35.165899 2026] [:error] [pid 52341:tid 52345] [client 20.215.241.7:4987] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acFGz6PKTBDR2u47Gb3oUgAAAUI"]
[Mon Mar 23 21:57:35.706577 2026] [:error] [pid 38178:tid 38254] [client 20.215.241.7:63223] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acFGzw0axWfXsVvR9udIeQAAAIw"]
[Mon Mar 23 21:57:36.251778 2026] [:error] [pid 38178:tid 38259] [client 20.215.241.7:63187] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acFG0A0axWfXsVvR9udIfAAAAJE"]
[Mon Mar 23 21:57:36.836207 2026] [:error] [pid 52341:tid 52355] [client 20.215.241.7:31574] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acFG0KPKTBDR2u47Gb3oWAAAAUw"]
[Mon Mar 23 21:57:37.387397 2026] [:error] [pid 38178:tid 38244] [client 20.215.241.7:58300] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "acFG0Q0axWfXsVvR9udIfwAAAII"]
[Mon Mar 23 21:57:38.009003 2026] [:error] [pid 38178:tid 38256] [client 20.215.241.7:62110] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "acFG0g0axWfXsVvR9udIgAAAAI4"]
[Mon Mar 23 21:57:38.626187 2026] [:error] [pid 38176:tid 38198] [client 20.215.241.7:31600] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "acFG0ktG4qlh1gvNjuJGhQAAAAs"]
[Mon Mar 23 21:57:39.150123 2026] [:error] [pid 38276:tid 38300] [client 20.215.241.7:34031] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roter.php"] [unique_id "acFG05oKGiI-a7oME3L_nQAAANU"]
[Mon Mar 23 21:57:39.715185 2026] [:error] [pid 52341:tid 52358] [client 20.215.241.7:58276] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acFG06PKTBDR2u47Gb3oWgAAAU8"]
[Mon Mar 23 21:57:40.379119 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:63110] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acFG1EtG4qlh1gvNjuJGiQAAABI"]
[Mon Mar 23 21:57:40.960262 2026] [:error] [pid 38177:tid 38237] [client 20.215.241.7:63219] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acFG1HsYW-_HCI66Mun4xQAAAFY"]
[Mon Mar 23 21:57:41.607048 2026] [:error] [pid 52341:tid 52346] [client 20.215.241.7:62091] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acFG1aPKTBDR2u47Gb3oYQAAAUM"]
[Mon Mar 23 21:57:42.259201 2026] [:error] [pid 38176:tid 38194] [client 20.215.241.7:63106] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acFG1ktG4qlh1gvNjuJGjgAAAAc"]
[Mon Mar 23 21:57:42.911133 2026] [:error] [pid 38177:tid 38215] [client 20.215.241.7:31588] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acFG1nsYW-_HCI66Mun4xgAAAEA"]
[Mon Mar 23 21:57:43.703852 2026] [:error] [pid 38178:tid 38257] [client 20.215.241.7:44072] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acFG1w0axWfXsVvR9udIiwAAAI8"]
[Mon Mar 23 21:57:44.656630 2026] [:error] [pid 38178:tid 38261] [client 20.215.241.7:60065] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acFG2A0axWfXsVvR9udIjQAAAJM"]
[Mon Mar 23 21:57:45.208536 2026] [:error] [pid 38276:tid 38285] [client 20.215.241.7:63211] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acFG2ZoKGiI-a7oME3L_pgAAAMY"]
[Mon Mar 23 21:57:45.860969 2026] [:error] [pid 38176:tid 38203] [client 20.215.241.7:44059] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acFG2UtG4qlh1gvNjuJGkQAAABA"]
[Mon Mar 23 21:57:46.456026 2026] [:error] [pid 52341:tid 52361] [client 20.215.241.7:53660] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acFG2qPKTBDR2u47Gb3oaAAAAVI"]
[Mon Mar 23 21:57:47.041507 2026] [:error] [pid 38176:tid 38201] [client 20.215.241.7:44092] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acFG20tG4qlh1gvNjuJGlQAAAA4"]
[Mon Mar 23 21:57:47.670450 2026] [:error] [pid 38177:tid 38226] [client 20.215.241.7:60071] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acFG23sYW-_HCI66Mun40QAAAEs"]
[Mon Mar 23 21:57:48.257214 2026] [:error] [pid 52341:tid 52362] [client 20.215.241.7:33986] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acFG3KPKTBDR2u47Gb3oagAAAVM"]
[Mon Mar 23 21:57:48.820035 2026] [:error] [pid 38276:tid 38280] [client 20.215.241.7:34012] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acFG3JoKGiI-a7oME3L_rAAAAME"]
[Mon Mar 23 21:57:49.469974 2026] [:error] [pid 38306:tid 38318] [client 20.215.241.7:34044] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acFG3TkL8qwu-hHc6BiszAAAAQo"]
[Mon Mar 23 21:57:50.052759 2026] [:error] [pid 38178:tid 38265] [client 20.215.241.7:35239] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acFG3g0axWfXsVvR9udInAAAAJc"]
[Mon Mar 23 21:57:50.733791 2026] [:error] [pid 52341:tid 52357] [client 20.215.241.7:62098] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acFG3qPKTBDR2u47Gb3obAAAAU4"]
[Mon Mar 23 21:57:51.333353 2026] [:error] [pid 52341:tid 52352] [client 20.215.241.7:49374] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acFG36PKTBDR2u47Gb3obQAAAUk"]
[Mon Mar 23 21:57:51.946221 2026] [:error] [pid 38176:tid 38195] [client 20.215.241.7:58274] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acFG30tG4qlh1gvNjuJGpgAAAAg"]
[Mon Mar 23 21:57:52.474624 2026] [:error] [pid 38178:tid 38244] [client 20.215.241.7:4952] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acFG4A0axWfXsVvR9udIqwAAAII"]
[Mon Mar 23 21:57:53.086098 2026] [:error] [pid 38276:tid 38290] [client 20.215.241.7:4946] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acFG4ZoKGiI-a7oME3L_rgAAAMs"]
[Mon Mar 23 21:57:53.722685 2026] [:error] [pid 52341:tid 52356] [client 20.215.241.7:63188] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acFG4aPKTBDR2u47Gb3ocQAAAU0"]
[Mon Mar 23 21:57:54.269911 2026] [:error] [pid 38306:tid 38317] [client 20.215.241.7:60051] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acFG4jkL8qwu-hHc6Bis8QAAAQk"]
[Mon Mar 23 21:57:54.907401 2026] [:error] [pid 38176:tid 38191] [client 20.215.241.7:60042] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acFG4ktG4qlh1gvNjuJGswAAAAQ"]
[Mon Mar 23 21:57:55.475043 2026] [:error] [pid 38178:tid 38248] [client 20.215.241.7:63227] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acFG4w0axWfXsVvR9udIsgAAAIY"]
[Mon Mar 23 21:57:56.014644 2026] [:error] [pid 52341:tid 52354] [client 20.215.241.7:53656] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acFG5KPKTBDR2u47Gb3oeAAAAUs"]
[Mon Mar 23 21:57:56.543364 2026] [:error] [pid 52341:tid 52352] [client 20.215.241.7:4637] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acFG5KPKTBDR2u47Gb3ofgAAAUk"]
[Mon Mar 23 21:57:57.056103 2026] [:error] [pid 38178:tid 38265] [client 20.215.241.7:53685] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acFG5Q0axWfXsVvR9udItAAAAJc"]
[Mon Mar 23 21:57:57.655981 2026] [:error] [pid 38176:tid 38205] [client 20.215.241.7:35235] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acFG5UtG4qlh1gvNjuJGtQAAABI"]
[Mon Mar 23 21:57:58.177898 2026] [:error] [pid 38178:tid 38252] [client 20.215.241.7:31611] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acFG5g0axWfXsVvR9udIuQAAAIo"]
[Mon Mar 23 21:57:58.782175 2026] [:error] [pid 38306:tid 38327] [client 20.215.241.7:62094] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acFG5jkL8qwu-hHc6Bis9QAAARM"]
[Mon Mar 23 21:57:59.305312 2026] [:error] [pid 52341:tid 52344] [client 20.215.241.7:62119] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "acFG56PKTBDR2u47Gb3ojwAAAUE"]
[Mon Mar 23 21:57:59.830737 2026] [:error] [pid 52341:tid 52343] [client 20.215.241.7:4937] [client 20.215.241.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/caiij.php"] [unique_id "acFG56PKTBDR2u47Gb3okAAAAUA"]
[Mon Mar 23 21:58:00.370725 2026] [proxy_fcgi:error] [pid 38176:tid 38199] [client 20.215.241.7:58297] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:58:00.629984 2026] [proxy_fcgi:error] [pid 38176:tid 38189] [client 20.215.241.7:58297] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:58:00.888839 2026] [proxy_fcgi:error] [pid 38176:tid 38191] [client 20.215.241.7:58297] AH01071: Got error 'Primary script unknown'
[Mon Mar 23 21:58:01.145281 2026] [:error] [pid 38176:tid 38197] [client 20.215.241.7:58297] [client 20.215.241.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "acFG6UtG4qlh1gvNjuJGyAAAAAo"]
[Tue Mar 24 02:03:54.826495 2026] [:error] [pid 56435:tid 56508] [client 43.130.101.151:49340] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acGAisrwr-l5A-s9ryCZVAAAAQg"]
[Tue Mar 24 02:31:12.937745 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:52213] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acGG8AymO0MnzQb90MM_4QAAAIw"]
[Tue Mar 24 02:31:13.498798 2026] [:error] [pid 56236:tid 56295] [client 20.220.216.188:52216] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acGG8XapFgYp0uZ8twA2SQAAAEI"]
[Tue Mar 24 02:31:13.983092 2026] [:error] [pid 56236:tid 56309] [client 20.220.216.188:52221] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acGG8XapFgYp0uZ8twA2SwAAAFA"]
[Tue Mar 24 02:31:14.405510 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:52170] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acGG8ndtW_1bksndFbZaEQAAAAw"]
[Tue Mar 24 06:04:42.324892 2026] [:error] [pid 38767:tid 38789] [client 182.42.111.213:38101] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acG4-vwkUqN4GJAI5oWCdgAAARM"]
[Tue Mar 24 06:09:33.287808 2026] [proxy_fcgi:error] [pid 64198:tid 64203] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:33.762650 2026] [proxy_fcgi:error] [pid 64198:tid 64212] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:34.071497 2026] [proxy_fcgi:error] [pid 64198:tid 64205] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:34.335555 2026] [proxy_fcgi:error] [pid 64198:tid 64208] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:34.646399 2026] [proxy_fcgi:error] [pid 64198:tid 64222] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:34.910689 2026] [proxy_fcgi:error] [pid 64198:tid 64200] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:35.176288 2026] [proxy_fcgi:error] [pid 64198:tid 64203] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:35.442865 2026] [proxy_fcgi:error] [pid 64198:tid 64220] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:35.707473 2026] [proxy_fcgi:error] [pid 64198:tid 64207] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:36.019894 2026] [proxy_fcgi:error] [pid 64198:tid 64223] [client 20.251.9.203:64922] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:09:36.288439 2026] [:error] [pid 64198:tid 64224] [client 20.251.9.203:64922] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "acG6IHVzJqf6OS_oSZ3bgwAAAVg"]
[Tue Mar 24 06:09:36.913220 2026] [:error] [pid 3032:tid 3125] [client 20.251.9.203:64213] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "acG6ICa_-JXXD03-JNzOPgAAAJY"]
[Tue Mar 24 06:09:37.474848 2026] [:error] [pid 3030:tid 3058] [client 20.251.9.203:64302] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "acG6IQyOuILyynfcqfn62QAAAAk"]
[Tue Mar 24 06:09:38.060702 2026] [:error] [pid 64198:tid 64213] [client 20.251.9.203:64245] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "acG6InVzJqf6OS_oSZ3biAAAAU0"]
[Tue Mar 24 06:09:38.695429 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:64852] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "acG6InVzJqf6OS_oSZ3bjAAAAUE"]
[Tue Mar 24 06:09:39.337577 2026] [:error] [pid 3032:tid 3121] [client 20.251.9.203:63577] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "acG6Iya_-JXXD03-JNzORgAAAJI"]
[Tue Mar 24 06:09:39.903231 2026] [:error] [pid 3137:tid 3139] [client 20.251.9.203:64933] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "acG6I5dZesutm6dfYM_srQAAAMA"]
[Tue Mar 24 06:09:40.890879 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:63108] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "acG6JJdZesutm6dfYM_srgAAAM8"]
[Tue Mar 24 06:09:41.470534 2026] [:error] [pid 38767:tid 38783] [client 20.251.9.203:63563] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acG6JfwkUqN4GJAI5oWEygAAAQ0"]
[Tue Mar 24 06:09:42.298695 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:63647] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acG6JnVzJqf6OS_oSZ3b4AAAAUM"]
[Tue Mar 24 06:09:42.860247 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:64255] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acG6JvwkUqN4GJAI5oWEzgAAAQI"]
[Tue Mar 24 06:09:43.520838 2026] [:error] [pid 64198:tid 64212] [client 20.251.9.203:65515] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acG6J3VzJqf6OS_oSZ3b5QAAAUw"]
[Tue Mar 24 06:09:44.088825 2026] [:error] [pid 3137:tid 3145] [client 20.251.9.203:64836] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acG6KJdZesutm6dfYM_stAAAAMY"]
[Tue Mar 24 06:09:44.626868 2026] [:error] [pid 3032:tid 3117] [client 20.251.9.203:64230] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acG6KCa_-JXXD03-JNzOTgAAAI4"]
[Tue Mar 24 06:09:45.155342 2026] [:error] [pid 38767:tid 38785] [client 20.251.9.203:65504] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acG6KfwkUqN4GJAI5oWE1gAAAQ8"]
[Tue Mar 24 06:09:45.729744 2026] [:error] [pid 3137:tid 3162] [client 20.251.9.203:63608] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acG6KZdZesutm6dfYM_suQAAANc"]
[Tue Mar 24 06:09:46.439872 2026] [:error] [pid 3032:tid 3104] [client 20.251.9.203:63119] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acG6Kia_-JXXD03-JNzOVgAAAIE"]
[Tue Mar 24 06:09:47.254899 2026] [:error] [pid 38767:tid 38774] [client 20.251.9.203:65519] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acG6K_wkUqN4GJAI5oWE2gAAAQQ"]
[Tue Mar 24 06:09:47.889547 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:63581] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acG6K_wkUqN4GJAI5oWE2wAAARM"]
[Tue Mar 24 06:09:48.435825 2026] [:error] [pid 38767:tid 38776] [client 20.251.9.203:64317] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acG6LPwkUqN4GJAI5oWE3wAAAQY"]
[Tue Mar 24 06:09:48.996746 2026] [:error] [pid 3137:tid 3152] [client 20.251.9.203:65497] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acG6LJdZesutm6dfYM_swQAAAM0"]
[Tue Mar 24 06:09:49.572361 2026] [:error] [pid 3031:tid 3077] [client 20.251.9.203:63123] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acG6LaJBKytnG47nuibiGgAAAEE"]
[Tue Mar 24 06:09:50.483136 2026] [:error] [pid 38767:tid 38791] [client 20.251.9.203:64927] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acG6LvwkUqN4GJAI5oWE5AAAARU"]
[Tue Mar 24 06:09:51.292072 2026] [:error] [pid 3031:tid 3100] [client 20.251.9.203:63612] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acG6L6JBKytnG47nuibiIQAAAFg"]
[Tue Mar 24 06:09:52.179510 2026] [:error] [pid 64198:tid 64218] [client 20.251.9.203:63673] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acG6MHVzJqf6OS_oSZ3b9wAAAVI"]
[Tue Mar 24 06:09:52.937845 2026] [:error] [pid 3137:tid 3159] [client 20.251.9.203:64197] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acG6MJdZesutm6dfYM_sxAAAANQ"]
[Tue Mar 24 06:09:54.041788 2026] [:error] [pid 3031:tid 3079] [client 20.251.9.203:64883] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acG6MqJBKytnG47nuibiKQAAAEM"]
[Tue Mar 24 06:09:55.170790 2026] [:error] [pid 3030:tid 3066] [client 20.251.9.203:64296] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acG6MwyOuILyynfcqfn64AAAABE"]
[Tue Mar 24 06:09:56.990453 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:63639] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acG6NPwkUqN4GJAI5oWE8QAAAQI"]
[Tue Mar 24 06:10:00.658438 2026] [:error] [pid 38767:tid 38788] [client 20.251.9.203:64865] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acG6OPwkUqN4GJAI5oWE-QAAARI"]
[Tue Mar 24 06:10:01.606297 2026] [:error] [pid 3030:tid 3060] [client 20.251.9.203:64932] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acG6OQyOuILyynfcqfn65AAAAAs"]
[Tue Mar 24 06:10:02.810642 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:62502] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acG6OpdZesutm6dfYM_s2AAAAM4"]
[Tue Mar 24 06:10:04.287042 2026] [:error] [pid 3032:tid 3105] [client 20.251.9.203:64253] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acG6PCa_-JXXD03-JNzOgQAAAII"]
[Tue Mar 24 06:10:05.674465 2026] [:error] [pid 64198:tid 64224] [client 20.251.9.203:65525] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acG6PXVzJqf6OS_oSZ3cJAAAAVg"]
[Tue Mar 24 06:10:06.908690 2026] [:error] [pid 64198:tid 64216] [client 20.251.9.203:64220] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acG6PnVzJqf6OS_oSZ3cKwAAAVA"]
[Tue Mar 24 06:10:08.755042 2026] [:error] [pid 64198:tid 64207] [client 20.251.9.203:64265] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acG6QHVzJqf6OS_oSZ3cQAAAAUc"]
[Tue Mar 24 06:10:10.935131 2026] [:error] [pid 3031:tid 3093] [client 20.251.9.203:65486] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acG6QqJBKytnG47nuibiPwAAAFE"]
[Tue Mar 24 06:10:13.006830 2026] [:error] [pid 64198:tid 64219] [client 20.251.9.203:63640] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acG6RXVzJqf6OS_oSZ3cSgAAAVM"]
[Tue Mar 24 06:10:13.969656 2026] [:error] [pid 3030:tid 3051] [client 20.251.9.203:64244] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acG6RQyOuILyynfcqfn66gAAAAI"]
[Tue Mar 24 06:10:15.099025 2026] [:error] [pid 3031:tid 3087] [client 20.251.9.203:63125] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acG6R6JBKytnG47nuibiQwAAAEs"]
[Tue Mar 24 06:10:16.303789 2026] [:error] [pid 3137:tid 3152] [client 20.251.9.203:61776] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acG6SJdZesutm6dfYM_s-AAAAM0"]
[Tue Mar 24 06:10:18.687860 2026] [:error] [pid 3137:tid 3161] [client 20.251.9.203:63126] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acG6SpdZesutm6dfYM_s_wAAANY"]
[Tue Mar 24 06:10:25.926768 2026] [:error] [pid 3031:tid 3076] [client 20.251.9.203:64881] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acG6UaJBKytnG47nuibiVQAAAEA"]
[Tue Mar 24 06:10:29.342816 2026] [:error] [pid 38767:tid 38788] [client 20.251.9.203:63589] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acG6VfwkUqN4GJAI5oWFIQAAARI"]
[Tue Mar 24 06:10:31.076650 2026] [:error] [pid 3030:tid 3049] [client 20.251.9.203:64877] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acG6VwyOuILyynfcqfn68gAAAAA"]
[Tue Mar 24 06:10:32.281151 2026] [:error] [pid 38767:tid 38793] [client 20.251.9.203:64214] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acG6WPwkUqN4GJAI5oWFJQAAARc"]
[Tue Mar 24 06:10:33.215905 2026] [:error] [pid 38767:tid 38785] [client 20.251.9.203:65511] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acG6WfwkUqN4GJAI5oWFJgAAAQ8"]
[Tue Mar 24 06:10:34.517288 2026] [:error] [pid 64198:tid 64222] [client 20.251.9.203:64939] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acG6WnVzJqf6OS_oSZ3cfwAAAVY"]
[Tue Mar 24 06:10:35.425051 2026] [:error] [pid 38767:tid 38780] [client 20.251.9.203:64250] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acG6W_wkUqN4GJAI5oWFLAAAAQo"]
[Tue Mar 24 06:10:36.052668 2026] [proxy_fcgi:error] [pid 3137:tid 3144] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:36.328391 2026] [proxy_fcgi:error] [pid 3137:tid 3155] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:38.048577 2026] [proxy_fcgi:error] [pid 3137:tid 3149] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:38.313577 2026] [proxy_fcgi:error] [pid 3137:tid 3148] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:38.586877 2026] [proxy_fcgi:error] [pid 3137:tid 3159] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:38.865552 2026] [proxy_fcgi:error] [pid 3137:tid 3146] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:39.129780 2026] [proxy_fcgi:error] [pid 3137:tid 3154] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:39.394688 2026] [proxy_fcgi:error] [pid 3137:tid 3157] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:39.696076 2026] [proxy_fcgi:error] [pid 3137:tid 3161] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:39.969014 2026] [proxy_fcgi:error] [pid 3137:tid 3141] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:40.234720 2026] [proxy_fcgi:error] [pid 3137:tid 3139] [client 20.251.9.203:64845] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:10:40.495858 2026] [:error] [pid 3137:tid 3156] [client 20.251.9.203:64845] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acG6YJdZesutm6dfYM_tMgAAANE"]
[Tue Mar 24 06:10:41.745719 2026] [:error] [pid 3030:tid 3070] [client 20.251.9.203:64917] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acG6YQyOuILyynfcqfn7AAAAABU"]
[Tue Mar 24 06:10:43.036433 2026] [:error] [pid 64198:tid 64208] [client 20.251.9.203:64266] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acG6Y3VzJqf6OS_oSZ3cjQAAAUg"]
[Tue Mar 24 06:10:43.761470 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:63605] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acG6Y_wkUqN4GJAI5oWFNAAAARY"]
[Tue Mar 24 06:10:44.526972 2026] [:error] [pid 38767:tid 38770] [client 20.251.9.203:64300] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acG6ZPwkUqN4GJAI5oWFNwAAAQA"]
[Tue Mar 24 06:10:46.838501 2026] [:error] [pid 38767:tid 38786] [client 20.251.9.203:64926] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acG6ZvwkUqN4GJAI5oWFQAAAARA"]
[Tue Mar 24 06:10:47.666814 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:64873] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acG6Z_wkUqN4GJAI5oWFQwAAARM"]
[Tue Mar 24 06:10:48.565643 2026] [:error] [pid 3030:tid 3066] [client 20.251.9.203:63646] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acG6aAyOuILyynfcqfn7AwAAABE"]
[Tue Mar 24 06:10:49.512318 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:63566] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acG6aXVzJqf6OS_oSZ3cpAAAAUE"]
[Tue Mar 24 06:10:50.255133 2026] [:error] [pid 64198:tid 64217] [client 20.251.9.203:63146] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acG6anVzJqf6OS_oSZ3cpwAAAVE"]
[Tue Mar 24 06:10:51.618432 2026] [:error] [pid 3030:tid 3069] [client 20.251.9.203:64950] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acG6awyOuILyynfcqfn7CwAAABQ"]
[Tue Mar 24 06:10:52.540727 2026] [:error] [pid 3137:tid 3162] [client 20.251.9.203:64307] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acG6bJdZesutm6dfYM_tUAAAANc"]
[Tue Mar 24 06:10:53.434359 2026] [:error] [pid 3032:tid 3112] [client 20.251.9.203:63113] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acG6bSa_-JXXD03-JNzO4gAAAIk"]
[Tue Mar 24 06:10:55.103440 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:64304] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acG6b3VzJqf6OS_oSZ3ctwAAAUM"]
[Tue Mar 24 06:10:56.008904 2026] [:error] [pid 64198:tid 64213] [client 20.251.9.203:63657] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acG6cHVzJqf6OS_oSZ3cvAAAAU0"]
[Tue Mar 24 06:10:57.415349 2026] [:error] [pid 38767:tid 38782] [client 20.251.9.203:63655] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acG6cfwkUqN4GJAI5oWFXQAAAQw"]
[Tue Mar 24 06:10:59.032066 2026] [:error] [pid 64198:tid 64216] [client 20.251.9.203:64856] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acG6c3VzJqf6OS_oSZ3cwwAAAVA"]
[Tue Mar 24 06:10:59.865619 2026] [:error] [pid 3030:tid 3067] [client 20.251.9.203:65522] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acG6cwyOuILyynfcqfn7DgAAABI"]
[Tue Mar 24 06:11:00.653246 2026] [:error] [pid 3032:tid 3114] [client 20.251.9.203:64215] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acG6dCa_-JXXD03-JNzO7gAAAIs"]
[Tue Mar 24 06:11:01.422172 2026] [:error] [pid 3137:tid 3139] [client 20.251.9.203:64243] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acG6dZdZesutm6dfYM_tZAAAAMA"]
[Tue Mar 24 06:11:02.349686 2026] [:error] [pid 3032:tid 3125] [client 20.251.9.203:63672] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acG6dia_-JXXD03-JNzO8AAAAJY"]
[Tue Mar 24 06:11:03.152137 2026] [:error] [pid 38767:tid 38781] [client 20.251.9.203:64953] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acG6d_wkUqN4GJAI5oWFawAAAQs"]
[Tue Mar 24 06:11:03.726190 2026] [:error] [pid 3032:tid 3120] [client 20.251.9.203:64839] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acG6dya_-JXXD03-JNzO8gAAAJE"]
[Tue Mar 24 06:11:04.470804 2026] [:error] [pid 3032:tid 3116] [client 20.251.9.203:64854] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acG6eCa_-JXXD03-JNzO9AAAAI0"]
[Tue Mar 24 06:11:05.217586 2026] [:error] [pid 3031:tid 3100] [client 20.251.9.203:64941] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acG6eaJBKytnG47nuibilAAAAFg"]
[Tue Mar 24 06:11:06.351589 2026] [:error] [pid 3031:tid 3084] [client 20.251.9.203:63584] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acG6eqJBKytnG47nuibimQAAAEg"]
[Tue Mar 24 06:11:08.174187 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:64864] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acG6fHVzJqf6OS_oSZ3czgAAAUE"]
[Tue Mar 24 06:11:08.868878 2026] [:error] [pid 64198:tid 64206] [client 20.251.9.203:63579] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acG6fHVzJqf6OS_oSZ3c5AAAAUY"]
[Tue Mar 24 06:11:33.333794 2026] [:error] [pid 64198:tid 64202] [client 20.251.9.203:63638] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acG6lXVzJqf6OS_oSZ3dPgAAAUI"]
[Tue Mar 24 06:11:36.136521 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:64948] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acG6mHVzJqf6OS_oSZ3dRwAAAUE"]
[Tue Mar 24 06:11:38.845918 2026] [:error] [pid 3032:tid 3105] [client 20.251.9.203:63580] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acG6mia_-JXXD03-JNzPMwAAAII"]
[Tue Mar 24 06:11:43.556094 2026] [proxy_fcgi:error] [pid 3030:tid 3066] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:43.847193 2026] [proxy_fcgi:error] [pid 3030:tid 3053] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:44.158705 2026] [proxy_fcgi:error] [pid 3030:tid 3068] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:44.710278 2026] [proxy_fcgi:error] [pid 3030:tid 3063] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:45.009427 2026] [proxy_fcgi:error] [pid 3030:tid 3054] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:45.274406 2026] [proxy_fcgi:error] [pid 3030:tid 3057] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:45.581388 2026] [proxy_fcgi:error] [pid 3030:tid 3055] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:45.848136 2026] [proxy_fcgi:error] [pid 3030:tid 3072] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:46.135684 2026] [proxy_fcgi:error] [pid 3030:tid 3069] [client 20.251.9.203:63619] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:11:46.435341 2026] [:error] [pid 3030:tid 3056] [client 20.251.9.203:63619] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acG6ogyOuILyynfcqfn7PwAAAAc"]
[Tue Mar 24 06:11:49.239781 2026] [:error] [pid 38767:tid 38789] [client 20.251.9.203:64938] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acG6pfwkUqN4GJAI5oWFzwAAARM"]
[Tue Mar 24 06:11:52.817854 2026] [:error] [pid 38767:tid 38794] [client 20.251.9.203:64906] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acG6qPwkUqN4GJAI5oWF2QAAARg"]
[Tue Mar 24 06:11:54.286533 2026] [:error] [pid 38767:tid 38786] [client 20.251.9.203:64211] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acG6qvwkUqN4GJAI5oWF5AAAARA"]
[Tue Mar 24 06:11:55.090898 2026] [:error] [pid 64198:tid 64201] [client 20.251.9.203:61856] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acG6q3VzJqf6OS_oSZ3dgQAAAUE"]
[Tue Mar 24 06:11:55.870024 2026] [:error] [pid 38767:tid 38777] [client 20.251.9.203:63642] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acG6q_wkUqN4GJAI5oWF7AAAAQc"]
[Tue Mar 24 06:11:57.022456 2026] [:error] [pid 3031:tid 3081] [client 20.251.9.203:63575] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acG6raJBKytnG47nuibjUAAAAEU"]
[Tue Mar 24 06:11:57.834150 2026] [:error] [pid 38767:tid 38782] [client 20.251.9.203:64930] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acG6rfwkUqN4GJAI5oWF8wAAAQw"]
[Tue Mar 24 06:11:58.791138 2026] [:error] [pid 3031:tid 3099] [client 20.251.9.203:63564] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "acG6rqJBKytnG47nuibjUgAAAFc"]
[Tue Mar 24 06:11:59.383810 2026] [:error] [pid 3031:tid 3100] [client 20.251.9.203:62416] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "acG6r6JBKytnG47nuibjVQAAAFg"]
[Tue Mar 24 06:12:00.576571 2026] [:error] [pid 3032:tid 3110] [client 20.251.9.203:63110] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "acG6sCa_-JXXD03-JNzPSgAAAIc"]
[Tue Mar 24 06:12:01.363781 2026] [:error] [pid 3032:tid 3120] [client 20.251.9.203:64897] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "acG6sSa_-JXXD03-JNzPUQAAAJE"]
[Tue Mar 24 06:12:02.672370 2026] [:error] [pid 3137:tid 3147] [client 20.251.9.203:64297] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "acG6spdZesutm6dfYM_t1AAAAMg"]
[Tue Mar 24 06:12:05.585578 2026] [:error] [pid 3031:tid 3077] [client 20.251.9.203:65483] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "acG6taJBKytnG47nuibjYgAAAEE"]
[Tue Mar 24 06:12:06.283142 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:62462] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "acG6tpdZesutm6dfYM_t3QAAAM4"]
[Tue Mar 24 06:12:07.289316 2026] [:error] [pid 3031:tid 3081] [client 20.251.9.203:63593] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "acG6t6JBKytnG47nuibjYwAAAEU"]
[Tue Mar 24 06:12:11.005174 2026] [:error] [pid 64198:tid 64221] [client 20.251.9.203:64226] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acG6u3VzJqf6OS_oSZ3dkwAAAVU"]
[Tue Mar 24 06:12:13.083719 2026] [:error] [pid 3030:tid 3057] [client 20.251.9.203:64261] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acG6vQyOuILyynfcqfn7VAAAAAg"]
[Tue Mar 24 06:12:14.586370 2026] [:error] [pid 38767:tid 38781] [client 20.251.9.203:64246] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acG6vvwkUqN4GJAI5oWGBAAAAQs"]
[Tue Mar 24 06:12:16.860935 2026] [:error] [pid 64198:tid 64211] [client 20.251.9.203:63587] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acG6wHVzJqf6OS_oSZ3duQAAAUs"]
[Tue Mar 24 06:12:18.318498 2026] [:error] [pid 64198:tid 64211] [client 20.251.9.203:63592] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acG6wnVzJqf6OS_oSZ3dxQAAAUs"]
[Tue Mar 24 06:12:19.522732 2026] [:error] [pid 3137:tid 3145] [client 20.251.9.203:63620] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acG6w5dZesutm6dfYM_t-QAAAMY"]
[Tue Mar 24 06:12:20.504651 2026] [:error] [pid 64198:tid 64200] [client 20.251.9.203:63117] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acG6xHVzJqf6OS_oSZ3d0gAAAUA"]
[Tue Mar 24 06:12:22.863313 2026] [:error] [pid 3031:tid 3092] [client 20.251.9.203:64233] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acG6xqJBKytnG47nuibjagAAAFA"]
[Tue Mar 24 06:12:24.048845 2026] [:error] [pid 3032:tid 3127] [client 20.251.9.203:64959] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acG6yCa_-JXXD03-JNzPkQAAAJc"]
[Tue Mar 24 06:12:25.017304 2026] [:error] [pid 3030:tid 3055] [client 20.251.9.203:65476] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acG6yQyOuILyynfcqfn7YQAAAAY"]
[Tue Mar 24 06:12:26.046462 2026] [:error] [pid 3031:tid 3099] [client 20.251.9.203:65494] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acG6yqJBKytnG47nuibjbAAAAFc"]
[Tue Mar 24 06:12:26.684207 2026] [:error] [pid 3032:tid 3114] [client 20.251.9.203:63159] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acG6yia_-JXXD03-JNzPnAAAAIs"]
[Tue Mar 24 06:12:27.250180 2026] [:error] [pid 3030:tid 3069] [client 20.251.9.203:65517] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acG6ywyOuILyynfcqfn7ZwAAABQ"]
[Tue Mar 24 06:12:27.780472 2026] [:error] [pid 3137:tid 3154] [client 20.251.9.203:65481] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acG6y5dZesutm6dfYM_uBgAAAM8"]
[Tue Mar 24 06:12:28.307857 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:65507] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acG6zJdZesutm6dfYM_uBwAAAM4"]
[Tue Mar 24 06:12:28.975916 2026] [:error] [pid 38767:tid 38792] [client 20.251.9.203:64196] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acG6zPwkUqN4GJAI5oWGGAAAARY"]
[Tue Mar 24 06:12:29.501659 2026] [:error] [pid 3137:tid 3162] [client 20.251.9.203:65496] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acG6zZdZesutm6dfYM_uDAAAANc"]
[Tue Mar 24 06:12:30.024462 2026] [:error] [pid 64198:tid 64214] [client 20.251.9.203:63662] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acG6znVzJqf6OS_oSZ3d7gAAAU4"]
[Tue Mar 24 06:12:30.665558 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:64954] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acG6zvwkUqN4GJAI5oWGHAAAAQM"]
[Tue Mar 24 06:12:31.228731 2026] [:error] [pid 3032:tid 3123] [client 20.251.9.203:63648] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acG6zya_-JXXD03-JNzPoAAAAJQ"]
[Tue Mar 24 06:12:31.945679 2026] [:error] [pid 38767:tid 38776] [client 20.251.9.203:64287] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acG6z_wkUqN4GJAI5oWGHwAAAQY"]
[Tue Mar 24 06:12:32.759750 2026] [:error] [pid 38767:tid 38774] [client 20.251.9.203:63664] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acG60PwkUqN4GJAI5oWGIgAAAQQ"]
[Tue Mar 24 06:12:33.601303 2026] [:error] [pid 3137:tid 3160] [client 20.251.9.203:62440] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acG60ZdZesutm6dfYM_uHwAAANU"]
[Tue Mar 24 06:12:34.308277 2026] [:error] [pid 3032:tid 3118] [client 20.251.9.203:63576] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acG60ia_-JXXD03-JNzPowAAAI8"]
[Tue Mar 24 06:12:35.154794 2026] [:error] [pid 38767:tid 38776] [client 20.251.9.203:64248] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acG60_wkUqN4GJAI5oWGKQAAAQY"]
[Tue Mar 24 06:12:36.334268 2026] [:error] [pid 3137:tid 3162] [client 20.251.9.203:64904] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acG61JdZesutm6dfYM_uLAAAANc"]
[Tue Mar 24 06:12:38.143267 2026] [:error] [pid 3032:tid 3108] [client 20.251.9.203:64936] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acG61ia_-JXXD03-JNzPtgAAAIU"]
[Tue Mar 24 06:12:39.594904 2026] [:error] [pid 38767:tid 38773] [client 20.251.9.203:64896] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acG61_wkUqN4GJAI5oWGOAAAAQM"]
[Tue Mar 24 06:12:57.705197 2026] [proxy_fcgi:error] [pid 38767:tid 38770] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:58.032674 2026] [proxy_fcgi:error] [pid 38767:tid 38790] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:58.560710 2026] [proxy_fcgi:error] [pid 38767:tid 38793] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:58.889919 2026] [proxy_fcgi:error] [pid 38767:tid 38785] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:59.180246 2026] [proxy_fcgi:error] [pid 38767:tid 38792] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:59.479283 2026] [proxy_fcgi:error] [pid 38767:tid 38776] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:12:59.748341 2026] [proxy_fcgi:error] [pid 38767:tid 38787] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:13:00.098461 2026] [proxy_fcgi:error] [pid 38767:tid 38770] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:13:00.365553 2026] [proxy_fcgi:error] [pid 38767:tid 38782] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:13:00.661302 2026] [proxy_fcgi:error] [pid 38767:tid 38786] [client 20.251.9.203:63104] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:13:00.924003 2026] [:error] [pid 38767:tid 38785] [client 20.251.9.203:63104] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acG67PwkUqN4GJAI5oWGbwAAAQ8"]
[Tue Mar 24 06:13:02.728427 2026] [:error] [pid 64198:tid 64224] [client 20.251.9.203:65491] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acG67nVzJqf6OS_oSZ3eAwAAAVg"]
[Tue Mar 24 06:13:04.401937 2026] [:error] [pid 3031:tid 3095] [client 20.251.9.203:64298] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acG68KJBKytnG47nuibjggAAAFM"]
[Tue Mar 24 06:13:05.174966 2026] [:error] [pid 38767:tid 38779] [client 20.251.9.203:63558] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acG68fwkUqN4GJAI5oWGeAAAAQk"]
[Tue Mar 24 06:13:12.354518 2026] [:error] [pid 3137:tid 3153] [client 20.251.9.203:65484] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acG6-JdZesutm6dfYM_ufAAAAM4"]
[Tue Mar 24 06:13:15.436480 2026] [:error] [pid 3031:tid 3095] [client 20.251.9.203:63601] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acG6-6JBKytnG47nuibjjgAAAFM"]
[Tue Mar 24 06:13:16.719568 2026] [:error] [pid 3137:tid 3161] [client 20.251.9.203:65516] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acG6_JdZesutm6dfYM_upQAAANY"]
[Tue Mar 24 06:13:17.624265 2026] [:error] [pid 3031:tid 3084] [client 20.251.9.203:64887] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acG6_aJBKytnG47nuibjkAAAAEg"]
[Tue Mar 24 06:13:20.480443 2026] [:error] [pid 38767:tid 38772] [client 20.251.9.203:62456] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acG7APwkUqN4GJAI5oWGnwAAAQI"]
[Tue Mar 24 06:13:21.360360 2026] [:error] [pid 3031:tid 3083] [client 20.251.9.203:63654] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acG7AaJBKytnG47nuibjlAAAAEc"]
[Tue Mar 24 06:13:24.239776 2026] [:error] [pid 3137:tid 3144] [client 20.251.9.203:64862] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acG7BJdZesutm6dfYM_urgAAAMU"]
[Tue Mar 24 06:13:36.251700 2026] [:error] [pid 64198:tid 64203] [client 20.251.9.203:64869] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acG7EHVzJqf6OS_oSZ3eXQAAAUM"]
[Tue Mar 24 06:13:37.291250 2026] [:error] [pid 64198:tid 64210] [client 20.251.9.203:63604] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acG7EXVzJqf6OS_oSZ3eZAAAAUo"]
[Tue Mar 24 06:13:38.787325 2026] [:error] [pid 64198:tid 64202] [client 20.251.9.203:63114] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acG7EnVzJqf6OS_oSZ3ebQAAAUI"]
[Tue Mar 24 06:13:40.276966 2026] [:error] [pid 3031:tid 3086] [client 20.251.9.203:64867] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acG7FKJBKytnG47nuibjrgAAAEo"]
[Tue Mar 24 06:13:42.160709 2026] [:error] [pid 3030:tid 3057] [client 20.251.9.203:65512] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acG7FgyOuILyynfcqfn70gAAAAg"]
[Tue Mar 24 06:13:43.129798 2026] [:error] [pid 64198:tid 64219] [client 20.251.9.203:64260] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acG7F3VzJqf6OS_oSZ3ehwAAAVM"]
[Tue Mar 24 06:13:44.595576 2026] [:error] [pid 38767:tid 38787] [client 20.251.9.203:63670] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acG7GPwkUqN4GJAI5oWGtAAAARE"]
[Tue Mar 24 06:13:49.082396 2026] [:error] [pid 3030:tid 3050] [client 20.251.9.203:64913] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acG7HQyOuILyynfcqfn71QAAAAE"]
[Tue Mar 24 06:13:57.188976 2026] [:error] [pid 3137:tid 3158] [client 20.251.9.203:65493] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acG7JZdZesutm6dfYM_u6QAAANM"]
[Tue Mar 24 06:13:59.233325 2026] [:error] [pid 64198:tid 64200] [client 20.251.9.203:63637] [client 20.251.9.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acG7J3VzJqf6OS_oSZ3eyAAAAUA"]
[Tue Mar 24 06:14:00.594311 2026] [proxy_fcgi:error] [pid 64198:tid 64202] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:00.859073 2026] [proxy_fcgi:error] [pid 64198:tid 64201] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:01.122920 2026] [proxy_fcgi:error] [pid 64198:tid 64207] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:01.442733 2026] [proxy_fcgi:error] [pid 64198:tid 64220] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:01.781846 2026] [proxy_fcgi:error] [pid 64198:tid 64212] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:02.058222 2026] [proxy_fcgi:error] [pid 64198:tid 64214] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:02.322691 2026] [proxy_fcgi:error] [pid 64198:tid 64223] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 06:14:02.586575 2026] [proxy_fcgi:error] [pid 64198:tid 64206] [client 20.251.9.203:64847] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 08:06:55.403711 2026] [:error] [pid 3137:tid 3144] [client 43.133.66.51:47928] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acHVn5dZesutm6dfYM8yLQAAAMU"]
[Tue Mar 24 09:02:44.731818 2026] [:error] [pid 3137:tid 3147] [client 185.223.152.252:25023] [client 185.223.152.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.252, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acHitJdZesutm6dfYM9XggAAAMg"]
[Tue Mar 24 09:02:44.748300 2026] [proxy_fcgi:error] [pid 3137:tid 3147] [client 185.223.152.252:25023] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 12:57:41.504192 2026] [:error] [pid 3031:tid 3076] [client 88.214.188.164:53514] [client 88.214.188.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.214.188.164, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acIZxaJBKytnG47nuiYVVwAAAEA"]
[Tue Mar 24 12:57:41.514266 2026] [proxy_fcgi:error] [pid 3031:tid 3076] [client 88.214.188.164:53514] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 12:57:42.828923 2026] [proxy_fcgi:error] [pid 48128:tid 48176] [client 88.214.188.164:53520] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 13:23:16.607851 2026] [:error] [pid 64198:tid 64209] [client 182.42.110.255:37928] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acIfxHVzJqf6OS_oSZ3ydQAAAUk"]
[Tue Mar 24 14:12:31.478616 2026] [:error] [pid 64198:tid 64204] [client 106.200.13.199:17787] [client 106.200.13.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.200.13.199, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acIrT3VzJqf6OS_oSZ0PPQAAAUQ"]
[Tue Mar 24 14:12:31.488163 2026] [proxy_fcgi:error] [pid 64198:tid 64204] [client 106.200.13.199:17787] AH01071: Got error 'Primary script unknown'
[Tue Mar 24 14:21:13.780482 2026] [:error] [pid 64198:tid 64217] [client 43.130.174.37:48602] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acItWXVzJqf6OS_oSZ0TqAAAAVE"]
[Tue Mar 24 16:42:01.112947 2026] [:error] [pid 38767:tid 38786] [client 180.153.236.31:60230] [client 180.153.236.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acJOWfwkUqN4GJAI5oWtiwAAARA"], referer: http://www.switchcreative.net/
[Tue Mar 24 16:42:50.934065 2026] [:error] [pid 38767:tid 38775] [client 223.91.89.168:14560] [client 223.91.89.168] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acJOivwkUqN4GJAI5oWuAwAAAQU"], referer: http://www.switchcreative.net/
[Tue Mar 24 17:56:57.544125 2026] [:error] [pid 48219:tid 48303] [client 43.157.179.227:35174] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acJf6Shf3b4R_lAIyv9cKwAAAhY"]
[Tue Mar 24 18:55:46.378586 2026] [:error] [pid 38767:tid 38787] [client 43.153.62.161:34294] [client 43.153.62.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acJtsvwkUqN4GJAI5oUGMgAAARE"]
[Wed Mar 25 00:32:51.364402 2026] [:error] [pid 57711:tid 58074] [client 182.187.165.144:51025] [client 182.187.165.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.187.165.144, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acK8s6LdPFdeRRktTdNK-AAAAJQ"]
[Wed Mar 25 00:32:51.376509 2026] [proxy_fcgi:error] [pid 57711:tid 58074] [client 182.187.165.144:51025] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 02:57:16.880519 2026] [:error] [pid 57703:tid 58020] [client 68.183.151.56:58130] [client 68.183.151.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "acLejPIVQxDtjkklWGZvygAAAEE"]
[Wed Mar 25 03:33:58.481098 2026] [:error] [pid 62428:tid 62459] [client 41.90.136.221:6098] [client 41.90.136.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.90.136.221, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acLnJvhIU_wsjNikOwwzlgAAAAA"]
[Wed Mar 25 03:33:58.493332 2026] [proxy_fcgi:error] [pid 62428:tid 62459] [client 41.90.136.221:6098] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 05:34:32.423117 2026] [:error] [pid 892:tid 907] [client 148.72.173.218:52689] [client 148.72.173.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.173.218, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acMDaCT_G8WMU3T3yxot4wAAAMk"]
[Wed Mar 25 05:34:32.423206 2026] [:error] [pid 892:tid 907] [client 148.72.173.218:52689] [client 148.72.173.218] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 148.72.173.218 on wp-login.php, counter = 52"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acMDaCT_G8WMU3T3yxot4wAAAMk"]
[Wed Mar 25 05:54:36.103639 2026] [:error] [pid 754:tid 774] [client 43.135.144.81:54754] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acMIHDisL3asPbA3Cti7PQAAAAk"]
[Wed Mar 25 06:54:09.701268 2026] [:error] [pid 892:tid 899] [client 43.165.190.5:53166] [client 43.165.190.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acMWEST_G8WMU3T3yxpEHgAAAMM"]
[Wed Mar 25 08:26:56.668499 2026] [:error] [pid 26449:tid 26473] [client 105.96.145.213:65284] [client 105.96.145.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.96.145.213, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acMr0NpZ2T15NDqzAjG0fgAAAlQ"]
[Wed Mar 25 08:26:56.680423 2026] [proxy_fcgi:error] [pid 26449:tid 26473] [client 105.96.145.213:65284] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 08:52:32.556319 2026] [:error] [pid 47946:tid 47971] [client 173.239.240.15:36795] [client 173.239.240.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.15, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acMx0DipQTqBMSeKYhct9QAAARc"]
[Wed Mar 25 08:52:32.567526 2026] [proxy_fcgi:error] [pid 47946:tid 47971] [client 173.239.240.15:36795] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 11:31:48.216770 2026] [:error] [pid 47989:tid 47998] [client 125.94.144.102:56963] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acNXJCWKdJMhIccROjkBYgAAAUc"]
[Wed Mar 25 11:39:10.551394 2026] [:error] [pid 25968:tid 26016] [client 185.192.71.134:52951] [client 185.192.71.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.134, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acNY3vza_DO-rs4M6G6pGgAAA5E"]
[Wed Mar 25 11:39:10.563330 2026] [proxy_fcgi:error] [pid 25968:tid 26016] [client 185.192.71.134:52951] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 13:07:25.956666 2026] [:error] [pid 26269:tid 26297] [client 102.129.165.142:57924] [client 102.129.165.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acNtjUn7e-ZQbaIs7qyYqAAAAZU"]
[Wed Mar 25 13:12:03.597423 2026] [:error] [pid 47989:tid 48011] [client 43.153.19.83:40496] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acNuoyWKdJMhIccROjkdgQAAAVQ"]
[Wed Mar 25 15:05:22.847999 2026] [:error] [pid 47946:tid 47948] [client 178.51.0.188:2294] [client 178.51.0.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.51.0.188, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acOJMjipQTqBMSeKYhdxLAAAAQA"]
[Wed Mar 25 15:05:22.859489 2026] [proxy_fcgi:error] [pid 47946:tid 47948] [client 178.51.0.188:2294] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 15:05:46.811520 2026] [:error] [pid 26449:tid 26473] [client 97.227.223.67:58213] [client 97.227.223.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.227.223.67, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acOJStpZ2T15NDqzAjFPtQAAAlQ"]
[Wed Mar 25 15:05:46.824105 2026] [proxy_fcgi:error] [pid 26449:tid 26473] [client 97.227.223.67:58213] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 15:05:55.802151 2026] [:error] [pid 47989:tid 48014] [client 109.245.39.25:32801] [client 109.245.39.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.245.39.25, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acOJUyWKdJMhIccROjlKhAAAAVc"]
[Wed Mar 25 15:05:55.809997 2026] [proxy_fcgi:error] [pid 47989:tid 48014] [client 109.245.39.25:32801] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 15:19:35.624678 2026] [:error] [pid 25967:tid 25977] [client 158.140.211.0:54038] [client 158.140.211.0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "acOMh_g8Qtq7ZM4mSFnweQAAA0U"]
[Wed Mar 25 18:47:38.922351 2026] [:error] [pid 26321:tid 26355] [client 150.109.230.210:43834] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acO9SvKO65qqGZCSPZo7NQAAAg4"]
[Wed Mar 25 18:49:00.253941 2026] [:error] [pid 25875:tid 25881] [client 101.42.46.71:56538] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acO9nBJ38QkS3NyfshznqgAAAoA"]
[Wed Mar 25 18:56:35.451586 2026] [:error] [pid 25967:tid 25977] [client 186.206.216.131:59341] [client 186.206.216.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.206.216.131, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acO_Y_g8Qtq7ZM4mSFlIVQAAA0U"]
[Wed Mar 25 18:56:35.461335 2026] [proxy_fcgi:error] [pid 25967:tid 25977] [client 186.206.216.131:59341] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 19:05:44.813646 2026] [:error] [pid 25967:tid 25988] [client 23.226.132.115:42808] [client 23.226.132.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acPBiPg8Qtq7ZM4mSFlNGgAAA1A"], referer: https://www.google.com/search?q=admin+panel
[Wed Mar 25 19:43:54.315345 2026] [:error] [pid 25969:tid 26032] [client 150.109.230.210:57610] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acPKehd3aEUmOfdKja8JtgAAA8Y"]
[Wed Mar 25 21:19:47.782687 2026] [proxy_fcgi:error] [pid 47989:tid 48000] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:48.037338 2026] [proxy_fcgi:error] [pid 47989:tid 48003] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:48.805582 2026] [proxy_fcgi:error] [pid 47989:tid 47997] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:49.059614 2026] [proxy_fcgi:error] [pid 47989:tid 47991] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:49.313655 2026] [proxy_fcgi:error] [pid 47989:tid 48006] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:49.567662 2026] [proxy_fcgi:error] [pid 47989:tid 48012] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:49.821554 2026] [proxy_fcgi:error] [pid 47989:tid 47993] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:50.076153 2026] [proxy_fcgi:error] [pid 47989:tid 48000] [client 20.166.31.118:8145] AH01071: Got error 'Primary script unknown'
[Wed Mar 25 21:19:50.333693 2026] [:error] [pid 47989:tid 48001] [client 20.166.31.118:8145] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/AAAA.php"] [unique_id "acPg9iWKdJMhIccROjn9lwAAAUo"]
[Wed Mar 25 21:19:50.838157 2026] [:error] [pid 25967:tid 25976] [client 20.166.31.118:65514] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/AAAA.php"] [unique_id "acPg9vg8Qtq7ZM4mSFlw3gAAA0Q"]
[Wed Mar 25 21:19:51.344922 2026] [:error] [pid 25875:tid 25883] [client 20.166.31.118:8151] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/AAAA.php"] [unique_id "acPg9xJ38QkS3Nyfshwl4AAAAoI"]
[Wed Mar 25 21:19:51.847178 2026] [:error] [pid 25875:tid 25886] [client 20.166.31.118:65526] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/AAAA.php"] [unique_id "acPg9xJ38QkS3Nyfshwl4wAAAoU"]
[Wed Mar 25 21:19:52.348246 2026] [:error] [pid 25875:tid 25892] [client 20.166.31.118:8073] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fde.php"] [unique_id "acPg-BJ38QkS3Nyfshwl5QAAAos"]
[Wed Mar 25 21:19:52.849458 2026] [:error] [pid 892:tid 904] [client 20.166.31.118:65515] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fde.php"] [unique_id "acPg-CT_G8WMU3T3yxrdsAAAAMY"]
[Wed Mar 25 21:19:53.353895 2026] [:error] [pid 756:tid 860] [client 20.166.31.118:8128] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fde.php"] [unique_id "acPg-TOaW6oylMIDBCQlNAAAAIg"]
[Wed Mar 25 21:19:53.857449 2026] [:error] [pid 756:tid 858] [client 20.166.31.118:65523] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fde.php"] [unique_id "acPg-TOaW6oylMIDBCQlNQAAAIY"]
[Wed Mar 25 21:19:54.359384 2026] [:error] [pid 25967:tid 25981] [client 20.166.31.118:8143] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mjde.php"] [unique_id "acPg-vg8Qtq7ZM4mSFlw5gAAA0k"]
[Wed Mar 25 21:19:54.859631 2026] [:error] [pid 26449:tid 26476] [client 20.166.31.118:65489] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mjde.php"] [unique_id "acPg-tpZ2T15NDqzAjGJTAAAAlc"]
[Wed Mar 25 21:19:55.363711 2026] [:error] [pid 25967:tid 25992] [client 20.166.31.118:65490] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bays.php"] [unique_id "acPg-_g8Qtq7ZM4mSFlw6QAAA1Q"]
[Wed Mar 25 21:19:55.865683 2026] [:error] [pid 892:tid 908] [client 20.166.31.118:8160] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bays.php"] [unique_id "acPg-yT_G8WMU3T3yxrdtQAAAMo"]
[Wed Mar 25 21:19:56.368964 2026] [:error] [pid 25875:tid 25904] [client 20.166.31.118:65483] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bays.php"] [unique_id "acPg_BJ38QkS3Nyfshwl9QAAApc"]
[Wed Mar 25 21:19:56.870264 2026] [:error] [pid 892:tid 912] [client 20.166.31.118:8141] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bays.php"] [unique_id "acPg_CT_G8WMU3T3yxrdtgAAAM4"]
[Wed Mar 25 21:19:57.370417 2026] [:error] [pid 26449:tid 26469] [client 20.166.31.118:8157] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x0rg.php"] [unique_id "acPg_dpZ2T15NDqzAjGJUQAAAlA"]
[Wed Mar 25 21:19:57.871279 2026] [:error] [pid 47946:tid 47961] [client 20.166.31.118:8153] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x0rg.php"] [unique_id "acPg_TipQTqBMSeKYheJwQAAAQ0"]
[Wed Mar 25 21:19:58.383541 2026] [:error] [pid 25875:tid 25884] [client 20.166.31.118:65500] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x0rg.php"] [unique_id "acPg_hJ38QkS3Nyfshwl9wAAAoM"]
[Wed Mar 25 21:19:58.883464 2026] [:error] [pid 25875:tid 25881] [client 20.166.31.118:65507] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x0rg.php"] [unique_id "acPg_hJ38QkS3Nyfshwl-AAAAoA"]
[Wed Mar 25 21:19:59.387576 2026] [:error] [pid 25875:tid 25896] [client 20.166.31.118:8134] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dk.php"] [unique_id "acPg_xJ38QkS3Nyfshwl-gAAAo8"]
[Wed Mar 25 21:19:59.888855 2026] [:error] [pid 26449:tid 26457] [client 20.166.31.118:8081] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dk.php"] [unique_id "acPg_9pZ2T15NDqzAjGJWAAAAkQ"]
[Wed Mar 25 21:20:00.404594 2026] [:error] [pid 26449:tid 26472] [client 20.166.31.118:8159] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dk.php"] [unique_id "acPhANpZ2T15NDqzAjGJWgAAAlM"]
[Wed Mar 25 21:20:00.908560 2026] [:error] [pid 26449:tid 26460] [client 20.166.31.118:65494] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dk.php"] [unique_id "acPhANpZ2T15NDqzAjGJWwAAAkc"]
[Wed Mar 25 21:20:01.409387 2026] [:error] [pid 25875:tid 25901] [client 20.166.31.118:8102] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acPhARJ38QkS3Nyfshwl_QAAApQ"]
[Wed Mar 25 21:20:01.915383 2026] [:error] [pid 26449:tid 26466] [client 20.166.31.118:65485] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acPhAdpZ2T15NDqzAjGJXgAAAk0"]
[Wed Mar 25 21:20:02.417737 2026] [:error] [pid 26321:tid 26361] [client 20.166.31.118:8170] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acPhAvKO65qqGZCSPZpa1gAAAhQ"]
[Wed Mar 25 21:20:02.918599 2026] [:error] [pid 892:tid 919] [client 20.166.31.118:8132] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "acPhAiT_G8WMU3T3yxrduwAAANQ"]
[Wed Mar 25 21:33:23.092469 2026] [:error] [pid 26321:tid 26354] [client 123.55.61.147:15327] [client 123.55.61.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acPkI_KO65qqGZCSPZpc7gAAAg0"], referer: http://www.switchcreative.net/
[Wed Mar 25 23:02:26.763190 2026] [:error] [pid 25875:tid 25884] [client 94.156.152.43:59161] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "acP5AhJ38QkS3NyfshxSdwAAAoM"]
[Wed Mar 25 23:02:27.377166 2026] [:error] [pid 25969:tid 26026] [client 94.156.152.43:60444] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/style.php"] [unique_id "acP5Axd3aEUmOfdKja8aXgAAA8A"]
[Wed Mar 25 23:02:27.989092 2026] [:error] [pid 25967:tid 25973] [client 94.156.152.43:61574] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/themes/style.php"] [unique_id "acP5A_g8Qtq7ZM4mSFmP9wAAA0E"]
[Wed Mar 25 23:02:28.643541 2026] [:error] [pid 25967:tid 25977] [client 94.156.152.43:63024] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/style.php"] [unique_id "acP5BPg8Qtq7ZM4mSFmP-gAAA0U"]
[Wed Mar 25 23:02:29.256549 2026] [:error] [pid 26269:tid 26298] [client 94.156.152.43:64213] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style.php"] [unique_id "acP5BUn7e-ZQbaIs7qzIhgAAAZY"]
[Wed Mar 25 23:02:29.911945 2026] [:error] [pid 47989:tid 47994] [client 94.156.152.43:65173] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "acP5BSWKdJMhIccROjkUxwAAAUM"]
[Wed Mar 25 23:02:30.523950 2026] [:error] [pid 26269:tid 26281] [client 94.156.152.43:49793] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acP5Bkn7e-ZQbaIs7qzIhwAAAYU"]
[Wed Mar 25 23:02:31.178384 2026] [:error] [pid 25967:tid 25972] [client 94.156.152.43:50825] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/flower.php"] [unique_id "acP5B_g8Qtq7ZM4mSFmP_wAAA0A"]
[Wed Mar 25 23:02:31.791603 2026] [:error] [pid 25967:tid 25982] [client 94.156.152.43:51968] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acP5B_g8Qtq7ZM4mSFmQAgAAA0o"]
[Wed Mar 25 23:02:32.403697 2026] [:error] [pid 25967:tid 25976] [client 94.156.152.43:52848] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "acP5CPg8Qtq7ZM4mSFmQBQAAA0Q"]
[Wed Mar 25 23:02:33.016996 2026] [:error] [pid 25969:tid 26047] [client 94.156.152.43:53796] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "acP5CRd3aEUmOfdKja8aYAAAA9U"]
[Wed Mar 25 23:02:33.628310 2026] [:error] [pid 25875:tid 25895] [client 94.156.152.43:54847] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/blurbs.php"] [unique_id "acP5CRJ38QkS3NyfshxSfwAAAo4"]
[Wed Mar 25 23:02:34.242101 2026] [:error] [pid 25967:tid 25980] [client 94.156.152.43:55661] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "acP5Cvg8Qtq7ZM4mSFmQBwAAA0g"]
[Wed Mar 25 23:02:34.861705 2026] [:error] [pid 25875:tid 25899] [client 94.156.152.43:56600] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "acP5ChJ38QkS3NyfshxSgAAAApI"]
[Wed Mar 25 23:02:35.487513 2026] [:error] [pid 25875:tid 25892] [client 94.156.152.43:57479] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "acP5CxJ38QkS3NyfshxSgQAAAos"]
[Wed Mar 25 23:02:36.098942 2026] [:error] [pid 25875:tid 25891] [client 94.156.152.43:58525] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/cord.php"] [unique_id "acP5DBJ38QkS3NyfshxSgwAAAoo"]
[Wed Mar 25 23:02:36.711985 2026] [:error] [pid 26449:tid 26467] [client 94.156.152.43:59598] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/dex.php"] [unique_id "acP5DNpZ2T15NDqzAjGWLwAAAk4"]
[Wed Mar 25 23:02:37.374936 2026] [:error] [pid 25875:tid 25889] [client 94.156.152.43:60671] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/admin-ajax.php"] [unique_id "acP5DRJ38QkS3NyfshxShgAAAog"]
[Wed Mar 25 23:02:37.987351 2026] [:error] [pid 47946:tid 47965] [client 94.156.152.43:61641] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "acP5DTipQTqBMSeKYhePKQAAARE"]
[Wed Mar 25 23:02:38.640998 2026] [:error] [pid 47989:tid 48001] [client 94.156.152.43:62607] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "acP5DiWKdJMhIccROjkUyAAAAUo"]
[Wed Mar 25 23:02:39.295739 2026] [:error] [pid 25967:tid 25985] [client 94.156.152.43:63742] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/zwso.php"] [unique_id "acP5D_g8Qtq7ZM4mSFmQDAAAA00"]
[Wed Mar 25 23:02:39.909029 2026] [:error] [pid 26449:tid 26455] [client 94.156.152.43:64759] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "acP5D9pZ2T15NDqzAjGWMAAAAkI"]
[Wed Mar 25 23:02:40.521553 2026] [:error] [pid 47989:tid 48005] [client 94.156.152.43:49265] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acP5ECWKdJMhIccROjkUyQAAAU4"]
[Wed Mar 25 23:02:41.132841 2026] [:error] [pid 25967:tid 25984] [client 94.156.152.43:50032] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "acP5Efg8Qtq7ZM4mSFmQDwAAA0w"]
[Wed Mar 25 23:02:41.789297 2026] [:error] [pid 25967:tid 25976] [client 94.156.152.43:51014] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "acP5Efg8Qtq7ZM4mSFmQEQAAA0Q"]
[Wed Mar 25 23:02:42.402339 2026] [:error] [pid 892:tid 906] [client 94.156.152.43:52083] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "acP5EiT_G8WMU3T3yxrnlgAAAMg"]
[Wed Mar 25 23:02:43.056731 2026] [:error] [pid 892:tid 919] [client 94.156.152.43:53015] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/php8.php"] [unique_id "acP5EyT_G8WMU3T3yxrnlwAAANQ"]
[Wed Mar 25 23:02:43.714505 2026] [:error] [pid 25875:tid 25896] [client 94.156.152.43:54313] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/lufix1.php"] [unique_id "acP5ExJ38QkS3NyfshxSjQAAAo8"]
[Wed Mar 25 23:02:44.372975 2026] [:error] [pid 25875:tid 25902] [client 94.156.152.43:55488] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/witmm.php"] [unique_id "acP5FBJ38QkS3NyfshxSjwAAApU"]
[Wed Mar 25 23:02:44.986002 2026] [:error] [pid 25875:tid 25905] [client 94.156.152.43:56636] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/css/index.php"] [unique_id "acP5FBJ38QkS3NyfshxSkQAAApg"]
[Wed Mar 25 23:02:45.597714 2026] [:error] [pid 26449:tid 26460] [client 94.156.152.43:57602] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "acP5FdpZ2T15NDqzAjGWMQAAAkc"]
[Wed Mar 25 23:02:46.267041 2026] [:error] [pid 47989:tid 48003] [client 94.156.152.43:58675] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "acP5FiWKdJMhIccROjkUywAAAUw"]
[Wed Mar 25 23:02:46.923296 2026] [:error] [pid 47989:tid 47991] [client 94.156.152.43:59820] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acP5FiWKdJMhIccROjkUzAAAAUA"]
[Wed Mar 25 23:02:47.536503 2026] [:error] [pid 25967:tid 25982] [client 94.156.152.43:60987] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acP5F_g8Qtq7ZM4mSFmQFwAAA0o"]
[Wed Mar 25 23:02:48.150480 2026] [:error] [pid 25967:tid 25993] [client 94.156.152.43:62084] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/files.php"] [unique_id "acP5GPg8Qtq7ZM4mSFmQGQAAA1U"]
[Wed Mar 25 23:02:48.763475 2026] [:error] [pid 47989:tid 48008] [client 94.156.152.43:63640] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-editor.php"] [unique_id "acP5GCWKdJMhIccROjkUzgAAAVE"]
[Wed Mar 25 23:02:49.376282 2026] [:error] [pid 25967:tid 25994] [client 94.156.152.43:64884] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "acP5Gfg8Qtq7ZM4mSFmQHgAAA1Y"]
[Wed Mar 25 23:02:50.030185 2026] [:error] [pid 25875:tid 25885] [client 94.156.152.43:49787] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/txets.php"] [unique_id "acP5GhJ38QkS3NyfshxSkwAAAoQ"]
[Wed Mar 25 23:02:50.642319 2026] [:error] [pid 47989:tid 48013] [client 94.156.152.43:51229] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/txets.php"] [unique_id "acP5GiWKdJMhIccROjkU0wAAAVY"]
[Wed Mar 25 23:02:51.255527 2026] [:error] [pid 47989:tid 48014] [client 94.156.152.43:52563] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/postnews.php"] [unique_id "acP5GyWKdJMhIccROjkU1AAAAVc"]
[Wed Mar 25 23:02:51.910813 2026] [:error] [pid 25967:tid 25975] [client 94.156.152.43:54117] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/postnews.php"] [unique_id "acP5G_g8Qtq7ZM4mSFmQIQAAA0M"]
[Wed Mar 25 23:02:52.524074 2026] [:error] [pid 26321:tid 26341] [client 94.156.152.43:55661] [client 94.156.152.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/postnews.php"] [unique_id "acP5HPKO65qqGZCSPZpsuwAAAgI"]
[Thu Mar 26 00:13:33.489454 2026] [:error] [pid 25875:tid 25903] [client 115.96.216.125:51241] [client 115.96.216.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.96.216.125, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acQJrRJ38QkS3Nyfshxr7wAAApY"]
[Thu Mar 26 00:13:33.500350 2026] [proxy_fcgi:error] [pid 25875:tid 25903] [client 115.96.216.125:51241] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 00:13:50.574556 2026] [:error] [pid 892:tid 921] [client 120.61.179.33:56122] [client 120.61.179.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.61.179.33, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acQJviT_G8WMU3T3yxru2gAAANY"]
[Thu Mar 26 00:13:50.585063 2026] [proxy_fcgi:error] [pid 892:tid 921] [client 120.61.179.33:56122] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 00:18:30.644366 2026] [:error] [pid 25875:tid 25900] [client 130.43.210.127:55683] [client 130.43.210.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.43.210.127, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acQK1hJ38QkS3NyfshxuDAAAApM"]
[Thu Mar 26 00:18:30.658297 2026] [proxy_fcgi:error] [pid 25875:tid 25900] [client 130.43.210.127:55683] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 00:54:00.204120 2026] [:error] [pid 32829:tid 32841] [client 43.130.174.37:50672] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acQTKHFEeazI9mYaKszKqAAAAEo"]
[Thu Mar 26 02:03:49.930853 2026] [:error] [pid 32829:tid 32845] [client 43.153.10.13:56816] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acQjhXFEeazI9mYaKszvswAAAE4"]
[Thu Mar 26 02:33:22.638334 2026] [:error] [pid 32829:tid 32852] [client 182.44.12.37:51625] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acQqcnFEeazI9mYaKsz_yQAAAFU"]
[Thu Mar 26 07:12:51.581805 2026] [:error] [pid 19818:tid 19836] [client 192.3.207.218:56417] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/artisan"] [unique_id "acRr88zaSnm3d1BeM5WNPAAAANA"]
[Thu Mar 26 07:12:52.008930 2026] [:error] [pid 19818:tid 19839] [client 192.3.207.218:56847] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/artisan"] [unique_id "acRr9MzaSnm3d1BeM5WNWQAAANM"]
[Thu Mar 26 07:12:53.108927 2026] [:error] [pid 19710:tid 19727] [client 192.3.207.218:57254] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/artisan"] [unique_id "acRr9QVEWP8Ar68Njk6oswAAAAU"]
[Thu Mar 26 07:12:53.544055 2026] [:error] [pid 19711:tid 19750] [client 192.3.207.218:57778] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/artisan"] [unique_id "acRr9Wj3l1y81GYfluRJfgAAAEE"]
[Thu Mar 26 07:12:54.406219 2026] [:error] [pid 19710:tid 19724] [client 192.3.207.218:58124] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "acRr9gVEWP8Ar68Njk6pFQAAAAI"]
[Thu Mar 26 07:12:54.850778 2026] [:error] [pid 60829:tid 60835] [client 192.3.207.218:58801] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "acRr9vTdjHKeZokybaQpyQAAAQQ"]
[Thu Mar 26 07:12:55.831256 2026] [:error] [pid 19710:tid 19729] [client 192.3.207.218:59207] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "acRr9wVEWP8Ar68Njk6pWgAAAAc"]
[Thu Mar 26 07:12:56.251328 2026] [:error] [pid 31717:tid 31740] [client 192.3.207.218:60263] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "acRr-L-SCF7YDISDX49wGgAAAZI"]
[Thu Mar 26 07:46:26.628629 2026] [:error] [pid 19711:tid 19770] [client 43.131.243.61:36828] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acRz0mj3l1y81GYfluRNpAAAAFU"]
[Thu Mar 26 08:53:20.336216 2026] [:error] [pid 31717:tid 31723] [client 49.51.178.45:35500] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acSDgL-SCF7YDISDX4-C_QAAAYE"]
[Thu Mar 26 09:28:46.971355 2026] [:error] [pid 19712:tid 19788] [client 182.42.104.32:36863] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acSLztWhKhRNqm23vFPqAwAAAIw"]
[Thu Mar 26 09:42:36.957865 2026] [:error] [pid 60829:tid 60843] [client 46.1.46.174:44043] [client 46.1.46.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.1.46.174, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acSPDPTdjHKeZokybaRPqgAAAQw"]
[Thu Mar 26 09:42:36.969652 2026] [proxy_fcgi:error] [pid 60829:tid 60843] [client 46.1.46.174:44043] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:04.881891 2026] [proxy_fcgi:error] [pid 31778:tid 31802] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:05.175923 2026] [proxy_fcgi:error] [pid 31778:tid 31806] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:05.428631 2026] [proxy_fcgi:error] [pid 31778:tid 31807] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:05.742294 2026] [proxy_fcgi:error] [pid 31778:tid 31798] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:06.018868 2026] [proxy_fcgi:error] [pid 31778:tid 31817] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:06.312041 2026] [proxy_fcgi:error] [pid 31778:tid 31816] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:06.602633 2026] [proxy_fcgi:error] [pid 31778:tid 31810] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:06.925629 2026] [proxy_fcgi:error] [pid 31778:tid 31800] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:07.219213 2026] [proxy_fcgi:error] [pid 31778:tid 31811] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:10.693541 2026] [proxy_fcgi:error] [pid 31778:tid 31804] [client 20.250.3.85:34222] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:23:10.989614 2026] [:error] [pid 31778:tid 31793] [client 20.250.3.85:34222] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTe3g3kybI2o-xasmDIQQAAAcA"]
[Thu Mar 26 15:23:20.867635 2026] [:error] [pid 31670:tid 31686] [client 20.250.3.85:40986] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTe6DXVthXxCnWjOTQi6QAAAU4"]
[Thu Mar 26 15:23:22.331025 2026] [:error] [pid 31778:tid 31813] [client 20.250.3.85:22439] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTe6g3kybI2o-xasmDISAAAAdQ"]
[Thu Mar 26 15:23:23.124758 2026] [:error] [pid 19710:tid 19741] [client 20.250.3.85:53707] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTe6wVEWP8Ar68Njk7knQAAABM"]
[Thu Mar 26 15:23:24.079854 2026] [:error] [pid 19818:tid 19823] [client 20.250.3.85:41359] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTe7MzaSnm3d1BeM5WZRgAAAMM"]
[Thu Mar 26 15:23:25.325086 2026] [:error] [pid 31670:tid 31678] [client 20.250.3.85:22412] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTe7TXVthXxCnWjOTQi8wAAAUY"]
[Thu Mar 26 15:23:26.180175 2026] [:error] [pid 60829:tid 60851] [client 20.250.3.85:35320] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTe7vTdjHKeZokybaSTIQAAARQ"]
[Thu Mar 26 15:23:27.618958 2026] [:error] [pid 19711:tid 19772] [client 20.250.3.85:54300] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTe72j3l1y81GYfluR6wAAAAFc"]
[Thu Mar 26 15:23:28.430371 2026] [:error] [pid 31717:tid 31746] [client 20.250.3.85:41382] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTe8L-SCF7YDISDX4_BqwAAAZg"]
[Thu Mar 26 15:23:29.469973 2026] [:error] [pid 60829:tid 60855] [client 20.250.3.85:41376] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTe8fTdjHKeZokybaSTKQAAARg"]
[Thu Mar 26 15:23:31.036404 2026] [:error] [pid 19818:tid 19820] [client 20.250.3.85:35287] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTe88zaSnm3d1BeM5WZUAAAAMA"]
[Thu Mar 26 15:23:34.451553 2026] [:error] [pid 31778:tid 31798] [client 20.250.3.85:41366] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTe9g3kybI2o-xasmDIVwAAAcU"]
[Thu Mar 26 15:23:40.644785 2026] [:error] [pid 31670:tid 31695] [client 20.250.3.85:48769] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTe_DXVthXxCnWjOTQjAgAAAVc"]
[Thu Mar 26 15:23:41.447819 2026] [:error] [pid 31670:tid 31694] [client 20.250.3.85:35266] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTe_TXVthXxCnWjOTQjCAAAAVY"]
[Thu Mar 26 15:23:42.132802 2026] [:error] [pid 19710:tid 19732] [client 20.250.3.85:24671] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTe_gVEWP8Ar68Njk7kpwAAAAo"]
[Thu Mar 26 15:23:46.455621 2026] [:error] [pid 19818:tid 19844] [client 20.250.3.85:41395] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTfAszaSnm3d1BeM5WZawAAANg"]
[Thu Mar 26 15:23:48.281209 2026] [:error] [pid 31670:tid 31691] [client 20.250.3.85:24643] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTfBDXVthXxCnWjOTQjJgAAAVM"]
[Thu Mar 26 15:23:50.181476 2026] [:error] [pid 60829:tid 60833] [client 20.250.3.85:4527] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTfBvTdjHKeZokybaSTMQAAAQI"]
[Thu Mar 26 15:23:51.820353 2026] [:error] [pid 31778:tid 31803] [client 20.250.3.85:52440] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTfBw3kybI2o-xasmDIbgAAAco"]
[Thu Mar 26 15:23:52.498057 2026] [:error] [pid 19711:tid 19767] [client 20.250.3.85:41371] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTfCGj3l1y81GYfluR6zQAAAFI"]
[Thu Mar 26 15:23:54.526537 2026] [:error] [pid 31670:tid 31683] [client 20.250.3.85:45791] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTfCjXVthXxCnWjOTQjNAAAAUs"]
[Thu Mar 26 15:23:55.814898 2026] [:error] [pid 31670:tid 31692] [client 20.250.3.85:35321] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTfCzXVthXxCnWjOTQjOQAAAVQ"]
[Thu Mar 26 15:23:59.416700 2026] [:error] [pid 31670:tid 31683] [client 20.250.3.85:43045] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTfDzXVthXxCnWjOTQjRAAAAUs"]
[Thu Mar 26 15:24:00.371582 2026] [:error] [pid 31778:tid 31802] [client 20.250.3.85:37845] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTfEA3kybI2o-xasmDIfwAAAck"]
[Thu Mar 26 15:24:02.675442 2026] [:error] [pid 60829:tid 60855] [client 20.250.3.85:53717] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTfEvTdjHKeZokybaSTPAAAARg"]
[Thu Mar 26 15:24:04.199543 2026] [:error] [pid 31670:tid 31673] [client 20.250.3.85:35325] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTfFDXVthXxCnWjOTQjSAAAAUE"]
[Thu Mar 26 15:24:06.007139 2026] [:error] [pid 31780:tid 31823] [client 20.250.3.85:35314] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTfFpJDwZsy5O4ZXEhaRAAAAgM"]
[Thu Mar 26 15:24:07.197723 2026] [:error] [pid 19711:tid 19771] [client 20.250.3.85:40978] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTfF2j3l1y81GYfluR61AAAAFY"]
[Thu Mar 26 15:24:08.231460 2026] [:error] [pid 19711:tid 19773] [client 20.250.3.85:23457] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTfGGj3l1y81GYfluR61gAAAFg"]
[Thu Mar 26 15:24:09.400537 2026] [:error] [pid 19712:tid 19795] [client 20.250.3.85:53725] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTfGdWhKhRNqm23vFMI9AAAAJM"]
[Thu Mar 26 15:24:10.982780 2026] [proxy_fcgi:error] [pid 60829:tid 60834] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:11.224115 2026] [proxy_fcgi:error] [pid 60829:tid 60844] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:11.492907 2026] [proxy_fcgi:error] [pid 60829:tid 60842] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:11.780809 2026] [proxy_fcgi:error] [pid 60829:tid 60836] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:12.053034 2026] [proxy_fcgi:error] [pid 60829:tid 60847] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:12.338396 2026] [proxy_fcgi:error] [pid 60829:tid 60843] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:12.584881 2026] [proxy_fcgi:error] [pid 60829:tid 60850] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:12.870118 2026] [proxy_fcgi:error] [pid 60829:tid 60840] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:13.145118 2026] [proxy_fcgi:error] [pid 60829:tid 60837] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:13.484203 2026] [proxy_fcgi:error] [pid 60829:tid 60851] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:13.724957 2026] [proxy_fcgi:error] [pid 60829:tid 60841] [client 20.250.3.85:40997] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:24:13.960821 2026] [:error] [pid 60829:tid 60845] [client 20.250.3.85:40997] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTfHfTdjHKeZokybaSTWgAAAQ4"]
[Thu Mar 26 15:24:15.083957 2026] [:error] [pid 19818:tid 19833] [client 20.250.3.85:38159] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTfH8zaSnm3d1BeM5WZhgAAAM0"]
[Thu Mar 26 15:24:16.132928 2026] [:error] [pid 31670:tid 31691] [client 20.250.3.85:45817] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTfIDXVthXxCnWjOTQjVQAAAVM"]
[Thu Mar 26 15:24:17.002005 2026] [:error] [pid 31670:tid 31690] [client 20.250.3.85:32428] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTfITXVthXxCnWjOTQjXAAAAVI"]
[Thu Mar 26 15:24:17.713302 2026] [:error] [pid 19818:tid 19831] [client 20.250.3.85:4553] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acTfIczaSnm3d1BeM5WZiAAAAMs"]
[Thu Mar 26 15:24:18.646390 2026] [:error] [pid 19818:tid 19842] [client 20.250.3.85:53311] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acTfIszaSnm3d1BeM5WZiQAAANY"]
[Thu Mar 26 15:24:20.953812 2026] [:error] [pid 31778:tid 31804] [client 20.250.3.85:58061] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acTfJA3kybI2o-xasmDIlAAAAcs"]
[Thu Mar 26 15:24:22.128905 2026] [:error] [pid 60829:tid 60831] [client 20.250.3.85:41360] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "acTfJvTdjHKeZokybaSTYQAAAQA"]
[Thu Mar 26 15:24:23.156394 2026] [:error] [pid 19711:tid 19773] [client 20.250.3.85:23471] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acTfJ2j3l1y81GYfluR63QAAAFg"]
[Thu Mar 26 15:24:23.855527 2026] [:error] [pid 31780:tid 31822] [client 20.250.3.85:45802] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acTfJ5JDwZsy5O4ZXEhaZAAAAgI"]
[Thu Mar 26 15:24:24.674862 2026] [:error] [pid 19818:tid 19825] [client 20.250.3.85:40982] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acTfKMzaSnm3d1BeM5WZrQAAAMU"]
[Thu Mar 26 15:24:25.403257 2026] [:error] [pid 31717:tid 31731] [client 20.250.3.85:40727] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acTfKb-SCF7YDISDX4_BvAAAAYk"]
[Thu Mar 26 15:24:26.815599 2026] [:error] [pid 19818:tid 19844] [client 20.250.3.85:53307] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acTfKszaSnm3d1BeM5WZtQAAANg"]
[Thu Mar 26 15:24:28.657536 2026] [:error] [pid 31670:tid 31682] [client 20.250.3.85:4993] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acTfLDXVthXxCnWjOTQjewAAAUo"]
[Thu Mar 26 15:24:29.641415 2026] [:error] [pid 31670:tid 31681] [client 20.250.3.85:5011] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acTfLTXVthXxCnWjOTQjhwAAAUk"]
[Thu Mar 26 15:24:30.801591 2026] [:error] [pid 31717:tid 31742] [client 20.250.3.85:29232] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acTfLr-SCF7YDISDX4_BwAAAAZQ"]
[Thu Mar 26 15:24:32.191119 2026] [:error] [pid 19818:tid 19832] [client 20.250.3.85:49815] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acTfMMzaSnm3d1BeM5WZwAAAAMw"]
[Thu Mar 26 15:24:32.882586 2026] [:error] [pid 31717:tid 31730] [client 20.250.3.85:43017] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acTfML-SCF7YDISDX4_BxAAAAYg"]
[Thu Mar 26 15:24:33.822165 2026] [:error] [pid 31780:tid 31821] [client 20.250.3.85:29230] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acTfMZJDwZsy5O4ZXEhacQAAAgE"]
[Thu Mar 26 15:24:35.226859 2026] [:error] [pid 31778:tid 31813] [client 20.250.3.85:29244] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acTfMw3kybI2o-xasmDIqwAAAdQ"]
[Thu Mar 26 15:24:36.277206 2026] [:error] [pid 31670:tid 31685] [client 20.250.3.85:35771] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acTfNDXVthXxCnWjOTQjoAAAAU0"]
[Thu Mar 26 15:24:37.553037 2026] [:error] [pid 31717:tid 31741] [client 20.250.3.85:53293] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acTfNb-SCF7YDISDX4_ByQAAAZM"]
[Thu Mar 26 15:24:39.806248 2026] [:error] [pid 19710:tid 19732] [client 20.250.3.85:37882] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acTfNwVEWP8Ar68Njk7k2wAAAAo"]
[Thu Mar 26 15:24:41.341161 2026] [:error] [pid 31717:tid 31726] [client 20.250.3.85:53719] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acTfOb-SCF7YDISDX4_BzgAAAYQ"]
[Thu Mar 26 15:24:42.530962 2026] [:error] [pid 60829:tid 60833] [client 20.250.3.85:35757] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTfOvTdjHKeZokybaSTcwAAAQI"]
[Thu Mar 26 15:24:44.296070 2026] [:error] [pid 31717:tid 31732] [client 20.250.3.85:45813] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTfPL-SCF7YDISDX4_B0QAAAYo"]
[Thu Mar 26 15:24:45.577628 2026] [:error] [pid 19712:tid 19800] [client 20.250.3.85:54004] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTfPdWhKhRNqm23vFMJBQAAAJg"]
[Thu Mar 26 15:24:47.062737 2026] [:error] [pid 19818:tid 19834] [client 20.250.3.85:31929] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTfP8zaSnm3d1BeM5WZzwAAAM4"]
[Thu Mar 26 15:24:49.559597 2026] [:error] [pid 19818:tid 19821] [client 20.250.3.85:53724] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTfQczaSnm3d1BeM5WZ2gAAAME"]
[Thu Mar 26 15:24:51.113876 2026] [:error] [pid 19818:tid 19822] [client 20.250.3.85:53259] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTfQ8zaSnm3d1BeM5WZ5gAAAMI"]
[Thu Mar 26 15:24:51.996912 2026] [:error] [pid 19711:tid 19767] [client 20.250.3.85:53806] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTfQ2j3l1y81GYfluR66gAAAFI"]
[Thu Mar 26 15:24:53.253157 2026] [:error] [pid 19818:tid 19821] [client 20.250.3.85:46210] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTfRczaSnm3d1BeM5WZ8gAAAME"]
[Thu Mar 26 15:24:54.800628 2026] [:error] [pid 31670:tid 31687] [client 20.250.3.85:53749] [client 20.250.3.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "acTfRjXVthXxCnWjOTQjxgAAAU8"]
[Thu Mar 26 15:24:56.273476 2026] [:error] [pid 31717:tid 31739] [client 20.250.3.85:35269] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTfSL-SCF7YDISDX4_B2gAAAZE"]
[Thu Mar 26 15:24:58.643454 2026] [:error] [pid 31717:tid 31725] [client 20.250.3.85:38153] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTfSr-SCF7YDISDX4_B3wAAAYM"]
[Thu Mar 26 15:25:00.662243 2026] [:error] [pid 31670:tid 31681] [client 20.250.3.85:4552] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTfTDXVthXxCnWjOTQj0gAAAUk"]
[Thu Mar 26 15:25:02.024428 2026] [:error] [pid 19818:tid 19842] [client 20.250.3.85:4856] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTfTszaSnm3d1BeM5WaHgAAANY"]
[Thu Mar 26 15:25:03.700161 2026] [:error] [pid 31717:tid 31741] [client 20.250.3.85:43038] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTfT7-SCF7YDISDX4_B4QAAAZM"]
[Thu Mar 26 15:25:04.537693 2026] [:error] [pid 60829:tid 60832] [client 20.250.3.85:4991] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTfUPTdjHKeZokybaSTfgAAAQE"]
[Thu Mar 26 15:25:06.289163 2026] [:error] [pid 19818:tid 19836] [client 20.250.3.85:41004] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTfUszaSnm3d1BeM5WaOgAAANA"]
[Thu Mar 26 15:25:07.910244 2026] [:error] [pid 19818:tid 19833] [client 20.250.3.85:54065] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTfU8zaSnm3d1BeM5WaRgAAAM0"]
[Thu Mar 26 15:25:09.452572 2026] [:error] [pid 19818:tid 19834] [client 20.250.3.85:57092] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acTfVczaSnm3d1BeM5WaUQAAAM4"]
[Thu Mar 26 15:25:10.945320 2026] [:error] [pid 31670:tid 31686] [client 20.250.3.85:54076] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acTfVjXVthXxCnWjOTQj4wAAAU4"]
[Thu Mar 26 15:25:12.115296 2026] [:error] [pid 19710:tid 19735] [client 20.250.3.85:51760] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acTfWAVEWP8Ar68Njk7k9AAAAA0"]
[Thu Mar 26 15:25:13.049362 2026] [proxy_fcgi:error] [pid 19711:tid 19751] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:13.366188 2026] [proxy_fcgi:error] [pid 19711:tid 19773] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:13.627388 2026] [proxy_fcgi:error] [pid 19711:tid 19754] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:13.930124 2026] [proxy_fcgi:error] [pid 19711:tid 19768] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:14.209466 2026] [proxy_fcgi:error] [pid 19711:tid 19755] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:14.449326 2026] [proxy_fcgi:error] [pid 19711:tid 19770] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:25:14.692048 2026] [proxy_fcgi:error] [pid 19711:tid 19759] [client 20.250.3.85:4587] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:26:10.012575 2026] [proxy_fcgi:error] [pid 31780:tid 31826] [client 20.250.3.85:56392] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:26:10.254302 2026] [proxy_fcgi:error] [pid 31780:tid 31836] [client 20.250.3.85:56392] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:26:10.493939 2026] [proxy_fcgi:error] [pid 31780:tid 31827] [client 20.250.3.85:56392] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:26:10.948246 2026] [proxy_fcgi:error] [pid 31780:tid 31840] [client 20.250.3.85:56392] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:26:11.285767 2026] [:error] [pid 31780:tid 31829] [client 20.250.3.85:56392] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "acTfk5JDwZsy5O4ZXEhbSwAAAgg"]
[Thu Mar 26 15:26:12.057393 2026] [:error] [pid 19711:tid 19767] [client 20.250.3.85:34798] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "acTflGj3l1y81GYfluR7EQAAAFI"]
[Thu Mar 26 15:26:13.668850 2026] [:error] [pid 31670:tid 31691] [client 20.250.3.85:44379] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "acTflTXVthXxCnWjOTQkxgAAAVM"]
[Thu Mar 26 15:26:16.317382 2026] [:error] [pid 31778:tid 31797] [client 20.250.3.85:41007] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "acTfmA3kybI2o-xasmDJJgAAAcQ"]
[Thu Mar 26 15:26:17.329795 2026] [:error] [pid 31778:tid 31812] [client 20.250.3.85:25212] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTfmQ3kybI2o-xasmDJKgAAAdM"]
[Thu Mar 26 15:26:18.127931 2026] [:error] [pid 19711:tid 19755] [client 20.250.3.85:52455] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTfmmj3l1y81GYfluR7EgAAAEY"]
[Thu Mar 26 15:26:19.230771 2026] [:error] [pid 31778:tid 31804] [client 20.250.3.85:4326] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTfmw3kybI2o-xasmDJLQAAAcs"]
[Thu Mar 26 15:26:20.699748 2026] [:error] [pid 19710:tid 19742] [client 20.250.3.85:52217] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTfnAVEWP8Ar68Njk7lDAAAABQ"]
[Thu Mar 26 15:26:21.461730 2026] [:error] [pid 60829:tid 60841] [client 20.250.3.85:22424] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTfnfTdjHKeZokybaST2QAAAQo"]
[Thu Mar 26 15:26:22.512131 2026] [:error] [pid 31778:tid 31804] [client 20.250.3.85:23464] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTfng3kybI2o-xasmDJOAAAAcs"]
[Thu Mar 26 15:26:24.123225 2026] [:error] [pid 31717:tid 31743] [client 20.250.3.85:34291] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTfoL-SCF7YDISDX4_CKQAAAZU"]
[Thu Mar 26 15:26:26.135487 2026] [:error] [pid 60829:tid 60855] [client 20.250.3.85:52180] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTfovTdjHKeZokybaST3gAAARg"]
[Thu Mar 26 15:26:27.622681 2026] [:error] [pid 60829:tid 60848] [client 20.250.3.85:44353] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTfo_TdjHKeZokybaST4wAAARE"]
[Thu Mar 26 15:26:29.383280 2026] [:error] [pid 31717:tid 31730] [client 20.250.3.85:46580] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTfpb-SCF7YDISDX4_CKgAAAYg"]
[Thu Mar 26 15:26:32.983616 2026] [:error] [pid 31778:tid 31798] [client 20.250.3.85:53704] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTfqA3kybI2o-xasmDJRwAAAcU"]
[Thu Mar 26 15:26:34.202857 2026] [:error] [pid 31778:tid 31807] [client 20.250.3.85:43354] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTfqg3kybI2o-xasmDJSgAAAc4"]
[Thu Mar 26 15:26:39.270348 2026] [:error] [pid 19712:tid 19795] [client 20.250.3.85:40150] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTfr9WhKhRNqm23vFMJJgAAAJM"]
[Thu Mar 26 15:26:40.230173 2026] [:error] [pid 31670:tid 31681] [client 20.250.3.85:4150] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTfsDXVthXxCnWjOTQlIAAAAUk"]
[Thu Mar 26 15:26:41.359339 2026] [:error] [pid 31670:tid 31676] [client 20.250.3.85:43975] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTfsTXVthXxCnWjOTQlKAAAAUQ"]
[Thu Mar 26 15:26:42.672608 2026] [:error] [pid 31670:tid 31684] [client 20.250.3.85:40142] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTfsjXVthXxCnWjOTQlMgAAAUw"]
[Thu Mar 26 15:26:43.414753 2026] [:error] [pid 31670:tid 31692] [client 20.250.3.85:47873] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTfszXVthXxCnWjOTQlPgAAAVQ"]
[Thu Mar 26 15:26:44.249791 2026] [:error] [pid 60829:tid 60836] [client 20.250.3.85:44000] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTftPTdjHKeZokybaST7gAAAQU"]
[Thu Mar 26 15:26:46.189138 2026] [:error] [pid 31780:tid 31842] [client 20.250.3.85:25187] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTftpJDwZsy5O4ZXEhbgQAAAhU"]
[Thu Mar 26 15:26:47.275298 2026] [:error] [pid 19818:tid 19841] [client 20.250.3.85:40172] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTft8zaSnm3d1BeM5WbWgAAANU"]
[Thu Mar 26 15:26:48.958710 2026] [:error] [pid 19712:tid 19785] [client 20.250.3.85:47882] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTfuNWhKhRNqm23vFMJKQAAAIk"]
[Thu Mar 26 15:26:50.269126 2026] [:error] [pid 31778:tid 31798] [client 20.250.3.85:23546] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTfug3kybI2o-xasmDJXwAAAcU"]
[Thu Mar 26 15:26:52.121721 2026] [:error] [pid 19710:tid 19739] [client 20.250.3.85:34246] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTfvAVEWP8Ar68Njk7lHgAAABE"]
[Thu Mar 26 15:26:53.644149 2026] [:error] [pid 31717:tid 31741] [client 20.250.3.85:53743] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTfvb-SCF7YDISDX4_COAAAAZM"]
[Thu Mar 26 15:26:56.684928 2026] [:error] [pid 60829:tid 60848] [client 20.250.3.85:23429] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTfwPTdjHKeZokybaST-gAAARE"]
[Thu Mar 26 15:26:57.668841 2026] [:error] [pid 31670:tid 31687] [client 20.250.3.85:49826] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTfwTXVthXxCnWjOTQlRwAAAU8"]
[Thu Mar 26 15:26:59.278864 2026] [:error] [pid 60829:tid 60838] [client 20.250.3.85:34778] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTfw_TdjHKeZokybaST_gAAAQc"]
[Thu Mar 26 15:27:00.351958 2026] [:error] [pid 31670:tid 31680] [client 20.250.3.85:52160] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTfxDXVthXxCnWjOTQlUAAAAUg"]
[Thu Mar 26 15:27:01.196632 2026] [:error] [pid 31670:tid 31695] [client 20.250.3.85:50337] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTfxTXVthXxCnWjOTQlVwAAAVc"]
[Thu Mar 26 15:27:02.191657 2026] [:error] [pid 19712:tid 19783] [client 20.250.3.85:22427] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTfxtWhKhRNqm23vFMJOwAAAIc"]
[Thu Mar 26 15:27:03.138452 2026] [:error] [pid 31670:tid 31684] [client 20.250.3.85:51250] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTfxzXVthXxCnWjOTQlYQAAAUw"]
[Thu Mar 26 15:27:03.905335 2026] [:error] [pid 31778:tid 31807] [client 20.250.3.85:4309] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTfxw3kybI2o-xasmDJdAAAAc4"]
[Thu Mar 26 15:27:04.832004 2026] [:error] [pid 19818:tid 19844] [client 20.250.3.85:4136] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTfyMzaSnm3d1BeM5WbcAAAANg"]
[Thu Mar 26 15:27:05.897980 2026] [:error] [pid 31717:tid 31722] [client 20.250.3.85:38188] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTfyb-SCF7YDISDX4_CQgAAAYA"]
[Thu Mar 26 15:27:06.904156 2026] [:error] [pid 31670:tid 31680] [client 20.250.3.85:25190] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTfyjXVthXxCnWjOTQldAAAAUg"]
[Thu Mar 26 15:27:07.647544 2026] [:error] [pid 31778:tid 31814] [client 20.250.3.85:4102] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTfyw3kybI2o-xasmDJeQAAAdU"]
[Thu Mar 26 15:27:08.789204 2026] [:error] [pid 19711:tid 19759] [client 20.250.3.85:52192] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acTfzGj3l1y81GYfluR7KwAAAEo"]
[Thu Mar 26 15:27:10.430534 2026] [proxy_fcgi:error] [pid 31778:tid 31801] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:10.672809 2026] [proxy_fcgi:error] [pid 31778:tid 31804] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:10.916869 2026] [proxy_fcgi:error] [pid 31778:tid 31813] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:11.191836 2026] [proxy_fcgi:error] [pid 31778:tid 31810] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:11.433245 2026] [proxy_fcgi:error] [pid 31778:tid 31798] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:11.823662 2026] [proxy_fcgi:error] [pid 31778:tid 31817] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:12.126847 2026] [proxy_fcgi:error] [pid 31778:tid 31801] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:12.494835 2026] [proxy_fcgi:error] [pid 31778:tid 31804] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:12.783484 2026] [proxy_fcgi:error] [pid 31778:tid 31793] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:13.540044 2026] [proxy_fcgi:error] [pid 31778:tid 31813] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:14.008857 2026] [proxy_fcgi:error] [pid 31778:tid 31802] [client 20.250.3.85:25176] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:27:14.274180 2026] [:error] [pid 31778:tid 31795] [client 20.250.3.85:25176] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acTf0g3kybI2o-xasmDJmgAAAcI"]
[Thu Mar 26 15:27:15.441310 2026] [:error] [pid 31717:tid 31725] [client 20.250.3.85:4147] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acTf07-SCF7YDISDX4_CSAAAAYM"]
[Thu Mar 26 15:27:16.909059 2026] [:error] [pid 31778:tid 31813] [client 20.250.3.85:38199] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acTf1A3kybI2o-xasmDJoAAAAdQ"]
[Thu Mar 26 15:27:17.802164 2026] [:error] [pid 31778:tid 31805] [client 20.250.3.85:39120] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "acTf1Q3kybI2o-xasmDJpgAAAcw"]
[Thu Mar 26 15:27:18.937136 2026] [:error] [pid 31778:tid 31807] [client 20.250.3.85:34268] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTf1g3kybI2o-xasmDJrAAAAc4"]
[Thu Mar 26 15:27:19.876674 2026] [:error] [pid 19710:tid 19731] [client 20.250.3.85:53711] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTf1wVEWP8Ar68Njk7lOQAAAAk"]
[Thu Mar 26 15:27:21.102811 2026] [:error] [pid 19712:tid 19788] [client 20.250.3.85:4548] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTf2dWhKhRNqm23vFMJRQAAAIw"]
[Thu Mar 26 15:27:22.092126 2026] [:error] [pid 31778:tid 31816] [client 20.250.3.85:50346] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTf2g3kybI2o-xasmDJsgAAAdc"]
[Thu Mar 26 15:27:23.669781 2026] [:error] [pid 31670:tid 31679] [client 20.250.3.85:4941] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTf2zXVthXxCnWjOTQlggAAAUc"]
[Thu Mar 26 15:27:24.567197 2026] [:error] [pid 19818:tid 19842] [client 20.250.3.85:4329] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTf3MzaSnm3d1BeM5WbiQAAANY"]
[Thu Mar 26 15:27:27.035817 2026] [:error] [pid 31778:tid 31794] [client 20.250.3.85:50362] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTf3w3kybI2o-xasmDJugAAAcE"]
[Thu Mar 26 15:27:29.493662 2026] [:error] [pid 60829:tid 60854] [client 20.250.3.85:41355] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTf4fTdjHKeZokybaSUEAAAARc"]
[Thu Mar 26 15:27:30.381333 2026] [:error] [pid 31780:tid 31825] [client 20.250.3.85:4557] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTf4pJDwZsy5O4ZXEhbqAAAAgU"]
[Thu Mar 26 15:27:31.079404 2026] [:error] [pid 19818:tid 19821] [client 20.250.3.85:4339] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTf48zaSnm3d1BeM5WblAAAAME"]
[Thu Mar 26 15:27:32.813033 2026] [:error] [pid 19818:tid 19838] [client 20.250.3.85:4330] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTf5MzaSnm3d1BeM5WbngAAANI"]
[Thu Mar 26 15:27:34.263581 2026] [:error] [pid 31780:tid 31827] [client 20.250.3.85:40980] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTf5pJDwZsy5O4ZXEhbrAAAAgc"]
[Thu Mar 26 15:27:35.350097 2026] [:error] [pid 19818:tid 19823] [client 20.250.3.85:25209] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTf58zaSnm3d1BeM5WbpgAAAMM"]
[Thu Mar 26 15:27:36.423499 2026] [:error] [pid 31670:tid 31676] [client 20.250.3.85:34256] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTf6DXVthXxCnWjOTQlkgAAAUQ"]
[Thu Mar 26 15:27:38.880819 2026] [:error] [pid 19712:tid 19787] [client 20.250.3.85:22463] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTf6tWhKhRNqm23vFMJTAAAAIs"]
[Thu Mar 26 15:27:40.060504 2026] [:error] [pid 31670:tid 31673] [client 20.250.3.85:25161] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTf7DXVthXxCnWjOTQllQAAAUE"]
[Thu Mar 26 15:27:41.423658 2026] [:error] [pid 19818:tid 19830] [client 20.250.3.85:23438] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTf7czaSnm3d1BeM5WbqgAAAMo"]
[Thu Mar 26 15:27:42.575133 2026] [:error] [pid 31778:tid 31800] [client 20.250.3.85:4825] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTf7g3kybI2o-xasmDJ1QAAAcc"]
[Thu Mar 26 15:27:44.663823 2026] [:error] [pid 60829:tid 60849] [client 20.250.3.85:23432] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTf8PTdjHKeZokybaSUJwAAARI"]
[Thu Mar 26 15:27:46.289668 2026] [:error] [pid 31778:tid 31814] [client 20.250.3.85:52475] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTf8g3kybI2o-xasmDJ4QAAAdU"]
[Thu Mar 26 15:27:48.224900 2026] [:error] [pid 19818:tid 19843] [client 20.250.3.85:4986] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTf9MzaSnm3d1BeM5WbsAAAANc"]
[Thu Mar 26 15:27:49.063338 2026] [:error] [pid 31670:tid 31694] [client 20.250.3.85:51217] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTf9TXVthXxCnWjOTQlogAAAVY"]
[Thu Mar 26 15:27:50.043954 2026] [:error] [pid 19711:tid 19762] [client 20.250.3.85:51239] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTf9mj3l1y81GYfluR7WwAAAE0"]
[Thu Mar 26 15:27:51.329490 2026] [:error] [pid 31670:tid 31693] [client 20.250.3.85:41057] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTf9zXVthXxCnWjOTQlpAAAAVU"]
[Thu Mar 26 15:27:52.534656 2026] [:error] [pid 19818:tid 19839] [client 20.250.3.85:22420] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acTf-MzaSnm3d1BeM5WbvgAAANM"]
[Thu Mar 26 15:27:53.806894 2026] [:error] [pid 19818:tid 19826] [client 20.250.3.85:33705] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acTf-czaSnm3d1BeM5WbxwAAAMY"]
[Thu Mar 26 15:27:54.614704 2026] [:error] [pid 19818:tid 19843] [client 20.250.3.85:23426] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acTf-szaSnm3d1BeM5WbzQAAANc"]
[Thu Mar 26 15:27:55.389055 2026] [:error] [pid 60829:tid 60847] [client 20.250.3.85:50318] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acTf-_TdjHKeZokybaSUOgAAARA"]
[Thu Mar 26 15:27:56.107388 2026] [:error] [pid 31778:tid 31810] [client 20.250.3.85:40996] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acTf_A3kybI2o-xasmDJ8QAAAdE"]
[Thu Mar 26 15:27:56.976342 2026] [:error] [pid 31670:tid 31672] [client 20.250.3.85:50312] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acTf_DXVthXxCnWjOTQlpwAAAUA"]
[Thu Mar 26 15:27:57.752571 2026] [:error] [pid 19711:tid 19758] [client 20.250.3.85:52474] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acTf_Wj3l1y81GYfluR7XQAAAEk"]
[Thu Mar 26 15:27:58.966746 2026] [:error] [pid 31780:tid 31844] [client 20.250.3.85:38157] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acTf_pJDwZsy5O4ZXEhb2gAAAhc"]
[Thu Mar 26 15:27:59.781351 2026] [:error] [pid 19818:tid 19836] [client 20.250.3.85:4951] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acTf_8zaSnm3d1BeM5Wb2gAAANA"]
[Thu Mar 26 15:28:01.681304 2026] [:error] [pid 31670:tid 31679] [client 20.250.3.85:51206] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acTgATXVthXxCnWjOTQlugAAAUc"]
[Thu Mar 26 15:28:02.954457 2026] [:error] [pid 31780:tid 31840] [client 20.250.3.85:51740] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acTgApJDwZsy5O4ZXEhb4QAAAhM"]
[Thu Mar 26 15:28:04.384710 2026] [:error] [pid 31780:tid 31835] [client 20.250.3.85:50352] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acTgBJJDwZsy5O4ZXEhb6wAAAg4"]
[Thu Mar 26 15:28:10.362514 2026] [:error] [pid 31780:tid 31833] [client 20.250.3.85:22424] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "acTgCpJDwZsy5O4ZXEhb8wAAAgw"]
[Thu Mar 26 15:28:14.643628 2026] [proxy_fcgi:error] [pid 31670:tid 31694] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:14.912191 2026] [proxy_fcgi:error] [pid 31670:tid 31685] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:15.167079 2026] [proxy_fcgi:error] [pid 31670:tid 31687] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:15.452830 2026] [proxy_fcgi:error] [pid 31670:tid 31684] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:15.721675 2026] [proxy_fcgi:error] [pid 31670:tid 31688] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:16.017792 2026] [proxy_fcgi:error] [pid 31670:tid 31675] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:16.288651 2026] [proxy_fcgi:error] [pid 31670:tid 31693] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:16.546607 2026] [proxy_fcgi:error] [pid 31670:tid 31686] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:16.788802 2026] [proxy_fcgi:error] [pid 31670:tid 31672] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:17.071459 2026] [proxy_fcgi:error] [pid 31670:tid 31674] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:17.354775 2026] [proxy_fcgi:error] [pid 31670:tid 31687] [client 20.250.3.85:4545] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:17.662205 2026] [:error] [pid 31670:tid 31681] [client 20.250.3.85:4545] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/juuuu.php"] [unique_id "acTgETXVthXxCnWjOTQl5wAAAUk"]
[Thu Mar 26 15:28:19.595086 2026] [proxy_fcgi:error] [pid 19818:tid 19837] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:19.861851 2026] [proxy_fcgi:error] [pid 19818:tid 19841] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:20.131431 2026] [proxy_fcgi:error] [pid 19818:tid 19836] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:20.419274 2026] [proxy_fcgi:error] [pid 19818:tid 19831] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:20.685932 2026] [proxy_fcgi:error] [pid 19818:tid 19824] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:20.954594 2026] [proxy_fcgi:error] [pid 19818:tid 19821] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:21.290825 2026] [proxy_fcgi:error] [pid 19818:tid 19827] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:21.676653 2026] [proxy_fcgi:error] [pid 19818:tid 19834] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:22.065739 2026] [proxy_fcgi:error] [pid 19818:tid 19842] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:22.474700 2026] [proxy_fcgi:error] [pid 19818:tid 19823] [client 20.240.134.170:64731] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:28:22.878898 2026] [:error] [pid 19818:tid 19844] [client 20.240.134.170:64731] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTgFszaSnm3d1BeM5WcIwAAANg"]
[Thu Mar 26 15:28:23.790736 2026] [:error] [pid 31780:tid 31841] [client 20.240.134.170:64971] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTgF5JDwZsy5O4ZXEhb_wAAAhQ"]
[Thu Mar 26 15:28:24.703917 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:64251] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTgGMzaSnm3d1BeM5WcJwAAAMQ"]
[Thu Mar 26 15:28:25.495816 2026] [:error] [pid 19818:tid 19826] [client 20.240.134.170:63590] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zcsu.php"] [unique_id "acTgGczaSnm3d1BeM5WcLgAAAMY"]
[Thu Mar 26 15:28:26.496060 2026] [:error] [pid 31778:tid 31804] [client 20.240.134.170:64649] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTgGg3kybI2o-xasmDKDwAAAcs"]
[Thu Mar 26 15:28:27.872165 2026] [:error] [pid 19710:tid 19743] [client 20.240.134.170:64649] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTgGwVEWP8Ar68Njk7lbQAAABU"]
[Thu Mar 26 15:28:29.868729 2026] [:error] [pid 31717:tid 31741] [client 20.240.134.170:63885] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTgHb-SCF7YDISDX4_ChAAAAZM"]
[Thu Mar 26 15:28:30.943634 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:64709] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acTgHjXVthXxCnWjOTQl-QAAAUQ"]
[Thu Mar 26 15:28:31.853290 2026] [:error] [pid 31717:tid 31729] [client 20.240.134.170:65332] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTgH7-SCF7YDISDX4_CiQAAAYc"]
[Thu Mar 26 15:28:32.945574 2026] [:error] [pid 19818:tid 19832] [client 20.240.134.170:64409] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTgIMzaSnm3d1BeM5WcSAAAAMw"]
[Thu Mar 26 15:28:35.288296 2026] [:error] [pid 19818:tid 19820] [client 20.250.3.85:56696] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nox.php"] [unique_id "acTgI8zaSnm3d1BeM5WcUQAAAMA"]
[Thu Mar 26 15:28:35.554036 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:64439] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTgIzXVthXxCnWjOTQmBQAAAUQ"]
[Thu Mar 26 15:28:36.325040 2026] [:error] [pid 19818:tid 19843] [client 20.250.3.85:27203] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nox.php"] [unique_id "acTgJMzaSnm3d1BeM5WcWAAAANc"]
[Thu Mar 26 15:28:36.546922 2026] [:error] [pid 31780:tid 31843] [client 20.240.134.170:64424] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acTgJJJDwZsy5O4ZXEhcCwAAAhY"]
[Thu Mar 26 15:28:37.329877 2026] [:error] [pid 31670:tid 31679] [client 20.250.3.85:56654] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nox.php"] [unique_id "acTgJTXVthXxCnWjOTQmCQAAAUc"]
[Thu Mar 26 15:28:38.094572 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:63951] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTgJszaSnm3d1BeM5WcYwAAAMQ"]
[Thu Mar 26 15:28:38.383312 2026] [:error] [pid 60829:tid 60838] [client 20.250.3.85:43268] [client 20.250.3.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nox.php"] [unique_id "acTgJvTdjHKeZokybaSUYgAAAQc"]
[Thu Mar 26 15:28:39.174898 2026] [:error] [pid 31778:tid 31803] [client 20.240.134.170:65119] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTgJw3kybI2o-xasmDKJQAAAco"]
[Thu Mar 26 15:28:40.627778 2026] [:error] [pid 19818:tid 19842] [client 20.240.134.170:63953] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTgKMzaSnm3d1BeM5WceQAAANY"]
[Thu Mar 26 15:28:41.371813 2026] [:error] [pid 19818:tid 19826] [client 20.240.134.170:64656] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acTgKczaSnm3d1BeM5WcfgAAAMY"]
[Thu Mar 26 15:28:42.415249 2026] [:error] [pid 19818:tid 19838] [client 20.240.134.170:64701] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTgKszaSnm3d1BeM5WciQAAANI"]
[Thu Mar 26 15:28:43.612554 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:64936] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTgKzXVthXxCnWjOTQmGQAAAUU"]
[Thu Mar 26 15:28:44.852960 2026] [:error] [pid 31670:tid 31683] [client 20.240.134.170:64918] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTgLDXVthXxCnWjOTQmJQAAAUs"]
[Thu Mar 26 15:28:45.634591 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:64725] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acTgLfTdjHKeZokybaSUZAAAAQ0"]
[Thu Mar 26 15:28:46.744198 2026] [:error] [pid 60829:tid 60847] [client 20.240.134.170:64252] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTgLvTdjHKeZokybaSUZwAAARA"]
[Thu Mar 26 15:28:47.603147 2026] [:error] [pid 31717:tid 31744] [client 20.240.134.170:63962] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTgL7-SCF7YDISDX4_CkgAAAZY"]
[Thu Mar 26 15:28:48.505896 2026] [:error] [pid 31780:tid 31830] [client 20.240.134.170:64146] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTgMJJDwZsy5O4ZXEhcHwAAAgk"]
[Thu Mar 26 15:28:49.611821 2026] [:error] [pid 31778:tid 31797] [client 20.240.134.170:64385] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acTgMQ3kybI2o-xasmDKKAAAAcQ"]
[Thu Mar 26 15:28:50.653839 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:65123] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTgMvTdjHKeZokybaSUcgAAARI"]
[Thu Mar 26 15:28:51.760496 2026] [:error] [pid 60829:tid 60842] [client 20.240.134.170:64738] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTgM_TdjHKeZokybaSUeAAAAQs"]
[Thu Mar 26 15:28:52.795694 2026] [:error] [pid 31778:tid 31800] [client 20.240.134.170:64719] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTgNA3kybI2o-xasmDKMAAAAcc"]
[Thu Mar 26 15:28:53.657937 2026] [:error] [pid 60829:tid 60834] [client 20.240.134.170:64761] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTgNfTdjHKeZokybaSUfwAAAQM"]
[Thu Mar 26 15:28:54.567026 2026] [:error] [pid 19710:tid 19726] [client 20.240.134.170:64715] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTgNgVEWP8Ar68Njk7lfgAAAAQ"]
[Thu Mar 26 15:28:55.248571 2026] [:error] [pid 31780:tid 31835] [client 20.240.134.170:63587] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTgN5JDwZsy5O4ZXEhcLgAAAg4"]
[Thu Mar 26 15:28:56.110483 2026] [:error] [pid 31778:tid 31802] [client 20.240.134.170:64950] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTgOA3kybI2o-xasmDKPQAAAck"]
[Thu Mar 26 15:28:57.072725 2026] [:error] [pid 31778:tid 31798] [client 20.240.134.170:65104] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acTgOQ3kybI2o-xasmDKQgAAAcU"]
[Thu Mar 26 15:28:57.873758 2026] [:error] [pid 19818:tid 19841] [client 20.240.134.170:64907] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acTgOczaSnm3d1BeM5WcngAAANU"]
[Thu Mar 26 15:28:58.669595 2026] [:error] [pid 31778:tid 31797] [client 20.240.134.170:64728] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acTgOg3kybI2o-xasmDKTAAAAcQ"]
[Thu Mar 26 15:28:59.579828 2026] [:error] [pid 31778:tid 31805] [client 20.240.134.170:64959] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acTgOw3kybI2o-xasmDKUgAAAcw"]
[Thu Mar 26 15:29:00.786090 2026] [:error] [pid 19818:tid 19835] [client 20.240.134.170:63922] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acTgPMzaSnm3d1BeM5WcowAAAM8"]
[Thu Mar 26 15:29:03.543984 2026] [:error] [pid 19818:tid 19830] [client 20.240.134.170:63552] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acTgP8zaSnm3d1BeM5WcuAAAAMo"]
[Thu Mar 26 15:29:04.342094 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:64247] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acTgQDXVthXxCnWjOTQmRwAAAUA"]
[Thu Mar 26 15:29:05.252536 2026] [:error] [pid 31670:tid 31688] [client 20.240.134.170:63589] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acTgQTXVthXxCnWjOTQmTgAAAVA"]
[Thu Mar 26 15:29:07.597338 2026] [:error] [pid 31780:tid 31835] [client 20.240.134.170:64432] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acTgQ5JDwZsy5O4ZXEhcNQAAAg4"]
[Thu Mar 26 15:29:08.994930 2026] [:error] [pid 60829:tid 60841] [client 20.240.134.170:63968] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acTgRPTdjHKeZokybaSUjwAAAQo"]
[Thu Mar 26 15:29:09.892389 2026] [:error] [pid 31778:tid 31795] [client 20.240.134.170:62676] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acTgRQ3kybI2o-xasmDKYQAAAcI"]
[Thu Mar 26 15:29:10.680397 2026] [:error] [pid 31778:tid 31810] [client 20.240.134.170:63933] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acTgRg3kybI2o-xasmDKaAAAAdE"]
[Thu Mar 26 15:29:11.865024 2026] [:error] [pid 31717:tid 31730] [client 20.240.134.170:64131] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "acTgR7-SCF7YDISDX4_CuQAAAYg"]
[Thu Mar 26 15:29:13.925800 2026] [:error] [pid 31670:tid 31690] [client 20.240.134.170:64737] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acTgSTXVthXxCnWjOTQmagAAAVI"]
[Thu Mar 26 15:29:14.799344 2026] [:error] [pid 19712:tid 19788] [client 20.240.134.170:64693] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acTgStWhKhRNqm23vFMJawAAAIw"]
[Thu Mar 26 15:29:16.346577 2026] [:error] [pid 31780:tid 31821] [client 20.240.134.170:64458] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acTgTJJDwZsy5O4ZXEhcSQAAAgE"]
[Thu Mar 26 15:29:17.189730 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:64403] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acTgTfTdjHKeZokybaSUlgAAARI"]
[Thu Mar 26 15:29:18.290607 2026] [:error] [pid 60829:tid 60842] [client 20.240.134.170:64916] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acTgTvTdjHKeZokybaSUmQAAAQs"]
[Thu Mar 26 15:29:19.073327 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:64168] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acTgT_TdjHKeZokybaSUmgAAAQ0"]
[Thu Mar 26 15:29:19.889502 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:64464] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acTgTzXVthXxCnWjOTQmdQAAAUM"]
[Thu Mar 26 15:29:20.654588 2026] [:error] [pid 31670:tid 31691] [client 20.240.134.170:64423] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acTgUDXVthXxCnWjOTQmeAAAAVM"]
[Thu Mar 26 15:29:21.535524 2026] [:error] [pid 19818:tid 19842] [client 20.240.134.170:63941] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acTgUczaSnm3d1BeM5WczgAAANY"]
[Thu Mar 26 15:29:22.481768 2026] [proxy_fcgi:error] [pid 31778:tid 31793] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:22.855115 2026] [proxy_fcgi:error] [pid 31778:tid 31809] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:23.231779 2026] [proxy_fcgi:error] [pid 31778:tid 31798] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:23.500013 2026] [proxy_fcgi:error] [pid 31778:tid 31802] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:23.768202 2026] [proxy_fcgi:error] [pid 31778:tid 31806] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:24.463047 2026] [proxy_fcgi:error] [pid 31778:tid 31793] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:25.106839 2026] [proxy_fcgi:error] [pid 31778:tid 31817] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:25.419159 2026] [proxy_fcgi:error] [pid 31778:tid 31803] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:25.770565 2026] [proxy_fcgi:error] [pid 31778:tid 31804] [client 20.240.134.170:64173] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:29:26.033680 2026] [:error] [pid 31778:tid 31806] [client 20.240.134.170:64173] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTgVg3kybI2o-xasmDKmgAAAc0"]
[Thu Mar 26 15:29:28.138536 2026] [:error] [pid 19710:tid 19738] [client 20.240.134.170:64181] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTgWAVEWP8Ar68Njk7ljAAAABA"]
[Thu Mar 26 15:29:28.950662 2026] [:error] [pid 19710:tid 19744] [client 20.240.134.170:63571] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTgWAVEWP8Ar68Njk7ljQAAABY"]
[Thu Mar 26 15:29:30.494911 2026] [:error] [pid 19818:tid 19841] [client 20.240.134.170:63927] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "acTgWszaSnm3d1BeM5Wc7QAAANU"]
[Thu Mar 26 15:29:31.177831 2026] [:error] [pid 19818:tid 19844] [client 20.240.134.170:64250] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTgW8zaSnm3d1BeM5Wc8gAAANg"]
[Thu Mar 26 15:29:31.917000 2026] [:error] [pid 19712:tid 19798] [client 20.240.134.170:64922] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTgW9WhKhRNqm23vFMJeQAAAJY"]
[Thu Mar 26 15:29:32.701448 2026] [:error] [pid 31670:tid 31692] [client 20.240.134.170:64155] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTgXDXVthXxCnWjOTQmhAAAAVQ"]
[Thu Mar 26 15:29:33.705942 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:64203] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "acTgXfTdjHKeZokybaSUowAAARI"]
[Thu Mar 26 15:29:34.527274 2026] [:error] [pid 31780:tid 31832] [client 20.240.134.170:65318] [client 20.240.134.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "acTgXpJDwZsy5O4ZXEhcUwAAAgs"]
[Thu Mar 26 15:29:35.208499 2026] [:error] [pid 31780:tid 31830] [client 20.240.134.170:65280] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTgX5JDwZsy5O4ZXEhcVAAAAgk"]
[Thu Mar 26 15:29:36.256970 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:64706] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTgYMzaSnm3d1BeM5WdCgAAAMQ"]
[Thu Mar 26 15:29:37.361358 2026] [:error] [pid 31670:tid 31685] [client 20.240.134.170:64724] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTgYTXVthXxCnWjOTQmjwAAAU0"]
[Thu Mar 26 15:29:38.103457 2026] [:error] [pid 19818:tid 19841] [client 20.240.134.170:63899] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acTgYszaSnm3d1BeM5WdDgAAANU"]
[Thu Mar 26 15:29:39.376190 2026] [:error] [pid 19712:tid 19796] [client 20.240.134.170:63955] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTgY9WhKhRNqm23vFMJewAAAJQ"]
[Thu Mar 26 15:29:43.906075 2026] [:error] [pid 19712:tid 19800] [client 20.240.134.170:63591] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTgZ9WhKhRNqm23vFMJfwAAAJg"]
[Thu Mar 26 15:29:47.110762 2026] [:error] [pid 19712:tid 19776] [client 20.240.134.170:63579] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTga9WhKhRNqm23vFMJgQAAAIA"]
[Thu Mar 26 15:29:47.956067 2026] [:error] [pid 60829:tid 60838] [client 20.240.134.170:64942] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "acTga_TdjHKeZokybaSUrAAAAQc"]
[Thu Mar 26 15:30:36.675449 2026] [proxy_fcgi:error] [pid 19712:tid 19799] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:36.943292 2026] [proxy_fcgi:error] [pid 19712:tid 19789] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:37.210405 2026] [proxy_fcgi:error] [pid 19712:tid 19783] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:37.480037 2026] [proxy_fcgi:error] [pid 19712:tid 19785] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:37.866049 2026] [proxy_fcgi:error] [pid 19712:tid 19796] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:38.219767 2026] [proxy_fcgi:error] [pid 19712:tid 19792] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:38.486409 2026] [proxy_fcgi:error] [pid 19712:tid 19784] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:38.826836 2026] [proxy_fcgi:error] [pid 19712:tid 19797] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:39.252150 2026] [proxy_fcgi:error] [pid 19712:tid 19794] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:39.552876 2026] [proxy_fcgi:error] [pid 19712:tid 19790] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:39.823183 2026] [proxy_fcgi:error] [pid 19712:tid 19776] [client 20.240.134.170:64910] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:30:40.225249 2026] [:error] [pid 19712:tid 19780] [client 20.240.134.170:64910] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTgoNWhKhRNqm23vFMJnQAAAIQ"]
[Thu Mar 26 15:30:41.173032 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:64243] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTgoTXVthXxCnWjOTQnigAAAVE"]
[Thu Mar 26 15:30:42.155420 2026] [:error] [pid 31780:tid 31834] [client 20.240.134.170:63931] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTgopJDwZsy5O4ZXEhcxgAAAg0"]
[Thu Mar 26 15:30:43.443076 2026] [:error] [pid 19711:tid 19758] [client 20.240.134.170:64195] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "acTgo2j3l1y81GYfluR7ngAAAEk"]
[Thu Mar 26 15:30:44.606248 2026] [:error] [pid 19818:tid 19842] [client 20.240.134.170:65330] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTgpMzaSnm3d1BeM5Wd3wAAANY"]
[Thu Mar 26 15:30:45.285719 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:64392] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTgpczaSnm3d1BeM5Wd4QAAAMU"]
[Thu Mar 26 15:30:46.582751 2026] [:error] [pid 31780:tid 31829] [client 20.240.134.170:63930] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTgppJDwZsy5O4ZXEhczQAAAgg"]
[Thu Mar 26 15:30:47.801474 2026] [:error] [pid 31780:tid 31839] [client 20.240.134.170:63499] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acTgp5JDwZsy5O4ZXEhc0AAAAhI"]
[Thu Mar 26 15:30:49.046262 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:63302] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTgqfTdjHKeZokybaSU5QAAARI"]
[Thu Mar 26 15:30:52.605597 2026] [:error] [pid 60829:tid 60851] [client 20.240.134.170:63494] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTgrPTdjHKeZokybaSU6gAAARQ"]
[Thu Mar 26 15:30:54.374750 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:64459] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTgrjXVthXxCnWjOTQnogAAAVE"]
[Thu Mar 26 15:30:55.500717 2026] [:error] [pid 19710:tid 19742] [client 20.240.134.170:63592] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acTgrwVEWP8Ar68Njk7ltwAAABQ"]
[Thu Mar 26 15:30:56.875771 2026] [:error] [pid 31670:tid 31696] [client 20.240.134.170:64457] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTgsDXVthXxCnWjOTQnpgAAAVg"]
[Thu Mar 26 15:30:58.066575 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:64229] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTgsjXVthXxCnWjOTQnrQAAAVc"]
[Thu Mar 26 15:30:59.003542 2026] [:error] [pid 31717:tid 31727] [client 20.240.134.170:64765] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTgs7-SCF7YDISDX4_DBgAAAYU"]
[Thu Mar 26 15:31:00.100095 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:64673] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acTgtMzaSnm3d1BeM5Wd9AAAAME"]
[Thu Mar 26 15:31:02.384868 2026] [:error] [pid 31780:tid 31821] [client 20.240.134.170:64672] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTgtpJDwZsy5O4ZXEhc3wAAAgE"]
[Thu Mar 26 15:31:05.293407 2026] [:error] [pid 31670:tid 31687] [client 20.240.134.170:64726] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTguTXVthXxCnWjOTQnuQAAAU8"]
[Thu Mar 26 15:31:06.265149 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:64984] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTguszaSnm3d1BeM5WeGQAAAMI"]
[Thu Mar 26 15:31:07.917414 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:62690] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acTguzXVthXxCnWjOTQnxQAAAU4"]
[Thu Mar 26 15:31:09.866314 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:64503] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTgvTXVthXxCnWjOTQnzAAAAVc"]
[Thu Mar 26 15:31:11.173375 2026] [:error] [pid 31717:tid 31735] [client 20.240.134.170:65355] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTgv7-SCF7YDISDX4_DCgAAAY0"]
[Thu Mar 26 15:31:12.569315 2026] [:error] [pid 19712:tid 19782] [client 20.240.134.170:63495] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTgwNWhKhRNqm23vFMJoQAAAIY"]
[Thu Mar 26 15:31:13.667314 2026] [:error] [pid 31780:tid 31831] [client 20.240.134.170:64216] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acTgwZJDwZsy5O4ZXEhc6wAAAgo"]
[Thu Mar 26 15:31:14.512213 2026] [:error] [pid 31780:tid 31844] [client 20.240.134.170:65395] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTgwpJDwZsy5O4ZXEhc7wAAAhc"]
[Thu Mar 26 15:31:15.543952 2026] [:error] [pid 31717:tid 31730] [client 20.240.134.170:65311] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTgw7-SCF7YDISDX4_DEQAAAYg"]
[Thu Mar 26 15:31:16.609915 2026] [:error] [pid 31778:tid 31804] [client 20.240.134.170:63878] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTgxA3kybI2o-xasmDK7AAAAcs"]
[Thu Mar 26 15:31:17.400880 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:64481] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "acTgxczaSnm3d1BeM5WeKgAAAM4"]
[Thu Mar 26 15:31:18.321247 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:64763] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTgxjXVthXxCnWjOTQn1AAAAUM"]
[Thu Mar 26 15:31:19.664911 2026] [:error] [pid 19712:tid 19796] [client 20.240.134.170:65327] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTgx9WhKhRNqm23vFMJpAAAAJQ"]
[Thu Mar 26 15:31:21.269736 2026] [:error] [pid 31670:tid 31693] [client 20.240.134.170:65348] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTgyTXVthXxCnWjOTQn2wAAAVU"]
[Thu Mar 26 15:31:22.590860 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:63993] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "acTgyszaSnm3d1BeM5WeNwAAAMI"]
[Thu Mar 26 15:31:24.257440 2026] [:error] [pid 19818:tid 19836] [client 20.240.134.170:64754] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTgzMzaSnm3d1BeM5WeQwAAANA"]
[Thu Mar 26 15:31:26.222951 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:65126] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTgzszaSnm3d1BeM5WeTgAAAMI"]
[Thu Mar 26 15:31:29.607779 2026] [:error] [pid 31780:tid 31839] [client 20.240.134.170:62643] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTg0ZJDwZsy5O4ZXEhc-gAAAhI"]
[Thu Mar 26 15:31:30.745299 2026] [:error] [pid 31780:tid 31833] [client 20.240.134.170:64667] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/privacy.php"] [unique_id "acTg0pJDwZsy5O4ZXEhc_AAAAgw"]
[Thu Mar 26 15:31:32.157421 2026] [:error] [pid 19818:tid 19826] [client 20.240.134.170:64474] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acTg1MzaSnm3d1BeM5WeXAAAAMY"]
[Thu Mar 26 15:31:33.356207 2026] [:error] [pid 19818:tid 19836] [client 20.240.134.170:63958] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acTg1czaSnm3d1BeM5WeZAAAANA"]
[Thu Mar 26 15:31:34.288868 2026] [:error] [pid 19818:tid 19820] [client 20.240.134.170:63059] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acTg1szaSnm3d1BeM5WebAAAAMA"]
[Thu Mar 26 15:31:35.248387 2026] [:error] [pid 31780:tid 31842] [client 20.240.134.170:63309] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "acTg15JDwZsy5O4ZXEhdAQAAAhU"]
[Thu Mar 26 15:31:36.456839 2026] [:error] [pid 60829:tid 60841] [client 20.240.134.170:64690] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gm.php"] [unique_id "acTg2PTdjHKeZokybaSVCQAAAQo"]
[Thu Mar 26 15:31:37.766379 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:63910] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gm.php"] [unique_id "acTg2czaSnm3d1BeM5WedgAAAM4"]
[Thu Mar 26 15:31:38.776597 2026] [:error] [pid 19818:tid 19830] [client 20.240.134.170:64679] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gm.php"] [unique_id "acTg2szaSnm3d1BeM5WedwAAAMo"]
[Thu Mar 26 15:31:40.402034 2026] [proxy_fcgi:error] [pid 19710:tid 19722] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:40.669171 2026] [proxy_fcgi:error] [pid 19710:tid 19725] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:41.016010 2026] [proxy_fcgi:error] [pid 19710:tid 19738] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:41.462925 2026] [proxy_fcgi:error] [pid 19710:tid 19740] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:41.820752 2026] [proxy_fcgi:error] [pid 19710:tid 19733] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:42.154102 2026] [proxy_fcgi:error] [pid 19710:tid 19743] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:42.465688 2026] [proxy_fcgi:error] [pid 19710:tid 19730] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:42.806730 2026] [proxy_fcgi:error] [pid 19710:tid 19744] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:43.176181 2026] [proxy_fcgi:error] [pid 19710:tid 19728] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:43.445430 2026] [proxy_fcgi:error] [pid 19710:tid 19731] [client 20.240.134.170:65015] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:31:44.153122 2026] [:error] [pid 19710:tid 19723] [client 20.240.134.170:65015] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTg4AVEWP8Ar68Njk7l1AAAAAE"]
[Thu Mar 26 15:31:45.610171 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:64692] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTg4TXVthXxCnWjOTQoAQAAAU4"]
[Thu Mar 26 15:31:46.725352 2026] [:error] [pid 31670:tid 31678] [client 20.240.134.170:64199] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTg4jXVthXxCnWjOTQoBwAAAUY"]
[Thu Mar 26 15:31:48.668796 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:64911] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "acTg5MzaSnm3d1BeM5WeewAAAMM"]
[Thu Mar 26 15:31:50.287571 2026] [:error] [pid 19710:tid 19724] [client 20.240.134.170:64139] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTg5gVEWP8Ar68Njk7l1QAAAAI"]
[Thu Mar 26 15:31:51.570432 2026] [:error] [pid 31778:tid 31814] [client 20.240.134.170:64729] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTg5w3kybI2o-xasmDLDwAAAdU"]
[Thu Mar 26 15:31:52.499308 2026] [:error] [pid 19712:tid 19780] [client 20.240.134.170:64200] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTg6NWhKhRNqm23vFMJqQAAAIQ"]
[Thu Mar 26 15:31:55.200331 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:65333] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acTg6zXVthXxCnWjOTQoFgAAAUc"]
[Thu Mar 26 15:31:56.008265 2026] [:error] [pid 31670:tid 31694] [client 20.240.134.170:65127] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTg7DXVthXxCnWjOTQoGgAAAVY"]
[Thu Mar 26 15:31:57.157054 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:64422] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTg7TXVthXxCnWjOTQoHwAAAUM"]
[Thu Mar 26 15:31:58.872542 2026] [:error] [pid 19818:tid 19844] [client 20.240.134.170:64404] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTg7szaSnm3d1BeM5WeiAAAANg"]
[Thu Mar 26 15:32:00.677745 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:64749] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "acTg8MzaSnm3d1BeM5WejAAAAMk"]
[Thu Mar 26 15:32:01.833845 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:65402] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTg8czaSnm3d1BeM5WemgAAANQ"]
[Thu Mar 26 15:32:03.162554 2026] [:error] [pid 31670:tid 31682] [client 20.240.134.170:64152] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTg8zXVthXxCnWjOTQoJQAAAUo"]
[Thu Mar 26 15:32:05.399527 2026] [:error] [pid 31670:tid 31680] [client 20.240.134.170:64658] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTg9TXVthXxCnWjOTQoLQAAAUg"]
[Thu Mar 26 15:32:06.575647 2026] [:error] [pid 19818:tid 19835] [client 20.240.134.170:65096] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acTg9szaSnm3d1BeM5WeqAAAAM8"]
[Thu Mar 26 15:32:07.660822 2026] [:error] [pid 60829:tid 60845] [client 20.240.134.170:63609] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTg9_TdjHKeZokybaSVKQAAAQ4"]
[Thu Mar 26 15:32:08.736266 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:65092] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTg-MzaSnm3d1BeM5WesAAAAMU"]
[Thu Mar 26 15:32:09.766835 2026] [:error] [pid 31780:tid 31844] [client 20.240.134.170:63602] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTg-ZJDwZsy5O4ZXEhdGgAAAhc"]
[Thu Mar 26 15:32:10.507977 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:64752] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "acTg-pJDwZsy5O4ZXEhdHgAAAgI"]
[Thu Mar 26 15:32:11.674648 2026] [:error] [pid 31670:tid 31693] [client 20.240.134.170:65319] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTg-zXVthXxCnWjOTQoOgAAAVU"]
[Thu Mar 26 15:32:12.444700 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:64686] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTg_MzaSnm3d1BeM5WetgAAAMM"]
[Thu Mar 26 15:32:13.464044 2026] [:error] [pid 19712:tid 19779] [client 20.240.134.170:65380] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTg_dWhKhRNqm23vFMJtgAAAIM"]
[Thu Mar 26 15:32:14.372954 2026] [:error] [pid 19711:tid 19766] [client 20.240.134.170:64912] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acTg_mj3l1y81GYfluR7wgAAAFE"]
[Thu Mar 26 15:32:15.704209 2026] [:error] [pid 31780:tid 31844] [client 20.240.134.170:65394] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acTg_5JDwZsy5O4ZXEhdIQAAAhc"]
[Thu Mar 26 15:32:16.633133 2026] [:error] [pid 60829:tid 60835] [client 20.240.134.170:64507] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acThAPTdjHKeZokybaSVLQAAAQQ"]
[Thu Mar 26 15:32:17.421685 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:64994] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acThATXVthXxCnWjOTQoPwAAAVc"]
[Thu Mar 26 15:32:18.311728 2026] [:error] [pid 19818:tid 19830] [client 20.240.134.170:64475] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acThAszaSnm3d1BeM5WeyQAAAMo"]
[Thu Mar 26 15:32:19.185411 2026] [:error] [pid 19818:tid 19827] [client 20.240.134.170:64198] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acThA8zaSnm3d1BeM5WezwAAAMc"]
[Thu Mar 26 15:32:20.074944 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:63889] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acThBJJDwZsy5O4ZXEhdKgAAAg8"]
[Thu Mar 26 15:32:20.974944 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:63932] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acThBJJDwZsy5O4ZXEhdLQAAAgQ"]
[Thu Mar 26 15:32:22.546930 2026] [:error] [pid 31670:tid 31691] [client 20.240.134.170:64732] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acThBjXVthXxCnWjOTQoSQAAAVM"]
[Thu Mar 26 15:32:23.710005 2026] [:error] [pid 19710:tid 19744] [client 20.240.134.170:64945] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acThBwVEWP8Ar68Njk7l5AAAABY"]
[Thu Mar 26 15:32:24.671697 2026] [:error] [pid 31670:tid 31680] [client 20.240.134.170:65309] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acThCDXVthXxCnWjOTQoTgAAAUg"]
[Thu Mar 26 15:32:26.594861 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:64505] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acThCszaSnm3d1BeM5We2QAAAMs"]
[Thu Mar 26 15:32:27.427586 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:65343] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acThC8zaSnm3d1BeM5We2wAAANc"]
[Thu Mar 26 15:32:28.223308 2026] [:error] [pid 31670:tid 31680] [client 20.240.134.170:64698] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "acThDDXVthXxCnWjOTQoWAAAAUg"]
[Thu Mar 26 15:32:29.684902 2026] [:error] [pid 60829:tid 60845] [client 20.240.134.170:63570] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "acThDfTdjHKeZokybaSVNQAAAQ4"]
[Thu Mar 26 15:32:30.897726 2026] [:error] [pid 31670:tid 31690] [client 20.240.134.170:64144] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "acThDjXVthXxCnWjOTQoWQAAAVI"]
[Thu Mar 26 15:32:31.911980 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:63584] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filesss.php"] [unique_id "acThD8zaSnm3d1BeM5We3wAAANQ"]
[Thu Mar 26 15:32:33.583986 2026] [:error] [pid 31717:tid 31740] [client 20.240.134.170:64660] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "acThEb-SCF7YDISDX4_DMQAAAZI"]
[Thu Mar 26 15:32:37.162966 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:64655] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "acThFczaSnm3d1BeM5We6AAAAMM"]
[Thu Mar 26 15:33:37.715631 2026] [proxy_fcgi:error] [pid 31778:tid 31801] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:38.049308 2026] [proxy_fcgi:error] [pid 31778:tid 31802] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:38.508850 2026] [proxy_fcgi:error] [pid 31778:tid 31804] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:38.820946 2026] [proxy_fcgi:error] [pid 31778:tid 31806] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:39.191368 2026] [proxy_fcgi:error] [pid 31778:tid 31797] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:39.457684 2026] [proxy_fcgi:error] [pid 31778:tid 31794] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:39.724902 2026] [proxy_fcgi:error] [pid 31778:tid 31807] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:40.128062 2026] [proxy_fcgi:error] [pid 31778:tid 31793] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:40.480636 2026] [proxy_fcgi:error] [pid 31778:tid 31814] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 15:33:40.802477 2026] [proxy_fcgi:error] [pid 31778:tid 31809] [client 20.240.134.170:64407] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 16:08:18.370177 2026] [:error] [pid 31780:tid 31841] [client 148.72.173.105:53063] [client 148.72.173.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.173.105, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acTpcpJDwZsy5O4ZXEhoMgAAAhQ"]
[Thu Mar 26 16:08:18.380144 2026] [proxy_fcgi:error] [pid 31780:tid 31841] [client 148.72.173.105:53063] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 17:12:20.022144 2026] [:error] [pid 31780:tid 31830] [client 182.42.111.213:49539] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acT4dJJDwZsy5O4ZXEh8LwAAAgk"]
[Thu Mar 26 18:59:17.315357 2026] [:error] [pid 31778:tid 31808] [client 45.15.128.171:56624] [client 45.15.128.171] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/x-ms-wmv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acURhQ3kybI2o-xasmD9cQAAAc8"]
[Thu Mar 26 18:59:17.315685 2026] [:error] [pid 31778:tid 31808] [client 45.15.128.171:56624] [client 45.15.128.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acURhQ3kybI2o-xasmD9cQAAAc8"]
[Thu Mar 26 19:59:57.459134 2026] [:error] [pid 31670:tid 31691] [client 49.51.52.250:58186] [client 49.51.52.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acUfvTXVthXxCnWjOTSr2gAAAVM"]
[Thu Mar 26 23:29:58.857453 2026] [:error] [pid 31670:tid 31682] [client 209.198.155.197:21481] [client 209.198.155.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.198.155.197, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acVQ9jXVthXxCnWjOTTw3gAAAUo"]
[Thu Mar 26 23:29:58.870070 2026] [proxy_fcgi:error] [pid 31670:tid 31682] [client 209.198.155.197:21481] AH01071: Got error 'Primary script unknown'
[Thu Mar 26 23:47:56.375715 2026] [:error] [pid 31717:tid 31734] [client 20.63.103.30:20752] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acVVLL-SCF7YDISDX48EwgAAAYw"]
[Thu Mar 26 23:47:57.203698 2026] [:error] [pid 19711:tid 19749] [client 20.63.103.30:20750] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acVVLWj3l1y81GYfluTn0QAAAEA"]
[Thu Mar 26 23:47:58.029546 2026] [:error] [pid 19711:tid 19759] [client 20.63.103.30:20923] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acVVLmj3l1y81GYfluTn1AAAAEo"]
[Thu Mar 26 23:47:58.863097 2026] [:error] [pid 31778:tid 31796] [client 20.63.103.30:20917] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acVVLg3kybI2o-xasmAw6QAAAcM"]
[Fri Mar 27 00:10:44.910838 2026] [proxy_fcgi:error] [pid 19711:tid 19750] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:45.177878 2026] [proxy_fcgi:error] [pid 19711:tid 19765] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:45.449187 2026] [proxy_fcgi:error] [pid 19711:tid 19749] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:45.708968 2026] [proxy_fcgi:error] [pid 19711:tid 19755] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:45.971289 2026] [proxy_fcgi:error] [pid 19711:tid 19771] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:46.235818 2026] [proxy_fcgi:error] [pid 19711:tid 19770] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:46.522940 2026] [proxy_fcgi:error] [pid 19711:tid 19768] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:46.783729 2026] [proxy_fcgi:error] [pid 19711:tid 19767] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:47.226101 2026] [proxy_fcgi:error] [pid 19711:tid 19751] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:47.485407 2026] [proxy_fcgi:error] [pid 19711:tid 19758] [client 20.215.248.112:46423] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:10:47.749367 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:46423] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acVah2j3l1y81GYfluTy-wAAAEE"]
[Fri Mar 27 00:10:48.776525 2026] [:error] [pid 19711:tid 19773] [client 20.215.248.112:46426] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acVaiGj3l1y81GYfluTy_wAAAFg"]
[Fri Mar 27 00:10:50.313508 2026] [:error] [pid 19710:tid 19722] [client 20.215.248.112:48608] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acVaigVEWP8Ar68Njk5bxgAAAAA"]
[Fri Mar 27 00:10:51.483852 2026] [:error] [pid 19712:tid 19796] [client 20.215.248.112:26249] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acVai9WhKhRNqm23vFNnVgAAAJQ"]
[Fri Mar 27 00:10:52.409184 2026] [:error] [pid 19712:tid 19788] [client 20.215.248.112:36227] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acVajNWhKhRNqm23vFNnWgAAAIw"]
[Fri Mar 27 00:10:53.123217 2026] [:error] [pid 19711:tid 19772] [client 20.215.248.112:8379] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acVajWj3l1y81GYfluTzBwAAAFc"]
[Fri Mar 27 00:10:53.718425 2026] [:error] [pid 19710:tid 19732] [client 20.215.248.112:26265] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acVajQVEWP8Ar68Njk5b0AAAAAo"]
[Fri Mar 27 00:10:54.563058 2026] [:error] [pid 19711:tid 19749] [client 20.215.248.112:27572] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cxs.php"] [unique_id "acVajmj3l1y81GYfluTzDAAAAEA"]
[Fri Mar 27 00:10:55.232108 2026] [:error] [pid 19710:tid 19743] [client 20.215.248.112:46368] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acVajwVEWP8Ar68Njk5b0wAAABU"]
[Fri Mar 27 00:10:56.050395 2026] [:error] [pid 19711:tid 19761] [client 20.215.248.112:8360] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acVakGj3l1y81GYfluTzEQAAAEw"]
[Fri Mar 27 00:10:56.714530 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:37699] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acVakAVEWP8Ar68Njk5b1QAAAAs"]
[Fri Mar 27 00:10:57.325907 2026] [:error] [pid 19818:tid 19832] [client 20.215.248.112:37758] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acVakczaSnm3d1BeM5VRZgAAAMw"]
[Fri Mar 27 00:10:58.081128 2026] [:error] [pid 31670:tid 31693] [client 20.215.248.112:8357] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acVakjXVthXxCnWjOTT8cgAAAVU"]
[Fri Mar 27 00:10:58.780894 2026] [:error] [pid 19710:tid 19737] [client 20.215.248.112:48590] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acVakgVEWP8Ar68Njk5b2gAAAA8"]
[Fri Mar 27 00:10:59.599729 2026] [:error] [pid 19710:tid 19738] [client 20.215.248.112:30806] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acVakwVEWP8Ar68Njk5b3gAAABA"]
[Fri Mar 27 00:11:00.475258 2026] [:error] [pid 19818:tid 19836] [client 20.215.248.112:27525] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acValMzaSnm3d1BeM5VRaAAAANA"]
[Fri Mar 27 00:11:01.247935 2026] [:error] [pid 19711:tid 19756] [client 20.215.248.112:23763] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acValWj3l1y81GYfluTzGQAAAEc"]
[Fri Mar 27 00:11:01.889464 2026] [:error] [pid 19711:tid 19754] [client 20.215.248.112:56549] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acValWj3l1y81GYfluTzHAAAAEU"]
[Fri Mar 27 00:11:02.772653 2026] [:error] [pid 19711:tid 19765] [client 20.215.248.112:29525] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acValmj3l1y81GYfluTzIAAAAFA"]
[Fri Mar 27 00:11:03.580177 2026] [:error] [pid 31780:tid 31823] [client 20.215.248.112:37748] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "acVal5JDwZsy5O4ZXEjb5gAAAgM"]
[Fri Mar 27 00:11:04.467261 2026] [:error] [pid 19711:tid 19772] [client 20.215.248.112:26255] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "acVamGj3l1y81GYfluTzJwAAAFc"]
[Fri Mar 27 00:11:05.288689 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:30802] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "acVamWj3l1y81GYfluTzKQAAAEE"]
[Fri Mar 27 00:11:05.976429 2026] [:error] [pid 19712:tid 19779] [client 20.215.248.112:24992] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "acVamdWhKhRNqm23vFNnZwAAAIM"]
[Fri Mar 27 00:11:07.251634 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:48627] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zz8.php"] [unique_id "acVamwVEWP8Ar68Njk5b6gAAAAs"]
[Fri Mar 27 00:11:08.258549 2026] [:error] [pid 19710:tid 19736] [client 20.215.248.112:30822] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acVanAVEWP8Ar68Njk5b8QAAAA4"]
[Fri Mar 27 00:11:08.978194 2026] [:error] [pid 19711:tid 19763] [client 20.215.248.112:23764] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acVanGj3l1y81GYfluTzNAAAAE4"]
[Fri Mar 27 00:11:09.856321 2026] [:error] [pid 31670:tid 31685] [client 20.215.248.112:48599] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acVanTXVthXxCnWjOTT8fgAAAU0"]
[Fri Mar 27 00:11:11.151601 2026] [:error] [pid 19711:tid 19768] [client 20.215.248.112:28208] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "acVan2j3l1y81GYfluTzPgAAAFM"]
[Fri Mar 27 00:11:11.825832 2026] [:error] [pid 19818:tid 19829] [client 20.215.248.112:48633] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "acVan8zaSnm3d1BeM5VRcwAAAMk"]
[Fri Mar 27 00:11:12.590293 2026] [:error] [pid 31780:tid 31830] [client 20.215.248.112:48591] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "acVaoJJDwZsy5O4ZXEjb6gAAAgk"]
[Fri Mar 27 00:11:13.378757 2026] [:error] [pid 31778:tid 31815] [client 20.215.248.112:3980] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "acVaoQ3kybI2o-xasmAzoQAAAdY"]
[Fri Mar 27 00:11:14.022022 2026] [:error] [pid 31717:tid 31735] [client 20.215.248.112:30824] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "acVaor-SCF7YDISDX48G7AAAAY0"]
[Fri Mar 27 00:11:14.943026 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:48622] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acVaomj3l1y81GYfluTzRAAAAEE"]
[Fri Mar 27 00:11:15.617117 2026] [:error] [pid 19712:tid 19792] [client 20.215.248.112:46348] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acVao9WhKhRNqm23vFNnawAAAJA"]
[Fri Mar 27 00:11:16.452277 2026] [:error] [pid 31670:tid 31678] [client 20.215.248.112:25007] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acVapDXVthXxCnWjOTT8hQAAAUY"]
[Fri Mar 27 00:11:17.255257 2026] [:error] [pid 19711:tid 19752] [client 20.215.248.112:45286] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpmini.php"] [unique_id "acVapWj3l1y81GYfluTzRwAAAEM"]
[Fri Mar 27 00:11:17.837835 2026] [:error] [pid 19711:tid 19756] [client 20.215.248.112:30797] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acVapWj3l1y81GYfluTzSwAAAEc"]
[Fri Mar 27 00:11:18.569855 2026] [:error] [pid 31670:tid 31676] [client 20.215.248.112:23774] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acVapjXVthXxCnWjOTT8iwAAAUQ"]
[Fri Mar 27 00:11:19.158915 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:48601] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acVap2j3l1y81GYfluTzTgAAAEE"]
[Fri Mar 27 00:11:19.948058 2026] [:error] [pid 31670:tid 31691] [client 20.215.248.112:53067] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "acVapzXVthXxCnWjOTT8kAAAAVM"]
[Fri Mar 27 00:11:20.935518 2026] [:error] [pid 31780:tid 31825] [client 20.215.248.112:3987] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbute.php"] [unique_id "acVaqJJDwZsy5O4ZXEjb7AAAAgU"]
[Fri Mar 27 00:11:21.976692 2026] [:error] [pid 19818:tid 19839] [client 20.215.248.112:23785] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbute.php"] [unique_id "acVaqczaSnm3d1BeM5VRiQAAANM"]
[Fri Mar 27 00:11:23.542702 2026] [:error] [pid 19818:tid 19832] [client 20.215.248.112:26260] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbute.php"] [unique_id "acVaq8zaSnm3d1BeM5VRjwAAAMw"]
[Fri Mar 27 00:11:24.984509 2026] [:error] [pid 19711:tid 19753] [client 20.215.248.112:31834] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tbute.php"] [unique_id "acVarGj3l1y81GYfluTzWgAAAEQ"]
[Fri Mar 27 00:11:26.387471 2026] [:error] [pid 19710:tid 19724] [client 20.215.248.112:37020] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acVargVEWP8Ar68Njk5b_AAAAAI"]
[Fri Mar 27 00:11:27.430929 2026] [:error] [pid 19818:tid 19829] [client 20.215.248.112:37708] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acVar8zaSnm3d1BeM5VRlQAAAMk"]
[Fri Mar 27 00:11:28.337706 2026] [:error] [pid 19710:tid 19726] [client 20.215.248.112:25014] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acVasAVEWP8Ar68Njk5b_wAAAAQ"]
[Fri Mar 27 00:11:29.230727 2026] [:error] [pid 19710:tid 19735] [client 20.215.248.112:46389] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rovoj.php"] [unique_id "acVasQVEWP8Ar68Njk5cBgAAAA0"]
[Fri Mar 27 00:11:30.469765 2026] [:error] [pid 19710:tid 19727] [client 20.215.248.112:53104] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r3grt7.php"] [unique_id "acVasgVEWP8Ar68Njk5cCAAAAAU"]
[Fri Mar 27 00:11:31.570046 2026] [:error] [pid 19710:tid 19745] [client 20.215.248.112:30836] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r3grt7.php"] [unique_id "acVaswVEWP8Ar68Njk5cDgAAABc"]
[Fri Mar 27 00:11:32.429583 2026] [:error] [pid 19818:tid 19834] [client 20.215.248.112:46397] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r3grt7.php"] [unique_id "acVatMzaSnm3d1BeM5VRlwAAAM4"]
[Fri Mar 27 00:11:33.908615 2026] [:error] [pid 31717:tid 31733] [client 20.215.248.112:37716] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r3grt7.php"] [unique_id "acVatb-SCF7YDISDX48G9gAAAYs"]
[Fri Mar 27 00:11:34.740279 2026] [:error] [pid 31670:tid 31684] [client 20.215.248.112:23769] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acVatjXVthXxCnWjOTT8pgAAAUw"]
[Fri Mar 27 00:11:35.652952 2026] [:error] [pid 19711:tid 19752] [client 20.215.248.112:3972] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acVat2j3l1y81GYfluTzagAAAEM"]
[Fri Mar 27 00:11:36.668115 2026] [:error] [pid 60829:tid 60833] [client 20.215.248.112:3403] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acVauPTdjHKeZokybaTpGgAAAQI"]
[Fri Mar 27 00:11:37.555177 2026] [:error] [pid 31670:tid 31692] [client 20.215.248.112:28168] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phina.php"] [unique_id "acVauTXVthXxCnWjOTT8rgAAAVQ"]
[Fri Mar 27 00:11:38.765443 2026] [:error] [pid 60829:tid 60843] [client 20.215.248.112:28237] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acVauvTdjHKeZokybaTpJQAAAQw"]
[Fri Mar 27 00:11:41.354851 2026] [:error] [pid 19712:tid 19787] [client 20.215.248.112:46358] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acVavdWhKhRNqm23vFNngAAAAIs"]
[Fri Mar 27 00:11:42.270524 2026] [:error] [pid 19712:tid 19794] [client 20.215.248.112:37004] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acVavtWhKhRNqm23vFNngwAAAJI"]
[Fri Mar 27 00:11:43.267691 2026] [:error] [pid 19710:tid 19727] [client 20.215.248.112:53057] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acVavwVEWP8Ar68Njk5cFgAAAAU"]
[Fri Mar 27 00:11:44.845915 2026] [:error] [pid 19712:tid 19790] [client 20.215.248.112:3446] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "acVawNWhKhRNqm23vFNniQAAAI4"]
[Fri Mar 27 00:11:46.032452 2026] [:error] [pid 19711:tid 19764] [client 20.215.248.112:24993] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs6.php"] [unique_id "acVawmj3l1y81GYfluTzgwAAAE8"]
[Fri Mar 27 00:11:47.111186 2026] [proxy_fcgi:error] [pid 19818:tid 19827] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:47.625687 2026] [proxy_fcgi:error] [pid 19818:tid 19844] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:47.885251 2026] [proxy_fcgi:error] [pid 19818:tid 19840] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:48.143919 2026] [proxy_fcgi:error] [pid 19818:tid 19830] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:48.403232 2026] [proxy_fcgi:error] [pid 19818:tid 19835] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:48.683682 2026] [proxy_fcgi:error] [pid 19818:tid 19839] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:48.943033 2026] [proxy_fcgi:error] [pid 19818:tid 19829] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:49.218974 2026] [proxy_fcgi:error] [pid 19818:tid 19838] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:49.479512 2026] [proxy_fcgi:error] [pid 19818:tid 19842] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:49.739327 2026] [proxy_fcgi:error] [pid 19818:tid 19824] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:50.009349 2026] [proxy_fcgi:error] [pid 19818:tid 19825] [client 20.215.248.112:16794] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:11:50.264626 2026] [:error] [pid 19818:tid 19832] [client 20.215.248.112:16794] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws50.php"] [unique_id "acVaxszaSnm3d1BeM5VRsAAAAMw"]
[Fri Mar 27 00:11:51.263010 2026] [:error] [pid 31670:tid 31673] [client 20.215.248.112:24987] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws50.php"] [unique_id "acVaxzXVthXxCnWjOTT8tgAAAUE"]
[Fri Mar 27 00:11:52.480986 2026] [:error] [pid 31780:tid 31840] [client 20.215.248.112:31861] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws50.php"] [unique_id "acVayJJDwZsy5O4ZXEjcAAAAAhM"]
[Fri Mar 27 00:11:53.554837 2026] [:error] [pid 19818:tid 19821] [client 20.215.248.112:24972] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws50.php"] [unique_id "acVayczaSnm3d1BeM5VRsQAAAME"]
[Fri Mar 27 00:11:55.020671 2026] [:error] [pid 19711:tid 19749] [client 20.215.248.112:48581] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws44.php"] [unique_id "acVay2j3l1y81GYfluTzogAAAEA"]
[Fri Mar 27 00:11:56.211739 2026] [:error] [pid 19818:tid 19834] [client 20.215.248.112:56178] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws44.php"] [unique_id "acVazMzaSnm3d1BeM5VRswAAAM4"]
[Fri Mar 27 00:11:57.288038 2026] [:error] [pid 19818:tid 19840] [client 20.215.248.112:31860] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws44.php"] [unique_id "acVazczaSnm3d1BeM5VRtgAAANQ"]
[Fri Mar 27 00:11:58.583976 2026] [:error] [pid 19710:tid 19732] [client 20.215.248.112:56555] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws44.php"] [unique_id "acVazgVEWP8Ar68Njk5cIgAAAAo"]
[Fri Mar 27 00:11:59.503914 2026] [:error] [pid 60829:tid 60853] [client 20.215.248.112:56174] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acVaz_TdjHKeZokybaTpMAAAARY"]
[Fri Mar 27 00:12:00.592411 2026] [:error] [pid 31717:tid 31726] [client 20.215.248.112:53114] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acVa0L-SCF7YDISDX48G-gAAAYQ"]
[Fri Mar 27 00:12:01.327523 2026] [:error] [pid 31778:tid 31808] [client 20.215.248.112:3439] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acVa0Q3kybI2o-xasmAzpwAAAc8"]
[Fri Mar 27 00:12:02.082621 2026] [:error] [pid 19818:tid 19842] [client 20.215.248.112:63596] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acVa0szaSnm3d1BeM5VRvAAAANY"]
[Fri Mar 27 00:12:03.005160 2026] [:error] [pid 19712:tid 19785] [client 20.215.248.112:3898] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acVa09WhKhRNqm23vFNntQAAAIk"]
[Fri Mar 27 00:12:03.714080 2026] [:error] [pid 31670:tid 31676] [client 20.215.248.112:63552] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acVa0zXVthXxCnWjOTT8wQAAAUQ"]
[Fri Mar 27 00:12:04.391660 2026] [:error] [pid 19711:tid 19757] [client 20.215.248.112:60815] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acVa1Gj3l1y81GYfluTzvgAAAEg"]
[Fri Mar 27 00:12:05.285034 2026] [:error] [pid 31670:tid 31690] [client 20.215.248.112:63395] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acVa1TXVthXxCnWjOTT8xgAAAVI"]
[Fri Mar 27 00:12:06.213953 2026] [:error] [pid 19712:tid 19788] [client 20.215.248.112:13285] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws40.php"] [unique_id "acVa1tWhKhRNqm23vFNnvAAAAIw"]
[Fri Mar 27 00:12:07.395430 2026] [:error] [pid 31670:tid 31678] [client 20.215.248.112:55519] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws40.php"] [unique_id "acVa1zXVthXxCnWjOTT8ywAAAUY"]
[Fri Mar 27 00:12:08.257766 2026] [:error] [pid 19712:tid 19781] [client 20.215.248.112:13288] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws40.php"] [unique_id "acVa2NWhKhRNqm23vFNnwwAAAIU"]
[Fri Mar 27 00:12:09.030999 2026] [:error] [pid 31780:tid 31829] [client 20.215.248.112:60800] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws40.php"] [unique_id "acVa2ZJDwZsy5O4ZXEjcCgAAAgg"]
[Fri Mar 27 00:12:09.757743 2026] [:error] [pid 19711:tid 19749] [client 20.215.248.112:65465] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws36.php"] [unique_id "acVa2Wj3l1y81GYfluTzwgAAAEA"]
[Fri Mar 27 00:12:10.391838 2026] [:error] [pid 19711:tid 19755] [client 20.215.248.112:55492] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws36.php"] [unique_id "acVa2mj3l1y81GYfluTzxgAAAEY"]
[Fri Mar 27 00:12:11.170044 2026] [:error] [pid 19711:tid 19749] [client 20.215.248.112:35016] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws36.php"] [unique_id "acVa22j3l1y81GYfluTzzQAAAEA"]
[Fri Mar 27 00:12:11.977379 2026] [:error] [pid 31670:tid 31688] [client 20.215.248.112:52551] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws36.php"] [unique_id "acVa2zXVthXxCnWjOTT80gAAAVA"]
[Fri Mar 27 00:12:13.016912 2026] [:error] [pid 31780:tid 31841] [client 20.215.248.112:65481] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vwxbi.php"] [unique_id "acVa3ZJDwZsy5O4ZXEjcDwAAAhQ"]
[Fri Mar 27 00:12:14.046797 2026] [:error] [pid 19710:tid 19730] [client 20.215.248.112:23147] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vwxbi.php"] [unique_id "acVa3gVEWP8Ar68Njk5cJwAAAAg"]
[Fri Mar 27 00:12:14.832377 2026] [:error] [pid 31780:tid 31844] [client 20.215.248.112:54341] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vwxbi.php"] [unique_id "acVa3pJDwZsy5O4ZXEjcEQAAAhc"]
[Fri Mar 27 00:12:15.593016 2026] [:error] [pid 60829:tid 60850] [client 20.215.248.112:58598] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vwxbi.php"] [unique_id "acVa3_TdjHKeZokybaTpNgAAARM"]
[Fri Mar 27 00:12:16.384018 2026] [:error] [pid 19711:tid 19767] [client 20.215.248.112:23166] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acVa4Gj3l1y81GYfluTz3AAAAFI"]
[Fri Mar 27 00:12:17.257966 2026] [:error] [pid 31670:tid 31676] [client 20.215.248.112:60039] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acVa4TXVthXxCnWjOTT83QAAAUQ"]
[Fri Mar 27 00:12:18.002466 2026] [:error] [pid 19710:tid 19737] [client 20.215.248.112:32401] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acVa4gVEWP8Ar68Njk5cLAAAAA8"]
[Fri Mar 27 00:12:18.671459 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:53805] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acVa4mj3l1y81GYfluTz5gAAAEE"]
[Fri Mar 27 00:12:19.449110 2026] [:error] [pid 19710:tid 19745] [client 20.215.248.112:24394] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acVa4wVEWP8Ar68Njk5cLwAAABc"]
[Fri Mar 27 00:12:20.259555 2026] [:error] [pid 19711:tid 19749] [client 20.215.248.112:40312] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acVa5Gj3l1y81GYfluTz6QAAAEA"]
[Fri Mar 27 00:12:21.268872 2026] [:error] [pid 31670:tid 31679] [client 20.215.248.112:54294] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acVa5TXVthXxCnWjOTT86gAAAUc"]
[Fri Mar 27 00:12:21.985584 2026] [:error] [pid 19710:tid 19723] [client 20.215.248.112:40286] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acVa5QVEWP8Ar68Njk5cMwAAAAE"]
[Fri Mar 27 00:12:22.831758 2026] [:error] [pid 19710:tid 19740] [client 20.215.248.112:60042] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cvz.php"] [unique_id "acVa5gVEWP8Ar68Njk5cNQAAABI"]
[Fri Mar 27 00:12:24.082479 2026] [:error] [pid 19711:tid 19769] [client 20.215.248.112:32441] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cvz.php"] [unique_id "acVa6Gj3l1y81GYfluTz8AAAAFQ"]
[Fri Mar 27 00:12:25.393652 2026] [:error] [pid 19818:tid 19837] [client 20.215.248.112:40293] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cvz.php"] [unique_id "acVa6czaSnm3d1BeM5VRxAAAANE"]
[Fri Mar 27 00:12:26.568689 2026] [:error] [pid 31670:tid 31685] [client 20.215.248.112:53813] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cvz.php"] [unique_id "acVa6jXVthXxCnWjOTT88AAAAU0"]
[Fri Mar 27 00:12:27.378010 2026] [:error] [pid 19711:tid 19766] [client 20.215.248.112:62924] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acVa62j3l1y81GYfluTz-AAAAFE"]
[Fri Mar 27 00:12:28.117890 2026] [:error] [pid 19711:tid 19762] [client 20.215.248.112:35696] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acVa7Gj3l1y81GYfluT0AAAAAE0"]
[Fri Mar 27 00:12:28.861066 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:64330] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acVa7AVEWP8Ar68Njk5cQQAAAAs"]
[Fri Mar 27 00:12:29.780281 2026] [:error] [pid 19818:tid 19840] [client 20.215.248.112:57275] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "acVa7czaSnm3d1BeM5VRyQAAANQ"]
[Fri Mar 27 00:12:30.726923 2026] [:error] [pid 19711:tid 19765] [client 20.215.248.112:31128] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acVa7mj3l1y81GYfluT0BAAAAFA"]
[Fri Mar 27 00:12:31.406480 2026] [:error] [pid 19711:tid 19760] [client 20.215.248.112:53774] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acVa72j3l1y81GYfluT0BQAAAEs"]
[Fri Mar 27 00:12:31.966608 2026] [:error] [pid 19712:tid 19783] [client 20.215.248.112:40302] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acVa79WhKhRNqm23vFNn0QAAAIc"]
[Fri Mar 27 00:12:32.894076 2026] [:error] [pid 19818:tid 19820] [client 20.215.248.112:54301] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aee.php"] [unique_id "acVa8MzaSnm3d1BeM5VRzgAAAMA"]
[Fri Mar 27 00:12:33.806643 2026] [:error] [pid 19712:tid 19795] [client 20.215.248.112:64713] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acVa8dWhKhRNqm23vFNn1AAAAJM"]
[Fri Mar 27 00:12:35.688939 2026] [:error] [pid 31717:tid 31740] [client 20.215.248.112:31120] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acVa87-SCF7YDISDX48HBQAAAZI"]
[Fri Mar 27 00:12:36.402330 2026] [:error] [pid 31717:tid 31746] [client 20.215.248.112:54398] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acVa9L-SCF7YDISDX48HBgAAAZg"]
[Fri Mar 27 00:12:37.604183 2026] [:error] [pid 19818:tid 19844] [client 20.215.248.112:54305] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sweg.php"] [unique_id "acVa9czaSnm3d1BeM5VR1QAAANg"]
[Fri Mar 27 00:12:38.609114 2026] [:error] [pid 19711:tid 19756] [client 20.215.248.112:32385] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acVa9mj3l1y81GYfluT0DwAAAEc"]
[Fri Mar 27 00:12:39.503056 2026] [:error] [pid 19711:tid 19753] [client 20.215.248.112:40284] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acVa92j3l1y81GYfluT0EQAAAEQ"]
[Fri Mar 27 00:12:40.355670 2026] [:error] [pid 31670:tid 31694] [client 20.215.248.112:40927] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acVa-DXVthXxCnWjOTT8_wAAAVY"]
[Fri Mar 27 00:12:41.446825 2026] [:error] [pid 19710:tid 19735] [client 20.215.248.112:47389] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acVa-QVEWP8Ar68Njk5cTAAAAA0"]
[Fri Mar 27 00:12:42.600766 2026] [:error] [pid 19710:tid 19726] [client 20.215.248.112:36303] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acVa-gVEWP8Ar68Njk5cTwAAAAQ"]
[Fri Mar 27 00:12:43.723987 2026] [:error] [pid 19711:tid 19760] [client 20.215.248.112:31110] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acVa-2j3l1y81GYfluT0GQAAAEs"]
[Fri Mar 27 00:12:44.340755 2026] [:error] [pid 19711:tid 19767] [client 20.215.248.112:24444] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acVa_Gj3l1y81GYfluT0HgAAAFI"]
[Fri Mar 27 00:12:45.213879 2026] [:error] [pid 31670:tid 31691] [client 20.215.248.112:31110] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "acVa_TXVthXxCnWjOTT9AQAAAVM"]
[Fri Mar 27 00:12:45.946514 2026] [:error] [pid 19710:tid 19738] [client 20.215.248.112:3646] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acVa_QVEWP8Ar68Njk5cVwAAABA"]
[Fri Mar 27 00:12:46.525556 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:3104] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acVa_gVEWP8Ar68Njk5cWwAAAAs"]
[Fri Mar 27 00:12:47.155995 2026] [:error] [pid 19818:tid 19836] [client 20.215.248.112:23122] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acVa_8zaSnm3d1BeM5VR2wAAANA"]
[Fri Mar 27 00:12:47.966695 2026] [:error] [pid 19710:tid 19744] [client 20.215.248.112:43289] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acVa_wVEWP8Ar68Njk5cXQAAABY"]
[Fri Mar 27 00:12:48.703351 2026] [:error] [pid 31778:tid 31804] [client 20.215.248.112:54394] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acVbAA3kybI2o-xasmAzvAAAAcs"]
[Fri Mar 27 00:12:49.509153 2026] [:error] [pid 19711:tid 19755] [client 20.215.248.112:24358] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acVbAWj3l1y81GYfluT0JwAAAEY"]
[Fri Mar 27 00:12:50.135568 2026] [proxy_fcgi:error] [pid 19710:tid 19745] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:50.402761 2026] [proxy_fcgi:error] [pid 19710:tid 19729] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:51.917773 2026] [proxy_fcgi:error] [pid 19710:tid 19742] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:52.176840 2026] [proxy_fcgi:error] [pid 19710:tid 19737] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:52.438868 2026] [proxy_fcgi:error] [pid 19710:tid 19743] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:52.704497 2026] [proxy_fcgi:error] [pid 19710:tid 19738] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:52.964367 2026] [proxy_fcgi:error] [pid 19710:tid 19726] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:53.223407 2026] [proxy_fcgi:error] [pid 19710:tid 19732] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:53.528690 2026] [proxy_fcgi:error] [pid 19710:tid 19736] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:53.794321 2026] [proxy_fcgi:error] [pid 19710:tid 19728] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:54.053683 2026] [proxy_fcgi:error] [pid 19710:tid 19731] [client 20.215.248.112:53796] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:12:54.320663 2026] [:error] [pid 19710:tid 19746] [client 20.215.248.112:53796] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfuKK.php"] [unique_id "acVbBgVEWP8Ar68Njk5cfAAAABg"]
[Fri Mar 27 00:12:55.427340 2026] [:error] [pid 19818:tid 19839] [client 20.215.248.112:4060] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfuKK.php"] [unique_id "acVbB8zaSnm3d1BeM5VR4gAAANM"]
[Fri Mar 27 00:12:56.251255 2026] [:error] [pid 19711:tid 19755] [client 20.215.248.112:45239] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfuKK.php"] [unique_id "acVbCGj3l1y81GYfluT0LgAAAEY"]
[Fri Mar 27 00:12:57.157947 2026] [:error] [pid 19712:tid 19782] [client 20.215.248.112:52563] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfuKK.php"] [unique_id "acVbCdWhKhRNqm23vFNn7QAAAIY"]
[Fri Mar 27 00:12:58.249374 2026] [:error] [pid 19710:tid 19745] [client 20.215.248.112:54362] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OpVq6.php"] [unique_id "acVbCgVEWP8Ar68Njk5cgQAAABc"]
[Fri Mar 27 00:12:59.092584 2026] [:error] [pid 19712:tid 19784] [client 20.215.248.112:65422] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OpVq6.php"] [unique_id "acVbC9WhKhRNqm23vFNn8AAAAIg"]
[Fri Mar 27 00:13:00.090810 2026] [:error] [pid 19712:tid 19779] [client 20.215.248.112:65418] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OpVq6.php"] [unique_id "acVbDNWhKhRNqm23vFNn8wAAAIM"]
[Fri Mar 27 00:13:01.019085 2026] [:error] [pid 19712:tid 19786] [client 20.215.248.112:47367] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OpVq6.php"] [unique_id "acVbDdWhKhRNqm23vFNn9wAAAIo"]
[Fri Mar 27 00:13:01.795257 2026] [:error] [pid 19712:tid 19783] [client 20.215.248.112:57800] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Q73BO.php"] [unique_id "acVbDdWhKhRNqm23vFNn-gAAAIc"]
[Fri Mar 27 00:13:02.456715 2026] [:error] [pid 31717:tid 31732] [client 20.215.248.112:52105] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Q73BO.php"] [unique_id "acVbDr-SCF7YDISDX48HFAAAAYo"]
[Fri Mar 27 00:13:03.115912 2026] [:error] [pid 31717:tid 31744] [client 20.215.248.112:47422] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Q73BO.php"] [unique_id "acVbD7-SCF7YDISDX48HFwAAAZY"]
[Fri Mar 27 00:13:04.033893 2026] [:error] [pid 19712:tid 19793] [client 20.215.248.112:3951] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Q73BO.php"] [unique_id "acVbENWhKhRNqm23vFNoAQAAAJE"]
[Fri Mar 27 00:13:05.198227 2026] [:error] [pid 19818:tid 19825] [client 20.215.248.112:52115] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rmpoa.php"] [unique_id "acVbEczaSnm3d1BeM5VR7QAAAMU"]
[Fri Mar 27 00:13:05.895184 2026] [:error] [pid 31670:tid 31694] [client 20.215.248.112:63362] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rmpoa.php"] [unique_id "acVbETXVthXxCnWjOTT9EgAAAVY"]
[Fri Mar 27 00:13:06.637299 2026] [:error] [pid 31670:tid 31683] [client 20.215.248.112:47003] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rmpoa.php"] [unique_id "acVbEjXVthXxCnWjOTT9FgAAAUs"]
[Fri Mar 27 00:13:07.585389 2026] [:error] [pid 19711:tid 19756] [client 20.215.248.112:60427] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rmpoa.php"] [unique_id "acVbE2j3l1y81GYfluT0NAAAAEc"]
[Fri Mar 27 00:13:08.577355 2026] [:error] [pid 19710:tid 19722] [client 20.215.248.112:3947] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acVbFAVEWP8Ar68Njk5cigAAAAA"]
[Fri Mar 27 00:13:09.387863 2026] [:error] [pid 19711:tid 19764] [client 20.215.248.112:58235] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acVbFWj3l1y81GYfluT0RAAAAE8"]
[Fri Mar 27 00:13:10.196031 2026] [:error] [pid 19710:tid 19741] [client 20.215.248.112:63414] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acVbFgVEWP8Ar68Njk5cjgAAABM"]
[Fri Mar 27 00:13:11.184123 2026] [:error] [pid 19711:tid 19758] [client 20.215.248.112:58176] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acVbF2j3l1y81GYfluT0SAAAAEk"]
[Fri Mar 27 00:13:12.137341 2026] [:error] [pid 19710:tid 19731] [client 20.215.248.112:40218] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acVbGAVEWP8Ar68Njk5ckQAAAAk"]
[Fri Mar 27 00:13:13.520178 2026] [:error] [pid 19710:tid 19740] [client 20.215.248.112:37703] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acVbGQVEWP8Ar68Njk5clgAAABI"]
[Fri Mar 27 00:13:14.329472 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:37735] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acVbGgVEWP8Ar68Njk5cmgAAAAs"]
[Fri Mar 27 00:13:15.161949 2026] [:error] [pid 19711:tid 19763] [client 20.215.248.112:46394] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acVbG2j3l1y81GYfluT0TwAAAE4"]
[Fri Mar 27 00:13:16.260084 2026] [:error] [pid 19710:tid 19727] [client 20.215.248.112:25002] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acVbHAVEWP8Ar68Njk5cowAAAAU"]
[Fri Mar 27 00:13:17.207089 2026] [:error] [pid 19710:tid 19744] [client 20.215.248.112:65061] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acVbHQVEWP8Ar68Njk5cpwAAABY"]
[Fri Mar 27 00:13:17.996736 2026] [:error] [pid 19710:tid 19725] [client 20.215.248.112:56557] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acVbHQVEWP8Ar68Njk5cqwAAAAM"]
[Fri Mar 27 00:13:18.804660 2026] [:error] [pid 19710:tid 19742] [client 20.215.248.112:27535] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acVbHgVEWP8Ar68Njk5csAAAABQ"]
[Fri Mar 27 00:13:19.563005 2026] [:error] [pid 31717:tid 31723] [client 20.215.248.112:62939] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acVbH7-SCF7YDISDX48HGQAAAYE"]
[Fri Mar 27 00:13:20.553973 2026] [:error] [pid 19711:tid 19750] [client 20.215.248.112:62912] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acVbIGj3l1y81GYfluT0WgAAAEE"]
[Fri Mar 27 00:13:21.220577 2026] [:error] [pid 19711:tid 19766] [client 20.215.248.112:46451] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acVbIWj3l1y81GYfluT0XAAAAFE"]
[Fri Mar 27 00:13:21.933034 2026] [:error] [pid 19710:tid 19733] [client 20.215.248.112:28221] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "acVbIQVEWP8Ar68Njk5cswAAAAs"]
[Fri Mar 27 00:13:22.787585 2026] [:error] [pid 19711:tid 19751] [client 20.215.248.112:46384] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "acVbImj3l1y81GYfluT0awAAAEI"]
[Fri Mar 27 00:13:23.631276 2026] [:error] [pid 31670:tid 31688] [client 20.215.248.112:37759] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "acVbIzXVthXxCnWjOTT9JgAAAVA"]
[Fri Mar 27 00:13:24.416869 2026] [:error] [pid 19818:tid 19831] [client 20.215.248.112:3981] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "acVbJMzaSnm3d1BeM5VR9gAAAMs"]
[Fri Mar 27 00:13:25.563878 2026] [:error] [pid 19710:tid 19727] [client 20.215.248.112:30842] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "acVbJQVEWP8Ar68Njk5cuAAAAAU"]
[Fri Mar 27 00:13:27.091389 2026] [:error] [pid 19710:tid 19730] [client 20.215.248.112:46454] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acVbJwVEWP8Ar68Njk5cvgAAAAg"]
[Fri Mar 27 00:13:27.710699 2026] [:error] [pid 19710:tid 19722] [client 20.215.248.112:30086] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acVbJwVEWP8Ar68Njk5cvwAAAAA"]
[Fri Mar 27 00:13:28.507567 2026] [:error] [pid 19710:tid 19742] [client 20.215.248.112:4020] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acVbKAVEWP8Ar68Njk5cwQAAABQ"]
[Fri Mar 27 00:13:29.835057 2026] [:error] [pid 19710:tid 19724] [client 20.215.248.112:3991] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "acVbKQVEWP8Ar68Njk5cwgAAAAI"]
[Fri Mar 27 00:13:30.934270 2026] [:error] [pid 19710:tid 19732] [client 20.215.248.112:3970] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v4.php"] [unique_id "acVbKgVEWP8Ar68Njk5cxgAAAAo"]
[Fri Mar 27 00:13:31.886175 2026] [:error] [pid 19711:tid 19761] [client 20.215.248.112:48037] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v4.php"] [unique_id "acVbK2j3l1y81GYfluT0jQAAAEw"]
[Fri Mar 27 00:13:32.721038 2026] [:error] [pid 31778:tid 31812] [client 20.215.248.112:62916] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v4.php"] [unique_id "acVbLA3kybI2o-xasmAz4gAAAdM"]
[Fri Mar 27 00:13:33.933526 2026] [:error] [pid 60829:tid 60847] [client 20.215.248.112:26286] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v4.php"] [unique_id "acVbLfTdjHKeZokybaTpSgAAARA"]
[Fri Mar 27 00:13:35.165013 2026] [:error] [pid 31778:tid 31797] [client 20.215.248.112:48577] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acVbLw3kybI2o-xasmAz5AAAAcQ"]
[Fri Mar 27 00:13:36.260229 2026] [:error] [pid 31670:tid 31679] [client 20.215.248.112:48053] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acVbMDXVthXxCnWjOTT9MgAAAUc"]
[Fri Mar 27 00:13:37.417728 2026] [:error] [pid 60829:tid 60837] [client 20.215.248.112:37721] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acVbMfTdjHKeZokybaTpVwAAAQY"]
[Fri Mar 27 00:13:38.293803 2026] [:error] [pid 31717:tid 31743] [client 20.215.248.112:27568] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acVbMr-SCF7YDISDX48HJgAAAZU"]
[Fri Mar 27 00:13:39.379716 2026] [:error] [pid 31670:tid 31677] [client 20.215.248.112:46448] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acVbMzXVthXxCnWjOTT9OwAAAUU"]
[Fri Mar 27 00:13:40.435365 2026] [:error] [pid 19711:tid 19772] [client 20.215.248.112:48040] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acVbNGj3l1y81GYfluT0kwAAAFc"]
[Fri Mar 27 00:13:41.724729 2026] [:error] [pid 19710:tid 19724] [client 20.215.248.112:30790] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acVbNQVEWP8Ar68Njk5cywAAAAI"]
[Fri Mar 27 00:13:42.987356 2026] [:error] [pid 31670:tid 31693] [client 20.215.248.112:60526] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acVbNjXVthXxCnWjOTT9QgAAAVU"]
[Fri Mar 27 00:13:44.099864 2026] [:error] [pid 31778:tid 31810] [client 20.215.248.112:48586] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acVbOA3kybI2o-xasmAz5gAAAdE"]
[Fri Mar 27 00:13:44.936624 2026] [:error] [pid 19712:tid 19781] [client 20.215.248.112:28183] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acVbONWhKhRNqm23vFNoKQAAAIU"]
[Fri Mar 27 00:13:46.104211 2026] [:error] [pid 31670:tid 31687] [client 20.215.248.112:60512] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acVbOjXVthXxCnWjOTT9UAAAAU8"]
[Fri Mar 27 00:13:47.098562 2026] [:error] [pid 19712:tid 19782] [client 20.215.248.112:22400] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc13.php"] [unique_id "acVbO9WhKhRNqm23vFNoMAAAAIY"]
[Fri Mar 27 00:13:48.447372 2026] [:error] [pid 31670:tid 31688] [client 20.215.248.112:48057] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acVbPDXVthXxCnWjOTT9VgAAAVA"]
[Fri Mar 27 00:13:50.026165 2026] [:error] [pid 31780:tid 31833] [client 20.215.248.112:22443] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acVbPpJDwZsy5O4ZXEjcMwAAAgw"]
[Fri Mar 27 00:13:51.603418 2026] [:error] [pid 19711:tid 19757] [client 20.215.248.112:48046] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acVbP2j3l1y81GYfluT0mwAAAEg"]
[Fri Mar 27 00:13:52.616606 2026] [:error] [pid 31670:tid 31696] [client 20.215.248.112:46392] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acVbQDXVthXxCnWjOTT9YQAAAVg"]
[Fri Mar 27 00:13:54.074017 2026] [proxy_fcgi:error] [pid 19711:tid 19764] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:54.341053 2026] [proxy_fcgi:error] [pid 19711:tid 19751] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:55.667638 2026] [proxy_fcgi:error] [pid 19711:tid 19756] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:55.926875 2026] [proxy_fcgi:error] [pid 19711:tid 19762] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:56.188004 2026] [proxy_fcgi:error] [pid 19711:tid 19770] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:56.448064 2026] [proxy_fcgi:error] [pid 19711:tid 19771] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:56.708752 2026] [proxy_fcgi:error] [pid 19711:tid 19760] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:56.972996 2026] [proxy_fcgi:error] [pid 19711:tid 19755] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:57.232434 2026] [proxy_fcgi:error] [pid 19711:tid 19772] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:57.498957 2026] [proxy_fcgi:error] [pid 19711:tid 19765] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:57.762553 2026] [proxy_fcgi:error] [pid 19711:tid 19758] [client 20.215.248.112:26287] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:13:58.036582 2026] [:error] [pid 19711:tid 19752] [client 20.215.248.112:26287] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lanou.php"] [unique_id "acVbRmj3l1y81GYfluT0sgAAAEM"]
[Fri Mar 27 00:13:58.799783 2026] [:error] [pid 19710:tid 19737] [client 20.215.248.112:46453] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lanou.php"] [unique_id "acVbRgVEWP8Ar68Njk5c4QAAAA8"]
[Fri Mar 27 00:13:59.479923 2026] [:error] [pid 31670:tid 31688] [client 20.215.248.112:23805] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lanou.php"] [unique_id "acVbRzXVthXxCnWjOTT9bQAAAVA"]
[Fri Mar 27 00:14:00.299315 2026] [:error] [pid 19712:tid 19783] [client 20.215.248.112:40927] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lanou.php"] [unique_id "acVbSNWhKhRNqm23vFNoQQAAAIc"]
[Fri Mar 27 00:14:01.172551 2026] [:error] [pid 31717:tid 31744] [client 20.215.248.112:22432] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "acVbSb-SCF7YDISDX48HKwAAAZY"]
[Fri Mar 27 00:14:01.858449 2026] [:error] [pid 19712:tid 19779] [client 20.215.248.112:37723] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "acVbSdWhKhRNqm23vFNoRQAAAIM"]
[Fri Mar 27 00:14:02.587200 2026] [:error] [pid 31670:tid 31687] [client 20.215.248.112:27534] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "acVbSjXVthXxCnWjOTT9cAAAAU8"]
[Fri Mar 27 00:14:03.475996 2026] [:error] [pid 19712:tid 19789] [client 20.215.248.112:16797] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "acVbS9WhKhRNqm23vFNoRwAAAI0"]
[Fri Mar 27 00:14:05.106305 2026] [:error] [pid 60829:tid 60847] [client 20.215.248.112:22444] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acVbTfTdjHKeZokybaTpZwAAARA"]
[Fri Mar 27 00:14:06.323816 2026] [:error] [pid 31670:tid 31674] [client 20.215.248.112:30785] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acVbTjXVthXxCnWjOTT9fAAAAUI"]
[Fri Mar 27 00:14:07.271504 2026] [:error] [pid 31778:tid 31801] [client 20.215.248.112:27570] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acVbTw3kybI2o-xasmAz6gAAAcg"]
[Fri Mar 27 00:14:07.953146 2026] [:error] [pid 60829:tid 60841] [client 20.215.248.112:60509] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pas2.php"] [unique_id "acVbT_TdjHKeZokybaTpaAAAAQo"]
[Fri Mar 27 00:14:08.751451 2026] [:error] [pid 19710:tid 19741] [client 20.215.248.112:46420] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schal.php"] [unique_id "acVbUAVEWP8Ar68Njk5c-gAAABM"]
[Fri Mar 27 00:14:09.515559 2026] [:error] [pid 19818:tid 19832] [client 20.215.248.112:48050] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schal.php"] [unique_id "acVbUczaSnm3d1BeM5VSCAAAAMw"]
[Fri Mar 27 00:14:10.667465 2026] [:error] [pid 31778:tid 31805] [client 20.215.248.112:48033] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schal.php"] [unique_id "acVbUg3kybI2o-xasmAz6wAAAcw"]
[Fri Mar 27 00:14:11.449673 2026] [:error] [pid 19712:tid 19800] [client 20.215.248.112:26896] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schal.php"] [unique_id "acVbU9WhKhRNqm23vFNoUAAAAJg"]
[Fri Mar 27 00:14:12.536222 2026] [:error] [pid 19710:tid 19737] [client 20.215.248.112:30796] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "acVbVAVEWP8Ar68Njk5c_QAAAA8"]
[Fri Mar 27 00:14:13.278180 2026] [:error] [pid 19711:tid 19759] [client 20.215.248.112:60543] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "acVbVWj3l1y81GYfluT0uwAAAEo"]
[Fri Mar 27 00:14:14.094500 2026] [:error] [pid 19711:tid 19751] [client 20.215.248.112:26880] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "acVbVmj3l1y81GYfluT0vgAAAEI"]
[Fri Mar 27 00:14:15.137004 2026] [:error] [pid 19710:tid 19731] [client 20.215.248.112:30833] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xex.php"] [unique_id "acVbVwVEWP8Ar68Njk5dAQAAAAk"]
[Fri Mar 27 00:14:17.351017 2026] [:error] [pid 19711:tid 19755] [client 20.215.248.112:54748] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acVbWWj3l1y81GYfluT0wQAAAEY"]
[Fri Mar 27 00:14:18.938923 2026] [:error] [pid 31780:tid 31822] [client 20.215.248.112:30786] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acVbWpJDwZsy5O4ZXEjcRAAAAgI"]
[Fri Mar 27 00:14:20.476910 2026] [:error] [pid 60829:tid 60832] [client 20.215.248.112:25641] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acVbXPTdjHKeZokybaTpbgAAAQE"]
[Fri Mar 27 00:14:22.008846 2026] [:error] [pid 19710:tid 19738] [client 20.215.248.112:23766] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acVbXgVEWP8Ar68Njk5dDwAAABA"]
[Fri Mar 27 00:14:22.755011 2026] [:error] [pid 19818:tid 19825] [client 20.215.248.112:22456] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acVbXszaSnm3d1BeM5VSEgAAAMU"]
[Fri Mar 27 00:14:23.916267 2026] [:error] [pid 31778:tid 31803] [client 20.215.248.112:16819] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acVbXw3kybI2o-xasmAz9QAAAco"]
[Fri Mar 27 00:14:25.284268 2026] [:error] [pid 19710:tid 19727] [client 20.215.248.112:57224] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acVbYQVEWP8Ar68Njk5dFgAAAAU"]
[Fri Mar 27 00:14:26.045774 2026] [:error] [pid 31670:tid 31692] [client 20.215.248.112:30105] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acVbYjXVthXxCnWjOTT9mgAAAVQ"]
[Fri Mar 27 00:14:28.904619 2026] [:error] [pid 19711:tid 19772] [client 20.215.248.112:48056] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dtyh.php"] [unique_id "acVbZGj3l1y81GYfluT00gAAAFc"]
[Fri Mar 27 00:14:30.120986 2026] [:error] [pid 31670:tid 31692] [client 20.215.248.112:46436] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dtyh.php"] [unique_id "acVbZjXVthXxCnWjOTT9pwAAAVQ"]
[Fri Mar 27 00:14:31.020253 2026] [:error] [pid 31778:tid 31804] [client 20.215.248.112:63466] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dtyh.php"] [unique_id "acVbZw3kybI2o-xasmAz-gAAAcs"]
[Fri Mar 27 00:14:31.905389 2026] [:error] [pid 31670:tid 31686] [client 20.215.248.112:54738] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dtyh.php"] [unique_id "acVbZzXVthXxCnWjOTT9qgAAAU4"]
[Fri Mar 27 00:14:32.782157 2026] [:error] [pid 31670:tid 31675] [client 20.215.248.112:63425] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acVbaDXVthXxCnWjOTT9rgAAAUM"]
[Fri Mar 27 00:14:33.487241 2026] [:error] [pid 31780:tid 31820] [client 20.215.248.112:44668] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acVbaZJDwZsy5O4ZXEjcUAAAAgA"]
[Fri Mar 27 00:14:34.737162 2026] [:error] [pid 19712:tid 19799] [client 20.215.248.112:44659] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acVbatWhKhRNqm23vFNoZgAAAJc"]
[Fri Mar 27 00:14:36.005081 2026] [:error] [pid 31717:tid 31741] [client 20.215.248.112:33770] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wta.php"] [unique_id "acVbbL-SCF7YDISDX48HNQAAAZM"]
[Fri Mar 27 00:14:37.005006 2026] [:error] [pid 31780:tid 31843] [client 20.215.248.112:39666] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acVbbZJDwZsy5O4ZXEjcUgAAAhY"]
[Fri Mar 27 00:14:37.985571 2026] [:error] [pid 31778:tid 31808] [client 20.215.248.112:39653] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acVbbQ3kybI2o-xasmA0BAAAAc8"]
[Fri Mar 27 00:14:38.956892 2026] [:error] [pid 31780:tid 31836] [client 20.215.248.112:39625] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acVbbpJDwZsy5O4ZXEjcVgAAAg8"]
[Fri Mar 27 00:14:40.423856 2026] [:error] [pid 19710:tid 19728] [client 20.215.248.112:9385] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acVbcAVEWP8Ar68Njk5dJQAAAAY"]
[Fri Mar 27 00:14:41.460394 2026] [:error] [pid 31670:tid 31693] [client 20.215.248.112:25669] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acVbcTXVthXxCnWjOTT9xQAAAVU"]
[Fri Mar 27 00:14:42.505458 2026] [:error] [pid 31717:tid 31737] [client 20.215.248.112:31766] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acVbcr-SCF7YDISDX48HNgAAAY8"]
[Fri Mar 27 00:14:43.339456 2026] [:error] [pid 19712:tid 19780] [client 20.215.248.112:30536] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acVbc9WhKhRNqm23vFNobwAAAIQ"]
[Fri Mar 27 00:14:43.921134 2026] [:error] [pid 19712:tid 19799] [client 20.215.248.112:58543] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acVbc9WhKhRNqm23vFNocAAAAJc"]
[Fri Mar 27 00:14:44.626797 2026] [:error] [pid 19818:tid 19837] [client 20.215.248.112:28866] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acVbdMzaSnm3d1BeM5VSMQAAANE"]
[Fri Mar 27 00:14:45.520505 2026] [:error] [pid 31670:tid 31692] [client 20.215.248.112:60869] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acVbdTXVthXxCnWjOTT9yAAAAVQ"]
[Fri Mar 27 00:14:46.386508 2026] [:error] [pid 19710:tid 19741] [client 20.215.248.112:20757] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acVbdgVEWP8Ar68Njk5dKQAAABM"]
[Fri Mar 27 00:14:47.250712 2026] [:error] [pid 19711:tid 19773] [client 20.215.248.112:29488] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acVbd2j3l1y81GYfluT04gAAAFg"]
[Fri Mar 27 00:14:47.899070 2026] [:error] [pid 19710:tid 19743] [client 20.215.248.112:20759] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acVbdwVEWP8Ar68Njk5dLgAAABU"]
[Fri Mar 27 00:14:48.735221 2026] [:error] [pid 19710:tid 19730] [client 20.215.248.112:36043] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acVbeAVEWP8Ar68Njk5dMwAAAAg"]
[Fri Mar 27 00:14:49.340400 2026] [:error] [pid 19711:tid 19770] [client 20.215.248.112:59677] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acVbeWj3l1y81GYfluT05gAAAFU"]
[Fri Mar 27 00:14:50.232086 2026] [:error] [pid 31670:tid 31690] [client 20.215.248.112:36052] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acVbejXVthXxCnWjOTT9ywAAAVI"]
[Fri Mar 27 00:14:50.998092 2026] [:error] [pid 19712:tid 19790] [client 20.215.248.112:51824] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acVbetWhKhRNqm23vFNoiAAAAI4"]
[Fri Mar 27 00:14:51.652064 2026] [:error] [pid 19710:tid 19746] [client 20.215.248.112:14032] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acVbewVEWP8Ar68Njk5dPAAAABg"]
[Fri Mar 27 00:14:52.704156 2026] [:error] [pid 19710:tid 19736] [client 20.215.248.112:25063] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acVbfAVEWP8Ar68Njk5dQwAAAA4"]
[Fri Mar 27 00:14:53.627557 2026] [:error] [pid 19711:tid 19757] [client 20.215.248.112:62547] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acVbfWj3l1y81GYfluT09AAAAEg"]
[Fri Mar 27 00:14:54.433927 2026] [:error] [pid 19711:tid 19768] [client 20.215.248.112:60152] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acVbfmj3l1y81GYfluT0-QAAAFM"]
[Fri Mar 27 00:14:55.480918 2026] [:error] [pid 31778:tid 31795] [client 20.215.248.112:34952] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acVbfw3kybI2o-xasmA0CwAAAcI"]
[Fri Mar 27 00:14:56.745168 2026] [:error] [pid 60829:tid 60835] [client 20.215.248.112:62559] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acVbgPTdjHKeZokybaTpfQAAAQQ"]
[Fri Mar 27 00:14:57.662882 2026] [proxy_fcgi:error] [pid 19711:tid 19761] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:57.925754 2026] [proxy_fcgi:error] [pid 19711:tid 19770] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:58.195866 2026] [proxy_fcgi:error] [pid 19711:tid 19760] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:58.472066 2026] [proxy_fcgi:error] [pid 19711:tid 19756] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:58.730975 2026] [proxy_fcgi:error] [pid 19711:tid 19750] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:59.005639 2026] [proxy_fcgi:error] [pid 19711:tid 19758] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:59.265331 2026] [proxy_fcgi:error] [pid 19711:tid 19761] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:59.528808 2026] [proxy_fcgi:error] [pid 19711:tid 19762] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:14:59.787931 2026] [proxy_fcgi:error] [pid 19711:tid 19766] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:15:00.050419 2026] [proxy_fcgi:error] [pid 19711:tid 19760] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:15:00.321051 2026] [proxy_fcgi:error] [pid 19711:tid 19756] [client 20.215.248.112:61660] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 00:15:00.579315 2026] [:error] [pid 19711:tid 19767] [client 20.215.248.112:61660] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "acVbhGj3l1y81GYfluT1HQAAAFI"]
[Fri Mar 27 00:15:01.404031 2026] [:error] [pid 19711:tid 19752] [client 20.215.248.112:45891] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "acVbhWj3l1y81GYfluT1IAAAAEM"]
[Fri Mar 27 00:15:02.223572 2026] [:error] [pid 31778:tid 31811] [client 20.215.248.112:62534] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "acVbhg3kybI2o-xasmA0EAAAAdI"]
[Fri Mar 27 00:15:03.274482 2026] [:error] [pid 19710:tid 19740] [client 20.215.248.112:61653] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "acVbhwVEWP8Ar68Njk5dZgAAABI"]
[Fri Mar 27 00:15:04.149089 2026] [:error] [pid 19710:tid 19736] [client 20.215.248.112:61685] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acVbiAVEWP8Ar68Njk5dawAAAA4"]
[Fri Mar 27 00:15:05.126753 2026] [:error] [pid 19818:tid 19842] [client 20.215.248.112:45934] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acVbiczaSnm3d1BeM5VSOQAAANY"]
[Fri Mar 27 00:15:05.820965 2026] [:error] [pid 31670:tid 31694] [client 20.215.248.112:55797] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acVbiTXVthXxCnWjOTT95QAAAVY"]
[Fri Mar 27 00:15:06.769497 2026] [:error] [pid 19711:tid 19773] [client 20.215.248.112:40833] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acVbimj3l1y81GYfluT1KQAAAFg"]
[Fri Mar 27 00:15:07.767818 2026] [:error] [pid 31778:tid 31799] [client 20.215.248.112:3389] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acVbiw3kybI2o-xasmA0EgAAAcY"]
[Fri Mar 27 00:15:08.593074 2026] [:error] [pid 19710:tid 19739] [client 20.215.248.112:50722] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acVbjAVEWP8Ar68Njk5deQAAABE"]
[Fri Mar 27 00:15:09.431331 2026] [:error] [pid 19711:tid 19754] [client 20.215.248.112:61262] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acVbjWj3l1y81GYfluT1MwAAAEU"]
[Fri Mar 27 00:15:10.238511 2026] [:error] [pid 19712:tid 19797] [client 20.215.248.112:50742] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acVbjtWhKhRNqm23vFNomwAAAJU"]
[Fri Mar 27 00:15:10.810483 2026] [:error] [pid 19711:tid 19770] [client 20.215.248.112:14761] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ticket.php"] [unique_id "acVbjmj3l1y81GYfluT1OAAAAFU"]
[Fri Mar 27 00:15:11.638030 2026] [:error] [pid 19711:tid 19767] [client 20.215.248.112:31361] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ticket.php"] [unique_id "acVbj2j3l1y81GYfluT1PQAAAFI"]
[Fri Mar 27 00:15:12.351017 2026] [:error] [pid 60829:tid 60834] [client 20.215.248.112:61301] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ticket.php"] [unique_id "acVbkPTdjHKeZokybaTphgAAAQM"]
[Fri Mar 27 00:15:13.188095 2026] [:error] [pid 19711:tid 19751] [client 20.215.248.112:48563] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ticket.php"] [unique_id "acVbkWj3l1y81GYfluT1QQAAAEI"]
[Fri Mar 27 00:15:13.979042 2026] [:error] [pid 19711:tid 19762] [client 20.215.248.112:14766] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "acVbkWj3l1y81GYfluT1QwAAAE0"]
[Fri Mar 27 00:15:14.839090 2026] [:error] [pid 31670:tid 31687] [client 20.215.248.112:31202] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "acVbkjXVthXxCnWjOTT9-QAAAU8"]
[Fri Mar 27 00:15:15.616144 2026] [:error] [pid 19818:tid 19840] [client 20.215.248.112:31202] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "acVbk8zaSnm3d1BeM5VSSAAAANQ"]
[Fri Mar 27 00:15:16.515940 2026] [:error] [pid 31778:tid 31797] [client 20.215.248.112:3757] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "acVblA3kybI2o-xasmA0GAAAAcQ"]
[Fri Mar 27 00:15:17.413149 2026] [:error] [pid 60829:tid 60840] [client 20.215.248.112:58964] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpwer1.php"] [unique_id "acVblfTdjHKeZokybaTpiQAAAQk"]
[Fri Mar 27 00:15:18.243225 2026] [:error] [pid 31717:tid 31742] [client 20.215.248.112:58918] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpwer1.php"] [unique_id "acVblr-SCF7YDISDX48HQAAAAZQ"]
[Fri Mar 27 00:15:19.246372 2026] [:error] [pid 31780:tid 31844] [client 20.215.248.112:58956] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpwer1.php"] [unique_id "acVbl5JDwZsy5O4ZXEjccwAAAhc"]
[Fri Mar 27 00:15:19.981828 2026] [:error] [pid 19712:tid 19790] [client 20.215.248.112:39614] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpwer1.php"] [unique_id "acVbl9WhKhRNqm23vFNorQAAAI4"]
[Fri Mar 27 00:15:20.705934 2026] [:error] [pid 19712:tid 19778] [client 20.215.248.112:62134] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "acVbmNWhKhRNqm23vFNorwAAAII"]
[Fri Mar 27 00:15:21.811679 2026] [:error] [pid 19711:tid 19764] [client 20.215.248.112:47107] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "acVbmWj3l1y81GYfluT1TAAAAE8"]
[Fri Mar 27 00:15:22.619521 2026] [:error] [pid 31670:tid 31690] [client 20.215.248.112:33067] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "acVbmjXVthXxCnWjOTT9_wAAAVI"]
[Fri Mar 27 00:15:23.287177 2026] [:error] [pid 31780:tid 31830] [client 20.215.248.112:42205] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "acVbm5JDwZsy5O4ZXEjceQAAAgk"]
[Fri Mar 27 00:15:24.036935 2026] [:error] [pid 19710:tid 19737] [client 20.215.248.112:47166] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "acVbnAVEWP8Ar68Njk5dhgAAAA8"]
[Fri Mar 27 00:15:24.694789 2026] [:error] [pid 60829:tid 60839] [client 20.215.248.112:38331] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "acVbnPTdjHKeZokybaTpkQAAAQg"]
[Fri Mar 27 00:15:25.227330 2026] [:error] [pid 31670:tid 31679] [client 20.215.248.112:28622] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "acVbnTXVthXxCnWjOTT-CQAAAUc"]
[Fri Mar 27 00:15:25.975613 2026] [:error] [pid 19711:tid 19773] [client 20.215.248.112:49692] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "acVbnWj3l1y81GYfluT1UwAAAFg"]
[Fri Mar 27 00:15:26.835409 2026] [:error] [pid 31670:tid 31685] [client 20.215.248.112:54676] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpass.php"] [unique_id "acVbnjXVthXxCnWjOTT-DAAAAU0"]
[Fri Mar 27 00:15:27.645675 2026] [:error] [pid 31778:tid 31808] [client 20.215.248.112:30774] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpass.php"] [unique_id "acVbnw3kybI2o-xasmA0IgAAAc8"]
[Fri Mar 27 00:15:28.278595 2026] [:error] [pid 19711:tid 19767] [client 20.215.248.112:37676] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpass.php"] [unique_id "acVboGj3l1y81GYfluT1WQAAAFI"]
[Fri Mar 27 00:15:29.012297 2026] [:error] [pid 60829:tid 60835] [client 20.215.248.112:45846] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xpass.php"] [unique_id "acVbofTdjHKeZokybaTplAAAAQQ"]
[Fri Mar 27 00:15:29.672032 2026] [:error] [pid 31670:tid 31672] [client 20.215.248.112:63966] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acVboTXVthXxCnWjOTT-GwAAAUA"]
[Fri Mar 27 00:15:30.325359 2026] [:error] [pid 19710:tid 19735] [client 20.215.248.112:54713] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acVbogVEWP8Ar68Njk5djgAAAA0"]
[Fri Mar 27 00:15:31.153588 2026] [:error] [pid 19711:tid 19757] [client 20.215.248.112:42229] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acVbo2j3l1y81GYfluT1ZgAAAEg"]
[Fri Mar 27 00:15:31.751511 2026] [:error] [pid 19712:tid 19776] [client 20.215.248.112:62905] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acVbo9WhKhRNqm23vFNovgAAAIA"]
[Fri Mar 27 00:15:32.350056 2026] [:error] [pid 19711:tid 19752] [client 20.215.248.112:3506] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acVbpGj3l1y81GYfluT1bAAAAEM"]
[Fri Mar 27 00:15:32.930640 2026] [:error] [pid 19710:tid 19731] [client 20.215.248.112:54710] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acVbpAVEWP8Ar68Njk5dlAAAAAk"]
[Fri Mar 27 00:15:33.463781 2026] [:error] [pid 19712:tid 19780] [client 20.215.248.112:58914] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acVbpdWhKhRNqm23vFNowwAAAIQ"]
[Fri Mar 27 00:15:34.125833 2026] [:error] [pid 19711:tid 19761] [client 20.215.248.112:62853] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acVbpmj3l1y81GYfluT1cgAAAEw"]
[Fri Mar 27 00:52:26.261630 2026] [:error] [pid 44058:tid 44060] [client 175.6.217.4:51724] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acVkSuqp9u5CVRGdZPHj4wAAAIA"]
[Fri Mar 27 01:40:02.104784 2026] [:error] [pid 62148:tid 62514] [client 185.169.4.152:50096] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "acVvcoduik-mTruBKFVv9gAAAFE"]
[Fri Mar 27 01:40:02.822356 2026] [:error] [pid 62551:tid 62570] [client 185.169.4.152:54399] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "acVvcoQvFHgfE1g4p7CRyAAAAdA"]
[Fri Mar 27 01:56:37.872415 2026] [:error] [pid 62149:tid 62541] [client 43.130.116.87:44490] [client 43.130.116.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acVzVWHvvta9MPqU8PVp3wAAARE"]
[Fri Mar 27 03:01:01.630454 2026] [:error] [pid 44058:tid 44077] [client 43.156.228.27:53174] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acWCbeqp9u5CVRGdZPE25gAAAJE"]
[Fri Mar 27 03:32:50.771101 2026] [:error] [pid 44058:tid 44065] [client 128.201.45.150:64548] [client 128.201.45.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.201.45.150, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acWJ4uqp9u5CVRGdZPFRsQAAAIU"]
[Fri Mar 27 03:32:50.782574 2026] [proxy_fcgi:error] [pid 44058:tid 44065] [client 128.201.45.150:64548] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.242985 2026] [proxy_fcgi:error] [pid 27851:tid 27876] [client 20.92.95.100:8114] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.264291 2026] [proxy_fcgi:error] [pid 27851:tid 27867] [client 20.92.95.100:8114] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.283561 2026] [proxy_fcgi:error] [pid 27851:tid 27858] [client 20.92.95.100:8114] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.332023 2026] [proxy_fcgi:error] [pid 27851:tid 27859] [client 20.92.95.100:8114] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.433250 2026] [proxy_fcgi:error] [pid 27851:tid 27877] [client 20.92.95.100:8114] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 06:11:25.486669 2026] [:error] [pid 27851:tid 27872] [client 20.92.95.100:8114] [client 20.92.95.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Content/Type/index.php"] [unique_id "acWvDXR2ccxe3RMCLboUfgAAAM4"]
[Fri Mar 27 06:11:25.586732 2026] [:error] [pid 27851:tid 27868] [client 20.92.95.100:6278] [client 20.92.95.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Content/Type/index.php"] [unique_id "acWvDXR2ccxe3RMCLboUfwAAAMo"]
[Fri Mar 27 06:11:25.651691 2026] [:error] [pid 4293:tid 4315] [client 20.92.95.100:11455] [client 20.92.95.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Content/Type/index.php"] [unique_id "acWvDZLjeJUC3OKtEx9aTwAAAVQ"]
[Fri Mar 27 06:11:25.717575 2026] [:error] [pid 4293:tid 4308] [client 20.92.95.100:3724] [client 20.92.95.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Content/Type/index.php"] [unique_id "acWvDZLjeJUC3OKtEx9aUAAAAU0"]
[Fri Mar 27 08:00:22.532530 2026] [:error] [pid 27851:tid 27875] [client 182.44.2.148:56738] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acXIlnR2ccxe3RMCLboy4wAAANE"]
[Fri Mar 27 09:25:42.622676 2026] [proxy_fcgi:error] [pid 4293:tid 4311] [client 45.89.60.157:49725] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 09:56:46.728783 2026] [:error] [pid 4341:tid 4348] [client 43.157.20.63:49000] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acXj3uKJWrNB5dMlERFqtQAAAYU"]
[Fri Mar 27 11:23:08.440427 2026] [:error] [pid 4293:tid 4298] [client 216.81.248.80:34138] [client 216.81.248.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "acX4HJLjeJUC3OKtEx8x9gAAAUM"]
[Fri Mar 27 12:50:19.536811 2026] [:error] [pid 63897:tid 63919] [client 180.243.36.95:23023] [client 180.243.36.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.36.95, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acYMi2VSkmYmLu7ycYi_kwAAARQ"]
[Fri Mar 27 12:50:19.553676 2026] [proxy_fcgi:error] [pid 63897:tid 63919] [client 180.243.36.95:23023] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 12:55:43.423528 2026] [:error] [pid 27743:tid 27783] [client 64.226.68.115:64250] [client 64.226.68.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.226.68.115, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acYNzyA46UYYLqzw99A-pgAAABM"]
[Fri Mar 27 12:55:43.432938 2026] [proxy_fcgi:error] [pid 27743:tid 27783] [client 64.226.68.115:64250] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 12:55:48.763582 2026] [:error] [pid 27743:tid 27776] [client 64.226.68.115:64250] [client 64.226.68.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acYN1CA46UYYLqzw99A-sQAAAAw"]
[Fri Mar 27 12:55:49.447974 2026] [:error] [pid 4293:tid 4304] [client 64.226.68.115:49764] [client 64.226.68.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acYN1ZLjeJUC3OKtEx91IQAAAUk"]
[Fri Mar 27 12:55:50.330044 2026] [:error] [pid 4293:tid 4303] [client 64.226.68.115:49981] [client 64.226.68.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acYN1pLjeJUC3OKtEx91JwAAAUg"]
[Fri Mar 27 12:55:50.923895 2026] [:error] [pid 4293:tid 4317] [client 64.226.68.115:50139] [client 64.226.68.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acYN1pLjeJUC3OKtEx91KgAAAVY"]
[Fri Mar 27 13:44:43.222373 2026] [:error] [pid 4341:tid 4345] [client 78.47.100.175:42348] [client 78.47.100.175] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/css"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acYZS-KJWrNB5dMlERHl0wAAAYI"]
[Fri Mar 27 13:44:43.222644 2026] [:error] [pid 4341:tid 4345] [client 78.47.100.175:42348] [client 78.47.100.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acYZS-KJWrNB5dMlERHl0wAAAYI"]
[Fri Mar 27 14:24:52.139169 2026] [:error] [pid 63897:tid 63918] [client 185.192.71.143:59613] [client 185.192.71.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.143, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "acYitGVSkmYmLu7ycYjhtgAAARM"]
[Fri Mar 27 14:24:52.148648 2026] [proxy_fcgi:error] [pid 63897:tid 63918] [client 185.192.71.143:59613] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 15:13:21.325666 2026] [:error] [pid 4293:tid 4309] [client 182.42.111.213:39280] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acYuEZLjeJUC3OKtEx_BwQAAAU4"]
[Fri Mar 27 17:22:13.893169 2026] [:error] [pid 27743:tid 27767] [client 43.131.45.213:43076] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acZMRSA46UYYLqzw99CP4gAAAAM"]
[Fri Mar 27 18:37:51.294647 2026] [proxy_fcgi:error] [pid 4341:tid 4357] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:51.539548 2026] [proxy_fcgi:error] [pid 4341:tid 4343] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:51.783202 2026] [proxy_fcgi:error] [pid 4341:tid 4355] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:52.029943 2026] [proxy_fcgi:error] [pid 4341:tid 4349] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:52.276289 2026] [proxy_fcgi:error] [pid 4341:tid 4364] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:52.524891 2026] [proxy_fcgi:error] [pid 4341:tid 4366] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:52.767934 2026] [proxy_fcgi:error] [pid 4341:tid 4346] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:53.030945 2026] [proxy_fcgi:error] [pid 4341:tid 4348] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:53.275185 2026] [proxy_fcgi:error] [pid 4341:tid 4361] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:53.520452 2026] [proxy_fcgi:error] [pid 4341:tid 4347] [client 158.158.43.158:65015] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:37:53.759972 2026] [:error] [pid 4341:tid 4367] [client 158.158.43.158:65015] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bootstrap.php"] [unique_id "acZeAeKJWrNB5dMlERGB9AAAAZg"]
[Fri Mar 27 18:37:54.253027 2026] [:error] [pid 4293:tid 4296] [client 158.158.43.158:65059] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bootstrap.php"] [unique_id "acZeApLjeJUC3OKtEx9HbAAAAUE"]
[Fri Mar 27 18:37:54.752936 2026] [:error] [pid 4293:tid 4313] [client 158.158.43.158:64521] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bootstrap.php"] [unique_id "acZeApLjeJUC3OKtEx9HbwAAAVI"]
[Fri Mar 27 18:37:55.242046 2026] [:error] [pid 4341:tid 4366] [client 158.158.43.158:65493] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bootstrap.php"] [unique_id "acZeA-KJWrNB5dMlERGB-AAAAZc"]
[Fri Mar 27 18:37:55.741090 2026] [:error] [pid 27743:tid 27773] [client 158.158.43.158:65083] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "acZeAyA46UYYLqzw99C4ngAAAAk"]
[Fri Mar 27 18:37:56.243904 2026] [:error] [pid 27750:tid 27832] [client 158.158.43.158:65061] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "acZeBIaSil5rd17ieLzgbQAAAI4"]
[Fri Mar 27 18:37:56.738851 2026] [:error] [pid 63897:tid 63906] [client 158.158.43.158:64978] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "acZeBGVSkmYmLu7ycYg1rwAAAQc"]
[Fri Mar 27 18:37:57.229672 2026] [:error] [pid 63897:tid 63915] [client 158.158.43.158:64995] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "acZeBWVSkmYmLu7ycYg1sgAAARA"]
[Fri Mar 27 18:37:57.793109 2026] [:error] [pid 27749:tid 27801] [client 158.158.43.158:64982] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "acZeBcEqyoMni2Q6_X7kAQAAAEo"]
[Fri Mar 27 18:37:58.309782 2026] [:error] [pid 4341:tid 4355] [client 158.158.43.158:65477] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "acZeBuKJWrNB5dMlERGB_wAAAYw"]
[Fri Mar 27 18:37:58.789635 2026] [:error] [pid 27851:tid 27872] [client 158.158.43.158:64559] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "acZeBnR2ccxe3RMCLbrbTAAAAM4"]
[Fri Mar 27 18:37:59.344008 2026] [:error] [pid 27750:tid 27833] [client 158.158.43.158:65478] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "acZeB4aSil5rd17ieLzgbwAAAI8"]
[Fri Mar 27 18:37:59.839425 2026] [:error] [pid 4293:tid 4302] [client 158.158.43.158:65520] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "acZeB5LjeJUC3OKtEx9HegAAAUc"]
[Fri Mar 27 18:38:00.343863 2026] [:error] [pid 27750:tid 27823] [client 158.158.43.158:64520] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "acZeCIaSil5rd17ieLzgcAAAAIU"]
[Fri Mar 27 18:38:00.851663 2026] [:error] [pid 27851:tid 27865] [client 158.158.43.158:65054] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "acZeCHR2ccxe3RMCLbrbTwAAAMc"]
[Fri Mar 27 18:38:01.350121 2026] [:error] [pid 4293:tid 4298] [client 158.158.43.158:65512] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "acZeCZLjeJUC3OKtEx9HfAAAAUM"]
[Fri Mar 27 18:38:01.845294 2026] [:error] [pid 4293:tid 4319] [client 158.158.43.158:64515] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "acZeCZLjeJUC3OKtEx9HfgAAAVg"]
[Fri Mar 27 18:38:02.378553 2026] [:error] [pid 4341:tid 4357] [client 158.158.43.158:65522] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "acZeCuKJWrNB5dMlERGCBgAAAY4"]
[Fri Mar 27 18:38:02.865590 2026] [:error] [pid 4341:tid 4355] [client 158.158.43.158:65048] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "acZeCuKJWrNB5dMlERGCBwAAAYw"]
[Fri Mar 27 18:38:03.352232 2026] [:error] [pid 63897:tid 63916] [client 158.158.43.158:65087] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "acZeC2VSkmYmLu7ycYg1ugAAARE"]
[Fri Mar 27 18:38:03.838938 2026] [:error] [pid 27749:tid 27796] [client 158.158.43.158:64981] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxfyf.php"] [unique_id "acZeC8EqyoMni2Q6_X7kBgAAAEU"]
[Fri Mar 27 18:38:04.331570 2026] [:error] [pid 27743:tid 27765] [client 158.158.43.158:65040] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxfyf.php"] [unique_id "acZeDCA46UYYLqzw99C4pAAAAAE"]
[Fri Mar 27 18:38:04.818985 2026] [:error] [pid 4293:tid 4303] [client 158.158.43.158:64517] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxfyf.php"] [unique_id "acZeDJLjeJUC3OKtEx9HggAAAUg"]
[Fri Mar 27 18:38:05.303637 2026] [:error] [pid 27749:tid 27811] [client 158.158.43.158:65069] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxfyf.php"] [unique_id "acZeDcEqyoMni2Q6_X7kBwAAAFQ"]
[Fri Mar 27 18:38:05.793640 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:65031] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acZeDZLjeJUC3OKtEx9HhAAAAUU"]
[Fri Mar 27 18:38:06.296532 2026] [:error] [pid 27743:tid 27782] [client 158.158.43.158:64970] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acZeDiA46UYYLqzw99C4pgAAABI"]
[Fri Mar 27 18:38:06.785109 2026] [:error] [pid 27743:tid 27778] [client 158.158.43.158:65501] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acZeDiA46UYYLqzw99C4qAAAAA4"]
[Fri Mar 27 18:38:07.264178 2026] [:error] [pid 27743:tid 27787] [client 158.158.43.158:65007] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "acZeDyA46UYYLqzw99C4qwAAABc"]
[Fri Mar 27 18:38:07.757113 2026] [:error] [pid 4293:tid 4311] [client 158.158.43.158:65510] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acZeD5LjeJUC3OKtEx9HiwAAAVA"]
[Fri Mar 27 18:38:08.243544 2026] [:error] [pid 27743:tid 27779] [client 158.158.43.158:65518] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acZeECA46UYYLqzw99C4rwAAAA8"]
[Fri Mar 27 18:38:08.725974 2026] [:error] [pid 27743:tid 27774] [client 158.158.43.158:65024] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acZeECA46UYYLqzw99C4sAAAAAo"]
[Fri Mar 27 18:38:09.219894 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:65066] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acZeESA46UYYLqzw99C4swAAAAY"]
[Fri Mar 27 18:38:09.728685 2026] [:error] [pid 27750:tid 27833] [client 158.158.43.158:65053] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "acZeEYaSil5rd17ieLzgewAAAI8"]
[Fri Mar 27 18:38:10.232075 2026] [:error] [pid 63897:tid 63914] [client 158.158.43.158:65009] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "acZeEmVSkmYmLu7ycYg1wQAAAQ8"]
[Fri Mar 27 18:38:10.734629 2026] [:error] [pid 27743:tid 27786] [client 158.158.43.158:65498] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "acZeEiA46UYYLqzw99C4uwAAABY"]
[Fri Mar 27 18:38:11.265456 2026] [:error] [pid 27851:tid 27873] [client 158.158.43.158:64575] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "acZeE3R2ccxe3RMCLbrbVQAAAM8"]
[Fri Mar 27 18:38:11.773620 2026] [:error] [pid 4341:tid 4366] [client 158.158.43.158:65521] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "acZeE-KJWrNB5dMlERGCCgAAAZc"]
[Fri Mar 27 18:38:12.266431 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:64013] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "acZeFOKJWrNB5dMlERGCDAAAAYg"]
[Fri Mar 27 18:38:12.781149 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64490] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "acZeFOKJWrNB5dMlERGCDQAAAYk"]
[Fri Mar 27 18:38:13.290519 2026] [:error] [pid 27743:tid 27775] [client 158.158.43.158:65017] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "acZeFSA46UYYLqzw99C4vQAAAAs"]
[Fri Mar 27 18:38:13.772532 2026] [:error] [pid 27851:tid 27872] [client 158.158.43.158:65016] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "acZeFXR2ccxe3RMCLbrbVwAAAM4"]
[Fri Mar 27 18:38:14.294832 2026] [:error] [pid 27851:tid 27870] [client 158.158.43.158:64960] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "acZeFnR2ccxe3RMCLbrbWQAAAMw"]
[Fri Mar 27 18:38:14.783280 2026] [:error] [pid 4341:tid 4347] [client 158.158.43.158:65078] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "acZeFuKJWrNB5dMlERGCEgAAAYQ"]
[Fri Mar 27 18:38:15.298789 2026] [:error] [pid 27750:tid 27821] [client 158.158.43.158:65067] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "acZeF4aSil5rd17ieLzgfQAAAIM"]
[Fri Mar 27 18:38:15.781107 2026] [:error] [pid 27743:tid 27782] [client 158.158.43.158:65062] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "acZeFyA46UYYLqzw99C4xAAAABI"]
[Fri Mar 27 18:38:16.303065 2026] [:error] [pid 27851:tid 27865] [client 158.158.43.158:65475] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "acZeGHR2ccxe3RMCLbrbWgAAAMc"]
[Fri Mar 27 18:38:16.816933 2026] [:error] [pid 4293:tid 4311] [client 158.158.43.158:65013] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "acZeGJLjeJUC3OKtEx9HkAAAAVA"]
[Fri Mar 27 18:38:17.323055 2026] [:error] [pid 27743:tid 27773] [client 158.158.43.158:64539] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "acZeGSA46UYYLqzw99C4xgAAAAk"]
[Fri Mar 27 18:38:17.842819 2026] [:error] [pid 27743:tid 27781] [client 158.158.43.158:64056] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "acZeGSA46UYYLqzw99C4yQAAABE"]
[Fri Mar 27 18:38:18.348057 2026] [:error] [pid 27750:tid 27835] [client 158.158.43.158:65076] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "acZeGoaSil5rd17ieLzghgAAAJE"]
[Fri Mar 27 18:38:18.838834 2026] [:error] [pid 4293:tid 4313] [client 158.158.43.158:65074] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "acZeGpLjeJUC3OKtEx9HkwAAAVI"]
[Fri Mar 27 18:38:19.331713 2026] [:error] [pid 27743:tid 27777] [client 158.158.43.158:65047] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "acZeGyA46UYYLqzw99C4zAAAAA0"]
[Fri Mar 27 18:38:19.811490 2026] [:error] [pid 27749:tid 27813] [client 158.158.43.158:65497] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "acZeG8EqyoMni2Q6_X7kCwAAAFY"]
[Fri Mar 27 18:38:20.321570 2026] [:error] [pid 27851:tid 27867] [client 158.158.43.158:65075] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "acZeHHR2ccxe3RMCLbrbXQAAAMk"]
[Fri Mar 27 18:38:20.801790 2026] [:error] [pid 27749:tid 27800] [client 158.158.43.158:65030] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "acZeHMEqyoMni2Q6_X7kDAAAAEk"]
[Fri Mar 27 18:38:21.302380 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64462] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "acZeHeKJWrNB5dMlERGCFwAAAYk"]
[Fri Mar 27 18:38:21.789185 2026] [:error] [pid 27851:tid 27860] [client 158.158.43.158:65524] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "acZeHXR2ccxe3RMCLbrbXwAAAMI"]
[Fri Mar 27 18:38:22.294093 2026] [:error] [pid 4293:tid 4302] [client 158.158.43.158:64449] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "acZeHpLjeJUC3OKtEx9HmAAAAUc"]
[Fri Mar 27 18:38:22.784460 2026] [:error] [pid 4293:tid 4316] [client 158.158.43.158:64984] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "acZeHpLjeJUC3OKtEx9HmgAAAVU"]
[Fri Mar 27 18:38:23.318928 2026] [:error] [pid 4293:tid 4315] [client 158.158.43.158:65035] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "acZeH5LjeJUC3OKtEx9HngAAAVQ"]
[Fri Mar 27 18:38:23.797746 2026] [:error] [pid 27851:tid 27880] [client 158.158.43.158:65515] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "acZeH3R2ccxe3RMCLbrbYgAAANY"]
[Fri Mar 27 18:38:24.316747 2026] [:error] [pid 27743:tid 27783] [client 158.158.43.158:64973] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "acZeICA46UYYLqzw99C4zgAAABM"]
[Fri Mar 27 18:38:24.796791 2026] [:error] [pid 27750:tid 27827] [client 158.158.43.158:64563] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "acZeIIaSil5rd17ieLzgjQAAAIk"]
[Fri Mar 27 18:38:25.289954 2026] [:error] [pid 27743:tid 27779] [client 158.158.43.158:65001] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "acZeISA46UYYLqzw99C40QAAAA8"]
[Fri Mar 27 18:38:25.782597 2026] [:error] [pid 27750:tid 27838] [client 158.158.43.158:65523] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acZeIYaSil5rd17ieLzgjwAAAJQ"]
[Fri Mar 27 18:38:26.282139 2026] [:error] [pid 4341:tid 4360] [client 158.158.43.158:65002] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acZeIuKJWrNB5dMlERGCHwAAAZE"]
[Fri Mar 27 18:38:26.787896 2026] [:error] [pid 4341:tid 4343] [client 158.158.43.158:65051] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acZeIuKJWrNB5dMlERGCIAAAAYA"]
[Fri Mar 27 18:38:27.285407 2026] [:error] [pid 63897:tid 63909] [client 158.158.43.158:65489] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acZeI2VSkmYmLu7ycYg13wAAAQo"]
[Fri Mar 27 18:38:27.787415 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:65085] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acZeI5LjeJUC3OKtEx9HpgAAAVM"]
[Fri Mar 27 18:38:28.292819 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:64035] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acZeJOKJWrNB5dMlERGCIQAAAYg"]
[Fri Mar 27 18:38:28.778532 2026] [:error] [pid 63897:tid 63923] [client 158.158.43.158:65043] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acZeJGVSkmYmLu7ycYg14gAAARg"]
[Fri Mar 27 18:38:29.287323 2026] [:error] [pid 27750:tid 27835] [client 158.158.43.158:65501] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "acZeJYaSil5rd17ieLzgkQAAAJE"]
[Fri Mar 27 18:38:29.786312 2026] [:error] [pid 4293:tid 4308] [client 158.158.43.158:65519] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acZeJZLjeJUC3OKtEx9HqwAAAU0"]
[Fri Mar 27 18:38:30.289539 2026] [:error] [pid 63897:tid 63904] [client 158.158.43.158:65487] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acZeJmVSkmYmLu7ycYg15AAAAQU"]
[Fri Mar 27 18:38:30.822590 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64006] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acZeJuKJWrNB5dMlERGCIgAAAYk"]
[Fri Mar 27 18:38:31.311286 2026] [:error] [pid 27743:tid 27773] [client 158.158.43.158:64988] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acZeJyA46UYYLqzw99C41gAAAAk"]
[Fri Mar 27 18:38:31.792670 2026] [:error] [pid 27743:tid 27781] [client 158.158.43.158:64983] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "acZeJyA46UYYLqzw99C42AAAABE"]
[Fri Mar 27 18:38:32.301670 2026] [:error] [pid 4341:tid 4350] [client 158.158.43.158:64485] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "acZeKOKJWrNB5dMlERGCJQAAAYc"]
[Fri Mar 27 18:38:32.805359 2026] [:error] [pid 4341:tid 4347] [client 158.158.43.158:64974] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "acZeKOKJWrNB5dMlERGCJwAAAYQ"]
[Fri Mar 27 18:38:33.303695 2026] [:error] [pid 4341:tid 4364] [client 158.158.43.158:64012] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "acZeKeKJWrNB5dMlERGCKgAAAZU"]
[Fri Mar 27 18:38:33.786410 2026] [:error] [pid 4341:tid 4367] [client 158.158.43.158:64029] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "acZeKeKJWrNB5dMlERGCKwAAAZg"]
[Fri Mar 27 18:38:34.274168 2026] [:error] [pid 4293:tid 4298] [client 158.158.43.158:64523] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "acZeKpLjeJUC3OKtEx9HswAAAUM"]
[Fri Mar 27 18:38:34.791603 2026] [:error] [pid 4341:tid 4349] [client 158.158.43.158:65506] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "acZeKuKJWrNB5dMlERGCLQAAAYY"]
[Fri Mar 27 18:38:35.277218 2026] [:error] [pid 4341:tid 4343] [client 158.158.43.158:65516] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "acZeK-KJWrNB5dMlERGCLgAAAYA"]
[Fri Mar 27 18:38:35.784120 2026] [:error] [pid 27851:tid 27871] [client 158.158.43.158:65023] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "acZeK3R2ccxe3RMCLbrbaQAAAM0"]
[Fri Mar 27 18:38:36.278925 2026] [:error] [pid 4341:tid 4345] [client 158.158.43.158:64567] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "acZeLOKJWrNB5dMlERGCLwAAAYI"]
[Fri Mar 27 18:38:36.800434 2026] [:error] [pid 4341:tid 4344] [client 158.158.43.158:65065] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "acZeLOKJWrNB5dMlERGCMAAAAYE"]
[Fri Mar 27 18:38:37.304534 2026] [:error] [pid 27749:tid 27797] [client 158.158.43.158:64987] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "acZeLcEqyoMni2Q6_X7kEQAAAEY"]
[Fri Mar 27 18:38:37.783416 2026] [:error] [pid 27743:tid 27771] [client 158.158.43.158:64518] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acZeLSA46UYYLqzw99C44AAAAAc"]
[Fri Mar 27 18:38:38.279801 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:65082] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acZeLiA46UYYLqzw99C44wAAABQ"]
[Fri Mar 27 18:38:38.783624 2026] [:error] [pid 27743:tid 27768] [client 158.158.43.158:64963] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acZeLiA46UYYLqzw99C45gAAAAQ"]
[Fri Mar 27 18:38:39.292502 2026] [:error] [pid 27743:tid 27777] [client 158.158.43.158:65525] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acZeLyA46UYYLqzw99C46QAAAA0"]
[Fri Mar 27 18:38:39.809995 2026] [:error] [pid 4341:tid 4356] [client 158.158.43.158:64041] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acZeL-KJWrNB5dMlERGCMwAAAY0"]
[Fri Mar 27 18:38:40.299842 2026] [:error] [pid 4341:tid 4367] [client 158.158.43.158:64540] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acZeMOKJWrNB5dMlERGCNwAAAZg"]
[Fri Mar 27 18:38:40.778334 2026] [:error] [pid 27743:tid 27772] [client 158.158.43.158:65500] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acZeMCA46UYYLqzw99C46gAAAAg"]
[Fri Mar 27 18:38:41.293767 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:65479] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "acZeMSA46UYYLqzw99C47gAAABQ"]
[Fri Mar 27 18:38:41.790823 2026] [:error] [pid 27750:tid 27820] [client 158.158.43.158:65504] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "acZeMYaSil5rd17ieLzgnwAAAII"]
[Fri Mar 27 18:38:42.288561 2026] [:error] [pid 4341:tid 4345] [client 158.158.43.158:64996] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "acZeMuKJWrNB5dMlERGCOwAAAYI"]
[Fri Mar 27 18:38:42.787947 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64022] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "acZeMuKJWrNB5dMlERGCPgAAAYM"]
[Fri Mar 27 18:38:43.277196 2026] [:error] [pid 4341:tid 4366] [client 158.158.43.158:65511] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "acZeM-KJWrNB5dMlERGCQQAAAZc"]
[Fri Mar 27 18:38:43.760732 2026] [:error] [pid 27743:tid 27772] [client 158.158.43.158:64979] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acZeMyA46UYYLqzw99C48gAAAAg"]
[Fri Mar 27 18:38:44.255154 2026] [:error] [pid 4293:tid 4296] [client 158.158.43.158:65003] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acZeNJLjeJUC3OKtEx9HvAAAAUE"]
[Fri Mar 27 18:38:44.735911 2026] [:error] [pid 27749:tid 27808] [client 158.158.43.158:64513] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acZeNMEqyoMni2Q6_X7kFAAAAFE"]
[Fri Mar 27 18:38:45.219703 2026] [:error] [pid 4293:tid 4301] [client 158.158.43.158:65020] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "acZeNZLjeJUC3OKtEx9HwQAAAUY"]
[Fri Mar 27 18:38:45.703066 2026] [:error] [pid 4293:tid 4311] [client 158.158.43.158:65037] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acZeNZLjeJUC3OKtEx9HxQAAAVA"]
[Fri Mar 27 18:38:46.190570 2026] [:error] [pid 27743:tid 27783] [client 158.158.43.158:64533] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acZeNiA46UYYLqzw99C49QAAABM"]
[Fri Mar 27 18:38:46.712043 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64971] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acZeNuKJWrNB5dMlERGCSAAAAYM"]
[Fri Mar 27 18:38:47.215947 2026] [:error] [pid 4341:tid 4344] [client 158.158.43.158:65514] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acZeN-KJWrNB5dMlERGCSgAAAYE"]
[Fri Mar 27 18:38:47.703206 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64025] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acZeN-KJWrNB5dMlERGCTQAAAYk"]
[Fri Mar 27 18:38:48.196207 2026] [:error] [pid 4341:tid 4364] [client 158.158.43.158:65513] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acZeOOKJWrNB5dMlERGCTgAAAZU"]
[Fri Mar 27 18:38:48.702384 2026] [:error] [pid 4293:tid 4318] [client 158.158.43.158:65057] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acZeOJLjeJUC3OKtEx9HzwAAAVc"]
[Fri Mar 27 18:38:49.200578 2026] [:error] [pid 4293:tid 4296] [client 158.158.43.158:64972] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acZeOZLjeJUC3OKtEx9H1AAAAUE"]
[Fri Mar 27 18:38:49.686580 2026] [:error] [pid 27743:tid 27765] [client 158.158.43.158:65484] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "acZeOSA46UYYLqzw99C4-QAAAAE"]
[Fri Mar 27 18:38:50.204190 2026] [:error] [pid 4293:tid 4311] [client 158.158.43.158:65084] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "acZeOpLjeJUC3OKtEx9H1gAAAVA"]
[Fri Mar 27 18:38:50.699199 2026] [:error] [pid 4293:tid 4315] [client 158.158.43.158:64454] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "acZeOpLjeJUC3OKtEx9H2AAAAVQ"]
[Fri Mar 27 18:38:51.184519 2026] [:error] [pid 4293:tid 4298] [client 158.158.43.158:65070] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "acZeO5LjeJUC3OKtEx9H2gAAAUM"]
[Fri Mar 27 18:38:51.671348 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:64477] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acZeOyA46UYYLqzw99C4_wAAABQ"]
[Fri Mar 27 18:38:52.164037 2026] [:error] [pid 4293:tid 4318] [client 158.158.43.158:64497] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acZePJLjeJUC3OKtEx9H5AAAAVc"]
[Fri Mar 27 18:38:52.660722 2026] [:error] [pid 4293:tid 4296] [client 158.158.43.158:64552] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "acZePJLjeJUC3OKtEx9H6QAAAUE"]
[Fri Mar 27 18:38:53.178980 2026] [proxy_fcgi:error] [pid 4293:tid 4317] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:53.423009 2026] [proxy_fcgi:error] [pid 4293:tid 4306] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:53.666613 2026] [proxy_fcgi:error] [pid 4293:tid 4301] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:53.910004 2026] [proxy_fcgi:error] [pid 4293:tid 4319] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:54.469082 2026] [proxy_fcgi:error] [pid 4293:tid 4303] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:54.713176 2026] [proxy_fcgi:error] [pid 4293:tid 4317] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:54.961071 2026] [proxy_fcgi:error] [pid 4293:tid 4295] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:55.204541 2026] [proxy_fcgi:error] [pid 4293:tid 4309] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:55.454311 2026] [proxy_fcgi:error] [pid 4293:tid 4311] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:55.696702 2026] [proxy_fcgi:error] [pid 4293:tid 4302] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:55.940092 2026] [proxy_fcgi:error] [pid 4293:tid 4313] [client 158.158.43.158:65058] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:38:56.190453 2026] [:error] [pid 4293:tid 4298] [client 158.158.43.158:65058] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acZeQJLjeJUC3OKtEx9H_wAAAUM"]
[Fri Mar 27 18:38:56.746859 2026] [:error] [pid 27851:tid 27869] [client 158.158.43.158:64976] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acZeQHR2ccxe3RMCLbrbcwAAAMs"]
[Fri Mar 27 18:38:57.240467 2026] [:error] [pid 27749:tid 27809] [client 158.158.43.158:64986] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acZeQcEqyoMni2Q6_X7kGwAAAFI"]
[Fri Mar 27 18:38:57.783936 2026] [:error] [pid 4341:tid 4350] [client 158.158.43.158:64997] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "acZeQeKJWrNB5dMlERGCWQAAAYc"]
[Fri Mar 27 18:38:58.406426 2026] [:error] [pid 27851:tid 27873] [client 158.158.43.158:65064] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acZeQnR2ccxe3RMCLbrbdwAAAM8"]
[Fri Mar 27 18:38:59.081102 2026] [:error] [pid 27750:tid 27831] [client 158.158.43.158:64977] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acZeQ4aSil5rd17ieLzgswAAAI0"]
[Fri Mar 27 18:38:59.640502 2026] [:error] [pid 27851:tid 27865] [client 158.158.43.158:64461] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acZeQ3R2ccxe3RMCLbrbegAAAMc"]
[Fri Mar 27 18:39:00.230615 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:64448] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "acZeRCA46UYYLqzw99C5AgAAABQ"]
[Fri Mar 27 18:39:00.777620 2026] [:error] [pid 27743:tid 27782] [client 158.158.43.158:64514] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeRCA46UYYLqzw99C5BQAAABI"]
[Fri Mar 27 18:39:01.401251 2026] [:error] [pid 27743:tid 27768] [client 158.158.43.158:65034] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeRSA46UYYLqzw99C5CwAAAAQ"]
[Fri Mar 27 18:39:01.989770 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:63638] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeRWVSkmYmLu7ycYg17wAAAQk"]
[Fri Mar 27 18:39:02.469342 2026] [:error] [pid 63897:tid 63918] [client 158.158.43.158:64459] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeRmVSkmYmLu7ycYg18QAAARM"]
[Fri Mar 27 18:39:03.035733 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:65046] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acZeR5LjeJUC3OKtEx9IBQAAAVM"]
[Fri Mar 27 18:39:03.535760 2026] [:error] [pid 4341:tid 4348] [client 158.158.43.158:64969] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acZeR-KJWrNB5dMlERGCZgAAAYU"]
[Fri Mar 27 18:39:04.046484 2026] [:error] [pid 4341:tid 4360] [client 158.158.43.158:64980] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acZeSOKJWrNB5dMlERGCaQAAAZE"]
[Fri Mar 27 18:39:04.546898 2026] [:error] [pid 63897:tid 63906] [client 158.158.43.158:65073] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "acZeSGVSkmYmLu7ycYg19AAAAQc"]
[Fri Mar 27 18:39:05.044780 2026] [:error] [pid 27851:tid 27873] [client 158.158.43.158:65491] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acZeSXR2ccxe3RMCLbrbgAAAAM8"]
[Fri Mar 27 18:39:05.538261 2026] [:error] [pid 4293:tid 4313] [client 158.158.43.158:64532] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acZeSZLjeJUC3OKtEx9ICgAAAVI"]
[Fri Mar 27 18:39:06.028799 2026] [:error] [pid 27749:tid 27807] [client 158.158.43.158:64991] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acZeSsEqyoMni2Q6_X7kJAAAAFA"]
[Fri Mar 27 18:39:06.523772 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:64998] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acZeSpLjeJUC3OKtEx9IEQAAAVM"]
[Fri Mar 27 18:39:07.028588 2026] [:error] [pid 63897:tid 63923] [client 158.158.43.158:64530] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acZeS2VSkmYmLu7ycYg1-AAAARg"]
[Fri Mar 27 18:39:07.540023 2026] [:error] [pid 27743:tid 27786] [client 158.158.43.158:64553] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acZeSyA46UYYLqzw99C5EgAAABY"]
[Fri Mar 27 18:39:08.048953 2026] [:error] [pid 4293:tid 4302] [client 158.158.43.158:64494] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acZeTJLjeJUC3OKtEx9IFwAAAUc"]
[Fri Mar 27 18:39:08.571191 2026] [:error] [pid 63897:tid 63900] [client 158.158.43.158:64009] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "acZeTGVSkmYmLu7ycYg1_AAAAQE"]
[Fri Mar 27 18:39:09.088188 2026] [:error] [pid 27743:tid 27765] [client 158.158.43.158:65036] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acZeTSA46UYYLqzw99C5FwAAAAE"]
[Fri Mar 27 18:39:09.583066 2026] [:error] [pid 4293:tid 4299] [client 158.158.43.158:65068] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acZeTZLjeJUC3OKtEx9IHwAAAUQ"]
[Fri Mar 27 18:39:10.069785 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:64992] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acZeTiA46UYYLqzw99C5GwAAAAY"]
[Fri Mar 27 18:39:10.580210 2026] [:error] [pid 4293:tid 4318] [client 158.158.43.158:64527] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "acZeTpLjeJUC3OKtEx9IIwAAAVc"]
[Fri Mar 27 18:39:11.083875 2026] [:error] [pid 27749:tid 27812] [client 158.158.43.158:65014] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acZeT8EqyoMni2Q6_X7kJQAAAFU"]
[Fri Mar 27 18:39:11.602597 2026] [:error] [pid 4293:tid 4305] [client 158.158.43.158:64989] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acZeT5LjeJUC3OKtEx9IKgAAAUo"]
[Fri Mar 27 18:39:12.090587 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:65081] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acZeUJLjeJUC3OKtEx9ILAAAAU8"]
[Fri Mar 27 18:39:12.587273 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:64475] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "acZeUCA46UYYLqzw99C5HAAAABQ"]
[Fri Mar 27 18:39:13.076433 2026] [:error] [pid 27743:tid 27776] [client 158.158.43.158:65045] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acZeUSA46UYYLqzw99C5HwAAAAw"]
[Fri Mar 27 18:39:13.576095 2026] [:error] [pid 27750:tid 27824] [client 158.158.43.158:64526] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acZeUYaSil5rd17ieLzgxAAAAIY"]
[Fri Mar 27 18:39:14.067899 2026] [:error] [pid 27749:tid 27804] [client 158.158.43.158:64965] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acZeUsEqyoMni2Q6_X7kJgAAAE0"]
[Fri Mar 27 18:39:14.553433 2026] [:error] [pid 27851:tid 27875] [client 158.158.43.158:65000] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "acZeUnR2ccxe3RMCLbrbigAAANE"]
[Fri Mar 27 18:39:15.052463 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:64476] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acZeU2VSkmYmLu7ycYg2AwAAAQk"]
[Fri Mar 27 18:39:15.549638 2026] [:error] [pid 27743:tid 27777] [client 158.158.43.158:64510] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acZeUyA46UYYLqzw99C5JwAAAA0"]
[Fri Mar 27 18:39:16.041382 2026] [:error] [pid 27743:tid 27783] [client 158.158.43.158:64975] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acZeVCA46UYYLqzw99C5KwAAABM"]
[Fri Mar 27 18:39:16.544883 2026] [:error] [pid 27749:tid 27806] [client 158.158.43.158:65018] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "acZeVMEqyoMni2Q6_X7kKQAAAE8"]
[Fri Mar 27 18:39:17.050647 2026] [:error] [pid 27749:tid 27798] [client 158.158.43.158:64528] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acZeVcEqyoMni2Q6_X7kLQAAAEc"]
[Fri Mar 27 18:39:17.547294 2026] [:error] [pid 27749:tid 27803] [client 158.158.43.158:65080] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acZeVcEqyoMni2Q6_X7kLwAAAEw"]
[Fri Mar 27 18:39:18.039528 2026] [:error] [pid 27743:tid 27778] [client 158.158.43.158:64994] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acZeViA46UYYLqzw99C5MQAAAA4"]
[Fri Mar 27 18:39:18.526712 2026] [:error] [pid 27743:tid 27769] [client 158.158.43.158:64017] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "acZeViA46UYYLqzw99C5NAAAAAU"]
[Fri Mar 27 18:39:19.030543 2026] [:error] [pid 27749:tid 27812] [client 158.158.43.158:65517] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "acZeV8EqyoMni2Q6_X7kMgAAAFU"]
[Fri Mar 27 18:39:19.524423 2026] [:error] [pid 4293:tid 4303] [client 158.158.43.158:64529] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "acZeV5LjeJUC3OKtEx9IOwAAAUg"]
[Fri Mar 27 18:39:20.002080 2026] [:error] [pid 27750:tid 27827] [client 158.158.43.158:64047] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "acZeWIaSil5rd17ieLzgyQAAAIk"]
[Fri Mar 27 18:39:20.500608 2026] [:error] [pid 4293:tid 4316] [client 158.158.43.158:65527] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "acZeWJLjeJUC3OKtEx9IPQAAAVU"]
[Fri Mar 27 18:39:20.987737 2026] [:error] [pid 4293:tid 4319] [client 158.158.43.158:64498] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "acZeWJLjeJUC3OKtEx9ISAAAAVg"]
[Fri Mar 27 18:39:21.475820 2026] [:error] [pid 63897:tid 63907] [client 158.158.43.158:64993] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "acZeWWVSkmYmLu7ycYg2CgAAAQg"]
[Fri Mar 27 18:39:21.983649 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:64474] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "acZeWZLjeJUC3OKtEx9IUgAAAUU"]
[Fri Mar 27 18:39:22.474366 2026] [:error] [pid 4341:tid 4347] [client 158.158.43.158:63999] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "acZeWuKJWrNB5dMlERGCdQAAAYQ"]
[Fri Mar 27 18:39:22.961826 2026] [:error] [pid 4341:tid 4361] [client 158.158.43.158:65474] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acZeWuKJWrNB5dMlERGCeAAAAZI"]
[Fri Mar 27 18:39:23.464360 2026] [:error] [pid 4341:tid 4363] [client 158.158.43.158:65005] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acZeW-KJWrNB5dMlERGCeQAAAZQ"]
[Fri Mar 27 18:39:23.958696 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:65473] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acZeW2VSkmYmLu7ycYg2DQAAAQk"]
[Fri Mar 27 18:39:24.438929 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:64480] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "acZeXJLjeJUC3OKtEx9IXgAAAUU"]
[Fri Mar 27 18:39:24.939332 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:64030] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "acZeXJLjeJUC3OKtEx9IZAAAAU8"]
[Fri Mar 27 18:39:25.460891 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:64570] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "acZeXZLjeJUC3OKtEx9IZwAAAVM"]
[Fri Mar 27 18:39:25.948503 2026] [:error] [pid 63897:tid 63922] [client 158.158.43.158:64536] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "acZeXWVSkmYmLu7ycYg2DwAAARc"]
[Fri Mar 27 18:39:26.436011 2026] [:error] [pid 27851:tid 27860] [client 158.158.43.158:64556] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "acZeXnR2ccxe3RMCLbrbjgAAAMI"]
[Fri Mar 27 18:39:26.923908 2026] [:error] [pid 63897:tid 63916] [client 158.158.43.158:65056] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acZeXmVSkmYmLu7ycYg2EAAAARE"]
[Fri Mar 27 18:39:27.413963 2026] [:error] [pid 63897:tid 63915] [client 158.158.43.158:64548] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acZeX2VSkmYmLu7ycYg2EQAAARA"]
[Fri Mar 27 18:39:27.896483 2026] [:error] [pid 4293:tid 4316] [client 158.158.43.158:64564] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acZeX5LjeJUC3OKtEx9IcgAAAVU"]
[Fri Mar 27 18:39:28.377316 2026] [:error] [pid 4293:tid 4312] [client 158.158.43.158:65011] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "acZeYJLjeJUC3OKtEx9IdQAAAVE"]
[Fri Mar 27 18:39:28.863828 2026] [:error] [pid 27743:tid 27783] [client 158.158.43.158:64007] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "acZeYCA46UYYLqzw99C5QAAAABM"]
[Fri Mar 27 18:39:29.353526 2026] [:error] [pid 27851:tid 27881] [client 158.158.43.158:65499] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "acZeYXR2ccxe3RMCLbrbkQAAANc"]
[Fri Mar 27 18:39:29.856522 2026] [:error] [pid 4341:tid 4359] [client 158.158.43.158:65021] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "acZeYeKJWrNB5dMlERGCfQAAAZA"]
[Fri Mar 27 18:39:30.345364 2026] [:error] [pid 27750:tid 27830] [client 158.158.43.158:63646] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "acZeYoaSil5rd17ieLzg1QAAAIw"]
[Fri Mar 27 18:39:30.822788 2026] [:error] [pid 63897:tid 63902] [client 158.158.43.158:65044] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "acZeYmVSkmYmLu7ycYg2FgAAAQM"]
[Fri Mar 27 18:39:31.308348 2026] [:error] [pid 4341:tid 4345] [client 158.158.43.158:64484] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "acZeY-KJWrNB5dMlERGCfgAAAYI"]
[Fri Mar 27 18:39:31.786149 2026] [:error] [pid 4341:tid 4364] [client 158.158.43.158:64543] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "acZeY-KJWrNB5dMlERGCgAAAAZU"]
[Fri Mar 27 18:39:32.283858 2026] [:error] [pid 27750:tid 27834] [client 158.158.43.158:65480] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "acZeZIaSil5rd17ieLzg2gAAAJA"]
[Fri Mar 27 18:39:32.767692 2026] [:error] [pid 4293:tid 4301] [client 158.158.43.158:64512] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "acZeZJLjeJUC3OKtEx9IfgAAAUY"]
[Fri Mar 27 18:39:33.251393 2026] [:error] [pid 4293:tid 4302] [client 158.158.43.158:63995] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "acZeZZLjeJUC3OKtEx9IfwAAAUc"]
[Fri Mar 27 18:39:33.732730 2026] [:error] [pid 4341:tid 4344] [client 158.158.43.158:64519] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "acZeZeKJWrNB5dMlERGChAAAAYE"]
[Fri Mar 27 18:39:34.223051 2026] [:error] [pid 4341:tid 4348] [client 158.158.43.158:64506] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "acZeZuKJWrNB5dMlERGChQAAAYU"]
[Fri Mar 27 18:39:34.709781 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64546] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acZeZuKJWrNB5dMlERGChwAAAYM"]
[Fri Mar 27 18:39:35.211075 2026] [:error] [pid 4341:tid 4360] [client 158.158.43.158:64458] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acZeZ-KJWrNB5dMlERGCiwAAAZE"]
[Fri Mar 27 18:39:35.704534 2026] [:error] [pid 27743:tid 27772] [client 158.158.43.158:64040] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acZeZyA46UYYLqzw99C5SQAAAAg"]
[Fri Mar 27 18:39:36.205410 2026] [:error] [pid 27743:tid 27767] [client 158.158.43.158:64002] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "acZeaCA46UYYLqzw99C5TAAAAAM"]
[Fri Mar 27 18:39:36.714053 2026] [:error] [pid 27749:tid 27815] [client 158.158.43.158:64460] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acZeaMEqyoMni2Q6_X7kNwAAAFg"]
[Fri Mar 27 18:39:37.198412 2026] [:error] [pid 27749:tid 27801] [client 158.158.43.158:64541] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acZeacEqyoMni2Q6_X7kOQAAAEo"]
[Fri Mar 27 18:39:37.697686 2026] [:error] [pid 27749:tid 27795] [client 158.158.43.158:64489] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acZeacEqyoMni2Q6_X7kPQAAAEQ"]
[Fri Mar 27 18:39:38.186517 2026] [:error] [pid 27851:tid 27867] [client 158.158.43.158:65086] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "acZeanR2ccxe3RMCLbrbmAAAAMk"]
[Fri Mar 27 18:39:38.687489 2026] [:error] [pid 27750:tid 27820] [client 158.158.43.158:64055] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZeaoaSil5rd17ieLzg3QAAAII"]
[Fri Mar 27 18:39:39.183472 2026] [:error] [pid 63897:tid 63905] [client 158.158.43.158:64464] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZea2VSkmYmLu7ycYg2JwAAAQY"]
[Fri Mar 27 18:39:39.663776 2026] [:error] [pid 27851:tid 27873] [client 158.158.43.158:64531] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZea3R2ccxe3RMCLbrbnwAAAM8"]
[Fri Mar 27 18:39:40.147200 2026] [:error] [pid 27750:tid 27818] [client 158.158.43.158:65029] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "acZebIaSil5rd17ieLzg4AAAAIA"]
[Fri Mar 27 18:39:40.638500 2026] [:error] [pid 27851:tid 27878] [client 158.158.43.158:64964] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acZebHR2ccxe3RMCLbrbowAAANQ"]
[Fri Mar 27 18:39:41.122704 2026] [:error] [pid 27750:tid 27839] [client 158.158.43.158:65039] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acZebYaSil5rd17ieLzg5AAAAJU"]
[Fri Mar 27 18:39:41.613259 2026] [:error] [pid 27750:tid 27829] [client 158.158.43.158:63951] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acZebYaSil5rd17ieLzg5QAAAIs"]
[Fri Mar 27 18:39:42.096880 2026] [:error] [pid 27750:tid 27819] [client 158.158.43.158:64962] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acZeboaSil5rd17ieLzg6AAAAIE"]
[Fri Mar 27 18:39:42.595328 2026] [:error] [pid 63897:tid 63921] [client 158.158.43.158:64542] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acZebmVSkmYmLu7ycYg2NAAAARY"]
[Fri Mar 27 18:39:43.091618 2026] [:error] [pid 27743:tid 27786] [client 158.158.43.158:65022] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acZebyA46UYYLqzw99C5VAAAABY"]
[Fri Mar 27 18:39:43.602246 2026] [:error] [pid 27750:tid 27831] [client 158.158.43.158:63952] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acZeb4aSil5rd17ieLzg6wAAAI0"]
[Fri Mar 27 18:39:44.092490 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:65008] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "acZecGVSkmYmLu7ycYg2OQAAAQk"]
[Fri Mar 27 18:39:44.581086 2026] [:error] [pid 27750:tid 27818] [client 158.158.43.158:64535] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acZecIaSil5rd17ieLzg7QAAAIA"]
[Fri Mar 27 18:39:45.077935 2026] [:error] [pid 27851:tid 27858] [client 158.158.43.158:64492] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acZecXR2ccxe3RMCLbrbpQAAAMA"]
[Fri Mar 27 18:39:45.570789 2026] [:error] [pid 27749:tid 27803] [client 158.158.43.158:64534] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acZeccEqyoMni2Q6_X7kQwAAAEw"]
[Fri Mar 27 18:39:46.064327 2026] [:error] [pid 4341:tid 4354] [client 158.158.43.158:65041] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "acZecuKJWrNB5dMlERGCjgAAAYs"]
[Fri Mar 27 18:39:46.564309 2026] [:error] [pid 27749:tid 27807] [client 158.158.43.158:63963] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acZecsEqyoMni2Q6_X7kSgAAAFA"]
[Fri Mar 27 18:39:47.044508 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:64569] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acZec5LjeJUC3OKtEx9IhAAAAUU"]
[Fri Mar 27 18:39:47.538461 2026] [:error] [pid 4293:tid 4301] [client 158.158.43.158:63996] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acZec5LjeJUC3OKtEx9IhgAAAUY"]
[Fri Mar 27 18:39:48.023107 2026] [:error] [pid 27749:tid 27800] [client 158.158.43.158:64483] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "acZedMEqyoMni2Q6_X7kTQAAAEk"]
[Fri Mar 27 18:39:48.508106 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:65490] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "acZedOKJWrNB5dMlERGCkQAAAYg"]
[Fri Mar 27 18:39:48.993058 2026] [:error] [pid 4293:tid 4319] [client 158.158.43.158:63998] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "acZedJLjeJUC3OKtEx9IjQAAAVg"]
[Fri Mar 27 18:39:49.477277 2026] [:error] [pid 27743:tid 27764] [client 158.158.43.158:63971] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "acZedSA46UYYLqzw99C5XQAAAAA"]
[Fri Mar 27 18:39:49.968963 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:64544] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "acZedZLjeJUC3OKtEx9IjwAAAU8"]
[Fri Mar 27 18:39:50.451317 2026] [:error] [pid 4293:tid 4297] [client 158.158.43.158:64042] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acZedpLjeJUC3OKtEx9IkQAAAUI"]
[Fri Mar 27 18:39:50.942890 2026] [:error] [pid 63897:tid 63904] [client 158.158.43.158:63967] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acZedmVSkmYmLu7ycYg2PAAAAQU"]
[Fri Mar 27 18:39:51.441056 2026] [:error] [pid 27743:tid 27774] [client 158.158.43.158:64574] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acZedyA46UYYLqzw99C5ZAAAAAo"]
[Fri Mar 27 18:39:51.929597 2026] [:error] [pid 63897:tid 63919] [client 158.158.43.158:64054] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "acZed2VSkmYmLu7ycYg2QAAAARQ"]
[Fri Mar 27 18:39:52.419975 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:64524] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeeCA46UYYLqzw99C5ZQAAAAY"]
[Fri Mar 27 18:39:52.912182 2026] [:error] [pid 4293:tid 4299] [client 158.158.43.158:65026] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeeJLjeJUC3OKtEx9IkwAAAUQ"]
[Fri Mar 27 18:39:53.395593 2026] [:error] [pid 27743:tid 27782] [client 158.158.43.158:65494] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeeSA46UYYLqzw99C5ZwAAABI"]
[Fri Mar 27 18:39:53.909308 2026] [:error] [pid 4293:tid 4297] [client 158.158.43.158:64005] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "acZeeZLjeJUC3OKtEx9InAAAAUI"]
[Fri Mar 27 18:39:54.393893 2026] [:error] [pid 27851:tid 27871] [client 158.158.43.158:64481] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acZeenR2ccxe3RMCLbrbpwAAAM0"]
[Fri Mar 27 18:39:54.882688 2026] [:error] [pid 27851:tid 27864] [client 158.158.43.158:64557] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "acZeenR2ccxe3RMCLbrbqQAAAMY"]
[Fri Mar 27 18:39:55.384553 2026] [proxy_fcgi:error] [pid 27743:tid 27766] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:55.626593 2026] [proxy_fcgi:error] [pid 27743:tid 27779] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:55.872479 2026] [proxy_fcgi:error] [pid 27743:tid 27788] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:56.116098 2026] [proxy_fcgi:error] [pid 27743:tid 27773] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:56.360604 2026] [proxy_fcgi:error] [pid 27743:tid 27783] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:56.623897 2026] [proxy_fcgi:error] [pid 27743:tid 27784] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:56.868438 2026] [proxy_fcgi:error] [pid 27743:tid 27781] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:57.112009 2026] [proxy_fcgi:error] [pid 27743:tid 27767] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:57.355265 2026] [proxy_fcgi:error] [pid 27743:tid 27776] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:57.598370 2026] [proxy_fcgi:error] [pid 27743:tid 27771] [client 158.158.43.158:65055] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:39:58.079688 2026] [:error] [pid 27743:tid 27772] [client 158.158.43.158:65055] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acZefiA46UYYLqzw99C5fQAAAAg"]
[Fri Mar 27 18:39:58.567148 2026] [:error] [pid 27749:tid 27800] [client 158.158.43.158:65033] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acZefsEqyoMni2Q6_X7kVQAAAEk"]
[Fri Mar 27 18:39:59.046526 2026] [:error] [pid 27749:tid 27805] [client 158.158.43.158:64028] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acZef8EqyoMni2Q6_X7kVgAAAE4"]
[Fri Mar 27 18:39:59.527807 2026] [:error] [pid 27851:tid 27865] [client 158.158.43.158:65476] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "acZef3R2ccxe3RMCLbrbrQAAAMc"]
[Fri Mar 27 18:40:00.019327 2026] [:error] [pid 27743:tid 27781] [client 158.158.43.158:63650] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acZegCA46UYYLqzw99C5gwAAABE"]
[Fri Mar 27 18:40:00.519191 2026] [:error] [pid 27743:tid 27766] [client 158.158.43.158:64468] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acZegCA46UYYLqzw99C5hQAAAAI"]
[Fri Mar 27 18:40:01.000851 2026] [:error] [pid 27743:tid 27772] [client 158.158.43.158:65505] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acZegCA46UYYLqzw99C5iAAAAAg"]
[Fri Mar 27 18:40:01.490296 2026] [:error] [pid 27749:tid 27814] [client 158.158.43.158:63977] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "acZegcEqyoMni2Q6_X7kWQAAAFc"]
[Fri Mar 27 18:40:01.986048 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:64048] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acZegeKJWrNB5dMlERGCnQAAAYg"]
[Fri Mar 27 18:40:02.473686 2026] [:error] [pid 27851:tid 27871] [client 158.158.43.158:64014] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acZegnR2ccxe3RMCLbrbsgAAAM0"]
[Fri Mar 27 18:40:02.962581 2026] [:error] [pid 27851:tid 27880] [client 158.158.43.158:64961] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acZegnR2ccxe3RMCLbrbswAAANY"]
[Fri Mar 27 18:40:03.448750 2026] [:error] [pid 4341:tid 4358] [client 158.158.43.158:64990] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "acZeg-KJWrNB5dMlERGCnwAAAY8"]
[Fri Mar 27 18:40:03.930997 2026] [:error] [pid 63897:tid 63921] [client 158.158.43.158:64999] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acZeg2VSkmYmLu7ycYg2QwAAARY"]
[Fri Mar 27 18:40:04.422508 2026] [:error] [pid 4293:tid 4313] [client 158.158.43.158:63940] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acZehJLjeJUC3OKtEx9IqwAAAVI"]
[Fri Mar 27 18:40:04.905315 2026] [:error] [pid 27851:tid 27872] [client 158.158.43.158:64036] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acZehHR2ccxe3RMCLbrbuAAAAM4"]
[Fri Mar 27 18:40:05.409151 2026] [:error] [pid 27743:tid 27764] [client 158.158.43.158:65042] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "acZehSA46UYYLqzw99C5kQAAAAA"]
[Fri Mar 27 18:40:05.887163 2026] [:error] [pid 27750:tid 27831] [client 158.158.43.158:64503] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acZehYaSil5rd17ieLzhAAAAAI0"]
[Fri Mar 27 18:40:06.386738 2026] [:error] [pid 27851:tid 27877] [client 158.158.43.158:63666] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acZehnR2ccxe3RMCLbrbugAAANM"]
[Fri Mar 27 18:40:06.872411 2026] [:error] [pid 27851:tid 27869] [client 158.158.43.158:65507] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acZehnR2ccxe3RMCLbrbvAAAAMs"]
[Fri Mar 27 18:40:07.360659 2026] [:error] [pid 27749:tid 27796] [client 158.158.43.158:63945] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "acZeh8EqyoMni2Q6_X7kWgAAAEU"]
[Fri Mar 27 18:40:07.839634 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:64560] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acZeh5LjeJUC3OKtEx9IrgAAAU8"]
[Fri Mar 27 18:40:08.333108 2026] [:error] [pid 4341:tid 4356] [client 158.158.43.158:65485] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acZeiOKJWrNB5dMlERGCqQAAAY0"]
[Fri Mar 27 18:40:08.811774 2026] [:error] [pid 4293:tid 4319] [client 158.158.43.158:65012] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acZeiJLjeJUC3OKtEx9IswAAAVg"]
[Fri Mar 27 18:40:09.300561 2026] [:error] [pid 63897:tid 63918] [client 158.158.43.158:63233] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "acZeiWVSkmYmLu7ycYg2TAAAARM"]
[Fri Mar 27 18:40:09.779961 2026] [:error] [pid 4341:tid 4349] [client 158.158.43.158:64555] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acZeieKJWrNB5dMlERGCqwAAAYY"]
[Fri Mar 27 18:40:10.263561 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:64481] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acZeiiA46UYYLqzw99C5kwAAAAY"]
[Fri Mar 27 18:40:10.750077 2026] [:error] [pid 4293:tid 4318] [client 158.158.43.158:63656] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acZeipLjeJUC3OKtEx9ItwAAAVc"]
[Fri Mar 27 18:40:11.233483 2026] [:error] [pid 63897:tid 63902] [client 158.158.43.158:65050] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "acZei2VSkmYmLu7ycYg2UAAAAQM"]
[Fri Mar 27 18:40:11.729576 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:64453] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acZei5LjeJUC3OKtEx9IvQAAAU8"]
[Fri Mar 27 18:40:12.221848 2026] [:error] [pid 27851:tid 27872] [client 158.158.43.158:65060] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acZejHR2ccxe3RMCLbrbwwAAAM4"]
[Fri Mar 27 18:40:12.721952 2026] [:error] [pid 27851:tid 27860] [client 158.158.43.158:65006] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acZejHR2ccxe3RMCLbrbxAAAAMI"]
[Fri Mar 27 18:40:13.211201 2026] [:error] [pid 27851:tid 27869] [client 158.158.43.158:63633] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acZejXR2ccxe3RMCLbrbxgAAAMs"]
[Fri Mar 27 18:40:13.722853 2026] [:error] [pid 4293:tid 4297] [client 158.158.43.158:64502] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acZejZLjeJUC3OKtEx9IxAAAAUI"]
[Fri Mar 27 18:40:14.216462 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64554] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acZejuKJWrNB5dMlERGCsAAAAYM"]
[Fri Mar 27 18:40:14.698897 2026] [:error] [pid 4293:tid 4315] [client 158.158.43.158:64034] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acZejpLjeJUC3OKtEx9IyQAAAVQ"]
[Fri Mar 27 18:40:15.206811 2026] [:error] [pid 4293:tid 4309] [client 158.158.43.158:64016] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "acZej5LjeJUC3OKtEx9IygAAAU4"]
[Fri Mar 27 18:40:15.696204 2026] [:error] [pid 4341:tid 4366] [client 158.158.43.158:64558] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acZej-KJWrNB5dMlERGCuQAAAZc"]
[Fri Mar 27 18:40:16.180776 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:64493] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acZekCA46UYYLqzw99C5lgAAABQ"]
[Fri Mar 27 18:40:16.673624 2026] [:error] [pid 27851:tid 27870] [client 158.158.43.158:65010] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acZekHR2ccxe3RMCLbrbyAAAAMw"]
[Fri Mar 27 18:40:17.165609 2026] [:error] [pid 27750:tid 27827] [client 158.158.43.158:64522] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acZekYaSil5rd17ieLzhBgAAAIk"]
[Fri Mar 27 18:40:17.656308 2026] [:error] [pid 27750:tid 27825] [client 158.158.43.158:65071] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "acZekYaSil5rd17ieLzhCAAAAIc"]
[Fri Mar 27 18:40:18.147560 2026] [:error] [pid 4293:tid 4299] [client 158.158.43.158:64479] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "acZekpLjeJUC3OKtEx9IzwAAAUQ"]
[Fri Mar 27 18:40:18.635802 2026] [:error] [pid 4293:tid 4309] [client 158.158.43.158:64019] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "acZekpLjeJUC3OKtEx9I0gAAAU4"]
[Fri Mar 27 18:40:19.126491 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:64472] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "acZek5LjeJUC3OKtEx9I1AAAAVM"]
[Fri Mar 27 18:40:19.619336 2026] [:error] [pid 4293:tid 4316] [client 158.158.43.158:64469] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "acZek5LjeJUC3OKtEx9I1gAAAVU"]
[Fri Mar 27 18:40:20.099230 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:65502] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "acZelOKJWrNB5dMlERGCvAAAAYg"]
[Fri Mar 27 18:40:20.602333 2026] [:error] [pid 27750:tid 27818] [client 158.158.43.158:63558] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "acZelIaSil5rd17ieLzhCwAAAIA"]
[Fri Mar 27 18:40:21.088681 2026] [:error] [pid 4293:tid 4301] [client 158.158.43.158:63184] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "acZelZLjeJUC3OKtEx9I3QAAAUY"]
[Fri Mar 27 18:40:21.568370 2026] [:error] [pid 27750:tid 27841] [client 158.158.43.158:65077] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acZelYaSil5rd17ieLzhDQAAAJc"]
[Fri Mar 27 18:40:22.063422 2026] [:error] [pid 4293:tid 4305] [client 158.158.43.158:65038] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acZelpLjeJUC3OKtEx9I4QAAAUo"]
[Fri Mar 27 18:40:22.551582 2026] [:error] [pid 4341:tid 4350] [client 158.158.43.158:63968] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acZeluKJWrNB5dMlERGCvQAAAYc"]
[Fri Mar 27 18:40:23.079631 2026] [:error] [pid 4293:tid 4306] [client 158.158.43.158:64051] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acZel5LjeJUC3OKtEx9I5gAAAUs"]
[Fri Mar 27 18:40:23.584900 2026] [:error] [pid 27851:tid 27865] [client 158.158.43.158:64031] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/grsiuk.php"] [unique_id "acZel3R2ccxe3RMCLbrbzgAAAMc"]
[Fri Mar 27 18:40:24.114810 2026] [:error] [pid 4293:tid 4311] [client 158.158.43.158:65496] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/grsiuk.php"] [unique_id "acZemJLjeJUC3OKtEx9I6AAAAVA"]
[Fri Mar 27 18:40:24.597500 2026] [:error] [pid 4341:tid 4347] [client 158.158.43.158:64002] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/grsiuk.php"] [unique_id "acZemOKJWrNB5dMlERGCwgAAAYQ"]
[Fri Mar 27 18:40:25.079704 2026] [:error] [pid 63897:tid 63915] [client 158.158.43.158:64053] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/grsiuk.php"] [unique_id "acZemWVSkmYmLu7ycYg2WgAAARA"]
[Fri Mar 27 18:40:25.573171 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:63662] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "acZemSA46UYYLqzw99C5oAAAAAY"]
[Fri Mar 27 18:40:26.072891 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64505] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "acZemuKJWrNB5dMlERGCxAAAAYM"]
[Fri Mar 27 18:40:26.578661 2026] [:error] [pid 4341:tid 4363] [client 158.158.43.158:64011] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "acZemuKJWrNB5dMlERGCxQAAAZQ"]
[Fri Mar 27 18:40:27.089739 2026] [:error] [pid 27743:tid 27765] [client 158.158.43.158:63605] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "acZemyA46UYYLqzw99C5qAAAAAE"]
[Fri Mar 27 18:40:27.576083 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:63586] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "acZem2VSkmYmLu7ycYg2XwAAAQk"]
[Fri Mar 27 18:40:28.059503 2026] [:error] [pid 27750:tid 27831] [client 158.158.43.158:64538] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "acZenIaSil5rd17ieLzhEgAAAI0"]
[Fri Mar 27 18:40:28.548685 2026] [:error] [pid 27750:tid 27824] [client 158.158.43.158:64000] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "acZenIaSil5rd17ieLzhFQAAAIY"]
[Fri Mar 27 18:40:29.057595 2026] [:error] [pid 27750:tid 27837] [client 158.158.43.158:63957] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "acZenYaSil5rd17ieLzhGwAAAJM"]
[Fri Mar 27 18:40:29.542741 2026] [:error] [pid 27750:tid 27839] [client 158.158.43.158:64455] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acZenYaSil5rd17ieLzhHAAAAJU"]
[Fri Mar 27 18:40:30.029661 2026] [:error] [pid 27743:tid 27775] [client 158.158.43.158:64015] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acZeniA46UYYLqzw99C5rQAAAAs"]
[Fri Mar 27 18:40:30.533366 2026] [:error] [pid 27743:tid 27777] [client 158.158.43.158:64507] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acZeniA46UYYLqzw99C5rwAAAA0"]
[Fri Mar 27 18:40:31.024531 2026] [:error] [pid 27743:tid 27771] [client 158.158.43.158:65025] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acZenyA46UYYLqzw99C5sQAAAAc"]
[Fri Mar 27 18:40:31.516992 2026] [:error] [pid 63897:tid 63920] [client 158.158.43.158:63984] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "acZen2VSkmYmLu7ycYg2aAAAARU"]
[Fri Mar 27 18:40:32.023304 2026] [:error] [pid 63897:tid 63915] [client 158.158.43.158:64463] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "acZeoGVSkmYmLu7ycYg2agAAARA"]
[Fri Mar 27 18:40:32.502476 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:64063] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "acZeoGVSkmYmLu7ycYg2bQAAAQk"]
[Fri Mar 27 18:40:32.985045 2026] [:error] [pid 63897:tid 63913] [client 158.158.43.158:65072] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "acZeoGVSkmYmLu7ycYg2cAAAAQ4"]
[Fri Mar 27 18:40:33.469849 2026] [:error] [pid 27851:tid 27873] [client 158.158.43.158:63959] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acZeoXR2ccxe3RMCLbrb1QAAAM8"]
[Fri Mar 27 18:40:33.954626 2026] [:error] [pid 27743:tid 27784] [client 158.158.43.158:64496] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acZeoSA46UYYLqzw99C5twAAABQ"]
[Fri Mar 27 18:40:34.467589 2026] [:error] [pid 4341:tid 4355] [client 158.158.43.158:64561] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acZeouKJWrNB5dMlERGCzQAAAYw"]
[Fri Mar 27 18:40:34.951135 2026] [:error] [pid 27851:tid 27868] [client 158.158.43.158:63962] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vanda.php"] [unique_id "acZeonR2ccxe3RMCLbrb1gAAAMo"]
[Fri Mar 27 18:40:35.446398 2026] [:error] [pid 63897:tid 63902] [client 158.158.43.158:64550] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acZeo2VSkmYmLu7ycYg2cgAAAQM"]
[Fri Mar 27 18:40:35.932776 2026] [:error] [pid 4293:tid 4307] [client 158.158.43.158:64467] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acZeo5LjeJUC3OKtEx9I8AAAAUw"]
[Fri Mar 27 18:40:36.425160 2026] [:error] [pid 27743:tid 27777] [client 158.158.43.158:65063] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acZepCA46UYYLqzw99C5ugAAAA0"]
[Fri Mar 27 18:40:36.908553 2026] [:error] [pid 63897:tid 63918] [client 158.158.43.158:64465] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "acZepGVSkmYmLu7ycYg2eAAAARM"]
[Fri Mar 27 18:40:37.393328 2026] [:error] [pid 27743:tid 27780] [client 158.158.43.158:63625] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/144.php"] [unique_id "acZepSA46UYYLqzw99C5vwAAABA"]
[Fri Mar 27 18:40:37.889853 2026] [:error] [pid 63897:tid 63902] [client 158.158.43.158:64003] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/144.php"] [unique_id "acZepWVSkmYmLu7ycYg2egAAAQM"]
[Fri Mar 27 18:40:38.397207 2026] [:error] [pid 27851:tid 27882] [client 158.158.43.158:63994] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/144.php"] [unique_id "acZepnR2ccxe3RMCLbrb2gAAANg"]
[Fri Mar 27 18:40:38.899599 2026] [:error] [pid 27743:tid 27771] [client 158.158.43.158:64547] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/144.php"] [unique_id "acZepiA46UYYLqzw99C5ywAAAAc"]
[Fri Mar 27 18:40:39.433026 2026] [:error] [pid 27743:tid 27774] [client 158.158.43.158:65488] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acZepyA46UYYLqzw99C5zwAAAAo"]
[Fri Mar 27 18:40:39.939991 2026] [:error] [pid 63897:tid 63907] [client 158.158.43.158:64008] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acZep2VSkmYmLu7ycYg2ewAAAQg"]
[Fri Mar 27 18:40:40.434724 2026] [:error] [pid 27743:tid 27785] [client 158.158.43.158:65495] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acZeqCA46UYYLqzw99C50gAAABU"]
[Fri Mar 27 18:40:40.941594 2026] [:error] [pid 27749:tid 27803] [client 158.158.43.158:65086] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "acZeqMEqyoMni2Q6_X7kYQAAAEw"]
[Fri Mar 27 18:40:41.440723 2026] [:error] [pid 4293:tid 4304] [client 158.158.43.158:65079] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acZeqZLjeJUC3OKtEx9I9gAAAUk"]
[Fri Mar 27 18:40:41.955149 2026] [:error] [pid 4293:tid 4295] [client 158.158.43.158:64967] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acZeqZLjeJUC3OKtEx9I-AAAAUA"]
[Fri Mar 27 18:40:42.456972 2026] [:error] [pid 4293:tid 4312] [client 158.158.43.158:64004] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acZeqpLjeJUC3OKtEx9I-wAAAVE"]
[Fri Mar 27 18:40:42.972206 2026] [:error] [pid 27851:tid 27859] [client 158.158.43.158:63626] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "acZeqnR2ccxe3RMCLbrb3gAAAME"]
[Fri Mar 27 18:40:43.479144 2026] [:error] [pid 27750:tid 27839] [client 158.158.43.158:64470] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acZeq4aSil5rd17ieLzhLwAAAJU"]
[Fri Mar 27 18:40:44.018723 2026] [:error] [pid 4341:tid 4349] [client 158.158.43.158:64565] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acZerOKJWrNB5dMlERGC1AAAAYY"]
[Fri Mar 27 18:40:44.505006 2026] [:error] [pid 27851:tid 27870] [client 158.158.43.158:64470] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acZerHR2ccxe3RMCLbrb4QAAAMw"]
[Fri Mar 27 18:40:44.984718 2026] [:error] [pid 27743:tid 27764] [client 158.158.43.158:63561] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "acZerCA46UYYLqzw99C51QAAAAA"]
[Fri Mar 27 18:40:45.479640 2026] [:error] [pid 4341:tid 4353] [client 158.158.43.158:63642] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acZereKJWrNB5dMlERGC2QAAAYo"]
[Fri Mar 27 18:40:45.970959 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64049] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acZereKJWrNB5dMlERGC3AAAAYk"]
[Fri Mar 27 18:40:46.466113 2026] [:error] [pid 4341:tid 4358] [client 158.158.43.158:64466] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acZeruKJWrNB5dMlERGC3gAAAY8"]
[Fri Mar 27 18:40:46.959478 2026] [:error] [pid 4293:tid 4302] [client 158.158.43.158:65503] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "acZerpLjeJUC3OKtEx9JCQAAAUc"]
[Fri Mar 27 18:40:47.449518 2026] [:error] [pid 4341:tid 4363] [client 158.158.43.158:64966] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acZer-KJWrNB5dMlERGC5QAAAZQ"]
[Fri Mar 27 18:40:47.935877 2026] [:error] [pid 4341:tid 4352] [client 158.158.43.158:64566] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acZer-KJWrNB5dMlERGC5wAAAYk"]
[Fri Mar 27 18:40:48.418729 2026] [:error] [pid 4341:tid 4366] [client 158.158.43.158:64032] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acZesOKJWrNB5dMlERGC6QAAAZc"]
[Fri Mar 27 18:40:48.915342 2026] [:error] [pid 27743:tid 27780] [client 158.158.43.158:63636] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "acZesCA46UYYLqzw99C52AAAABA"]
[Fri Mar 27 18:40:49.406808 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64568] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acZeseKJWrNB5dMlERGC8QAAAYM"]
[Fri Mar 27 18:40:49.893750 2026] [:error] [pid 27749:tid 27794] [client 158.158.43.158:64037] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acZescEqyoMni2Q6_X7kaQAAAEM"]
[Fri Mar 27 18:40:50.394620 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:63620] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acZesiA46UYYLqzw99C52gAAAAY"]
[Fri Mar 27 18:40:50.875978 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:63556] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "acZesuKJWrNB5dMlERGC9gAAAYg"]
[Fri Mar 27 18:40:51.361544 2026] [:error] [pid 27743:tid 27786] [client 158.158.43.158:64001] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "acZesyA46UYYLqzw99C53gAAABY"]
[Fri Mar 27 18:40:51.847026 2026] [:error] [pid 27750:tid 27819] [client 158.158.43.158:63238] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "acZes4aSil5rd17ieLzhNAAAAIE"]
[Fri Mar 27 18:40:52.336087 2026] [:error] [pid 27743:tid 27775] [client 158.158.43.158:64486] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "acZetCA46UYYLqzw99C54AAAAAs"]
[Fri Mar 27 18:40:52.824668 2026] [:error] [pid 27750:tid 27824] [client 158.158.43.158:64545] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "acZetIaSil5rd17ieLzhNgAAAIY"]
[Fri Mar 27 18:40:53.330335 2026] [:error] [pid 63897:tid 63918] [client 158.158.43.158:63637] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "acZetWVSkmYmLu7ycYg2fQAAARM"]
[Fri Mar 27 18:40:53.832955 2026] [:error] [pid 27750:tid 27839] [client 158.158.43.158:64061] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "acZetYaSil5rd17ieLzhOAAAAJU"]
[Fri Mar 27 18:40:54.319575 2026] [:error] [pid 27750:tid 27835] [client 158.158.43.158:63944] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "acZetoaSil5rd17ieLzhOgAAAJE"]
[Fri Mar 27 18:40:54.800536 2026] [:error] [pid 27851:tid 27866] [client 158.158.43.158:63559] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "acZetnR2ccxe3RMCLbrb5AAAAMg"]
[Fri Mar 27 18:40:55.289714 2026] [:error] [pid 4341:tid 4343] [client 158.158.43.158:65492] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "acZet-KJWrNB5dMlERGC-QAAAYA"]
[Fri Mar 27 18:40:55.771191 2026] [:error] [pid 4341:tid 4351] [client 158.158.43.158:65509] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "acZet-KJWrNB5dMlERGC-gAAAYg"]
[Fri Mar 27 18:40:56.256096 2026] [:error] [pid 4341:tid 4367] [client 158.158.43.158:63632] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "acZeuOKJWrNB5dMlERGC-wAAAZg"]
[Fri Mar 27 18:40:56.736356 2026] [:error] [pid 4293:tid 4299] [client 158.158.43.158:63970] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "acZeuJLjeJUC3OKtEx9JDQAAAUQ"]
[Fri Mar 27 18:40:57.231332 2026] [proxy_fcgi:error] [pid 63897:tid 63920] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:57.476421 2026] [proxy_fcgi:error] [pid 63897:tid 63910] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:57.721089 2026] [proxy_fcgi:error] [pid 63897:tid 63908] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:57.978742 2026] [proxy_fcgi:error] [pid 63897:tid 63922] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:58.222223 2026] [proxy_fcgi:error] [pid 63897:tid 63919] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:58.464797 2026] [proxy_fcgi:error] [pid 63897:tid 63904] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:40:59.935584 2026] [proxy_fcgi:error] [pid 63897:tid 63899] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:41:00.180805 2026] [proxy_fcgi:error] [pid 63897:tid 63917] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:41:00.426701 2026] [proxy_fcgi:error] [pid 63897:tid 63900] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:41:00.679091 2026] [proxy_fcgi:error] [pid 63897:tid 63905] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:41:00.922151 2026] [proxy_fcgi:error] [pid 63897:tid 63912] [client 158.158.43.158:64044] AH01071: Got error 'Primary script unknown'
[Fri Mar 27 18:41:01.161116 2026] [:error] [pid 63897:tid 63901] [client 158.158.43.158:64044] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acZevWVSkmYmLu7ycYg2kwAAAQI"]
[Fri Mar 27 18:41:01.644378 2026] [:error] [pid 4341:tid 4360] [client 158.158.43.158:64002] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acZeveKJWrNB5dMlERGC_gAAAZE"]
[Fri Mar 27 18:41:02.127995 2026] [:error] [pid 4341:tid 4365] [client 158.158.43.158:63961] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acZevuKJWrNB5dMlERGC_wAAAZY"]
[Fri Mar 27 18:41:02.620026 2026] [:error] [pid 63897:tid 63908] [client 158.158.43.158:64491] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "acZevmVSkmYmLu7ycYg2lgAAAQk"]
[Fri Mar 27 18:41:03.102253 2026] [:error] [pid 27743:tid 27774] [client 158.158.43.158:64516] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acZevyA46UYYLqzw99C57QAAAAo"]
[Fri Mar 27 18:41:03.616852 2026] [:error] [pid 4293:tid 4298] [client 158.158.43.158:64985] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acZev5LjeJUC3OKtEx9JIwAAAUM"]
[Fri Mar 27 18:41:04.106043 2026] [:error] [pid 4293:tid 4307] [client 158.158.43.158:63247] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acZewJLjeJUC3OKtEx9JJgAAAUw"]
[Fri Mar 27 18:41:04.636497 2026] [:error] [pid 4293:tid 4314] [client 158.158.43.158:63672] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acZewJLjeJUC3OKtEx9JKgAAAVM"]
[Fri Mar 27 18:41:05.123069 2026] [:error] [pid 4293:tid 4295] [client 158.158.43.158:63175] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acZewZLjeJUC3OKtEx9JLQAAAUA"]
[Fri Mar 27 18:41:05.631216 2026] [:error] [pid 63897:tid 63918] [client 158.158.43.158:63989] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acZewWVSkmYmLu7ycYg2mwAAARM"]
[Fri Mar 27 18:41:06.127457 2026] [:error] [pid 4293:tid 4310] [client 158.158.43.158:63953] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acZewpLjeJUC3OKtEx9JNwAAAU8"]
[Fri Mar 27 18:41:06.606969 2026] [:error] [pid 63897:tid 63912] [client 158.158.43.158:63985] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "acZewmVSkmYmLu7ycYg2nwAAAQ0"]
[Fri Mar 27 18:41:07.096389 2026] [:error] [pid 4293:tid 4301] [client 158.158.43.158:63195] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acZew5LjeJUC3OKtEx9JOwAAAUY"]
[Fri Mar 27 18:41:07.592346 2026] [:error] [pid 4293:tid 4306] [client 158.158.43.158:64038] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acZew5LjeJUC3OKtEx9JPQAAAUs"]
[Fri Mar 27 18:41:08.077100 2026] [:error] [pid 4293:tid 4296] [client 158.158.43.158:64018] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acZexJLjeJUC3OKtEx9JQQAAAUE"]
[Fri Mar 27 18:41:08.597967 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:63639] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "acZexJLjeJUC3OKtEx9JRgAAAUU"]
[Fri Mar 27 18:41:09.082382 2026] [:error] [pid 27743:tid 27781] [client 158.158.43.158:63617] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acZexSA46UYYLqzw99C59QAAABE"]
[Fri Mar 27 18:41:09.574017 2026] [:error] [pid 63897:tid 63910] [client 158.158.43.158:63939] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acZexWVSkmYmLu7ycYg2oQAAAQs"]
[Fri Mar 27 18:41:10.057822 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:63947] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acZexiA46UYYLqzw99C5-AAAAAY"]
[Fri Mar 27 18:41:10.540214 2026] [:error] [pid 27749:tid 27802] [client 158.158.43.158:63938] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acZexsEqyoMni2Q6_X7kcQAAAEs"]
[Fri Mar 27 18:41:11.031932 2026] [:error] [pid 63897:tid 63921] [client 158.158.43.158:64033] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acZex2VSkmYmLu7ycYg2pAAAARY"]
[Fri Mar 27 18:41:11.519219 2026] [:error] [pid 4341:tid 4346] [client 158.158.43.158:64451] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acZex-KJWrNB5dMlERGDAgAAAYM"]
[Fri Mar 27 18:41:12.010615 2026] [:error] [pid 63897:tid 63899] [client 158.158.43.158:64968] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acZeyGVSkmYmLu7ycYg2pgAAAQA"]
[Fri Mar 27 18:41:12.509201 2026] [:error] [pid 63897:tid 63906] [client 158.158.43.158:63665] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "acZeyGVSkmYmLu7ycYg2qAAAAQc"]
[Fri Mar 27 18:41:13.009502 2026] [:error] [pid 4341:tid 4361] [client 158.158.43.158:64511] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "acZeyeKJWrNB5dMlERGDBAAAAZI"]
[Fri Mar 27 18:41:13.498600 2026] [:error] [pid 4293:tid 4297] [client 158.158.43.158:65049] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "acZeyZLjeJUC3OKtEx9JWQAAAUI"]
[Fri Mar 27 18:41:13.982261 2026] [:error] [pid 27743:tid 27764] [client 158.158.43.158:64501] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "acZeySA46UYYLqzw99C5_AAAAAA"]
[Fri Mar 27 18:41:14.463050 2026] [:error] [pid 27743:tid 27778] [client 158.158.43.158:64026] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "acZeyiA46UYYLqzw99C5_gAAAA4"]
[Fri Mar 27 18:41:14.957288 2026] [:error] [pid 27743:tid 27770] [client 158.158.43.158:63946] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "acZeyiA46UYYLqzw99C6AgAAAAY"]
[Fri Mar 27 18:41:15.443336 2026] [:error] [pid 27851:tid 27875] [client 158.158.43.158:63943] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "acZey3R2ccxe3RMCLbrb9QAAANE"]
[Fri Mar 27 18:41:15.929772 2026] [:error] [pid 27743:tid 27765] [client 158.158.43.158:64039] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "acZeyyA46UYYLqzw99C6BwAAAAE"]
[Fri Mar 27 18:41:16.420837 2026] [:error] [pid 27743:tid 27787] [client 158.158.43.158:63949] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "acZezCA46UYYLqzw99C6CAAAABc"]
[Fri Mar 27 18:41:16.929293 2026] [:error] [pid 27743:tid 27785] [client 158.158.43.158:64024] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acZezCA46UYYLqzw99C6DQAAABU"]
[Fri Mar 27 18:41:17.414569 2026] [:error] [pid 27851:tid 27864] [client 158.158.43.158:64045] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acZezXR2ccxe3RMCLbrb-gAAAMY"]
[Fri Mar 27 18:41:17.907837 2026] [:error] [pid 27750:tid 27818] [client 158.158.43.158:64060] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acZezYaSil5rd17ieLzhTQAAAIA"]
[Fri Mar 27 18:41:18.400936 2026] [:error] [pid 4341:tid 4345] [client 158.158.43.158:63648] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "acZezuKJWrNB5dMlERGDCQAAAYI"]
[Fri Mar 27 18:41:18.902521 2026] [:error] [pid 27743:tid 27774] [client 158.158.43.158:64457] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acZeziA46UYYLqzw99C6GwAAAAo"]
[Fri Mar 27 18:41:19.390891 2026] [:error] [pid 27749:tid 27803] [client 158.158.43.158:63599] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acZez8EqyoMni2Q6_X7kdAAAAEw"]
[Fri Mar 27 18:41:19.876658 2026] [:error] [pid 27743:tid 27782] [client 158.158.43.158:64500] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acZezyA46UYYLqzw99C6JgAAABI"]
[Fri Mar 27 18:41:20.380071 2026] [:error] [pid 4293:tid 4317] [client 158.158.43.158:65486] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "acZe0JLjeJUC3OKtEx9JZQAAAVY"]
[Fri Mar 27 18:41:20.863313 2026] [:error] [pid 27743:tid 27773] [client 158.158.43.158:64549] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acZe0CA46UYYLqzw99C6KwAAAAk"]
[Fri Mar 27 18:41:21.350945 2026] [:error] [pid 4293:tid 4300] [client 158.158.43.158:63592] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acZe0ZLjeJUC3OKtEx9JaQAAAUU"]
[Fri Mar 27 18:41:21.838876 2026] [:error] [pid 4293:tid 4309] [client 158.158.43.158:63576] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acZe0ZLjeJUC3OKtEx9JbAAAAU4"]
[Fri Mar 27 18:41:22.324981 2026] [:error] [pid 4293:tid 4318] [client 158.158.43.158:64027] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "acZe0pLjeJUC3OKtEx9JbwAAAVc"]
[Fri Mar 27 18:41:22.801901 2026] [:error] [pid 27743:tid 27768] [client 158.158.43.158:64537] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acZe0iA46UYYLqzw99C6TAAAAAQ"]
[Fri Mar 27 18:41:23.297798 2026] [:error] [pid 27743:tid 27773] [client 158.158.43.158:63647] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acZe0yA46UYYLqzw99C6VAAAAAk"]
[Fri Mar 27 18:41:23.778943 2026] [:error] [pid 27749:tid 27802] [client 158.158.43.158:63978] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acZe08EqyoMni2Q6_X7kigAAAEs"]
[Fri Mar 27 18:41:24.261394 2026] [:error] [pid 4341:tid 4350] [client 158.158.43.158:63975] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "acZe1OKJWrNB5dMlERGDMgAAAYc"]
[Fri Mar 27 18:41:24.741503 2026] [:error] [pid 4293:tid 4308] [client 158.158.43.158:63679] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acZe1JLjeJUC3OKtEx9JfQAAAU0"]
[Fri Mar 27 18:41:25.225138 2026] [:error] [pid 27851:tid 27875] [client 158.158.43.158:63634] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acZe1XR2ccxe3RMCLbrb_wAAANE"]
[Fri Mar 27 18:41:25.717170 2026] [:error] [pid 27743:tid 27768] [client 158.158.43.158:63937] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acZe1SA46UYYLqzw99C6aAAAAAQ"]
[Fri Mar 27 18:41:26.208523 2026] [:error] [pid 27851:tid 27879] [client 158.158.43.158:64062] [client 158.158.43.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "acZe1nR2ccxe3RMCLbrcAQAAANU"]
[Fri Mar 27 22:18:17.061781 2026] [:error] [pid 27851:tid 27858] [client 43.166.239.145:53558] [client 43.166.239.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acaRqXR2ccxe3RMCLboMMQAAAMA"]
[Fri Mar 27 23:24:27.399888 2026] [:error] [pid 27750:tid 27828] [client 170.106.180.153:52236] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acahK4aSil5rd17ieLwVWQAAAIo"]
[Sat Mar 28 00:21:59.752829 2026] [proxy_fcgi:error] [pid 27851:tid 27880] [client 66.249.69.141:55887] AH01071: Got error 'Primary script unknown'
[Sat Mar 28 05:08:26.490650 2026] [:error] [pid 64860:tid 64923] [client 85.239.53.164:41948] [client 85.239.53.164] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=image/tiff"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acbxyhkU3N0pg_4aEL-M6AAAAE8"]
[Sat Mar 28 06:48:44.940627 2026] [:error] [pid 34631:tid 34664] [client 178.212.207.5:58078] [client 178.212.207.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "accJTDtzjMMS6kojpeQgqAAAAcQ"]
[Sat Mar 28 07:11:36.614496 2026] [:error] [pid 64861:tid 64945] [client 181.199.62.7:50335] [client 181.199.62.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.199.62.7, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "accOqOxK22_lUN2kvnVa3wAAAIo"]
[Sat Mar 28 07:11:36.625216 2026] [proxy_fcgi:error] [pid 64861:tid 64945] [client 181.199.62.7:50335] AH01071: Got error 'Primary script unknown'
[Sat Mar 28 13:45:23.932871 2026] [:error] [pid 43578:tid 43585] [client 182.42.105.85:39134] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acdq83NG2YdGm41aN8J0rAAAAkQ"]
[Sat Mar 28 16:56:24.686903 2026] [:error] [pid 34631:tid 34671] [client 43.153.122.30:52930] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aceXuDtzjMMS6kojpeT4TQAAAcs"]
[Sat Mar 28 19:25:22.927464 2026] [:error] [pid 34631:tid 34683] [client 103.47.218.38:64269] [client 103.47.218.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.218.38, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ace6ojtzjMMS6kojpeQxfAAAAdc"]
[Sat Mar 28 19:25:22.938428 2026] [proxy_fcgi:error] [pid 34631:tid 34683] [client 103.47.218.38:64269] AH01071: Got error 'Primary script unknown'
[Sat Mar 28 21:03:02.472844 2026] [:error] [pid 64861:tid 64956] [client 49.7.227.204:55114] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acfRhuxK22_lUN2kvnVyPQAAAJU"]
[Sat Mar 28 21:25:11.524517 2026] [:error] [pid 34597:tid 34619] [client 104.28.161.186:53944] [client 104.28.161.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "acfWt4luI7-e5s1cafehtAAAAVI"]
[Sat Mar 28 22:57:33.492758 2026] [:error] [pid 34631:tid 34672] [client 106.215.167.223:17766] [client 106.215.167.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.215.167.223, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acfsXTtzjMMS6kojpeR2mwAAAcw"]
[Sat Mar 28 22:57:33.504311 2026] [proxy_fcgi:error] [pid 34631:tid 34672] [client 106.215.167.223:17766] AH01071: Got error 'Primary script unknown'
[Sat Mar 28 23:02:05.533045 2026] [:error] [pid 64861:tid 64938] [client 170.106.161.78:47232] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acftbexK22_lUN2kvnWlWgAAAIM"]
[Sun Mar 29 00:00:45.705047 2026] [:error] [pid 34631:tid 34677] [client 43.157.150.69:49922] [client 43.157.150.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acf7LTtzjMMS6kojpeSO0wAAAdE"]
[Sun Mar 29 05:08:33.987101 2026] [:error] [pid 1524:tid 1549] [client 20.122.187.158:17348] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achDUVoaWSl2asqQCh8QMwAAARI"]
[Sun Mar 29 05:08:34.431882 2026] [:error] [pid 32254:tid 32267] [client 20.122.187.158:17368] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achDUqug2IHuyGgCTn8N2gAAAAM"]
[Sun Mar 29 05:08:34.862719 2026] [:error] [pid 32257:tid 32323] [client 20.122.187.158:17400] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achDUiE3TArOFrUtgWopqQAAAIU"]
[Sun Mar 29 05:08:35.276719 2026] [:error] [pid 1524:tid 1556] [client 20.122.187.158:17359] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achDU1oaWSl2asqQCh8QNAAAARg"]
[Sun Mar 29 07:07:52.487693 2026] [:error] [pid 23137:tid 23147] [client 43.135.185.59:44156] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "achfSBaWQa7LdZ_qGFaMBgAAAYg"]
[Sun Mar 29 07:58:00.929000 2026] [proxy_fcgi:error] [pid 23167:tid 23176] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:01.096894 2026] [proxy_fcgi:error] [pid 23167:tid 23179] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:01.265219 2026] [proxy_fcgi:error] [pid 23167:tid 23191] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:01.427306 2026] [proxy_fcgi:error] [pid 23167:tid 23188] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:01.589205 2026] [proxy_fcgi:error] [pid 23167:tid 23183] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:01.750208 2026] [proxy_fcgi:error] [pid 23167:tid 23175] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:02.021090 2026] [proxy_fcgi:error] [pid 23167:tid 23174] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:02.189571 2026] [proxy_fcgi:error] [pid 23167:tid 23181] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:02.349175 2026] [proxy_fcgi:error] [pid 23167:tid 23189] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:02.509808 2026] [proxy_fcgi:error] [pid 23167:tid 23180] [client 57.154.25.166:51016] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:58:02.666835 2026] [:error] [pid 23167:tid 23172] [client 57.154.25.166:51016] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "achrChIAHJCFaHff3_d6EQAAAcI"]
[Sun Mar 29 07:58:03.289782 2026] [:error] [pid 23284:tid 23303] [client 57.154.25.166:57252] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "achrC4zBujdPHsq7wyRoeAAAApE"]
[Sun Mar 29 07:58:04.133589 2026] [:error] [pid 23284:tid 23301] [client 57.154.25.166:4240] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "achrDIzBujdPHsq7wyRoegAAAo8"]
[Sun Mar 29 07:58:05.052914 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:4249] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "achrDZxrpj-dQjy1cvpT-AAAAk4"]
[Sun Mar 29 07:58:05.752746 2026] [:error] [pid 23137:tid 23142] [client 57.154.25.166:45033] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "achrDRaWQa7LdZ_qGFaTngAAAYM"]
[Sun Mar 29 07:58:06.259004 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:4741] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "achrDhIAHJCFaHff3_d6FgAAAdc"]
[Sun Mar 29 07:58:07.217431 2026] [:error] [pid 23137:tid 23140] [client 57.154.25.166:45051] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "achrDxaWQa7LdZ_qGFaTnwAAAYE"]
[Sun Mar 29 07:58:07.831858 2026] [:error] [pid 32255:tid 32298] [client 57.154.25.166:4527] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "achrD2nfn-AtRoMbqux9ugAAAEc"]
[Sun Mar 29 07:58:08.311800 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:59677] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "achrEGnfn-AtRoMbqux9vwAAAFU"]
[Sun Mar 29 07:58:08.803053 2026] [:error] [pid 23284:tid 23306] [client 57.154.25.166:57271] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "achrEIzBujdPHsq7wyRofQAAApQ"]
[Sun Mar 29 07:58:09.441976 2026] [:error] [pid 23284:tid 23308] [client 57.154.25.166:64943] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "achrEYzBujdPHsq7wyRofgAAApY"]
[Sun Mar 29 07:58:10.066024 2026] [:error] [pid 23284:tid 23287] [client 57.154.25.166:42474] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "achrEozBujdPHsq7wyRogQAAAoE"]
[Sun Mar 29 07:58:10.553006 2026] [:error] [pid 23284:tid 23289] [client 57.154.25.166:57216] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "achrEozBujdPHsq7wyRohQAAAoM"]
[Sun Mar 29 07:58:11.083958 2026] [:error] [pid 23167:tid 23180] [client 57.154.25.166:59307] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "achrExIAHJCFaHff3_d6HAAAAco"]
[Sun Mar 29 07:58:11.674496 2026] [:error] [pid 23284:tid 23298] [client 57.154.25.166:51063] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "achrE4zBujdPHsq7wyRoiQAAAow"]
[Sun Mar 29 07:58:12.384363 2026] [:error] [pid 23167:tid 23182] [client 57.154.25.166:4491] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "achrFBIAHJCFaHff3_d6HwAAAcw"]
[Sun Mar 29 07:58:12.775221 2026] [:error] [pid 32257:tid 32337] [client 57.154.25.166:59681] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "achrFCE3TArOFrUtgWpaoAAAAJM"]
[Sun Mar 29 07:58:13.253336 2026] [:error] [pid 1524:tid 1547] [client 57.154.25.166:64910] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "achrFVoaWSl2asqQCh8xVwAAARA"]
[Sun Mar 29 07:58:13.686202 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:4252] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "achrFRIAHJCFaHff3_d6IQAAAdc"]
[Sun Mar 29 07:58:14.285418 2026] [:error] [pid 23137:tid 23149] [client 57.154.25.166:42435] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "achrFhaWQa7LdZ_qGFaToQAAAYo"]
[Sun Mar 29 07:58:14.721567 2026] [:error] [pid 23137:tid 23157] [client 57.154.25.166:64958] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "achrFhaWQa7LdZ_qGFaTowAAAZI"]
[Sun Mar 29 07:58:15.292616 2026] [:error] [pid 23168:tid 23209] [client 57.154.25.166:42433] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "achrF2P8p0yRL8ot_28JpgAAAgw"]
[Sun Mar 29 07:58:15.666766 2026] [:error] [pid 23168:tid 23201] [client 57.154.25.166:57276] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "achrF2P8p0yRL8ot_28JpwAAAgQ"]
[Sun Mar 29 07:58:16.210710 2026] [:error] [pid 23167:tid 23179] [client 57.154.25.166:4522] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "achrGBIAHJCFaHff3_d6JAAAAck"]
[Sun Mar 29 07:58:16.694691 2026] [:error] [pid 23250:tid 23259] [client 57.154.25.166:4245] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "achrGJxrpj-dQjy1cvpT-QAAAkc"]
[Sun Mar 29 07:58:17.139942 2026] [:error] [pid 23250:tid 23256] [client 57.154.25.166:4765] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "achrGZxrpj-dQjy1cvpT-wAAAkQ"]
[Sun Mar 29 07:58:17.664635 2026] [:error] [pid 23167:tid 23171] [client 57.154.25.166:64906] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "achrGRIAHJCFaHff3_d6KAAAAcE"]
[Sun Mar 29 07:58:18.125325 2026] [:error] [pid 23250:tid 23258] [client 57.154.25.166:54180] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "achrGpxrpj-dQjy1cvpT_QAAAkY"]
[Sun Mar 29 07:58:18.668641 2026] [:error] [pid 23284:tid 23303] [client 57.154.25.166:42494] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "achrGozBujdPHsq7wyRokgAAApE"]
[Sun Mar 29 07:58:19.313799 2026] [:error] [pid 23284:tid 23292] [client 57.154.25.166:42460] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "achrG4zBujdPHsq7wyRokwAAAoY"]
[Sun Mar 29 07:58:19.944426 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:54171] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "achrG2nfn-AtRoMbqux9xAAAAEg"]
[Sun Mar 29 07:58:20.766575 2026] [:error] [pid 23137:tid 23158] [client 57.154.25.166:54177] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "achrHBaWQa7LdZ_qGFaTpQAAAZM"]
[Sun Mar 29 07:58:21.439803 2026] [:error] [pid 32257:tid 32334] [client 57.154.25.166:42464] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "achrHSE3TArOFrUtgWpapQAAAJA"]
[Sun Mar 29 07:58:22.089893 2026] [:error] [pid 23168:tid 23208] [client 57.154.25.166:4738] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "achrHmP8p0yRL8ot_28JqgAAAgs"]
[Sun Mar 29 07:58:22.664510 2026] [:error] [pid 23284:tid 23301] [client 57.154.25.166:59271] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "achrHozBujdPHsq7wyRolgAAAo8"]
[Sun Mar 29 07:58:23.137454 2026] [:error] [pid 32255:tid 32309] [client 57.154.25.166:54189] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "achrH2nfn-AtRoMbqux9xQAAAFI"]
[Sun Mar 29 07:58:23.720297 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:45041] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "achrH5xrpj-dQjy1cvpUAgAAAk4"]
[Sun Mar 29 07:58:24.369439 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:58808] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "achrIBIAHJCFaHff3_d6KwAAAdQ"]
[Sun Mar 29 07:58:25.160893 2026] [:error] [pid 23284:tid 23291] [client 57.154.25.166:4756] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "achrIYzBujdPHsq7wyRomQAAAoU"]
[Sun Mar 29 07:58:25.935356 2026] [:error] [pid 23167:tid 23187] [client 57.154.25.166:64950] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "achrIRIAHJCFaHff3_d6MAAAAdE"]
[Sun Mar 29 07:58:26.875527 2026] [:error] [pid 23167:tid 23182] [client 57.154.25.166:4750] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "achrIhIAHJCFaHff3_d6NQAAAcw"]
[Sun Mar 29 07:58:27.935467 2026] [:error] [pid 23250:tid 23261] [client 57.154.25.166:51045] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "achrI5xrpj-dQjy1cvpUBQAAAkk"]
[Sun Mar 29 07:58:29.192425 2026] [:error] [pid 23284:tid 23309] [client 57.154.25.166:57256] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "achrJYzBujdPHsq7wyRonQAAApc"]
[Sun Mar 29 07:58:30.254451 2026] [:error] [pid 23137:tid 23144] [client 57.154.25.166:42432] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "achrJhaWQa7LdZ_qGFaTqwAAAYU"]
[Sun Mar 29 07:58:31.267994 2026] [:error] [pid 23250:tid 23262] [client 57.154.25.166:64919] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "achrJ5xrpj-dQjy1cvpUBgAAAko"]
[Sun Mar 29 07:58:32.459003 2026] [:error] [pid 23168:tid 23216] [client 57.154.25.166:57223] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "achrKGP8p0yRL8ot_28JrQAAAhM"]
[Sun Mar 29 07:58:34.791866 2026] [:error] [pid 23284:tid 23293] [client 57.154.25.166:59311] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "achrKozBujdPHsq7wyRoxgAAAoc"]
[Sun Mar 29 07:58:35.801499 2026] [:error] [pid 23284:tid 23298] [client 57.154.25.166:59291] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "achrK4zBujdPHsq7wyRo1wAAAow"]
[Sun Mar 29 07:58:36.555839 2026] [:error] [pid 1524:tid 1536] [client 57.154.25.166:42443] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "achrLFoaWSl2asqQCh8xYQAAAQc"]
[Sun Mar 29 07:58:37.384480 2026] [:error] [pid 1524:tid 1547] [client 57.154.25.166:59707] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "achrLVoaWSl2asqQCh8xYgAAARA"]
[Sun Mar 29 07:58:38.572348 2026] [:error] [pid 32257:tid 32324] [client 57.154.25.166:51035] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "achrLiE3TArOFrUtgWpatAAAAIY"]
[Sun Mar 29 07:58:39.431650 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:4227] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "achrLxIAHJCFaHff3_d6QQAAAdQ"]
[Sun Mar 29 07:58:41.085467 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:51023] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "achrMWnfn-AtRoMbqux92gAAAFU"]
[Sun Mar 29 07:58:41.922918 2026] [:error] [pid 23168:tid 23204] [client 57.154.25.166:4737] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "achrMWP8p0yRL8ot_28JsgAAAgc"]
[Sun Mar 29 07:58:42.465572 2026] [:error] [pid 23250:tid 23265] [client 57.154.25.166:57266] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "achrMpxrpj-dQjy1cvpUCwAAAk0"]
[Sun Mar 29 07:58:43.671497 2026] [:error] [pid 23168:tid 23199] [client 57.154.25.166:51034] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "achrM2P8p0yRL8ot_28JtQAAAgI"]
[Sun Mar 29 07:58:44.354558 2026] [:error] [pid 23167:tid 23191] [client 57.154.25.166:4501] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achrNBIAHJCFaHff3_d6SgAAAdU"]
[Sun Mar 29 07:58:45.482197 2026] [:error] [pid 23167:tid 23179] [client 57.154.25.166:57278] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achrNRIAHJCFaHff3_d6UgAAAck"]
[Sun Mar 29 07:58:46.678910 2026] [:error] [pid 23137:tid 23158] [client 57.154.25.166:59276] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achrNhaWQa7LdZ_qGFaTsgAAAZM"]
[Sun Mar 29 07:58:47.542508 2026] [:error] [pid 23167:tid 23194] [client 57.154.25.166:4238] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "achrNxIAHJCFaHff3_d6WgAAAdg"]
[Sun Mar 29 07:58:48.312345 2026] [:error] [pid 32257:tid 32323] [client 57.154.25.166:4789] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "achrOCE3TArOFrUtgWpavwAAAIU"]
[Sun Mar 29 07:58:48.859199 2026] [:error] [pid 32257:tid 32342] [client 57.154.25.166:59315] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "achrOCE3TArOFrUtgWpaxAAAAJg"]
[Sun Mar 29 07:58:49.840581 2026] [:error] [pid 32255:tid 32297] [client 57.154.25.166:54179] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "achrOWnfn-AtRoMbqux94AAAAEY"]
[Sun Mar 29 07:58:50.648538 2026] [:error] [pid 32257:tid 32342] [client 57.154.25.166:4743] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "achrOiE3TArOFrUtgWpa1AAAAJg"]
[Sun Mar 29 07:58:51.977800 2026] [:error] [pid 23250:tid 23262] [client 57.154.25.166:64928] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "achrO5xrpj-dQjy1cvpUEwAAAko"]
[Sun Mar 29 07:58:52.928070 2026] [:error] [pid 32257:tid 32338] [client 57.154.25.166:42452] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "achrPCE3TArOFrUtgWpa5QAAAJQ"]
[Sun Mar 29 07:58:53.693557 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:4538] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "achrPWnfn-AtRoMbqux94QAAAEg"]
[Sun Mar 29 07:58:54.413202 2026] [:error] [pid 32255:tid 32311] [client 57.154.25.166:59293] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "achrPmnfn-AtRoMbqux94gAAAFQ"]
[Sun Mar 29 07:58:55.108370 2026] [:error] [pid 32255:tid 32310] [client 57.154.25.166:51009] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "achrP2nfn-AtRoMbqux95AAAAFM"]
[Sun Mar 29 07:58:55.738438 2026] [:error] [pid 1524:tid 1542] [client 57.154.25.166:44995] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "achrP1oaWSl2asqQCh8xaQAAAQs"]
[Sun Mar 29 07:58:56.574183 2026] [:error] [pid 32257:tid 32318] [client 57.154.25.166:4246] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "achrQCE3TArOFrUtgWpa8AAAAIA"]
[Sun Mar 29 07:58:57.321208 2026] [:error] [pid 32255:tid 32303] [client 57.154.25.166:44996] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "achrQWnfn-AtRoMbqux96QAAAEw"]
[Sun Mar 29 07:58:57.874068 2026] [:error] [pid 32255:tid 32292] [client 57.154.25.166:54159] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "achrQWnfn-AtRoMbqux96gAAAEE"]
[Sun Mar 29 07:58:58.468622 2026] [:error] [pid 23168:tid 23220] [client 57.154.25.166:58765] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "achrQmP8p0yRL8ot_28JuwAAAhc"]
[Sun Mar 29 07:58:59.497643 2026] [:error] [pid 32257:tid 32327] [client 57.154.25.166:42473] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "achrQyE3TArOFrUtgWpa8gAAAIk"]
[Sun Mar 29 07:59:00.033313 2026] [:error] [pid 23250:tid 23255] [client 57.154.25.166:54185] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "achrRJxrpj-dQjy1cvpUGgAAAkM"]
[Sun Mar 29 07:59:00.522685 2026] [:error] [pid 23137:tid 23139] [client 57.154.25.166:64929] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "achrRBaWQa7LdZ_qGFaTtwAAAYA"]
[Sun Mar 29 07:59:01.009417 2026] [:error] [pid 1524:tid 1553] [client 57.154.25.166:51049] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "achrRVoaWSl2asqQCh8xbwAAARU"]
[Sun Mar 29 07:59:01.642913 2026] [:error] [pid 32359:tid 32384] [client 57.154.25.166:42458] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "achrRQMb8G3UzfQP3Wjk2gAAANc"]
[Sun Mar 29 07:59:02.060628 2026] [proxy_fcgi:error] [pid 23167:tid 23183] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:02.226268 2026] [proxy_fcgi:error] [pid 23167:tid 23175] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:02.390369 2026] [proxy_fcgi:error] [pid 23167:tid 23188] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:02.564824 2026] [proxy_fcgi:error] [pid 23167:tid 23180] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:02.819614 2026] [proxy_fcgi:error] [pid 23167:tid 23182] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:02.988559 2026] [proxy_fcgi:error] [pid 23167:tid 23190] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:03.148377 2026] [proxy_fcgi:error] [pid 23167:tid 23194] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:03.325784 2026] [proxy_fcgi:error] [pid 23167:tid 23185] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:03.510349 2026] [proxy_fcgi:error] [pid 23167:tid 23177] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:03.675467 2026] [proxy_fcgi:error] [pid 23167:tid 23191] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:03.898862 2026] [proxy_fcgi:error] [pid 23167:tid 23173] [client 57.154.25.166:39182] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 07:59:04.059916 2026] [:error] [pid 23167:tid 23179] [client 57.154.25.166:39182] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "achrSBIAHJCFaHff3_d6dgAAAck"]
[Sun Mar 29 07:59:04.931202 2026] [:error] [pid 23167:tid 23188] [client 57.154.25.166:4740] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "achrSBIAHJCFaHff3_d6egAAAdI"]
[Sun Mar 29 07:59:05.660568 2026] [:error] [pid 32359:tid 32380] [client 57.154.25.166:4225] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "achrSQMb8G3UzfQP3Wjk3AAAANM"]
[Sun Mar 29 07:59:06.298372 2026] [:error] [pid 32255:tid 32294] [client 57.154.25.166:59670] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "achrSmnfn-AtRoMbqux98gAAAEM"]
[Sun Mar 29 07:59:07.348344 2026] [:error] [pid 32255:tid 32314] [client 57.154.25.166:4530] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "achrS2nfn-AtRoMbqux99gAAAFc"]
[Sun Mar 29 07:59:07.806853 2026] [:error] [pid 23250:tid 23271] [client 57.154.25.166:59676] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "achrS5xrpj-dQjy1cvpUHwAAAlM"]
[Sun Mar 29 07:59:08.442271 2026] [:error] [pid 23284:tid 23304] [client 57.154.25.166:4769] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "achrTIzBujdPHsq7wyRpIwAAApI"]
[Sun Mar 29 07:59:09.324766 2026] [:error] [pid 32255:tid 32295] [client 57.154.25.166:4267] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "achrTWnfn-AtRoMbqux9-AAAAEQ"]
[Sun Mar 29 07:59:10.454023 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:57235] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "achrTmnfn-AtRoMbqux9-gAAAEg"]
[Sun Mar 29 07:59:11.815309 2026] [:error] [pid 23137:tid 23157] [client 57.154.25.166:51022] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "achrTxaWQa7LdZ_qGFaTvgAAAZI"]
[Sun Mar 29 07:59:13.435591 2026] [:error] [pid 23168:tid 23209] [client 57.154.25.166:59309] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "achrUWP8p0yRL8ot_28JvwAAAgw"]
[Sun Mar 29 07:59:14.462854 2026] [:error] [pid 32254:tid 32283] [client 57.154.25.166:59297] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "achrUqug2IHuyGgCTn8gUgAAABM"]
[Sun Mar 29 07:59:15.604831 2026] [:error] [pid 23250:tid 23264] [client 57.154.25.166:51027] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "achrU5xrpj-dQjy1cvpUJQAAAkw"]
[Sun Mar 29 07:59:16.554293 2026] [:error] [pid 23167:tid 23183] [client 57.154.25.166:42448] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "achrVBIAHJCFaHff3_d6hwAAAc0"]
[Sun Mar 29 07:59:17.388737 2026] [:error] [pid 23167:tid 23194] [client 57.154.25.166:51044] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "achrVRIAHJCFaHff3_d6kQAAAdg"]
[Sun Mar 29 07:59:18.217333 2026] [:error] [pid 32255:tid 32295] [client 57.154.25.166:4507] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "achrVmnfn-AtRoMbqux-CAAAAEQ"]
[Sun Mar 29 07:59:19.001756 2026] [:error] [pid 23167:tid 23183] [client 57.154.25.166:45004] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "achrVxIAHJCFaHff3_d6nQAAAc0"]
[Sun Mar 29 07:59:20.027360 2026] [:error] [pid 23137:tid 23160] [client 57.154.25.166:4224] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "achrWBaWQa7LdZ_qGFaTwgAAAZU"]
[Sun Mar 29 07:59:20.764517 2026] [:error] [pid 23167:tid 23185] [client 57.154.25.166:4534] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "achrWBIAHJCFaHff3_d6pgAAAc8"]
[Sun Mar 29 07:59:21.484971 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:54202] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "achrWRIAHJCFaHff3_d6rAAAAdc"]
[Sun Mar 29 07:59:22.178438 2026] [:error] [pid 23167:tid 23178] [client 57.154.25.166:45027] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "achrWhIAHJCFaHff3_d6sAAAAcg"]
[Sun Mar 29 07:59:22.734945 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:42480] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "achrWhIAHJCFaHff3_d6uAAAAdQ"]
[Sun Mar 29 07:59:23.495931 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:59664] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "achrWxIAHJCFaHff3_d6vwAAAdM"]
[Sun Mar 29 07:59:24.347945 2026] [:error] [pid 23168:tid 23198] [client 57.154.25.166:51053] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "achrXGP8p0yRL8ot_28JzwAAAgE"]
[Sun Mar 29 07:59:25.332422 2026] [:error] [pid 23167:tid 23184] [client 57.154.25.166:54188] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "achrXRIAHJCFaHff3_d60wAAAc4"]
[Sun Mar 29 07:59:25.792795 2026] [:error] [pid 23167:tid 23182] [client 57.154.25.166:4253] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "achrXRIAHJCFaHff3_d62AAAAcw"]
[Sun Mar 29 07:59:26.288588 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:48954] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "achrXhIAHJCFaHff3_d63gAAAdM"]
[Sun Mar 29 07:59:26.933298 2026] [:error] [pid 23167:tid 23175] [client 57.154.25.166:54197] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "achrXhIAHJCFaHff3_d65AAAAcU"]
[Sun Mar 29 07:59:28.029938 2026] [:error] [pid 23168:tid 23201] [client 57.154.25.166:51051] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "achrYGP8p0yRL8ot_28J0QAAAgQ"]
[Sun Mar 29 07:59:29.043460 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:45008] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "achrYRIAHJCFaHff3_d69QAAAdc"]
[Sun Mar 29 07:59:30.155331 2026] [:error] [pid 23167:tid 23177] [client 57.154.25.166:4774] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "achrYhIAHJCFaHff3_d7AgAAAcc"]
[Sun Mar 29 07:59:31.247941 2026] [:error] [pid 23167:tid 23181] [client 57.154.25.166:57262] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "achrYxIAHJCFaHff3_d7DwAAAcs"]
[Sun Mar 29 07:59:31.866492 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:4798] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "achrYxIAHJCFaHff3_d7FgAAAdc"]
[Sun Mar 29 07:59:32.517317 2026] [:error] [pid 23167:tid 23180] [client 57.154.25.166:4744] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "achrZBIAHJCFaHff3_d7HQAAAco"]
[Sun Mar 29 07:59:32.986256 2026] [:error] [pid 23167:tid 23171] [client 57.154.25.166:57250] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "achrZBIAHJCFaHff3_d7IQAAAcE"]
[Sun Mar 29 07:59:33.473390 2026] [:error] [pid 23168:tid 23219] [client 57.154.25.166:45038] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "achrZWP8p0yRL8ot_28J0wAAAhY"]
[Sun Mar 29 07:59:34.226314 2026] [:error] [pid 32257:tid 32330] [client 57.154.25.166:4536] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "achrZiE3TArOFrUtgWpa9QAAAIw"]
[Sun Mar 29 07:59:34.604477 2026] [:error] [pid 23137:tid 23143] [client 57.154.25.166:54187] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "achrZhaWQa7LdZ_qGFaTxAAAAYQ"]
[Sun Mar 29 07:59:35.196081 2026] [:error] [pid 23167:tid 23176] [client 57.154.25.166:64952] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "achrZxIAHJCFaHff3_d7NAAAAcY"]
[Sun Mar 29 07:59:35.730759 2026] [:error] [pid 23167:tid 23170] [client 57.154.25.166:39237] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "achrZxIAHJCFaHff3_d7OgAAAcA"]
[Sun Mar 29 07:59:36.383756 2026] [:error] [pid 23167:tid 23180] [client 57.154.25.166:64955] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "achraBIAHJCFaHff3_d7QAAAAco"]
[Sun Mar 29 07:59:37.178498 2026] [:error] [pid 23168:tid 23214] [client 57.154.25.166:51042] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "achraWP8p0yRL8ot_28J1gAAAhE"]
[Sun Mar 29 07:59:37.580976 2026] [:error] [pid 32255:tid 32295] [client 57.154.25.166:4481] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "achraWnfn-AtRoMbqux-EgAAAEQ"]
[Sun Mar 29 07:59:38.102819 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:58778] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "achramnfn-AtRoMbqux-FQAAAEg"]
[Sun Mar 29 07:59:38.566250 2026] [:error] [pid 32255:tid 32315] [client 57.154.25.166:59691] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "achramnfn-AtRoMbqux-FwAAAFg"]
[Sun Mar 29 07:59:38.955509 2026] [:error] [pid 1524:tid 1528] [client 57.154.25.166:54175] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "achraloaWSl2asqQCh8xcwAAAQE"]
[Sun Mar 29 07:59:39.517957 2026] [:error] [pid 32255:tid 32308] [client 57.154.25.166:59700] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "achra2nfn-AtRoMbqux-GwAAAFE"]
[Sun Mar 29 07:59:40.078418 2026] [:error] [pid 32255:tid 32295] [client 57.154.25.166:45000] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "achrbGnfn-AtRoMbqux-IAAAAEQ"]
[Sun Mar 29 07:59:40.453222 2026] [:error] [pid 23167:tid 23172] [client 57.154.25.166:4239] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "achrbBIAHJCFaHff3_d7TwAAAcI"]
[Sun Mar 29 07:59:40.903627 2026] [:error] [pid 23284:tid 23288] [client 57.154.25.166:58754] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "achrbIzBujdPHsq7wyRpNAAAAoI"]
[Sun Mar 29 07:59:41.356496 2026] [:error] [pid 32359:tid 32365] [client 57.154.25.166:59265] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "achrbQMb8G3UzfQP3Wjk4QAAAMQ"]
[Sun Mar 29 07:59:41.875547 2026] [:error] [pid 23284:tid 23290] [client 57.154.25.166:44994] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "achrbYzBujdPHsq7wyRpYwAAAoQ"]
[Sun Mar 29 07:59:42.339285 2026] [:error] [pid 23167:tid 23192] [client 57.154.25.166:4256] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "achrbhIAHJCFaHff3_d7VAAAAdY"]
[Sun Mar 29 07:59:42.834253 2026] [:error] [pid 23137:tid 23159] [client 57.154.25.166:4268] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "achrbhaWQa7LdZ_qGFaTyAAAAZQ"]
[Sun Mar 29 07:59:43.300458 2026] [:error] [pid 32257:tid 32333] [client 57.154.25.166:42451] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "achrbyE3TArOFrUtgWpa_QAAAI8"]
[Sun Mar 29 07:59:43.700617 2026] [:error] [pid 23137:tid 23157] [client 57.154.25.166:57242] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "achrbxaWQa7LdZ_qGFaTygAAAZI"]
[Sun Mar 29 07:59:44.188533 2026] [:error] [pid 32255:tid 32311] [client 57.154.25.166:4485] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lowpr.php"] [unique_id "achrcGnfn-AtRoMbqux-JQAAAFQ"]
[Sun Mar 29 07:59:44.990956 2026] [:error] [pid 23284:tid 23301] [client 57.154.25.166:54174] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lowpr.php"] [unique_id "achrcIzBujdPHsq7wyRpmgAAAo8"]
[Sun Mar 29 07:59:45.490401 2026] [:error] [pid 32255:tid 32296] [client 57.154.25.166:59657] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lowpr.php"] [unique_id "achrcWnfn-AtRoMbqux-KQAAAEU"]
[Sun Mar 29 07:59:45.843408 2026] [:error] [pid 32255:tid 32302] [client 57.154.25.166:45024] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lowpr.php"] [unique_id "achrcWnfn-AtRoMbqux-KgAAAEs"]
[Sun Mar 29 07:59:46.396686 2026] [:error] [pid 32257:tid 32319] [client 57.154.25.166:4785] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "achrciE3TArOFrUtgWpbAQAAAIE"]
[Sun Mar 29 07:59:46.865591 2026] [:error] [pid 32255:tid 32310] [client 57.154.25.166:58794] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "achrcmnfn-AtRoMbqux-LwAAAFM"]
[Sun Mar 29 07:59:47.408473 2026] [:error] [pid 23168:tid 23218] [client 57.154.25.166:4748] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "achrc2P8p0yRL8ot_28KAAAAAhU"]
[Sun Mar 29 07:59:47.792148 2026] [:error] [pid 32254:tid 32277] [client 57.154.25.166:59319] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "achrc6ug2IHuyGgCTn8gVwAAAA0"]
[Sun Mar 29 07:59:48.201846 2026] [:error] [pid 23168:tid 23203] [client 57.154.25.166:4759] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "achrdGP8p0yRL8ot_28KAgAAAgY"]
[Sun Mar 29 07:59:48.783272 2026] [:error] [pid 23250:tid 23257] [client 57.154.25.166:4286] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "achrdJxrpj-dQjy1cvpULQAAAkU"]
[Sun Mar 29 07:59:49.267200 2026] [:error] [pid 23250:tid 23269] [client 57.154.25.166:4261] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "achrdZxrpj-dQjy1cvpULwAAAlE"]
[Sun Mar 29 07:59:49.720988 2026] [:error] [pid 23167:tid 23187] [client 57.154.25.166:4771] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "achrdRIAHJCFaHff3_d7XgAAAdE"]
[Sun Mar 29 07:59:50.171821 2026] [:error] [pid 23167:tid 23191] [client 57.154.25.166:54150] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "achrdhIAHJCFaHff3_d7YAAAAdU"]
[Sun Mar 29 07:59:50.577511 2026] [:error] [pid 23167:tid 23192] [client 57.154.25.166:64904] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "achrdhIAHJCFaHff3_d7YgAAAdY"]
[Sun Mar 29 07:59:51.322699 2026] [:error] [pid 23284:tid 23292] [client 57.154.25.166:45054] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "achrd4zBujdPHsq7wyRpmwAAAoY"]
[Sun Mar 29 07:59:51.763888 2026] [:error] [pid 32254:tid 32280] [client 57.154.25.166:4243] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "achrd6ug2IHuyGgCTn8gWAAAABA"]
[Sun Mar 29 07:59:52.402659 2026] [:error] [pid 32255:tid 32298] [client 57.154.25.166:42476] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "achreGnfn-AtRoMbqux-MQAAAEc"]
[Sun Mar 29 07:59:52.914399 2026] [:error] [pid 23168:tid 23209] [client 57.154.25.166:4285] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "achreGP8p0yRL8ot_28KCQAAAgw"]
[Sun Mar 29 07:59:54.005999 2026] [:error] [pid 23167:tid 23194] [client 57.154.25.166:4255] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "achrehIAHJCFaHff3_d7awAAAdg"]
[Sun Mar 29 07:59:54.556270 2026] [:error] [pid 23284:tid 23293] [client 57.154.25.166:57228] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "achreozBujdPHsq7wyRpnQAAAoc"]
[Sun Mar 29 07:59:55.108151 2026] [:error] [pid 23167:tid 23192] [client 57.154.25.166:4790] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "achrexIAHJCFaHff3_d7cAAAAdY"]
[Sun Mar 29 07:59:55.599689 2026] [:error] [pid 32255:tid 32304] [client 57.154.25.166:57248] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "achre2nfn-AtRoMbqux-MwAAAE0"]
[Sun Mar 29 07:59:56.085783 2026] [:error] [pid 32255:tid 32291] [client 57.154.25.166:59278] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "achrfGnfn-AtRoMbqux-NwAAAEA"]
[Sun Mar 29 07:59:56.573041 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:4247] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "achrfGnfn-AtRoMbqux-PAAAAEg"]
[Sun Mar 29 07:59:57.092089 2026] [:error] [pid 32255:tid 32310] [client 57.154.25.166:57251] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "achrfWnfn-AtRoMbqux-PwAAAFM"]
[Sun Mar 29 07:59:57.553622 2026] [:error] [pid 32255:tid 32315] [client 57.154.25.166:51010] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "achrfWnfn-AtRoMbqux-QQAAAFg"]
[Sun Mar 29 07:59:58.225612 2026] [:error] [pid 32255:tid 32306] [client 57.154.25.166:51066] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "achrfmnfn-AtRoMbqux-RQAAAE8"]
[Sun Mar 29 07:59:58.723519 2026] [:error] [pid 32254:tid 32286] [client 57.154.25.166:45049] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "achrfqug2IHuyGgCTn8gWgAAABY"]
[Sun Mar 29 07:59:59.185323 2026] [:error] [pid 23284:tid 23299] [client 57.154.25.166:64923] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achrf4zBujdPHsq7wyRpngAAAo0"]
[Sun Mar 29 07:59:59.695721 2026] [:error] [pid 32255:tid 32296] [client 57.154.25.166:45035] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achrf2nfn-AtRoMbqux-RwAAAEU"]
[Sun Mar 29 08:00:00.161298 2026] [:error] [pid 23250:tid 23258] [client 57.154.25.166:44458] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achrgJxrpj-dQjy1cvpUOAAAAkY"]
[Sun Mar 29 08:00:00.557993 2026] [:error] [pid 23168:tid 23203] [client 57.154.25.166:64942] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achrgGP8p0yRL8ot_28KDQAAAgY"]
[Sun Mar 29 08:00:00.995092 2026] [:error] [pid 23168:tid 23214] [client 57.154.25.166:48927] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "achrgGP8p0yRL8ot_28KEAAAAhE"]
[Sun Mar 29 08:00:01.629594 2026] [:error] [pid 32255:tid 32300] [client 57.154.25.166:59305] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "achrgWnfn-AtRoMbqux-TQAAAEk"]
[Sun Mar 29 08:00:02.008316 2026] [:error] [pid 23168:tid 23213] [client 57.154.25.166:51017] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "achrgmP8p0yRL8ot_28KEgAAAhA"]
[Sun Mar 29 08:00:02.394581 2026] [:error] [pid 23137:tid 23145] [client 57.154.25.166:4514] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ne2026.php"] [unique_id "achrghaWQa7LdZ_qGFaTzgAAAYY"]
[Sun Mar 29 08:00:02.784907 2026] [:error] [pid 32257:tid 32335] [client 57.154.25.166:59286] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws73.php"] [unique_id "achrgiE3TArOFrUtgWpbHQAAAJE"]
[Sun Mar 29 08:00:03.381176 2026] [proxy_fcgi:error] [pid 23284:tid 23296] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:03.541201 2026] [proxy_fcgi:error] [pid 23284:tid 23310] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:03.711952 2026] [proxy_fcgi:error] [pid 23284:tid 23288] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:03.880797 2026] [proxy_fcgi:error] [pid 23284:tid 23297] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.041073 2026] [proxy_fcgi:error] [pid 23284:tid 23287] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.202189 2026] [proxy_fcgi:error] [pid 23284:tid 23302] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.372103 2026] [proxy_fcgi:error] [pid 23284:tid 23300] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.536088 2026] [proxy_fcgi:error] [pid 23284:tid 23308] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.695634 2026] [proxy_fcgi:error] [pid 23284:tid 23304] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:04.860301 2026] [proxy_fcgi:error] [pid 23284:tid 23286] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:05.020270 2026] [proxy_fcgi:error] [pid 23284:tid 23309] [client 57.154.25.166:45045] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:00:05.189543 2026] [:error] [pid 23284:tid 23290] [client 57.154.25.166:45045] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "achrhYzBujdPHsq7wyRprAAAAoQ"]
[Sun Mar 29 08:00:05.605138 2026] [:error] [pid 23284:tid 23305] [client 57.154.25.166:57249] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "achrhYzBujdPHsq7wyRprQAAApM"]
[Sun Mar 29 08:00:06.127066 2026] [:error] [pid 23250:tid 23265] [client 57.154.25.166:51018] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "achrhpxrpj-dQjy1cvpUOwAAAk0"]
[Sun Mar 29 08:00:06.783725 2026] [:error] [pid 32255:tid 32310] [client 57.154.25.166:4745] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asd.php"] [unique_id "achrhmnfn-AtRoMbqux-UwAAAFM"]
[Sun Mar 29 08:00:07.593402 2026] [:error] [pid 32254:tid 32281] [client 57.154.25.166:64934] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "achrh6ug2IHuyGgCTn8gXAAAABE"]
[Sun Mar 29 08:00:08.669109 2026] [:error] [pid 23284:tid 23300] [client 57.154.25.166:39180] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "achriIzBujdPHsq7wyRptwAAAo4"]
[Sun Mar 29 08:00:10.084149 2026] [:error] [pid 23250:tid 23272] [client 57.154.25.166:51065] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "achripxrpj-dQjy1cvpUPQAAAlQ"]
[Sun Mar 29 08:00:11.045332 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:4269] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "achri2nfn-AtRoMbqux-VwAAAFU"]
[Sun Mar 29 08:00:11.487964 2026] [:error] [pid 1524:tid 1543] [client 57.154.25.166:54182] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "achri1oaWSl2asqQCh8xhgAAAQw"]
[Sun Mar 29 08:00:12.145550 2026] [:error] [pid 32257:tid 32333] [client 57.154.25.166:39241] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "achrjCE3TArOFrUtgWpbMQAAAI8"]
[Sun Mar 29 08:00:12.652628 2026] [:error] [pid 32257:tid 32328] [client 57.154.25.166:59324] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "achrjCE3TArOFrUtgWpbMwAAAIo"]
[Sun Mar 29 08:00:13.108216 2026] [:error] [pid 32257:tid 32323] [client 57.154.25.166:4758] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "achrjSE3TArOFrUtgWpbNQAAAIU"]
[Sun Mar 29 08:00:13.561527 2026] [:error] [pid 1524:tid 1552] [client 57.154.25.166:39239] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "achrjVoaWSl2asqQCh8xigAAARQ"]
[Sun Mar 29 08:00:14.129285 2026] [:error] [pid 32257:tid 32332] [client 57.154.25.166:64904] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "achrjiE3TArOFrUtgWpbNgAAAI4"]
[Sun Mar 29 08:00:14.909563 2026] [:error] [pid 23167:tid 23177] [client 57.154.25.166:57275] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "achrjhIAHJCFaHff3_d7eQAAAcc"]
[Sun Mar 29 08:00:15.487634 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:47678] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "achrj5xrpj-dQjy1cvpUQQAAAk4"]
[Sun Mar 29 08:00:15.939466 2026] [:error] [pid 23250:tid 23252] [client 57.154.25.166:59672] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "achrj5xrpj-dQjy1cvpUQgAAAkA"]
[Sun Mar 29 08:00:16.363615 2026] [:error] [pid 23250:tid 23271] [client 57.154.25.166:4237] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "achrkJxrpj-dQjy1cvpURQAAAlM"]
[Sun Mar 29 08:00:16.716215 2026] [:error] [pid 1524:tid 1528] [client 57.154.25.166:59313] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "achrkFoaWSl2asqQCh8xjwAAAQE"]
[Sun Mar 29 08:00:17.152607 2026] [:error] [pid 23250:tid 23261] [client 57.154.25.166:42445] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "achrkZxrpj-dQjy1cvpURgAAAkk"]
[Sun Mar 29 08:00:17.632314 2026] [:error] [pid 32359:tid 32369] [client 57.154.25.166:59705] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "achrkQMb8G3UzfQP3WjlNgAAAMg"]
[Sun Mar 29 08:00:18.097949 2026] [:error] [pid 23250:tid 23258] [client 57.154.25.166:4761] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "achrkpxrpj-dQjy1cvpUSAAAAkY"]
[Sun Mar 29 08:00:18.694724 2026] [:error] [pid 23250:tid 23257] [client 57.154.25.166:59283] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "achrkpxrpj-dQjy1cvpUSQAAAkU"]
[Sun Mar 29 08:00:19.458034 2026] [:error] [pid 23250:tid 23269] [client 57.154.25.166:4753] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "achrk5xrpj-dQjy1cvpUSwAAAlE"]
[Sun Mar 29 08:00:19.897218 2026] [:error] [pid 23250:tid 23256] [client 57.154.25.166:45053] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "achrk5xrpj-dQjy1cvpUTQAAAkQ"]
[Sun Mar 29 08:00:20.521855 2026] [:error] [pid 23168:tid 23200] [client 57.154.25.166:64902] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "achrlGP8p0yRL8ot_28KGAAAAgM"]
[Sun Mar 29 08:00:21.453438 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:47668] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "achrlWnfn-AtRoMbqux-ZQAAAFU"]
[Sun Mar 29 08:00:22.059888 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:4535] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "achrlpxrpj-dQjy1cvpUUwAAAk4"]
[Sun Mar 29 08:00:22.808171 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:57254] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "achrlhIAHJCFaHff3_d7fQAAAdM"]
[Sun Mar 29 08:00:23.391651 2026] [:error] [pid 23167:tid 23172] [client 57.154.25.166:4747] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "achrlxIAHJCFaHff3_d7gQAAAcI"]
[Sun Mar 29 08:00:26.556059 2026] [:error] [pid 23167:tid 23184] [client 57.154.25.166:51064] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "achrmhIAHJCFaHff3_d7iwAAAc4"]
[Sun Mar 29 08:00:27.556827 2026] [:error] [pid 32359:tid 32380] [client 57.154.25.166:4276] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "achrmwMb8G3UzfQP3WjlOAAAANM"]
[Sun Mar 29 08:00:29.416706 2026] [:error] [pid 23167:tid 23181] [client 57.154.25.166:4752] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "achrnRIAHJCFaHff3_d7kwAAAcs"]
[Sun Mar 29 08:00:32.626531 2026] [:error] [pid 23167:tid 23176] [client 57.154.25.166:51071] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "achroBIAHJCFaHff3_d7lwAAAcY"]
[Sun Mar 29 08:00:33.563957 2026] [:error] [pid 23167:tid 23172] [client 57.154.25.166:4532] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "achroRIAHJCFaHff3_d7nwAAAcI"]
[Sun Mar 29 08:00:35.276039 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:4504] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "achroxIAHJCFaHff3_d7pgAAAdQ"]
[Sun Mar 29 08:00:37.326202 2026] [:error] [pid 23167:tid 23176] [client 57.154.25.166:57245] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "achrpRIAHJCFaHff3_d7sAAAAcY"]
[Sun Mar 29 08:00:38.647319 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:4490] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "achrphIAHJCFaHff3_d7sgAAAdQ"]
[Sun Mar 29 08:00:40.075680 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:54181] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "achrqBIAHJCFaHff3_d7tQAAAdM"]
[Sun Mar 29 08:00:47.211193 2026] [:error] [pid 32255:tid 32307] [client 57.154.25.166:51038] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "achrr2nfn-AtRoMbqux-0wAAAFA"]
[Sun Mar 29 08:00:48.255416 2026] [:error] [pid 23167:tid 23181] [client 57.154.25.166:63007] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "achrsBIAHJCFaHff3_d7ygAAAcs"]
[Sun Mar 29 08:00:50.270454 2026] [:error] [pid 23167:tid 23183] [client 57.154.25.166:50341] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "achrshIAHJCFaHff3_d70AAAAc0"]
[Sun Mar 29 08:00:51.852788 2026] [:error] [pid 23167:tid 23170] [client 57.154.25.166:50339] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "achrsxIAHJCFaHff3_d71AAAAcA"]
[Sun Mar 29 08:00:52.975530 2026] [:error] [pid 23137:tid 23157] [client 57.154.25.166:63836] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/green.php"] [unique_id "achrtBaWQa7LdZ_qGFaT2AAAAZI"]
[Sun Mar 29 08:00:53.942664 2026] [:error] [pid 23168:tid 23200] [client 57.154.25.166:56206] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "achrtWP8p0yRL8ot_28KUgAAAgM"]
[Sun Mar 29 08:00:54.881177 2026] [:error] [pid 23167:tid 23176] [client 57.154.25.166:41524] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "achrthIAHJCFaHff3_d72AAAAcY"]
[Sun Mar 29 08:00:56.236558 2026] [:error] [pid 32255:tid 32314] [client 57.154.25.166:43711] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "achruGnfn-AtRoMbqux-5AAAAFc"]
[Sun Mar 29 08:00:56.863387 2026] [:error] [pid 32255:tid 32305] [client 57.154.25.166:47957] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "achruGnfn-AtRoMbqux-5wAAAE4"]
[Sun Mar 29 08:00:57.520363 2026] [:error] [pid 23168:tid 23205] [client 57.154.25.166:50947] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "achruWP8p0yRL8ot_28KUwAAAgg"]
[Sun Mar 29 08:00:58.058114 2026] [:error] [pid 32255:tid 32311] [client 57.154.25.166:41508] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "achrumnfn-AtRoMbqux-8AAAAFQ"]
[Sun Mar 29 08:00:58.622949 2026] [:error] [pid 32255:tid 32292] [client 57.154.25.166:65404] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "achrumnfn-AtRoMbqux-9QAAAEE"]
[Sun Mar 29 08:00:59.311347 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:41904] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "achru2nfn-AtRoMbqux-_AAAAFU"]
[Sun Mar 29 08:01:00.104998 2026] [:error] [pid 23250:tid 23268] [client 57.154.25.166:65351] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "achrvJxrpj-dQjy1cvpUiwAAAlA"]
[Sun Mar 29 08:01:00.751524 2026] [:error] [pid 23250:tid 23255] [client 57.154.25.166:41478] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "achrvJxrpj-dQjy1cvpUjAAAAkM"]
[Sun Mar 29 08:01:01.342639 2026] [:error] [pid 32255:tid 32292] [client 57.154.25.166:56137] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "achrvWnfn-AtRoMbqux_AgAAAEE"]
[Sun Mar 29 08:01:01.861768 2026] [:error] [pid 23167:tid 23187] [client 57.154.25.166:44533] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "achrvRIAHJCFaHff3_d75wAAAdE"]
[Sun Mar 29 08:01:02.600813 2026] [:error] [pid 32255:tid 32309] [client 57.154.25.166:42937] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "achrvmnfn-AtRoMbqux_BgAAAFI"]
[Sun Mar 29 08:01:03.391173 2026] [:error] [pid 23167:tid 23186] [client 57.154.25.166:41982] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "achrvxIAHJCFaHff3_d76wAAAdA"]
[Sun Mar 29 08:01:03.958496 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:44518] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "achrv5xrpj-dQjy1cvpUkQAAAk4"]
[Sun Mar 29 08:01:04.549916 2026] [:error] [pid 23250:tid 23260] [client 57.154.25.166:41862] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "achrwJxrpj-dQjy1cvpUkgAAAkg"]
[Sun Mar 29 08:01:04.966395 2026] [:error] [pid 32257:tid 32331] [client 57.154.25.166:65380] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "achrwCE3TArOFrUtgWpbRQAAAI0"]
[Sun Mar 29 08:01:05.660038 2026] [proxy_fcgi:error] [pid 23250:tid 23264] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:05.824884 2026] [proxy_fcgi:error] [pid 23250:tid 23276] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:06.161841 2026] [proxy_fcgi:error] [pid 23250:tid 23275] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:06.321666 2026] [proxy_fcgi:error] [pid 23250:tid 23259] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:06.481290 2026] [proxy_fcgi:error] [pid 23250:tid 23258] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:06.641334 2026] [proxy_fcgi:error] [pid 23250:tid 23267] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:06.810728 2026] [proxy_fcgi:error] [pid 23250:tid 23273] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:07.200875 2026] [proxy_fcgi:error] [pid 23250:tid 23252] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:07.378859 2026] [proxy_fcgi:error] [pid 23250:tid 23266] [client 57.154.25.166:42899] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:01:07.553039 2026] [:error] [pid 23250:tid 23263] [client 57.154.25.166:42899] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "achrw5xrpj-dQjy1cvpUowAAAks"]
[Sun Mar 29 08:01:10.279725 2026] [:error] [pid 23284:tid 23299] [client 57.154.25.166:45724] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "achrxozBujdPHsq7wyRp_AAAAo0"]
[Sun Mar 29 08:01:12.014078 2026] [:error] [pid 32257:tid 32338] [client 57.154.25.166:4613] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "achryCE3TArOFrUtgWpbSwAAAJQ"]
[Sun Mar 29 08:01:13.025299 2026] [:error] [pid 23250:tid 23261] [client 57.154.25.166:47352] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws60.php"] [unique_id "achryZxrpj-dQjy1cvpUqQAAAkk"]
[Sun Mar 29 08:01:14.673857 2026] [:error] [pid 23284:tid 23292] [client 57.154.25.166:45735] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "achryozBujdPHsq7wyRqAAAAAoY"]
[Sun Mar 29 08:01:17.212792 2026] [:error] [pid 32255:tid 32308] [client 57.154.25.166:45738] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "achrzWnfn-AtRoMbqux_IAAAAFE"]
[Sun Mar 29 08:01:18.712158 2026] [:error] [pid 23167:tid 23187] [client 57.154.25.166:47255] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "achrzhIAHJCFaHff3_d8BQAAAdE"]
[Sun Mar 29 08:01:19.630012 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:45756] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "achrzxIAHJCFaHff3_d8CQAAAdQ"]
[Sun Mar 29 08:01:20.129172 2026] [:error] [pid 32257:tid 32323] [client 57.154.25.166:4671] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "achr0CE3TArOFrUtgWpbTwAAAIU"]
[Sun Mar 29 08:01:20.795515 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:48541] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "achr0BIAHJCFaHff3_d8DAAAAdM"]
[Sun Mar 29 08:01:21.302557 2026] [:error] [pid 23167:tid 23179] [client 57.154.25.166:47235] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "achr0RIAHJCFaHff3_d8DgAAAck"]
[Sun Mar 29 08:01:21.708137 2026] [:error] [pid 23167:tid 23177] [client 57.154.25.166:53659] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "achr0RIAHJCFaHff3_d8EQAAAcc"]
[Sun Mar 29 08:01:22.263666 2026] [:error] [pid 32257:tid 32321] [client 57.154.25.166:47267] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "achr0iE3TArOFrUtgWpbUwAAAIM"]
[Sun Mar 29 08:01:23.132122 2026] [:error] [pid 23167:tid 23170] [client 57.154.25.166:49325] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "achr0xIAHJCFaHff3_d8FgAAAcA"]
[Sun Mar 29 08:01:23.810904 2026] [:error] [pid 23250:tid 23255] [client 57.154.25.166:4359] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "achr05xrpj-dQjy1cvpUqwAAAkM"]
[Sun Mar 29 08:01:24.663053 2026] [:error] [pid 23284:tid 23297] [client 57.154.25.166:47291] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "achr1IzBujdPHsq7wyRqCgAAAos"]
[Sun Mar 29 08:01:25.844212 2026] [:error] [pid 23167:tid 23182] [client 57.154.25.166:49328] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "achr1RIAHJCFaHff3_d8GwAAAcw"]
[Sun Mar 29 08:01:26.917121 2026] [:error] [pid 23250:tid 23262] [client 57.154.25.166:47310] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "achr1pxrpj-dQjy1cvpUsgAAAko"]
[Sun Mar 29 08:01:29.314426 2026] [:error] [pid 23284:tid 23293] [client 57.154.25.166:47288] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "achr2YzBujdPHsq7wyRqDwAAAoc"]
[Sun Mar 29 08:01:30.540910 2026] [:error] [pid 23284:tid 23287] [client 57.154.25.166:48560] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "achr2ozBujdPHsq7wyRqEgAAAoE"]
[Sun Mar 29 08:01:31.331267 2026] [:error] [pid 23167:tid 23175] [client 57.154.25.166:47348] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "achr2xIAHJCFaHff3_d8KAAAAcU"]
[Sun Mar 29 08:01:31.753833 2026] [:error] [pid 23167:tid 23171] [client 57.154.25.166:47324] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "achr2xIAHJCFaHff3_d8KwAAAcE"]
[Sun Mar 29 08:01:32.202611 2026] [:error] [pid 32257:tid 32338] [client 57.154.25.166:61038] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "achr3CE3TArOFrUtgWpbWgAAAJQ"]
[Sun Mar 29 08:01:32.557427 2026] [:error] [pid 32359:tid 32382] [client 57.154.25.166:49336] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "achr3AMb8G3UzfQP3WjlPwAAANU"]
[Sun Mar 29 08:01:33.042421 2026] [:error] [pid 1524:tid 1555] [client 57.154.25.166:47321] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "achr3VoaWSl2asqQCh8xmwAAARc"]
[Sun Mar 29 08:01:33.498650 2026] [:error] [pid 1524:tid 1545] [client 57.154.25.166:45702] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "achr3VoaWSl2asqQCh8xnQAAAQ4"]
[Sun Mar 29 08:01:34.217981 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:47335] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "achr3mnfn-AtRoMbqux_NQAAAFU"]
[Sun Mar 29 08:01:34.773584 2026] [:error] [pid 1524:tid 1549] [client 57.154.25.166:4668] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "achr3loaWSl2asqQCh8xoAAAARI"]
[Sun Mar 29 08:01:35.311008 2026] [:error] [pid 32257:tid 32330] [client 57.154.25.166:64335] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "achr3yE3TArOFrUtgWpbYAAAAIw"]
[Sun Mar 29 08:01:35.835685 2026] [:error] [pid 23284:tid 23310] [client 57.154.25.166:48516] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "achr34zBujdPHsq7wyRqFQAAApg"]
[Sun Mar 29 08:01:36.363173 2026] [:error] [pid 23284:tid 23301] [client 57.154.25.166:48547] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "achr4IzBujdPHsq7wyRqGAAAAo8"]
[Sun Mar 29 08:01:36.909449 2026] [:error] [pid 32255:tid 32296] [client 57.154.25.166:4617] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "achr4Gnfn-AtRoMbqux_OgAAAEU"]
[Sun Mar 29 08:01:37.524443 2026] [:error] [pid 32257:tid 32321] [client 57.154.25.166:4661] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "achr4SE3TArOFrUtgWpbYwAAAIM"]
[Sun Mar 29 08:01:38.054099 2026] [:error] [pid 23168:tid 23211] [client 57.154.25.166:55156] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "achr4mP8p0yRL8ot_28KXgAAAg4"]
[Sun Mar 29 08:01:38.735273 2026] [:error] [pid 23168:tid 23204] [client 57.154.25.166:55141] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "achr4mP8p0yRL8ot_28KYQAAAgc"]
[Sun Mar 29 08:01:39.362782 2026] [:error] [pid 23168:tid 23214] [client 57.154.25.166:47282] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "achr42P8p0yRL8ot_28KZQAAAhE"]
[Sun Mar 29 08:01:39.728971 2026] [:error] [pid 1524:tid 1547] [client 57.154.25.166:53669] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "achr41oaWSl2asqQCh8xpQAAARA"]
[Sun Mar 29 08:01:40.214930 2026] [:error] [pid 23167:tid 23177] [client 57.154.25.166:47284] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "achr5BIAHJCFaHff3_d8MAAAAcc"]
[Sun Mar 29 08:01:40.663785 2026] [:error] [pid 32359:tid 32384] [client 57.154.25.166:49285] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "achr5AMb8G3UzfQP3WjlQgAAANc"]
[Sun Mar 29 08:01:41.036897 2026] [:error] [pid 23284:tid 23289] [client 57.154.25.166:64348] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blogs.php"] [unique_id "achr5YzBujdPHsq7wyRqHwAAAoM"]
[Sun Mar 29 08:01:41.542838 2026] [:error] [pid 32255:tid 32300] [client 57.154.25.166:4352] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "achr5Wnfn-AtRoMbqux_PwAAAEk"]
[Sun Mar 29 08:01:41.936075 2026] [:error] [pid 32255:tid 32301] [client 57.154.25.166:4670] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "achr5Wnfn-AtRoMbqux_QQAAAEo"]
[Sun Mar 29 08:01:42.410955 2026] [:error] [pid 23250:tid 23267] [client 57.154.25.166:55153] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "achr5pxrpj-dQjy1cvpUuwAAAk8"]
[Sun Mar 29 08:01:42.750250 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:48521] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "achr5hIAHJCFaHff3_d8NgAAAdQ"]
[Sun Mar 29 08:01:43.177811 2026] [:error] [pid 23284:tid 23300] [client 57.154.25.166:61000] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "achr54zBujdPHsq7wyRqIwAAAo4"]
[Sun Mar 29 08:01:43.842405 2026] [:error] [pid 1524:tid 1528] [client 57.154.25.166:47342] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "achr51oaWSl2asqQCh8xrgAAAQE"]
[Sun Mar 29 08:01:44.298214 2026] [:error] [pid 32257:tid 32327] [client 57.154.25.166:49304] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "achr6CE3TArOFrUtgWpbaAAAAIk"]
[Sun Mar 29 08:01:44.656508 2026] [:error] [pid 1524:tid 1537] [client 57.154.25.166:49306] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "achr6FoaWSl2asqQCh8xsgAAAQg"]
[Sun Mar 29 08:01:45.191007 2026] [:error] [pid 32257:tid 32337] [client 57.154.25.166:60999] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "achr6SE3TArOFrUtgWpbbAAAAJM"]
[Sun Mar 29 08:01:45.659118 2026] [:error] [pid 1524:tid 1543] [client 57.154.25.166:45732] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "achr6VoaWSl2asqQCh8xtAAAAQw"]
[Sun Mar 29 08:01:46.316661 2026] [:error] [pid 32255:tid 32307] [client 57.154.25.166:45751] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "achr6mnfn-AtRoMbqux_RAAAAFA"]
[Sun Mar 29 08:01:46.897114 2026] [:error] [pid 32257:tid 32323] [client 57.154.25.166:49287] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "achr6iE3TArOFrUtgWpbcgAAAIU"]
[Sun Mar 29 08:01:47.444483 2026] [:error] [pid 32255:tid 32311] [client 57.154.25.166:47268] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "achr62nfn-AtRoMbqux_RwAAAFQ"]
[Sun Mar 29 08:01:48.082087 2026] [:error] [pid 32257:tid 32335] [client 57.154.25.166:47292] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "achr7CE3TArOFrUtgWpbeAAAAJE"]
[Sun Mar 29 08:01:48.683427 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:49294] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "achr7BIAHJCFaHff3_d8OgAAAdM"]
[Sun Mar 29 08:01:49.587650 2026] [:error] [pid 23284:tid 23306] [client 57.154.25.166:49289] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "achr7YzBujdPHsq7wyRqNAAAApQ"]
[Sun Mar 29 08:01:50.336575 2026] [:error] [pid 23167:tid 23185] [client 57.154.25.166:53660] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "achr7hIAHJCFaHff3_d8PwAAAc8"]
[Sun Mar 29 08:01:51.236709 2026] [:error] [pid 23137:tid 23159] [client 57.154.25.166:47259] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "achr7xaWQa7LdZ_qGFaT5AAAAZQ"]
[Sun Mar 29 08:01:51.811583 2026] [:error] [pid 23284:tid 23298] [client 57.154.25.166:42889] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "achr74zBujdPHsq7wyRqPQAAAow"]
[Sun Mar 29 08:01:52.476568 2026] [:error] [pid 32359:tid 32363] [client 57.154.25.166:45715] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "achr8AMb8G3UzfQP3WjlRwAAAMI"]
[Sun Mar 29 08:01:53.139638 2026] [:error] [pid 23167:tid 23179] [client 57.154.25.166:47248] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "achr8RIAHJCFaHff3_d8SwAAAck"]
[Sun Mar 29 08:01:55.026878 2026] [:error] [pid 32255:tid 32309] [client 57.154.25.166:48563] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "achr82nfn-AtRoMbqux_SgAAAFI"]
[Sun Mar 29 08:01:56.459994 2026] [:error] [pid 32359:tid 32373] [client 57.154.25.166:49326] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "achr9AMb8G3UzfQP3WjlSwAAAMw"]
[Sun Mar 29 08:01:56.902139 2026] [:error] [pid 32359:tid 32367] [client 57.154.25.166:64360] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "achr9AMb8G3UzfQP3WjlTAAAAMY"]
[Sun Mar 29 08:01:57.437930 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:4403] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "achr9Wnfn-AtRoMbqux_UAAAAEg"]
[Sun Mar 29 08:01:58.110540 2026] [:error] [pid 23167:tid 23174] [client 57.154.25.166:49300] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "achr9hIAHJCFaHff3_d8UAAAAcQ"]
[Sun Mar 29 08:01:59.444132 2026] [:error] [pid 32255:tid 32298] [client 57.154.25.166:49337] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "achr92nfn-AtRoMbqux_VgAAAEc"]
[Sun Mar 29 08:02:00.737058 2026] [:error] [pid 32255:tid 32304] [client 57.154.25.166:4372] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "achr-Gnfn-AtRoMbqux_XQAAAE0"]
[Sun Mar 29 08:02:01.847588 2026] [:error] [pid 32257:tid 32328] [client 57.154.25.166:61054] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "achr-SE3TArOFrUtgWpbgQAAAIo"]
[Sun Mar 29 08:02:02.367290 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:49320] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "achr-mnfn-AtRoMbqux_ZAAAAFU"]
[Sun Mar 29 08:02:03.163414 2026] [:error] [pid 32255:tid 32291] [client 57.154.25.166:51018] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "achr-2nfn-AtRoMbqux_ZwAAAEA"]
[Sun Mar 29 08:02:03.974017 2026] [:error] [pid 32359:tid 32371] [client 57.154.25.166:42881] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "achr-wMb8G3UzfQP3WjlUAAAAMo"]
[Sun Mar 29 08:02:04.470140 2026] [:error] [pid 23167:tid 23189] [client 57.154.25.166:61045] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "achr_BIAHJCFaHff3_d8WQAAAdM"]
[Sun Mar 29 08:02:04.920564 2026] [:error] [pid 32359:tid 32361] [client 57.154.25.166:47290] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "achr_AMb8G3UzfQP3WjlUQAAAMA"]
[Sun Mar 29 08:02:05.386378 2026] [:error] [pid 32255:tid 32292] [client 57.154.25.166:49288] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "achr_Wnfn-AtRoMbqux_agAAAEE"]
[Sun Mar 29 08:02:05.974876 2026] [:error] [pid 23167:tid 23180] [client 57.154.25.166:47339] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "achr_RIAHJCFaHff3_d8XQAAAco"]
[Sun Mar 29 08:02:06.564549 2026] [:error] [pid 23167:tid 23194] [client 57.154.25.166:55152] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "achr_hIAHJCFaHff3_d8YgAAAdg"]
[Sun Mar 29 08:02:07.105961 2026] [proxy_fcgi:error] [pid 32255:tid 32297] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:07.293732 2026] [proxy_fcgi:error] [pid 32255:tid 32300] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:07.465018 2026] [proxy_fcgi:error] [pid 32255:tid 32305] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:07.642897 2026] [proxy_fcgi:error] [pid 32255:tid 32298] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:07.802175 2026] [proxy_fcgi:error] [pid 32255:tid 32307] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:07.961978 2026] [proxy_fcgi:error] [pid 32255:tid 32313] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.124486 2026] [proxy_fcgi:error] [pid 32255:tid 32315] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.286026 2026] [proxy_fcgi:error] [pid 32255:tid 32294] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.447939 2026] [proxy_fcgi:error] [pid 32255:tid 32303] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.608862 2026] [proxy_fcgi:error] [pid 32255:tid 32314] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.769575 2026] [proxy_fcgi:error] [pid 32255:tid 32292] [client 57.154.25.166:4407] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 08:02:08.926325 2026] [:error] [pid 32255:tid 32296] [client 57.154.25.166:4407] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "achsAGnfn-AtRoMbqux_fwAAAEU"]
[Sun Mar 29 08:02:09.464063 2026] [:error] [pid 23167:tid 23181] [client 57.154.25.166:54605] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "achsARIAHJCFaHff3_d8awAAAcs"]
[Sun Mar 29 08:02:10.023217 2026] [:error] [pid 23167:tid 23192] [client 57.154.25.166:45713] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "achsAhIAHJCFaHff3_d8cAAAAdY"]
[Sun Mar 29 08:02:10.456769 2026] [:error] [pid 23167:tid 23190] [client 57.154.25.166:47302] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "achsAhIAHJCFaHff3_d8cQAAAdQ"]
[Sun Mar 29 08:02:10.892594 2026] [:error] [pid 32255:tid 32309] [client 57.154.25.166:64351] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "achsAmnfn-AtRoMbqux_gAAAAFI"]
[Sun Mar 29 08:02:11.360131 2026] [:error] [pid 23167:tid 23170] [client 57.154.25.166:55143] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "achsAxIAHJCFaHff3_d8dQAAAcA"]
[Sun Mar 29 08:02:12.008165 2026] [:error] [pid 32257:tid 32341] [client 57.154.25.166:61015] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "achsBCE3TArOFrUtgWpbhQAAAJc"]
[Sun Mar 29 08:02:12.395803 2026] [:error] [pid 32255:tid 32299] [client 57.154.25.166:55144] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "achsBGnfn-AtRoMbqux_gwAAAEg"]
[Sun Mar 29 08:02:12.743750 2026] [:error] [pid 23284:tid 23288] [client 57.154.25.166:55122] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "achsBIzBujdPHsq7wyRqVQAAAoI"]
[Sun Mar 29 08:02:13.245929 2026] [:error] [pid 23284:tid 23301] [client 57.154.25.166:61009] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "achsBYzBujdPHsq7wyRqWAAAAo8"]
[Sun Mar 29 08:02:13.709686 2026] [:error] [pid 23168:tid 23220] [client 57.154.25.166:65383] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "achsBWP8p0yRL8ot_28KbQAAAhc"]
[Sun Mar 29 08:02:14.065437 2026] [:error] [pid 23284:tid 23297] [client 57.154.25.166:41903] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "achsBozBujdPHsq7wyRqWwAAAos"]
[Sun Mar 29 08:02:14.540692 2026] [:error] [pid 23250:tid 23259] [client 57.154.25.166:64356] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "achsBpxrpj-dQjy1cvpUxgAAAkc"]
[Sun Mar 29 08:02:14.904748 2026] [:error] [pid 23284:tid 23291] [client 57.154.25.166:61023] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "achsBozBujdPHsq7wyRqYgAAAoU"]
[Sun Mar 29 08:02:15.374364 2026] [:error] [pid 23250:tid 23261] [client 57.154.25.166:45729] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "achsB5xrpj-dQjy1cvpUxwAAAkk"]
[Sun Mar 29 08:02:15.720141 2026] [:error] [pid 23137:tid 23140] [client 57.154.25.166:64375] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "achsBxaWQa7LdZ_qGFaT8wAAAYE"]
[Sun Mar 29 08:02:16.080598 2026] [:error] [pid 23137:tid 23142] [client 57.154.25.166:48527] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "achsCBaWQa7LdZ_qGFaT9AAAAYM"]
[Sun Mar 29 08:02:16.509660 2026] [:error] [pid 23250:tid 23255] [client 57.154.25.166:45755] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "achsCJxrpj-dQjy1cvpUywAAAkM"]
[Sun Mar 29 08:02:16.828477 2026] [:error] [pid 23250:tid 23267] [client 57.154.25.166:4646] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "achsCJxrpj-dQjy1cvpUzQAAAk8"]
[Sun Mar 29 08:02:17.190412 2026] [:error] [pid 23284:tid 23310] [client 57.154.25.166:64346] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "achsCYzBujdPHsq7wyRqaAAAApg"]
[Sun Mar 29 08:02:17.558819 2026] [:error] [pid 32255:tid 32292] [client 57.154.25.166:53695] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "achsCWnfn-AtRoMbqux_iwAAAEE"]
[Sun Mar 29 08:02:17.922451 2026] [:error] [pid 32255:tid 32304] [client 57.154.25.166:53648] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "achsCWnfn-AtRoMbqux_jAAAAE0"]
[Sun Mar 29 08:02:18.337827 2026] [:error] [pid 32255:tid 32308] [client 57.154.25.166:49297] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "achsCmnfn-AtRoMbqux_jgAAAFE"]
[Sun Mar 29 08:02:18.705826 2026] [:error] [pid 23250:tid 23266] [client 57.154.25.166:4268] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "achsCpxrpj-dQjy1cvpU0QAAAk4"]
[Sun Mar 29 08:02:19.116911 2026] [:error] [pid 23250:tid 23271] [client 57.154.25.166:47237] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "achsC5xrpj-dQjy1cvpU0wAAAlM"]
[Sun Mar 29 08:02:19.491858 2026] [:error] [pid 23168:tid 23210] [client 57.154.25.166:47355] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "achsC2P8p0yRL8ot_28KbgAAAg0"]
[Sun Mar 29 08:02:19.890722 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:60994] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "achsC2nfn-AtRoMbqux_kgAAAFU"]
[Sun Mar 29 08:02:20.260437 2026] [:error] [pid 23284:tid 23294] [client 57.154.25.166:4628] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "achsDIzBujdPHsq7wyRqcAAAAog"]
[Sun Mar 29 08:02:20.741509 2026] [:error] [pid 23167:tid 23185] [client 57.154.25.166:48631] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "achsDBIAHJCFaHff3_d8fAAAAc8"]
[Sun Mar 29 08:02:21.186575 2026] [:error] [pid 23284:tid 23310] [client 57.154.25.166:55142] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "achsDYzBujdPHsq7wyRqdwAAApg"]
[Sun Mar 29 08:02:21.609553 2026] [:error] [pid 23284:tid 23292] [client 57.154.25.166:45699] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "achsDYzBujdPHsq7wyRqeQAAAoY"]
[Sun Mar 29 08:02:21.977961 2026] [:error] [pid 23168:tid 23211] [client 57.154.25.166:55119] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "achsDWP8p0yRL8ot_28KbwAAAg4"]
[Sun Mar 29 08:02:22.365146 2026] [:error] [pid 23284:tid 23302] [client 57.154.25.166:48571] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achsDozBujdPHsq7wyRqfgAAApA"]
[Sun Mar 29 08:02:22.746704 2026] [:error] [pid 23250:tid 23259] [client 57.154.25.166:45703] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achsDpxrpj-dQjy1cvpU2wAAAkc"]
[Sun Mar 29 08:02:23.144179 2026] [:error] [pid 32255:tid 32307] [client 57.154.25.166:47346] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achsD2nfn-AtRoMbqux_lQAAAFA"]
[Sun Mar 29 08:02:23.572274 2026] [:error] [pid 32255:tid 32313] [client 57.154.25.166:61044] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "achsD2nfn-AtRoMbqux_lgAAAFY"]
[Sun Mar 29 08:02:24.387053 2026] [:error] [pid 32255:tid 32300] [client 57.154.25.166:47316] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "achsEGnfn-AtRoMbqux_nwAAAEk"]
[Sun Mar 29 08:02:24.905699 2026] [:error] [pid 23167:tid 23193] [client 57.154.25.166:47271] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "achsEBIAHJCFaHff3_d8gQAAAdc"]
[Sun Mar 29 08:02:25.353980 2026] [:error] [pid 23167:tid 23171] [client 57.154.25.166:48518] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "achsERIAHJCFaHff3_d8hAAAAcE"]
[Sun Mar 29 08:02:25.750287 2026] [:error] [pid 32255:tid 32312] [client 57.154.25.166:55106] [client 57.154.25.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "achsEWnfn-AtRoMbqux_oAAAAFU"]
[Sun Mar 29 08:31:53.060786 2026] [:error] [pid 23284:tid 23294] [client 43.159.141.150:33252] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "achy-YzBujdPHsq7wyR0IwAAAog"]
[Sun Mar 29 11:05:03.188455 2026] [:error] [pid 23250:tid 23260] [client 122.54.198.52:52083] [client 122.54.198.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.54.198.52, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aciW35xrpj-dQjy1cvp8YgAAAkg"]
[Sun Mar 29 11:05:03.200460 2026] [proxy_fcgi:error] [pid 23250:tid 23260] [client 122.54.198.52:52083] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 14:48:14.479943 2026] [:error] [pid 32255:tid 32314] [client 43.157.179.227:50638] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acjLLmnfn-AtRoMbquwiEwAAAFc"]
[Sun Mar 29 15:54:44.855362 2026] [:error] [pid 32359:tid 32366] [client 43.157.22.57:57470] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acjaxAMb8G3UzfQP3WgIDwAAAMU"]
[Sun Mar 29 18:24:50.895016 2026] [:error] [pid 32255:tid 32299] [client 129.45.66.51:40702] [client 129.45.66.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.45.66.51, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acj98mnfn-AtRoMbquyatwAAAEg"]
[Sun Mar 29 18:24:50.908721 2026] [proxy_fcgi:error] [pid 32255:tid 32299] [client 129.45.66.51:40702] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 18:34:56.003270 2026] [proxy_fcgi:error] [pid 23250:tid 23266] [client 20.106.74.254:46047] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 18:34:56.319490 2026] [:error] [pid 23250:tid 23256] [client 20.106.74.254:46047] [client 20.106.74.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.106.74.254, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ackAUJxrpj-dQjy1cvrlzAAAAkQ"]
[Sun Mar 29 18:34:56.508092 2026] [proxy_fcgi:error] [pid 23250:tid 23254] [client 20.106.74.254:46047] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 18:34:57.587028 2026] [proxy_fcgi:error] [pid 23250:tid 23270] [client 20.106.74.254:46047] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 18:34:58.069982 2026] [proxy_fcgi:error] [pid 23250:tid 23257] [client 20.106.74.254:46047] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 18:34:58.243899 2026] [:error] [pid 23250:tid 23267] [client 20.106.74.254:46047] [client 20.106.74.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "ackAUpxrpj-dQjy1cvrl1gAAAk8"]
[Sun Mar 29 18:34:58.889411 2026] [:error] [pid 23167:tid 23185] [client 20.106.74.254:44046] [client 20.106.74.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "ackAUhIAHJCFaHff3_eT2gAAAc8"]
[Sun Mar 29 18:34:59.529954 2026] [:error] [pid 8818:tid 8836] [client 20.106.74.254:44032] [client 20.106.74.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "ackAUyCDvotZNSF0FBq6jwAAAU4"]
[Sun Mar 29 18:35:00.162059 2026] [:error] [pid 23250:tid 23272] [client 20.106.74.254:46007] [client 20.106.74.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "ackAVJxrpj-dQjy1cvrl1wAAAlQ"]
[Sun Mar 29 19:49:38.921053 2026] [:error] [pid 23137:tid 23141] [client 114.80.36.40:39988] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ackR0haWQa7LdZ_qGFbp5AAAAYI"]
[Sun Mar 29 21:07:12.373415 2026] [:error] [pid 8818:tid 8835] [client 180.153.236.54:3037] [client 180.153.236.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ackkACCDvotZNSF0FBrWCQAAAU0"], referer: http://switchcreative.net/
[Sun Mar 29 23:41:11.918058 2026] [proxy_fcgi:error] [pid 32257:tid 32319] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:12.232258 2026] [proxy_fcgi:error] [pid 32257:tid 32333] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:12.859031 2026] [proxy_fcgi:error] [pid 32257:tid 32331] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:13.171742 2026] [proxy_fcgi:error] [pid 32257:tid 32325] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:13.811956 2026] [proxy_fcgi:error] [pid 32257:tid 32333] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:14.125446 2026] [proxy_fcgi:error] [pid 32257:tid 32327] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:14.439088 2026] [proxy_fcgi:error] [pid 32257:tid 32338] [client 20.226.72.134:33293] AH01071: Got error 'Primary script unknown'
[Sun Mar 29 23:41:15.061598 2026] [:error] [pid 32257:tid 32335] [client 20.226.72.134:33293] [client 20.226.72.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "aclIGyE3TArOFrUtgWp0QAAAAJE"]
[Sun Mar 29 23:41:16.328639 2026] [:error] [pid 32255:tid 32301] [client 20.226.72.134:3766] [client 20.226.72.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "aclIHGnfn-AtRoMbquwgNAAAAEo"]
[Sun Mar 29 23:41:17.562862 2026] [:error] [pid 23167:tid 23192] [client 20.226.72.134:32948] [client 20.226.72.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "aclIHRIAHJCFaHff3_fcJAAAAdY"]
[Sun Mar 29 23:41:18.805448 2026] [:error] [pid 32257:tid 32325] [client 20.226.72.134:33343] [client 20.226.72.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "aclIHiE3TArOFrUtgWp0TgAAAIc"]
[Mon Mar 30 00:58:48.154756 2026] [:error] [pid 32255:tid 32303] [client 45.81.254.120:46122] [client 45.81.254.120] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=video/x-flv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aclaSGnfn-AtRoMbquxIUQAAAEw"]
[Mon Mar 30 01:29:34.850406 2026] [:error] [pid 23167:tid 23191] [client 93.158.213.26:43322] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aclhfhIAHJCFaHff3_f-9gAAAdU"]
[Mon Mar 30 01:29:36.865309 2026] [:error] [pid 32257:tid 32330] [client 93.158.213.26:45984] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aclhgCE3TArOFrUtgWrHsgAAAIw"]
[Mon Mar 30 01:29:38.837209 2026] [:error] [pid 23284:tid 23299] [client 93.158.213.26:45990] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aclhgozBujdPHsq7wyRCMwAAAo0"]
[Mon Mar 30 01:29:40.683801 2026] [:error] [pid 23284:tid 23301] [client 93.158.213.26:45994] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aclhhIzBujdPHsq7wyRCNQAAAo8"]
[Mon Mar 30 01:29:42.701061 2026] [:error] [pid 23284:tid 23293] [client 93.158.213.26:46010] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aclhhozBujdPHsq7wyRCQQAAAoc"]
[Mon Mar 30 01:29:45.017596 2026] [:error] [pid 32255:tid 32310] [client 93.158.213.26:47356] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aclhiWnfn-AtRoMbquxWVAAAAFM"]
[Mon Mar 30 01:29:47.137926 2026] [:error] [pid 23284:tid 23292] [client 93.158.213.26:47366] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aclhi4zBujdPHsq7wyRCVQAAAoY"]
[Mon Mar 30 01:29:49.116638 2026] [:error] [pid 32257:tid 32320] [client 93.158.213.26:47382] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aclhjSE3TArOFrUtgWrH5QAAAII"]
[Mon Mar 30 01:29:51.078777 2026] [:error] [pid 23137:tid 23141] [client 93.158.213.26:47390] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aclhjxaWQa7LdZ_qGFYiMAAAAYI"]
[Mon Mar 30 01:29:53.434069 2026] [:error] [pid 8818:tid 8832] [client 93.158.213.26:50258] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aclhkSCDvotZNSF0FBoUZAAAAUo"]
[Mon Mar 30 01:29:55.470949 2026] [:error] [pid 23284:tid 23303] [client 93.158.213.26:50268] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aclhk4zBujdPHsq7wyRCbgAAApE"]
[Mon Mar 30 01:29:57.419678 2026] [:error] [pid 32257:tid 32324] [client 93.158.213.26:50274] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aclhlSE3TArOFrUtgWrH8QAAAIY"]
[Mon Mar 30 01:29:59.519837 2026] [:error] [pid 32255:tid 32292] [client 93.158.213.26:50276] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aclhl2nfn-AtRoMbquxWbgAAAEE"]
[Mon Mar 30 01:30:01.597071 2026] [:error] [pid 32257:tid 32319] [client 93.158.213.26:50290] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aclhmSE3TArOFrUtgWrH_AAAAIE"]
[Mon Mar 30 01:30:03.691639 2026] [:error] [pid 32359:tid 32378] [client 93.158.213.26:57724] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aclhmwMb8G3UzfQP3WhOiQAAANE"]
[Mon Mar 30 01:30:05.773546 2026] [:error] [pid 32254:tid 32283] [client 93.158.213.26:57734] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aclhnaug2IHuyGgCTn91xgAAABM"]
[Mon Mar 30 01:30:07.852063 2026] [:error] [pid 23168:tid 23203] [client 93.158.213.26:57738] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aclhn2P8p0yRL8ot_2_tZQAAAgY"]
[Mon Mar 30 01:30:09.839833 2026] [:error] [pid 23167:tid 23183] [client 93.158.213.26:57754] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aclhoRIAHJCFaHff3_f_HwAAAc0"]
[Mon Mar 30 01:30:11.722652 2026] [:error] [pid 23250:tid 23252] [client 93.158.213.26:57764] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aclho5xrpj-dQjy1cvowiQAAAkA"]
[Mon Mar 30 01:30:13.896206 2026] [:error] [pid 23284:tid 23287] [client 93.158.213.26:48210] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aclhpYzBujdPHsq7wyRChwAAAoE"]
[Mon Mar 30 01:30:15.938196 2026] [:error] [pid 23168:tid 23202] [client 93.158.213.26:48222] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aclhp2P8p0yRL8ot_2_tbgAAAgU"]
[Mon Mar 30 01:30:17.904576 2026] [:error] [pid 32257:tid 32340] [client 93.158.213.26:48234] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aclhqSE3TArOFrUtgWrIGAAAAJY"]
[Mon Mar 30 01:30:20.045562 2026] [:error] [pid 23284:tid 23299] [client 93.158.213.26:48248] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aclhrIzBujdPHsq7wyRClQAAAo0"]
[Mon Mar 30 01:30:22.151135 2026] [:error] [pid 23284:tid 23302] [client 93.158.213.26:48258] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aclhrozBujdPHsq7wyRCoAAAApA"]
[Mon Mar 30 01:30:24.106863 2026] [:error] [pid 23284:tid 23306] [client 93.158.213.26:50994] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aclhsIzBujdPHsq7wyRCqgAAApQ"]
[Mon Mar 30 01:30:26.145932 2026] [:error] [pid 32257:tid 32340] [client 93.158.213.26:51002] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aclhsiE3TArOFrUtgWrILgAAAJY"]
[Mon Mar 30 01:30:28.173479 2026] [:error] [pid 32255:tid 32303] [client 93.158.213.26:51004] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aclhtGnfn-AtRoMbquxWkwAAAEw"]
[Mon Mar 30 01:30:30.093721 2026] [:error] [pid 23167:tid 23189] [client 93.158.213.26:51018] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aclhthIAHJCFaHff3_f_ZAAAAdM"]
[Mon Mar 30 01:30:32.184008 2026] [:error] [pid 32255:tid 32310] [client 93.158.213.26:36082] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aclhuGnfn-AtRoMbquxWpwAAAFM"]
[Mon Mar 30 01:30:58.519140 2026] [:error] [pid 8818:tid 8836] [client 93.158.213.26:52750] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aclh0iCDvotZNSF0FBoUjQAAAU4"]
[Mon Mar 30 01:31:00.335208 2026] [:error] [pid 23168:tid 23207] [client 93.158.213.26:34838] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aclh1GP8p0yRL8ot_2_tlwAAAgo"]
[Mon Mar 30 01:31:02.900525 2026] [:error] [pid 32255:tid 32302] [client 93.158.213.26:52760] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aclh1mnfn-AtRoMbquxW4gAAAEs"]
[Mon Mar 30 01:31:04.922984 2026] [:error] [pid 23250:tid 23267] [client 93.158.213.26:46794] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aclh2Jxrpj-dQjy1cvoxCgAAAk8"]
[Mon Mar 30 01:31:06.890784 2026] [:error] [pid 23167:tid 23194] [client 93.158.213.26:46800] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aclh2hIAHJCFaHff3_f_ewAAAdg"]
[Mon Mar 30 01:31:09.460289 2026] [:error] [pid 8818:tid 8845] [client 93.158.213.26:50184] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aclh3SCDvotZNSF0FBoUqgAAAVc"]
[Mon Mar 30 01:31:11.457749 2026] [:error] [pid 32359:tid 32383] [client 93.158.213.26:46806] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aclh3wMb8G3UzfQP3WhOwwAAANY"]
[Mon Mar 30 01:31:13.359550 2026] [:error] [pid 32359:tid 32378] [client 93.158.213.26:59462] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aclh4QMb8G3UzfQP3WhOxQAAANE"]
[Mon Mar 30 01:31:15.295538 2026] [:error] [pid 23167:tid 23184] [client 93.158.213.26:59468] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aclh4xIAHJCFaHff3_f_igAAAc4"]
[Mon Mar 30 01:31:17.782603 2026] [:error] [pid 32257:tid 32335] [client 93.158.213.26:60914] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aclh5SE3TArOFrUtgWrIkQAAAJE"]
[Mon Mar 30 01:31:19.903083 2026] [:error] [pid 23168:tid 23208] [client 93.158.213.26:59480] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aclh52P8p0yRL8ot_2_tpwAAAgs"]
[Mon Mar 30 01:31:22.520089 2026] [:error] [pid 8818:tid 8832] [client 93.158.213.26:60922] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aclh6iCDvotZNSF0FBoUwAAAAUo"]
[Mon Mar 30 01:31:24.554872 2026] [:error] [pid 23284:tid 23296] [client 93.158.213.26:38040] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aclh7IzBujdPHsq7wyRDKAAAAoo"]
[Mon Mar 30 01:31:26.581491 2026] [:error] [pid 32257:tid 32327] [client 93.158.213.26:38054] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aclh7iE3TArOFrUtgWrIlgAAAIk"]
[Mon Mar 30 01:31:28.871936 2026] [:error] [pid 32257:tid 32322] [client 93.158.213.26:38062] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aclh8CE3TArOFrUtgWrImgAAAIQ"]
[Mon Mar 30 01:31:30.790396 2026] [:error] [pid 23168:tid 23216] [client 93.158.213.26:38074] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aclh8mP8p0yRL8ot_2_twAAAAhM"]
[Mon Mar 30 01:31:32.855798 2026] [:error] [pid 23167:tid 23174] [client 93.158.213.26:38088] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aclh9BIAHJCFaHff3_f_pQAAAcQ"]
[Mon Mar 30 01:31:34.924448 2026] [:error] [pid 23168:tid 23205] [client 93.158.213.26:40302] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aclh9mP8p0yRL8ot_2_txAAAAgg"]
[Mon Mar 30 01:31:37.432517 2026] [:error] [pid 23168:tid 23211] [client 93.158.213.26:47930] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aclh-WP8p0yRL8ot_2_tzQAAAg4"]
[Mon Mar 30 01:31:39.562696 2026] [:error] [pid 23168:tid 23214] [client 93.158.213.26:40306] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aclh-2P8p0yRL8ot_2_t1gAAAhE"]
[Mon Mar 30 01:31:42.218047 2026] [:error] [pid 32257:tid 32319] [client 93.158.213.26:47944] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aclh_iE3TArOFrUtgWrIrgAAAIE"]
[Mon Mar 30 01:31:44.274288 2026] [:error] [pid 32257:tid 32318] [client 93.158.213.26:58820] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "acliACE3TArOFrUtgWrIuQAAAIA"]
[Mon Mar 30 01:31:46.371720 2026] [:error] [pid 32257:tid 32330] [client 93.158.213.26:58832] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "acliAiE3TArOFrUtgWrIwAAAAIw"]
[Mon Mar 30 01:31:48.829281 2026] [:error] [pid 32257:tid 32323] [client 93.158.213.26:56502] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "acliBCE3TArOFrUtgWrIzQAAAIU"]
[Mon Mar 30 01:31:51.046022 2026] [:error] [pid 32255:tid 32308] [client 93.158.213.26:58838] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "acliB2nfn-AtRoMbquxXJQAAAFE"]
[Mon Mar 30 01:31:53.277983 2026] [:error] [pid 32257:tid 32336] [client 93.158.213.26:39686] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "acliCSE3TArOFrUtgWrI4QAAAJI"]
[Mon Mar 30 01:31:55.414613 2026] [:error] [pid 32257:tid 32328] [client 93.158.213.26:39698] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "acliCyE3TArOFrUtgWrI6AAAAIo"]
[Mon Mar 30 01:32:19.613368 2026] [:error] [pid 32257:tid 32331] [client 93.158.213.26:39710] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "acliIyE3TArOFrUtgWrJewAAAI0"]
[Mon Mar 30 01:32:21.876415 2026] [:error] [pid 32254:tid 32267] [client 93.158.213.26:41666] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "acliJaug2IHuyGgCTn917wAAAAM"]
[Mon Mar 30 01:32:23.907939 2026] [:error] [pid 23167:tid 23186] [client 93.158.213.26:51836] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "acliJxIAHJCFaHff3_f_wQAAAdA"]
[Mon Mar 30 01:32:25.849893 2026] [:error] [pid 23137:tid 23147] [client 93.158.213.26:51844] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "acliKRaWQa7LdZ_qGFYifAAAAYg"]
[Mon Mar 30 01:32:27.802411 2026] [:error] [pid 32255:tid 32299] [client 93.158.213.26:51846] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "acliK2nfn-AtRoMbquxXZAAAAEg"]
[Mon Mar 30 01:32:29.817118 2026] [:error] [pid 23137:tid 23152] [client 93.158.213.26:51856] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "acliLRaWQa7LdZ_qGFYihAAAAY0"]
[Mon Mar 30 01:32:31.864057 2026] [:error] [pid 32255:tid 32302] [client 93.158.213.26:51870] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "acliL2nfn-AtRoMbquxXawAAAEs"]
[Mon Mar 30 01:32:34.008522 2026] [:error] [pid 32255:tid 32301] [client 93.158.213.26:58790] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "acliMmnfn-AtRoMbquxXcwAAAEo"]
[Mon Mar 30 01:32:35.985523 2026] [:error] [pid 23137:tid 23160] [client 93.158.213.26:58802] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "acliMxaWQa7LdZ_qGFYijAAAAZU"]
[Mon Mar 30 01:32:38.144996 2026] [:error] [pid 32254:tid 32266] [client 93.158.213.26:58816] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "acliNqug2IHuyGgCTn918wAAAAI"]
[Mon Mar 30 01:32:40.259480 2026] [:error] [pid 23284:tid 23294] [client 93.158.213.26:58818] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "acliOIzBujdPHsq7wyRDlwAAAog"]
[Mon Mar 30 01:32:42.345536 2026] [:error] [pid 23284:tid 23304] [client 93.158.213.26:58832] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "acliOozBujdPHsq7wyRDmwAAApI"]
[Mon Mar 30 01:32:44.393084 2026] [:error] [pid 23284:tid 23290] [client 93.158.213.26:53000] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "acliPIzBujdPHsq7wyRDowAAAoQ"]
[Mon Mar 30 01:32:46.310976 2026] [:error] [pid 23250:tid 23252] [client 93.158.213.26:53014] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "acliPpxrpj-dQjy1cvoxjwAAAkA"]
[Mon Mar 30 01:32:48.341371 2026] [:error] [pid 23250:tid 23276] [client 93.158.213.26:53022] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "acliQJxrpj-dQjy1cvoxkgAAAlg"]
[Mon Mar 30 01:32:50.402010 2026] [:error] [pid 32257:tid 32339] [client 93.158.213.26:53038] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "acliQiE3TArOFrUtgWrJ7QAAAJU"]
[Mon Mar 30 01:32:52.328250 2026] [:error] [pid 32255:tid 32302] [client 93.158.213.26:53046] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "acliRGnfn-AtRoMbquxXkwAAAEs"]
[Mon Mar 30 01:32:54.434634 2026] [:error] [pid 32257:tid 32329] [client 93.158.213.26:56358] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "acliRiE3TArOFrUtgWrKCwAAAIs"]
[Mon Mar 30 01:32:56.639123 2026] [:error] [pid 23168:tid 23211] [client 93.158.213.26:56374] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "acliSGP8p0yRL8ot_2_uTAAAAg4"]
[Mon Mar 30 01:32:58.687836 2026] [:error] [pid 32359:tid 32371] [client 93.158.213.26:56382] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "acliSgMb8G3UzfQP3WhPDwAAAMo"]
[Mon Mar 30 01:33:00.649298 2026] [:error] [pid 32255:tid 32298] [client 93.158.213.26:56384] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "acliTGnfn-AtRoMbquxXrgAAAEc"]
[Mon Mar 30 01:33:02.766152 2026] [:error] [pid 32255:tid 32310] [client 93.158.213.26:56388] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "acliTmnfn-AtRoMbquxXuwAAAFM"]
[Mon Mar 30 01:33:04.726917 2026] [:error] [pid 32257:tid 32339] [client 93.158.213.26:39866] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "acliUCE3TArOFrUtgWrKOAAAAJU"]
[Mon Mar 30 01:33:06.542336 2026] [:error] [pid 32257:tid 32322] [client 93.158.213.26:39868] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "acliUiE3TArOFrUtgWrKQgAAAIQ"]
[Mon Mar 30 01:33:08.614865 2026] [:error] [pid 8818:tid 8836] [client 93.158.213.26:39876] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "acliVCCDvotZNSF0FBoVGgAAAU4"]
[Mon Mar 30 01:33:10.797690 2026] [:error] [pid 32257:tid 32334] [client 93.158.213.26:39890] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "acliViE3TArOFrUtgWrKVwAAAJA"]
[Mon Mar 30 01:33:12.788964 2026] [:error] [pid 23284:tid 23310] [client 93.158.213.26:39898] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "acliWIzBujdPHsq7wyRDwgAAApg"]
[Mon Mar 30 01:33:14.889689 2026] [:error] [pid 23284:tid 23301] [client 93.158.213.26:41574] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "acliWozBujdPHsq7wyRDywAAAo8"]
[Mon Mar 30 01:33:16.912039 2026] [:error] [pid 23168:tid 23208] [client 93.158.213.26:41576] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "acliXGP8p0yRL8ot_2_udQAAAgs"]
[Mon Mar 30 01:33:38.435313 2026] [:error] [pid 32255:tid 32302] [client 93.158.213.26:41592] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aclicmnfn-AtRoMbquxYDgAAAEs"]
[Mon Mar 30 01:33:40.475497 2026] [:error] [pid 23168:tid 23205] [client 93.158.213.26:34862] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aclidGP8p0yRL8ot_2_utgAAAgg"]
[Mon Mar 30 01:33:42.411896 2026] [:error] [pid 23167:tid 23184] [client 93.158.213.26:34868] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aclidhIAHJCFaHff3_cAGwAAAc4"]
[Mon Mar 30 01:33:44.540979 2026] [:error] [pid 32359:tid 32382] [client 93.158.213.26:57884] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aclieAMb8G3UzfQP3WhPJgAAANU"]
[Mon Mar 30 01:33:46.469687 2026] [:error] [pid 23284:tid 23309] [client 93.158.213.26:57894] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aclieozBujdPHsq7wyREDgAAApc"]
[Mon Mar 30 01:33:48.468703 2026] [:error] [pid 32257:tid 32330] [client 93.158.213.26:57900] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aclifCE3TArOFrUtgWrKigAAAIw"]
[Mon Mar 30 01:33:50.482617 2026] [:error] [pid 32257:tid 32321] [client 93.158.213.26:57908] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aclifiE3TArOFrUtgWrKlwAAAIM"]
[Mon Mar 30 01:33:52.637490 2026] [:error] [pid 23168:tid 23200] [client 93.158.213.26:57910] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "acligGP8p0yRL8ot_2_uwQAAAgM"]
[Mon Mar 30 01:33:54.701483 2026] [:error] [pid 32254:tid 32284] [client 93.158.213.26:46122] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "acligqug2IHuyGgCTn92FgAAABQ"]
[Mon Mar 30 01:33:56.789369 2026] [:error] [pid 23167:tid 23179] [client 93.158.213.26:46136] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aclihBIAHJCFaHff3_cANgAAAck"]
[Mon Mar 30 01:33:58.860918 2026] [:error] [pid 23167:tid 23192] [client 93.158.213.26:46146] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aclihhIAHJCFaHff3_cARwAAAdY"]
[Mon Mar 30 01:34:00.804681 2026] [:error] [pid 32257:tid 32327] [client 93.158.213.26:46158] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "acliiCE3TArOFrUtgWrKoAAAAIk"]
[Mon Mar 30 01:34:02.826631 2026] [:error] [pid 32257:tid 32337] [client 93.158.213.26:46174] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "acliiiE3TArOFrUtgWrKqAAAAJM"]
[Mon Mar 30 01:34:04.862858 2026] [:error] [pid 23167:tid 23193] [client 93.158.213.26:60186] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aclijBIAHJCFaHff3_cAVgAAAdc"]
[Mon Mar 30 01:34:06.991580 2026] [:error] [pid 32257:tid 32340] [client 93.158.213.26:60194] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aclijiE3TArOFrUtgWrKuAAAAJY"]
[Mon Mar 30 01:34:09.055754 2026] [:error] [pid 23284:tid 23306] [client 93.158.213.26:60210] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aclikYzBujdPHsq7wyREJgAAApQ"]
[Mon Mar 30 01:34:11.052731 2026] [:error] [pid 23168:tid 23199] [client 93.158.213.26:60214] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aclik2P8p0yRL8ot_2_uxwAAAgI"]
[Mon Mar 30 01:34:13.079397 2026] [:error] [pid 8818:tid 8838] [client 93.158.213.26:44238] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aclilSCDvotZNSF0FBoVYgAAAVA"]
[Mon Mar 30 01:34:15.038364 2026] [:error] [pid 32359:tid 32366] [client 93.158.213.26:44250] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aclilwMb8G3UzfQP3WhPOQAAAMU"]
[Mon Mar 30 01:34:17.057691 2026] [:error] [pid 23284:tid 23302] [client 93.158.213.26:44260] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aclimYzBujdPHsq7wyRELAAAApA"]
[Mon Mar 30 01:34:19.062348 2026] [:error] [pid 23168:tid 23217] [client 93.158.213.26:44276] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aclim2P8p0yRL8ot_2_u1AAAAhQ"]
[Mon Mar 30 01:34:21.227772 2026] [:error] [pid 32255:tid 32291] [client 93.158.213.26:44286] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aclinWnfn-AtRoMbquxYhQAAAEA"]
[Mon Mar 30 01:34:23.239679 2026] [:error] [pid 23168:tid 23218] [client 93.158.213.26:38448] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aclin2P8p0yRL8ot_2_u4AAAAhU"]
[Mon Mar 30 01:34:25.041210 2026] [:error] [pid 23284:tid 23303] [client 93.158.213.26:38462] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aclioYzBujdPHsq7wyRENQAAApE"]
[Mon Mar 30 01:34:27.107570 2026] [:error] [pid 23168:tid 23209] [client 93.158.213.26:38472] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aclio2P8p0yRL8ot_2_u5wAAAgw"]
[Mon Mar 30 01:34:29.218770 2026] [:error] [pid 32254:tid 32266] [client 93.158.213.26:38476] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aclipaug2IHuyGgCTn92IgAAAAI"]
[Mon Mar 30 01:34:31.274972 2026] [:error] [pid 23168:tid 23214] [client 93.158.213.26:38478] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aclip2P8p0yRL8ot_2_u8QAAAhE"]
[Mon Mar 30 01:34:33.298646 2026] [:error] [pid 23168:tid 23197] [client 93.158.213.26:55496] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "acliqWP8p0yRL8ot_2_u8gAAAgA"]
[Mon Mar 30 01:34:35.414354 2026] [:error] [pid 32257:tid 32324] [client 93.158.213.26:55504] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "acliqyE3TArOFrUtgWrK-QAAAIY"]
[Mon Mar 30 03:19:57.078330 2026] [:error] [pid 689:tid 764] [client 60.188.57.0:50991] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acl7Xf4r3N5Aei23bYwVTwAAAIE"]
[Mon Mar 30 04:36:34.881309 2026] [:error] [pid 4033:tid 4071] [client 43.155.140.157:51676] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acmNUqnf-DXI9VblHi1EtwAAABI"]
[Mon Mar 30 08:11:46.336715 2026] [:error] [pid 35343:tid 35358] [client 159.146.43.197:15337] [client 159.146.43.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.146.43.197, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acm_wqP5HurqmbvwN-L1jAAAAA0"]
[Mon Mar 30 08:11:46.350771 2026] [proxy_fcgi:error] [pid 35343:tid 35358] [client 159.146.43.197:15337] AH01071: Got error 'Primary script unknown'
[Mon Mar 30 11:55:26.958466 2026] [:error] [pid 35250:tid 35334] [client 185.198.240.40:48553] [client 185.198.240.40] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "acn0LoaKM1MR6zcp2YOz7gAAANc"]
[Mon Mar 30 13:15:00.598179 2026] [:error] [pid 35343:tid 35349] [client 217.73.117.198:5781] [client 217.73.117.198] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=multipart/alternative"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acoG1KP5HurqmbvwN-KkpgAAAAQ"]
[Mon Mar 30 13:15:00.896343 2026] [:error] [pid 35343:tid 35366] [client 217.73.117.198:5781] [client 217.73.117.198] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=multipart/alternative"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acoG1KP5HurqmbvwN-KkqAAAABU"]
[Mon Mar 30 13:44:08.761593 2026] [:error] [pid 35250:tid 35325] [client 23.95.212.247:4532] [client 23.95.212.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "acoNqIaKM1MR6zcp2YPQjQAAAM4"]
[Mon Mar 30 13:49:51.547987 2026] [:error] [pid 35343:tid 35354] [client 223.88.199.150:20590] [client 223.88.199.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acoO_6P5HurqmbvwN-K9ZgAAAAk"], referer: http://www.switchcreative.net/
[Mon Mar 30 15:41:22.931639 2026] [:error] [pid 41941:tid 41952] [client 109.167.208.75:43770] [client 109.167.208.75] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acopIiB2g7BNCXGBOJMBpwAAAQk"]
[Mon Mar 30 17:10:59.622358 2026] [:error] [pid 41941:tid 41965] [client 180.110.203.108:50864] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aco-IyB2g7BNCXGBOJM3egAAARY"]
[Mon Mar 30 18:03:09.153244 2026] [:error] [pid 41941:tid 41967] [client 43.166.237.57:55906] [client 43.166.237.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acpKXSB2g7BNCXGBOJNZxQAAARg"]
[Mon Mar 30 20:33:06.268665 2026] [:error] [pid 50663:tid 50668] [client 193.23.211.203:59338] [client 193.23.211.203] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=image/svg+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acptgm28b9DKIAMEdfA9ugAAAYM"]
[Mon Mar 30 22:55:08.169390 2026] [:error] [pid 60747:tid 60808] [client 88.180.187.72:32955] [client 88.180.187.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.180.187.72, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "acqOzAU3IY-cCpy_-zE-IAAAAMU"]
[Mon Mar 30 22:55:08.180502 2026] [proxy_fcgi:error] [pid 60747:tid 60808] [client 88.180.187.72:32955] AH01071: Got error 'Primary script unknown'
[Mon Mar 30 23:47:02.433948 2026] [:error] [pid 63557:tid 63575] [client 180.110.203.108:54502] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acqa9q4QNVlzYgEvIjnUowAAARA"]
[Tue Mar 31 00:04:20.044932 2026] [:error] [pid 31577:tid 31597] [client 43.135.115.233:35300] [client 43.135.115.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acqfBHOcPMUnrUQjB4JSjwAAAZI"]
[Tue Mar 31 03:16:08.664018 2026] [proxy_fcgi:error] [pid 39123:tid 39134] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:08.900114 2026] [proxy_fcgi:error] [pid 39123:tid 39139] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:09.136658 2026] [proxy_fcgi:error] [pid 39123:tid 39140] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:09.374680 2026] [proxy_fcgi:error] [pid 39123:tid 39149] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:09.611592 2026] [proxy_fcgi:error] [pid 39123:tid 39125] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:09.849354 2026] [proxy_fcgi:error] [pid 39123:tid 39142] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:10.098092 2026] [proxy_fcgi:error] [pid 39123:tid 39132] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:10.336365 2026] [proxy_fcgi:error] [pid 39123:tid 39130] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:10.585511 2026] [proxy_fcgi:error] [pid 39123:tid 39134] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:10.828429 2026] [proxy_fcgi:error] [pid 39123:tid 39140] [client 20.19.191.237:63707] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 03:16:11.061295 2026] [:error] [pid 39123:tid 39149] [client 20.19.191.237:63707] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acrL-yobgVY20PMQKVvENAAAARg"]
[Tue Mar 31 03:16:11.664091 2026] [:error] [pid 39123:tid 39126] [client 20.19.191.237:63712] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrL-yobgVY20PMQKVvENgAAAQE"]
[Tue Mar 31 03:16:12.154366 2026] [:error] [pid 36706:tid 36880] [client 20.19.191.237:65006] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrL_La-eBLL1E34-UUr-wAAANI"]
[Tue Mar 31 03:16:12.718378 2026] [:error] [pid 36688:tid 36852] [client 20.19.191.237:65020] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrL_JIe8NBGKiiCIcI9ywAAAJE"]
[Tue Mar 31 03:16:13.463559 2026] [:error] [pid 36706:tid 36868] [client 20.19.191.237:64911] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "acrL_ba-eBLL1E34-UUr_gAAAMY"]
[Tue Mar 31 03:16:14.034935 2026] [:error] [pid 36706:tid 36867] [client 20.19.191.237:65002] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "acrL_ra-eBLL1E34-UUsAgAAAMU"]
[Tue Mar 31 03:16:14.515835 2026] [:error] [pid 36688:tid 36845] [client 20.19.191.237:64280] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "acrL_pIe8NBGKiiCIcI90gAAAIo"]
[Tue Mar 31 03:16:15.053258 2026] [:error] [pid 36706:tid 36862] [client 20.19.191.237:64932] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "acrL_7a-eBLL1E34-UUsBwAAAMA"]
[Tue Mar 31 03:16:15.571055 2026] [:error] [pid 36706:tid 36881] [client 20.19.191.237:63730] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acrL_7a-eBLL1E34-UUsCgAAANM"]
[Tue Mar 31 03:16:16.077149 2026] [:error] [pid 36939:tid 36956] [client 20.19.191.237:64996] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acrMAMRDKH225Jeq1jeNlgAAAA8"]
[Tue Mar 31 03:16:16.548186 2026] [:error] [pid 36672:tid 36812] [client 20.19.191.237:64961] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acrMALKHDzEfeL3XiLpqZwAAAEU"]
[Tue Mar 31 03:16:17.028141 2026] [:error] [pid 36672:tid 36811] [client 20.19.191.237:64315] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acrMAbKHDzEfeL3XiLpqaQAAAEQ"]
[Tue Mar 31 03:16:17.497714 2026] [:error] [pid 36939:tid 36962] [client 20.19.191.237:64963] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acrMAcRDKH225Jeq1jeNmQAAABU"]
[Tue Mar 31 03:16:18.234569 2026] [:error] [pid 36939:tid 36941] [client 20.19.191.237:64312] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acrMAsRDKH225Jeq1jeNmwAAAAA"]
[Tue Mar 31 03:16:18.721376 2026] [:error] [pid 36939:tid 36954] [client 20.19.191.237:65008] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acrMAsRDKH225Jeq1jeNngAAAA0"]
[Tue Mar 31 03:16:19.288700 2026] [:error] [pid 39123:tid 39131] [client 20.19.191.237:65015] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acrMAyobgVY20PMQKVvESwAAAQY"]
[Tue Mar 31 03:16:19.797486 2026] [:error] [pid 36672:tid 36829] [client 20.19.191.237:63691] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acrMA7KHDzEfeL3XiLpqbQAAAFY"]
[Tue Mar 31 03:16:20.336589 2026] [:error] [pid 36688:tid 36836] [client 20.19.191.237:65017] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acrMBJIe8NBGKiiCIcI93gAAAIE"]
[Tue Mar 31 03:16:20.864103 2026] [:error] [pid 39123:tid 39129] [client 20.19.191.237:64317] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acrMBCobgVY20PMQKVvEUAAAAQQ"]
[Tue Mar 31 03:16:21.381422 2026] [:error] [pid 39123:tid 39132] [client 20.19.191.237:64967] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acrMBSobgVY20PMQKVvEUQAAAQc"]
[Tue Mar 31 03:16:22.013012 2026] [:error] [pid 36939:tid 36942] [client 20.19.191.237:64958] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acrMBsRDKH225Jeq1jeNqgAAAAE"]
[Tue Mar 31 03:16:22.524345 2026] [:error] [pid 39123:tid 39130] [client 20.19.191.237:63675] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "acrMBiobgVY20PMQKVvEVQAAAQU"]
[Tue Mar 31 03:16:23.049479 2026] [:error] [pid 39123:tid 39145] [client 20.19.191.237:64975] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "acrMByobgVY20PMQKVvEWgAAARQ"]
[Tue Mar 31 03:16:23.649229 2026] [:error] [pid 36939:tid 36952] [client 20.19.191.237:64282] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "acrMB8RDKH225Jeq1jeNsgAAAAs"]
[Tue Mar 31 03:16:24.151536 2026] [:error] [pid 36939:tid 36957] [client 20.19.191.237:64955] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "acrMCMRDKH225Jeq1jeNuQAAABA"]
[Tue Mar 31 03:16:24.739508 2026] [:error] [pid 36706:tid 36879] [client 20.19.191.237:63739] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acrMCLa-eBLL1E34-UUsGwAAANE"]
[Tue Mar 31 03:16:25.223752 2026] [:error] [pid 36939:tid 36959] [client 20.19.191.237:63688] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acrMCcRDKH225Jeq1jeNvAAAABI"]
[Tue Mar 31 03:16:25.939786 2026] [:error] [pid 36672:tid 36809] [client 20.19.191.237:65004] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acrMCbKHDzEfeL3XiLpqdwAAAEI"]
[Tue Mar 31 03:16:26.431603 2026] [:error] [pid 36672:tid 36817] [client 20.19.191.237:64916] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acrMCrKHDzEfeL3XiLpqeQAAAEo"]
[Tue Mar 31 03:16:27.049565 2026] [:error] [pid 36939:tid 36941] [client 20.19.191.237:64375] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "acrMC8RDKH225Jeq1jeNwgAAAAA"]
[Tue Mar 31 03:16:27.603128 2026] [:error] [pid 36672:tid 36807] [client 20.19.191.237:63041] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "acrMC7KHDzEfeL3XiLpqfwAAAEA"]
[Tue Mar 31 03:16:28.079704 2026] [:error] [pid 39123:tid 39133] [client 20.19.191.237:64305] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "acrMDCobgVY20PMQKVvEaQAAAQg"]
[Tue Mar 31 03:16:28.656322 2026] [:error] [pid 36706:tid 36874] [client 20.19.191.237:64898] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "acrMDLa-eBLL1E34-UUsJAAAAMw"]
[Tue Mar 31 03:16:29.558744 2026] [:error] [pid 36672:tid 36829] [client 20.19.191.237:64945] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "acrMDbKHDzEfeL3XiLpqiAAAAFY"]
[Tue Mar 31 03:16:30.052349 2026] [:error] [pid 36939:tid 36946] [client 20.19.191.237:64360] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vvedr.php"] [unique_id "acrMDsRDKH225Jeq1jeNzAAAAAU"]
[Tue Mar 31 03:16:30.565895 2026] [:error] [pid 36688:tid 36856] [client 20.19.191.237:63692] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vvedr.php"] [unique_id "acrMDpIe8NBGKiiCIcI97gAAAJU"]
[Tue Mar 31 03:16:31.174069 2026] [:error] [pid 36939:tid 36962] [client 20.19.191.237:63699] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vvedr.php"] [unique_id "acrMD8RDKH225Jeq1jeN0gAAABU"]
[Tue Mar 31 03:16:31.739845 2026] [:error] [pid 36939:tid 36946] [client 20.19.191.237:64303] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vvedr.php"] [unique_id "acrMD8RDKH225Jeq1jeN2QAAAAU"]
[Tue Mar 31 03:16:32.468810 2026] [:error] [pid 36706:tid 36881] [client 20.19.191.237:64343] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "acrMELa-eBLL1E34-UUsKgAAANM"]
[Tue Mar 31 03:16:33.076653 2026] [:error] [pid 39123:tid 39135] [client 20.19.191.237:64279] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acrMESobgVY20PMQKVvEbwAAAQo"]
[Tue Mar 31 03:16:33.623136 2026] [:error] [pid 39123:tid 39149] [client 20.19.191.237:63075] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acrMESobgVY20PMQKVvEdwAAARg"]
[Tue Mar 31 03:16:34.098863 2026] [:error] [pid 39123:tid 39139] [client 20.19.191.237:64365] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acrMEiobgVY20PMQKVvEeQAAAQ4"]
[Tue Mar 31 03:16:34.595788 2026] [:error] [pid 39123:tid 39129] [client 20.19.191.237:64318] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acrMEiobgVY20PMQKVvEgAAAAQQ"]
[Tue Mar 31 03:16:35.113846 2026] [:error] [pid 39123:tid 39143] [client 20.19.191.237:63723] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acrMEyobgVY20PMQKVvEggAAARI"]
[Tue Mar 31 03:16:35.593775 2026] [:error] [pid 36939:tid 36951] [client 20.19.191.237:64929] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acrME8RDKH225Jeq1jeN5QAAAAo"]
[Tue Mar 31 03:16:36.155006 2026] [:error] [pid 36688:tid 36843] [client 20.19.191.237:63722] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acrMFJIe8NBGKiiCIcI9-AAAAIg"]
[Tue Mar 31 03:16:36.695030 2026] [:error] [pid 36672:tid 36829] [client 20.19.191.237:64328] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrMFLKHDzEfeL3XiLpqnAAAAFY"]
[Tue Mar 31 03:16:37.180037 2026] [:error] [pid 36939:tid 36949] [client 20.19.191.237:63681] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrMFcRDKH225Jeq1jeN6wAAAAg"]
[Tue Mar 31 03:16:37.654139 2026] [:error] [pid 36939:tid 36948] [client 20.19.191.237:64376] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrMFcRDKH225Jeq1jeN7wAAAAc"]
[Tue Mar 31 03:16:38.131595 2026] [:error] [pid 36688:tid 36854] [client 20.19.191.237:64259] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrMFpIe8NBGKiiCIcI9_gAAAJM"]
[Tue Mar 31 03:16:38.651908 2026] [:error] [pid 36706:tid 36875] [client 20.19.191.237:63618] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrMFra-eBLL1E34-UUsMQAAAM0"]
[Tue Mar 31 03:16:39.128878 2026] [:error] [pid 39123:tid 39133] [client 20.19.191.237:63703] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrMFyobgVY20PMQKVvEjgAAAQg"]
[Tue Mar 31 03:16:39.604421 2026] [:error] [pid 39123:tid 39147] [client 20.19.191.237:63641] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrMFyobgVY20PMQKVvEkQAAARY"]
[Tue Mar 31 03:16:40.102798 2026] [:error] [pid 39123:tid 39139] [client 20.19.191.237:63720] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrMGCobgVY20PMQKVvElAAAAQ4"]
[Tue Mar 31 03:16:40.731606 2026] [:error] [pid 36706:tid 36866] [client 20.19.191.237:64290] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrMGLa-eBLL1E34-UUsMwAAAMQ"]
[Tue Mar 31 03:16:41.249415 2026] [:error] [pid 39123:tid 39145] [client 20.19.191.237:64915] [client 20.19.191.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrMGSobgVY20PMQKVvEnAAAARQ"]
[Tue Mar 31 04:18:28.748145 2026] [proxy_fcgi:error] [pid 18332:tid 18356] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:28.984443 2026] [proxy_fcgi:error] [pid 18332:tid 18361] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:29.221685 2026] [proxy_fcgi:error] [pid 18332:tid 18366] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:29.462794 2026] [proxy_fcgi:error] [pid 18332:tid 18365] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:29.700287 2026] [proxy_fcgi:error] [pid 18332:tid 18362] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:29.936079 2026] [proxy_fcgi:error] [pid 18332:tid 18369] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:30.172883 2026] [proxy_fcgi:error] [pid 18332:tid 18364] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:30.409177 2026] [proxy_fcgi:error] [pid 18332:tid 18372] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:30.647449 2026] [proxy_fcgi:error] [pid 18332:tid 18353] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:30.884325 2026] [proxy_fcgi:error] [pid 18332:tid 18352] [client 72.146.12.161:14833] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:18:31.119316 2026] [:error] [pid 18332:tid 18350] [client 72.146.12.161:14833] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acral74KXr1F9raS5GSDdgAAAAI"]
[Tue Mar 31 04:18:31.589182 2026] [:error] [pid 18439:tid 18452] [client 72.146.12.161:14791] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acraly-R9nOaA8Xqs7iV4AAAAME"]
[Tue Mar 31 04:18:32.055588 2026] [:error] [pid 18439:tid 18473] [client 72.146.12.161:14786] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acramC-R9nOaA8Xqs7iV6AAAANY"]
[Tue Mar 31 04:18:32.527960 2026] [:error] [pid 18439:tid 18453] [client 72.146.12.161:14845] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acramC-R9nOaA8Xqs7iV7gAAAMI"]
[Tue Mar 31 04:18:32.993651 2026] [:error] [pid 18439:tid 18457] [client 72.146.12.161:14828] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acramC-R9nOaA8Xqs7iV8gAAAMY"]
[Tue Mar 31 04:18:33.459401 2026] [:error] [pid 18439:tid 18474] [client 72.146.12.161:14812] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acramS-R9nOaA8Xqs7iV9wAAANc"]
[Tue Mar 31 04:18:33.925155 2026] [:error] [pid 18334:tid 18409] [client 72.146.12.161:14720] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zlnckdxn.php"] [unique_id "acramXqQrXLbk1cg3mgcdAAAAIM"]
[Tue Mar 31 04:18:34.391287 2026] [:error] [pid 18333:tid 18386] [client 72.146.12.161:14739] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acramkSx2C5hLR0-8dLJvAAAAEc"]
[Tue Mar 31 04:18:34.856560 2026] [:error] [pid 18334:tid 18425] [client 72.146.12.161:14832] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acramnqQrXLbk1cg3mgcdgAAAJM"]
[Tue Mar 31 04:18:35.330085 2026] [:error] [pid 18332:tid 18356] [client 72.146.12.161:14803] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "acram74KXr1F9raS5GSDegAAAAg"]
[Tue Mar 31 04:18:35.799198 2026] [:error] [pid 18332:tid 18366] [client 72.146.12.161:14736] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "acram74KXr1F9raS5GSDfAAAABI"]
[Tue Mar 31 04:18:36.263982 2026] [:error] [pid 18439:tid 18461] [client 72.146.12.161:14725] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "acranC-R9nOaA8Xqs7iWEwAAAMo"]
[Tue Mar 31 04:18:36.729188 2026] [:error] [pid 18334:tid 18430] [client 72.146.12.161:14843] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "acranHqQrXLbk1cg3mgcfAAAAJg"]
[Tue Mar 31 04:18:37.195216 2026] [:error] [pid 18439:tid 18475] [client 72.146.12.161:14742] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "acranS-R9nOaA8Xqs7iWFwAAANg"]
[Tue Mar 31 04:18:37.665207 2026] [:error] [pid 18334:tid 18426] [client 72.146.12.161:14792] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acranXqQrXLbk1cg3mgcgAAAAJQ"]
[Tue Mar 31 04:18:38.129335 2026] [:error] [pid 18439:tid 18470] [client 72.146.12.161:14738] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acrani-R9nOaA8Xqs7iWHwAAANM"]
[Tue Mar 31 04:18:38.609596 2026] [:error] [pid 18332:tid 18358] [client 72.146.12.161:14785] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acranr4KXr1F9raS5GSDggAAAAo"]
[Tue Mar 31 04:18:39.077409 2026] [:error] [pid 18334:tid 18407] [client 72.146.12.161:14727] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acran3qQrXLbk1cg3mgciQAAAIE"]
[Tue Mar 31 04:18:39.542488 2026] [:error] [pid 18334:tid 18424] [client 72.146.12.161:14799] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acran3qQrXLbk1cg3mgcjgAAAJI"]
[Tue Mar 31 04:18:40.007980 2026] [:error] [pid 18334:tid 18409] [client 72.146.12.161:14835] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "acraoHqQrXLbk1cg3mgcmAAAAIM"]
[Tue Mar 31 04:18:40.485347 2026] [:error] [pid 18439:tid 18468] [client 72.146.12.161:14830] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acraoC-R9nOaA8Xqs7iWJAAAANE"]
[Tue Mar 31 04:18:40.951897 2026] [:error] [pid 18439:tid 18451] [client 72.146.12.161:14723] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acraoC-R9nOaA8Xqs7iWJgAAAMA"]
[Tue Mar 31 04:18:41.417576 2026] [:error] [pid 18332:tid 18363] [client 72.146.12.161:14764] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acraob4KXr1F9raS5GSDiAAAAA8"]
[Tue Mar 31 04:18:41.882183 2026] [:error] [pid 18333:tid 18398] [client 72.146.12.161:14797] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acraoUSx2C5hLR0-8dLJzQAAAFM"]
[Tue Mar 31 04:18:42.346126 2026] [:error] [pid 18334:tid 18408] [client 72.146.12.161:14811] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htto.php"] [unique_id "acraonqQrXLbk1cg3mgcpQAAAII"]
[Tue Mar 31 04:18:42.812029 2026] [:error] [pid 18439:tid 18467] [client 72.146.12.161:14818] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htto.php"] [unique_id "acraoi-R9nOaA8Xqs7iWKQAAANA"]
[Tue Mar 31 04:18:43.304417 2026] [:error] [pid 18439:tid 18454] [client 72.146.12.161:14733] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xhejulap.php"] [unique_id "acraoy-R9nOaA8Xqs7iWLwAAAMM"]
[Tue Mar 31 04:18:43.770681 2026] [:error] [pid 18439:tid 18471] [client 72.146.12.161:14776] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acraoy-R9nOaA8Xqs7iWNAAAANQ"]
[Tue Mar 31 04:18:44.247001 2026] [:error] [pid 18334:tid 18425] [client 72.146.12.161:14819] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrapHqQrXLbk1cg3mgcrwAAAJM"]
[Tue Mar 31 04:18:44.729909 2026] [:error] [pid 18334:tid 18417] [client 72.146.12.161:14800] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrapHqQrXLbk1cg3mgcsgAAAIs"]
[Tue Mar 31 04:18:45.194295 2026] [:error] [pid 18332:tid 18354] [client 72.146.12.161:14798] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrapb4KXr1F9raS5GSDjwAAAAY"]
[Tue Mar 31 04:18:45.661522 2026] [:error] [pid 18332:tid 18350] [client 72.146.12.161:14752] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8pewqMTX.php"] [unique_id "acrapb4KXr1F9raS5GSDkgAAAAI"]
[Tue Mar 31 04:18:46.126657 2026] [:error] [pid 18332:tid 18367] [client 72.146.12.161:14829] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8pewqMTX.php"] [unique_id "acrapr4KXr1F9raS5GSDlwAAABM"]
[Tue Mar 31 04:18:46.593738 2026] [:error] [pid 18333:tid 18395] [client 72.146.12.161:14788] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8pewqMTX.php"] [unique_id "acrapkSx2C5hLR0-8dLJ1QAAAFA"]
[Tue Mar 31 04:18:47.075543 2026] [:error] [pid 18334:tid 18430] [client 72.146.12.161:14774] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8pewqMTX.php"] [unique_id "acrap3qQrXLbk1cg3mgctQAAAJg"]
[Tue Mar 31 04:24:20.817828 2026] [proxy_fcgi:error] [pid 18332:tid 18364] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:21.069176 2026] [proxy_fcgi:error] [pid 18332:tid 18367] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:21.306263 2026] [proxy_fcgi:error] [pid 18332:tid 18373] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:21.542985 2026] [proxy_fcgi:error] [pid 18332:tid 18360] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:21.779724 2026] [proxy_fcgi:error] [pid 18332:tid 18356] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:22.016873 2026] [proxy_fcgi:error] [pid 18332:tid 18362] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:22.256299 2026] [proxy_fcgi:error] [pid 18332:tid 18349] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:22.494118 2026] [proxy_fcgi:error] [pid 18332:tid 18353] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:22.733170 2026] [proxy_fcgi:error] [pid 18332:tid 18350] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:22.970472 2026] [proxy_fcgi:error] [pid 18332:tid 18348] [client 72.146.12.161:54698] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 04:24:23.203103 2026] [:error] [pid 18332:tid 18355] [client 72.146.12.161:54698] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acrb974KXr1F9raS5GSFtQAAAAc"]
[Tue Mar 31 04:24:23.667573 2026] [:error] [pid 18439:tid 18464] [client 72.146.12.161:53424] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acrb9y-R9nOaA8Xqs7ibzAAAAM0"]
[Tue Mar 31 04:24:24.134205 2026] [:error] [pid 18333:tid 18396] [client 72.146.12.161:54684] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acrb-ESx2C5hLR0-8dLMUQAAAFE"]
[Tue Mar 31 04:24:24.604461 2026] [:error] [pid 18439:tid 18473] [client 72.146.12.161:49962] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "acrb-C-R9nOaA8Xqs7ibzgAAANY"]
[Tue Mar 31 04:24:25.070681 2026] [:error] [pid 18439:tid 18465] [client 72.146.12.161:46977] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "acrb-S-R9nOaA8Xqs7ibzwAAAM4"]
[Tue Mar 31 04:24:25.544891 2026] [:error] [pid 18439:tid 18463] [client 72.146.12.161:50704] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "acrb-S-R9nOaA8Xqs7ib1QAAAMw"]
[Tue Mar 31 04:24:26.010668 2026] [:error] [pid 18439:tid 18469] [client 72.146.12.161:51116] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "acrb-i-R9nOaA8Xqs7ib1wAAANI"]
[Tue Mar 31 04:24:26.476257 2026] [:error] [pid 18439:tid 18458] [client 72.146.12.161:49961] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "acrb-i-R9nOaA8Xqs7ib2wAAAMc"]
[Tue Mar 31 04:24:26.942521 2026] [:error] [pid 18439:tid 18471] [client 72.146.12.161:44997] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrb-i-R9nOaA8Xqs7ib3wAAANQ"]
[Tue Mar 31 04:24:27.416541 2026] [:error] [pid 18334:tid 18420] [client 72.146.12.161:51133] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrb-3qQrXLbk1cg3mgg2gAAAI4"]
[Tue Mar 31 04:24:27.883550 2026] [:error] [pid 18439:tid 18466] [client 72.146.12.161:50715] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrb-y-R9nOaA8Xqs7ib5wAAAM8"]
[Tue Mar 31 04:24:28.361448 2026] [:error] [pid 18333:tid 18389] [client 72.146.12.161:45029] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-moonka.php"] [unique_id "acrb_ESx2C5hLR0-8dLMVgAAAEo"]
[Tue Mar 31 04:24:28.832556 2026] [:error] [pid 18332:tid 18360] [client 72.146.12.161:53412] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "acrb_L4KXr1F9raS5GSFugAAAAw"]
[Tue Mar 31 04:24:29.307421 2026] [:error] [pid 18439:tid 18474] [client 72.146.12.161:51082] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "acrb_S-R9nOaA8Xqs7ib7gAAANc"]
[Tue Mar 31 04:24:29.780867 2026] [:error] [pid 18439:tid 18466] [client 72.146.12.161:50749] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "acrb_S-R9nOaA8Xqs7ib8gAAAM8"]
[Tue Mar 31 04:24:30.245946 2026] [:error] [pid 18439:tid 18453] [client 72.146.12.161:49928] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "acrb_i-R9nOaA8Xqs7ib9gAAAMI"]
[Tue Mar 31 04:24:30.711547 2026] [:error] [pid 18439:tid 18469] [client 72.146.12.161:50711] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "acrb_i-R9nOaA8Xqs7ib-wAAANI"]
[Tue Mar 31 04:24:31.177828 2026] [:error] [pid 18334:tid 18406] [client 72.146.12.161:50742] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "acrb_3qQrXLbk1cg3mgg4QAAAIA"]
[Tue Mar 31 04:24:31.644821 2026] [:error] [pid 18334:tid 18426] [client 72.146.12.161:45037] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "acrb_3qQrXLbk1cg3mgg4wAAAJQ"]
[Tue Mar 31 04:24:32.124495 2026] [:error] [pid 18333:tid 18393] [client 72.146.12.161:51101] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xhejulap.php"] [unique_id "acrcAESx2C5hLR0-8dLMVwAAAE4"]
[Tue Mar 31 04:24:32.589924 2026] [:error] [pid 18334:tid 18411] [client 72.146.12.161:54656] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xhejulap.php"] [unique_id "acrcAHqQrXLbk1cg3mgg6gAAAIU"]
[Tue Mar 31 04:24:33.056818 2026] [:error] [pid 18333:tid 18394] [client 72.146.12.161:45021] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xhejulap.php"] [unique_id "acrcAUSx2C5hLR0-8dLMWQAAAE8"]
[Tue Mar 31 04:24:33.527261 2026] [:error] [pid 18334:tid 18409] [client 72.146.12.161:53407] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrcAXqQrXLbk1cg3mgg7wAAAIM"]
[Tue Mar 31 04:24:34.023404 2026] [:error] [pid 18334:tid 18417] [client 72.146.12.161:62602] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrcAnqQrXLbk1cg3mgg9AAAAIs"]
[Tue Mar 31 04:24:34.490288 2026] [:error] [pid 18334:tid 18429] [client 72.146.12.161:49920] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrcAnqQrXLbk1cg3mgg9wAAAJc"]
[Tue Mar 31 04:24:34.991677 2026] [:error] [pid 18333:tid 18399] [client 72.146.12.161:49956] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acrcAkSx2C5hLR0-8dLMWgAAAFQ"]
[Tue Mar 31 04:24:35.457707 2026] [:error] [pid 18439:tid 18462] [client 72.146.12.161:50746] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8pewqMTX.php"] [unique_id "acrcAy-R9nOaA8Xqs7icCQAAAMs"]
[Tue Mar 31 04:24:35.928972 2026] [:error] [pid 18334:tid 18420] [client 72.146.12.161:54038] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrcA3qQrXLbk1cg3mgg_QAAAI4"]
[Tue Mar 31 04:24:36.395284 2026] [:error] [pid 18333:tid 18390] [client 72.146.12.161:54041] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ddpxi.php"] [unique_id "acrcBESx2C5hLR0-8dLMXwAAAEs"]
[Tue Mar 31 04:24:36.862422 2026] [:error] [pid 18334:tid 18413] [client 72.146.12.161:45010] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrcBHqQrXLbk1cg3mgg_wAAAIc"]
[Tue Mar 31 04:24:37.328208 2026] [:error] [pid 18332:tid 18358] [client 72.146.12.161:50712] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrcBb4KXr1F9raS5GSFvwAAAAo"]
[Tue Mar 31 04:24:37.792406 2026] [:error] [pid 18334:tid 18410] [client 72.146.12.161:54029] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrcBXqQrXLbk1cg3mghCAAAAIQ"]
[Tue Mar 31 04:24:38.256972 2026] [:error] [pid 18333:tid 18388] [client 72.146.12.161:50689] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdkfu.php"] [unique_id "acrcBkSx2C5hLR0-8dLMYwAAAEk"]
[Tue Mar 31 04:24:38.722780 2026] [:error] [pid 18332:tid 18369] [client 72.146.12.161:47038] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrcBr4KXr1F9raS5GSFwQAAABU"]
[Tue Mar 31 04:24:39.188962 2026] [:error] [pid 18334:tid 18427] [client 72.146.12.161:51121] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrcB3qQrXLbk1cg3mghDgAAAJU"]
[Tue Mar 31 04:24:39.655002 2026] [:error] [pid 18333:tid 18398] [client 72.146.12.161:50744] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrcB0Sx2C5hLR0-8dLMaQAAAFM"]
[Tue Mar 31 04:24:40.119780 2026] [:error] [pid 18333:tid 18381] [client 72.146.12.161:54657] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/IcC7p.php"] [unique_id "acrcCESx2C5hLR0-8dLMbQAAAEI"]
[Tue Mar 31 04:24:40.594028 2026] [:error] [pid 18334:tid 18422] [client 72.146.12.161:49946] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "acrcCHqQrXLbk1cg3mghEgAAAJA"]
[Tue Mar 31 04:24:41.058372 2026] [:error] [pid 18333:tid 18384] [client 72.146.12.161:54061] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "acrcCUSx2C5hLR0-8dLMdAAAAEU"]
[Tue Mar 31 04:24:41.524576 2026] [:error] [pid 18333:tid 18387] [client 72.146.12.161:54074] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "acrcCUSx2C5hLR0-8dLMdgAAAEg"]
[Tue Mar 31 04:24:41.989952 2026] [:error] [pid 18333:tid 18399] [client 72.146.12.161:53425] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "acrcCUSx2C5hLR0-8dLMdwAAAFQ"]
[Tue Mar 31 04:24:42.455248 2026] [:error] [pid 18334:tid 18414] [client 72.146.12.161:54699] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "acrcCnqQrXLbk1cg3mghGgAAAIg"]
[Tue Mar 31 04:24:42.921414 2026] [:error] [pid 18334:tid 18423] [client 72.146.12.161:50698] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "acrcCnqQrXLbk1cg3mghHwAAAJE"]
[Tue Mar 31 04:24:43.387337 2026] [:error] [pid 18332:tid 18348] [client 72.146.12.161:54076] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "acrcC74KXr1F9raS5GSFywAAAAA"]
[Tue Mar 31 05:32:55.968714 2026] [:error] [pid 18332:tid 18362] [client 43.167.232.38:46080] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acrsB74KXr1F9raS5GSeNwAAAA4"]
[Tue Mar 31 06:03:33.851735 2026] [:error] [pid 11869:tid 11887] [client 125.75.66.97:49802] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acrzNRvAVplg9I6KoIIj9wAAAc8"]
[Tue Mar 31 06:35:15.443323 2026] [:error] [pid 18439:tid 18462] [client 43.152.72.247:52262] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acr6oy-R9nOaA8Xqs7jxUgAAAMs"]
[Tue Mar 31 07:18:26.719163 2026] [:error] [pid 36890:tid 36900] [client 180.153.236.180:25355] [client 180.153.236.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acsEwp8FASPd_uH8z7cYCQAAAAU"], referer: http://www.switchcreative.net/
[Tue Mar 31 09:45:35.188992 2026] [:error] [pid 6548:tid 6572] [client 95.91.110.210:32314] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "acsnP7gIz9HgMl9YwE6oHAAAAVY"]
[Tue Mar 31 09:45:37.340535 2026] [:error] [pid 41421:tid 41447] [client 95.91.110.210:7838] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "acsnQRSaDjY9kKFtUQCJkwAAARc"]
[Tue Mar 31 09:45:39.464075 2026] [:error] [pid 36982:tid 37006] [client 95.91.110.210:7840] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "acsnQ_lMmeoQKN0r_GOofwAAANU"]
[Tue Mar 31 09:45:42.547869 2026] [:error] [pid 36890:tid 36904] [client 95.91.110.210:37696] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "acsnRp8FASPd_uH8z7dhWgAAAAk"]
[Tue Mar 31 09:45:44.541982 2026] [:error] [pid 6548:tid 6561] [client 95.91.110.210:37698] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "acsnSLgIz9HgMl9YwE6oXwAAAUs"]
[Tue Mar 31 09:45:46.609288 2026] [:error] [pid 6548:tid 6570] [client 95.91.110.210:37708] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "acsnSrgIz9HgMl9YwE6ogAAAAVQ"]
[Tue Mar 31 09:45:48.743261 2026] [:error] [pid 6548:tid 6566] [client 95.91.110.210:37724] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "acsnTLgIz9HgMl9YwE6ojgAAAVA"]
[Tue Mar 31 09:45:50.898990 2026] [:error] [pid 6548:tid 6553] [client 95.91.110.210:9944] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "acsnTrgIz9HgMl9YwE6olgAAAUM"]
[Tue Mar 31 09:45:53.014383 2026] [:error] [pid 36892:tid 36964] [client 95.91.110.210:9958] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "acsnUUyj9S4G0ek3O4LhpQAAAI0"]
[Tue Mar 31 09:45:56.175881 2026] [:error] [pid 36982:tid 36999] [client 95.91.110.210:9972] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "acsnVPlMmeoQKN0r_GOo_gAAAM4"]
[Tue Mar 31 09:45:58.299060 2026] [:error] [pid 36982:tid 37005] [client 95.91.110.210:9974] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "acsnVvlMmeoQKN0r_GOpEQAAANQ"]
[Tue Mar 31 09:46:00.455939 2026] [:error] [pid 36982:tid 37002] [client 95.91.110.210:9988] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "acsnWPlMmeoQKN0r_GOpHQAAANE"]
[Tue Mar 31 09:46:03.622327 2026] [:error] [pid 36892:tid 36954] [client 95.91.110.210:43050] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "acsnW0yj9S4G0ek3O4LhtgAAAIM"]
[Tue Mar 31 09:46:05.697328 2026] [:error] [pid 36982:tid 36999] [client 95.91.110.210:43062] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "acsnXflMmeoQKN0r_GOpLgAAAM4"]
[Tue Mar 31 09:46:07.895582 2026] [:error] [pid 6548:tid 6568] [client 95.91.110.210:43076] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "acsnX7gIz9HgMl9YwE6orAAAAVI"]
[Tue Mar 31 09:46:09.928440 2026] [:error] [pid 36982:tid 36996] [client 95.91.110.210:43084] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "acsnYflMmeoQKN0r_GOpOQAAAMs"]
[Tue Mar 31 09:46:12.253072 2026] [:error] [pid 6548:tid 6561] [client 95.91.110.210:26832] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "acsnZLgIz9HgMl9YwE6ougAAAUs"]
[Tue Mar 31 09:46:14.377520 2026] [:error] [pid 36982:tid 37009] [client 95.91.110.210:26846] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "acsnZvlMmeoQKN0r_GOpUwAAANg"]
[Tue Mar 31 09:46:16.443780 2026] [:error] [pid 36982:tid 37000] [client 95.91.110.210:26856] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "acsnaPlMmeoQKN0r_GOpXQAAAM8"]
[Tue Mar 31 09:46:18.450289 2026] [:error] [pid 36982:tid 36996] [client 95.91.110.210:26872] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "acsnavlMmeoQKN0r_GOpZgAAAMs"]
[Tue Mar 31 09:46:20.576360 2026] [:error] [pid 6548:tid 6573] [client 95.91.110.210:26878] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "acsnbLgIz9HgMl9YwE6oxAAAAVc"]
[Tue Mar 31 09:46:22.752348 2026] [:error] [pid 36891:tid 36931] [client 95.91.110.210:51164] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "acsnbpJhiMaJUqoqfl5DhgAAAEc"]
[Tue Mar 31 09:46:24.885283 2026] [:error] [pid 36890:tid 36914] [client 95.91.110.210:51174] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "acsncJ8FASPd_uH8z7dhoAAAABM"]
[Tue Mar 31 09:46:26.952727 2026] [:error] [pid 36890:tid 36909] [client 95.91.110.210:51180] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "acsncp8FASPd_uH8z7dhpgAAAA4"]
[Tue Mar 31 09:46:28.809733 2026] [:error] [pid 36982:tid 36998] [client 95.91.110.210:51186] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "acsndPlMmeoQKN0r_GOpiQAAAM0"]
[Tue Mar 31 09:46:31.388772 2026] [:error] [pid 6548:tid 6552] [client 95.91.110.210:18672] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "acsnd7gIz9HgMl9YwE6o4wAAAUI"]
[Tue Mar 31 09:47:02.005369 2026] [:error] [pid 36891:tid 36931] [client 95.91.110.210:60278] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "acsnlpJhiMaJUqoqfl5DwQAAAEc"]
[Tue Mar 31 09:47:11.713585 2026] [:error] [pid 36982:tid 37001] [client 95.91.110.210:54034] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "acsnn_lMmeoQKN0r_GOqhAAAANA"]
[Tue Mar 31 09:47:17.352901 2026] [:error] [pid 36892:tid 36969] [client 95.91.110.210:51786] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "acsnpUyj9S4G0ek3O4LiAwAAAJI"]
[Tue Mar 31 09:47:26.553842 2026] [:error] [pid 6548:tid 6565] [client 95.91.110.210:51800] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "acsnrrgIz9HgMl9YwE6pgQAAAU8"]
[Tue Mar 31 09:47:30.484339 2026] [:error] [pid 36890:tid 36910] [client 95.91.110.210:58116] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "acsnsp8FASPd_uH8z7dh9QAAAA8"]
[Tue Mar 31 09:47:32.726571 2026] [:error] [pid 36891:tid 36939] [client 95.91.110.210:14078] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "acsntJJhiMaJUqoqfl5DzQAAAE8"]
[Tue Mar 31 09:47:36.221300 2026] [:error] [pid 36890:tid 36912] [client 95.91.110.210:14086] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "acsnuJ8FASPd_uH8z7dh-gAAABE"]
[Tue Mar 31 09:47:44.031373 2026] [:error] [pid 36891:tid 36941] [client 95.91.110.210:14092] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "acsnwJJhiMaJUqoqfl5D1QAAAFE"]
[Tue Mar 31 09:47:47.029579 2026] [:error] [pid 36982:tid 37009] [client 95.91.110.210:47248] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "acsnw_lMmeoQKN0r_GOq9gAAANg"]
[Tue Mar 31 09:47:51.984270 2026] [:error] [pid 6548:tid 6567] [client 95.91.110.210:38702] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "acsnx7gIz9HgMl9YwE6psgAAAVE"]
[Tue Mar 31 09:48:49.059882 2026] [:error] [pid 36982:tid 36994] [client 95.91.110.210:4610] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "acsoAflMmeoQKN0r_GOr5wAAAMk"]
[Tue Mar 31 09:48:53.466591 2026] [:error] [pid 36891:tid 36946] [client 95.91.110.210:9118] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "acsoBZJhiMaJUqoqfl5EIAAAAFY"]
[Tue Mar 31 09:48:55.712737 2026] [:error] [pid 36892:tid 36966] [client 95.91.110.210:9122] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "acsoB0yj9S4G0ek3O4LilgAAAI8"]
[Tue Mar 31 09:49:01.893405 2026] [:error] [pid 36890:tid 36909] [client 95.91.110.210:51844] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "acsoDZ8FASPd_uH8z7di1gAAAA4"]
[Tue Mar 31 09:49:06.735803 2026] [:error] [pid 6548:tid 6567] [client 95.91.110.210:51854] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "acsoErgIz9HgMl9YwE6qbQAAAVE"]
[Tue Mar 31 11:44:31.535142 2026] [:error] [pid 36982:tid 36989] [client 51.75.129.164:37872] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "actDH_lMmeoQKN0r_GMZcAAAAMQ"]
[Tue Mar 31 11:44:33.322295 2026] [:error] [pid 36982:tid 37001] [client 51.75.129.164:53956] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "actDIflMmeoQKN0r_GMZfgAAANA"]
[Tue Mar 31 11:44:36.053841 2026] [:error] [pid 36892:tid 36975] [client 51.75.129.164:47982] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "actDJEyj9S4G0ek3O4IB7AAAAJg"]
[Tue Mar 31 11:44:38.049843 2026] [:error] [pid 36890:tid 36913] [client 51.75.129.164:60752] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "actDJp8FASPd_uH8z7eLkAAAABI"]
[Tue Mar 31 11:44:40.060680 2026] [:error] [pid 36890:tid 36915] [client 51.75.129.164:60828] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "actDKJ8FASPd_uH8z7eLmQAAABQ"]
[Tue Mar 31 11:44:42.575812 2026] [:error] [pid 41421:tid 41424] [client 51.75.129.164:48548] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "actDKhSaDjY9kKFtUQDCjwAAAQA"]
[Tue Mar 31 11:44:44.535655 2026] [:error] [pid 36891:tid 36936] [client 51.75.129.164:60834] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "actDLJJhiMaJUqoqfl5dkQAAAEw"]
[Tue Mar 31 11:44:46.552944 2026] [:error] [pid 36982:tid 36991] [client 51.75.129.164:60848] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "actDLvlMmeoQKN0r_GMZpAAAAMY"]
[Tue Mar 31 11:44:49.097304 2026] [:error] [pid 41421:tid 41440] [client 51.75.129.164:41432] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "actDMRSaDjY9kKFtUQDClwAAARA"]
[Tue Mar 31 11:44:50.995443 2026] [:error] [pid 36982:tid 37000] [client 51.75.129.164:35930] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "actDMvlMmeoQKN0r_GMZuAAAAM8"]
[Tue Mar 31 11:44:52.956515 2026] [:error] [pid 41421:tid 41436] [client 51.75.129.164:35946] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "actDNBSaDjY9kKFtUQDCnwAAAQw"]
[Tue Mar 31 11:44:55.044327 2026] [:error] [pid 36982:tid 36986] [client 51.75.129.164:35948] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "actDN_lMmeoQKN0r_GMZ0QAAAME"]
[Tue Mar 31 11:44:57.023115 2026] [:error] [pid 41421:tid 41436] [client 51.75.129.164:35954] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "actDORSaDjY9kKFtUQDCqwAAAQw"]
[Tue Mar 31 11:44:59.137585 2026] [:error] [pid 36891:tid 36934] [client 51.75.129.164:42552] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "actDO5JhiMaJUqoqfl5dlgAAAEo"]
[Tue Mar 31 11:45:00.960610 2026] [:error] [pid 36982:tid 37006] [client 51.75.129.164:42564] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "actDPPlMmeoQKN0r_GMZ7wAAANU"]
[Tue Mar 31 11:45:03.324818 2026] [:error] [pid 36982:tid 36996] [client 51.75.129.164:44032] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "actDP_lMmeoQKN0r_GMZ_QAAAMs"]
[Tue Mar 31 11:45:05.930364 2026] [:error] [pid 36982:tid 36997] [client 51.75.129.164:44046] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "actDQflMmeoQKN0r_GMaDQAAAMw"]
[Tue Mar 31 11:45:08.411755 2026] [:error] [pid 36890:tid 36910] [client 51.75.129.164:44050] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "actDRJ8FASPd_uH8z7eLrQAAAA8"]
[Tue Mar 31 11:45:10.381307 2026] [:error] [pid 36982:tid 37004] [client 51.75.129.164:55020] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "actDRvlMmeoQKN0r_GMaLAAAANM"]
[Tue Mar 31 11:45:12.840248 2026] [:error] [pid 36982:tid 37001] [client 51.75.129.164:33272] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "actDSPlMmeoQKN0r_GMaQAAAANA"]
[Tue Mar 31 11:45:15.245759 2026] [:error] [pid 36982:tid 36991] [client 51.75.129.164:33280] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "actDS_lMmeoQKN0r_GMaUwAAAMY"]
[Tue Mar 31 11:45:17.038575 2026] [:error] [pid 41421:tid 41424] [client 51.75.129.164:55036] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "actDTRSaDjY9kKFtUQDCwwAAAQA"]
[Tue Mar 31 11:45:19.347134 2026] [:error] [pid 6548:tid 6567] [client 51.75.129.164:44630] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "actDT7gIz9HgMl9YwE73HAAAAVE"]
[Tue Mar 31 11:45:21.933910 2026] [:error] [pid 6548:tid 6569] [client 51.75.129.164:44636] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "actDUbgIz9HgMl9YwE73IgAAAVM"]
[Tue Mar 31 11:45:24.031838 2026] [:error] [pid 36890:tid 36907] [client 51.75.129.164:37642] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "actDVJ8FASPd_uH8z7eLvQAAAAw"]
[Tue Mar 31 11:45:26.617746 2026] [:error] [pid 36982:tid 37008] [client 51.75.129.164:44652] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "actDVvlMmeoQKN0r_GMahgAAANc"]
[Tue Mar 31 11:45:28.428597 2026] [:error] [pid 36982:tid 37007] [client 51.75.129.164:47856] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "actDWPlMmeoQKN0r_GMalQAAANY"]
[Tue Mar 31 11:45:49.631027 2026] [:error] [pid 36982:tid 36993] [client 51.75.129.164:56586] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "actDbflMmeoQKN0r_GMbHAAAAMg"]
[Tue Mar 31 11:45:51.991189 2026] [:error] [pid 6548:tid 6557] [client 51.75.129.164:48302] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "actDb7gIz9HgMl9YwE73hgAAAUc"]
[Tue Mar 31 11:45:54.511380 2026] [:error] [pid 36891:tid 36930] [client 51.75.129.164:48312] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "actDcpJhiMaJUqoqfl5dtwAAAEY"]
[Tue Mar 31 11:45:57.035783 2026] [:error] [pid 36982:tid 36989] [client 51.75.129.164:48326] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "actDdflMmeoQKN0r_GMbUAAAAMQ"]
[Tue Mar 31 11:45:59.051600 2026] [:error] [pid 36982:tid 36999] [client 51.75.129.164:49330] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "actDd_lMmeoQKN0r_GMbXwAAAM4"]
[Tue Mar 31 11:46:01.572468 2026] [:error] [pid 36982:tid 37008] [client 51.75.129.164:58542] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "actDeflMmeoQKN0r_GMbcQAAANc"]
[Tue Mar 31 11:46:03.584621 2026] [:error] [pid 36982:tid 36988] [client 51.75.129.164:49332] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "actDe_lMmeoQKN0r_GMbdgAAAMM"]
[Tue Mar 31 11:46:06.124289 2026] [:error] [pid 41421:tid 41429] [client 51.75.129.164:58554] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "actDfhSaDjY9kKFtUQDDHwAAAQU"]
[Tue Mar 31 11:46:08.631346 2026] [:error] [pid 6548:tid 6551] [client 51.75.129.164:58558] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "actDgLgIz9HgMl9YwE73vgAAAUE"]
[Tue Mar 31 11:46:11.127841 2026] [:error] [pid 36892:tid 36960] [client 51.75.129.164:34166] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "actDg0yj9S4G0ek3O4ICSwAAAIk"]
[Tue Mar 31 11:46:13.144404 2026] [:error] [pid 36982:tid 36990] [client 51.75.129.164:34046] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "actDhflMmeoQKN0r_GMbpAAAAMU"]
[Tue Mar 31 11:46:15.014730 2026] [:error] [pid 41421:tid 41437] [client 51.75.129.164:34048] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "actDhxSaDjY9kKFtUQDDLAAAAQ0"]
[Tue Mar 31 11:46:17.053574 2026] [:error] [pid 6548:tid 6557] [client 51.75.129.164:34060] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "actDibgIz9HgMl9YwE73zgAAAUc"]
[Tue Mar 31 11:46:19.574513 2026] [:error] [pid 41421:tid 41446] [client 51.75.129.164:57320] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "actDixSaDjY9kKFtUQDDNgAAARY"]
[Tue Mar 31 11:46:21.604866 2026] [:error] [pid 36891:tid 36937] [client 51.75.129.164:51648] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "actDjZJhiMaJUqoqfl5dwgAAAE0"]
[Tue Mar 31 11:46:23.464897 2026] [:error] [pid 36982:tid 36991] [client 51.75.129.164:51656] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "actDj_lMmeoQKN0r_GMb3gAAAMY"]
[Tue Mar 31 11:46:25.489132 2026] [:error] [pid 36982:tid 36986] [client 51.75.129.164:51658] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "actDkflMmeoQKN0r_GMb8AAAAME"]
[Tue Mar 31 11:46:27.515088 2026] [:error] [pid 36982:tid 36996] [client 51.75.129.164:51672] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "actDk_lMmeoQKN0r_GMcAAAAAMs"]
[Tue Mar 31 11:46:29.386962 2026] [:error] [pid 6548:tid 6557] [client 51.75.129.164:38494] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "actDlbgIz9HgMl9YwE739QAAAUc"]
[Tue Mar 31 11:46:31.428154 2026] [:error] [pid 36982:tid 37005] [client 51.75.129.164:38496] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "actDl_lMmeoQKN0r_GMcEQAAANQ"]
[Tue Mar 31 11:46:33.933846 2026] [:error] [pid 6548:tid 6553] [client 51.75.129.164:50578] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "actDmbgIz9HgMl9YwE74EgAAAUM"]
[Tue Mar 31 11:46:35.940825 2026] [:error] [pid 36891:tid 36947] [client 51.75.129.164:38512] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "actDm5JhiMaJUqoqfl5dzwAAAFc"]
[Tue Mar 31 11:46:37.968020 2026] [:error] [pid 6548:tid 6567] [client 51.75.129.164:38528] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "actDnbgIz9HgMl9YwE74JQAAAVE"]
[Tue Mar 31 11:46:40.486560 2026] [:error] [pid 36982:tid 36996] [client 51.75.129.164:49406] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "actDoPlMmeoQKN0r_GMcZAAAAMs"]
[Tue Mar 31 11:46:42.503137 2026] [:error] [pid 36982:tid 37009] [client 51.75.129.164:37356] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "actDovlMmeoQKN0r_GMccQAAANg"]
[Tue Mar 31 11:46:44.363949 2026] [:error] [pid 36982:tid 37005] [client 51.75.129.164:37362] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "actDpPlMmeoQKN0r_GMcfQAAANQ"]
[Tue Mar 31 11:46:46.908941 2026] [:error] [pid 41421:tid 41429] [client 51.75.129.164:49408] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "actDphSaDjY9kKFtUQDDVwAAAQU"]
[Tue Mar 31 11:47:08.852884 2026] [:error] [pid 36982:tid 36997] [client 51.75.129.164:44766] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "actDvPlMmeoQKN0r_GMdAAAAAMw"]
[Tue Mar 31 11:47:10.820516 2026] [:error] [pid 36982:tid 36993] [client 51.75.129.164:34284] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "actDvvlMmeoQKN0r_GMdAgAAAMg"]
[Tue Mar 31 11:47:12.842775 2026] [:error] [pid 41421:tid 41437] [client 51.75.129.164:34286] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "actDwBSaDjY9kKFtUQDDjwAAAQ0"]
[Tue Mar 31 11:47:15.183579 2026] [:error] [pid 41421:tid 41424] [client 51.75.129.164:45800] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "actDwxSaDjY9kKFtUQDDmgAAAQA"]
[Tue Mar 31 11:47:17.031300 2026] [:error] [pid 41421:tid 41442] [client 51.75.129.164:34300] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "actDxRSaDjY9kKFtUQDDpAAAARI"]
[Tue Mar 31 11:47:19.051709 2026] [:error] [pid 36982:tid 36992] [client 51.75.129.164:38554] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "actDx_lMmeoQKN0r_GMdKQAAAMc"]
[Tue Mar 31 11:47:21.549553 2026] [:error] [pid 41421:tid 41447] [client 51.75.129.164:35412] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "actDyRSaDjY9kKFtUQDDsQAAARc"]
[Tue Mar 31 11:47:24.038378 2026] [:error] [pid 6548:tid 6567] [client 51.75.129.164:35414] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "actDzLgIz9HgMl9YwE74mgAAAVE"]
[Tue Mar 31 11:47:26.027405 2026] [:error] [pid 36982:tid 37003] [client 51.75.129.164:38570] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "actDzvlMmeoQKN0r_GMdNwAAANI"]
[Tue Mar 31 11:47:28.548163 2026] [:error] [pid 36982:tid 36993] [client 51.75.129.164:35424] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "actD0PlMmeoQKN0r_GMdSgAAAMg"]
[Tue Mar 31 11:47:30.390830 2026] [:error] [pid 6548:tid 6574] [client 51.75.129.164:55028] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "actD0rgIz9HgMl9YwE74tAAAAVg"]
[Tue Mar 31 11:47:32.920492 2026] [:error] [pid 6548:tid 6551] [client 51.75.129.164:58740] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "actD1LgIz9HgMl9YwE74uQAAAUE"]
[Tue Mar 31 11:47:35.421833 2026] [:error] [pid 41421:tid 41447] [client 51.75.129.164:58742] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "actD1xSaDjY9kKFtUQDDxwAAARc"]
[Tue Mar 31 11:47:37.386594 2026] [:error] [pid 36982:tid 36990] [client 51.75.129.164:55032] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "actD2flMmeoQKN0r_GMdigAAAMU"]
[Tue Mar 31 11:47:39.920870 2026] [:error] [pid 6548:tid 6569] [client 51.75.129.164:48714] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "actD27gIz9HgMl9YwE74zwAAAVM"]
[Tue Mar 31 11:47:41.744303 2026] [:error] [pid 36982:tid 36994] [client 51.75.129.164:58024] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "actD3flMmeoQKN0r_GMdnQAAAMk"]
[Tue Mar 31 11:47:44.260796 2026] [:error] [pid 36982:tid 37006] [client 51.75.129.164:48728] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "actD4PlMmeoQKN0r_GMdtAAAANU"]
[Tue Mar 31 11:47:46.271524 2026] [:error] [pid 36982:tid 37009] [client 51.75.129.164:58030] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "actD4vlMmeoQKN0r_GMdwgAAANg"]
[Tue Mar 31 11:47:48.776104 2026] [:error] [pid 41421:tid 41440] [client 51.75.129.164:47156] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "actD5BSaDjY9kKFtUQDD6AAAARA"]
[Tue Mar 31 11:47:51.257330 2026] [:error] [pid 36890:tid 36916] [client 51.75.129.164:47162] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "actD558FASPd_uH8z7eMvAAAABU"]
[Tue Mar 31 11:47:53.232118 2026] [:error] [pid 36982:tid 37002] [client 51.75.129.164:53846] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "actD6flMmeoQKN0r_GMd6gAAANE"]
[Tue Mar 31 11:47:55.747878 2026] [:error] [pid 36982:tid 36990] [client 51.75.129.164:47176] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "actD6_lMmeoQKN0r_GMeLAAAAMU"]
[Tue Mar 31 11:47:57.576223 2026] [:error] [pid 36982:tid 36998] [client 51.75.129.164:53854] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "actD7flMmeoQKN0r_GMePAAAAM0"]
[Tue Mar 31 11:48:00.088793 2026] [:error] [pid 41421:tid 41443] [client 51.75.129.164:52274] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "actD8BSaDjY9kKFtUQDEHAAAARM"]
[Tue Mar 31 11:48:02.563880 2026] [:error] [pid 6548:tid 6564] [client 51.75.129.164:52282] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "actD8rgIz9HgMl9YwE75AgAAAU4"]
[Tue Mar 31 11:48:04.536301 2026] [:error] [pid 41421:tid 41430] [client 51.75.129.164:57006] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "actD9BSaDjY9kKFtUQDEJAAAAQY"]
[Tue Mar 31 11:48:06.890636 2026] [:error] [pid 6548:tid 6559] [client 51.75.129.164:52294] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "actD9rgIz9HgMl9YwE75FQAAAUk"]
[Tue Mar 31 11:48:27.846627 2026] [:error] [pid 36982:tid 37008] [client 51.75.129.164:50862] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "actEC_lMmeoQKN0r_GMe7gAAANc"]
[Tue Mar 31 11:48:30.285512 2026] [:error] [pid 36982:tid 36988] [client 51.75.129.164:44926] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "actEDvlMmeoQKN0r_GMfAAAAAMM"]
[Tue Mar 31 11:48:32.600992 2026] [:error] [pid 36982:tid 37003] [client 51.75.129.164:44930] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "actEEPlMmeoQKN0r_GMfCQAAANI"]
[Tue Mar 31 11:48:35.079744 2026] [:error] [pid 41421:tid 41440] [client 51.75.129.164:44944] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "actEExSaDjY9kKFtUQDEYwAAARA"]
[Tue Mar 31 11:48:37.539748 2026] [:error] [pid 36982:tid 36989] [client 51.75.129.164:44952] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "actEFflMmeoQKN0r_GMfJQAAAMQ"]
[Tue Mar 31 11:48:40.597849 2026] [:error] [pid 36982:tid 36986] [client 51.75.129.164:48224] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "actEGPlMmeoQKN0r_GMfOAAAAME"]
[Tue Mar 31 11:48:44.427198 2026] [:error] [pid 6548:tid 6551] [client 51.75.129.164:48230] [client 51.75.129.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "actEHLgIz9HgMl9YwE75bQAAAUE"]
[Tue Mar 31 11:54:33.859094 2026] [:error] [pid 36890:tid 36919] [client 49.51.233.95:59142] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "actFeZ8FASPd_uH8z7eQFwAAABg"]
[Tue Mar 31 12:17:02.287790 2026] [:error] [pid 6548:tid 6573] [client 182.42.111.156:41472] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "actKvrgIz9HgMl9YwE4KTwAAAVc"]
[Tue Mar 31 12:55:29.663901 2026] [:error] [pid 36982:tid 37007] [client 43.130.16.212:45526] [client 43.130.16.212] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "actTwflMmeoQKN0r_GNhhgAAANY"]
[Tue Mar 31 14:07:32.244935 2026] [:error] [pid 41421:tid 41426] [client 212.227.21.19:9850] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "actkpBSaDjY9kKFtUQAGBQAAAQI"]
[Tue Mar 31 14:07:34.705428 2026] [:error] [pid 6548:tid 6561] [client 212.227.21.19:9856] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "actkprgIz9HgMl9YwE5aQwAAAUs"]
[Tue Mar 31 14:07:37.162328 2026] [:error] [pid 41421:tid 41441] [client 212.227.21.19:9870] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "actkqRSaDjY9kKFtUQAGEAAAARE"]
[Tue Mar 31 14:07:39.646259 2026] [:error] [pid 41421:tid 41430] [client 212.227.21.19:57184] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "actkqxSaDjY9kKFtUQAGGQAAAQY"]
[Tue Mar 31 14:07:42.150033 2026] [:error] [pid 36890:tid 36915] [client 212.227.21.19:57192] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "actkrp8FASPd_uH8z7fAQgAAABQ"]
[Tue Mar 31 14:07:44.459104 2026] [:error] [pid 6548:tid 6573] [client 212.227.21.19:57198] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "actksLgIz9HgMl9YwE5aUAAAAVc"]
[Tue Mar 31 14:07:46.963733 2026] [:error] [pid 6548:tid 6569] [client 212.227.21.19:57210] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "actksrgIz9HgMl9YwE5aWQAAAVM"]
[Tue Mar 31 14:07:49.309007 2026] [:error] [pid 6548:tid 6551] [client 212.227.21.19:47614] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "actktbgIz9HgMl9YwE5aZQAAAUE"]
[Tue Mar 31 14:07:51.795129 2026] [:error] [pid 36982:tid 37006] [client 212.227.21.19:47628] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "actkt_lMmeoQKN0r_GOhkwAAANU"]
[Tue Mar 31 14:07:54.111805 2026] [:error] [pid 41421:tid 41448] [client 212.227.21.19:47642] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "actkuhSaDjY9kKFtUQAGQgAAARg"]
[Tue Mar 31 14:07:56.604521 2026] [:error] [pid 36890:tid 36910] [client 212.227.21.19:47646] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "actkvJ8FASPd_uH8z7fAXAAAAA8"]
[Tue Mar 31 14:07:59.084519 2026] [:error] [pid 36892:tid 36971] [client 212.227.21.19:38362] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "actkv0yj9S4G0ek3O4ItugAAAJQ"]
[Tue Mar 31 14:08:01.536947 2026] [:error] [pid 36982:tid 37005] [client 212.227.21.19:38368] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "actkwflMmeoQKN0r_GOhqAAAANQ"]
[Tue Mar 31 14:08:03.909049 2026] [:error] [pid 41421:tid 41439] [client 212.227.21.19:38384] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "actkwxSaDjY9kKFtUQAGtQAAAQ8"]
[Tue Mar 31 14:08:06.394830 2026] [:error] [pid 36982:tid 36989] [client 212.227.21.19:38398] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "actkxvlMmeoQKN0r_GOhuwAAAMQ"]
[Tue Mar 31 14:08:08.916098 2026] [:error] [pid 36982:tid 36986] [client 212.227.21.19:6672] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "actkyPlMmeoQKN0r_GOhwwAAAME"]
[Tue Mar 31 14:08:11.350819 2026] [:error] [pid 41421:tid 41438] [client 212.227.21.19:6682] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "actkyxSaDjY9kKFtUQAG0gAAAQ4"]
[Tue Mar 31 14:08:13.868294 2026] [:error] [pid 6548:tid 6573] [client 212.227.21.19:6692] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "actkzbgIz9HgMl9YwE5amAAAAVc"]
[Tue Mar 31 14:08:16.343020 2026] [:error] [pid 36982:tid 36999] [client 212.227.21.19:6706] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "actk0PlMmeoQKN0r_GOh4AAAAM4"]
[Tue Mar 31 14:08:18.887926 2026] [:error] [pid 36982:tid 37005] [client 212.227.21.19:37394] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "actk0vlMmeoQKN0r_GOh4gAAANQ"]
[Tue Mar 31 14:08:21.369663 2026] [:error] [pid 36982:tid 37007] [client 212.227.21.19:37398] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "actk1flMmeoQKN0r_GOh7AAAANY"]
[Tue Mar 31 14:08:23.875953 2026] [:error] [pid 36982:tid 36994] [client 212.227.21.19:37404] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "actk1_lMmeoQKN0r_GOh9AAAAMk"]
[Tue Mar 31 14:08:26.206200 2026] [:error] [pid 36982:tid 37008] [client 212.227.21.19:37416] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "actk2vlMmeoQKN0r_GOh_wAAANc"]
[Tue Mar 31 14:08:28.708224 2026] [:error] [pid 36890:tid 36897] [client 212.227.21.19:8958] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "actk3J8FASPd_uH8z7fAoQAAAAI"]
[Tue Mar 31 14:08:58.070010 2026] [:error] [pid 6548:tid 6564] [client 212.227.21.19:20246] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "actk-rgIz9HgMl9YwE5bEgAAAU4"]
[Tue Mar 31 14:09:00.558676 2026] [:error] [pid 36891:tid 36937] [client 212.227.21.19:20256] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "actk_JJhiMaJUqoqfl6BgQAAAE0"]
[Tue Mar 31 14:09:02.917706 2026] [:error] [pid 6548:tid 6564] [client 212.227.21.19:20258] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "actk_rgIz9HgMl9YwE5bHgAAAU4"]
[Tue Mar 31 16:51:05.757691 2026] [proxy_fcgi:error] [pid 36891:tid 36929] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:06.024092 2026] [proxy_fcgi:error] [pid 36891:tid 36930] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:06.290430 2026] [proxy_fcgi:error] [pid 36891:tid 36941] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:06.555211 2026] [proxy_fcgi:error] [pid 36891:tid 36931] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:06.823144 2026] [proxy_fcgi:error] [pid 36891:tid 36940] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:07.089795 2026] [proxy_fcgi:error] [pid 36891:tid 36946] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:07.362363 2026] [proxy_fcgi:error] [pid 36891:tid 36938] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:07.628359 2026] [proxy_fcgi:error] [pid 36891:tid 36937] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:07.894061 2026] [proxy_fcgi:error] [pid 36891:tid 36947] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:08.161396 2026] [proxy_fcgi:error] [pid 36891:tid 36924] [client 4.223.110.202:13249] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:51:08.424531 2026] [:error] [pid 36891:tid 36927] [client 4.223.110.202:13249] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-true.php"] [unique_id "acuK_JJhiMaJUqoqfl6jOQAAAEM"]
[Tue Mar 31 16:51:08.972060 2026] [:error] [pid 36892:tid 36960] [client 4.223.110.202:12937] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-true.php"] [unique_id "acuK_Eyj9S4G0ek3O4JXZQAAAIk"]
[Tue Mar 31 16:51:09.521838 2026] [:error] [pid 36890:tid 36900] [client 4.223.110.202:12931] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-true.php"] [unique_id "acuK_Z8FASPd_uH8z7fyzgAAAAU"]
[Tue Mar 31 16:51:10.052790 2026] [:error] [pid 41421:tid 41438] [client 4.223.110.202:12940] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-true.php"] [unique_id "acuK_hSaDjY9kKFtUQBF6gAAAQ4"]
[Tue Mar 31 16:51:10.591888 2026] [:error] [pid 41421:tid 41445] [client 4.223.110.202:13262] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acuK_hSaDjY9kKFtUQBF6wAAARU"]
[Tue Mar 31 16:51:11.177661 2026] [:error] [pid 36891:tid 36935] [client 4.223.110.202:12970] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acuK_5JhiMaJUqoqfl6jQAAAAEs"]
[Tue Mar 31 16:51:11.714944 2026] [:error] [pid 6548:tid 6562] [client 4.223.110.202:12987] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acuK_7gIz9HgMl9YwE6z9QAAAUw"]
[Tue Mar 31 16:51:12.268165 2026] [:error] [pid 6548:tid 6558] [client 4.223.110.202:12951] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws42.php"] [unique_id "acuLALgIz9HgMl9YwE6z-wAAAUg"]
[Tue Mar 31 16:51:12.802627 2026] [:error] [pid 6548:tid 6563] [client 4.223.110.202:13256] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acuLALgIz9HgMl9YwE6z_gAAAU0"]
[Tue Mar 31 16:51:13.338520 2026] [:error] [pid 6548:tid 6556] [client 4.223.110.202:12943] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acuLAbgIz9HgMl9YwE60CAAAAUY"]
[Tue Mar 31 16:51:14.068363 2026] [:error] [pid 6548:tid 6571] [client 4.223.110.202:13266] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acuLArgIz9HgMl9YwE60DAAAAVU"]
[Tue Mar 31 16:51:14.639564 2026] [:error] [pid 6548:tid 6569] [client 4.223.110.202:12955] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "acuLArgIz9HgMl9YwE60DgAAAVM"]
[Tue Mar 31 16:51:15.169742 2026] [:error] [pid 36982:tid 37005] [client 4.223.110.202:12952] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acuLA_lMmeoQKN0r_GMfqwAAANQ"]
[Tue Mar 31 16:51:15.706337 2026] [:error] [pid 36982:tid 36986] [client 4.223.110.202:13311] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acuLA_lMmeoQKN0r_GMfrQAAAME"]
[Tue Mar 31 16:51:16.237129 2026] [:error] [pid 36982:tid 36997] [client 4.223.110.202:12982] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acuLBPlMmeoQKN0r_GMfrwAAAMw"]
[Tue Mar 31 16:51:16.897398 2026] [:error] [pid 36982:tid 37004] [client 4.223.110.202:13265] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "acuLBPlMmeoQKN0r_GMfswAAANM"]
[Tue Mar 31 16:51:17.466455 2026] [:error] [pid 36890:tid 36916] [client 4.223.110.202:12942] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acuLBZ8FASPd_uH8z7fy3wAAABU"]
[Tue Mar 31 16:51:18.261461 2026] [:error] [pid 6548:tid 6567] [client 4.223.110.202:12965] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acuLBrgIz9HgMl9YwE60HAAAAVE"]
[Tue Mar 31 16:51:18.818376 2026] [:error] [pid 36890:tid 36903] [client 4.223.110.202:12981] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acuLBp8FASPd_uH8z7fy4QAAAAg"]
[Tue Mar 31 16:51:19.415283 2026] [:error] [pid 36890:tid 36896] [client 4.223.110.202:12936] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "acuLB58FASPd_uH8z7fy5AAAAAE"]
[Tue Mar 31 16:51:19.970404 2026] [:error] [pid 36890:tid 36912] [client 4.223.110.202:12941] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/north1.php"] [unique_id "acuLB58FASPd_uH8z7fy5gAAABE"]
[Tue Mar 31 16:51:20.587461 2026] [:error] [pid 36891:tid 36932] [client 4.223.110.202:12979] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/north1.php"] [unique_id "acuLCJJhiMaJUqoqfl6jSAAAAEg"]
[Tue Mar 31 16:51:21.365302 2026] [:error] [pid 36891:tid 36925] [client 4.223.110.202:12983] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/north1.php"] [unique_id "acuLCZJhiMaJUqoqfl6jSQAAAEE"]
[Tue Mar 31 16:51:21.965269 2026] [:error] [pid 36890:tid 36896] [client 4.223.110.202:12950] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/north1.php"] [unique_id "acuLCZ8FASPd_uH8z7fy-QAAAAE"]
[Tue Mar 31 16:51:22.655025 2026] [:error] [pid 36890:tid 36915] [client 4.223.110.202:12980] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acuLCp8FASPd_uH8z7fy-gAAABQ"]
[Tue Mar 31 16:51:23.324076 2026] [:error] [pid 36891:tid 36930] [client 4.223.110.202:12947] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acuLC5JhiMaJUqoqfl6jTAAAAEY"]
[Tue Mar 31 16:51:23.901686 2026] [:error] [pid 36890:tid 36905] [client 4.223.110.202:12969] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acuLC58FASPd_uH8z7fy_gAAAAo"]
[Tue Mar 31 16:51:24.735707 2026] [:error] [pid 36982:tid 37006] [client 4.223.110.202:12988] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "acuLDPlMmeoQKN0r_GMfxQAAANU"]
[Tue Mar 31 16:51:25.435703 2026] [:error] [pid 6548:tid 6564] [client 4.223.110.202:13267] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "acuLDbgIz9HgMl9YwE60OgAAAU4"]
[Tue Mar 31 16:51:26.000769 2026] [:error] [pid 36982:tid 36992] [client 4.223.110.202:12991] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "acuLDflMmeoQKN0r_GMfzQAAAMc"]
[Tue Mar 31 16:51:26.749146 2026] [:error] [pid 6548:tid 6556] [client 4.223.110.202:12948] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "acuLDrgIz9HgMl9YwE60QwAAAUY"]
[Tue Mar 31 16:51:27.366643 2026] [:error] [pid 6548:tid 6560] [client 4.223.110.202:12956] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "acuLD7gIz9HgMl9YwE60SAAAAUo"]
[Tue Mar 31 16:51:27.946500 2026] [:error] [pid 36890:tid 36908] [client 4.223.110.202:12934] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acuLD58FASPd_uH8z7fzDgAAAA0"]
[Tue Mar 31 16:51:28.502056 2026] [:error] [pid 36982:tid 37004] [client 4.223.110.202:12968] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acuLEPlMmeoQKN0r_GMf0QAAANM"]
[Tue Mar 31 16:51:29.072301 2026] [:error] [pid 6548:tid 6565] [client 4.223.110.202:12972] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acuLEbgIz9HgMl9YwE60TQAAAU8"]
[Tue Mar 31 16:51:29.660892 2026] [:error] [pid 36982:tid 36991] [client 4.223.110.202:12967] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/admin.php"] [unique_id "acuLEflMmeoQKN0r_GMf1gAAAMY"]
[Tue Mar 31 16:51:30.259619 2026] [:error] [pid 36982:tid 36989] [client 4.223.110.202:12949] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acuLEvlMmeoQKN0r_GMf2QAAAMQ"]
[Tue Mar 31 16:51:30.822450 2026] [:error] [pid 36982:tid 36998] [client 4.223.110.202:12963] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acuLEvlMmeoQKN0r_GMf3wAAAM0"]
[Tue Mar 31 16:51:31.399620 2026] [:error] [pid 6548:tid 6568] [client 4.223.110.202:13199] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acuLE7gIz9HgMl9YwE60WAAAAVI"]
[Tue Mar 31 16:51:32.044544 2026] [:error] [pid 36891:tid 36942] [client 4.223.110.202:13261] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "acuLFJJhiMaJUqoqfl6jVQAAAFI"]
[Tue Mar 31 16:51:32.605621 2026] [:error] [pid 36982:tid 36986] [client 4.223.110.202:13258] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acuLFPlMmeoQKN0r_GMf4wAAAME"]
[Tue Mar 31 16:51:33.265228 2026] [:error] [pid 36982:tid 37003] [client 4.223.110.202:13196] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acuLFflMmeoQKN0r_GMf6QAAANI"]
[Tue Mar 31 16:51:33.818688 2026] [:error] [pid 36982:tid 36987] [client 4.223.110.202:12958] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acuLFflMmeoQKN0r_GMf7AAAAMI"]
[Tue Mar 31 16:51:34.464628 2026] [:error] [pid 41421:tid 41424] [client 4.223.110.202:12959] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "acuLFhSaDjY9kKFtUQBGIQAAAQA"]
[Tue Mar 31 16:51:35.034311 2026] [:error] [pid 41421:tid 41430] [client 4.223.110.202:13260] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "acuLFxSaDjY9kKFtUQBGJAAAAQY"]
[Tue Mar 31 16:51:35.631848 2026] [:error] [pid 36982:tid 37009] [client 4.223.110.202:12977] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "acuLF_lMmeoQKN0r_GMf_QAAANg"]
[Tue Mar 31 16:51:36.205603 2026] [:error] [pid 6548:tid 6574] [client 4.223.110.202:12946] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "acuLGLgIz9HgMl9YwE60ZAAAAVg"]
[Tue Mar 31 16:51:36.752344 2026] [:error] [pid 36892:tid 36958] [client 4.223.110.202:12964] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "acuLGEyj9S4G0ek3O4JXlAAAAIc"]
[Tue Mar 31 16:51:37.322958 2026] [:error] [pid 6548:tid 6554] [client 4.223.110.202:13263] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acuLGbgIz9HgMl9YwE60agAAAUQ"]
[Tue Mar 31 16:51:37.905064 2026] [:error] [pid 6548:tid 6558] [client 4.223.110.202:13250] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acuLGbgIz9HgMl9YwE60bQAAAUg"]
[Tue Mar 31 16:51:38.521978 2026] [:error] [pid 41421:tid 41443] [client 4.223.110.202:13269] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acuLGhSaDjY9kKFtUQBGLAAAARM"]
[Tue Mar 31 16:51:39.210834 2026] [:error] [pid 6548:tid 6560] [client 4.223.110.202:13299] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "acuLG7gIz9HgMl9YwE60cgAAAUo"]
[Tue Mar 31 16:51:39.801125 2026] [:error] [pid 36982:tid 37007] [client 4.223.110.202:13294] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "acuLG_lMmeoQKN0r_GMgDQAAANY"]
[Tue Mar 31 16:51:40.488361 2026] [:error] [pid 41421:tid 41435] [client 4.223.110.202:13201] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "acuLHBSaDjY9kKFtUQBGMQAAAQs"]
[Tue Mar 31 16:51:41.067917 2026] [:error] [pid 6548:tid 6551] [client 4.223.110.202:12960] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "acuLHbgIz9HgMl9YwE60fAAAAUE"]
[Tue Mar 31 16:51:41.621741 2026] [:error] [pid 41421:tid 41438] [client 4.223.110.202:13308] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "acuLHRSaDjY9kKFtUQBGNwAAAQ4"]
[Tue Mar 31 16:51:42.239861 2026] [:error] [pid 36982:tid 37006] [client 4.223.110.202:12954] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acuLHvlMmeoQKN0r_GMgEAAAANU"]
[Tue Mar 31 16:51:42.887405 2026] [:error] [pid 41421:tid 41445] [client 4.223.110.202:12930] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acuLHhSaDjY9kKFtUQBGPwAAARU"]
[Tue Mar 31 16:51:43.462939 2026] [:error] [pid 6548:tid 6568] [client 4.223.110.202:13219] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acuLH7gIz9HgMl9YwE60ggAAAVI"]
[Tue Mar 31 16:51:44.057656 2026] [:error] [pid 6548:tid 6567] [client 4.223.110.202:13274] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h02ugyh.php"] [unique_id "acuLILgIz9HgMl9YwE60gwAAAVE"]
[Tue Mar 31 16:51:44.629976 2026] [:error] [pid 6548:tid 6552] [client 4.223.110.202:13248] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acuLILgIz9HgMl9YwE60hQAAAUI"]
[Tue Mar 31 16:51:45.276437 2026] [:error] [pid 36890:tid 36902] [client 4.223.110.202:13187] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acuLIZ8FASPd_uH8z7fzSAAAAAc"]
[Tue Mar 31 16:51:45.848792 2026] [:error] [pid 6548:tid 6565] [client 4.223.110.202:12928] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acuLIbgIz9HgMl9YwE60jQAAAU8"]
[Tue Mar 31 16:51:46.508150 2026] [:error] [pid 36891:tid 36947] [client 4.223.110.202:12976] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ad.php"] [unique_id "acuLIpJhiMaJUqoqfl6jYAAAAFc"]
[Tue Mar 31 16:51:47.092518 2026] [:error] [pid 36892:tid 36953] [client 4.223.110.202:13275] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z60.php"] [unique_id "acuLI0yj9S4G0ek3O4JXmgAAAII"]
[Tue Mar 31 16:51:47.688138 2026] [:error] [pid 36892:tid 36960] [client 4.223.110.202:12986] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z60.php"] [unique_id "acuLI0yj9S4G0ek3O4JXnAAAAIk"]
[Tue Mar 31 16:51:48.300316 2026] [:error] [pid 36890:tid 36913] [client 4.223.110.202:13200] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z60.php"] [unique_id "acuLJJ8FASPd_uH8z7fzVgAAABI"]
[Tue Mar 31 16:51:48.924660 2026] [:error] [pid 36890:tid 36897] [client 4.223.110.202:12989] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z60.php"] [unique_id "acuLJJ8FASPd_uH8z7fzWgAAAAI"]
[Tue Mar 31 16:51:49.574820 2026] [:error] [pid 6548:tid 6571] [client 4.223.110.202:13285] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acuLJbgIz9HgMl9YwE60mAAAAVU"]
[Tue Mar 31 16:51:50.123191 2026] [:error] [pid 36982:tid 36994] [client 4.223.110.202:12974] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acuLJvlMmeoQKN0r_GMgGAAAAMk"]
[Tue Mar 31 16:51:50.656429 2026] [:error] [pid 36982:tid 37001] [client 4.223.110.202:13190] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acuLJvlMmeoQKN0r_GMgHwAAANA"]
[Tue Mar 31 16:51:51.234490 2026] [:error] [pid 36982:tid 37008] [client 4.223.110.202:13253] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "acuLJ_lMmeoQKN0r_GMgJQAAANc"]
[Tue Mar 31 16:51:51.765422 2026] [:error] [pid 36982:tid 36999] [client 4.223.110.202:12944] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acuLJ_lMmeoQKN0r_GMgKQAAAM4"]
[Tue Mar 31 16:51:52.308379 2026] [:error] [pid 41421:tid 41441] [client 4.223.110.202:13257] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acuLKBSaDjY9kKFtUQBGUQAAARE"]
[Tue Mar 31 16:51:52.855276 2026] [:error] [pid 36891:tid 36939] [client 4.223.110.202:13292] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acuLKJJhiMaJUqoqfl6jaAAAAE8"]
[Tue Mar 31 16:51:53.389616 2026] [:error] [pid 36982:tid 36996] [client 4.223.110.202:12962] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wta.php"] [unique_id "acuLKflMmeoQKN0r_GMgMQAAAMs"]
[Tue Mar 31 16:51:53.928050 2026] [:error] [pid 36982:tid 37003] [client 4.223.110.202:13194] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acuLKflMmeoQKN0r_GMgNAAAANI"]
[Tue Mar 31 16:51:54.475607 2026] [:error] [pid 36982:tid 37009] [client 4.223.110.202:13272] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acuLKvlMmeoQKN0r_GMgNgAAANg"]
[Tue Mar 31 16:51:55.029285 2026] [:error] [pid 36982:tid 36993] [client 4.223.110.202:12957] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acuLK_lMmeoQKN0r_GMgPAAAAMg"]
[Tue Mar 31 16:51:55.569881 2026] [:error] [pid 36982:tid 36986] [client 4.223.110.202:13208] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sql.php"] [unique_id "acuLK_lMmeoQKN0r_GMgQQAAAME"]
[Tue Mar 31 16:51:56.118148 2026] [:error] [pid 36982:tid 37002] [client 4.223.110.202:13251] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acuLLPlMmeoQKN0r_GMgRQAAANE"]
[Tue Mar 31 16:51:56.670016 2026] [:error] [pid 36890:tid 36910] [client 4.223.110.202:13296] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acuLLJ8FASPd_uH8z7fzZwAAAA8"]
[Tue Mar 31 16:51:57.303986 2026] [:error] [pid 6548:tid 6573] [client 4.223.110.202:12816] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acuLLbgIz9HgMl9YwE60oQAAAVc"]
[Tue Mar 31 16:51:57.850702 2026] [:error] [pid 41421:tid 41438] [client 4.223.110.202:12966] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "acuLLRSaDjY9kKFtUQBGWQAAAQ4"]
[Tue Mar 31 16:51:58.439609 2026] [:error] [pid 36892:tid 36951] [client 4.223.110.202:12801] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acuLLkyj9S4G0ek3O4JXrgAAAIA"]
[Tue Mar 31 16:51:58.974270 2026] [:error] [pid 36892:tid 36958] [client 4.223.110.202:13303] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acuLLkyj9S4G0ek3O4JXrwAAAIc"]
[Tue Mar 31 16:51:59.576760 2026] [:error] [pid 36982:tid 36991] [client 4.223.110.202:13211] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acuLL_lMmeoQKN0r_GMgSgAAAMY"]
[Tue Mar 31 16:52:00.150701 2026] [:error] [pid 36982:tid 36989] [client 4.223.110.202:13279] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "acuLMPlMmeoQKN0r_GMgTgAAAMQ"]
[Tue Mar 31 16:52:00.719541 2026] [:error] [pid 6548:tid 6562] [client 4.223.110.202:13268] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acuLMLgIz9HgMl9YwE60pwAAAUw"]
[Tue Mar 31 16:52:01.440836 2026] [:error] [pid 6548:tid 6559] [client 4.223.110.202:13264] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acuLMbgIz9HgMl9YwE60qQAAAUk"]
[Tue Mar 31 16:52:01.982749 2026] [:error] [pid 36891:tid 36930] [client 4.223.110.202:13276] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acuLMZJhiMaJUqoqfl6jcAAAAEY"]
[Tue Mar 31 16:52:02.686063 2026] [:error] [pid 6548:tid 6573] [client 4.223.110.202:13270] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "acuLMrgIz9HgMl9YwE60sQAAAVc"]
[Tue Mar 31 16:52:03.380929 2026] [:error] [pid 6548:tid 6574] [client 4.223.110.202:12800] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "acuLM7gIz9HgMl9YwE60tAAAAVg"]
[Tue Mar 31 16:52:03.920852 2026] [:error] [pid 36891:tid 36938] [client 4.223.110.202:13255] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "acuLM5JhiMaJUqoqfl6jcgAAAE4"]
[Tue Mar 31 16:52:04.530406 2026] [:error] [pid 36892:tid 36952] [client 4.223.110.202:13278] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "acuLNEyj9S4G0ek3O4JXuwAAAIE"]
[Tue Mar 31 16:52:05.069812 2026] [:error] [pid 36982:tid 36996] [client 4.223.110.202:13217] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "acuLNflMmeoQKN0r_GMgWAAAAMs"]
[Tue Mar 31 16:52:05.652157 2026] [:error] [pid 36892:tid 36956] [client 4.223.110.202:13237] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uang.php"] [unique_id "acuLNUyj9S4G0ek3O4JXwAAAAIU"]
[Tue Mar 31 16:52:06.223439 2026] [:error] [pid 36982:tid 36992] [client 4.223.110.202:13214] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uang.php"] [unique_id "acuLNvlMmeoQKN0r_GMgWwAAAMc"]
[Tue Mar 31 16:52:06.904678 2026] [:error] [pid 6548:tid 6559] [client 4.223.110.202:13284] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uang.php"] [unique_id "acuLNrgIz9HgMl9YwE60vAAAAUk"]
[Tue Mar 31 16:52:07.673163 2026] [:error] [pid 41421:tid 41438] [client 4.223.110.202:12823] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uang.php"] [unique_id "acuLNxSaDjY9kKFtUQBGcwAAAQ4"]
[Tue Mar 31 16:52:08.268131 2026] [proxy_fcgi:error] [pid 36982:tid 37008] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:08.534902 2026] [proxy_fcgi:error] [pid 36982:tid 37002] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:08.801364 2026] [proxy_fcgi:error] [pid 36982:tid 36998] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:09.067799 2026] [proxy_fcgi:error] [pid 36982:tid 36991] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:09.336814 2026] [proxy_fcgi:error] [pid 36982:tid 36994] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:09.606743 2026] [proxy_fcgi:error] [pid 36982:tid 37004] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:09.874643 2026] [proxy_fcgi:error] [pid 36982:tid 37000] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:10.143159 2026] [proxy_fcgi:error] [pid 36982:tid 36996] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:10.409855 2026] [proxy_fcgi:error] [pid 36982:tid 37001] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:10.677856 2026] [proxy_fcgi:error] [pid 36982:tid 37002] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:10.948107 2026] [proxy_fcgi:error] [pid 36982:tid 37005] [client 4.223.110.202:13213] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:52:11.212152 2026] [:error] [pid 36982:tid 37006] [client 4.223.110.202:13213] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acuLO_lMmeoQKN0r_GMggAAAANU"]
[Tue Mar 31 16:52:11.837021 2026] [:error] [pid 36892:tid 36968] [client 4.223.110.202:13254] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acuLO0yj9S4G0ek3O4JXyAAAAJE"]
[Tue Mar 31 16:52:12.426803 2026] [:error] [pid 36890:tid 36908] [client 4.223.110.202:12938] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acuLPJ8FASPd_uH8z7fzhQAAAA0"]
[Tue Mar 31 16:52:12.999423 2026] [:error] [pid 36982:tid 37001] [client 4.223.110.202:13295] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "acuLPPlMmeoQKN0r_GMghwAAANA"]
[Tue Mar 31 16:52:13.551907 2026] [:error] [pid 36982:tid 36998] [client 4.223.110.202:12985] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acuLPflMmeoQKN0r_GMgigAAAM0"]
[Tue Mar 31 16:52:14.105773 2026] [:error] [pid 6548:tid 6561] [client 4.223.110.202:13306] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acuLPrgIz9HgMl9YwE60zAAAAUs"]
[Tue Mar 31 16:52:14.672253 2026] [:error] [pid 36891:tid 36939] [client 4.223.110.202:13259] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acuLPpJhiMaJUqoqfl6jfgAAAE8"]
[Tue Mar 31 16:52:15.253623 2026] [:error] [pid 36982:tid 37008] [client 4.223.110.202:13304] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awh.php"] [unique_id "acuLP_lMmeoQKN0r_GMgkgAAANc"]
[Tue Mar 31 16:52:15.828064 2026] [:error] [pid 36891:tid 36926] [client 4.223.110.202:12978] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acuLP5JhiMaJUqoqfl6jfwAAAEI"]
[Tue Mar 31 16:52:16.425132 2026] [:error] [pid 36890:tid 36911] [client 4.223.110.202:13297] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acuLQJ8FASPd_uH8z7fzjQAAABA"]
[Tue Mar 31 16:52:17.031136 2026] [:error] [pid 36891:tid 36937] [client 4.223.110.202:13283] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acuLQZJhiMaJUqoqfl6jgAAAAE0"]
[Tue Mar 31 16:52:17.790898 2026] [:error] [pid 36982:tid 37007] [client 4.223.110.202:13225] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shellerr.php"] [unique_id "acuLQflMmeoQKN0r_GMgpQAAANY"]
[Tue Mar 31 16:52:18.456617 2026] [:error] [pid 36982:tid 37002] [client 4.223.110.202:13281] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acuLQvlMmeoQKN0r_GMgqQAAANE"]
[Tue Mar 31 16:52:19.039948 2026] [:error] [pid 6548:tid 6565] [client 4.223.110.202:13186] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acuLQ7gIz9HgMl9YwE600gAAAU8"]
[Tue Mar 31 16:52:19.637969 2026] [:error] [pid 41421:tid 41437] [client 4.223.110.202:13273] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acuLQxSaDjY9kKFtUQBGiAAAAQ0"]
[Tue Mar 31 16:52:20.209247 2026] [:error] [pid 36892:tid 36951] [client 4.223.110.202:13302] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scanner.php"] [unique_id "acuLREyj9S4G0ek3O4JX1QAAAIA"]
[Tue Mar 31 16:52:20.767493 2026] [:error] [pid 36982:tid 36985] [client 4.223.110.202:13287] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acuLRPlMmeoQKN0r_GMgtwAAAMA"]
[Tue Mar 31 16:52:21.404832 2026] [:error] [pid 36890:tid 36903] [client 4.223.110.202:13298] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acuLRZ8FASPd_uH8z7fzmAAAAAg"]
[Tue Mar 31 16:52:22.039042 2026] [:error] [pid 36891:tid 36929] [client 4.223.110.202:12990] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acuLRpJhiMaJUqoqfl6jhwAAAEU"]
[Tue Mar 31 16:52:22.670757 2026] [:error] [pid 36982:tid 36998] [client 4.223.110.202:12933] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "acuLRvlMmeoQKN0r_GMgvQAAAM0"]
[Tue Mar 31 16:52:23.246493 2026] [:error] [pid 36892:tid 36959] [client 4.223.110.202:13223] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acuLR0yj9S4G0ek3O4JX3wAAAIg"]
[Tue Mar 31 16:52:23.814328 2026] [:error] [pid 36892:tid 36954] [client 4.223.110.202:13277] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acuLR0yj9S4G0ek3O4JX5QAAAIM"]
[Tue Mar 31 16:52:24.347193 2026] [:error] [pid 36890:tid 36914] [client 4.223.110.202:13188] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acuLSJ8FASPd_uH8z7fzowAAABM"]
[Tue Mar 31 16:52:24.888302 2026] [:error] [pid 36892:tid 36953] [client 4.223.110.202:13233] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "acuLSEyj9S4G0ek3O4JX7QAAAII"]
[Tue Mar 31 16:52:25.451341 2026] [:error] [pid 6548:tid 6573] [client 4.223.110.202:12975] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acuLSbgIz9HgMl9YwE603wAAAVc"]
[Tue Mar 31 16:52:25.982078 2026] [:error] [pid 36982:tid 37000] [client 4.223.110.202:13252] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acuLSflMmeoQKN0r_GMg1QAAAM8"]
[Tue Mar 31 16:52:26.543827 2026] [:error] [pid 36982:tid 36996] [client 4.223.110.202:13300] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acuLSvlMmeoQKN0r_GMg4AAAAMs"]
[Tue Mar 31 16:52:27.095175 2026] [:error] [pid 41421:tid 41444] [client 4.223.110.202:12953] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "acuLSxSaDjY9kKFtUQBGxwAAARQ"]
[Tue Mar 31 16:52:27.627059 2026] [:error] [pid 41421:tid 41438] [client 4.223.110.202:12838] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acuLSxSaDjY9kKFtUQBGzQAAAQ4"]
[Tue Mar 31 16:52:28.200319 2026] [:error] [pid 6548:tid 6571] [client 4.223.110.202:12826] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acuLTLgIz9HgMl9YwE605wAAAVU"]
[Tue Mar 31 16:52:28.739656 2026] [:error] [pid 36890:tid 36911] [client 4.223.110.202:13215] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acuLTJ8FASPd_uH8z7fzvgAAABA"]
[Tue Mar 31 16:52:29.286479 2026] [:error] [pid 36982:tid 36992] [client 4.223.110.202:13288] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ant.php"] [unique_id "acuLTflMmeoQKN0r_GMhEQAAAMc"]
[Tue Mar 31 16:52:29.826140 2026] [:error] [pid 36982:tid 36997] [client 4.223.110.202:12984] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acuLTflMmeoQKN0r_GMhJQAAAMw"]
[Tue Mar 31 16:52:30.379891 2026] [:error] [pid 6548:tid 6573] [client 4.223.110.202:13242] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acuLTrgIz9HgMl9YwE608gAAAVc"]
[Tue Mar 31 16:52:30.929466 2026] [:error] [pid 6548:tid 6552] [client 4.223.110.202:13195] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acuLTrgIz9HgMl9YwE60-AAAAUI"]
[Tue Mar 31 16:52:31.461702 2026] [:error] [pid 6548:tid 6563] [client 4.223.110.202:13191] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "acuLT7gIz9HgMl9YwE60-gAAAU0"]
[Tue Mar 31 16:52:31.995290 2026] [:error] [pid 36982:tid 37007] [client 4.223.110.202:13203] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acuLT_lMmeoQKN0r_GMhPwAAANY"]
[Tue Mar 31 16:52:32.561557 2026] [:error] [pid 36890:tid 36904] [client 4.223.110.202:13291] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acuLUJ8FASPd_uH8z7fzxQAAAAk"]
[Tue Mar 31 16:52:33.090423 2026] [:error] [pid 6548:tid 6566] [client 4.223.110.202:13282] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acuLUbgIz9HgMl9YwE61AQAAAVA"]
[Tue Mar 31 16:52:33.619225 2026] [:error] [pid 6548:tid 6555] [client 4.223.110.202:12932] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "acuLUbgIz9HgMl9YwE61AgAAAUU"]
[Tue Mar 31 16:52:34.152179 2026] [:error] [pid 41421:tid 41429] [client 4.223.110.202:13305] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "acuLUhSaDjY9kKFtUQBG6QAAAQU"]
[Tue Mar 31 16:52:34.680282 2026] [:error] [pid 36982:tid 37003] [client 4.223.110.202:13271] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "acuLUvlMmeoQKN0r_GMhUgAAANI"]
[Tue Mar 31 16:52:35.208029 2026] [:error] [pid 36982:tid 36997] [client 4.223.110.202:13307] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "acuLU_lMmeoQKN0r_GMhVgAAAMw"]
[Tue Mar 31 16:52:35.734427 2026] [:error] [pid 36982:tid 37004] [client 4.223.110.202:13128] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "acuLU_lMmeoQKN0r_GMhWgAAANM"]
[Tue Mar 31 16:52:36.259210 2026] [:error] [pid 36982:tid 37000] [client 4.223.110.202:13235] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classgoto24.php"] [unique_id "acuLVPlMmeoQKN0r_GMhYAAAAM8"]
[Tue Mar 31 16:52:36.786657 2026] [:error] [pid 36982:tid 37008] [client 4.223.110.202:13205] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classgoto24.php"] [unique_id "acuLVPlMmeoQKN0r_GMhZwAAANc"]
[Tue Mar 31 16:52:37.311452 2026] [:error] [pid 36982:tid 37004] [client 4.223.110.202:12929] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classgoto24.php"] [unique_id "acuLVflMmeoQKN0r_GMhbgAAANM"]
[Tue Mar 31 16:52:37.846144 2026] [:error] [pid 36892:tid 36965] [client 4.223.110.202:13207] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classgoto24.php"] [unique_id "acuLVUyj9S4G0ek3O4JYDwAAAI4"]
[Tue Mar 31 16:52:38.375955 2026] [:error] [pid 36982:tid 36985] [client 4.223.110.202:12820] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "acuLVvlMmeoQKN0r_GMheQAAAMA"]
[Tue Mar 31 16:52:38.907556 2026] [:error] [pid 41421:tid 41432] [client 4.223.110.202:12803] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "acuLVhSaDjY9kKFtUQBG8AAAAQg"]
[Tue Mar 31 16:52:39.436187 2026] [:error] [pid 36890:tid 36904] [client 4.223.110.202:13193] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "acuLV58FASPd_uH8z7fz0gAAAAk"]
[Tue Mar 31 16:52:39.965966 2026] [:error] [pid 36982:tid 37000] [client 4.223.110.202:12973] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "acuLV_lMmeoQKN0r_GMhigAAAM8"]
[Tue Mar 31 16:52:40.494015 2026] [:error] [pid 36982:tid 36991] [client 4.223.110.202:13301] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acuLWPlMmeoQKN0r_GMhkgAAAMY"]
[Tue Mar 31 16:52:41.033943 2026] [:error] [pid 36891:tid 36928] [client 4.223.110.202:13202] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acuLWZJhiMaJUqoqfl6jkAAAAEQ"]
[Tue Mar 31 16:52:41.561253 2026] [:error] [pid 6548:tid 6569] [client 4.223.110.202:13210] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acuLWbgIz9HgMl9YwE61CgAAAVM"]
[Tue Mar 31 16:52:42.095988 2026] [:error] [pid 36982:tid 37002] [client 4.223.110.202:13247] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws43.php"] [unique_id "acuLWvlMmeoQKN0r_GMhnQAAANE"]
[Tue Mar 31 16:52:42.624018 2026] [:error] [pid 36982:tid 36985] [client 4.223.110.202:12815] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gec.php"] [unique_id "acuLWvlMmeoQKN0r_GMhoQAAAMA"]
[Tue Mar 31 16:52:43.150199 2026] [:error] [pid 36891:tid 36926] [client 4.223.110.202:13204] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gec.php"] [unique_id "acuLW5JhiMaJUqoqfl6jlQAAAEI"]
[Tue Mar 31 16:52:43.677071 2026] [:error] [pid 36982:tid 37004] [client 4.223.110.202:13198] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gec.php"] [unique_id "acuLW_lMmeoQKN0r_GMhqAAAANM"]
[Tue Mar 31 16:52:44.211888 2026] [:error] [pid 6548:tid 6558] [client 4.223.110.202:13220] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gec.php"] [unique_id "acuLXLgIz9HgMl9YwE61DAAAAUg"]
[Tue Mar 31 16:52:44.746130 2026] [:error] [pid 36982:tid 37007] [client 4.223.110.202:13224] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acuLXPlMmeoQKN0r_GMhrgAAANY"]
[Tue Mar 31 16:52:45.272185 2026] [:error] [pid 6548:tid 6565] [client 4.223.110.202:12821] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acuLXbgIz9HgMl9YwE61FQAAAU8"]
[Tue Mar 31 16:52:45.802320 2026] [:error] [pid 6548:tid 6550] [client 4.223.110.202:13212] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acuLXbgIz9HgMl9YwE61FgAAAUA"]
[Tue Mar 31 16:52:46.329283 2026] [:error] [pid 36890:tid 36914] [client 4.223.110.202:13238] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "acuLXp8FASPd_uH8z7fz4gAAABM"]
[Tue Mar 31 16:52:46.882616 2026] [:error] [pid 36890:tid 36909] [client 4.223.110.202:12825] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acuLXp8FASPd_uH8z7fz6gAAAA4"]
[Tue Mar 31 16:52:47.409407 2026] [:error] [pid 36890:tid 36919] [client 4.223.110.202:13228] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acuLX58FASPd_uH8z7fz7gAAABg"]
[Tue Mar 31 16:52:47.941825 2026] [:error] [pid 41421:tid 41436] [client 4.223.110.202:12812] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acuLXxSaDjY9kKFtUQBG9wAAAQw"]
[Tue Mar 31 16:52:48.468803 2026] [:error] [pid 41421:tid 41425] [client 4.223.110.202:13289] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "acuLYBSaDjY9kKFtUQBG-wAAAQE"]
[Tue Mar 31 16:52:49.015711 2026] [:error] [pid 36982:tid 37006] [client 4.223.110.202:12971] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "acuLYflMmeoQKN0r_GMhvAAAANU"]
[Tue Mar 31 16:52:49.542931 2026] [:error] [pid 36892:tid 36956] [client 4.223.110.202:13189] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "acuLYUyj9S4G0ek3O4JYGgAAAIU"]
[Tue Mar 31 16:52:50.069825 2026] [:error] [pid 36982:tid 37007] [client 4.223.110.202:13197] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "acuLYvlMmeoQKN0r_GMhwAAAANY"]
[Tue Mar 31 16:52:50.596481 2026] [:error] [pid 36982:tid 37003] [client 4.223.110.202:12814] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "acuLYvlMmeoQKN0r_GMhxAAAANI"]
[Tue Mar 31 16:52:51.135683 2026] [:error] [pid 36982:tid 36993] [client 4.223.110.202:13161] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acuLY_lMmeoQKN0r_GMhyAAAAMg"]
[Tue Mar 31 16:52:51.672818 2026] [:error] [pid 36892:tid 36951] [client 4.223.110.202:12857] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acuLY0yj9S4G0ek3O4JYHQAAAIA"]
[Tue Mar 31 16:52:52.238849 2026] [:error] [pid 36982:tid 37006] [client 4.223.110.202:13229] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acuLZPlMmeoQKN0r_GMhywAAANU"]
[Tue Mar 31 16:52:52.763627 2026] [:error] [pid 36890:tid 36910] [client 4.223.110.202:12822] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "acuLZJ8FASPd_uH8z7fz-QAAAA8"]
[Tue Mar 31 16:52:53.316746 2026] [:error] [pid 36982:tid 37003] [client 4.223.110.202:12807] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acuLZflMmeoQKN0r_GMh0gAAANI"]
[Tue Mar 31 16:52:53.851382 2026] [:error] [pid 36891:tid 36933] [client 4.223.110.202:12945] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acuLZZJhiMaJUqoqfl6jpAAAAEk"]
[Tue Mar 31 16:52:54.393509 2026] [:error] [pid 6548:tid 6574] [client 4.223.110.202:13246] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acuLZrgIz9HgMl9YwE61MgAAAVg"]
[Tue Mar 31 16:52:54.923651 2026] [:error] [pid 36891:tid 36927] [client 4.223.110.202:13293] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "acuLZpJhiMaJUqoqfl6jpQAAAEM"]
[Tue Mar 31 16:52:55.506428 2026] [:error] [pid 36891:tid 36925] [client 4.223.110.202:13209] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acuLZ5JhiMaJUqoqfl6jqAAAAEE"]
[Tue Mar 31 16:52:56.037647 2026] [:error] [pid 36892:tid 36956] [client 4.223.110.202:12806] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acuLaEyj9S4G0ek3O4JYJQAAAIU"]
[Tue Mar 31 16:52:56.611493 2026] [:error] [pid 36892:tid 36951] [client 4.223.110.202:12809] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acuLaEyj9S4G0ek3O4JYKQAAAIA"]
[Tue Mar 31 16:52:57.147623 2026] [:error] [pid 6548:tid 6551] [client 4.223.110.202:12939] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "acuLabgIz9HgMl9YwE61OgAAAUE"]
[Tue Mar 31 16:52:57.709105 2026] [:error] [pid 36891:tid 36932] [client 4.223.110.202:13185] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acuLaZJhiMaJUqoqfl6jrAAAAEg"]
[Tue Mar 31 16:52:58.245910 2026] [:error] [pid 36892:tid 36974] [client 4.223.110.202:13236] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acuLakyj9S4G0ek3O4JYMQAAAJc"]
[Tue Mar 31 16:52:58.774783 2026] [:error] [pid 36892:tid 36951] [client 4.223.110.202:13244] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acuLakyj9S4G0ek3O4JYOgAAAIA"]
[Tue Mar 31 16:52:59.317310 2026] [:error] [pid 36892:tid 36957] [client 4.223.110.202:13231] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "acuLa0yj9S4G0ek3O4JYPgAAAIY"]
[Tue Mar 31 16:52:59.853726 2026] [:error] [pid 36890:tid 36916] [client 4.223.110.202:13137] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acuLa58FASPd_uH8z7f0AwAAABU"]
[Tue Mar 31 16:53:00.387677 2026] [:error] [pid 36892:tid 36975] [client 4.223.110.202:13310] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acuLbEyj9S4G0ek3O4JYQwAAAJg"]
[Tue Mar 31 16:53:00.922651 2026] [:error] [pid 36982:tid 37008] [client 4.223.110.202:12804] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acuLbPlMmeoQKN0r_GMh6AAAANc"]
[Tue Mar 31 16:53:01.468263 2026] [:error] [pid 36892:tid 36970] [client 4.223.110.202:13218] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "acuLbUyj9S4G0ek3O4JYTAAAAJM"]
[Tue Mar 31 16:53:01.997704 2026] [:error] [pid 41421:tid 41434] [client 4.223.110.202:13222] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acuLbRSaDjY9kKFtUQBHDAAAAQo"]
[Tue Mar 31 16:53:02.562373 2026] [:error] [pid 36890:tid 36912] [client 4.223.110.202:13241] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acuLbp8FASPd_uH8z7f0CQAAABE"]
[Tue Mar 31 16:53:03.107422 2026] [:error] [pid 41421:tid 41431] [client 4.223.110.202:13152] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acuLbxSaDjY9kKFtUQBHEAAAAQc"]
[Tue Mar 31 16:53:03.641165 2026] [:error] [pid 41421:tid 41437] [client 4.223.110.202:13234] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "acuLbxSaDjY9kKFtUQBHGAAAAQ0"]
[Tue Mar 31 16:53:04.189924 2026] [:error] [pid 41421:tid 41429] [client 4.223.110.202:12852] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acuLcBSaDjY9kKFtUQBHGwAAAQU"]
[Tue Mar 31 16:53:04.753532 2026] [:error] [pid 36982:tid 36986] [client 4.223.110.202:12846] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acuLcPlMmeoQKN0r_GMh7wAAAME"]
[Tue Mar 31 16:53:05.288522 2026] [:error] [pid 36982:tid 36994] [client 4.223.110.202:13239] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acuLcflMmeoQKN0r_GMh8gAAAMk"]
[Tue Mar 31 16:53:05.819576 2026] [:error] [pid 36891:tid 36946] [client 4.223.110.202:12817] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "acuLcZJhiMaJUqoqfl6juQAAAFY"]
[Tue Mar 31 16:53:06.354463 2026] [:error] [pid 36982:tid 36986] [client 4.223.110.202:13280] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acuLcvlMmeoQKN0r_GMiAAAAAME"]
[Tue Mar 31 16:53:06.885176 2026] [:error] [pid 36890:tid 36899] [client 4.223.110.202:13130] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acuLcp8FASPd_uH8z7f0EQAAAAQ"]
[Tue Mar 31 16:53:07.413011 2026] [:error] [pid 41421:tid 41428] [client 4.223.110.202:13192] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acuLcxSaDjY9kKFtUQBHJQAAAQQ"]
[Tue Mar 31 16:53:07.939286 2026] [:error] [pid 36982:tid 36985] [client 4.223.110.202:12832] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "acuLc_lMmeoQKN0r_GMiBwAAAMA"]
[Tue Mar 31 16:53:08.476616 2026] [:error] [pid 41421:tid 41431] [client 4.223.110.202:13184] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acuLdBSaDjY9kKFtUQBHKQAAAQc"]
[Tue Mar 31 16:53:09.010447 2026] [:error] [pid 36891:tid 36940] [client 4.223.110.202:13309] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acuLdZJhiMaJUqoqfl6jwAAAAFA"]
[Tue Mar 31 16:53:09.542742 2026] [:error] [pid 36891:tid 36937] [client 4.223.110.202:12844] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "acuLdZJhiMaJUqoqfl6jwQAAAE0"]
[Tue Mar 31 16:53:10.120521 2026] [proxy_fcgi:error] [pid 36982:tid 36995] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:10.388152 2026] [proxy_fcgi:error] [pid 36982:tid 37004] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:10.922776 2026] [proxy_fcgi:error] [pid 36982:tid 37001] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:11.189991 2026] [proxy_fcgi:error] [pid 36982:tid 36999] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:11.460120 2026] [proxy_fcgi:error] [pid 36982:tid 36996] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:11.730184 2026] [proxy_fcgi:error] [pid 36982:tid 36986] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:11.997081 2026] [proxy_fcgi:error] [pid 36982:tid 37006] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:12.289699 2026] [proxy_fcgi:error] [pid 36982:tid 36985] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:12.556446 2026] [proxy_fcgi:error] [pid 36982:tid 36999] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:12.822730 2026] [proxy_fcgi:error] [pid 36982:tid 36998] [client 4.223.110.202:13138] AH01071: Got error 'Primary script unknown'
[Tue Mar 31 16:53:13.086308 2026] [:error] [pid 36982:tid 37005] [client 4.223.110.202:13138] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/20.php"] [unique_id "acuLeflMmeoQKN0r_GMiNQAAANQ"]
[Tue Mar 31 16:53:13.623094 2026] [:error] [pid 6548:tid 6571] [client 4.223.110.202:13245] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/20.php"] [unique_id "acuLebgIz9HgMl9YwE61UwAAAVU"]
[Tue Mar 31 16:53:14.155162 2026] [:error] [pid 36982:tid 36985] [client 4.223.110.202:12853] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/20.php"] [unique_id "acuLevlMmeoQKN0r_GMiPQAAAMA"]
[Tue Mar 31 16:53:14.687277 2026] [:error] [pid 6548:tid 6552] [client 4.223.110.202:13216] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/20.php"] [unique_id "acuLergIz9HgMl9YwE61VQAAAUI"]
[Tue Mar 31 16:53:15.219366 2026] [:error] [pid 36982:tid 37008] [client 4.223.110.202:12835] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "acuLe_lMmeoQKN0r_GMiSwAAANc"]
[Tue Mar 31 16:53:15.762027 2026] [:error] [pid 41421:tid 41443] [client 4.223.110.202:12848] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "acuLexSaDjY9kKFtUQBHNwAAARM"]
[Tue Mar 31 16:53:16.289331 2026] [:error] [pid 36982:tid 36993] [client 4.223.110.202:12842] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "acuLfPlMmeoQKN0r_GMiVgAAAMg"]
[Tue Mar 31 16:53:16.825959 2026] [:error] [pid 41421:tid 41426] [client 4.223.110.202:13150] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "acuLfBSaDjY9kKFtUQBHOQAAAQI"]
[Tue Mar 31 16:53:17.353425 2026] [:error] [pid 36982:tid 36991] [client 4.223.110.202:13286] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c.php"] [unique_id "acuLfflMmeoQKN0r_GMiXQAAAMY"]
[Tue Mar 31 16:53:17.897776 2026] [:error] [pid 6548:tid 6564] [client 4.223.110.202:12847] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c.php"] [unique_id "acuLfbgIz9HgMl9YwE61WAAAAU4"]
[Tue Mar 31 16:53:18.444775 2026] [:error] [pid 36982:tid 36990] [client 4.223.110.202:13071] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c.php"] [unique_id "acuLfvlMmeoQKN0r_GMiaAAAAMU"]
[Tue Mar 31 16:53:18.989152 2026] [:error] [pid 6548:tid 6551] [client 4.223.110.202:12805] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c.php"] [unique_id "acuLfrgIz9HgMl9YwE61WgAAAUE"]
[Tue Mar 31 16:53:19.516515 2026] [:error] [pid 36891:tid 36925] [client 4.223.110.202:13142] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we2.php"] [unique_id "acuLf5JhiMaJUqoqfl6jxgAAAEE"]
[Tue Mar 31 16:53:20.053540 2026] [:error] [pid 41421:tid 41429] [client 4.223.110.202:12827] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we2.php"] [unique_id "acuLgBSaDjY9kKFtUQBHQAAAAQU"]
[Tue Mar 31 16:53:20.584116 2026] [:error] [pid 41421:tid 41431] [client 4.223.110.202:13136] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we2.php"] [unique_id "acuLgBSaDjY9kKFtUQBHQQAAAQc"]
[Tue Mar 31 16:53:21.111766 2026] [:error] [pid 36982:tid 37001] [client 4.223.110.202:12811] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we2.php"] [unique_id "acuLgflMmeoQKN0r_GMidgAAANA"]
[Tue Mar 31 16:53:21.639578 2026] [:error] [pid 36982:tid 36994] [client 4.223.110.202:12831] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/04.php"] [unique_id "acuLgflMmeoQKN0r_GMiegAAAMk"]
[Tue Mar 31 16:53:22.176357 2026] [:error] [pid 41421:tid 41437] [client 4.223.110.202:13175] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/04.php"] [unique_id "acuLghSaDjY9kKFtUQBHRgAAAQ0"]
[Tue Mar 31 16:53:22.704052 2026] [:error] [pid 41421:tid 41433] [client 4.223.110.202:12836] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/04.php"] [unique_id "acuLghSaDjY9kKFtUQBHSgAAAQk"]
[Tue Mar 31 16:53:23.233632 2026] [:error] [pid 36982:tid 36988] [client 4.223.110.202:13147] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/04.php"] [unique_id "acuLg_lMmeoQKN0r_GMifQAAAMM"]
[Tue Mar 31 16:53:23.779486 2026] [:error] [pid 36982:tid 37005] [client 4.223.110.202:13133] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "acuLg_lMmeoQKN0r_GMigAAAANQ"]
[Tue Mar 31 16:53:24.307771 2026] [:error] [pid 36982:tid 37009] [client 4.223.110.202:13210] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "acuLhPlMmeoQKN0r_GMiiQAAANg"]
[Tue Mar 31 16:53:24.838899 2026] [:error] [pid 36982:tid 36994] [client 4.223.110.202:12843] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "acuLhPlMmeoQKN0r_GMikAAAAMk"]
[Tue Mar 31 16:53:25.369278 2026] [:error] [pid 36890:tid 36908] [client 4.223.110.202:13227] [client 4.223.110.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "acuLhZ8FASPd_uH8z7f0IwAAAA0"]
[Tue Mar 31 19:06:07.863017 2026] [:error] [pid 41421:tid 41437] [client 43.157.168.43:34136] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "acuqnxSaDjY9kKFtUQB_HAAAAQ0"]
[Tue Mar 31 22:14:18.789110 2026] [proxy_fcgi:error] [pid 36892:tid 36968] [client 185.165.46.202:60900] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 00:11:38.445190 2026] [:error] [pid 36890:tid 36901] [client 170.106.187.106:40708] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acvyOp8FASPd_uH8z7d7IgAAAAY"]
[Wed Apr 01 01:28:10.660250 2026] [:error] [pid 52836:tid 52896] [client 182.44.10.67:33673] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acwEKpjk_YTY8bXnEz43NwAAAEQ"]
[Wed Apr 01 03:38:08.151227 2026] [:error] [pid 45776:tid 45793] [client 178.151.245.162:34916] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "acwioG827UBx7K9U3bPK4QAAAMo"]
[Wed Apr 01 03:38:10.122314 2026] [:error] [pid 45611:tid 45636] [client 178.151.245.162:49364] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "acwiotKIjAB_8bBReJOyYgAAAA8"]
[Wed Apr 01 03:38:12.153175 2026] [:error] [pid 45613:tid 45704] [client 178.151.245.162:41522] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "acwipHVVWWw8hrj-8EunyQAAAJA"]
[Wed Apr 01 03:38:14.124521 2026] [:error] [pid 45776:tid 45805] [client 178.151.245.162:41532] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "acwipm827UBx7K9U3bPK8wAAANY"]
[Wed Apr 01 03:38:16.119892 2026] [:error] [pid 45776:tid 45797] [client 178.151.245.162:41538] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "acwiqG827UBx7K9U3bPLBgAAAM4"]
[Wed Apr 01 03:38:18.132450 2026] [:error] [pid 45776:tid 45793] [client 178.151.245.162:41546] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "acwiqm827UBx7K9U3bPLEQAAAMo"]
[Wed Apr 01 03:38:20.178352 2026] [:error] [pid 45613:tid 45696] [client 178.151.245.162:41556] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "acwirHVVWWw8hrj-8Eun3gAAAIg"]
[Wed Apr 01 03:38:22.167427 2026] [:error] [pid 45776:tid 45806] [client 178.151.245.162:32912] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "acwirm827UBx7K9U3bPLLQAAANc"]
[Wed Apr 01 03:38:24.148389 2026] [:error] [pid 45776:tid 45794] [client 178.151.245.162:32918] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "acwisG827UBx7K9U3bPLPAAAAMs"]
[Wed Apr 01 03:38:26.136844 2026] [:error] [pid 45613:tid 45706] [client 178.151.245.162:32934] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "acwisnVVWWw8hrj-8Eun9gAAAJI"]
[Wed Apr 01 03:38:28.185962 2026] [:error] [pid 45613:tid 45704] [client 178.151.245.162:32936] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "acwitHVVWWw8hrj-8Eun_AAAAJA"]
[Wed Apr 01 03:38:30.065280 2026] [:error] [pid 45776:tid 45800] [client 178.151.245.162:32950] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "acwitm827UBx7K9U3bPLTwAAANE"]
[Wed Apr 01 03:38:32.085419 2026] [:error] [pid 45776:tid 45785] [client 178.151.245.162:36370] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "acwiuG827UBx7K9U3bPLYwAAAMI"]
[Wed Apr 01 03:38:34.575371 2026] [:error] [pid 45613:tid 45711] [client 178.151.245.162:36378] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "acwiunVVWWw8hrj-8EuoEgAAAJc"]
[Wed Apr 01 03:38:36.608048 2026] [:error] [pid 45613:tid 45699] [client 178.151.245.162:36380] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "acwivHVVWWw8hrj-8EuoIQAAAIs"]
[Wed Apr 01 03:38:38.490925 2026] [:error] [pid 45611:tid 45623] [client 178.151.245.162:36388] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "acwivtKIjAB_8bBReJOyswAAAAM"]
[Wed Apr 01 03:38:40.376396 2026] [:error] [pid 45776:tid 45800] [client 178.151.245.162:37092] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "acwiwG827UBx7K9U3bPLeAAAANE"]
[Wed Apr 01 03:38:42.414446 2026] [:error] [pid 45776:tid 45792] [client 178.151.245.162:37102] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "acwiwm827UBx7K9U3bPLfgAAAMk"]
[Wed Apr 01 03:38:44.342902 2026] [:error] [pid 45613:tid 45709] [client 178.151.245.162:37118] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "acwixHVVWWw8hrj-8EuoUAAAAJU"]
[Wed Apr 01 03:38:46.442253 2026] [:error] [pid 45613:tid 45701] [client 178.151.245.162:37120] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "acwixnVVWWw8hrj-8EuoXAAAAI0"]
[Wed Apr 01 03:38:48.447144 2026] [:error] [pid 45776:tid 45806] [client 178.151.245.162:37132] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "acwiyG827UBx7K9U3bPLoAAAANc"]
[Wed Apr 01 03:38:50.358295 2026] [:error] [pid 45776:tid 45789] [client 178.151.245.162:37612] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "acwiym827UBx7K9U3bPLsQAAAMY"]
[Wed Apr 01 03:38:52.425155 2026] [:error] [pid 45613:tid 45697] [client 178.151.245.162:37616] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "acwizHVVWWw8hrj-8EuobgAAAIk"]
[Wed Apr 01 03:38:54.569732 2026] [:error] [pid 45612:tid 45665] [client 178.151.245.162:37628] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "acwizpHUY7GZN-DbctzQIwAAAEQ"]
[Wed Apr 01 03:38:56.669740 2026] [:error] [pid 45776:tid 45807] [client 178.151.245.162:37640] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "acwi0G827UBx7K9U3bPL3QAAANg"]
[Wed Apr 01 03:38:58.545098 2026] [:error] [pid 45776:tid 45801] [client 178.151.245.162:37644] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "acwi0m827UBx7K9U3bPL6QAAANI"]
[Wed Apr 01 03:39:01.639327 2026] [:error] [pid 45613:tid 45712] [client 178.151.245.162:35572] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "acwi1XVVWWw8hrj-8EuohQAAAJg"]
[Wed Apr 01 03:39:27.417682 2026] [:error] [pid 45776:tid 45802] [client 178.151.245.162:52446] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "acwi72827UBx7K9U3bPMhgAAANM"]
[Wed Apr 01 03:39:29.015324 2026] [:error] [pid 45776:tid 45785] [client 178.151.245.162:46972] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "acwi8W827UBx7K9U3bPMjQAAAMI"]
[Wed Apr 01 03:39:30.893641 2026] [:error] [pid 45776:tid 45788] [client 178.151.245.162:58984] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "acwi8m827UBx7K9U3bPMmgAAAMU"]
[Wed Apr 01 03:39:32.800294 2026] [:error] [pid 45613:tid 45703] [client 178.151.245.162:59000] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "acwi9HVVWWw8hrj-8Euo3AAAAI8"]
[Wed Apr 01 03:39:35.247996 2026] [:error] [pid 45776:tid 45791] [client 178.151.245.162:34092] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "acwi92827UBx7K9U3bPMrwAAAMg"]
[Wed Apr 01 03:39:37.257543 2026] [:error] [pid 45612:tid 45661] [client 178.151.245.162:59010] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "acwi-ZHUY7GZN-DbctzQfwAAAEA"]
[Wed Apr 01 03:39:39.142034 2026] [:error] [pid 45613:tid 45691] [client 178.151.245.162:59016] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "acwi-3VVWWw8hrj-8Euo-gAAAIM"]
[Wed Apr 01 03:39:41.070730 2026] [:error] [pid 45613:tid 45692] [client 178.151.245.162:42028] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "acwi_XVVWWw8hrj-8EupCgAAAIQ"]
[Wed Apr 01 03:39:43.537312 2026] [:error] [pid 45613:tid 45692] [client 178.151.245.162:57858] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "acwi_3VVWWw8hrj-8EupGgAAAIQ"]
[Wed Apr 01 03:39:45.696563 2026] [:error] [pid 45611:tid 45626] [client 178.151.245.162:42034] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "acwjAdKIjAB_8bBReJOzTwAAAAY"]
[Wed Apr 01 03:39:48.150494 2026] [:error] [pid 45776:tid 45783] [client 178.151.245.162:57860] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "acwjBG827UBx7K9U3bPM4QAAAMA"]
[Wed Apr 01 03:39:50.121154 2026] [:error] [pid 45776:tid 45803] [client 178.151.245.162:42042] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "acwjBm827UBx7K9U3bPNCAAAANQ"]
[Wed Apr 01 03:39:52.042125 2026] [:error] [pid 45613:tid 45699] [client 178.151.245.162:50958] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "acwjCHVVWWw8hrj-8EupQwAAAIs"]
[Wed Apr 01 03:39:54.084434 2026] [:error] [pid 45612:tid 45672] [client 178.151.245.162:50966] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "acwjCpHUY7GZN-DbctzQvQAAAEs"]
[Wed Apr 01 03:39:55.957760 2026] [:error] [pid 45612:tid 45685] [client 178.151.245.162:50968] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "acwjC5HUY7GZN-DbctzQwQAAAFg"]
[Wed Apr 01 03:39:58.005155 2026] [:error] [pid 45612:tid 45671] [client 178.151.245.162:50982] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "acwjDpHUY7GZN-DbctzQ0wAAAEo"]
[Wed Apr 01 03:39:59.893249 2026] [:error] [pid 45776:tid 45804] [client 178.151.245.162:50988] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "acwjD2827UBx7K9U3bPNKwAAANU"]
[Wed Apr 01 03:40:02.476620 2026] [:error] [pid 45612:tid 45680] [client 178.151.245.162:36628] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "acwjEpHUY7GZN-DbctzQ3gAAAFM"]
[Wed Apr 01 03:40:04.402875 2026] [:error] [pid 45611:tid 45627] [client 178.151.245.162:48554] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "acwjFNKIjAB_8bBReJOzggAAAAc"]
[Wed Apr 01 03:40:06.856532 2026] [:error] [pid 45613:tid 45691] [client 178.151.245.162:36632] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "acwjFnVVWWw8hrj-8EupZQAAAIM"]
[Wed Apr 01 03:40:09.378623 2026] [:error] [pid 45612:tid 45676] [client 178.151.245.162:36638] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "acwjGZHUY7GZN-DbctzQ7gAAAE8"]
[Wed Apr 01 03:40:11.319033 2026] [:error] [pid 45613:tid 45696] [client 178.151.245.162:47940] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "acwjG3VVWWw8hrj-8EupagAAAIg"]
[Wed Apr 01 03:40:13.358914 2026] [:error] [pid 45613:tid 45707] [client 178.151.245.162:47952] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "acwjHXVVWWw8hrj-8EupcAAAAJM"]
[Wed Apr 01 03:40:15.233081 2026] [:error] [pid 45613:tid 45706] [client 178.151.245.162:47956] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "acwjH3VVWWw8hrj-8EupdgAAAJI"]
[Wed Apr 01 03:40:18.389238 2026] [:error] [pid 45612:tid 45676] [client 178.151.245.162:47968] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "acwjIpHUY7GZN-DbctzQ_wAAAE8"]
[Wed Apr 01 03:40:22.254079 2026] [:error] [pid 45611:tid 45625] [client 178.151.245.162:58638] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "acwjJtKIjAB_8bBReJOzrgAAAAU"]
[Wed Apr 01 06:54:40.343348 2026] [proxy_fcgi:error] [pid 24346:tid 24355] [client 74.248.134.58:61220] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 06:54:40.602682 2026] [proxy_fcgi:error] [pid 24346:tid 24364] [client 74.248.134.58:61220] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 07:11:22.888859 2026] [:error] [pid 23714:tid 23748] [client 43.153.49.151:40062] [client 43.153.49.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acxUmkHxDDU2ETcG9DTgkQAAAA4"]
[Wed Apr 01 07:41:09.105152 2026] [:error] [pid 24348:tid 24402] [client 147.135.214.166:34342] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "acxblW0Vs69Y5nF1HA_s7gAAAZc"]
[Wed Apr 01 07:41:10.753458 2026] [:error] [pid 23714:tid 23735] [client 147.135.214.166:53792] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "acxblkHxDDU2ETcG9DT1FgAAAAE"]
[Wed Apr 01 07:41:12.738647 2026] [:error] [pid 24314:tid 24326] [client 147.135.214.166:42378] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "acxbmJRF3FCzjmMUX5bw1wAAAQg"]
[Wed Apr 01 07:41:14.711857 2026] [:error] [pid 23714:tid 23745] [client 147.135.214.166:42390] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "acxbmkHxDDU2ETcG9DT1HgAAAAs"]
[Wed Apr 01 07:41:17.232464 2026] [:error] [pid 23715:tid 23785] [client 147.135.214.166:44416] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "acxbna-REzOruNbiT9xoHAAAAFg"]
[Wed Apr 01 07:41:19.095475 2026] [:error] [pid 23714:tid 23755] [client 147.135.214.166:41852] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "acxbn0HxDDU2ETcG9DT1NAAAABU"]
[Wed Apr 01 07:41:21.029517 2026] [:error] [pid 23714:tid 23745] [client 147.135.214.166:41856] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "acxboUHxDDU2ETcG9DT1OwAAAAs"]
[Wed Apr 01 07:41:23.655865 2026] [:error] [pid 23716:tid 23805] [client 147.135.214.166:44420] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "acxbo3VtFUg_mx-RYb5xVAAAAJE"]
[Wed Apr 01 07:41:25.578473 2026] [:error] [pid 24346:tid 24375] [client 147.135.214.166:45826] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "acxbpbc1l8kg9MhGHIKZDAAAAVc"]
[Wed Apr 01 07:41:27.699411 2026] [:error] [pid 24346:tid 24355] [client 147.135.214.166:45832] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "acxbp7c1l8kg9MhGHIKZDgAAAUM"]
[Wed Apr 01 07:41:29.737316 2026] [:error] [pid 23714:tid 23748] [client 147.135.214.166:45848] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "acxbqUHxDDU2ETcG9DT1QgAAAA4"]
[Wed Apr 01 07:41:31.620219 2026] [:error] [pid 24348:tid 24380] [client 147.135.214.166:45854] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "acxbq20Vs69Y5nF1HA_tGQAAAYE"]
[Wed Apr 01 07:41:33.516837 2026] [:error] [pid 24348:tid 24397] [client 147.135.214.166:45868] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "acxbrW0Vs69Y5nF1HA_tGgAAAZI"]
[Wed Apr 01 07:41:35.550142 2026] [:error] [pid 23714:tid 23743] [client 147.135.214.166:36654] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "acxbr0HxDDU2ETcG9DT1XQAAAAk"]
[Wed Apr 01 07:41:38.210288 2026] [:error] [pid 23715:tid 23772] [client 147.135.214.166:37086] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "acxbsq-REzOruNbiT9xodAAAAEs"]
[Wed Apr 01 07:41:40.759114 2026] [:error] [pid 23714:tid 23754] [client 147.135.214.166:37096] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "acxbtEHxDDU2ETcG9DT1aQAAABQ"]
[Wed Apr 01 07:41:43.190970 2026] [:error] [pid 23715:tid 23763] [client 147.135.214.166:37106] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "acxbt6-REzOruNbiT9xomwAAAEI"]
[Wed Apr 01 07:41:45.040964 2026] [:error] [pid 23715:tid 23770] [client 147.135.214.166:36670] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "acxbua-REzOruNbiT9xopAAAAEk"]
[Wed Apr 01 07:41:47.424698 2026] [:error] [pid 23714:tid 23738] [client 147.135.214.166:39144] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "acxbu0HxDDU2ETcG9DT1eAAAAAQ"]
[Wed Apr 01 07:41:49.966458 2026] [:error] [pid 24346:tid 24376] [client 147.135.214.166:39150] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "acxbvbc1l8kg9MhGHIKZSQAAAVg"]
[Wed Apr 01 07:41:51.967867 2026] [:error] [pid 23715:tid 23779] [client 147.135.214.166:39508] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "acxbv6-REzOruNbiT9xowAAAAFI"]
[Wed Apr 01 07:41:54.409550 2026] [:error] [pid 23819:tid 23842] [client 147.135.214.166:39166] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "acxbwtdfUS_37wFAM77xwgAAANQ"]
[Wed Apr 01 07:41:56.893629 2026] [:error] [pid 23714:tid 23749] [client 147.135.214.166:60186] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "acxbxEHxDDU2ETcG9DT1sQAAAA8"]
[Wed Apr 01 07:41:58.800638 2026] [:error] [pid 24348:tid 24395] [client 147.135.214.166:50364] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "acxbxm0Vs69Y5nF1HA_tVgAAAZA"]
[Wed Apr 01 07:42:01.359917 2026] [:error] [pid 23716:tid 23802] [client 147.135.214.166:60194] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "acxbyXVtFUg_mx-RYb5xYgAAAI4"]
[Wed Apr 01 07:42:03.189765 2026] [:error] [pid 23716:tid 23811] [client 147.135.214.166:50380] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "acxby3VtFUg_mx-RYb5xZQAAAJc"]
[Wed Apr 01 07:42:05.580286 2026] [:error] [pid 23714:tid 23744] [client 147.135.214.166:60202] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "acxbzUHxDDU2ETcG9DT18AAAAAo"]
[Wed Apr 01 07:42:29.105355 2026] [:error] [pid 23716:tid 23802] [client 147.135.214.166:50428] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "acxb5XVtFUg_mx-RYb5xfgAAAI4"]
[Wed Apr 01 07:42:31.533298 2026] [:error] [pid 23716:tid 23788] [client 147.135.214.166:42696] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "acxb53VtFUg_mx-RYb5xhwAAAIA"]
[Wed Apr 01 07:42:33.564912 2026] [:error] [pid 23819:tid 23836] [client 147.135.214.166:46792] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "acxb6ddfUS_37wFAM77x2gAAAM4"]
[Wed Apr 01 07:42:36.112059 2026] [:error] [pid 23714:tid 23744] [client 147.135.214.166:48232] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "acxb7EHxDDU2ETcG9DT2NAAAAAo"]
[Wed Apr 01 07:42:38.075600 2026] [:error] [pid 23714:tid 23743] [client 147.135.214.166:52108] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "acxb7kHxDDU2ETcG9DT2PgAAAAk"]
[Wed Apr 01 07:42:40.556213 2026] [:error] [pid 24346:tid 24363] [client 147.135.214.166:48234] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "acxb8Lc1l8kg9MhGHIKZYwAAAUs"]
[Wed Apr 01 07:42:42.912660 2026] [:error] [pid 23714:tid 23749] [client 147.135.214.166:48240] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "acxb8kHxDDU2ETcG9DT2SQAAAA8"]
[Wed Apr 01 07:42:45.358779 2026] [:error] [pid 24314:tid 24337] [client 147.135.214.166:48246] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "acxb9ZRF3FCzjmMUX5bxBAAAARM"]
[Wed Apr 01 07:42:47.351156 2026] [:error] [pid 23715:tid 23767] [client 147.135.214.166:46290] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "acxb96-REzOruNbiT9xo_gAAAEY"]
[Wed Apr 01 07:42:49.343338 2026] [:error] [pid 23819:tid 23837] [client 147.135.214.166:46304] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "acxb-ddfUS_37wFAM77x6QAAAM8"]
[Wed Apr 01 07:42:51.326191 2026] [:error] [pid 23715:tid 23771] [client 147.135.214.166:46310] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "acxb-6-REzOruNbiT9xpBgAAAEo"]
[Wed Apr 01 07:42:53.834184 2026] [:error] [pid 23715:tid 23768] [client 147.135.214.166:54320] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "acxb_a-REzOruNbiT9xpDwAAAEc"]
[Wed Apr 01 07:42:55.677895 2026] [:error] [pid 24348:tid 24400] [client 147.135.214.166:46228] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "acxb_20Vs69Y5nF1HA_tgQAAAZU"]
[Wed Apr 01 07:42:57.642598 2026] [:error] [pid 24348:tid 24386] [client 147.135.214.166:46236] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "acxcAW0Vs69Y5nF1HA_thgAAAYc"]
[Wed Apr 01 07:42:59.630115 2026] [:error] [pid 23714:tid 23742] [client 147.135.214.166:46242] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "acxcA0HxDDU2ETcG9DT2WwAAAAg"]
[Wed Apr 01 07:43:01.429156 2026] [:error] [pid 23819:tid 23839] [client 147.135.214.166:46252] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "acxcBddfUS_37wFAM77x7AAAANE"]
[Wed Apr 01 07:43:03.418166 2026] [:error] [pid 23715:tid 23766] [client 147.135.214.166:46260] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "acxcB6-REzOruNbiT9xpJAAAAEU"]
[Wed Apr 01 07:43:05.473958 2026] [:error] [pid 23714:tid 23746] [client 147.135.214.166:44780] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "acxcCUHxDDU2ETcG9DT2bQAAAAw"]
[Wed Apr 01 07:43:08.098632 2026] [:error] [pid 23715:tid 23772] [client 147.135.214.166:34182] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "acxcDK-REzOruNbiT9xpJwAAAEs"]
[Wed Apr 01 07:43:09.950787 2026] [:error] [pid 23714:tid 23745] [client 147.135.214.166:44790] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "acxcDUHxDDU2ETcG9DT2dAAAAAs"]
[Wed Apr 01 07:43:12.090812 2026] [:error] [pid 24346:tid 24366] [client 147.135.214.166:44796] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "acxcELc1l8kg9MhGHIKZiwAAAU4"]
[Wed Apr 01 07:43:14.703286 2026] [:error] [pid 23715:tid 23764] [client 147.135.214.166:34192] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "acxcEq-REzOruNbiT9xpQwAAAEM"]
[Wed Apr 01 07:43:16.721121 2026] [:error] [pid 23714:tid 23748] [client 147.135.214.166:37550] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "acxcFEHxDDU2ETcG9DT2fAAAAA4"]
[Wed Apr 01 07:43:18.663623 2026] [:error] [pid 23716:tid 23801] [client 147.135.214.166:37562] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "acxcFnVtFUg_mx-RYb5xnwAAAI0"]
[Wed Apr 01 07:43:21.006724 2026] [:error] [pid 23716:tid 23804] [client 147.135.214.166:36626] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "acxcGXVtFUg_mx-RYb5xpgAAAJA"]
[Wed Apr 01 07:43:22.801676 2026] [:error] [pid 23714:tid 23736] [client 147.135.214.166:37578] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "acxcGkHxDDU2ETcG9DT2kwAAAAI"]
[Wed Apr 01 07:43:24.639999 2026] [:error] [pid 23715:tid 23764] [client 147.135.214.166:37588] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "acxcHK-REzOruNbiT9xpTgAAAEM"]
[Wed Apr 01 07:43:26.477266 2026] [:error] [pid 23715:tid 23780] [client 147.135.214.166:38960] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "acxcHq-REzOruNbiT9xpVgAAAFM"]
[Wed Apr 01 07:43:49.289316 2026] [:error] [pid 23716:tid 23793] [client 147.135.214.166:54674] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "acxcNXVtFUg_mx-RYb5xsgAAAIU"]
[Wed Apr 01 07:43:51.140055 2026] [:error] [pid 24346:tid 24363] [client 147.135.214.166:38970] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "acxcN7c1l8kg9MhGHIKZrgAAAUs"]
[Wed Apr 01 07:43:52.992112 2026] [:error] [pid 23715:tid 23774] [client 147.135.214.166:45298] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "acxcOK-REzOruNbiT9xpgAAAAE0"]
[Wed Apr 01 07:43:55.436834 2026] [:error] [pid 23819:tid 23822] [client 147.135.214.166:54682] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "acxcO9dfUS_37wFAM77yDgAAAMA"]
[Wed Apr 01 07:43:57.953770 2026] [:error] [pid 23715:tid 23779] [client 147.135.214.166:56222] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "acxcPa-REzOruNbiT9xpjgAAAFI"]
[Wed Apr 01 07:44:00.022905 2026] [:error] [pid 23716:tid 23812] [client 147.135.214.166:36432] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "acxcQHVtFUg_mx-RYb5xuAAAAJg"]
[Wed Apr 01 07:44:02.455745 2026] [:error] [pid 24346:tid 24363] [client 147.135.214.166:56228] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "acxcQrc1l8kg9MhGHIKZyQAAAUs"]
[Wed Apr 01 07:44:04.393589 2026] [:error] [pid 23715:tid 23780] [client 147.135.214.166:36448] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "acxcRK-REzOruNbiT9xplQAAAFM"]
[Wed Apr 01 07:44:06.863673 2026] [:error] [pid 23716:tid 23807] [client 147.135.214.166:57252] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "acxcRnVtFUg_mx-RYb5xvQAAAJM"]
[Wed Apr 01 07:44:09.433955 2026] [:error] [pid 24348:tid 24387] [client 147.135.214.166:57266] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "acxcSW0Vs69Y5nF1HA_tyAAAAYg"]
[Wed Apr 01 07:44:11.509933 2026] [:error] [pid 24346:tid 24354] [client 147.135.214.166:42268] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "acxcS7c1l8kg9MhGHIKZzwAAAUI"]
[Wed Apr 01 07:44:13.903749 2026] [:error] [pid 23714:tid 23749] [client 147.135.214.166:57268] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "acxcTUHxDDU2ETcG9DT25gAAAA8"]
[Wed Apr 01 07:44:15.830037 2026] [:error] [pid 23715:tid 23778] [client 147.135.214.166:51804] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "acxcT6-REzOruNbiT9xpqgAAAFE"]
[Wed Apr 01 07:44:18.245999 2026] [:error] [pid 23714:tid 23740] [client 147.135.214.166:59938] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "acxcUkHxDDU2ETcG9DT29QAAAAY"]
[Wed Apr 01 07:44:20.182795 2026] [:error] [pid 23714:tid 23755] [client 147.135.214.166:51810] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "acxcVEHxDDU2ETcG9DT2-gAAABU"]
[Wed Apr 01 07:44:22.487003 2026] [:error] [pid 23715:tid 23768] [client 147.135.214.166:59954] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "acxcVq-REzOruNbiT9xpsQAAAEc"]
[Wed Apr 01 07:44:24.919451 2026] [:error] [pid 23716:tid 23790] [client 147.135.214.166:59958] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "acxcWHVtFUg_mx-RYb5xwAAAAII"]
[Wed Apr 01 07:44:26.976766 2026] [:error] [pid 23715:tid 23780] [client 147.135.214.166:48860] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "acxcWq-REzOruNbiT9xptwAAAFM"]
[Wed Apr 01 07:44:29.517661 2026] [:error] [pid 23714:tid 23738] [client 147.135.214.166:48014] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "acxcXUHxDDU2ETcG9DT3GQAAAAQ"]
[Wed Apr 01 07:44:31.306024 2026] [:error] [pid 23715:tid 23774] [client 147.135.214.166:48872] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "acxcX6-REzOruNbiT9xpvgAAAE0"]
[Wed Apr 01 07:44:33.780140 2026] [:error] [pid 23715:tid 23772] [client 147.135.214.166:48028] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "acxcYa-REzOruNbiT9xpyAAAAEs"]
[Wed Apr 01 07:44:36.292776 2026] [:error] [pid 23819:tid 23846] [client 147.135.214.166:33862] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "acxcZNdfUS_37wFAM77yHQAAANg"]
[Wed Apr 01 07:44:38.202064 2026] [:error] [pid 24314:tid 24331] [client 147.135.214.166:48338] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "acxcZpRF3FCzjmMUX5bxWwAAAQ0"]
[Wed Apr 01 07:44:40.614550 2026] [:error] [pid 23714:tid 23739] [client 147.135.214.166:33870] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "acxcaEHxDDU2ETcG9DT3PQAAAAU"]
[Wed Apr 01 07:44:43.145177 2026] [:error] [pid 24346:tid 24356] [client 147.135.214.166:33878] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "acxca7c1l8kg9MhGHIKZ4wAAAUQ"]
[Wed Apr 01 07:44:45.678700 2026] [:error] [pid 23716:tid 23803] [client 147.135.214.166:39204] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "acxcbXVtFUg_mx-RYb5x0wAAAI8"]
[Wed Apr 01 07:45:07.031283 2026] [:error] [pid 23819:tid 23835] [client 147.135.214.166:40098] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "acxcg9dfUS_37wFAM77yWgAAAM0"]
[Wed Apr 01 07:45:08.908891 2026] [:error] [pid 24348:tid 24395] [client 147.135.214.166:40114] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "acxchG0Vs69Y5nF1HA_uCQAAAZA"]
[Wed Apr 01 07:45:10.825685 2026] [:error] [pid 23714:tid 23743] [client 147.135.214.166:40128] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "acxchkHxDDU2ETcG9DT3awAAAAk"]
[Wed Apr 01 07:45:12.750770 2026] [:error] [pid 24346:tid 24374] [client 147.135.214.166:40130] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "acxciLc1l8kg9MhGHIKaEAAAAVY"]
[Wed Apr 01 07:45:14.636855 2026] [:error] [pid 23716:tid 23803] [client 147.135.214.166:40138] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "acxcinVtFUg_mx-RYb5x7AAAAI8"]
[Wed Apr 01 07:45:16.566824 2026] [:error] [pid 23714:tid 23743] [client 147.135.214.166:39094] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "acxcjEHxDDU2ETcG9DT3eAAAAAk"]
[Wed Apr 01 07:45:18.492993 2026] [:error] [pid 23714:tid 23756] [client 147.135.214.166:39110] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "acxcjkHxDDU2ETcG9DT3ggAAABY"]
[Wed Apr 01 07:45:20.543251 2026] [:error] [pid 23714:tid 23734] [client 147.135.214.166:39114] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "acxckEHxDDU2ETcG9DT3lAAAAAA"]
[Wed Apr 01 07:45:22.453425 2026] [:error] [pid 23714:tid 23749] [client 147.135.214.166:39120] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "acxckkHxDDU2ETcG9DT3pQAAAA8"]
[Wed Apr 01 07:45:24.361811 2026] [:error] [pid 23714:tid 23747] [client 147.135.214.166:39130] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "acxclEHxDDU2ETcG9DT3vwAAAA0"]
[Wed Apr 01 07:45:26.242563 2026] [:error] [pid 24348:tid 24381] [client 147.135.214.166:59988] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "acxclm0Vs69Y5nF1HA_uFgAAAYI"]
[Wed Apr 01 07:45:28.259861 2026] [:error] [pid 23715:tid 23766] [client 147.135.214.166:59994] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "acxcmK-REzOruNbiT9xqBwAAAEU"]
[Wed Apr 01 07:45:30.167711 2026] [:error] [pid 23716:tid 23791] [client 147.135.214.166:59998] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "acxcmnVtFUg_mx-RYb5x9AAAAIM"]
[Wed Apr 01 07:45:32.060503 2026] [:error] [pid 24314:tid 24330] [client 147.135.214.166:60006] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "acxcnJRF3FCzjmMUX5bxhQAAAQw"]
[Wed Apr 01 07:45:34.087187 2026] [:error] [pid 23714:tid 23737] [client 147.135.214.166:60010] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "acxcnkHxDDU2ETcG9DT35AAAAAM"]
[Wed Apr 01 07:45:35.980944 2026] [:error] [pid 24346:tid 24368] [client 147.135.214.166:41804] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "acxcn7c1l8kg9MhGHIKaJgAAAVA"]
[Wed Apr 01 07:45:38.011883 2026] [:error] [pid 23715:tid 23783] [client 147.135.214.166:41808] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "acxcoq-REzOruNbiT9xqGQAAAFY"]
[Wed Apr 01 07:45:40.039821 2026] [:error] [pid 24348:tid 24380] [client 147.135.214.166:41814] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "acxcpG0Vs69Y5nF1HA_uLgAAAYE"]
[Wed Apr 01 07:45:41.933064 2026] [:error] [pid 24346:tid 24361] [client 147.135.214.166:41830] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "acxcpbc1l8kg9MhGHIKaNAAAAUk"]
[Wed Apr 01 07:45:43.829396 2026] [:error] [pid 23714:tid 23737] [client 147.135.214.166:41838] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "acxcp0HxDDU2ETcG9DT3-gAAAAM"]
[Wed Apr 01 07:45:45.870036 2026] [:error] [pid 23715:tid 23768] [client 147.135.214.166:48318] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "acxcqa-REzOruNbiT9xqHgAAAEc"]
[Wed Apr 01 07:45:47.754949 2026] [:error] [pid 24346:tid 24366] [client 147.135.214.166:48328] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "acxcq7c1l8kg9MhGHIKaOgAAAU4"]
[Wed Apr 01 07:45:49.807778 2026] [:error] [pid 23716:tid 23812] [client 147.135.214.166:48340] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "acxcrXVtFUg_mx-RYb5yAwAAAJg"]
[Wed Apr 01 07:45:51.927741 2026] [:error] [pid 23714:tid 23752] [client 147.135.214.166:48348] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "acxcr0HxDDU2ETcG9DT4CwAAABI"]
[Wed Apr 01 07:45:53.837699 2026] [:error] [pid 24348:tid 24388] [client 147.135.214.166:48358] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "acxcsW0Vs69Y5nF1HA_uRgAAAYk"]
[Wed Apr 01 07:45:55.587320 2026] [:error] [pid 23714:tid 23746] [client 147.135.214.166:50726] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "acxcs0HxDDU2ETcG9DT4EwAAAAw"]
[Wed Apr 01 07:45:57.630723 2026] [:error] [pid 23819:tid 23840] [client 147.135.214.166:50740] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "acxctddfUS_37wFAM77yiAAAANI"]
[Wed Apr 01 07:45:59.550361 2026] [:error] [pid 23714:tid 23754] [client 147.135.214.166:50756] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "acxct0HxDDU2ETcG9DT4JQAAABQ"]
[Wed Apr 01 07:46:01.561062 2026] [:error] [pid 24348:tid 24389] [client 147.135.214.166:50764] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "acxcuW0Vs69Y5nF1HA_uVAAAAYo"]
[Wed Apr 01 07:46:03.448261 2026] [:error] [pid 23715:tid 23779] [client 147.135.214.166:50776] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "acxcu6-REzOruNbiT9xqLgAAAFI"]
[Wed Apr 01 09:30:51.947241 2026] [:error] [pid 23716:tid 23789] [client 65.108.125.120:64732] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "acx1S3VtFUg_mx-RYb6aqQAAAIE"]
[Wed Apr 01 09:30:54.568124 2026] [:error] [pid 23714:tid 23754] [client 65.108.125.120:64748] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "acx1TkHxDDU2ETcG9DRI4gAAABQ"]
[Wed Apr 01 09:30:56.895808 2026] [:error] [pid 24348:tid 24400] [client 65.108.125.120:64758] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "acx1UG0Vs69Y5nF1HA8XsgAAAZU"]
[Wed Apr 01 09:30:59.355211 2026] [:error] [pid 23716:tid 23799] [client 65.108.125.120:20952] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "acx1U3VtFUg_mx-RYb6aywAAAIs"]
[Wed Apr 01 09:31:01.954852 2026] [:error] [pid 23716:tid 23796] [client 65.108.125.120:20956] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "acx1VXVtFUg_mx-RYb6a1AAAAIg"]
[Wed Apr 01 09:31:04.409885 2026] [:error] [pid 23714:tid 23737] [client 65.108.125.120:20962] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "acx1WEHxDDU2ETcG9DRI-wAAAAM"]
[Wed Apr 01 09:31:06.739221 2026] [:error] [pid 23715:tid 23770] [client 65.108.125.120:20966] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "acx1Wq-REzOruNbiT9ySmAAAAEk"]
[Wed Apr 01 09:31:09.320582 2026] [:error] [pid 23716:tid 23799] [client 65.108.125.120:35156] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "acx1XXVtFUg_mx-RYb6a3wAAAIs"]
[Wed Apr 01 09:31:11.915727 2026] [:error] [pid 23716:tid 23791] [client 65.108.125.120:35166] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "acx1X3VtFUg_mx-RYb6a5QAAAIM"]
[Wed Apr 01 09:31:14.374094 2026] [:error] [pid 23714:tid 23748] [client 65.108.125.120:35180] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "acx1YkHxDDU2ETcG9DRJFAAAAA4"]
[Wed Apr 01 09:31:16.987672 2026] [:error] [pid 24348:tid 24389] [client 65.108.125.120:35182] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "acx1ZG0Vs69Y5nF1HA8X1QAAAYo"]
[Wed Apr 01 09:31:19.476176 2026] [:error] [pid 23716:tid 23803] [client 65.108.125.120:10586] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "acx1Z3VtFUg_mx-RYb6a9gAAAI8"]
[Wed Apr 01 09:31:22.072601 2026] [:error] [pid 23716:tid 23791] [client 65.108.125.120:10596] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "acx1anVtFUg_mx-RYb6bCAAAAIM"]
[Wed Apr 01 09:31:24.681896 2026] [:error] [pid 23819:tid 23846] [client 65.108.125.120:10602] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "acx1bNdfUS_37wFAM74M6wAAANg"]
[Wed Apr 01 09:31:27.268220 2026] [:error] [pid 23819:tid 23840] [client 65.108.125.120:10612] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "acx1b9dfUS_37wFAM74M9AAAANI"]
[Wed Apr 01 09:31:29.745108 2026] [:error] [pid 23715:tid 23772] [client 65.108.125.120:46358] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "acx1ca-REzOruNbiT9yStQAAAEs"]
[Wed Apr 01 09:31:32.330525 2026] [:error] [pid 24346:tid 24369] [client 65.108.125.120:46374] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "acx1dLc1l8kg9MhGHIK1MwAAAVE"]
[Wed Apr 01 09:31:34.858543 2026] [:error] [pid 23716:tid 23812] [client 65.108.125.120:46376] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "acx1dnVtFUg_mx-RYb6bMwAAAJg"]
[Wed Apr 01 09:31:37.385713 2026] [:error] [pid 23714:tid 23742] [client 65.108.125.120:46386] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "acx1eUHxDDU2ETcG9DRJWAAAAAg"]
[Wed Apr 01 09:31:39.988338 2026] [:error] [pid 24348:tid 24398] [client 65.108.125.120:59498] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "acx1e20Vs69Y5nF1HA8X9AAAAZM"]
[Wed Apr 01 09:31:42.299543 2026] [:error] [pid 23819:tid 23833] [client 65.108.125.120:59512] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "acx1ftdfUS_37wFAM74NBgAAAMs"]
[Wed Apr 01 09:31:44.637484 2026] [:error] [pid 24314:tid 24337] [client 65.108.125.120:59526] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "acx1gJRF3FCzjmMUX5YJZQAAARM"]
[Wed Apr 01 09:31:47.158135 2026] [:error] [pid 23714:tid 23749] [client 65.108.125.120:59528] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "acx1g0HxDDU2ETcG9DRJbQAAAA8"]
[Wed Apr 01 09:32:17.439332 2026] [:error] [pid 23716:tid 23791] [client 65.108.125.120:50738] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "acx1oXVtFUg_mx-RYb6bkwAAAIM"]
[Wed Apr 01 09:32:19.770675 2026] [:error] [pid 24348:tid 24390] [client 65.108.125.120:38006] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "acx1o20Vs69Y5nF1HA8YNgAAAYs"]
[Wed Apr 01 09:32:22.226920 2026] [:error] [pid 23716:tid 23811] [client 65.108.125.120:38012] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "acx1pnVtFUg_mx-RYb6bpgAAAJc"]
[Wed Apr 01 09:32:24.946193 2026] [:error] [pid 23716:tid 23798] [client 65.108.125.120:38014] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "acx1qHVtFUg_mx-RYb6bqgAAAIo"]
[Wed Apr 01 09:32:27.531663 2026] [:error] [pid 23716:tid 23796] [client 65.108.125.120:38026] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "acx1q3VtFUg_mx-RYb6bsQAAAIg"]
[Wed Apr 01 09:32:30.030253 2026] [:error] [pid 24346:tid 24363] [client 65.108.125.120:46166] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "acx1rrc1l8kg9MhGHIK1bwAAAUs"]
[Wed Apr 01 09:32:32.624052 2026] [:error] [pid 23714:tid 23747] [client 65.108.125.120:46176] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "acx1sEHxDDU2ETcG9DRKOQAAAA0"]
[Wed Apr 01 09:32:35.098326 2026] [:error] [pid 23714:tid 23745] [client 65.108.125.120:46186] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "acx1s0HxDDU2ETcG9DRKSAAAAAs"]
[Wed Apr 01 12:47:51.311307 2026] [proxy_fcgi:error] [pid 36753:tid 36811] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:51.456478 2026] [proxy_fcgi:error] [pid 36753:tid 36808] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:51.597874 2026] [proxy_fcgi:error] [pid 36753:tid 36789] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:51.738252 2026] [proxy_fcgi:error] [pid 36753:tid 36807] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.035250 2026] [proxy_fcgi:error] [pid 36753:tid 36798] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.177189 2026] [proxy_fcgi:error] [pid 36753:tid 36809] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.322549 2026] [proxy_fcgi:error] [pid 36753:tid 36796] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.464050 2026] [proxy_fcgi:error] [pid 36753:tid 36787] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.607122 2026] [proxy_fcgi:error] [pid 36753:tid 36806] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.748521 2026] [proxy_fcgi:error] [pid 36753:tid 36797] [client 20.198.86.98:3597] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 12:47:52.885917 2026] [:error] [pid 36753:tid 36792] [client 20.198.86.98:3597] [client 20.198.86.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acyjeHlB4jUXc8OYIiphKwAAAsU"]
[Wed Apr 01 12:47:53.469745 2026] [:error] [pid 23819:tid 23826] [client 20.198.86.98:3613] [client 20.198.86.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acyjeddfUS_37wFAM75MIAAAAMQ"]
[Wed Apr 01 12:47:54.034335 2026] [:error] [pid 23819:tid 23840] [client 20.198.86.98:3606] [client 20.198.86.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acyjetdfUS_37wFAM75MIgAAANI"]
[Wed Apr 01 12:47:54.588997 2026] [:error] [pid 24348:tid 24393] [client 20.198.86.98:3638] [client 20.198.86.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "acyjem0Vs69Y5nF1HA9m-AAAAY4"]
[Wed Apr 01 14:12:55.367619 2026] [:error] [pid 8995:tid 9015] [client 182.44.8.254:55429] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "acy3Z-onaBjs3qxcRecjQQAAABE"]
[Wed Apr 01 14:50:42.957121 2026] [:error] [pid 8908:tid 8935] [client 49.51.141.76:54202] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aczAQvkmxtJXGnLdvgDOjAAAAJY"]
[Wed Apr 01 22:22:25.975788 2026] [proxy_fcgi:error] [pid 8910:tid 8989] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:26.216799 2026] [proxy_fcgi:error] [pid 8910:tid 8977] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:26.539778 2026] [proxy_fcgi:error] [pid 8910:tid 8978] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:27.132896 2026] [proxy_fcgi:error] [pid 8910:tid 8991] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:27.898013 2026] [proxy_fcgi:error] [pid 8910:tid 8992] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:28.137739 2026] [proxy_fcgi:error] [pid 8910:tid 8968] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:28.619860 2026] [proxy_fcgi:error] [pid 8910:tid 8976] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:28.910649 2026] [proxy_fcgi:error] [pid 8910:tid 8990] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:29.202924 2026] [proxy_fcgi:error] [pid 8910:tid 8979] [client 51.103.96.231:47585] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:22:29.555752 2026] [:error] [pid 8910:tid 8973] [client 51.103.96.231:47585] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac0qJaJZINUcF3tYgEx0OwAAAQU"]
[Wed Apr 01 22:22:30.321382 2026] [:error] [pid 62559:tid 62575] [client 51.103.96.231:38861] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac0qJi7NKI8IaNKZFIfACgAAAU4"]
[Wed Apr 01 22:22:31.297855 2026] [:error] [pid 62559:tid 62570] [client 51.103.96.231:57876] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac0qJy7NKI8IaNKZFIfADgAAAUk"]
[Wed Apr 01 22:22:32.200458 2026] [:error] [pid 8909:tid 8956] [client 51.103.96.231:63021] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac0qKDvP_a0662gDl6D1YwAAAM8"]
[Wed Apr 01 22:22:33.430608 2026] [:error] [pid 62559:tid 62579] [client 51.103.96.231:57909] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac0qKS7NKI8IaNKZFIfAFQAAAVI"]
[Wed Apr 01 22:22:34.157025 2026] [:error] [pid 8910:tid 8992] [client 51.103.96.231:57903] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac0qKqJZINUcF3tYgEx0PAAAARg"]
[Wed Apr 01 22:22:35.568962 2026] [:error] [pid 8909:tid 8951] [client 51.103.96.231:54526] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac0qKzvP_a0662gDl6D1bQAAAMo"]
[Wed Apr 01 22:22:36.310741 2026] [:error] [pid 62559:tid 62572] [client 51.103.96.231:49428] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac0qLC7NKI8IaNKZFIfAGwAAAUs"]
[Wed Apr 01 22:22:36.976785 2026] [:error] [pid 17856:tid 17863] [client 51.103.96.231:62250] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "ac0qLD7Idlm5j9frhqRmhQAAAEU"]
[Wed Apr 01 22:22:37.629863 2026] [:error] [pid 17856:tid 17870] [client 51.103.96.231:38128] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0qLT7Idlm5j9frhqRmhgAAAEw"]
[Wed Apr 01 22:22:38.655531 2026] [:error] [pid 17856:tid 17873] [client 51.103.96.231:47532] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0qLj7Idlm5j9frhqRmigAAAE8"]
[Wed Apr 01 22:22:39.190086 2026] [:error] [pid 17856:tid 17879] [client 51.103.96.231:5828] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0qLz7Idlm5j9frhqRmjAAAAFU"]
[Wed Apr 01 22:22:39.926745 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:62248] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0qLy7NKI8IaNKZFIfANAAAAUU"]
[Wed Apr 01 22:22:40.567138 2026] [:error] [pid 62559:tid 62574] [client 51.103.96.231:57856] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac0qMC7NKI8IaNKZFIfAPgAAAU0"]
[Wed Apr 01 22:22:41.443070 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:41096] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac0qMfkmxtJXGnLdvgCtzAAAAIE"]
[Wed Apr 01 22:22:42.041454 2026] [:error] [pid 8910:tid 8984] [client 51.103.96.231:36383] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac0qMqJZINUcF3tYgEx0RgAAARA"]
[Wed Apr 01 22:22:42.813254 2026] [:error] [pid 8908:tid 8924] [client 51.103.96.231:64952] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac0qMvkmxtJXGnLdvgCtzgAAAIs"]
[Wed Apr 01 22:22:43.894377 2026] [:error] [pid 62559:tid 62562] [client 51.103.96.231:53699] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0qMy7NKI8IaNKZFIfAVgAAAUE"]
[Wed Apr 01 22:22:45.373108 2026] [:error] [pid 8908:tid 8935] [client 51.103.96.231:39072] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0qNfkmxtJXGnLdvgCt0AAAAJY"]
[Wed Apr 01 22:23:14.278880 2026] [:error] [pid 8909:tid 8951] [client 51.103.96.231:51996] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ac0qUjvP_a0662gDl6D1mgAAAMo"]
[Wed Apr 01 22:23:17.300470 2026] [:error] [pid 8910:tid 8968] [client 51.103.96.231:64583] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ac0qVaJZINUcF3tYgEx0cwAAAQA"]
[Wed Apr 01 22:23:17.969478 2026] [:error] [pid 8908:tid 8927] [client 51.103.96.231:40167] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ac0qVfkmxtJXGnLdvgCuVAAAAI4"]
[Wed Apr 01 22:23:21.230565 2026] [:error] [pid 17856:tid 17871] [client 51.103.96.231:42953] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ac0qWT7Idlm5j9frhqRm8AAAAE0"]
[Wed Apr 01 22:23:21.984967 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:52020] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac0qWfkmxtJXGnLdvgCuYAAAAJA"]
[Wed Apr 01 22:23:24.452461 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:43590] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac0qXC7NKI8IaNKZFIfA2wAAAVM"]
[Wed Apr 01 22:23:27.245612 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:59419] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac0qX_kmxtJXGnLdvgCuegAAAIE"]
[Wed Apr 01 22:23:28.981580 2026] [:error] [pid 62559:tid 62571] [client 51.103.96.231:63796] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac0qYC7NKI8IaNKZFIfA-wAAAUo"]
[Wed Apr 01 22:23:41.633418 2026] [proxy_fcgi:error] [pid 17856:tid 17862] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:41.871967 2026] [proxy_fcgi:error] [pid 17856:tid 17863] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:42.348497 2026] [proxy_fcgi:error] [pid 17856:tid 17868] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:42.652922 2026] [proxy_fcgi:error] [pid 17856:tid 17879] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:43.110529 2026] [proxy_fcgi:error] [pid 17856:tid 17867] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:43.655864 2026] [proxy_fcgi:error] [pid 17856:tid 17865] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:43.930249 2026] [proxy_fcgi:error] [pid 17856:tid 17869] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:44.249899 2026] [proxy_fcgi:error] [pid 17856:tid 17876] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:44.517110 2026] [proxy_fcgi:error] [pid 17856:tid 17860] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:44.809675 2026] [proxy_fcgi:error] [pid 17856:tid 17859] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:45.050094 2026] [proxy_fcgi:error] [pid 17856:tid 17858] [client 51.103.96.231:63804] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:23:45.603361 2026] [:error] [pid 17856:tid 17864] [client 51.103.96.231:63804] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ac0qcT7Idlm5j9frhqRnIAAAAEY"]
[Wed Apr 01 22:23:47.080038 2026] [:error] [pid 8910:tid 8992] [client 51.103.96.231:49031] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ac0qc6JZINUcF3tYgEx0kAAAARg"]
[Wed Apr 01 22:23:49.520574 2026] [:error] [pid 62559:tid 62567] [client 51.103.96.231:51663] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ac0qdS7NKI8IaNKZFIfBRAAAAUY"]
[Wed Apr 01 22:23:51.024465 2026] [:error] [pid 8908:tid 8930] [client 51.103.96.231:43005] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sc.php"] [unique_id "ac0qd_kmxtJXGnLdvgCurAAAAJE"]
[Wed Apr 01 22:23:51.810159 2026] [:error] [pid 8909:tid 8941] [client 51.103.96.231:62287] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac0qdzvP_a0662gDl6D10QAAAMA"]
[Wed Apr 01 22:23:52.468614 2026] [:error] [pid 8909:tid 8945] [client 51.103.96.231:46790] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac0qeDvP_a0662gDl6D11QAAAMQ"]
[Wed Apr 01 22:23:53.957281 2026] [:error] [pid 8908:tid 8925] [client 51.103.96.231:41407] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac0qefkmxtJXGnLdvgCutQAAAIw"]
[Wed Apr 01 22:23:55.358426 2026] [:error] [pid 8908:tid 8922] [client 51.103.96.231:51686] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac0qe_kmxtJXGnLdvgCuugAAAIk"]
[Wed Apr 01 22:23:56.868891 2026] [:error] [pid 62559:tid 62574] [client 51.103.96.231:48686] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ac0qfC7NKI8IaNKZFIfBVQAAAU0"]
[Wed Apr 01 22:23:57.771533 2026] [:error] [pid 8909:tid 8959] [client 51.103.96.231:40436] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ac0qfTvP_a0662gDl6D12wAAANI"]
[Wed Apr 01 22:23:58.574458 2026] [:error] [pid 17856:tid 17876] [client 51.103.96.231:38352] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ac0qfj7Idlm5j9frhqRnNwAAAFI"]
[Wed Apr 01 22:23:59.246779 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:57572] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "ac0qfy7NKI8IaNKZFIfBXwAAAVA"]
[Wed Apr 01 22:24:00.096032 2026] [:error] [pid 62559:tid 62564] [client 51.103.96.231:41705] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac0qgC7NKI8IaNKZFIfBYgAAAUM"]
[Wed Apr 01 22:24:00.723303 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:46820] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac0qgC7NKI8IaNKZFIfBaAAAAUU"]
[Wed Apr 01 22:24:01.456506 2026] [:error] [pid 8909:tid 8965] [client 51.103.96.231:45357] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac0qgTvP_a0662gDl6D14AAAANg"]
[Wed Apr 01 22:24:02.732159 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:45135] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac0qgi7NKI8IaNKZFIfBcQAAAVA"]
[Wed Apr 01 22:24:03.688856 2026] [:error] [pid 62559:tid 62569] [client 51.103.96.231:40929] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac0qgy7NKI8IaNKZFIfBegAAAUg"]
[Wed Apr 01 22:24:04.522889 2026] [:error] [pid 62559:tid 62562] [client 51.103.96.231:57587] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac0qhC7NKI8IaNKZFIfBggAAAUE"]
[Wed Apr 01 22:24:05.234601 2026] [:error] [pid 62559:tid 62578] [client 51.103.96.231:45135] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac0qhS7NKI8IaNKZFIfBjAAAAVE"]
[Wed Apr 01 22:24:06.273279 2026] [:error] [pid 62559:tid 62567] [client 51.103.96.231:40924] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac0qhi7NKI8IaNKZFIfBmwAAAUY"]
[Wed Apr 01 22:24:07.125762 2026] [:error] [pid 8908:tid 8919] [client 51.103.96.231:40411] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac0qh_kmxtJXGnLdvgCuxQAAAIY"]
[Wed Apr 01 22:24:08.178331 2026] [:error] [pid 8909:tid 8964] [client 51.103.96.231:41679] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac0qiDvP_a0662gDl6D16wAAANc"]
[Wed Apr 01 22:24:09.375002 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:41353] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac0qifkmxtJXGnLdvgCuywAAAJA"]
[Wed Apr 01 22:24:10.869196 2026] [:error] [pid 8909:tid 8950] [client 51.103.96.231:57199] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac0qijvP_a0662gDl6D18gAAAMk"]
[Wed Apr 01 22:24:12.873127 2026] [:error] [pid 62559:tid 62581] [client 51.103.96.231:55658] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac0qjC7NKI8IaNKZFIfBtgAAAVQ"]
[Wed Apr 01 22:24:14.922931 2026] [:error] [pid 8908:tid 8921] [client 51.103.96.231:55616] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac0qjvkmxtJXGnLdvgCu2gAAAIg"]
[Wed Apr 01 22:24:16.130898 2026] [:error] [pid 8908:tid 8930] [client 51.103.96.231:62304] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac0qkPkmxtJXGnLdvgCu2wAAAJE"]
[Wed Apr 01 22:24:17.609585 2026] [:error] [pid 17856:tid 17882] [client 51.103.96.231:40415] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac0qkT7Idlm5j9frhqRnSwAAAFg"]
[Wed Apr 01 22:24:18.838651 2026] [:error] [pid 8908:tid 8929] [client 51.103.96.231:47121] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0qkvkmxtJXGnLdvgCu4gAAAJA"]
[Wed Apr 01 22:24:20.735564 2026] [:error] [pid 62559:tid 62582] [client 51.103.96.231:50213] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0qlC7NKI8IaNKZFIfB5AAAAVU"]
[Wed Apr 01 22:24:22.612454 2026] [:error] [pid 8995:tid 9009] [client 51.103.96.231:40358] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0qluonaBjs3qxcRefgpQAAAAs"]
[Wed Apr 01 22:24:24.079337 2026] [:error] [pid 8995:tid 9020] [client 51.103.96.231:40906] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0qmOonaBjs3qxcRefgqwAAABY"]
[Wed Apr 01 22:24:25.164116 2026] [:error] [pid 8908:tid 8913] [client 51.103.96.231:46730] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac0qmfkmxtJXGnLdvgCu6wAAAIA"]
[Wed Apr 01 22:24:26.490846 2026] [:error] [pid 8908:tid 8925] [client 51.103.96.231:56025] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac0qmvkmxtJXGnLdvgCu8QAAAIw"]
[Wed Apr 01 22:24:29.095447 2026] [:error] [pid 8908:tid 8919] [client 51.103.96.231:60969] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac0qnfkmxtJXGnLdvgCu-wAAAIY"]
[Wed Apr 01 22:24:30.156415 2026] [:error] [pid 8910:tid 8979] [client 51.103.96.231:56051] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac0qnqJZINUcF3tYgEx0tAAAAQs"]
[Wed Apr 01 22:24:31.080565 2026] [:error] [pid 17856:tid 17873] [client 51.103.96.231:56012] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac0qnz7Idlm5j9frhqRnVgAAAE8"]
[Wed Apr 01 22:24:32.032505 2026] [:error] [pid 62559:tid 62580] [client 51.103.96.231:50177] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac0qoC7NKI8IaNKZFIfB7wAAAVM"]
[Wed Apr 01 22:24:34.065430 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:42211] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac0qoi7NKI8IaNKZFIfB-gAAAUU"]
[Wed Apr 01 22:24:35.689318 2026] [:error] [pid 62559:tid 62572] [client 51.103.96.231:40945] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac0qoy7NKI8IaNKZFIfB_wAAAUs"]
[Wed Apr 01 22:24:40.201389 2026] [:error] [pid 62559:tid 62576] [client 51.103.96.231:35947] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac0qqC7NKI8IaNKZFIfCAwAAAU8"]
[Wed Apr 01 22:24:42.098753 2026] [:error] [pid 8909:tid 8941] [client 51.103.96.231:53140] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac0qqjvP_a0662gDl6D2JAAAAMA"]
[Wed Apr 01 22:24:50.601369 2026] [proxy_fcgi:error] [pid 8908:tid 8935] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:50.880374 2026] [proxy_fcgi:error] [pid 8908:tid 8921] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:52.728771 2026] [proxy_fcgi:error] [pid 8908:tid 8920] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:52.968200 2026] [proxy_fcgi:error] [pid 8908:tid 8929] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:53.491491 2026] [proxy_fcgi:error] [pid 8908:tid 8914] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:53.762332 2026] [proxy_fcgi:error] [pid 8908:tid 8935] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:54.061375 2026] [proxy_fcgi:error] [pid 8908:tid 8932] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:54.301745 2026] [proxy_fcgi:error] [pid 8908:tid 8927] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:54.603666 2026] [proxy_fcgi:error] [pid 8908:tid 8934] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:54.863370 2026] [proxy_fcgi:error] [pid 8908:tid 8919] [client 51.103.96.231:46735] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:24:56.284456 2026] [:error] [pid 8908:tid 8935] [client 51.103.96.231:46735] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "ac0quPkmxtJXGnLdvgCvWAAAAJY"]
[Wed Apr 01 22:24:58.160130 2026] [:error] [pid 8909:tid 8964] [client 51.103.96.231:56005] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "ac0qujvP_a0662gDl6D2OQAAANc"]
[Wed Apr 01 22:25:01.371658 2026] [:error] [pid 62559:tid 62584] [client 51.103.96.231:39324] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "ac0qvS7NKI8IaNKZFIfCJQAAAVc"]
[Wed Apr 01 22:25:02.343951 2026] [:error] [pid 8910:tid 8988] [client 51.103.96.231:42222] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aifa.php"] [unique_id "ac0qvqJZINUcF3tYgEx01QAAARQ"]
[Wed Apr 01 22:25:03.332163 2026] [:error] [pid 8908:tid 8937] [client 51.103.96.231:64990] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac0qv_kmxtJXGnLdvgCvXAAAAJg"]
[Wed Apr 01 22:25:04.634701 2026] [:error] [pid 62559:tid 62581] [client 51.103.96.231:39326] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac0qwC7NKI8IaNKZFIfCKwAAAVQ"]
[Wed Apr 01 22:25:05.949193 2026] [:error] [pid 62559:tid 62585] [client 51.103.96.231:5799] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac0qwS7NKI8IaNKZFIfCMQAAAVg"]
[Wed Apr 01 22:25:06.734270 2026] [:error] [pid 62559:tid 62566] [client 51.103.96.231:5784] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac0qwi7NKI8IaNKZFIfCNAAAAUU"]
[Wed Apr 01 22:25:07.677530 2026] [:error] [pid 17856:tid 17882] [client 51.103.96.231:39326] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ac0qwz7Idlm5j9frhqRnlAAAAFg"]
[Wed Apr 01 22:25:10.276880 2026] [:error] [pid 8910:tid 8989] [client 51.103.96.231:65000] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ac0qxqJZINUcF3tYgEx02QAAARU"]
[Wed Apr 01 22:25:11.962436 2026] [:error] [pid 8909:tid 8960] [client 51.103.96.231:57536] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ac0qxzvP_a0662gDl6D2UQAAANM"]
[Wed Apr 01 22:25:13.246365 2026] [:error] [pid 8909:tid 8947] [client 51.103.96.231:42229] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feokc.php"] [unique_id "ac0qyTvP_a0662gDl6D2UwAAAMY"]
[Wed Apr 01 22:25:17.072267 2026] [:error] [pid 62559:tid 62571] [client 51.103.96.231:44356] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac0qzS7NKI8IaNKZFIfCVQAAAUo"]
[Wed Apr 01 22:25:19.275112 2026] [:error] [pid 62559:tid 62579] [client 51.103.96.231:36213] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac0qzy7NKI8IaNKZFIfCYQAAAVI"]
[Wed Apr 01 22:25:21.258368 2026] [:error] [pid 8908:tid 8914] [client 51.103.96.231:6061] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac0q0fkmxtJXGnLdvgCvegAAAIE"]
[Wed Apr 01 22:25:22.620351 2026] [:error] [pid 8995:tid 8998] [client 51.103.96.231:60643] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac0q0uonaBjs3qxcRefg4AAAAAA"]
[Wed Apr 01 22:25:24.519761 2026] [:error] [pid 8908:tid 8916] [client 51.103.96.231:64218] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac0q1PkmxtJXGnLdvgCvhQAAAIM"]
[Wed Apr 01 22:25:27.651120 2026] [:error] [pid 8995:tid 9008] [client 51.103.96.231:63484] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac0q1-onaBjs3qxcRefg6QAAAAo"]
[Wed Apr 01 22:25:30.686410 2026] [:error] [pid 62559:tid 62569] [client 51.103.96.231:64963] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac0q2i7NKI8IaNKZFIfCjwAAAUg"]
[Wed Apr 01 22:25:31.579555 2026] [:error] [pid 8909:tid 8943] [client 51.103.96.231:64962] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac0q2zvP_a0662gDl6D2aQAAAMI"]
[Wed Apr 01 22:25:32.660259 2026] [:error] [pid 62559:tid 62568] [client 51.103.96.231:50213] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0q3C7NKI8IaNKZFIfClAAAAUc"]
[Wed Apr 01 22:25:33.307790 2026] [:error] [pid 8909:tid 8945] [client 51.103.96.231:64986] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0q3TvP_a0662gDl6D2bQAAAMQ"]
[Wed Apr 01 22:25:34.700486 2026] [:error] [pid 62559:tid 62578] [client 51.103.96.231:63468] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0q3i7NKI8IaNKZFIfCowAAAVE"]
[Wed Apr 01 22:25:35.405597 2026] [:error] [pid 62559:tid 62577] [client 51.103.96.231:60622] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0q3y7NKI8IaNKZFIfCqQAAAVA"]
[Wed Apr 01 22:25:35.964795 2026] [:error] [pid 8995:tid 9019] [client 51.103.96.231:64987] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac0q3-onaBjs3qxcRefg7gAAABU"]
[Wed Apr 01 22:25:36.739071 2026] [:error] [pid 8995:tid 9017] [client 51.103.96.231:5786] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac0q4OonaBjs3qxcRefg7wAAABM"]
[Wed Apr 01 22:25:37.685074 2026] [:error] [pid 8995:tid 9015] [client 51.103.96.231:39308] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac0q4eonaBjs3qxcRefg8QAAABE"]
[Wed Apr 01 22:25:38.555316 2026] [:error] [pid 62559:tid 62585] [client 51.103.96.231:39849] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac0q4i7NKI8IaNKZFIfCrwAAAVg"]
[Wed Apr 01 22:25:39.397149 2026] [:error] [pid 8995:tid 9010] [client 51.103.96.231:52471] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac0q4-onaBjs3qxcRefg9AAAAAw"]
[Wed Apr 01 22:25:40.712869 2026] [:error] [pid 8908:tid 8913] [client 51.103.96.231:44405] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac0q5PkmxtJXGnLdvgCvnAAAAIA"]
[Wed Apr 01 22:25:42.899373 2026] [:error] [pid 17856:tid 17871] [client 51.103.96.231:35596] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac0q5j7Idlm5j9frhqRnqgAAAE0"]
[Wed Apr 01 22:25:44.035012 2026] [:error] [pid 62559:tid 62569] [client 51.103.96.231:40837] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac0q6C7NKI8IaNKZFIfCtAAAAUg"]
[Wed Apr 01 22:25:45.308968 2026] [:error] [pid 8909:tid 8957] [client 51.103.96.231:52364] [client 51.103.96.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ac0q6TvP_a0662gDl6D2fQAAANA"]
[Wed Apr 01 22:26:14.766085 2026] [proxy_fcgi:error] [pid 8908:tid 8919] [client 51.103.96.231:61395] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:17.543856 2026] [proxy_fcgi:error] [pid 8908:tid 8930] [client 51.103.96.231:37834] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:17.811403 2026] [proxy_fcgi:error] [pid 8908:tid 8925] [client 51.103.96.231:37834] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:18.266119 2026] [proxy_fcgi:error] [pid 8908:tid 8934] [client 51.103.96.231:37834] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:18.518291 2026] [proxy_fcgi:error] [pid 8908:tid 8914] [client 51.103.96.231:37834] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:18.884140 2026] [:error] [pid 8908:tid 8927] [client 51.103.96.231:37834] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac0rCvkmxtJXGnLdvgCv8QAAAI4"]
[Wed Apr 01 22:26:22.051468 2026] [:error] [pid 62559:tid 62582] [client 51.103.96.231:37875] [client 51.103.96.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac0rDi7NKI8IaNKZFIfC6gAAAVU"]
[Wed Apr 01 22:26:23.731055 2026] [proxy_fcgi:error] [pid 62559:tid 62570] [client 51.103.96.231:55992] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:23.970403 2026] [proxy_fcgi:error] [pid 62559:tid 62567] [client 51.103.96.231:55992] AH01071: Got error 'Primary script unknown'
[Wed Apr 01 22:26:24.404578 2026] [proxy_fcgi:error] [pid 62559:tid 62573] [client 51.103.96.231:55992] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 00:00:35.268484 2026] [:error] [pid 62559:tid 62565] [client 144.31.111.47:48158] [client 144.31.111.47] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/x-msvideo"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac1BIy7NKI8IaNKZFIcU0wAAAUQ"]
[Thu Apr 02 03:33:20.276495 2026] [:error] [pid 59194:tid 59235] [client 43.152.72.244:56154] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac1zABMpAeV11hcQehy_iAAAABY"]
[Thu Apr 02 03:34:13.835466 2026] [proxy_fcgi:error] [pid 59305:tid 59309] [client 20.250.12.127:47837] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:10.080193 2026] [proxy_fcgi:error] [pid 29467:tid 29489] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:10.347343 2026] [proxy_fcgi:error] [pid 29467:tid 29488] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:10.615922 2026] [proxy_fcgi:error] [pid 29467:tid 29492] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:10.882793 2026] [proxy_fcgi:error] [pid 29467:tid 29473] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:11.164324 2026] [proxy_fcgi:error] [pid 29467:tid 29480] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:11.431118 2026] [proxy_fcgi:error] [pid 29467:tid 29486] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:11.697662 2026] [proxy_fcgi:error] [pid 29467:tid 29483] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:11.964550 2026] [proxy_fcgi:error] [pid 29467:tid 29481] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:12.239024 2026] [proxy_fcgi:error] [pid 29467:tid 29491] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:12.505915 2026] [proxy_fcgi:error] [pid 29467:tid 29484] [client 20.240.45.211:45711] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:49:12.768093 2026] [:error] [pid 29467:tid 29476] [client 20.240.45.211:45711] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ac2g6L4VUBFCJAq-WOkwSAAAAQY"]
[Thu Apr 02 06:49:13.465508 2026] [:error] [pid 59201:tid 59278] [client 20.240.45.211:55916] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ac2g6cAC0Tw8eL6gzZ6N4AAAAIs"]
[Thu Apr 02 06:49:14.092287 2026] [:error] [pid 37543:tid 37556] [client 20.240.45.211:40122] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ac2g6nhdk2bEYJCvILYw0wAAAUs"]
[Thu Apr 02 06:49:14.837941 2026] [:error] [pid 29467:tid 29486] [client 20.240.45.211:53345] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "ac2g6r4VUBFCJAq-WOkwUAAAARA"]
[Thu Apr 02 06:49:15.482652 2026] [:error] [pid 37543:tid 37550] [client 20.240.45.211:45670] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ac2g63hdk2bEYJCvILYw2gAAAUU"]
[Thu Apr 02 06:49:16.054037 2026] [:error] [pid 37543:tid 37546] [client 20.240.45.211:45680] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ac2g7Hhdk2bEYJCvILYw3QAAAUE"]
[Thu Apr 02 06:49:16.617929 2026] [:error] [pid 59305:tid 59325] [client 20.240.45.211:40076] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ac2g7Kr2tV4rDwKFxKccnAAAANA"]
[Thu Apr 02 06:49:17.243535 2026] [:error] [pid 37543:tid 37564] [client 20.240.45.211:45747] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ac2g7Xhdk2bEYJCvILYw4QAAAVM"]
[Thu Apr 02 06:49:17.890075 2026] [:error] [pid 29467:tid 29472] [client 20.240.45.211:52135] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ac2g7b4VUBFCJAq-WOkwVAAAAQI"]
[Thu Apr 02 06:49:18.527841 2026] [:error] [pid 59194:tid 59216] [client 20.240.45.211:53327] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ac2g7hMpAeV11hcQehzkawAAAAM"]
[Thu Apr 02 06:49:19.108110 2026] [:error] [pid 59200:tid 59260] [client 20.240.45.211:40124] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ac2g77fP26txrdLs3EoCxgAAAFQ"]
[Thu Apr 02 06:49:19.732296 2026] [:error] [pid 59305:tid 59310] [client 20.240.45.211:44808] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ac2g76r2tV4rDwKFxKccogAAAME"]
[Thu Apr 02 06:49:20.307551 2026] [:error] [pid 59305:tid 59314] [client 20.240.45.211:52114] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lef.php"] [unique_id "ac2g8Kr2tV4rDwKFxKccpQAAAMU"]
[Thu Apr 02 06:49:20.898313 2026] [:error] [pid 59194:tid 59233] [client 20.240.45.211:45661] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lef.php"] [unique_id "ac2g8BMpAeV11hcQehzkcAAAABQ"]
[Thu Apr 02 06:49:21.426741 2026] [:error] [pid 59194:tid 59215] [client 20.240.45.211:36826] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lef.php"] [unique_id "ac2g8RMpAeV11hcQehzkcwAAAAI"]
[Thu Apr 02 06:49:22.004159 2026] [:error] [pid 59201:tid 59291] [client 20.240.45.211:52148] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lef.php"] [unique_id "ac2g8sAC0Tw8eL6gzZ6N5wAAAJg"]
[Thu Apr 02 06:49:22.534690 2026] [:error] [pid 59305:tid 59317] [client 20.240.45.211:45709] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac2g8qr2tV4rDwKFxKccrAAAAMg"]
[Thu Apr 02 06:49:23.140581 2026] [:error] [pid 59201:tid 59281] [client 20.240.45.211:45698] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac2g88AC0Tw8eL6gzZ6N6QAAAI4"]
[Thu Apr 02 06:49:23.717460 2026] [:error] [pid 59201:tid 59289] [client 20.240.45.211:45690] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac2g88AC0Tw8eL6gzZ6N6wAAAJY"]
[Thu Apr 02 06:49:24.279683 2026] [:error] [pid 59201:tid 59271] [client 20.240.45.211:53342] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac2g9MAC0Tw8eL6gzZ6N7gAAAIQ"]
[Thu Apr 02 06:49:24.814383 2026] [:error] [pid 59305:tid 59327] [client 20.240.45.211:44854] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ccv.php"] [unique_id "ac2g9Kr2tV4rDwKFxKccrwAAANI"]
[Thu Apr 02 06:49:25.377880 2026] [:error] [pid 29467:tid 29489] [client 20.240.45.211:53365] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ccv.php"] [unique_id "ac2g9b4VUBFCJAq-WOkwXQAAARM"]
[Thu Apr 02 06:49:25.906662 2026] [:error] [pid 37543:tid 37556] [client 20.240.45.211:40117] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ccv.php"] [unique_id "ac2g9Xhdk2bEYJCvILYw6AAAAUs"]
[Thu Apr 02 06:49:26.436832 2026] [:error] [pid 37543:tid 37567] [client 20.240.45.211:40091] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ccv.php"] [unique_id "ac2g9nhdk2bEYJCvILYw7AAAAVY"]
[Thu Apr 02 06:49:26.963318 2026] [:error] [pid 37543:tid 37566] [client 20.240.45.211:40065] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ac2g9nhdk2bEYJCvILYw7gAAAVU"]
[Thu Apr 02 06:49:27.510473 2026] [:error] [pid 29467:tid 29485] [client 20.240.45.211:44800] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ac2g974VUBFCJAq-WOkwYgAAAQ8"]
[Thu Apr 02 06:49:28.036983 2026] [:error] [pid 29467:tid 29490] [client 20.240.45.211:36800] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ac2g-L4VUBFCJAq-WOkwZQAAARQ"]
[Thu Apr 02 06:49:28.564741 2026] [:error] [pid 37543:tid 37559] [client 20.240.45.211:53353] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "ac2g-Hhdk2bEYJCvILYw8QAAAU4"]
[Thu Apr 02 06:49:29.091483 2026] [:error] [pid 37543:tid 37563] [client 20.240.45.211:40118] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haz.php"] [unique_id "ac2g-Xhdk2bEYJCvILYw8wAAAVI"]
[Thu Apr 02 06:49:29.683597 2026] [:error] [pid 29467:tid 29478] [client 20.240.45.211:45740] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haz.php"] [unique_id "ac2g-b4VUBFCJAq-WOkwZwAAAQg"]
[Thu Apr 02 06:49:30.242539 2026] [:error] [pid 59201:tid 59273] [client 20.240.45.211:45733] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haz.php"] [unique_id "ac2g-sAC0Tw8eL6gzZ6N8wAAAIY"]
[Thu Apr 02 06:49:30.810165 2026] [:error] [pid 59305:tid 59322] [client 20.240.45.211:55880] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haz.php"] [unique_id "ac2g-qr2tV4rDwKFxKcctQAAAM0"]
[Thu Apr 02 06:49:31.388835 2026] [:error] [pid 29467:tid 29482] [client 20.240.45.211:45697] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ac2g-74VUBFCJAq-WOkwagAAAQw"]
[Thu Apr 02 06:49:31.934452 2026] [:error] [pid 59200:tid 59247] [client 20.240.45.211:44858] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ac2g-7fP26txrdLs3EoC2QAAAEc"]
[Thu Apr 02 06:49:32.498515 2026] [:error] [pid 59200:tid 59264] [client 20.240.45.211:40077] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ac2g_LfP26txrdLs3EoC3AAAAFg"]
[Thu Apr 02 06:49:33.108994 2026] [:error] [pid 59201:tid 59267] [client 20.240.45.211:45684] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ac2g_cAC0Tw8eL6gzZ6N-gAAAIA"]
[Thu Apr 02 06:49:33.654454 2026] [:error] [pid 59201:tid 59276] [client 20.240.45.211:44846] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac2g_cAC0Tw8eL6gzZ6N_QAAAIk"]
[Thu Apr 02 06:49:34.191920 2026] [:error] [pid 37543:tid 37549] [client 20.240.45.211:45651] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac2g_nhdk2bEYJCvILYw-AAAAUQ"]
[Thu Apr 02 06:49:34.720320 2026] [:error] [pid 59201:tid 59280] [client 20.240.45.211:45726] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac2g_sAC0Tw8eL6gzZ6N_wAAAI0"]
[Thu Apr 02 06:49:35.252928 2026] [:error] [pid 59201:tid 59285] [client 20.240.45.211:45652] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac2g_8AC0Tw8eL6gzZ6OAAAAAJI"]
[Thu Apr 02 06:49:35.778977 2026] [:error] [pid 37543:tid 37568] [client 20.240.45.211:55926] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilng.php"] [unique_id "ac2g_3hdk2bEYJCvILYw-wAAAVc"]
[Thu Apr 02 06:49:36.306101 2026] [:error] [pid 37543:tid 37552] [client 20.240.45.211:55911] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilng.php"] [unique_id "ac2hAHhdk2bEYJCvILYw_AAAAUc"]
[Thu Apr 02 06:49:36.835949 2026] [:error] [pid 37543:tid 37565] [client 20.240.45.211:44814] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilng.php"] [unique_id "ac2hAHhdk2bEYJCvILYw_QAAAVQ"]
[Thu Apr 02 06:49:37.368594 2026] [:error] [pid 59201:tid 59267] [client 20.240.45.211:45634] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilng.php"] [unique_id "ac2hAcAC0Tw8eL6gzZ6OCQAAAIA"]
[Thu Apr 02 06:49:37.905677 2026] [:error] [pid 59201:tid 59274] [client 20.240.45.211:45704] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f222.php"] [unique_id "ac2hAcAC0Tw8eL6gzZ6OCgAAAIc"]
[Thu Apr 02 06:49:38.465016 2026] [:error] [pid 59201:tid 59275] [client 20.240.45.211:45737] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f222.php"] [unique_id "ac2hAsAC0Tw8eL6gzZ6OCwAAAIg"]
[Thu Apr 02 06:49:38.996289 2026] [:error] [pid 59201:tid 59291] [client 20.240.45.211:55930] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f222.php"] [unique_id "ac2hAsAC0Tw8eL6gzZ6ODQAAAJg"]
[Thu Apr 02 06:49:39.576754 2026] [:error] [pid 59194:tid 59224] [client 20.240.45.211:55905] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f222.php"] [unique_id "ac2hAxMpAeV11hcQehzkkAAAAAs"]
[Thu Apr 02 06:49:40.126139 2026] [:error] [pid 37543:tid 37565] [client 20.240.45.211:45667] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ver.php"] [unique_id "ac2hBHhdk2bEYJCvILYxDAAAAVQ"]
[Thu Apr 02 06:49:40.666295 2026] [:error] [pid 59200:tid 59247] [client 20.240.45.211:40095] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ver.php"] [unique_id "ac2hBLfP26txrdLs3EoC3wAAAEc"]
[Thu Apr 02 06:49:41.192724 2026] [:error] [pid 37543:tid 37559] [client 20.240.45.211:52144] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ver.php"] [unique_id "ac2hBXhdk2bEYJCvILYxFgAAAU4"]
[Thu Apr 02 06:49:41.731501 2026] [:error] [pid 37543:tid 37563] [client 20.240.45.211:45699] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ver.php"] [unique_id "ac2hBXhdk2bEYJCvILYxGQAAAVI"]
[Thu Apr 02 06:49:42.300964 2026] [:error] [pid 59194:tid 59216] [client 20.240.45.211:44801] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "ac2hBhMpAeV11hcQehzklQAAAAM"]
[Thu Apr 02 06:49:42.834356 2026] [:error] [pid 59305:tid 59318] [client 20.240.45.211:44833] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "ac2hBqr2tV4rDwKFxKccuwAAAMk"]
[Thu Apr 02 06:49:43.374774 2026] [:error] [pid 59194:tid 59226] [client 20.240.45.211:45758] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "ac2hBxMpAeV11hcQehzklgAAAA0"]
[Thu Apr 02 06:49:43.912877 2026] [:error] [pid 37543:tid 37560] [client 20.240.45.211:53334] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "ac2hB3hdk2bEYJCvILYxHQAAAU8"]
[Thu Apr 02 06:49:44.460983 2026] [:error] [pid 59305:tid 59333] [client 20.240.45.211:53323] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac2hCKr2tV4rDwKFxKccvAAAANg"]
[Thu Apr 02 06:49:44.987675 2026] [:error] [pid 59305:tid 59330] [client 20.240.45.211:55927] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac2hCKr2tV4rDwKFxKccvQAAANU"]
[Thu Apr 02 06:49:45.532049 2026] [:error] [pid 59201:tid 59283] [client 20.240.45.211:45686] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac2hCcAC0Tw8eL6gzZ6OIgAAAJA"]
[Thu Apr 02 06:49:46.058038 2026] [:error] [pid 59305:tid 59322] [client 20.240.45.211:6420] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac2hCqr2tV4rDwKFxKccwAAAAM0"]
[Thu Apr 02 06:49:46.590015 2026] [:error] [pid 59194:tid 59217] [client 20.240.45.211:44827] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac2hChMpAeV11hcQehzkmgAAAAQ"]
[Thu Apr 02 06:49:47.115558 2026] [:error] [pid 37543:tid 37562] [client 20.240.45.211:45645] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac2hC3hdk2bEYJCvILYxHgAAAVE"]
[Thu Apr 02 06:49:47.641870 2026] [:error] [pid 59305:tid 59325] [client 20.240.45.211:45727] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac2hC6r2tV4rDwKFxKccxAAAANA"]
[Thu Apr 02 06:49:48.175018 2026] [:error] [pid 59305:tid 59311] [client 20.240.45.211:45752] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac2hDKr2tV4rDwKFxKccxQAAAMI"]
[Thu Apr 02 06:49:48.700058 2026] [:error] [pid 59200:tid 59242] [client 20.240.45.211:44816] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ac2hDLfP26txrdLs3EoC8QAAAEI"]
[Thu Apr 02 06:49:49.229987 2026] [:error] [pid 59200:tid 59257] [client 20.240.45.211:40093] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ac2hDbfP26txrdLs3EoC8wAAAFE"]
[Thu Apr 02 06:49:49.772997 2026] [:error] [pid 29467:tid 29477] [client 20.240.45.211:55909] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ac2hDb4VUBFCJAq-WOkwbgAAAQc"]
[Thu Apr 02 06:49:50.341271 2026] [:error] [pid 29467:tid 29483] [client 20.240.45.211:44830] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ac2hDr4VUBFCJAq-WOkwbwAAAQ0"]
[Thu Apr 02 06:49:50.889456 2026] [:error] [pid 29467:tid 29491] [client 20.240.45.211:53317] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ckk.php"] [unique_id "ac2hDr4VUBFCJAq-WOkwcwAAARU"]
[Thu Apr 02 06:49:51.472698 2026] [:error] [pid 59201:tid 59274] [client 20.240.45.211:45751] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ckk.php"] [unique_id "ac2hD8AC0Tw8eL6gzZ6OLQAAAIc"]
[Thu Apr 02 06:49:51.999576 2026] [:error] [pid 37543:tid 37565] [client 20.240.45.211:52127] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ckk.php"] [unique_id "ac2hD3hdk2bEYJCvILYxJQAAAVQ"]
[Thu Apr 02 06:49:52.597101 2026] [:error] [pid 29467:tid 29476] [client 20.240.45.211:45644] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ckk.php"] [unique_id "ac2hEL4VUBFCJAq-WOkwdAAAAQY"]
[Thu Apr 02 06:49:53.130675 2026] [:error] [pid 59305:tid 59324] [client 20.240.45.211:40089] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kiwkiw.php"] [unique_id "ac2hEar2tV4rDwKFxKcczQAAAM8"]
[Thu Apr 02 06:49:53.717815 2026] [:error] [pid 59200:tid 59248] [client 20.240.45.211:53324] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kiwkiw.php"] [unique_id "ac2hEbfP26txrdLs3EoC-AAAAEg"]
[Thu Apr 02 06:49:54.242882 2026] [:error] [pid 59194:tid 59234] [client 20.240.45.211:44803] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kiwkiw.php"] [unique_id "ac2hEhMpAeV11hcQehzkoAAAABU"]
[Thu Apr 02 06:49:54.772027 2026] [:error] [pid 29467:tid 29473] [client 20.240.45.211:45718] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kiwkiw.php"] [unique_id "ac2hEr4VUBFCJAq-WOkweQAAAQM"]
[Thu Apr 02 06:49:55.298570 2026] [:error] [pid 29467:tid 29483] [client 20.240.45.211:44843] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sfcl.php"] [unique_id "ac2hE74VUBFCJAq-WOkwfgAAAQ0"]
[Thu Apr 02 06:49:55.839478 2026] [:error] [pid 37543:tid 37554] [client 20.240.45.211:53351] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sfcl.php"] [unique_id "ac2hE3hdk2bEYJCvILYxLQAAAUk"]
[Thu Apr 02 06:49:56.403887 2026] [:error] [pid 29467:tid 29475] [client 20.240.45.211:45636] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sfcl.php"] [unique_id "ac2hFL4VUBFCJAq-WOkwhAAAAQU"]
[Thu Apr 02 06:49:56.962916 2026] [:error] [pid 59305:tid 59328] [client 20.240.45.211:6430] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sfcl.php"] [unique_id "ac2hFKr2tV4rDwKFxKcc0gAAANM"]
[Thu Apr 02 06:49:57.514260 2026] [:error] [pid 59194:tid 59227] [client 20.240.45.211:45649] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ac2hFRMpAeV11hcQehzkoQAAAA4"]
[Thu Apr 02 06:49:58.066493 2026] [:error] [pid 59201:tid 59273] [client 20.240.45.211:45672] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ac2hFsAC0Tw8eL6gzZ6OPAAAAIY"]
[Thu Apr 02 06:49:58.607228 2026] [:error] [pid 29467:tid 29485] [client 20.240.45.211:52099] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ac2hFr4VUBFCJAq-WOkwigAAAQ8"]
[Thu Apr 02 06:49:59.157294 2026] [:error] [pid 29467:tid 29483] [client 20.240.45.211:40109] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ac2hF74VUBFCJAq-WOkwjQAAAQ0"]
[Thu Apr 02 06:49:59.690348 2026] [:error] [pid 59194:tid 59236] [client 20.240.45.211:45677] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac2hFxMpAeV11hcQehzkowAAABc"]
[Thu Apr 02 06:50:00.217761 2026] [:error] [pid 59201:tid 59275] [client 20.240.45.211:52125] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac2hGMAC0Tw8eL6gzZ6OPwAAAIg"]
[Thu Apr 02 06:50:00.747117 2026] [:error] [pid 59200:tid 59244] [client 20.240.45.211:53312] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac2hGLfP26txrdLs3EoDAAAAAEQ"]
[Thu Apr 02 06:50:01.279647 2026] [:error] [pid 59194:tid 59223] [client 20.240.45.211:40075] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac2hGRMpAeV11hcQehzkpAAAAAo"]
[Thu Apr 02 06:50:01.811869 2026] [:error] [pid 59305:tid 59322] [client 20.240.45.211:44805] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-upload.php"] [unique_id "ac2hGar2tV4rDwKFxKcc1QAAAM0"]
[Thu Apr 02 06:50:02.375020 2026] [:error] [pid 37543:tid 37564] [client 20.240.45.211:44841] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-upload.php"] [unique_id "ac2hGnhdk2bEYJCvILYxNgAAAVM"]
[Thu Apr 02 06:50:02.922523 2026] [:error] [pid 29467:tid 29475] [client 20.240.45.211:40127] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-upload.php"] [unique_id "ac2hGr4VUBFCJAq-WOkwmAAAAQU"]
[Thu Apr 02 06:50:03.461007 2026] [:error] [pid 59305:tid 59317] [client 20.240.45.211:45662] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-upload.php"] [unique_id "ac2hG6r2tV4rDwKFxKcc1wAAAMg"]
[Thu Apr 02 06:50:04.026417 2026] [:error] [pid 37543:tid 37549] [client 20.240.45.211:40067] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "ac2hHHhdk2bEYJCvILYxOAAAAUQ"]
[Thu Apr 02 06:50:04.553618 2026] [:error] [pid 59200:tid 59243] [client 20.240.45.211:55899] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "ac2hHLfP26txrdLs3EoDAgAAAEM"]
[Thu Apr 02 06:50:05.083841 2026] [:error] [pid 59194:tid 59237] [client 20.240.45.211:45641] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "ac2hHRMpAeV11hcQehzkpgAAABg"]
[Thu Apr 02 06:50:05.611470 2026] [:error] [pid 59305:tid 59323] [client 20.240.45.211:52133] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "ac2hHar2tV4rDwKFxKcc2gAAAM4"]
[Thu Apr 02 06:50:06.141533 2026] [:error] [pid 37543:tid 37547] [client 20.240.45.211:44825] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac2hHnhdk2bEYJCvILYxOQAAAUI"]
[Thu Apr 02 06:50:06.670903 2026] [:error] [pid 59305:tid 59328] [client 20.240.45.211:52112] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac2hHqr2tV4rDwKFxKcc3gAAANM"]
[Thu Apr 02 06:50:07.197749 2026] [:error] [pid 37543:tid 37566] [client 20.240.45.211:52126] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac2hH3hdk2bEYJCvILYxPAAAAVU"]
[Thu Apr 02 06:50:07.729589 2026] [:error] [pid 59201:tid 59279] [client 20.240.45.211:52137] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac2hH8AC0Tw8eL6gzZ6OSgAAAIw"]
[Thu Apr 02 06:50:08.261356 2026] [:error] [pid 29467:tid 29491] [client 20.240.45.211:52115] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa.php"] [unique_id "ac2hIL4VUBFCJAq-WOkwoQAAARU"]
[Thu Apr 02 06:50:08.787136 2026] [:error] [pid 59201:tid 59290] [client 20.240.45.211:52130] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa.php"] [unique_id "ac2hIMAC0Tw8eL6gzZ6OTgAAAJc"]
[Thu Apr 02 06:50:09.325807 2026] [:error] [pid 59200:tid 59245] [client 20.240.45.211:40074] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa.php"] [unique_id "ac2hIbfP26txrdLs3EoDBQAAAEU"]
[Thu Apr 02 06:50:09.857037 2026] [:error] [pid 37543:tid 37551] [client 20.240.45.211:45710] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa.php"] [unique_id "ac2hIXhdk2bEYJCvILYxQgAAAUY"]
[Thu Apr 02 06:50:10.382287 2026] [:error] [pid 37543:tid 37561] [client 20.240.45.211:40085] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ac2hInhdk2bEYJCvILYxRwAAAVA"]
[Thu Apr 02 06:50:10.908829 2026] [:error] [pid 37543:tid 37559] [client 20.240.45.211:45674] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ac2hInhdk2bEYJCvILYxSgAAAU4"]
[Thu Apr 02 06:50:11.470991 2026] [:error] [pid 37543:tid 37565] [client 20.240.45.211:53332] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ac2hI3hdk2bEYJCvILYxTQAAAVQ"]
[Thu Apr 02 06:50:12.001380 2026] [:error] [pid 37543:tid 37545] [client 20.240.45.211:40079] [client 20.240.45.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ac2hI3hdk2bEYJCvILYxUAAAAUA"]
[Thu Apr 02 06:50:12.549363 2026] [proxy_fcgi:error] [pid 59201:tid 59267] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:12.818429 2026] [proxy_fcgi:error] [pid 59201:tid 59271] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:13.094484 2026] [proxy_fcgi:error] [pid 59201:tid 59272] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:13.365296 2026] [proxy_fcgi:error] [pid 59201:tid 59290] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:13.634069 2026] [proxy_fcgi:error] [pid 59201:tid 59283] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:13.901650 2026] [proxy_fcgi:error] [pid 59201:tid 59270] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:14.170948 2026] [proxy_fcgi:error] [pid 59201:tid 59281] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:14.441611 2026] [proxy_fcgi:error] [pid 59201:tid 59277] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:14.709166 2026] [proxy_fcgi:error] [pid 59201:tid 59269] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 06:50:14.977266 2026] [proxy_fcgi:error] [pid 59201:tid 59280] [client 20.240.45.211:55892] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 09:36:53.910655 2026] [:error] [pid 29467:tid 29473] [client 86.54.25.100:59762] [client 86.54.25.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at ARGS:name[#suffix]. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "70"] [id "211230"] [rev "1"] [msg "COMODO WAF: PHP Injection Attack||switchcreative.net|F|2"] [data "Matched Data: $_POST found within ARGS:name[#suffix]: eval($_POST[c]);//"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac3INb4VUBFCJAq-WOlvfgAAAQM"], referer: http://switchcreative.net/?q=user%2Fpassword&name%5B%23post_render%5D%5B0%5D=array_map&name%5B%23suffix%5D=eval%28%24_POST%5Bc%5D%29%3B%2F%2F&name%5B%23type%5D=markup&name%5B%23markup%5D=assert
[Thu Apr 02 09:45:14.421788 2026] [:error] [pid 59201:tid 59291] [client 60.188.57.0:50359] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac3KKsAC0Tw8eL6gzZ6uoQAAAJg"]
[Thu Apr 02 10:30:23.663126 2026] [:error] [pid 54384:tid 54405] [client 43.131.253.14:46532] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac3Uv9WWpaby3TVN7Mdf4gAAAdM"]
[Thu Apr 02 14:12:55.025809 2026] [:error] [pid 54384:tid 54397] [client 172.70.240.118:12317] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/logs/HEAD"] [unique_id "ac4I59WWpaby3TVN7MejLQAAAcs"]
[Thu Apr 02 14:12:55.055860 2026] [:error] [pid 54384:tid 54399] [client 172.70.240.118:12318] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/refs/heads/main"] [unique_id "ac4I59WWpaby3TVN7MejLgAAAc0"]
[Thu Apr 02 14:12:55.074561 2026] [:error] [pid 54384:tid 54391] [client 172.70.240.118:12316] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/index"] [unique_id "ac4I59WWpaby3TVN7MejLwAAAcU"]
[Thu Apr 02 14:12:55.077448 2026] [:error] [pid 54384:tid 54390] [client 172.70.240.119:10100] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ac4I59WWpaby3TVN7MejMAAAAcQ"]
[Thu Apr 02 14:12:55.080091 2026] [:error] [pid 54384:tid 54398] [client 172.70.240.119:10095] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/refs/heads/master"] [unique_id "ac4I59WWpaby3TVN7MejMQAAAcw"]
[Thu Apr 02 14:12:55.174996 2026] [:error] [pid 54384:tid 54396] [client 172.70.240.58:11660] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ac4I59WWpaby3TVN7MejMwAAAco"]
[Thu Apr 02 14:12:56.056651 2026] [:error] [pid 59305:tid 59330] [client 172.70.240.58:10670] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ac4I6Kr2tV4rDwKFxKfSyAAAANU"]
[Thu Apr 02 14:12:56.080001 2026] [:error] [pid 59305:tid 59328] [client 172.70.240.118:12320] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production"] [unique_id "ac4I6Kr2tV4rDwKFxKfSyQAAANM"]
[Thu Apr 02 14:12:56.087386 2026] [:error] [pid 59305:tid 59325] [client 172.70.240.58:10677] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "ac4I6Kr2tV4rDwKFxKfSygAAANA"]
[Thu Apr 02 14:12:56.088396 2026] [:error] [pid 59305:tid 59326] [client 172.70.240.59:12234] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "ac4I6Kr2tV4rDwKFxKfSywAAANE"]
[Thu Apr 02 14:12:56.117900 2026] [:error] [pid 59305:tid 59310] [client 172.70.240.58:10675] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development"] [unique_id "ac4I6Kr2tV4rDwKFxKfSzAAAAME"]
[Thu Apr 02 14:12:56.186977 2026] [:error] [pid 59305:tid 59315] [client 172.70.240.58:10685] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.test"] [unique_id "ac4I6Kr2tV4rDwKFxKfSzgAAAMY"]
[Thu Apr 02 14:12:57.057334 2026] [:error] [pid 59201:tid 59279] [client 172.70.240.58:10691] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.staging"] [unique_id "ac4I6cAC0Tw8eL6gzZ7T5AAAAIw"]
[Thu Apr 02 14:12:57.079391 2026] [:error] [pid 59201:tid 59274] [client 172.70.240.58:10692] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.backup"] [unique_id "ac4I6cAC0Tw8eL6gzZ7T5QAAAIc"]
[Thu Apr 02 14:12:57.090994 2026] [:error] [pid 59305:tid 59309] [client 172.70.240.59:12242] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.bak"] [unique_id "ac4I6ar2tV4rDwKFxKfS0AAAAMA"]
[Thu Apr 02 14:12:57.117562 2026] [:error] [pid 37543:tid 37554] [client 172.70.240.59:12244] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.old"] [unique_id "ac4I6Xhdk2bEYJCvILaHTAAAAUk"]
[Thu Apr 02 14:12:57.120699 2026] [:error] [pid 37543:tid 37545] [client 172.70.240.58:10699] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.save"] [unique_id "ac4I6Xhdk2bEYJCvILaHTQAAAUA"]
[Thu Apr 02 14:12:57.218764 2026] [:error] [pid 59305:tid 59317] [client 172.70.240.119:10112] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.tmp"] [unique_id "ac4I6ar2tV4rDwKFxKfS0gAAAMg"]
[Thu Apr 02 14:12:58.076099 2026] [:error] [pid 29467:tid 29481] [client 172.70.240.119:10117] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.example"] [unique_id "ac4I6r4VUBFCJAq-WOmpPwAAAQs"]
[Thu Apr 02 14:12:58.081538 2026] [:error] [pid 59194:tid 59233] [client 172.70.240.59:12245] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production.local"] [unique_id "ac4I6hMpAeV11hcQehwQvgAAABQ"]
[Thu Apr 02 14:12:58.114667 2026] [:error] [pid 59194:tid 59231] [client 172.70.240.118:12330] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/config/.env"] [unique_id "ac4I6hMpAeV11hcQehwQvwAAABI"]
[Thu Apr 02 14:12:58.115115 2026] [:error] [pid 59194:tid 59221] [client 172.70.240.118:12323] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development.local"] [unique_id "ac4I6hMpAeV11hcQehwQwAAAAAg"]
[Thu Apr 02 14:12:58.127355 2026] [:error] [pid 59194:tid 59229] [client 172.70.240.59:12251] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ac4I6hMpAeV11hcQehwQwQAAABA"]
[Thu Apr 02 14:12:58.262904 2026] [:error] [pid 59200:tid 59261] [client 172.70.240.59:12255] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/backend/.env"] [unique_id "ac4I6rfP26txrdLs3Eo5oQAAAFU"]
[Thu Apr 02 14:12:59.087460 2026] [:error] [pid 37543:tid 37552] [client 172.70.240.119:12186] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/admin/.env"] [unique_id "ac4I63hdk2bEYJCvILaHUQAAAUc"]
[Thu Apr 02 14:12:59.110841 2026] [:error] [pid 23927:tid 23940] [client 172.70.240.119:12178] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "ac4I60sZwqCndhl9uKAg7QAAAYs"]
[Thu Apr 02 14:12:59.115634 2026] [:error] [pid 59305:tid 59322] [client 172.70.240.118:12360] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/core/.env"] [unique_id "ac4I66r2tV4rDwKFxKfS1QAAAM0"]
[Thu Apr 02 14:12:59.121872 2026] [:error] [pid 59201:tid 59276] [client 172.70.240.59:12256] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/public/.env"] [unique_id "ac4I68AC0Tw8eL6gzZ7T8QAAAIk"]
[Thu Apr 02 14:12:59.148906 2026] [:error] [pid 59305:tid 59321] [client 172.70.240.59:12258] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/private/.env"] [unique_id "ac4I66r2tV4rDwKFxKfS1gAAAMw"]
[Thu Apr 02 14:12:59.567726 2026] [:error] [pid 59200:tid 59246] [client 172.70.240.119:12193] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env1"] [unique_id "ac4I67fP26txrdLs3Eo5pQAAAEY"]
[Thu Apr 02 14:13:00.113587 2026] [:error] [pid 59194:tid 59228] [client 172.70.240.58:10707] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/config/.env.local"] [unique_id "ac4I7BMpAeV11hcQehwQxAAAAA8"]
[Thu Apr 02 14:13:00.114881 2026] [:error] [pid 59194:tid 59236] [client 172.70.240.119:12198] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.json"] [unique_id "ac4I7BMpAeV11hcQehwQxQAAABc"]
[Thu Apr 02 14:13:00.143915 2026] [:error] [pid 59194:tid 59224] [client 172.70.240.59:12269] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_backup"] [unique_id "ac4I7BMpAeV11hcQehwQxgAAAAs"]
[Thu Apr 02 14:13:00.147586 2026] [:error] [pid 54384:tid 54403] [client 172.70.240.59:12262] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.php"] [unique_id "ac4I7NWWpaby3TVN7MejNgAAAdE"]
[Thu Apr 02 14:13:00.159217 2026] [:error] [pid 59200:tid 59257] [client 172.70.240.59:12273] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env~"] [unique_id "ac4I7LfP26txrdLs3Eo5qAAAAFE"]
[Thu Apr 02 14:13:00.602427 2026] [:error] [pid 59201:tid 59279] [client 172.70.240.119:12200] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env2"] [unique_id "ac4I7MAC0Tw8eL6gzZ7T-AAAAIw"]
[Thu Apr 02 14:13:01.109901 2026] [:error] [pid 23927:tid 23951] [client 172.70.240.119:12206] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dist"] [unique_id "ac4I7UsZwqCndhl9uKAg7gAAAZY"]
[Thu Apr 02 14:13:01.122971 2026] [:error] [pid 23927:tid 23952] [client 172.70.240.59:12275] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.envrc"] [unique_id "ac4I7UsZwqCndhl9uKAg7wAAAZc"]
[Thu Apr 02 14:13:01.152318 2026] [:error] [pid 23927:tid 23931] [client 172.70.240.58:10710] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production.bak"] [unique_id "ac4I7UsZwqCndhl9uKAg8AAAAYI"]
[Thu Apr 02 14:13:01.187513 2026] [:error] [pid 59305:tid 59314] [client 172.70.240.119:12210] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.orig"] [unique_id "ac4I7ar2tV4rDwKFxKfS2wAAAMU"]
[Thu Apr 02 14:13:01.187565 2026] [:error] [pid 23927:tid 23935] [client 172.70.240.119:12212] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.prod"] [unique_id "ac4I7UsZwqCndhl9uKAg8QAAAYY"]
[Thu Apr 02 14:13:01.667420 2026] [:error] [pid 23927:tid 23930] [client 172.70.240.59:12279] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev.local"] [unique_id "ac4I7UsZwqCndhl9uKAg9QAAAYE"]
[Thu Apr 02 14:13:02.118134 2026] [:error] [pid 23927:tid 23934] [client 172.70.240.118:12369] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.container"] [unique_id "ac4I7ksZwqCndhl9uKAg9wAAAYU"]
[Thu Apr 02 14:13:02.141719 2026] [:error] [pid 23927:tid 23933] [client 172.70.240.118:12367] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "ac4I7ksZwqCndhl9uKAg-AAAAYQ"]
[Thu Apr 02 14:13:02.154991 2026] [:error] [pid 23927:tid 23945] [client 172.70.240.59:12285] [client 172.70.240.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/docker/.env"] [unique_id "ac4I7ksZwqCndhl9uKAg-QAAAZA"]
[Thu Apr 02 14:13:02.229017 2026] [:error] [pid 23927:tid 23943] [client 172.70.240.58:10713] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/docker/.env.local"] [unique_id "ac4I7ksZwqCndhl9uKAg_AAAAY4"]
[Thu Apr 02 14:13:02.714492 2026] [:error] [pid 59305:tid 59316] [client 172.70.240.118:12376] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/server/.env"] [unique_id "ac4I7qr2tV4rDwKFxKfS3AAAAMc"]
[Thu Apr 02 14:13:03.109639 2026] [:error] [pid 59305:tid 59315] [client 172.70.240.119:12215] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/srv/.env"] [unique_id "ac4I76r2tV4rDwKFxKfS3wAAAMY"]
[Thu Apr 02 14:13:03.143706 2026] [:error] [pid 59305:tid 59324] [client 172.70.240.118:12384] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/web/.env"] [unique_id "ac4I76r2tV4rDwKFxKfS4AAAAM8"]
[Thu Apr 02 14:13:03.202426 2026] [:error] [pid 59305:tid 59332] [client 172.70.240.119:12219] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/site/.env"] [unique_id "ac4I76r2tV4rDwKFxKfS4QAAANc"]
[Thu Apr 02 14:13:03.267652 2026] [:error] [pid 23927:tid 23938] [client 172.70.240.119:12222] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/www/.env"] [unique_id "ac4I70sZwqCndhl9uKAhAAAAAYk"]
[Thu Apr 02 14:13:03.724911 2026] [:error] [pid 23927:tid 23941] [client 172.70.240.119:12229] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/var/www/.env"] [unique_id "ac4I70sZwqCndhl9uKAhAwAAAYw"]
[Thu Apr 02 14:13:04.133122 2026] [:error] [pid 54384:tid 54407] [client 172.70.240.119:12236] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/var/www/html/.env"] [unique_id "ac4I8NWWpaby3TVN7MejNwAAAdU"]
[Thu Apr 02 14:13:04.163206 2026] [:error] [pid 23927:tid 23937] [client 172.70.240.119:12243] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/home/.env"] [unique_id "ac4I8EsZwqCndhl9uKAhBgAAAYg"]
[Thu Apr 02 14:13:04.241565 2026] [:error] [pid 54384:tid 54388] [client 172.70.240.119:12245] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/root/.env"] [unique_id "ac4I8NWWpaby3TVN7MejOAAAAcI"]
[Thu Apr 02 14:13:04.750739 2026] [:error] [pid 59200:tid 59247] [client 172.70.240.118:11411] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ac4I8LfP26txrdLs3Eo5rwAAAEc"]
[Thu Apr 02 14:13:04.756492 2026] [:error] [pid 23927:tid 23945] [client 172.70.240.119:12250] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_secret"] [unique_id "ac4I8EsZwqCndhl9uKAhCQAAAZA"]
[Thu Apr 02 14:13:05.136332 2026] [:error] [pid 59305:tid 59312] [client 172.70.240.58:10718] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_settings"] [unique_id "ac4I8ar2tV4rDwKFxKfS5AAAAMM"]
[Thu Apr 02 14:13:05.261363 2026] [:error] [pid 59305:tid 59322] [client 172.70.240.118:11414] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ac4I8ar2tV4rDwKFxKfS5gAAAM0"]
[Thu Apr 02 14:13:05.267058 2026] [:error] [pid 59305:tid 59330] [client 172.70.240.58:11673] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/index"] [unique_id "ac4I8ar2tV4rDwKFxKfS5wAAANU"]
[Thu Apr 02 14:13:05.643541 2026] [:error] [pid 59305:tid 59324] [client 172.70.240.58:11678] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/logs/HEAD"] [unique_id "ac4I8ar2tV4rDwKFxKfS6gAAAM8"]
[Thu Apr 02 14:13:05.764829 2026] [:error] [pid 23927:tid 23940] [client 172.70.240.58:11683] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/refs/heads/master"] [unique_id "ac4I8UsZwqCndhl9uKAhCwAAAYs"]
[Thu Apr 02 14:13:05.781817 2026] [:error] [pid 23927:tid 23942] [client 172.70.240.58:11688] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/refs/heads/main"] [unique_id "ac4I8UsZwqCndhl9uKAhDAAAAY0"]
[Thu Apr 02 14:13:06.152784 2026] [:error] [pid 23927:tid 23933] [client 172.70.240.58:11694] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ac4I8ksZwqCndhl9uKAhDQAAAYQ"]
[Thu Apr 02 14:13:06.273753 2026] [:error] [pid 54384:tid 54390] [client 172.70.240.118:11415] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "ac4I8tWWpaby3TVN7MejOQAAAcQ"]
[Thu Apr 02 14:13:06.295288 2026] [:error] [pid 59194:tid 59235] [client 172.70.240.119:13839] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production"] [unique_id "ac4I8hMpAeV11hcQehwQxwAAABY"]
[Thu Apr 02 14:13:06.659015 2026] [:error] [pid 54384:tid 54396] [client 172.70.240.118:11420] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development"] [unique_id "ac4I8tWWpaby3TVN7MejOgAAAco"]
[Thu Apr 02 14:13:06.791962 2026] [:error] [pid 54384:tid 54409] [client 172.70.240.118:11423] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "ac4I8tWWpaby3TVN7MejOwAAAdc"]
[Thu Apr 02 14:13:06.805117 2026] [:error] [pid 54384:tid 54406] [client 172.70.240.118:11429] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.test"] [unique_id "ac4I8tWWpaby3TVN7MejPAAAAdQ"]
[Thu Apr 02 14:13:07.176284 2026] [:error] [pid 54384:tid 54408] [client 172.70.240.119:13847] [client 172.70.240.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.staging"] [unique_id "ac4I89WWpaby3TVN7MejPgAAAdY"]
[Thu Apr 02 14:13:07.301589 2026] [:error] [pid 54384:tid 54405] [client 172.70.240.118:11434] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.backup"] [unique_id "ac4I89WWpaby3TVN7MejPwAAAdM"]
[Thu Apr 02 14:13:07.697362 2026] [:error] [pid 23927:tid 23950] [client 172.70.240.118:11442] [client 172.70.240.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.old"] [unique_id "ac4I80sZwqCndhl9uKAhEAAAAZU"]
[Thu Apr 02 14:13:24.241039 2026] [:error] [pid 23927:tid 23944] [client 172.70.240.58:11994] [client 172.70.240.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production.local"] [unique_id "ac4JBEsZwqCndhl9uKAhIwAAAY8"]
[Thu Apr 02 14:13:26.792691 2026] [:error] [pid 59194:tid 59227] [client 172.69.33.44:13377] [client 172.69.33.44] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/config/.env"] [unique_id "ac4JBhMpAeV11hcQehwQywAAAA4"]
[Thu Apr 02 14:13:27.318606 2026] [:error] [pid 54384:tid 54396] [client 172.69.33.36:12741] [client 172.69.33.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ac4JB9WWpaby3TVN7MejTgAAAco"]
[Thu Apr 02 14:13:43.671834 2026] [:error] [pid 59305:tid 59319] [client 172.69.33.58:10039] [client 172.69.33.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/core/.env"] [unique_id "ac4JF6r2tV4rDwKFxKfTSgAAAMo"]
[Thu Apr 02 14:13:44.214684 2026] [:error] [pid 59194:tid 59216] [client 172.69.33.45:11533] [client 172.69.33.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/public/.env"] [unique_id "ac4JGBMpAeV11hcQehwQzAAAAAM"]
[Thu Apr 02 14:13:45.219677 2026] [:error] [pid 29467:tid 29476] [client 172.69.33.40:12562] [client 172.69.33.40] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/config/.env.local"] [unique_id "ac4JGb4VUBFCJAq-WOmpZAAAAQY"]
[Thu Apr 02 14:13:45.693895 2026] [:error] [pid 37543:tid 37562] [client 172.69.33.40:12567] [client 172.69.33.40] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.php"] [unique_id "ac4JGXhdk2bEYJCvILaHaAAAAVE"]
[Thu Apr 02 14:13:46.205951 2026] [:error] [pid 54384:tid 54402] [client 172.69.33.34:13055] [client 172.69.33.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.json"] [unique_id "ac4JGtWWpaby3TVN7MejdgAAAdA"]
[Thu Apr 02 14:13:46.694249 2026] [:error] [pid 37543:tid 37548] [client 172.69.33.51:9972] [client 172.69.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_backup"] [unique_id "ac4JGnhdk2bEYJCvILaHaQAAAUM"]
[Thu Apr 02 14:13:47.233047 2026] [:error] [pid 59201:tid 59285] [client 172.69.34.129:10329] [client 172.69.34.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env~"] [unique_id "ac4JG8AC0Tw8eL6gzZ7UGgAAAJI"]
[Thu Apr 02 14:13:47.263158 2026] [:error] [pid 54384:tid 54406] [client 172.69.33.64:9607] [client 172.69.33.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env2"] [unique_id "ac4JG9WWpaby3TVN7MejeQAAAdQ"]
[Thu Apr 02 14:13:47.714872 2026] [:error] [pid 37543:tid 37561] [client 172.69.33.35:12221] [client 172.69.33.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dist"] [unique_id "ac4JG3hdk2bEYJCvILaHagAAAVA"]
[Thu Apr 02 14:13:47.779987 2026] [:error] [pid 37543:tid 37552] [client 172.69.33.41:10100] [client 172.69.33.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.envrc"] [unique_id "ac4JG3hdk2bEYJCvILaHawAAAUc"]
[Thu Apr 02 14:13:48.249883 2026] [:error] [pid 59201:tid 59277] [client 172.69.34.129:10333] [client 172.69.34.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.orig"] [unique_id "ac4JHMAC0Tw8eL6gzZ7UGwAAAIo"]
[Thu Apr 02 14:13:48.299225 2026] [:error] [pid 23927:tid 23946] [client 172.69.33.50:12132] [client 172.69.33.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production.bak"] [unique_id "ac4JHEsZwqCndhl9uKAhSAAAAZE"]
[Thu Apr 02 14:13:48.789594 2026] [:error] [pid 59200:tid 59250] [client 172.69.34.175:13193] [client 172.69.34.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.prod"] [unique_id "ac4JHLfP26txrdLs3Eo5vgAAAEo"]
[Thu Apr 02 14:13:48.835918 2026] [:error] [pid 54384:tid 54408] [client 172.69.33.51:9979] [client 172.69.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev.local"] [unique_id "ac4JHNWWpaby3TVN7MejewAAAdY"]
[Thu Apr 02 14:13:49.331312 2026] [:error] [pid 59201:tid 59275] [client 172.69.34.175:13199] [client 172.69.34.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "ac4JHcAC0Tw8eL6gzZ7UHAAAAIg"]
[Thu Apr 02 14:13:49.339973 2026] [:error] [pid 54384:tid 54387] [client 172.69.33.41:10106] [client 172.69.33.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.container"] [unique_id "ac4JHdWWpaby3TVN7MejfAAAAcE"]
[Thu Apr 02 14:13:49.444582 2026] [:error] [pid 54384:tid 54397] [client 172.69.33.50:12138] [client 172.69.33.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/docker/.env"] [unique_id "ac4JHdWWpaby3TVN7MejfQAAAcs"]
[Thu Apr 02 14:13:49.820281 2026] [:error] [pid 23927:tid 23932] [client 172.69.33.34:13058] [client 172.69.33.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/docker/.env.local"] [unique_id "ac4JHUsZwqCndhl9uKAhSQAAAYM"]
[Thu Apr 02 14:13:49.990868 2026] [:error] [pid 29467:tid 29480] [client 172.69.34.176:13915] [client 172.69.34.176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/server/.env"] [unique_id "ac4JHb4VUBFCJAq-WOmpZwAAAQo"]
[Thu Apr 02 14:13:50.358379 2026] [:error] [pid 59201:tid 59284] [client 172.69.33.37:11056] [client 172.69.33.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/web/.env"] [unique_id "ac4JHsAC0Tw8eL6gzZ7UHgAAAJE"]
[Thu Apr 02 14:13:50.360421 2026] [:error] [pid 54384:tid 54393] [client 172.69.33.45:14277] [client 172.69.33.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/srv/.env"] [unique_id "ac4JHtWWpaby3TVN7MejfwAAAcc"]
[Thu Apr 02 14:13:50.477394 2026] [:error] [pid 54384:tid 54402] [client 172.69.33.41:11659] [client 172.69.33.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/site/.env"] [unique_id "ac4JHtWWpaby3TVN7MejgAAAAdA"]
[Thu Apr 02 14:13:50.835307 2026] [:error] [pid 59194:tid 59214] [client 172.69.33.34:13062] [client 172.69.33.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/www/.env"] [unique_id "ac4JHhMpAeV11hcQehwQ0gAAAAE"]
[Thu Apr 02 14:13:50.858416 2026] [:error] [pid 59201:tid 59286] [client 172.69.33.40:9927] [client 172.69.33.40] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/var/www/.env"] [unique_id "ac4JHsAC0Tw8eL6gzZ7UHwAAAJM"]
[Thu Apr 02 14:13:51.100284 2026] [:error] [pid 29467:tid 29478] [client 172.69.34.175:13202] [client 172.69.34.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/var/www/html/.env"] [unique_id "ac4JH74VUBFCJAq-WOmpaQAAAQg"]
[Thu Apr 02 14:13:51.347632 2026] [:error] [pid 29467:tid 29479] [client 172.69.33.50:12140] [client 172.69.33.50] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/root/.env"] [unique_id "ac4JH74VUBFCJAq-WOmpagAAAQk"]
[Thu Apr 02 14:13:51.371327 2026] [:error] [pid 23927:tid 23950] [client 172.69.33.37:11062] [client 172.69.33.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/home/.env"] [unique_id "ac4JH0sZwqCndhl9uKAhSgAAAZU"]
[Thu Apr 02 14:13:51.642209 2026] [:error] [pid 59305:tid 59327] [client 172.69.33.45:14278] [client 172.69.33.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_config"] [unique_id "ac4JH6r2tV4rDwKFxKfTUQAAANI"]
[Thu Apr 02 14:13:51.896588 2026] [:error] [pid 59305:tid 59310] [client 172.69.33.35:12228] [client 172.69.33.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_settings"] [unique_id "ac4JH6r2tV4rDwKFxKfTUgAAAME"]
[Thu Apr 02 14:13:52.158609 2026] [:error] [pid 37543:tid 37555] [client 172.69.33.30:12800] [client 172.69.33.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local.backup"] [unique_id "ac4JIHhdk2bEYJCvILaHcAAAAUo"]
[Thu Apr 02 14:13:52.662525 2026] [:error] [pid 37543:tid 37554] [client 172.69.33.41:11666] [client 172.69.33.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_secret"] [unique_id "ac4JIHhdk2bEYJCvILaHcQAAAUk"]
[Thu Apr 02 14:14:03.615124 2026] [:error] [pid 54384:tid 54407] [client 172.69.33.41:13103] [client 172.69.33.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/private/.env"] [unique_id "ac4JK9WWpaby3TVN7MejigAAAdU"]
[Thu Apr 02 14:14:06.893639 2026] [:error] [pid 59305:tid 59314] [client 172.69.33.51:13235] [client 172.69.33.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env1"] [unique_id "ac4JLqr2tV4rDwKFxKfTWAAAAMU"]
[Thu Apr 02 14:47:59.198574 2026] [:error] [pid 23927:tid 23947] [client 199.255.218.52:13100] [client 199.255.218.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.255.218.52, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac4RH0sZwqCndhl9uKAv0gAAAZI"]
[Thu Apr 02 14:47:59.209385 2026] [proxy_fcgi:error] [pid 23927:tid 23947] [client 199.255.218.52:13100] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 15:46:54.213785 2026] [:error] [pid 23927:tid 23949] [client 43.133.139.6:45698] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac4e7ksZwqCndhl9uKBL-wAAAZQ"]
[Thu Apr 02 16:58:38.926372 2026] [:error] [pid 54384:tid 54407] [client 43.159.148.221:47926] [client 43.159.148.221] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac4vvtWWpaby3TVN7MfTmAAAAdU"]
[Thu Apr 02 19:34:21.315950 2026] [proxy_fcgi:error] [pid 59201:tid 59268] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:21.575165 2026] [proxy_fcgi:error] [pid 59201:tid 59267] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:21.899518 2026] [proxy_fcgi:error] [pid 59201:tid 59284] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:22.226317 2026] [proxy_fcgi:error] [pid 59201:tid 59270] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:22.513295 2026] [proxy_fcgi:error] [pid 59201:tid 59274] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:22.847160 2026] [proxy_fcgi:error] [pid 59201:tid 59283] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:24.313649 2026] [proxy_fcgi:error] [pid 59201:tid 59290] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:24.597431 2026] [proxy_fcgi:error] [pid 59201:tid 59276] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:24.860779 2026] [proxy_fcgi:error] [pid 59201:tid 59286] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:25.240622 2026] [proxy_fcgi:error] [pid 59201:tid 59281] [client 74.248.145.211:5489] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:34:25.495789 2026] [:error] [pid 59201:tid 59269] [client 74.248.145.211:5489] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ac5UQcAC0Tw8eL6gzZ4WoAAAAII"]
[Thu Apr 02 19:34:26.410261 2026] [:error] [pid 23927:tid 23934] [client 74.248.145.211:38798] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ac5UQksZwqCndhl9uKCmIQAAAYU"]
[Thu Apr 02 19:34:27.093211 2026] [:error] [pid 54384:tid 54402] [client 74.248.145.211:41602] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ac5UQ9WWpaby3TVN7McI0wAAAdA"]
[Thu Apr 02 19:34:27.756663 2026] [:error] [pid 29467:tid 29472] [client 74.248.145.211:38842] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ac5UQ74VUBFCJAq-WOlupAAAAQI"]
[Thu Apr 02 19:34:28.546505 2026] [:error] [pid 29467:tid 29488] [client 74.248.145.211:39500] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ac5URL4VUBFCJAq-WOluqAAAARI"]
[Thu Apr 02 19:34:29.361100 2026] [:error] [pid 59305:tid 59330] [client 74.248.145.211:38816] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ac5URar2tV4rDwKFxKd93wAAANU"]
[Thu Apr 02 19:34:30.019774 2026] [:error] [pid 54384:tid 54409] [client 74.248.145.211:39510] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ac5URtWWpaby3TVN7McI1gAAAdc"]
[Thu Apr 02 19:34:30.671617 2026] [:error] [pid 54384:tid 54399] [client 74.248.145.211:6000] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ac5URtWWpaby3TVN7McI1wAAAc0"]
[Thu Apr 02 19:34:31.458497 2026] [:error] [pid 23927:tid 23931] [client 74.248.145.211:5455] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "ac5UR0sZwqCndhl9uKCmJAAAAYI"]
[Thu Apr 02 19:34:32.046101 2026] [:error] [pid 59194:tid 59231] [client 74.248.145.211:5970] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "ac5USBMpAeV11hcQehxBOQAAABI"]
[Thu Apr 02 19:34:33.023911 2026] [:error] [pid 23927:tid 23932] [client 74.248.145.211:5859] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "ac5USUsZwqCndhl9uKCmJQAAAYM"]
[Thu Apr 02 19:34:34.106526 2026] [:error] [pid 59200:tid 59248] [client 74.248.145.211:6015] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "ac5USrfP26txrdLs3EpwBQAAAEg"]
[Thu Apr 02 19:34:34.981758 2026] [:error] [pid 59201:tid 59289] [client 74.248.145.211:38799] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.yuf.php"] [unique_id "ac5USsAC0Tw8eL6gzZ4WqQAAAJY"]
[Thu Apr 02 19:34:35.852062 2026] [:error] [pid 54384:tid 54400] [client 74.248.145.211:5986] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.yuf.php"] [unique_id "ac5US9WWpaby3TVN7McI3wAAAc4"]
[Thu Apr 02 19:34:36.465660 2026] [:error] [pid 54384:tid 54410] [client 74.248.145.211:41639] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.yuf.php"] [unique_id "ac5UTNWWpaby3TVN7McI4QAAAdg"]
[Thu Apr 02 19:34:37.250402 2026] [:error] [pid 23927:tid 23940] [client 74.248.145.211:5664] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.yuf.php"] [unique_id "ac5UTUsZwqCndhl9uKCmKgAAAYs"]
[Thu Apr 02 19:34:37.994613 2026] [:error] [pid 59201:tid 59288] [client 74.248.145.211:5475] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "ac5UTcAC0Tw8eL6gzZ4WsgAAAJU"]
[Thu Apr 02 19:34:38.671935 2026] [:error] [pid 59200:tid 59262] [client 74.248.145.211:5352] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "ac5UTrfP26txrdLs3EpwCwAAAFY"]
[Thu Apr 02 19:34:39.469772 2026] [:error] [pid 59305:tid 59315] [client 74.248.145.211:5448] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "ac5UT6r2tV4rDwKFxKd96QAAAMY"]
[Thu Apr 02 19:34:40.229309 2026] [:error] [pid 59200:tid 59264] [client 74.248.145.211:5864] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "ac5UULfP26txrdLs3EpwDAAAAFg"]
[Thu Apr 02 19:34:40.855373 2026] [:error] [pid 59200:tid 59247] [client 74.248.145.211:5370] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ac5UULfP26txrdLs3EpwDgAAAEc"]
[Thu Apr 02 19:34:41.524028 2026] [:error] [pid 29467:tid 29489] [client 74.248.145.211:5683] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ac5UUb4VUBFCJAq-WOluvQAAARM"]
[Thu Apr 02 19:34:42.137230 2026] [:error] [pid 29467:tid 29478] [client 74.248.145.211:5458] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ac5UUr4VUBFCJAq-WOluwgAAAQg"]
[Thu Apr 02 19:34:42.819099 2026] [:error] [pid 23927:tid 23930] [client 74.248.145.211:39549] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ac5UUksZwqCndhl9uKCmMgAAAYE"]
[Thu Apr 02 19:34:43.421062 2026] [:error] [pid 37543:tid 37548] [client 74.248.145.211:5687] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "ac5UU3hdk2bEYJCvILbWnAAAAUM"]
[Thu Apr 02 19:34:44.358941 2026] [:error] [pid 59305:tid 59320] [client 74.248.145.211:5650] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "ac5UVKr2tV4rDwKFxKd97wAAAMs"]
[Thu Apr 02 19:34:45.502548 2026] [:error] [pid 59194:tid 59235] [client 74.248.145.211:5838] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "ac5UVRMpAeV11hcQehxBOgAAABY"]
[Thu Apr 02 19:34:46.275494 2026] [:error] [pid 29467:tid 29471] [client 74.248.145.211:41710] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "ac5UVr4VUBFCJAq-WOluyAAAAQE"]
[Thu Apr 02 19:34:47.044235 2026] [:error] [pid 59194:tid 59215] [client 74.248.145.211:39491] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac5UVxMpAeV11hcQehxBPAAAAAI"]
[Thu Apr 02 19:34:47.701745 2026] [:error] [pid 37543:tid 37551] [client 74.248.145.211:5373] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac5UV3hdk2bEYJCvILbWqgAAAUY"]
[Thu Apr 02 19:34:48.528180 2026] [:error] [pid 54384:tid 54410] [client 74.248.145.211:6007] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac5UWNWWpaby3TVN7McI6AAAAdg"]
[Thu Apr 02 19:34:49.174864 2026] [:error] [pid 29467:tid 29478] [client 74.248.145.211:5684] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ac5UWb4VUBFCJAq-WOluygAAAQg"]
[Thu Apr 02 19:34:49.773189 2026] [:error] [pid 29467:tid 29482] [client 74.248.145.211:5963] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "ac5UWb4VUBFCJAq-WOluzgAAAQw"]
[Thu Apr 02 19:34:50.383165 2026] [:error] [pid 59194:tid 59232] [client 74.248.145.211:39515] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "ac5UWhMpAeV11hcQehxBPgAAABM"]
[Thu Apr 02 19:34:51.054902 2026] [:error] [pid 29467:tid 29483] [client 74.248.145.211:5665] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "ac5UW74VUBFCJAq-WOlu0AAAAQ0"]
[Thu Apr 02 19:34:51.956309 2026] [:error] [pid 29467:tid 29471] [client 74.248.145.211:41676] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "ac5UW74VUBFCJAq-WOlu0wAAAQE"]
[Thu Apr 02 19:34:52.729137 2026] [:error] [pid 59194:tid 59226] [client 74.248.145.211:5993] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "ac5UXBMpAeV11hcQehxBQwAAAA0"]
[Thu Apr 02 19:34:53.443830 2026] [:error] [pid 54384:tid 54399] [client 74.248.145.211:5887] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "ac5UXdWWpaby3TVN7McI7QAAAc0"]
[Thu Apr 02 19:34:54.049734 2026] [:error] [pid 59200:tid 59248] [client 74.248.145.211:5996] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "ac5UXrfP26txrdLs3EpwFgAAAEg"]
[Thu Apr 02 19:34:54.966517 2026] [:error] [pid 37543:tid 37545] [client 74.248.145.211:5655] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "ac5UXnhdk2bEYJCvILbWsQAAAUA"]
[Thu Apr 02 19:34:55.623083 2026] [:error] [pid 59200:tid 59249] [client 74.248.145.211:5636] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "ac5UX7fP26txrdLs3EpwGgAAAEk"]
[Thu Apr 02 19:34:56.324651 2026] [:error] [pid 59194:tid 59230] [client 74.248.145.211:5456] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "ac5UYBMpAeV11hcQehxBRQAAABE"]
[Thu Apr 02 19:34:57.068469 2026] [:error] [pid 59201:tid 59269] [client 74.248.145.211:38795] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "ac5UYcAC0Tw8eL6gzZ4WuQAAAII"]
[Thu Apr 02 19:34:57.743276 2026] [:error] [pid 59194:tid 59224] [client 74.248.145.211:41637] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "ac5UYRMpAeV11hcQehxBSQAAAAs"]
[Thu Apr 02 19:34:59.348642 2026] [:error] [pid 59200:tid 59257] [client 74.248.145.211:5195] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac5UY7fP26txrdLs3EpwHgAAAFE"]
[Thu Apr 02 19:35:00.038100 2026] [:error] [pid 29467:tid 29487] [client 74.248.145.211:6009] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac5UZL4VUBFCJAq-WOlu1gAAARE"]
[Thu Apr 02 19:35:01.513411 2026] [:error] [pid 29467:tid 29492] [client 74.248.145.211:5653] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac5UZb4VUBFCJAq-WOlu4AAAARY"]
[Thu Apr 02 19:35:02.316920 2026] [:error] [pid 29467:tid 29489] [client 74.248.145.211:38788] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "ac5UZr4VUBFCJAq-WOlu6AAAARM"]
[Thu Apr 02 19:35:03.007406 2026] [:error] [pid 29467:tid 29480] [client 74.248.145.211:5867] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1111.php"] [unique_id "ac5UZ74VUBFCJAq-WOlu7QAAAQo"]
[Thu Apr 02 19:35:03.805751 2026] [:error] [pid 59194:tid 59216] [client 74.248.145.211:5988] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1111.php"] [unique_id "ac5UZxMpAeV11hcQehxBTgAAAAM"]
[Thu Apr 02 19:35:04.421690 2026] [:error] [pid 59305:tid 59324] [client 74.248.145.211:5652] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1111.php"] [unique_id "ac5UaKr2tV4rDwKFxKd-BAAAAM8"]
[Thu Apr 02 19:35:05.132979 2026] [:error] [pid 59194:tid 59217] [client 74.248.145.211:41603] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1111.php"] [unique_id "ac5UaRMpAeV11hcQehxBUAAAAAQ"]
[Thu Apr 02 19:35:05.684331 2026] [:error] [pid 37543:tid 37553] [client 74.248.145.211:5850] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "ac5UaXhdk2bEYJCvILbW0QAAAUg"]
[Thu Apr 02 19:35:06.400994 2026] [:error] [pid 59194:tid 59230] [client 74.248.145.211:5667] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "ac5UahMpAeV11hcQehxBUQAAABE"]
[Thu Apr 02 19:35:06.959381 2026] [:error] [pid 37543:tid 37569] [client 74.248.145.211:5470] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "ac5Uanhdk2bEYJCvILbW1wAAAVg"]
[Thu Apr 02 19:35:07.938915 2026] [:error] [pid 59305:tid 59332] [client 74.248.145.211:5852] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "ac5Ua6r2tV4rDwKFxKd-CgAAANc"]
[Thu Apr 02 19:35:08.594624 2026] [:error] [pid 54384:tid 54395] [client 74.248.145.211:5464] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "ac5UbNWWpaby3TVN7McI-QAAAck"]
[Thu Apr 02 19:35:09.244806 2026] [:error] [pid 59194:tid 59213] [client 74.248.145.211:38786] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "ac5UbRMpAeV11hcQehxBVQAAAAA"]
[Thu Apr 02 19:35:09.904419 2026] [:error] [pid 59201:tid 59273] [client 74.248.145.211:5329] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "ac5UbcAC0Tw8eL6gzZ4WxgAAAIY"]
[Thu Apr 02 19:35:10.664200 2026] [:error] [pid 59305:tid 59327] [client 74.248.145.211:38809] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "ac5Ubqr2tV4rDwKFxKd-DAAAANI"]
[Thu Apr 02 19:35:11.197734 2026] [:error] [pid 23927:tid 23930] [client 74.248.145.211:5452] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "ac5Ub0sZwqCndhl9uKCmTQAAAYE"]
[Thu Apr 02 19:35:11.933293 2026] [:error] [pid 59305:tid 59324] [client 74.248.145.211:5955] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "ac5Ub6r2tV4rDwKFxKd-DgAAAM8"]
[Thu Apr 02 19:35:12.690787 2026] [:error] [pid 59305:tid 59309] [client 74.248.145.211:5998] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "ac5UcKr2tV4rDwKFxKd-FQAAAMA"]
[Thu Apr 02 19:35:13.300563 2026] [:error] [pid 59305:tid 59317] [client 74.248.145.211:40963] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "ac5Ucar2tV4rDwKFxKd-GAAAAMg"]
[Thu Apr 02 19:35:14.123080 2026] [:error] [pid 23927:tid 23951] [client 74.248.145.211:5662] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "ac5UcksZwqCndhl9uKCmTwAAAZY"]
[Thu Apr 02 19:35:14.820518 2026] [:error] [pid 23927:tid 23946] [client 74.248.145.211:5495] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "ac5UcksZwqCndhl9uKCmUQAAAZE"]
[Thu Apr 02 19:35:15.500098 2026] [:error] [pid 54384:tid 54392] [client 74.248.145.211:39517] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "ac5Uc9WWpaby3TVN7McI_QAAAcY"]
[Thu Apr 02 19:35:16.077444 2026] [:error] [pid 54384:tid 54390] [client 74.248.145.211:41677] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "ac5UdNWWpaby3TVN7McI_wAAAcQ"]
[Thu Apr 02 19:35:16.703792 2026] [:error] [pid 23927:tid 23953] [client 74.248.145.211:5372] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "ac5UdEsZwqCndhl9uKCmWAAAAZg"]
[Thu Apr 02 19:35:17.541033 2026] [:error] [pid 29467:tid 29494] [client 74.248.145.211:41698] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "ac5Udb4VUBFCJAq-WOlvFwAAARg"]
[Thu Apr 02 19:35:18.386395 2026] [:error] [pid 37543:tid 37548] [client 74.248.145.211:5447] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "ac5Udnhdk2bEYJCvILbW9wAAAUM"]
[Thu Apr 02 19:35:19.099675 2026] [:error] [pid 29467:tid 29476] [client 74.248.145.211:41699] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "ac5Ud74VUBFCJAq-WOlvKQAAAQY"]
[Thu Apr 02 19:35:19.727700 2026] [:error] [pid 29467:tid 29487] [client 74.248.145.211:5368] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac5Ud74VUBFCJAq-WOlvOgAAARE"]
[Thu Apr 02 19:35:20.366966 2026] [:error] [pid 59200:tid 59252] [client 74.248.145.211:6010] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac5UeLfP26txrdLs3EpwLQAAAEw"]
[Thu Apr 02 19:35:21.101971 2026] [:error] [pid 59305:tid 59317] [client 74.248.145.211:41673] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac5Uear2tV4rDwKFxKd-IwAAAMg"]
[Thu Apr 02 19:35:21.753455 2026] [:error] [pid 37543:tid 37546] [client 74.248.145.211:41642] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac5UeXhdk2bEYJCvILbW-gAAAUE"]
[Thu Apr 02 19:35:22.471349 2026] [:error] [pid 59194:tid 59220] [client 74.248.145.211:41681] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ac5UehMpAeV11hcQehxBWAAAAAc"]
[Thu Apr 02 19:35:23.281567 2026] [:error] [pid 59201:tid 59268] [client 74.248.145.211:5638] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ac5Ue8AC0Tw8eL6gzZ4WzwAAAIE"]
[Thu Apr 02 19:35:23.867880 2026] [:error] [pid 59201:tid 59287] [client 74.248.145.211:5681] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ac5Ue8AC0Tw8eL6gzZ4W0wAAAJQ"]
[Thu Apr 02 19:35:24.702330 2026] [:error] [pid 59200:tid 59248] [client 74.248.145.211:41637] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ac5UfLfP26txrdLs3EpwLwAAAEg"]
[Thu Apr 02 19:35:25.275351 2026] [proxy_fcgi:error] [pid 37543:tid 37569] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:26.065785 2026] [proxy_fcgi:error] [pid 37543:tid 37562] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:26.411452 2026] [proxy_fcgi:error] [pid 37543:tid 37567] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:26.671056 2026] [proxy_fcgi:error] [pid 37543:tid 37566] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:26.970701 2026] [proxy_fcgi:error] [pid 37543:tid 37551] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:27.295888 2026] [proxy_fcgi:error] [pid 37543:tid 37557] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:27.555681 2026] [proxy_fcgi:error] [pid 37543:tid 37553] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:27.814094 2026] [proxy_fcgi:error] [pid 37543:tid 37547] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:28.141395 2026] [proxy_fcgi:error] [pid 37543:tid 37548] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:28.436725 2026] [proxy_fcgi:error] [pid 37543:tid 37564] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:28.695077 2026] [proxy_fcgi:error] [pid 37543:tid 37561] [client 74.248.145.211:5349] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:35:29.000671 2026] [:error] [pid 37543:tid 37546] [client 74.248.145.211:5349] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ac5UgHhdk2bEYJCvILbXDAAAAUE"]
[Thu Apr 02 19:35:31.578787 2026] [:error] [pid 59200:tid 59244] [client 74.248.145.211:5858] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ac5Ug7fP26txrdLs3EpwOgAAAEQ"]
[Thu Apr 02 19:35:32.359275 2026] [:error] [pid 59305:tid 59324] [client 74.248.145.211:41707] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ac5UhKr2tV4rDwKFxKd-MwAAAM8"]
[Thu Apr 02 19:35:33.126841 2026] [:error] [pid 23927:tid 23941] [client 74.248.145.211:5976] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ac5UhUsZwqCndhl9uKCmZQAAAYw"]
[Thu Apr 02 19:35:33.861524 2026] [:error] [pid 54384:tid 54406] [client 74.248.145.211:39490] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5UhdWWpaby3TVN7McJHQAAAdQ"]
[Thu Apr 02 19:35:34.397418 2026] [:error] [pid 54384:tid 54392] [client 74.248.145.211:38807] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5UhtWWpaby3TVN7McJIAAAAcY"]
[Thu Apr 02 19:35:35.307693 2026] [:error] [pid 59305:tid 59332] [client 74.248.145.211:5356] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5Uh6r2tV4rDwKFxKd-OwAAANc"]
[Thu Apr 02 19:35:36.016149 2026] [:error] [pid 29467:tid 29477] [client 74.248.145.211:41622] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5UiL4VUBFCJAq-WOlvWgAAAQc"]
[Thu Apr 02 19:35:36.878304 2026] [:error] [pid 37543:tid 37567] [client 74.248.145.211:5492] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "ac5UiHhdk2bEYJCvILbXFAAAAVY"]
[Thu Apr 02 19:35:38.668340 2026] [:error] [pid 54384:tid 54404] [client 74.248.145.211:5484] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "ac5UitWWpaby3TVN7McJIwAAAdI"]
[Thu Apr 02 19:35:39.317486 2026] [:error] [pid 59305:tid 59311] [client 74.248.145.211:5676] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "ac5Ui6r2tV4rDwKFxKd-RAAAAMI"]
[Thu Apr 02 19:35:40.081700 2026] [:error] [pid 59201:tid 59291] [client 74.248.145.211:5692] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "ac5UjMAC0Tw8eL6gzZ4W3QAAAJg"]
[Thu Apr 02 19:35:40.958142 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:39546] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ac5UjKr2tV4rDwKFxKd-SgAAANA"]
[Thu Apr 02 19:35:41.731876 2026] [:error] [pid 59201:tid 59289] [client 74.248.145.211:5914] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ac5UjcAC0Tw8eL6gzZ4W4AAAAJY"]
[Thu Apr 02 19:35:42.286127 2026] [:error] [pid 23927:tid 23934] [client 74.248.145.211:5957] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ac5UjksZwqCndhl9uKCmcgAAAYU"]
[Thu Apr 02 19:35:42.962986 2026] [:error] [pid 37543:tid 37556] [client 74.248.145.211:5323] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ac5Ujnhdk2bEYJCvILbXGQAAAUs"]
[Thu Apr 02 19:35:43.567038 2026] [:error] [pid 54384:tid 54389] [client 74.248.145.211:5991] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac5Uj9WWpaby3TVN7McJKwAAAcM"]
[Thu Apr 02 19:35:44.293858 2026] [:error] [pid 23927:tid 23948] [client 74.248.145.211:38812] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac5UkEsZwqCndhl9uKCmeQAAAZM"]
[Thu Apr 02 19:35:44.907664 2026] [:error] [pid 59305:tid 59323] [client 74.248.145.211:40163] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac5UkKr2tV4rDwKFxKd-VwAAAM4"]
[Thu Apr 02 19:35:45.742783 2026] [:error] [pid 23927:tid 23933] [client 74.248.145.211:5461] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "ac5UkUsZwqCndhl9uKCmfQAAAYQ"]
[Thu Apr 02 19:35:46.375864 2026] [:error] [pid 23927:tid 23931] [client 74.248.145.211:5490] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "ac5UkksZwqCndhl9uKCmfgAAAYI"]
[Thu Apr 02 19:35:47.056155 2026] [:error] [pid 37543:tid 37549] [client 74.248.145.211:40182] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "ac5Uk3hdk2bEYJCvILbXIgAAAUQ"]
[Thu Apr 02 19:35:47.807175 2026] [:error] [pid 23927:tid 23932] [client 74.248.145.211:5870] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "ac5Uk0sZwqCndhl9uKCmgwAAAYM"]
[Thu Apr 02 19:35:48.382514 2026] [:error] [pid 23927:tid 23941] [client 74.248.145.211:41617] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eee.php"] [unique_id "ac5UlEsZwqCndhl9uKCmhAAAAYw"]
[Thu Apr 02 19:35:49.072573 2026] [:error] [pid 59201:tid 59270] [client 74.248.145.211:41669] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ac5UlcAC0Tw8eL6gzZ4W6gAAAIM"]
[Thu Apr 02 19:35:49.697156 2026] [:error] [pid 23927:tid 23942] [client 74.248.145.211:38838] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ac5UlUsZwqCndhl9uKCmhwAAAY0"]
[Thu Apr 02 19:35:50.290812 2026] [:error] [pid 59305:tid 59330] [client 74.248.145.211:5677] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ac5Ulqr2tV4rDwKFxKd-XQAAANU"]
[Thu Apr 02 19:35:50.897440 2026] [:error] [pid 23927:tid 23943] [client 74.248.145.211:5913] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ac5UlksZwqCndhl9uKCmiwAAAY4"]
[Thu Apr 02 19:35:51.543354 2026] [:error] [pid 59194:tid 59237] [client 74.248.145.211:5494] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ac5UlxMpAeV11hcQehxBaQAAABg"]
[Thu Apr 02 19:35:52.968956 2026] [:error] [pid 29467:tid 29481] [client 74.248.145.211:5221] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ac5UmL4VUBFCJAq-WOlvZAAAAQs"]
[Thu Apr 02 19:35:53.684716 2026] [:error] [pid 59194:tid 59222] [client 74.248.145.211:38818] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ac5UmRMpAeV11hcQehxBagAAAAk"]
[Thu Apr 02 19:35:54.273145 2026] [:error] [pid 23927:tid 23932] [client 74.248.145.211:39494] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ac5UmksZwqCndhl9uKCmmgAAAYM"]
[Thu Apr 02 19:35:54.958756 2026] [:error] [pid 37543:tid 37569] [client 74.248.145.211:5997] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swallowable.php"] [unique_id "ac5Umnhdk2bEYJCvILbXJQAAAVg"]
[Thu Apr 02 19:35:55.604214 2026] [:error] [pid 54384:tid 54397] [client 74.248.145.211:5967] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swallowable.php"] [unique_id "ac5Um9WWpaby3TVN7McJPwAAAcs"]
[Thu Apr 02 19:35:56.158956 2026] [:error] [pid 54384:tid 54408] [client 74.248.145.211:5642] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swallowable.php"] [unique_id "ac5UnNWWpaby3TVN7McJQgAAAdY"]
[Thu Apr 02 19:35:56.750958 2026] [:error] [pid 37543:tid 37562] [client 74.248.145.211:5399] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/swallowable.php"] [unique_id "ac5UnHhdk2bEYJCvILbXKQAAAVE"]
[Thu Apr 02 19:35:57.330316 2026] [:error] [pid 59194:tid 59234] [client 74.248.145.211:41621] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ac5UnRMpAeV11hcQehxBbgAAABU"]
[Thu Apr 02 19:35:57.920495 2026] [:error] [pid 59201:tid 59283] [client 74.248.145.211:39547] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ac5UncAC0Tw8eL6gzZ4W7gAAAJA"]
[Thu Apr 02 19:35:58.514096 2026] [:error] [pid 54384:tid 54400] [client 74.248.145.211:5688] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ac5UntWWpaby3TVN7McJRgAAAc4"]
[Thu Apr 02 19:35:59.176187 2026] [:error] [pid 59305:tid 59327] [client 74.248.145.211:5657] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ac5Un6r2tV4rDwKFxKd-agAAANI"]
[Thu Apr 02 19:35:59.944886 2026] [:error] [pid 59194:tid 59230] [client 74.248.145.211:5351] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ac5UnxMpAeV11hcQehxBcQAAABE"]
[Thu Apr 02 19:36:00.821953 2026] [:error] [pid 29467:tid 29483] [client 74.248.145.211:41691] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ac5UoL4VUBFCJAq-WOlvZgAAAQ0"]
[Thu Apr 02 19:36:01.501056 2026] [:error] [pid 29467:tid 29488] [client 74.248.145.211:5849] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ac5Uob4VUBFCJAq-WOlvaQAAARI"]
[Thu Apr 02 19:36:02.124199 2026] [:error] [pid 29467:tid 29470] [client 74.248.145.211:39551] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ac5Uor4VUBFCJAq-WOlvbwAAAQA"]
[Thu Apr 02 19:36:02.955214 2026] [:error] [pid 59194:tid 59235] [client 74.248.145.211:39519] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ac5UohMpAeV11hcQehxBcgAAABY"]
[Thu Apr 02 19:36:03.560877 2026] [:error] [pid 23927:tid 23934] [client 74.248.145.211:39525] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ac5Uo0sZwqCndhl9uKCmpgAAAYU"]
[Thu Apr 02 19:36:05.239454 2026] [:error] [pid 59201:tid 59291] [client 74.248.145.211:5837] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ac5UpcAC0Tw8eL6gzZ4W8wAAAJg"]
[Thu Apr 02 19:36:06.145116 2026] [:error] [pid 29467:tid 29471] [client 74.248.145.211:5873] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ac5Upr4VUBFCJAq-WOlveAAAAQE"]
[Thu Apr 02 19:36:07.293841 2026] [:error] [pid 37543:tid 37554] [client 74.248.145.211:5375] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ac5Up3hdk2bEYJCvILbXNAAAAUk"]
[Thu Apr 02 19:36:08.118989 2026] [:error] [pid 23927:tid 23948] [client 74.248.145.211:39539] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ac5UqEsZwqCndhl9uKCmqAAAAZM"]
[Thu Apr 02 19:36:09.013543 2026] [:error] [pid 29467:tid 29471] [client 74.248.145.211:5344] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ac5Uqb4VUBFCJAq-WOlvgAAAAQE"]
[Thu Apr 02 19:36:09.670540 2026] [:error] [pid 29467:tid 29473] [client 74.248.145.211:5833] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ac5Uqb4VUBFCJAq-WOlvgQAAAQM"]
[Thu Apr 02 19:36:10.499285 2026] [:error] [pid 29467:tid 29484] [client 74.248.145.211:41616] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ac5Uqr4VUBFCJAq-WOlvhQAAAQ4"]
[Thu Apr 02 19:36:11.131519 2026] [:error] [pid 54384:tid 54388] [client 74.248.145.211:41686] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ac5Uq9WWpaby3TVN7McJWgAAAcI"]
[Thu Apr 02 19:36:11.994127 2026] [:error] [pid 59200:tid 59247] [client 74.248.145.211:41697] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ac5Uq7fP26txrdLs3EpwUwAAAEc"]
[Thu Apr 02 19:36:13.129143 2026] [:error] [pid 59305:tid 59320] [client 74.248.145.211:41687] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ac5Urar2tV4rDwKFxKd-gQAAAMs"]
[Thu Apr 02 19:36:14.064098 2026] [:error] [pid 59305:tid 59326] [client 74.248.145.211:41640] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ac5Urqr2tV4rDwKFxKd-ggAAANE"]
[Thu Apr 02 19:36:14.962696 2026] [:error] [pid 29467:tid 29472] [client 74.248.145.211:5371] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ac5Urr4VUBFCJAq-WOlvmQAAAQI"]
[Thu Apr 02 19:36:15.988816 2026] [:error] [pid 29467:tid 29478] [client 74.248.145.211:5472] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ac5Ur74VUBFCJAq-WOlvnQAAAQg"]
[Thu Apr 02 19:36:18.085859 2026] [:error] [pid 59305:tid 59319] [client 74.248.145.211:39528] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ac5Usqr2tV4rDwKFxKd-iQAAAMo"]
[Thu Apr 02 19:36:19.414555 2026] [:error] [pid 59194:tid 59221] [client 74.248.145.211:5478] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "ac5UsxMpAeV11hcQehxBfwAAAAg"]
[Thu Apr 02 19:36:20.156158 2026] [:error] [pid 37543:tid 37546] [client 74.248.145.211:41614] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "ac5UtHhdk2bEYJCvILbXOgAAAUE"]
[Thu Apr 02 19:36:20.888249 2026] [:error] [pid 54384:tid 54401] [client 74.248.145.211:5954] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "ac5UtNWWpaby3TVN7McJYwAAAc8"]
[Thu Apr 02 19:36:21.894021 2026] [:error] [pid 29467:tid 29494] [client 74.248.145.211:5651] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "ac5Utb4VUBFCJAq-WOlvrgAAARg"]
[Thu Apr 02 19:36:22.460198 2026] [:error] [pid 54384:tid 54404] [client 74.248.145.211:5477] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ac5UttWWpaby3TVN7McJZgAAAdI"]
[Thu Apr 02 19:36:23.057811 2026] [:error] [pid 29467:tid 29481] [client 74.248.145.211:5353] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ac5Ut74VUBFCJAq-WOlvvAAAAQs"]
[Thu Apr 02 19:36:23.759980 2026] [:error] [pid 29467:tid 29482] [client 74.248.145.211:39488] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ac5Ut74VUBFCJAq-WOlvxAAAAQw"]
[Thu Apr 02 19:36:24.438909 2026] [:error] [pid 59201:tid 59286] [client 74.248.145.211:5999] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ac5UuMAC0Tw8eL6gzZ4W_wAAAJM"]
[Thu Apr 02 19:36:26.543729 2026] [:error] [pid 29467:tid 29484] [client 74.248.145.211:41609] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "ac5Uur4VUBFCJAq-WOlvzgAAAQ4"]
[Thu Apr 02 19:36:27.637809 2026] [:error] [pid 29467:tid 29481] [client 74.248.145.211:5962] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "ac5Uu74VUBFCJAq-WOlv1wAAAQs"]
[Thu Apr 02 19:36:28.373825 2026] [proxy_fcgi:error] [pid 59305:tid 59324] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:28.710323 2026] [proxy_fcgi:error] [pid 59305:tid 59313] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:28.997048 2026] [proxy_fcgi:error] [pid 59305:tid 59332] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:29.258117 2026] [proxy_fcgi:error] [pid 59305:tid 59330] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:29.533357 2026] [proxy_fcgi:error] [pid 59305:tid 59310] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:30.418224 2026] [proxy_fcgi:error] [pid 59305:tid 59327] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:30.676750 2026] [proxy_fcgi:error] [pid 59305:tid 59324] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:31.265255 2026] [proxy_fcgi:error] [pid 59305:tid 59313] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:31.526750 2026] [proxy_fcgi:error] [pid 59305:tid 59322] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:31.851030 2026] [proxy_fcgi:error] [pid 59305:tid 59321] [client 74.248.145.211:40155] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:36:32.156573 2026] [:error] [pid 59305:tid 59316] [client 74.248.145.211:40155] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "ac5UwKr2tV4rDwKFxKd-sgAAAMc"]
[Thu Apr 02 19:36:32.706896 2026] [:error] [pid 59305:tid 59318] [client 74.248.145.211:39497] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "ac5UwKr2tV4rDwKFxKd-swAAAMk"]
[Thu Apr 02 19:36:33.584572 2026] [:error] [pid 37543:tid 37547] [client 74.248.145.211:5885] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "ac5UwXhdk2bEYJCvILbXTgAAAUI"]
[Thu Apr 02 19:36:34.322930 2026] [:error] [pid 29467:tid 29491] [client 74.248.145.211:5474] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "ac5Uwr4VUBFCJAq-WOlv6gAAARU"]
[Thu Apr 02 19:36:35.438361 2026] [:error] [pid 59201:tid 59268] [client 74.248.145.211:5839] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ac5Uw8AC0Tw8eL6gzZ4XDAAAAIE"]
[Thu Apr 02 19:36:36.028084 2026] [:error] [pid 54384:tid 54401] [client 74.248.145.211:41695] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ac5UxNWWpaby3TVN7McJbgAAAc8"]
[Thu Apr 02 19:36:36.722279 2026] [:error] [pid 59194:tid 59232] [client 74.248.145.211:5672] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ac5UxBMpAeV11hcQehxBhwAAABM"]
[Thu Apr 02 19:36:37.381929 2026] [:error] [pid 37543:tid 37560] [client 74.248.145.211:5485] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ac5UxXhdk2bEYJCvILbXVgAAAU8"]
[Thu Apr 02 19:36:38.337358 2026] [:error] [pid 37543:tid 37546] [client 74.248.145.211:5974] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ac5Uxnhdk2bEYJCvILbXXgAAAUE"]
[Thu Apr 02 19:36:39.002972 2026] [:error] [pid 29467:tid 29487] [client 74.248.145.211:41701] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ac5Ux74VUBFCJAq-WOlv-AAAARE"]
[Thu Apr 02 19:36:39.656128 2026] [:error] [pid 59201:tid 59285] [client 74.248.145.211:40128] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ac5Ux8AC0Tw8eL6gzZ4XEwAAAJI"]
[Thu Apr 02 19:36:40.517843 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:41708] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ac5UyKr2tV4rDwKFxKd-1gAAANA"]
[Thu Apr 02 19:36:41.207146 2026] [:error] [pid 59201:tid 59280] [client 74.248.145.211:5471] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ac5UycAC0Tw8eL6gzZ4XFAAAAI0"]
[Thu Apr 02 19:36:41.948520 2026] [:error] [pid 23927:tid 23942] [client 74.248.145.211:5445] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ac5UyUsZwqCndhl9uKCmyAAAAY0"]
[Thu Apr 02 19:36:42.657479 2026] [:error] [pid 59305:tid 59320] [client 74.248.145.211:41640] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Uyqr2tV4rDwKFxKd-5QAAAMs"]
[Thu Apr 02 19:36:43.452777 2026] [:error] [pid 59201:tid 59275] [client 74.248.145.211:5645] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ac5Uy8AC0Tw8eL6gzZ4XFgAAAIg"]
[Thu Apr 02 19:36:44.061952 2026] [:error] [pid 59201:tid 59274] [client 74.248.145.211:41638] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "ac5UzMAC0Tw8eL6gzZ4XGgAAAIc"]
[Thu Apr 02 19:36:44.797957 2026] [:error] [pid 54384:tid 54404] [client 74.248.145.211:5941] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "ac5UzNWWpaby3TVN7McJfQAAAdI"]
[Thu Apr 02 19:36:45.635212 2026] [:error] [pid 23927:tid 23940] [client 74.248.145.211:5442] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "ac5UzUsZwqCndhl9uKCmzgAAAYs"]
[Thu Apr 02 19:36:46.490826 2026] [:error] [pid 23927:tid 23945] [client 74.248.145.211:38828] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "ac5UzksZwqCndhl9uKCm0AAAAZA"]
[Thu Apr 02 19:36:47.354282 2026] [:error] [pid 59305:tid 59330] [client 74.248.145.211:38792] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ac5Uz6r2tV4rDwKFxKd-8AAAANU"]
[Thu Apr 02 19:36:48.217526 2026] [:error] [pid 23927:tid 23930] [client 74.248.145.211:39489] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ac5U0EsZwqCndhl9uKCm0wAAAYE"]
[Thu Apr 02 19:36:49.253250 2026] [:error] [pid 23927:tid 23937] [client 74.248.145.211:6005] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ac5U0UsZwqCndhl9uKCm2QAAAYg"]
[Thu Apr 02 19:36:50.051557 2026] [:error] [pid 29467:tid 29470] [client 74.248.145.211:5880] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ac5U0r4VUBFCJAq-WOlwFgAAAQA"]
[Thu Apr 02 19:36:51.431381 2026] [:error] [pid 29467:tid 29493] [client 74.248.145.211:5863] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ac5U074VUBFCJAq-WOlwIAAAARc"]
[Thu Apr 02 19:36:52.156706 2026] [:error] [pid 59305:tid 59323] [client 74.248.145.211:5315] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ac5U1Kr2tV4rDwKFxKd-9gAAAM4"]
[Thu Apr 02 19:36:53.507608 2026] [:error] [pid 23927:tid 23939] [client 74.248.145.211:5840] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ac5U1UsZwqCndhl9uKCm5wAAAYo"]
[Thu Apr 02 19:36:55.388764 2026] [:error] [pid 37543:tid 37553] [client 74.248.145.211:5846] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ac5U13hdk2bEYJCvILbXcwAAAUg"]
[Thu Apr 02 19:36:56.624499 2026] [:error] [pid 37543:tid 37548] [client 74.248.145.211:41686] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac5U2Hhdk2bEYJCvILbXdwAAAUM"]
[Thu Apr 02 19:36:57.557995 2026] [:error] [pid 29467:tid 29476] [client 74.248.145.211:5832] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac5U2b4VUBFCJAq-WOlwLwAAAQY"]
[Thu Apr 02 19:36:58.183428 2026] [:error] [pid 29467:tid 29485] [client 74.248.145.211:5718] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac5U2r4VUBFCJAq-WOlwNAAAAQ8"]
[Thu Apr 02 19:36:58.800026 2026] [:error] [pid 23927:tid 23942] [client 74.248.145.211:39542] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ac5U2ksZwqCndhl9uKCm6gAAAY0"]
[Thu Apr 02 19:36:59.467690 2026] [:error] [pid 23927:tid 23943] [client 74.248.145.211:41627] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5U20sZwqCndhl9uKCm8wAAAY4"]
[Thu Apr 02 19:37:00.092642 2026] [:error] [pid 29467:tid 29473] [client 74.248.145.211:5359] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5U3L4VUBFCJAq-WOlwOgAAAQM"]
[Thu Apr 02 19:37:01.021171 2026] [:error] [pid 29467:tid 29470] [client 74.248.145.211:41633] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5U3b4VUBFCJAq-WOlwPAAAAQA"]
[Thu Apr 02 19:37:02.772848 2026] [:error] [pid 23927:tid 23943] [client 74.248.145.211:5497] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "ac5U3ksZwqCndhl9uKCm_wAAAY4"]
[Thu Apr 02 19:37:36.428720 2026] [proxy_fcgi:error] [pid 59305:tid 59323] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:37.603184 2026] [proxy_fcgi:error] [pid 59305:tid 59332] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:37.950322 2026] [proxy_fcgi:error] [pid 59305:tid 59329] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:38.260098 2026] [proxy_fcgi:error] [pid 59305:tid 59333] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:38.597162 2026] [proxy_fcgi:error] [pid 59305:tid 59322] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:38.970200 2026] [proxy_fcgi:error] [pid 59305:tid 59330] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:39.557078 2026] [proxy_fcgi:error] [pid 59305:tid 59310] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:39.911277 2026] [proxy_fcgi:error] [pid 59305:tid 59325] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:40.202162 2026] [proxy_fcgi:error] [pid 59305:tid 59312] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:40.499921 2026] [proxy_fcgi:error] [pid 59305:tid 59320] [client 74.248.145.211:41696] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:37:40.770395 2026] [:error] [pid 59305:tid 59318] [client 74.248.145.211:41696] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ac5VBKr2tV4rDwKFxKd_LgAAAMk"]
[Thu Apr 02 19:37:41.353248 2026] [:error] [pid 54384:tid 54410] [client 74.248.145.211:38846] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ac5VBdWWpaby3TVN7McJtAAAAdg"]
[Thu Apr 02 19:37:41.901050 2026] [:error] [pid 59305:tid 59316] [client 74.248.145.211:5560] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ac5VBar2tV4rDwKFxKd_LwAAAMc"]
[Thu Apr 02 19:37:42.536214 2026] [:error] [pid 54384:tid 54400] [client 74.248.145.211:5217] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ac5VBtWWpaby3TVN7McJuAAAAc4"]
[Thu Apr 02 19:37:43.103418 2026] [:error] [pid 37543:tid 37546] [client 74.248.145.211:41662] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ac5VB3hdk2bEYJCvILbXjQAAAUE"]
[Thu Apr 02 19:37:43.842168 2026] [:error] [pid 54384:tid 54390] [client 74.248.145.211:40971] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ac5VB9WWpaby3TVN7McJvAAAAcQ"]
[Thu Apr 02 19:37:44.577744 2026] [:error] [pid 54384:tid 54404] [client 74.248.145.211:5499] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ac5VCNWWpaby3TVN7McJvgAAAdI"]
[Thu Apr 02 19:37:45.298383 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:5531] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ac5VCar2tV4rDwKFxKd_NAAAANA"]
[Thu Apr 02 19:37:46.590013 2026] [:error] [pid 23927:tid 23947] [client 74.248.145.211:5917] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ac5VCksZwqCndhl9uKCnRQAAAZI"]
[Thu Apr 02 19:37:47.298037 2026] [:error] [pid 54384:tid 54399] [client 74.248.145.211:5960] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ac5VC9WWpaby3TVN7McJwwAAAc0"]
[Thu Apr 02 19:37:48.022644 2026] [:error] [pid 54384:tid 54398] [client 74.248.145.211:41624] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ac5VDNWWpaby3TVN7McJygAAAcw"]
[Thu Apr 02 19:37:48.634568 2026] [:error] [pid 29467:tid 29475] [client 74.248.145.211:5542] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ac5VDL4VUBFCJAq-WOlw_AAAAQU"]
[Thu Apr 02 19:37:49.718008 2026] [:error] [pid 54384:tid 54386] [client 74.248.145.211:5828] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ac5VDdWWpaby3TVN7McJ0AAAAcA"]
[Thu Apr 02 19:37:50.491573 2026] [:error] [pid 29467:tid 29478] [client 74.248.145.211:5496] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ac5VDr4VUBFCJAq-WOlxAgAAAQg"]
[Thu Apr 02 19:37:51.212160 2026] [:error] [pid 59194:tid 59227] [client 74.248.145.211:5964] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ac5VDxMpAeV11hcQehxBvAAAAA4"]
[Thu Apr 02 19:37:52.058652 2026] [:error] [pid 59305:tid 59330] [client 74.248.145.211:5691] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ac5VEKr2tV4rDwKFxKd_PgAAANU"]
[Thu Apr 02 19:37:52.850054 2026] [:error] [pid 37543:tid 37547] [client 74.248.145.211:5654] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "ac5VEHhdk2bEYJCvILbXmQAAAUI"]
[Thu Apr 02 19:37:53.441440 2026] [:error] [pid 59305:tid 59329] [client 74.248.145.211:5966] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "ac5VEar2tV4rDwKFxKd_SAAAANQ"]
[Thu Apr 02 19:37:54.221718 2026] [:error] [pid 59201:tid 59274] [client 74.248.145.211:39530] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "ac5VEsAC0Tw8eL6gzZ4XaQAAAIc"]
[Thu Apr 02 19:37:54.917563 2026] [:error] [pid 59201:tid 59290] [client 74.248.145.211:41635] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "ac5VEsAC0Tw8eL6gzZ4XbAAAAJc"]
[Thu Apr 02 19:37:55.498904 2026] [:error] [pid 23927:tid 23946] [client 74.248.145.211:39499] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ac5VE0sZwqCndhl9uKCnTQAAAZE"]
[Thu Apr 02 19:37:56.146476 2026] [:error] [pid 23927:tid 23937] [client 74.248.145.211:5827] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ac5VFEsZwqCndhl9uKCnTgAAAYg"]
[Thu Apr 02 19:37:56.968311 2026] [:error] [pid 29467:tid 29488] [client 74.248.145.211:41632] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ac5VFL4VUBFCJAq-WOlxIAAAARI"]
[Thu Apr 02 19:37:57.636247 2026] [:error] [pid 59194:tid 59232] [client 74.248.145.211:5866] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ac5VFRMpAeV11hcQehxBxwAAABM"]
[Thu Apr 02 19:37:58.216902 2026] [:error] [pid 59201:tid 59280] [client 74.248.145.211:5332] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5VFsAC0Tw8eL6gzZ4XcQAAAI0"]
[Thu Apr 02 19:37:59.088608 2026] [:error] [pid 54384:tid 54408] [client 74.248.145.211:5453] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5VF9WWpaby3TVN7McJ3gAAAdY"]
[Thu Apr 02 19:37:59.963913 2026] [:error] [pid 59305:tid 59333] [client 74.248.145.211:5649] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5VF6r2tV4rDwKFxKd_ZQAAANg"]
[Thu Apr 02 19:38:00.644452 2026] [:error] [pid 23927:tid 23945] [client 74.248.145.211:41670] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "ac5VGEsZwqCndhl9uKCnWQAAAZA"]
[Thu Apr 02 19:38:01.560380 2026] [:error] [pid 23927:tid 23938] [client 74.248.145.211:40190] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5VGUsZwqCndhl9uKCnWwAAAYk"]
[Thu Apr 02 19:38:02.257400 2026] [:error] [pid 59305:tid 59322] [client 74.248.145.211:39538] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5VGqr2tV4rDwKFxKd_bQAAAM0"]
[Thu Apr 02 19:38:03.183900 2026] [:error] [pid 54384:tid 54409] [client 74.248.145.211:41653] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5VG9WWpaby3TVN7McJ5wAAAdc"]
[Thu Apr 02 19:38:03.845994 2026] [:error] [pid 59305:tid 59315] [client 74.248.145.211:41625] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ac5VG6r2tV4rDwKFxKd_cwAAAMY"]
[Thu Apr 02 19:38:04.627970 2026] [:error] [pid 54384:tid 54388] [client 74.248.145.211:5971] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ac5VHNWWpaby3TVN7McJ6wAAAcI"]
[Thu Apr 02 19:38:05.792092 2026] [:error] [pid 59305:tid 59316] [client 74.248.145.211:5658] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ac5VHar2tV4rDwKFxKd_dwAAAMc"]
[Thu Apr 02 19:38:07.125636 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:5931] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ac5VH6r2tV4rDwKFxKd_ewAAANA"]
[Thu Apr 02 19:38:09.649020 2026] [:error] [pid 54384:tid 54393] [client 74.248.145.211:5469] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ac5VIdWWpaby3TVN7McJ8gAAAcc"]
[Thu Apr 02 19:38:11.062631 2026] [:error] [pid 23927:tid 23952] [client 74.248.145.211:5357] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5VI0sZwqCndhl9uKCnZwAAAZc"]
[Thu Apr 02 19:38:12.037874 2026] [:error] [pid 37543:tid 37568] [client 74.248.145.211:40978] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5VJHhdk2bEYJCvILbXqwAAAVc"]
[Thu Apr 02 19:38:13.201546 2026] [:error] [pid 59305:tid 59309] [client 74.248.145.211:5958] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5VJar2tV4rDwKFxKd_lQAAAMA"]
[Thu Apr 02 19:38:14.500252 2026] [:error] [pid 59194:tid 59236] [client 74.248.145.211:41713] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ac5VJhMpAeV11hcQehxB0QAAABc"]
[Thu Apr 02 19:38:15.250557 2026] [:error] [pid 23927:tid 23947] [client 74.248.145.211:5358] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ac5VJ0sZwqCndhl9uKCnjAAAAZI"]
[Thu Apr 02 19:38:16.177535 2026] [:error] [pid 29467:tid 29494] [client 74.248.145.211:41645] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ac5VKL4VUBFCJAq-WOlxRgAAARg"]
[Thu Apr 02 19:38:17.656858 2026] [:error] [pid 59200:tid 59242] [client 74.248.145.211:5191] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ac5VKbfP26txrdLs3EpxBQAAAEI"]
[Thu Apr 02 19:38:18.886373 2026] [:error] [pid 59194:tid 59218] [client 74.248.145.211:5460] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ac5VKhMpAeV11hcQehxB0wAAAAU"]
[Thu Apr 02 19:38:19.761769 2026] [:error] [pid 37543:tid 37554] [client 74.248.145.211:5460] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "ac5VK3hdk2bEYJCvILbXsgAAAUk"]
[Thu Apr 02 19:38:20.621501 2026] [:error] [pid 23927:tid 23942] [client 74.248.145.211:40962] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "ac5VLEsZwqCndhl9uKCnmAAAAY0"]
[Thu Apr 02 19:38:22.476064 2026] [:error] [pid 59305:tid 59328] [client 74.248.145.211:41672] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "ac5VLqr2tV4rDwKFxKd_pwAAANM"]
[Thu Apr 02 19:38:23.363077 2026] [:error] [pid 59305:tid 59327] [client 74.248.145.211:40138] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "ac5VL6r2tV4rDwKFxKd_rgAAANI"]
[Thu Apr 02 19:38:26.745298 2026] [:error] [pid 54384:tid 54397] [client 74.248.145.211:41692] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "ac5VMtWWpaby3TVN7McJ_QAAAcs"]
[Thu Apr 02 19:38:29.627297 2026] [:error] [pid 23927:tid 23934] [client 74.248.145.211:5241] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "ac5VNUsZwqCndhl9uKCnswAAAYU"]
[Thu Apr 02 19:38:31.532142 2026] [:error] [pid 23927:tid 23953] [client 74.248.145.211:38823] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "ac5VN0sZwqCndhl9uKCnuAAAAZg"]
[Thu Apr 02 19:38:32.768631 2026] [:error] [pid 37543:tid 37550] [client 74.248.145.211:5685] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "ac5VOHhdk2bEYJCvILbXvAAAAUU"]
[Thu Apr 02 19:38:34.077819 2026] [:error] [pid 23927:tid 23948] [client 74.248.145.211:5336] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "ac5VOksZwqCndhl9uKCnwQAAAZM"]
[Thu Apr 02 19:38:35.038176 2026] [:error] [pid 59201:tid 59281] [client 74.248.145.211:5886] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "ac5VO8AC0Tw8eL6gzZ4XkAAAAI4"]
[Thu Apr 02 19:38:35.688765 2026] [:error] [pid 29467:tid 29485] [client 74.248.145.211:41663] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "ac5VO74VUBFCJAq-WOlxbAAAAQ8"]
[Thu Apr 02 19:38:36.949906 2026] [:error] [pid 54384:tid 54399] [client 74.248.145.211:5836] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "ac5VPNWWpaby3TVN7McKAgAAAc0"]
[Thu Apr 02 19:38:38.391846 2026] [:error] [pid 37543:tid 37548] [client 74.248.145.211:5842] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ac5VPnhdk2bEYJCvILbX1AAAAUM"]
[Thu Apr 02 19:38:39.431802 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:5890] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ac5VP6r2tV4rDwKFxKd_1wAAANA"]
[Thu Apr 02 19:38:40.344360 2026] [proxy_fcgi:error] [pid 23927:tid 23929] [client 74.248.145.211:5327] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:40.937040 2026] [:error] [pid 23927:tid 23941] [client 74.248.145.211:5327] [client 74.248.145.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ac5VQEsZwqCndhl9uKCn2AAAAYw"]
[Thu Apr 02 19:38:41.859461 2026] [proxy_fcgi:error] [pid 59201:tid 59291] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:42.875226 2026] [proxy_fcgi:error] [pid 59201:tid 59290] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:43.186111 2026] [proxy_fcgi:error] [pid 59201:tid 59285] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:43.446371 2026] [proxy_fcgi:error] [pid 59201:tid 59276] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:43.717821 2026] [proxy_fcgi:error] [pid 59201:tid 59283] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:44.039898 2026] [proxy_fcgi:error] [pid 59201:tid 59288] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:44.651280 2026] [proxy_fcgi:error] [pid 59201:tid 59281] [client 74.248.145.211:5451] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:38:44.986547 2026] [:error] [pid 59201:tid 59287] [client 74.248.145.211:5451] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "ac5VRMAC0Tw8eL6gzZ4XngAAAJQ"]
[Thu Apr 02 19:38:45.598144 2026] [:error] [pid 59305:tid 59325] [client 74.248.145.211:5661] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "ac5VRar2tV4rDwKFxKd_5wAAANA"]
[Thu Apr 02 19:38:46.211332 2026] [:error] [pid 59200:tid 59253] [client 74.248.145.211:5405] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "ac5VRrfP26txrdLs3EpxDQAAAE0"]
[Thu Apr 02 19:38:47.135769 2026] [:error] [pid 54384:tid 54402] [client 74.248.145.211:5340] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "ac5VR9WWpaby3TVN7McKDAAAAdA"]
[Thu Apr 02 19:38:47.877631 2026] [:error] [pid 37543:tid 37566] [client 74.248.145.211:5369] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ac5VR3hdk2bEYJCvILbX6QAAAVU"]
[Thu Apr 02 19:38:48.592206 2026] [:error] [pid 59200:tid 59256] [client 74.248.145.211:38801] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ac5VSLfP26txrdLs3EpxFQAAAFA"]
[Thu Apr 02 19:38:49.223634 2026] [:error] [pid 59201:tid 59280] [client 74.248.145.211:5674] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ac5VScAC0Tw8eL6gzZ4XpQAAAI0"]
[Thu Apr 02 19:38:49.921011 2026] [:error] [pid 59201:tid 59291] [client 74.248.145.211:5561] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ac5VScAC0Tw8eL6gzZ4XpgAAAJg"]
[Thu Apr 02 19:38:50.542283 2026] [:error] [pid 59200:tid 59251] [client 74.248.145.211:5448] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "ac5VSrfP26txrdLs3EpxIAAAAEs"]
[Thu Apr 02 19:38:51.161503 2026] [:error] [pid 59201:tid 59286] [client 74.248.145.211:41706] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "ac5VS8AC0Tw8eL6gzZ4XpwAAAJM"]
[Thu Apr 02 19:38:51.961569 2026] [:error] [pid 54384:tid 54408] [client 74.248.145.211:5223] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "ac5VS9WWpaby3TVN7McKFgAAAdY"]
[Thu Apr 02 19:38:52.672136 2026] [:error] [pid 59200:tid 59252] [client 74.248.145.211:5632] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "ac5VTLfP26txrdLs3EpxKAAAAEw"]
[Thu Apr 02 19:38:53.374253 2026] [:error] [pid 23927:tid 23948] [client 74.248.145.211:41705] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5VTUsZwqCndhl9uKCn9AAAAZM"]
[Thu Apr 02 19:38:54.087159 2026] [:error] [pid 23927:tid 23935] [client 74.248.145.211:5326] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5VTksZwqCndhl9uKCn-QAAAYY"]
[Thu Apr 02 19:38:54.994418 2026] [:error] [pid 59305:tid 59326] [client 74.248.145.211:41724] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5VTqr2tV4rDwKFxKd_7gAAANE"]
[Thu Apr 02 19:38:55.670922 2026] [:error] [pid 59305:tid 59321] [client 74.248.145.211:6000] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ac5VT6r2tV4rDwKFxKd_8QAAAMw"]
[Thu Apr 02 19:38:56.391052 2026] [:error] [pid 59305:tid 59333] [client 74.248.145.211:5491] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ac5VUKr2tV4rDwKFxKd_8wAAANg"]
[Thu Apr 02 19:38:56.995074 2026] [:error] [pid 54384:tid 54402] [client 74.248.145.211:40982] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ac5VUNWWpaby3TVN7McKGgAAAdA"]
[Thu Apr 02 19:38:57.800780 2026] [:error] [pid 29467:tid 29490] [client 74.248.145.211:5839] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ac5VUb4VUBFCJAq-WOlxiAAAARQ"]
[Thu Apr 02 19:38:58.322999 2026] [:error] [pid 29467:tid 29470] [client 74.248.145.211:5320] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ac5VUr4VUBFCJAq-WOlxjAAAAQA"]
[Thu Apr 02 19:38:58.925365 2026] [:error] [pid 59201:tid 59269] [client 74.248.145.211:5977] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ac5VUsAC0Tw8eL6gzZ4XsQAAAII"]
[Thu Apr 02 19:38:59.857700 2026] [:error] [pid 29467:tid 29479] [client 74.248.145.211:5352] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ac5VU74VUBFCJAq-WOlxlQAAAQk"]
[Thu Apr 02 19:39:00.600680 2026] [:error] [pid 54384:tid 54392] [client 74.248.145.211:40136] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ac5VVNWWpaby3TVN7McKHgAAAcY"]
[Thu Apr 02 19:39:01.711930 2026] [:error] [pid 37543:tid 37560] [client 74.248.145.211:65047] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ac5VVXhdk2bEYJCvILbX_QAAAU8"]
[Thu Apr 02 19:39:02.285005 2026] [:error] [pid 37543:tid 37564] [client 74.248.145.211:5843] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac5VVnhdk2bEYJCvILbYAQAAAVM"]
[Thu Apr 02 19:39:02.907346 2026] [:error] [pid 29467:tid 29479] [client 74.248.145.211:39518] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac5VVr4VUBFCJAq-WOlxnwAAAQk"]
[Thu Apr 02 19:39:03.629511 2026] [:error] [pid 59305:tid 59326] [client 74.248.145.211:5330] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac5VV6r2tV4rDwKFxKd__gAAANE"]
[Thu Apr 02 19:39:04.186826 2026] [:error] [pid 59201:tid 59275] [client 74.248.145.211:40167] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac5VWMAC0Tw8eL6gzZ4XuQAAAIg"]
[Thu Apr 02 19:39:04.834860 2026] [:error] [pid 37543:tid 37561] [client 74.248.145.211:5669] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ac5VWHhdk2bEYJCvILbYCgAAAVA"]
[Thu Apr 02 19:39:05.558130 2026] [:error] [pid 59305:tid 59312] [client 74.248.145.211:41615] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ac5VWar2tV4rDwKFxKeAAwAAAMM"]
[Thu Apr 02 19:39:06.443012 2026] [:error] [pid 59305:tid 59332] [client 74.248.145.211:5838] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ac5VWqr2tV4rDwKFxKeABgAAANc"]
[Thu Apr 02 19:39:07.052256 2026] [:error] [pid 29467:tid 29471] [client 74.248.145.211:65049] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ac5VW74VUBFCJAq-WOlxpwAAAQE"]
[Thu Apr 02 19:39:08.051515 2026] [:error] [pid 59305:tid 59311] [client 74.248.145.211:5503] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "ac5VXKr2tV4rDwKFxKeABwAAAMI"]
[Thu Apr 02 19:39:08.937077 2026] [:error] [pid 29467:tid 29487] [client 74.248.145.211:5919] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "ac5VXL4VUBFCJAq-WOlxrwAAARE"]
[Thu Apr 02 19:39:09.781923 2026] [:error] [pid 37543:tid 37561] [client 74.248.145.211:5984] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "ac5VXXhdk2bEYJCvILbYEwAAAVA"]
[Thu Apr 02 19:39:10.536149 2026] [:error] [pid 23927:tid 23938] [client 74.248.145.211:41612] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "ac5VXksZwqCndhl9uKCoDAAAAYk"]
[Thu Apr 02 19:39:11.247534 2026] [:error] [pid 29467:tid 29486] [client 74.248.145.211:5871] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "ac5VX74VUBFCJAq-WOlxtwAAARA"]
[Thu Apr 02 19:39:12.267961 2026] [:error] [pid 29467:tid 29480] [client 74.248.145.211:5875] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "ac5VYL4VUBFCJAq-WOlxuQAAAQo"]
[Thu Apr 02 19:39:13.428204 2026] [:error] [pid 29467:tid 29487] [client 74.248.145.211:5426] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "ac5VYb4VUBFCJAq-WOlxvAAAARE"]
[Thu Apr 02 19:39:15.395084 2026] [:error] [pid 29467:tid 29493] [client 74.248.145.211:5339] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "ac5VY74VUBFCJAq-WOlxywAAARc"]
[Thu Apr 02 19:39:16.167121 2026] [:error] [pid 29467:tid 29494] [client 74.248.145.211:40130] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "ac5VZL4VUBFCJAq-WOlx0QAAARg"]
[Thu Apr 02 19:39:17.167267 2026] [:error] [pid 23927:tid 23931] [client 74.248.145.211:38800] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "ac5VZUsZwqCndhl9uKCoEAAAAYI"]
[Thu Apr 02 19:39:17.810489 2026] [:error] [pid 59201:tid 59271] [client 74.248.145.211:5956] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "ac5VZcAC0Tw8eL6gzZ4XzgAAAIQ"]
[Thu Apr 02 19:39:18.361324 2026] [:error] [pid 23927:tid 23929] [client 74.248.145.211:40146] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "ac5VZksZwqCndhl9uKCoFAAAAYA"]
[Thu Apr 02 19:39:19.039619 2026] [:error] [pid 59201:tid 59289] [client 74.248.145.211:5459] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac5VZ8AC0Tw8eL6gzZ4X0wAAAJY"]
[Thu Apr 02 19:39:19.623159 2026] [:error] [pid 37543:tid 37545] [client 74.248.145.211:5479] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac5VZ3hdk2bEYJCvILbYHQAAAUA"]
[Thu Apr 02 19:39:20.655167 2026] [:error] [pid 23927:tid 23940] [client 74.248.145.211:6012] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac5VaEsZwqCndhl9uKCoIQAAAYs"]
[Thu Apr 02 19:39:21.522520 2026] [:error] [pid 29467:tid 29489] [client 74.248.145.211:39520] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac5Vab4VUBFCJAq-WOlx3gAAARM"]
[Thu Apr 02 19:39:22.292091 2026] [:error] [pid 29467:tid 29472] [client 74.248.145.211:38808] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "ac5Var4VUBFCJAq-WOlx4QAAAQI"]
[Thu Apr 02 19:39:23.057500 2026] [:error] [pid 54384:tid 54396] [client 74.248.145.211:39499] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "ac5Va9WWpaby3TVN7McKQwAAAco"]
[Thu Apr 02 19:39:25.473424 2026] [:error] [pid 37543:tid 37556] [client 74.248.145.211:5860] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "ac5VbXhdk2bEYJCvILbYMgAAAUs"]
[Thu Apr 02 19:39:26.109261 2026] [:error] [pid 23927:tid 23931] [client 74.248.145.211:40177] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "ac5VbksZwqCndhl9uKCoKgAAAYI"]
[Thu Apr 02 19:39:28.017144 2026] [:error] [pid 29467:tid 29481] [client 74.248.145.211:5911] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "ac5VcL4VUBFCJAq-WOlx9AAAAQs"]
[Thu Apr 02 19:39:29.815798 2026] [:error] [pid 37543:tid 37557] [client 74.248.145.211:41702] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "ac5VcXhdk2bEYJCvILbYOwAAAUw"]
[Thu Apr 02 19:39:31.191430 2026] [:error] [pid 54384:tid 54405] [client 74.248.145.211:41600] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "ac5Vc9WWpaby3TVN7McKTQAAAdM"]
[Thu Apr 02 19:39:32.272452 2026] [:error] [pid 29467:tid 29491] [client 74.248.145.211:41618] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "ac5VdL4VUBFCJAq-WOlyEwAAARU"]
[Thu Apr 02 19:39:33.729542 2026] [:error] [pid 59200:tid 59251] [client 74.248.145.211:5318] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "ac5VdbfP26txrdLs3EpxTwAAAEs"]
[Thu Apr 02 19:39:34.467006 2026] [:error] [pid 54384:tid 54388] [client 74.248.145.211:38817] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "ac5VdtWWpaby3TVN7McKTgAAAcI"]
[Thu Apr 02 19:39:35.753206 2026] [:error] [pid 54384:tid 54392] [client 74.248.145.211:40963] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "ac5Vd9WWpaby3TVN7McKUAAAAcY"]
[Thu Apr 02 19:39:37.851498 2026] [:error] [pid 59200:tid 59261] [client 74.248.145.211:39533] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "ac5VebfP26txrdLs3EpxUwAAAFU"]
[Thu Apr 02 19:39:38.801215 2026] [:error] [pid 59201:tid 59268] [client 74.248.145.211:38822] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "ac5VesAC0Tw8eL6gzZ4X6QAAAIE"]
[Thu Apr 02 19:39:39.530027 2026] [:error] [pid 59305:tid 59320] [client 74.248.145.211:5995] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "ac5Ve6r2tV4rDwKFxKeAGQAAAMs"]
[Thu Apr 02 19:39:40.202018 2026] [:error] [pid 29467:tid 29492] [client 74.248.145.211:41680] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "ac5VfL4VUBFCJAq-WOlyPQAAARY"]
[Thu Apr 02 19:39:41.407348 2026] [:error] [pid 59200:tid 59254] [client 74.248.145.211:5662] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "ac5VfbfP26txrdLs3EpxVwAAAE4"]
[Thu Apr 02 19:39:42.112318 2026] [:error] [pid 59200:tid 59258] [client 74.248.145.211:5473] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ac5VfrfP26txrdLs3EpxXQAAAFI"]
[Thu Apr 02 19:39:43.144645 2026] [:error] [pid 59305:tid 59333] [client 74.248.145.211:5948] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ac5Vf6r2tV4rDwKFxKeAHAAAANg"]
[Thu Apr 02 19:39:43.921302 2026] [:error] [pid 23927:tid 23938] [client 74.248.145.211:5831] [client 74.248.145.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ac5Vf0sZwqCndhl9uKCoQQAAAYk"]
[Thu Apr 02 19:39:44.818991 2026] [proxy_fcgi:error] [pid 23927:tid 23935] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:45.076932 2026] [proxy_fcgi:error] [pid 23927:tid 23942] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:45.374742 2026] [proxy_fcgi:error] [pid 23927:tid 23939] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:45.704984 2026] [proxy_fcgi:error] [pid 23927:tid 23951] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:45.966491 2026] [proxy_fcgi:error] [pid 23927:tid 23945] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:46.445111 2026] [proxy_fcgi:error] [pid 23927:tid 23940] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:46.703884 2026] [proxy_fcgi:error] [pid 23927:tid 23944] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:46.992649 2026] [proxy_fcgi:error] [pid 23927:tid 23935] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 19:39:47.283774 2026] [proxy_fcgi:error] [pid 23927:tid 23941] [client 74.248.145.211:5973] AH01071: Got error 'Primary script unknown'
[Thu Apr 02 22:00:24.793435 2026] [:error] [pid 37543:tid 37546] [client 43.155.188.157:48926] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac52eHhdk2bEYJCvILb_HQAAAUE"]
[Thu Apr 02 23:00:32.647853 2026] [:error] [pid 54384:tid 54410] [client 43.130.101.151:52622] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac6EkNWWpaby3TVN7MdICAAAAdg"]
[Fri Apr 03 00:09:08.374139 2026] [:error] [pid 29467:tid 29486] [client 51.75.128.94:56038] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ac6UpL4VUBFCJAq-WOkdfgAAARA"]
[Fri Apr 03 00:09:10.097183 2026] [:error] [pid 59305:tid 59311] [client 51.75.128.94:40082] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ac6Upqr2tV4rDwKFxKcUTQAAAMI"]
[Fri Apr 03 00:09:12.047452 2026] [:error] [pid 59305:tid 59315] [client 51.75.128.94:54608] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ac6UqKr2tV4rDwKFxKcUUQAAAMY"]
[Fri Apr 03 00:09:14.569135 2026] [:error] [pid 59305:tid 59323] [client 51.75.128.94:37000] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ac6Uqqr2tV4rDwKFxKcUXwAAAM4"]
[Fri Apr 03 00:09:17.067184 2026] [:error] [pid 59200:tid 59246] [client 51.75.128.94:34492] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ac6UrbfP26txrdLs3EqhPgAAAEY"]
[Fri Apr 03 00:09:19.060506 2026] [:error] [pid 59201:tid 59287] [client 51.75.128.94:56976] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ac6Ur8AC0Tw8eL6gzZ5VgQAAAJQ"]
[Fri Apr 03 00:09:21.100737 2026] [:error] [pid 23927:tid 23952] [client 51.75.128.94:56986] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ac6UsUsZwqCndhl9uKAPhwAAAZc"]
[Fri Apr 03 00:09:23.597093 2026] [:error] [pid 29467:tid 29474] [client 51.75.128.94:34502] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ac6Us74VUBFCJAq-WOkdnwAAAQQ"]
[Fri Apr 03 00:09:25.591788 2026] [:error] [pid 29467:tid 29477] [client 51.75.128.94:56996] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ac6Utb4VUBFCJAq-WOkdpQAAAQc"]
[Fri Apr 03 00:09:27.472330 2026] [:error] [pid 59305:tid 59317] [client 51.75.128.94:57544] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ac6Ut6r2tV4rDwKFxKcUegAAAMg"]
[Fri Apr 03 00:09:29.826986 2026] [:error] [pid 59200:tid 59253] [client 51.75.128.94:49220] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ac6UubfP26txrdLs3EqhUgAAAE0"]
[Fri Apr 03 00:09:31.815053 2026] [:error] [pid 23927:tid 23943] [client 51.75.128.94:57554] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ac6Uu0sZwqCndhl9uKAPkwAAAY4"]
[Fri Apr 03 00:09:33.819747 2026] [:error] [pid 37543:tid 37558] [client 51.75.128.94:57560] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ac6UvXhdk2bEYJCvILYc0AAAAU0"]
[Fri Apr 03 00:09:35.829921 2026] [:error] [pid 23927:tid 23938] [client 51.75.128.94:57570] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ac6Uv0sZwqCndhl9uKAPmAAAAYk"]
[Fri Apr 03 00:09:37.841062 2026] [:error] [pid 29467:tid 29489] [client 51.75.128.94:50698] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ac6Uwb4VUBFCJAq-WOkdwAAAARM"]
[Fri Apr 03 00:09:39.843597 2026] [:error] [pid 29467:tid 29471] [client 51.75.128.94:50706] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ac6Uw74VUBFCJAq-WOkdzQAAAQE"]
[Fri Apr 03 00:09:41.859774 2026] [:error] [pid 29467:tid 29490] [client 51.75.128.94:50722] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ac6Uxb4VUBFCJAq-WOkd6AAAARQ"]
[Fri Apr 03 00:09:44.351935 2026] [:error] [pid 37543:tid 37555] [client 51.75.128.94:46802] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ac6UyHhdk2bEYJCvILYc4wAAAUo"]
[Fri Apr 03 00:09:46.680031 2026] [:error] [pid 23927:tid 23931] [client 51.75.128.94:59944] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ac6UyksZwqCndhl9uKAPqwAAAYI"]
[Fri Apr 03 00:09:49.021870 2026] [:error] [pid 54384:tid 54409] [client 51.75.128.94:59952] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ac6UzdWWpaby3TVN7MdbJwAAAdc"]
[Fri Apr 03 00:09:51.005881 2026] [:error] [pid 59201:tid 59281] [client 51.75.128.94:52374] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ac6Uz8AC0Tw8eL6gzZ5VpgAAAI4"]
[Fri Apr 03 00:09:53.507253 2026] [:error] [pid 54384:tid 54406] [client 51.75.128.94:59968] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ac6U0dWWpaby3TVN7MdbMwAAAdQ"]
[Fri Apr 03 00:09:55.962104 2026] [:error] [pid 59305:tid 59318] [client 51.75.128.94:59970] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ac6U06r2tV4rDwKFxKcUtwAAAMk"]
[Fri Apr 03 00:09:57.954725 2026] [:error] [pid 29467:tid 29474] [client 51.75.128.94:56194] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ac6U1b4VUBFCJAq-WOkePAAAAQQ"]
[Fri Apr 03 00:10:00.456727 2026] [:error] [pid 59305:tid 59317] [client 51.75.128.94:48818] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ac6U2Kr2tV4rDwKFxKcUvgAAAMg"]
[Fri Apr 03 00:10:02.785161 2026] [:error] [pid 54384:tid 54405] [client 51.75.128.94:48834] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ac6U2tWWpaby3TVN7MdbQAAAAdM"]
[Fri Apr 03 00:10:04.601579 2026] [:error] [pid 59194:tid 59225] [client 51.75.128.94:56206] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ac6U3BMpAeV11hcQehxsRwAAAAw"]
[Fri Apr 03 00:10:29.399503 2026] [:error] [pid 59201:tid 59274] [client 51.75.128.94:46094] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ac6U9cAC0Tw8eL6gzZ5VwgAAAIc"]
[Fri Apr 03 00:10:31.812474 2026] [:error] [pid 29467:tid 29489] [client 51.75.128.94:48936] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ac6U974VUBFCJAq-WOkeuQAAARM"]
[Fri Apr 03 00:10:34.128979 2026] [:error] [pid 29467:tid 29485] [client 51.75.128.94:48946] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ac6U-r4VUBFCJAq-WOkezQAAAQ8"]
[Fri Apr 03 00:10:36.429969 2026] [:error] [pid 23927:tid 23929] [client 51.75.128.94:48958] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ac6U_EsZwqCndhl9uKAP2wAAAYA"]
[Fri Apr 03 00:10:38.413685 2026] [:error] [pid 59305:tid 59322] [client 51.75.128.94:38738] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ac6U_qr2tV4rDwKFxKcU9QAAAM0"]
[Fri Apr 03 00:10:40.894645 2026] [:error] [pid 59194:tid 59225] [client 51.75.128.94:36830] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ac6VABMpAeV11hcQehxsUgAAAAw"]
[Fri Apr 03 00:10:42.883429 2026] [:error] [pid 37543:tid 37552] [client 51.75.128.94:38744] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ac6VAnhdk2bEYJCvILYdHQAAAUc"]
[Fri Apr 03 00:10:45.369836 2026] [:error] [pid 54384:tid 54406] [client 51.75.128.94:36832] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ac6VBdWWpaby3TVN7MdbcAAAAdQ"]
[Fri Apr 03 00:10:47.848718 2026] [:error] [pid 37543:tid 37557] [client 51.75.128.94:34540] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ac6VB3hdk2bEYJCvILYdIgAAAUw"]
[Fri Apr 03 00:10:50.339117 2026] [:error] [pid 59305:tid 59310] [client 51.75.128.94:34554] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ac6VCqr2tV4rDwKFxKcVBAAAAME"]
[Fri Apr 03 00:10:52.313936 2026] [:error] [pid 59305:tid 59316] [client 51.75.128.94:48896] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ac6VDKr2tV4rDwKFxKcVCAAAAMc"]
[Fri Apr 03 00:10:54.310284 2026] [:error] [pid 29467:tid 29491] [client 51.75.128.94:48912] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ac6VDr4VUBFCJAq-WOkfIgAAARU"]
[Fri Apr 03 00:10:56.297012 2026] [:error] [pid 59305:tid 59320] [client 51.75.128.94:38312] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ac6VEKr2tV4rDwKFxKcVFAAAAMs"]
[Fri Apr 03 00:10:58.781264 2026] [:error] [pid 29467:tid 29486] [client 51.75.128.94:52504] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ac6VEr4VUBFCJAq-WOkfOgAAARA"]
[Fri Apr 03 00:11:00.756609 2026] [:error] [pid 59201:tid 59278] [client 51.75.128.94:38324] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ac6VFMAC0Tw8eL6gzZ5V1AAAAIs"]
[Fri Apr 03 00:11:02.760801 2026] [:error] [pid 29467:tid 29484] [client 51.75.128.94:38336] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ac6VFr4VUBFCJAq-WOkfPQAAAQ4"]
[Fri Apr 03 00:11:04.769290 2026] [:error] [pid 59305:tid 59331] [client 51.75.128.94:38350] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ac6VGKr2tV4rDwKFxKcVKQAAANY"]
[Fri Apr 03 00:11:06.785467 2026] [:error] [pid 29467:tid 29471] [client 51.75.128.94:37256] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ac6VGr4VUBFCJAq-WOkfRwAAAQE"]
[Fri Apr 03 00:11:08.778635 2026] [:error] [pid 59305:tid 59327] [client 51.75.128.94:37260] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ac6VHKr2tV4rDwKFxKcVMgAAANI"]
[Fri Apr 03 00:11:10.768866 2026] [:error] [pid 59305:tid 59310] [client 51.75.128.94:37274] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ac6VHqr2tV4rDwKFxKcVNwAAAME"]
[Fri Apr 03 00:11:12.789749 2026] [:error] [pid 29467:tid 29486] [client 51.75.128.94:37286] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ac6VIL4VUBFCJAq-WOkfWAAAARA"]
[Fri Apr 03 00:11:14.794354 2026] [:error] [pid 59305:tid 59321] [client 51.75.128.94:37288] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ac6VIqr2tV4rDwKFxKcVPQAAAMw"]
[Fri Apr 03 00:11:16.797000 2026] [:error] [pid 29467:tid 29491] [client 51.75.128.94:51796] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ac6VJL4VUBFCJAq-WOkfbAAAARU"]
[Fri Apr 03 00:11:19.273491 2026] [:error] [pid 37543:tid 37553] [client 51.75.128.94:35688] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ac6VJ3hdk2bEYJCvILYdMAAAAUg"]
[Fri Apr 03 00:11:21.255116 2026] [:error] [pid 59201:tid 59272] [client 51.75.128.94:51806] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ac6VKcAC0Tw8eL6gzZ5V6AAAAIU"]
[Fri Apr 03 00:11:23.266253 2026] [:error] [pid 54384:tid 54407] [client 51.75.128.94:51814] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ac6VK9WWpaby3TVN7MdbnQAAAdU"]
[Fri Apr 03 00:11:25.748693 2026] [:error] [pid 29467:tid 29479] [client 51.75.128.94:35702] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ac6VLb4VUBFCJAq-WOkfegAAAQk"]
[Fri Apr 03 00:11:46.550497 2026] [:error] [pid 59305:tid 59328] [client 51.75.128.94:42384] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ac6VQqr2tV4rDwKFxKcVgAAAANM"]
[Fri Apr 03 00:11:48.256536 2026] [:error] [pid 23927:tid 23940] [client 51.75.128.94:46754] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ac6VREsZwqCndhl9uKAQTQAAAYs"]
[Fri Apr 03 00:11:50.669676 2026] [:error] [pid 29467:tid 29472] [client 51.75.128.94:49162] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ac6VRr4VUBFCJAq-WOkfpgAAAQI"]
[Fri Apr 03 00:11:52.641816 2026] [:error] [pid 29467:tid 29471] [client 51.75.128.94:56392] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ac6VSL4VUBFCJAq-WOkfsAAAAQE"]
[Fri Apr 03 00:11:55.114954 2026] [:error] [pid 59194:tid 59236] [client 51.75.128.94:49172] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ac6VSxMpAeV11hcQehxsgAAAABc"]
[Fri Apr 03 00:11:57.570702 2026] [:error] [pid 23927:tid 23936] [client 51.75.128.94:48120] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ac6VTUsZwqCndhl9uKAQVwAAAYc"]
[Fri Apr 03 00:11:59.536911 2026] [:error] [pid 54384:tid 54409] [client 51.75.128.94:35554] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ac6VT9WWpaby3TVN7MdbwQAAAdc"]
[Fri Apr 03 00:12:02.019279 2026] [:error] [pid 23927:tid 23944] [client 51.75.128.94:48126] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ac6VUksZwqCndhl9uKAQXAAAAY8"]
[Fri Apr 03 00:12:03.861451 2026] [:error] [pid 59305:tid 59318] [client 51.75.128.94:35562] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ac6VU6r2tV4rDwKFxKcVhAAAAMk"]
[Fri Apr 03 00:12:06.342557 2026] [:error] [pid 59201:tid 59285] [client 51.75.128.94:48128] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ac6VVsAC0Tw8eL6gzZ5WDwAAAJI"]
[Fri Apr 03 00:12:08.181795 2026] [:error] [pid 59305:tid 59326] [client 51.75.128.94:50690] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ac6VWKr2tV4rDwKFxKcVjgAAANE"]
[Fri Apr 03 00:12:10.687812 2026] [:error] [pid 23927:tid 23933] [client 51.75.128.94:47494] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ac6VWksZwqCndhl9uKAQagAAAYQ"]
[Fri Apr 03 00:12:13.003403 2026] [:error] [pid 59305:tid 59322] [client 51.75.128.94:47510] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ac6VXar2tV4rDwKFxKcVmAAAAM0"]
[Fri Apr 03 00:12:14.978562 2026] [:error] [pid 23927:tid 23942] [client 51.75.128.94:50706] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ac6VXksZwqCndhl9uKAQcwAAAY0"]
[Fri Apr 03 00:12:17.466267 2026] [:error] [pid 54384:tid 54394] [client 51.75.128.94:59054] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ac6VYdWWpaby3TVN7Mdb0gAAAcg"]
[Fri Apr 03 00:12:19.425550 2026] [:error] [pid 59194:tid 59223] [client 51.75.128.94:57372] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ac6VYxMpAeV11hcQehxsjAAAAAo"]
[Fri Apr 03 00:12:21.904857 2026] [:error] [pid 59201:tid 59281] [client 51.75.128.94:59064] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ac6VZcAC0Tw8eL6gzZ5WKgAAAI4"]
[Fri Apr 03 00:12:24.368331 2026] [:error] [pid 59201:tid 59270] [client 51.75.128.94:59074] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ac6VaMAC0Tw8eL6gzZ5WKwAAAIM"]
[Fri Apr 03 00:12:26.330454 2026] [:error] [pid 29467:tid 29474] [client 51.75.128.94:44074] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ac6Var4VUBFCJAq-WOkf2QAAAQQ"]
[Fri Apr 03 00:12:28.808027 2026] [:error] [pid 23927:tid 23933] [client 51.75.128.94:43578] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ac6VbEsZwqCndhl9uKAQiwAAAYQ"]
[Fri Apr 03 00:12:30.809464 2026] [:error] [pid 59305:tid 59328] [client 51.75.128.94:44080] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ac6Vbqr2tV4rDwKFxKcVywAAANM"]
[Fri Apr 03 00:12:33.289552 2026] [:error] [pid 29467:tid 29482] [client 51.75.128.94:43588] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ac6Vcb4VUBFCJAq-WOkf7QAAAQw"]
[Fri Apr 03 00:12:35.731649 2026] [:error] [pid 29467:tid 29483] [client 51.75.128.94:43590] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ac6Vc74VUBFCJAq-WOkf9AAAAQ0"]
[Fri Apr 03 00:12:38.180461 2026] [:error] [pid 29467:tid 29486] [client 51.75.128.94:48950] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ac6Vdr4VUBFCJAq-WOkgAgAAARA"]
[Fri Apr 03 00:12:40.623666 2026] [:error] [pid 37543:tid 37548] [client 51.75.128.94:48962] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ac6VeHhdk2bEYJCvILYdWAAAAUM"]
[Fri Apr 03 00:12:43.072008 2026] [:error] [pid 59305:tid 59326] [client 51.75.128.94:48972] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ac6Ve6r2tV4rDwKFxKcV2QAAANE"]
[Fri Apr 03 00:13:09.899973 2026] [:error] [pid 59305:tid 59312] [client 51.75.128.94:33748] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac6Vlar2tV4rDwKFxKcWCgAAAMM"]
[Fri Apr 03 00:13:13.622513 2026] [:error] [pid 59200:tid 59241] [client 51.75.128.94:33750] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac6VmbfP26txrdLs3EqhuQAAAEE"]
[Fri Apr 03 00:17:53.970386 2026] [:error] [pid 29467:tid 29493] [client 83.228.250.33:53050] [client 83.228.250.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ac6Wsb4VUBFCJAq-WOkjJwAAARc"]
[Fri Apr 03 00:17:54.598816 2026] [:error] [pid 29467:tid 29484] [client 83.228.250.33:60489] [client 83.228.250.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ac6Wsr4VUBFCJAq-WOkjKwAAAQ4"]
[Fri Apr 03 01:13:06.695519 2026] [proxy_fcgi:error] [pid 25035:tid 25461] [client 20.215.186.32:25442] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 01:59:47.655343 2026] [:error] [pid 25018:tid 25426] [client 217.182.194.3:42172] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ac6uk3upR6lXnAUzFGoGCgAAAE0"]
[Fri Apr 03 01:59:50.200150 2026] [:error] [pid 25010:tid 25368] [client 217.182.194.3:41366] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ac6ulo_KcjFQF5TuqTW7nAAAABM"]
[Fri Apr 03 01:59:52.773097 2026] [:error] [pid 25010:tid 25373] [client 217.182.194.3:41380] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ac6umI_KcjFQF5TuqTW7pwAAABg"]
[Fri Apr 03 01:59:55.251672 2026] [:error] [pid 25470:tid 25484] [client 217.182.194.3:41384] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ac6um3hROcck6_9HYyg1ogAAAMw"]
[Fri Apr 03 01:59:57.678401 2026] [:error] [pid 25010:tid 25365] [client 217.182.194.3:41390] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ac6unY_KcjFQF5TuqTW7vgAAABA"]
[Fri Apr 03 02:00:00.099049 2026] [:error] [pid 25018:tid 25432] [client 217.182.194.3:36768] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ac6uoHupR6lXnAUzFGoGMAAAAFM"]
[Fri Apr 03 02:00:02.659129 2026] [:error] [pid 25470:tid 25479] [client 217.182.194.3:36778] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ac6uonhROcck6_9HYyg1vwAAAMc"]
[Fri Apr 03 02:00:05.198603 2026] [:error] [pid 25018:tid 25411] [client 217.182.194.3:36782] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ac6upXupR6lXnAUzFGoGNwAAAEA"]
[Fri Apr 03 02:00:07.431219 2026] [:error] [pid 25018:tid 25432] [client 217.182.194.3:36784] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ac6up3upR6lXnAUzFGoGQQAAAFM"]
[Fri Apr 03 02:00:09.949483 2026] [:error] [pid 25470:tid 25489] [client 217.182.194.3:39684] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ac6uqXhROcck6_9HYyg17gAAANE"]
[Fri Apr 03 02:00:12.475732 2026] [:error] [pid 25010:tid 25362] [client 217.182.194.3:39686] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ac6urI_KcjFQF5TuqTW7-QAAAA0"]
[Fri Apr 03 02:00:14.964866 2026] [:error] [pid 25470:tid 25488] [client 217.182.194.3:39688] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ac6urnhROcck6_9HYyg2HgAAANA"]
[Fri Apr 03 02:00:17.493038 2026] [:error] [pid 25470:tid 25481] [client 217.182.194.3:39700] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ac6usXhROcck6_9HYyg2NQAAAMk"]
[Fri Apr 03 02:00:19.885973 2026] [:error] [pid 25010:tid 25353] [client 217.182.194.3:40756] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ac6us4_KcjFQF5TuqTW8DQAAAAU"]
[Fri Apr 03 02:00:22.655648 2026] [:error] [pid 25470:tid 25495] [client 217.182.194.3:40772] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ac6utnhROcck6_9HYyg2XgAAANc"]
[Fri Apr 03 02:00:25.296907 2026] [:error] [pid 25035:tid 25459] [client 217.182.194.3:40778] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ac6uuRhR292toNOkLqHGmAAAAJE"]
[Fri Apr 03 02:00:28.065917 2026] [:error] [pid 25470:tid 25496] [client 217.182.194.3:40788] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ac6uvHhROcck6_9HYyg2cQAAANg"]
[Fri Apr 03 02:00:30.778959 2026] [:error] [pid 25010:tid 25369] [client 217.182.194.3:35960] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ac6uvo_KcjFQF5TuqTW8JwAAABQ"]
[Fri Apr 03 02:00:33.406335 2026] [:error] [pid 25470:tid 25492] [client 217.182.194.3:35966] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ac6uwXhROcck6_9HYyg2hwAAANQ"]
[Fri Apr 03 02:00:35.937833 2026] [:error] [pid 25018:tid 25412] [client 217.182.194.3:35970] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ac6uw3upR6lXnAUzFGoGaAAAAEE"]
[Fri Apr 03 02:00:38.467288 2026] [:error] [pid 25470:tid 25475] [client 217.182.194.3:35978] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ac6uxnhROcck6_9HYyg2nwAAAMM"]
[Fri Apr 03 02:00:40.939207 2026] [:error] [pid 25010:tid 25371] [client 217.182.194.3:44270] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ac6uyI_KcjFQF5TuqTW8RAAAABY"]
[Fri Apr 03 02:00:43.804430 2026] [:error] [pid 25018:tid 25434] [client 217.182.194.3:44272] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ac6uy3upR6lXnAUzFGoGfQAAAFU"]
[Fri Apr 03 02:01:06.469656 2026] [:error] [pid 25018:tid 25421] [client 217.182.194.3:44278] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ac6u4nupR6lXnAUzFGoGvQAAAEg"]
[Fri Apr 03 02:01:09.056716 2026] [:error] [pid 25035:tid 25452] [client 217.182.194.3:43084] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ac6u5RhR292toNOkLqHG_wAAAIo"]
[Fri Apr 03 02:01:11.522344 2026] [:error] [pid 25470:tid 25492] [client 217.182.194.3:43096] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ac6u53hROcck6_9HYyg3PQAAANQ"]
[Fri Apr 03 02:01:13.653809 2026] [:error] [pid 25035:tid 25462] [client 217.182.194.3:43360] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac6u6RhR292toNOkLqHHDAAAAJQ"]
[Fri Apr 03 02:01:17.487444 2026] [:error] [pid 25470:tid 25491] [client 217.182.194.3:43364] [client 217.182.194.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac6u7XhROcck6_9HYyg3VAAAANM"]
[Fri Apr 03 02:30:18.543251 2026] [proxy_fcgi:error] [pid 25010:tid 25356] [client 80.124.54.14:52103] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 02:34:57.347016 2026] [:error] [pid 25035:tid 25461] [client 39.130.52.80:5259] [client 39.130.52.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac620RhR292toNOkLqHaUgAAAJM"], referer: http://switchcreative.net/
[Fri Apr 03 05:00:44.740072 2026] [:error] [pid 58590:tid 58593] [client 49.51.204.74:40810] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac7Y_Eze_aEPDM9xEE2UfAAAAQE"]
[Fri Apr 03 06:09:35.370370 2026] [:error] [pid 22778:tid 22798] [client 43.166.134.114:45866] [client 43.166.134.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac7pH_S-q9hkdFqUjq-RjwAAAM0"]
[Fri Apr 03 07:05:04.449681 2026] [:error] [pid 33445:tid 33474] [client 212.145.212.135:54046] [client 212.145.212.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.145.212.135, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac72IFlRNZ0iDVmJWM2R_wAAABg"]
[Fri Apr 03 07:05:04.461148 2026] [proxy_fcgi:error] [pid 33445:tid 33474] [client 212.145.212.135:54046] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 09:20:59.222824 2026] [:error] [pid 33542:tid 33562] [client 101.23.227.183:61587] [client 101.23.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac8V-3wb6uB1LaGtepZc7gAAANE"], referer: http://switchcreative.net/
[Fri Apr 03 12:04:37.727581 2026] [:error] [pid 40533:tid 40541] [client 43.153.26.165:42816] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac88VfbIAA8AViDmwstYnQAAAUY"]
[Fri Apr 03 12:11:24.643849 2026] [:error] [pid 40562:tid 40575] [client 182.42.110.255:41419] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac897DfFMXuP9zvqCerf-QAAAYo"]
[Fri Apr 03 13:12:08.981004 2026] [:error] [pid 33445:tid 33472] [client 43.155.188.157:42068] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac9MKFlRNZ0iDVmJWM0EKgAAABY"]
[Fri Apr 03 16:09:04.271182 2026] [:error] [pid 55174:tid 55200] [client 51.75.128.94:39870] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ac91oJ_WKqUonPNUHYyiYwAAAdg"]
[Fri Apr 03 16:09:06.266251 2026] [:error] [pid 35469:tid 35482] [client 51.75.128.94:35570] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ac91oqGvTIc8-wY3jUTXRgAAAQs"]
[Fri Apr 03 16:09:08.177342 2026] [:error] [pid 35469:tid 35475] [client 51.75.128.94:35582] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ac91pKGvTIc8-wY3jUTXSgAAAQQ"]
[Fri Apr 03 16:09:10.203079 2026] [:error] [pid 33445:tid 33458] [client 51.75.128.94:35596] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ac91pllRNZ0iDVmJWM1oTwAAAAg"]
[Fri Apr 03 16:09:12.251994 2026] [:error] [pid 33445:tid 33474] [client 51.75.128.94:35606] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ac91qFlRNZ0iDVmJWM1oYAAAABg"]
[Fri Apr 03 16:09:14.286411 2026] [:error] [pid 33445:tid 33460] [client 51.75.128.94:35616] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ac91qllRNZ0iDVmJWM1oZgAAAAo"]
[Fri Apr 03 16:09:16.336984 2026] [:error] [pid 33446:tid 33495] [client 51.75.128.94:32810] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ac91rNg3dCqFYIIdw0rD2gAAAFI"]
[Fri Apr 03 16:09:18.216828 2026] [:error] [pid 33445:tid 33457] [client 51.75.128.94:32818] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ac91rllRNZ0iDVmJWM1ocgAAAAc"]
[Fri Apr 03 16:09:20.226622 2026] [:error] [pid 33445:tid 33466] [client 51.75.128.94:32834] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ac91sFlRNZ0iDVmJWM1oegAAABA"]
[Fri Apr 03 16:09:22.267202 2026] [:error] [pid 55174:tid 55183] [client 51.75.128.94:32840] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ac91sp_WKqUonPNUHYyidAAAAcc"]
[Fri Apr 03 16:09:24.287406 2026] [:error] [pid 33445:tid 33458] [client 51.75.128.94:32846] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ac91tFlRNZ0iDVmJWM1oewAAAAg"]
[Fri Apr 03 16:09:26.166839 2026] [:error] [pid 33446:tid 33482] [client 51.75.128.94:32852] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ac91ttg3dCqFYIIdw0rD5gAAAEU"]
[Fri Apr 03 16:09:28.206396 2026] [:error] [pid 33447:tid 33519] [client 51.75.128.94:46288] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ac91uEgaPmDHz92j4lMC0wAAAI8"]
[Fri Apr 03 16:09:30.094734 2026] [:error] [pid 33542:tid 33547] [client 51.75.128.94:46296] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ac91unwb6uB1LaGtepa_2wAAAMI"]
[Fri Apr 03 16:09:32.005107 2026] [:error] [pid 40562:tid 40583] [client 51.75.128.94:46298] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ac91vDfFMXuP9zvqCeof7wAAAZI"]
[Fri Apr 03 16:09:34.027060 2026] [:error] [pid 33447:tid 33514] [client 51.75.128.94:46300] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ac91vkgaPmDHz92j4lMC2wAAAIo"]
[Fri Apr 03 16:09:35.943346 2026] [:error] [pid 40562:tid 40571] [client 51.75.128.94:46316] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ac91vzfFMXuP9zvqCeof-gAAAYY"]
[Fri Apr 03 16:09:37.818434 2026] [:error] [pid 40533:tid 40559] [client 51.75.128.94:58562] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ac91wfbIAA8AViDmwst4dwAAAVg"]
[Fri Apr 03 16:09:39.862935 2026] [:error] [pid 35469:tid 35493] [client 51.75.128.94:58566] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ac91w6GvTIc8-wY3jUTXlQAAARY"]
[Fri Apr 03 16:09:41.865907 2026] [:error] [pid 33445:tid 33454] [client 51.75.128.94:58576] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ac91xVlRNZ0iDVmJWM1okgAAAAQ"]
[Fri Apr 03 16:09:43.870572 2026] [:error] [pid 33542:tid 33565] [client 51.75.128.94:58580] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ac91x3wb6uB1LaGtepa_6AAAANQ"]
[Fri Apr 03 16:09:45.764886 2026] [:error] [pid 33446:tid 33479] [client 51.75.128.94:58584] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ac91ydg3dCqFYIIdw0rECAAAAEI"]
[Fri Apr 03 16:09:47.794157 2026] [:error] [pid 33542:tid 33563] [client 51.75.128.94:52406] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ac91y3wb6uB1LaGtepa_8QAAANI"]
[Fri Apr 03 16:09:49.805819 2026] [:error] [pid 35469:tid 35489] [client 51.75.128.94:52408] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ac91zaGvTIc8-wY3jUTXrgAAARI"]
[Fri Apr 03 16:09:51.685153 2026] [:error] [pid 35469:tid 35485] [client 51.75.128.94:52422] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ac91z6GvTIc8-wY3jUTXtAAAAQ4"]
[Fri Apr 03 16:09:53.701659 2026] [:error] [pid 35469:tid 35476] [client 51.75.128.94:52436] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ac910aGvTIc8-wY3jUTXwwAAAQU"]
[Fri Apr 03 16:09:55.717118 2026] [:error] [pid 33542:tid 33563] [client 51.75.128.94:52442] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ac9103wb6uB1LaGtepa_9wAAANI"]
[Fri Apr 03 16:09:57.662229 2026] [:error] [pid 35469:tid 35493] [client 51.75.128.94:33008] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ac911aGvTIc8-wY3jUTXzwAAARY"]
[Fri Apr 03 16:10:01.812675 2026] [:error] [pid 40562:tid 40581] [client 51.75.128.94:33014] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ac912TfFMXuP9zvqCeogCAAAAZA"]
[Fri Apr 03 16:10:25.360858 2026] [:error] [pid 33447:tid 33515] [client 51.75.128.94:60572] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ac918UgaPmDHz92j4lMDEgAAAIs"]
[Fri Apr 03 16:10:27.323061 2026] [:error] [pid 35469:tid 35472] [client 51.75.128.94:50302] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ac9186GvTIc8-wY3jUTYEwAAAQE"]
[Fri Apr 03 16:10:29.813397 2026] [:error] [pid 35469:tid 35484] [client 51.75.128.94:50310] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ac919aGvTIc8-wY3jUTYGgAAAQ0"]
[Fri Apr 03 16:10:32.162651 2026] [:error] [pid 35469:tid 35478] [client 51.75.128.94:50312] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ac91-KGvTIc8-wY3jUTYHgAAAQc"]
[Fri Apr 03 16:10:34.182159 2026] [:error] [pid 35469:tid 35472] [client 51.75.128.94:50328] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ac91-qGvTIc8-wY3jUTYJwAAAQE"]
[Fri Apr 03 16:10:36.049649 2026] [:error] [pid 33445:tid 33454] [client 51.75.128.94:50334] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ac91_FlRNZ0iDVmJWM1o9AAAAAQ"]
[Fri Apr 03 16:10:38.060137 2026] [:error] [pid 33446:tid 33495] [client 51.75.128.94:47472] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ac91_tg3dCqFYIIdw0rEXQAAAFI"]
[Fri Apr 03 16:10:40.085868 2026] [:error] [pid 55174:tid 55190] [client 51.75.128.94:47484] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ac92AJ_WKqUonPNUHYyiuAAAAc4"]
[Fri Apr 03 16:10:42.105983 2026] [:error] [pid 33445:tid 33458] [client 51.75.128.94:47486] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ac92AllRNZ0iDVmJWM1pCQAAAAg"]
[Fri Apr 03 16:10:44.596632 2026] [:error] [pid 33445:tid 33458] [client 51.75.128.94:47494] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ac92BFlRNZ0iDVmJWM1pDwAAAAg"]
[Fri Apr 03 16:10:46.915903 2026] [:error] [pid 33445:tid 33471] [client 51.75.128.94:46678] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ac92BllRNZ0iDVmJWM1pHAAAABU"]
[Fri Apr 03 16:10:48.934410 2026] [:error] [pid 33446:tid 33489] [client 51.75.128.94:46682] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ac92CNg3dCqFYIIdw0rEZgAAAEw"]
[Fri Apr 03 16:10:51.414565 2026] [:error] [pid 33542:tid 33569] [client 51.75.128.94:46690] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ac92C3wb6uB1LaGtepbAHQAAANg"]
[Fri Apr 03 16:10:53.471835 2026] [:error] [pid 35469:tid 35478] [client 51.75.128.94:46702] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ac92DaGvTIc8-wY3jUTYQQAAAQc"]
[Fri Apr 03 16:10:55.467362 2026] [:error] [pid 40562:tid 40579] [client 51.75.128.94:46714] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ac92DzfFMXuP9zvqCeogPAAAAY4"]
[Fri Apr 03 16:10:59.139163 2026] [:error] [pid 40562:tid 40572] [client 51.75.128.94:41188] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac92EzfFMXuP9zvqCeogQQAAAYc"]
[Fri Apr 03 16:11:02.785108 2026] [:error] [pid 40562:tid 40580] [client 51.75.128.94:41194] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac92FjfFMXuP9zvqCeogVQAAAY8"]
[Fri Apr 03 17:07:13.144188 2026] [:error] [pid 55174:tid 55186] [client 39.184.92.210:26109] [client 39.184.92.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac-DQZ_WKqUonPNUHYyuygAAAco"], referer: http://www.switchcreative.net/
[Fri Apr 03 18:29:58.634091 2026] [:error] [pid 33542:tid 33567] [client 170.106.193.108:60218] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac-Wpnwb6uB1LaGtepbYjAAAANY"]
[Fri Apr 03 18:43:04.372301 2026] [:error] [pid 40562:tid 40575] [client 51.77.43.72:54084] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ac-ZuDfFMXuP9zvqCepPYgAAAYo"]
[Fri Apr 03 18:43:06.257515 2026] [:error] [pid 33446:tid 33494] [client 51.77.43.72:58220] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ac-Zutg3dCqFYIIdw0oH9wAAAFE"]
[Fri Apr 03 18:43:08.375401 2026] [:error] [pid 33446:tid 33481] [client 51.77.43.72:53212] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ac-ZvNg3dCqFYIIdw0oIAQAAAEQ"]
[Fri Apr 03 18:43:11.402725 2026] [:error] [pid 33446:tid 33498] [client 51.77.43.72:38536] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ac-Zv9g3dCqFYIIdw0oIGQAAAFU"]
[Fri Apr 03 18:43:15.215645 2026] [:error] [pid 33447:tid 33518] [client 51.77.43.72:41444] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ac-Zw0gaPmDHz92j4lMl7gAAAI4"]
[Fri Apr 03 18:43:17.229012 2026] [:error] [pid 40562:tid 40587] [client 51.77.43.72:46726] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ac-ZxTfFMXuP9zvqCepPeQAAAZY"]
[Fri Apr 03 18:43:20.169097 2026] [:error] [pid 40533:tid 40555] [client 51.77.43.72:46742] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ac-ZyPbIAA8AViDmwsuQUAAAAVQ"]
[Fri Apr 03 18:43:23.519081 2026] [:error] [pid 33446:tid 33497] [client 51.77.43.72:41450] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ac-Zy9g3dCqFYIIdw0oIUwAAAFQ"]
[Fri Apr 03 18:43:25.534345 2026] [:error] [pid 33542:tid 33545] [client 51.77.43.72:36916] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ac-ZzXwb6uB1LaGtepba6gAAAMA"]
[Fri Apr 03 18:43:27.563387 2026] [:error] [pid 33446:tid 33501] [client 51.77.43.72:36922] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ac-Zz9g3dCqFYIIdw0oIagAAAFg"]
[Fri Apr 03 18:43:30.700741 2026] [:error] [pid 33446:tid 33489] [client 51.77.43.72:48212] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ac-Z0tg3dCqFYIIdw0oIiQAAAEw"]
[Fri Apr 03 18:43:33.300635 2026] [:error] [pid 35469:tid 35474] [client 51.77.43.72:36934] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ac-Z1aGvTIc8-wY3jUQenAAAAQM"]
[Fri Apr 03 18:43:35.133765 2026] [:error] [pid 33446:tid 33501] [client 51.77.43.72:41794] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ac-Z19g3dCqFYIIdw0oIpAAAAFg"]
[Fri Apr 03 18:43:37.897474 2026] [:error] [pid 33446:tid 33481] [client 51.77.43.72:41802] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ac-Z2dg3dCqFYIIdw0oIuwAAAEQ"]
[Fri Apr 03 18:43:39.973816 2026] [:error] [pid 40562:tid 40567] [client 51.77.43.72:41812] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ac-Z2zfFMXuP9zvqCepPigAAAYI"]
[Fri Apr 03 18:43:41.946570 2026] [:error] [pid 40562:tid 40566] [client 51.77.43.72:41824] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ac-Z3TfFMXuP9zvqCepPjgAAAYE"]
[Fri Apr 03 18:43:43.901659 2026] [:error] [pid 40562:tid 40572] [client 51.77.43.72:41830] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ac-Z3zfFMXuP9zvqCepPkwAAAYc"]
[Fri Apr 03 18:43:47.288086 2026] [:error] [pid 55174:tid 55186] [client 51.77.43.72:59750] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ac-Z45_WKqUonPNUHYzIEgAAAco"]
[Fri Apr 03 18:43:49.753108 2026] [:error] [pid 33446:tid 33478] [client 51.77.43.72:59766] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ac-Z5dg3dCqFYIIdw0oJDQAAAEE"]
[Fri Apr 03 18:43:52.509029 2026] [:error] [pid 33445:tid 33471] [client 51.77.43.72:59768] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ac-Z6FlRNZ0iDVmJWM3D5gAAABU"]
[Fri Apr 03 18:43:54.545575 2026] [:error] [pid 40562:tid 40586] [client 51.77.43.72:36568] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ac-Z6jfFMXuP9zvqCepPnAAAAZU"]
[Fri Apr 03 18:43:57.296295 2026] [:error] [pid 33447:tid 33517] [client 51.77.43.72:35986] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ac-Z7UgaPmDHz92j4lMmFgAAAI0"]
[Fri Apr 03 18:43:59.726465 2026] [:error] [pid 40562:tid 40584] [client 51.77.43.72:35994] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ac-Z7zfFMXuP9zvqCepPpQAAAZM"]
[Fri Apr 03 18:44:01.852331 2026] [:error] [pid 40533:tid 40549] [client 51.77.43.72:36578] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ac-Z8fbIAA8AViDmwsuQdgAAAU4"]
[Fri Apr 03 18:44:26.987287 2026] [:error] [pid 33446:tid 33486] [client 51.77.43.72:35996] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ac-aCtg3dCqFYIIdw0oJiwAAAEk"]
[Fri Apr 03 18:44:29.857799 2026] [:error] [pid 33447:tid 33524] [client 51.77.43.72:44658] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ac-aDUgaPmDHz92j4lMmQQAAAJQ"]
[Fri Apr 03 18:44:33.061002 2026] [:error] [pid 40562:tid 40572] [client 51.77.43.72:36500] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "ac-aETfFMXuP9zvqCepP3AAAAYc"]
[Fri Apr 03 18:44:36.130510 2026] [:error] [pid 55174:tid 55179] [client 51.77.43.72:33200] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "ac-aFJ_WKqUonPNUHYzIRwAAAcM"]
[Fri Apr 03 18:44:39.173553 2026] [:error] [pid 40562:tid 40577] [client 51.77.43.72:33206] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ac-aFzfFMXuP9zvqCepP7AAAAYw"]
[Fri Apr 03 18:44:41.651780 2026] [:error] [pid 33445:tid 33453] [client 51.77.43.72:33216] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ac-aGVlRNZ0iDVmJWM3EWwAAAAM"]
[Fri Apr 03 18:44:44.511078 2026] [:error] [pid 35469:tid 35483] [client 51.77.43.72:33232] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ac-aHKGvTIc8-wY3jUQfMgAAAQw"]
[Fri Apr 03 18:44:46.942584 2026] [:error] [pid 35469:tid 35479] [client 51.77.43.72:34088] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ac-aHqGvTIc8-wY3jUQfPQAAAQg"]
[Fri Apr 03 18:44:48.881700 2026] [:error] [pid 35469:tid 35479] [client 51.77.43.72:36924] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ac-aIKGvTIc8-wY3jUQfRAAAAQg"]
[Fri Apr 03 18:44:51.888851 2026] [:error] [pid 33446:tid 33484] [client 51.77.43.72:34104] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ac-aI9g3dCqFYIIdw0oJqwAAAEc"]
[Fri Apr 03 18:44:53.803122 2026] [:error] [pid 40562:tid 40583] [client 51.77.43.72:36938] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ac-aJTfFMXuP9zvqCepQAgAAAZI"]
[Fri Apr 03 18:44:56.775410 2026] [:error] [pid 33445:tid 33461] [client 51.77.43.72:32836] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ac-aKFlRNZ0iDVmJWM3EeAAAAAs"]
[Fri Apr 03 18:44:59.357346 2026] [:error] [pid 33445:tid 33467] [client 51.77.43.72:32852] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ac-aK1lRNZ0iDVmJWM3EgAAAABE"]
[Fri Apr 03 18:45:02.389567 2026] [:error] [pid 33445:tid 33456] [client 51.77.43.72:32860] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ac-aLllRNZ0iDVmJWM3EjQAAAAY"]
[Fri Apr 03 18:45:05.086001 2026] [:error] [pid 35469:tid 35472] [client 51.77.43.72:44644] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ac-aMaGvTIc8-wY3jUQfbQAAAQE"]
[Fri Apr 03 18:45:09.116204 2026] [:error] [pid 33447:tid 33507] [client 51.77.43.72:44646] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ac-aNUgaPmDHz92j4lMmVwAAAIM"]
[Fri Apr 03 18:45:12.507571 2026] [:error] [pid 33446:tid 33485] [client 51.77.43.72:44660] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ac-aONg3dCqFYIIdw0oKAAAAAEg"]
[Fri Apr 03 18:45:17.236314 2026] [:error] [pid 35469:tid 35493] [client 51.77.43.72:36360] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ac-aPaGvTIc8-wY3jUQfjQAAARY"]
[Fri Apr 03 18:45:20.403049 2026] [:error] [pid 55174:tid 55178] [client 51.77.43.72:43958] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ac-aQJ_WKqUonPNUHYzIdgAAAcI"]
[Fri Apr 03 18:45:23.835889 2026] [:error] [pid 35469:tid 35493] [client 51.77.43.72:43966] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ac-aQ6GvTIc8-wY3jUQflwAAARY"]
[Fri Apr 03 18:45:53.023063 2026] [:error] [pid 35469:tid 35476] [client 51.77.43.72:44852] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ac-aYaGvTIc8-wY3jUQf2QAAAQU"]
[Fri Apr 03 18:45:56.418356 2026] [:error] [pid 33446:tid 33486] [client 51.77.43.72:45276] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ac-aZNg3dCqFYIIdw0oKlQAAAEk"]
[Fri Apr 03 18:45:58.524184 2026] [:error] [pid 55174:tid 55185] [client 51.77.43.72:45280] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ac-aZp_WKqUonPNUHYzIjwAAAck"]
[Fri Apr 03 18:46:00.643939 2026] [:error] [pid 35469:tid 35474] [client 51.77.43.72:45282] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ac-aaKGvTIc8-wY3jUQf6AAAAQM"]
[Fri Apr 03 18:46:02.615628 2026] [:error] [pid 40533:tid 40542] [client 51.77.43.72:45292] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ac-aavbIAA8AViDmwsuQ2wAAAUc"]
[Fri Apr 03 18:46:05.050173 2026] [:error] [pid 33445:tid 33460] [client 51.77.43.72:49496] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ac-abVlRNZ0iDVmJWM3FOwAAAAo"]
[Fri Apr 03 18:46:05.264144 2026] [:error] [pid 40562:tid 40589] [client 182.42.105.144:55837] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac-abTfFMXuP9zvqCepQWgAAAZg"]
[Fri Apr 03 18:46:07.289745 2026] [:error] [pid 33447:tid 33526] [client 51.77.43.72:49508] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ac-ab0gaPmDHz92j4lMmgwAAAJY"]
[Fri Apr 03 18:46:09.345877 2026] [:error] [pid 35469:tid 35493] [client 51.77.43.72:49518] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ac-acaGvTIc8-wY3jUQf8AAAARY"]
[Fri Apr 03 18:46:12.589580 2026] [:error] [pid 33446:tid 33487] [client 51.77.43.72:50536] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ac-adNg3dCqFYIIdw0oKsQAAAEo"]
[Fri Apr 03 18:46:15.163014 2026] [:error] [pid 35469:tid 35491] [client 51.77.43.72:48268] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ac-ad6GvTIc8-wY3jUQf_wAAARQ"]
[Fri Apr 03 18:46:17.773326 2026] [:error] [pid 35469:tid 35473] [client 51.77.43.72:48348] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ac-aeaGvTIc8-wY3jUQgBAAAAQI"]
[Fri Apr 03 18:46:21.263136 2026] [:error] [pid 33542:tid 33560] [client 51.77.43.72:48282] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ac-afXwb6uB1LaGtepbbdgAAAM8"]
[Fri Apr 03 18:46:23.772363 2026] [:error] [pid 40562:tid 40572] [client 51.77.43.72:48360] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ac-afzfFMXuP9zvqCepQdQAAAYc"]
[Fri Apr 03 18:46:25.793599 2026] [:error] [pid 33445:tid 33458] [client 51.77.43.72:54618] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ac-agVlRNZ0iDVmJWM3FUAAAAAg"]
[Fri Apr 03 18:46:28.353783 2026] [:error] [pid 35469:tid 35487] [client 51.77.43.72:58104] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ac-ahKGvTIc8-wY3jUQgDQAAARA"]
[Fri Apr 03 18:46:31.901873 2026] [:error] [pid 35469:tid 35472] [client 51.77.43.72:58118] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ac-ah6GvTIc8-wY3jUQgGAAAAQE"]
[Fri Apr 03 18:46:35.023023 2026] [:error] [pid 33446:tid 33486] [client 51.77.43.72:38326] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ac-ai9g3dCqFYIIdw0oK9AAAAEk"]
[Fri Apr 03 18:46:37.936197 2026] [:error] [pid 33542:tid 33568] [client 51.77.43.72:48286] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ac-ajXwb6uB1LaGtepbbhgAAANc"]
[Fri Apr 03 18:46:40.080924 2026] [:error] [pid 55174:tid 55199] [client 51.77.43.72:38342] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ac-akJ_WKqUonPNUHYzIvQAAAdc"]
[Fri Apr 03 18:46:42.952169 2026] [:error] [pid 33446:tid 33477] [client 51.77.43.72:48288] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ac-aktg3dCqFYIIdw0oLAgAAAEA"]
[Fri Apr 03 18:46:43.085708 2026] [:error] [pid 33446:tid 33485] [client 51.77.43.72:48290] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ac-ak9g3dCqFYIIdw0oLBAAAAEg"]
[Fri Apr 03 18:46:45.074000 2026] [:error] [pid 33445:tid 33470] [client 51.77.43.72:34616] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ac-alVlRNZ0iDVmJWM3FdAAAABQ"]
[Fri Apr 03 18:46:48.237278 2026] [:error] [pid 40562:tid 40567] [client 51.77.43.72:56320] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ac-amDfFMXuP9zvqCepQpAAAAYI"]
[Fri Apr 03 18:46:48.348633 2026] [:error] [pid 40562:tid 40579] [client 51.77.43.72:56334] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ac-amDfFMXuP9zvqCepQpgAAAY4"]
[Fri Apr 03 18:46:49.842321 2026] [:error] [pid 40562:tid 40587] [client 51.77.43.72:34626] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ac-amTfFMXuP9zvqCepQrAAAAZY"]
[Fri Apr 03 18:47:03.660388 2026] [:error] [pid 40562:tid 40581] [client 51.77.43.72:34632] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "ac-apzfFMXuP9zvqCepQwwAAAZA"]
[Fri Apr 03 18:47:05.191202 2026] [:error] [pid 33446:tid 33489] [client 51.77.43.72:42324] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ac-aqdg3dCqFYIIdw0oLTAAAAEw"]
[Fri Apr 03 18:47:06.486970 2026] [:error] [pid 55174:tid 55176] [client 51.77.43.72:46152] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ac-aqp_WKqUonPNUHYzI2AAAAcA"]
[Fri Apr 03 18:47:07.077510 2026] [:error] [pid 33446:tid 33499] [client 51.77.43.72:56344] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ac-aq9g3dCqFYIIdw0oLUwAAAFY"]
[Fri Apr 03 18:47:09.208166 2026] [:error] [pid 33445:tid 33456] [client 51.77.43.72:46158] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ac-arVlRNZ0iDVmJWM3FfAAAAAY"]
[Fri Apr 03 18:47:09.674858 2026] [:error] [pid 33445:tid 33468] [client 51.77.43.72:51854] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ac-arVlRNZ0iDVmJWM3FfQAAABI"]
[Fri Apr 03 18:47:12.123195 2026] [:error] [pid 33446:tid 33499] [client 51.77.43.72:51870] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ac-asNg3dCqFYIIdw0oLcwAAAFY"]
[Fri Apr 03 18:47:12.784447 2026] [:error] [pid 33446:tid 33483] [client 51.77.43.72:46174] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ac-asNg3dCqFYIIdw0oLeQAAAEY"]
[Fri Apr 03 18:47:14.515748 2026] [:error] [pid 40562:tid 40579] [client 51.77.43.72:51878] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ac-asjfFMXuP9zvqCepQzgAAAY4"]
[Fri Apr 03 18:47:15.370840 2026] [:error] [pid 33542:tid 33559] [client 51.77.43.72:44500] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ac-as3wb6uB1LaGtepbboQAAAM4"]
[Fri Apr 03 18:47:16.984050 2026] [:error] [pid 33445:tid 33455] [client 51.77.43.72:54186] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ac-atFlRNZ0iDVmJWM3FhQAAAAU"]
[Fri Apr 03 18:47:19.635572 2026] [:error] [pid 40562:tid 40571] [client 51.77.43.72:54188] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ac-atzfFMXuP9zvqCepQ1wAAAYY"]
[Fri Apr 03 18:47:19.996648 2026] [:error] [pid 55174:tid 55183] [client 51.77.43.72:44510] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ac-at5_WKqUonPNUHYzI7gAAAcc"]
[Fri Apr 03 18:47:22.094198 2026] [:error] [pid 55174:tid 55193] [client 51.77.43.72:44524] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ac-aup_WKqUonPNUHYzI9AAAAdE"]
[Fri Apr 03 18:47:22.389695 2026] [:error] [pid 55174:tid 55199] [client 51.77.43.72:54192] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ac-aup_WKqUonPNUHYzI9wAAAdc"]
[Fri Apr 03 18:47:25.166006 2026] [:error] [pid 35469:tid 35484] [client 51.77.43.72:52232] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ac-avaGvTIc8-wY3jUQgZAAAAQ0"]
[Fri Apr 03 18:47:25.509944 2026] [:error] [pid 35469:tid 35483] [client 51.77.43.72:51938] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ac-avaGvTIc8-wY3jUQgZQAAAQw"]
[Fri Apr 03 18:47:27.532870 2026] [:error] [pid 33446:tid 33499] [client 51.77.43.72:51942] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ac-av9g3dCqFYIIdw0oLnwAAAFY"]
[Fri Apr 03 18:47:27.706682 2026] [:error] [pid 33445:tid 33464] [client 51.77.43.72:52240] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ac-av1lRNZ0iDVmJWM3FlAAAAA4"]
[Fri Apr 03 18:47:30.324924 2026] [:error] [pid 33447:tid 33520] [client 51.77.43.72:52246] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ac-awkgaPmDHz92j4lMmyQAAAJA"]
[Fri Apr 03 18:47:30.390588 2026] [:error] [pid 55174:tid 55184] [client 51.77.43.72:51944] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ac-awp_WKqUonPNUHYzJAwAAAcg"]
[Fri Apr 03 18:47:32.851025 2026] [:error] [pid 33447:tid 33513] [client 51.77.43.72:51946] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ac-axEgaPmDHz92j4lMmzQAAAIk"]
[Fri Apr 03 18:47:33.078790 2026] [:error] [pid 33445:tid 33473] [client 51.77.43.72:52252] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ac-axVlRNZ0iDVmJWM3FnAAAABc"]
[Fri Apr 03 18:47:35.459022 2026] [:error] [pid 33445:tid 33453] [client 51.77.43.72:48038] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ac-ax1lRNZ0iDVmJWM3FowAAAAM"]
[Fri Apr 03 18:47:35.775897 2026] [:error] [pid 33445:tid 33450] [client 51.77.43.72:40726] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ac-ax1lRNZ0iDVmJWM3FpwAAAAA"]
[Fri Apr 03 18:47:37.379444 2026] [:error] [pid 33445:tid 33451] [client 51.77.43.72:48044] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ac-ayVlRNZ0iDVmJWM3FrQAAAAE"]
[Fri Apr 03 18:47:38.649059 2026] [:error] [pid 35469:tid 35495] [client 51.77.43.72:40732] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ac-ayqGvTIc8-wY3jUQghAAAARg"]
[Fri Apr 03 18:47:41.416905 2026] [:error] [pid 55174:tid 55178] [client 51.77.43.72:40746] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ac-azZ_WKqUonPNUHYzJFQAAAcI"]
[Fri Apr 03 18:47:42.395251 2026] [:error] [pid 33446:tid 33498] [client 51.77.43.72:48054] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ac-aztg3dCqFYIIdw0oLxQAAAFU"]
[Fri Apr 03 18:47:44.179474 2026] [:error] [pid 33445:tid 33470] [client 51.77.43.72:40752] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ac-a0FlRNZ0iDVmJWM3FtQAAABQ"]
[Fri Apr 03 18:47:45.749293 2026] [:error] [pid 40533:tid 40557] [client 51.77.43.72:44044] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ac-a0fbIAA8AViDmwsuRTQAAAVY"]
[Fri Apr 03 18:47:46.834944 2026] [:error] [pid 35469:tid 35474] [client 51.77.43.72:39092] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ac-a0qGvTIc8-wY3jUQgkgAAAQM"]
[Fri Apr 03 18:47:48.457417 2026] [:error] [pid 33446:tid 33496] [client 51.77.43.72:44046] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac-a1Ng3dCqFYIIdw0oL5wAAAFM"]
[Fri Apr 03 18:47:50.117710 2026] [:error] [pid 33445:tid 33474] [client 51.77.43.72:44052] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ac-a1llRNZ0iDVmJWM3FuQAAABg"]
[Fri Apr 03 18:47:52.390023 2026] [:error] [pid 33446:tid 33477] [client 51.77.43.72:44054] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ac-a2Ng3dCqFYIIdw0oL_gAAAEA"]
[Fri Apr 03 18:47:53.331413 2026] [:error] [pid 33446:tid 33486] [client 51.77.43.72:44064] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ac-a2dg3dCqFYIIdw0oMAQAAAEk"]
[Fri Apr 03 18:47:56.666115 2026] [:error] [pid 35469:tid 35474] [client 51.77.43.72:59816] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ac-a3KGvTIc8-wY3jUQgoQAAAQM"]
[Fri Apr 03 18:47:59.511847 2026] [:error] [pid 33542:tid 33557] [client 51.77.43.72:59828] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ac-a33wb6uB1LaGtepbbwgAAAMw"]
[Fri Apr 03 18:48:01.932048 2026] [:error] [pid 40533:tid 40555] [client 51.77.43.72:59842] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ac-a4fbIAA8AViDmwsuRcQAAAVQ"]
[Fri Apr 03 18:48:35.553977 2026] [:error] [pid 33445:tid 33452] [client 51.77.43.72:37950] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ac-bA1lRNZ0iDVmJWM3GHgAAAAI"]
[Fri Apr 03 18:48:37.614223 2026] [:error] [pid 33445:tid 33460] [client 51.77.43.72:48846] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ac-bBVlRNZ0iDVmJWM3GJgAAAAo"]
[Fri Apr 03 18:48:39.585692 2026] [:error] [pid 33446:tid 33501] [client 51.77.43.72:48850] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ac-bB9g3dCqFYIIdw0oMnAAAAFg"]
[Fri Apr 03 18:48:41.887531 2026] [:error] [pid 33446:tid 33489] [client 51.77.43.72:48860] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ac-bCdg3dCqFYIIdw0oMpAAAAEw"]
[Fri Apr 03 18:48:44.392574 2026] [:error] [pid 40533:tid 40557] [client 51.77.43.72:52802] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ac-bDPbIAA8AViDmwsuRmwAAAVY"]
[Fri Apr 03 18:48:46.425765 2026] [:error] [pid 33446:tid 33500] [client 51.77.43.72:52810] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ac-bDtg3dCqFYIIdw0oMuQAAAFc"]
[Fri Apr 03 18:48:49.112800 2026] [:error] [pid 33446:tid 33477] [client 51.77.43.72:52816] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ac-bEdg3dCqFYIIdw0oMwwAAAEA"]
[Fri Apr 03 18:48:51.127000 2026] [:error] [pid 35469:tid 35474] [client 51.77.43.72:52818] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ac-bE6GvTIc8-wY3jUQg7QAAAQM"]
[Fri Apr 03 18:48:53.010816 2026] [:error] [pid 40562:tid 40577] [client 51.77.43.72:52832] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ac-bFTfFMXuP9zvqCepRPwAAAYw"]
[Fri Apr 03 18:48:55.527206 2026] [:error] [pid 33445:tid 33461] [client 51.77.43.72:58318] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ac-bF1lRNZ0iDVmJWM3GSQAAAAs"]
[Fri Apr 03 18:48:57.922737 2026] [:error] [pid 33445:tid 33468] [client 51.77.43.72:58324] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ac-bGVlRNZ0iDVmJWM3GSgAAABI"]
[Fri Apr 03 18:49:00.631328 2026] [:error] [pid 33446:tid 33496] [client 51.77.43.72:58332] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ac-bHNg3dCqFYIIdw0oM_gAAAFM"]
[Fri Apr 03 18:49:03.103154 2026] [:error] [pid 55174:tid 55176] [client 51.77.43.72:58336] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ac-bH5_WKqUonPNUHYzJdgAAAcA"]
[Fri Apr 03 18:49:05.008671 2026] [:error] [pid 33446:tid 33482] [client 51.77.43.72:34158] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ac-bIdg3dCqFYIIdw0oNEwAAAEU"]
[Fri Apr 03 18:49:08.080124 2026] [:error] [pid 33445:tid 33465] [client 51.77.43.72:34160] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ac-bJFlRNZ0iDVmJWM3GbAAAAA8"]
[Fri Apr 03 18:49:11.025395 2026] [:error] [pid 33447:tid 33527] [client 51.77.43.72:34166] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ac-bJ0gaPmDHz92j4lMnGwAAAJc"]
[Fri Apr 03 18:49:14.402729 2026] [:error] [pid 33445:tid 33467] [client 51.77.43.72:34180] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ac-bKllRNZ0iDVmJWM3GhQAAABE"]
[Fri Apr 03 18:49:20.660100 2026] [:error] [pid 55174:tid 55195] [client 51.77.43.72:35016] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ac-bMJ_WKqUonPNUHYzJigAAAdM"]
[Fri Apr 03 18:49:29.147334 2026] [:error] [pid 33542:tid 33560] [client 51.77.43.72:47456] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ac-bOXwb6uB1LaGtepbcFQAAAM8"]
[Fri Apr 03 18:50:40.788794 2026] [:error] [pid 40562:tid 40576] [client 51.77.43.72:36664] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ac-bgDfFMXuP9zvqCepR7QAAAYs"]
[Fri Apr 03 18:50:43.035053 2026] [:error] [pid 33445:tid 33452] [client 51.77.43.72:56884] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ac-bg1lRNZ0iDVmJWM3HTwAAAAI"]
[Fri Apr 03 18:50:45.594472 2026] [:error] [pid 33445:tid 33457] [client 51.77.43.72:34022] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ac-bhVlRNZ0iDVmJWM3HYgAAAAc"]
[Fri Apr 03 18:50:47.855437 2026] [:error] [pid 40562:tid 40579] [client 51.77.43.72:34026] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ac-bhzfFMXuP9zvqCepR-AAAAY4"]
[Fri Apr 03 18:50:50.794305 2026] [:error] [pid 33447:tid 33513] [client 51.77.43.72:34034] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ac-bikgaPmDHz92j4lMnhgAAAIk"]
[Fri Apr 03 18:50:53.648117 2026] [:error] [pid 40533:tid 40555] [client 51.77.43.72:34036] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ac-bjfbIAA8AViDmwsuR_gAAAVQ"]
[Fri Apr 03 18:50:55.982786 2026] [:error] [pid 33542:tid 33550] [client 51.77.43.72:56784] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ac-bj3wb6uB1LaGtepbcbAAAAMU"]
[Fri Apr 03 18:50:58.015777 2026] [:error] [pid 35469:tid 35494] [client 51.77.43.72:56796] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ac-bkqGvTIc8-wY3jUQh-gAAARc"]
[Fri Apr 03 18:51:00.221941 2026] [:error] [pid 33445:tid 33458] [client 51.77.43.72:56798] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ac-blFlRNZ0iDVmJWM3HfwAAAAg"]
[Fri Apr 03 18:51:04.158739 2026] [:error] [pid 35469:tid 35485] [client 51.77.43.72:56808] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ac-bmKGvTIc8-wY3jUQiEwAAAQ4"]
[Fri Apr 03 18:51:07.468476 2026] [:error] [pid 35469:tid 35477] [client 51.77.43.72:56882] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ac-bm6GvTIc8-wY3jUQiHgAAAQY"]
[Fri Apr 03 18:51:09.312003 2026] [:error] [pid 33542:tid 33565] [client 51.77.43.72:56888] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ac-bnXwb6uB1LaGtepbchwAAANQ"]
[Fri Apr 03 18:51:11.821526 2026] [:error] [pid 33446:tid 33499] [client 51.77.43.72:56900] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ac-bn9g3dCqFYIIdw0oOlgAAAFY"]
[Fri Apr 03 18:51:13.966595 2026] [:error] [pid 33447:tid 33512] [client 51.77.43.72:56902] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ac-boUgaPmDHz92j4lMnnwAAAIg"]
[Fri Apr 03 18:51:16.109823 2026] [:error] [pid 55174:tid 55179] [client 51.77.43.72:57504] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ac-bpJ_WKqUonPNUHYzKIgAAAcM"]
[Fri Apr 03 18:51:18.296839 2026] [:error] [pid 35469:tid 35481] [client 51.77.43.72:57506] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ac-bpqGvTIc8-wY3jUQiNgAAAQo"]
[Fri Apr 03 18:51:20.164148 2026] [:error] [pid 40562:tid 40586] [client 51.77.43.72:57512] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ac-bqDfFMXuP9zvqCepSKQAAAZU"]
[Fri Apr 03 18:51:22.438825 2026] [:error] [pid 33445:tid 33457] [client 51.77.43.72:57524] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ac-bqllRNZ0iDVmJWM3HpAAAAAc"]
[Fri Apr 03 18:51:24.693995 2026] [:error] [pid 40562:tid 40568] [client 51.77.43.72:49078] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ac-brDfFMXuP9zvqCepSMQAAAYM"]
[Fri Apr 03 18:51:26.782382 2026] [:error] [pid 33542:tid 33558] [client 51.77.43.72:49086] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ac-brnwb6uB1LaGtepbctQAAAM0"]
[Fri Apr 03 18:51:29.053952 2026] [:error] [pid 33446:tid 33492] [client 51.77.43.72:49092] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ac-bsdg3dCqFYIIdw0oOrgAAAE8"]
[Fri Apr 03 18:51:31.153358 2026] [:error] [pid 33446:tid 33493] [client 51.77.43.72:49106] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ac-bs9g3dCqFYIIdw0oOtwAAAFA"]
[Fri Apr 03 18:51:33.240193 2026] [:error] [pid 33445:tid 33460] [client 51.77.43.72:49122] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ac-btVlRNZ0iDVmJWM3HrgAAAAo"]
[Fri Apr 03 18:51:35.178866 2026] [:error] [pid 35469:tid 35484] [client 51.77.43.72:58776] [client 51.77.43.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ac-bt6GvTIc8-wY3jUQiYQAAAQ0"]
[Fri Apr 03 19:36:14.132044 2026] [:error] [pid 35469:tid 35479] [client 43.165.65.75:39002] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac-mLqGvTIc8-wY3jURBtQAAAQg"]
[Fri Apr 03 19:52:27.740219 2026] [:error] [pid 55174:tid 55200] [client 147.135.213.27:56324] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ac-p-5_WKqUonPNUHYzafQAAAdg"]
[Fri Apr 03 19:52:30.195028 2026] [:error] [pid 33542:tid 33562] [client 147.135.213.27:46302] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ac-p_nwb6uB1LaGtepbouwAAANE"]
[Fri Apr 03 19:52:32.598033 2026] [:error] [pid 35469:tid 35477] [client 147.135.213.27:46306] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ac-qAKGvTIc8-wY3jUROfQAAAQY"]
[Fri Apr 03 19:52:35.027192 2026] [:error] [pid 33445:tid 33470] [client 147.135.213.27:56612] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ac-qA1lRNZ0iDVmJWM3hDwAAABQ"]
[Fri Apr 03 19:52:37.432198 2026] [:error] [pid 33446:tid 33498] [client 147.135.213.27:56618] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ac-qBdg3dCqFYIIdw0ox3AAAAFU"]
[Fri Apr 03 19:52:39.931007 2026] [:error] [pid 40562:tid 40585] [client 147.135.213.27:56632] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ac-qBzfFMXuP9zvqCepldgAAAZQ"]
[Fri Apr 03 19:52:42.398251 2026] [:error] [pid 35469:tid 35487] [client 147.135.213.27:56642] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ac-qCqGvTIc8-wY3jUROqQAAARA"]
[Fri Apr 03 19:52:44.958315 2026] [:error] [pid 35469:tid 35478] [client 147.135.213.27:38378] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ac-qDKGvTIc8-wY3jUROxQAAAQc"]
[Fri Apr 03 19:52:47.489254 2026] [:error] [pid 55174:tid 55183] [client 147.135.213.27:38386] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ac-qD5_WKqUonPNUHYzahwAAAcc"]
[Fri Apr 03 19:52:49.947184 2026] [:error] [pid 33445:tid 33458] [client 147.135.213.27:38394] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ac-qEVlRNZ0iDVmJWM3hGgAAAAg"]
[Fri Apr 03 19:52:52.356322 2026] [:error] [pid 33542:tid 33566] [client 147.135.213.27:38402] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ac-qFHwb6uB1LaGtepbowAAAANU"]
[Fri Apr 03 19:52:54.709158 2026] [:error] [pid 55174:tid 55191] [client 147.135.213.27:35518] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ac-qFp_WKqUonPNUHYzajAAAAc8"]
[Fri Apr 03 19:52:57.215846 2026] [:error] [pid 35469:tid 35484] [client 147.135.213.27:35522] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ac-qGaGvTIc8-wY3jURPDwAAAQ0"]
[Fri Apr 03 19:52:59.687494 2026] [:error] [pid 55174:tid 55177] [client 147.135.213.27:35534] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ac-qG5_WKqUonPNUHYzalgAAAcE"]
[Fri Apr 03 19:53:02.175911 2026] [:error] [pid 35469:tid 35495] [client 147.135.213.27:35540] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ac-qHqGvTIc8-wY3jURPLAAAARg"]
[Fri Apr 03 19:53:04.681729 2026] [:error] [pid 33446:tid 33488] [client 147.135.213.27:33028] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ac-qINg3dCqFYIIdw0oyJQAAAEs"]
[Fri Apr 03 19:53:07.097734 2026] [:error] [pid 33446:tid 33496] [client 147.135.213.27:33038] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ac-qI9g3dCqFYIIdw0oyMQAAAFM"]
[Fri Apr 03 19:53:09.614399 2026] [:error] [pid 35469:tid 35479] [client 147.135.213.27:33044] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ac-qJaGvTIc8-wY3jURPSQAAAQg"]
[Fri Apr 03 19:53:12.081458 2026] [:error] [pid 33447:tid 33509] [client 147.135.213.27:33048] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ac-qKEgaPmDHz92j4lM3igAAAIU"]
[Fri Apr 03 19:53:14.582043 2026] [:error] [pid 40562:tid 40582] [client 147.135.213.27:46422] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ac-qKjfFMXuP9zvqCeplowAAAZE"]
[Fri Apr 03 19:53:17.049213 2026] [:error] [pid 33446:tid 33497] [client 147.135.213.27:46438] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ac-qLdg3dCqFYIIdw0oyOwAAAFQ"]
[Fri Apr 03 19:53:19.609422 2026] [:error] [pid 35469:tid 35482] [client 147.135.213.27:46448] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ac-qL6GvTIc8-wY3jURPaQAAAQs"]
[Fri Apr 03 19:53:22.051743 2026] [:error] [pid 33446:tid 33491] [client 147.135.213.27:46454] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ac-qMtg3dCqFYIIdw0oySwAAAE4"]
[Fri Apr 03 19:53:24.538753 2026] [:error] [pid 33542:tid 33568] [client 147.135.213.27:49614] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ac-qNHwb6uB1LaGtepbo1QAAANc"]
[Fri Apr 03 21:02:12.323846 2026] [:error] [pid 35469:tid 35479] [client 121.206.94.74:16182] [client 121.206.94.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ac-6VKGvTIc8-wY3jUSJ1wAAAQg"], referer: http://www.switchcreative.net/
[Fri Apr 03 23:08:44.883497 2026] [:error] [pid 33445:tid 33464] [client 49.47.154.45:60869] [client 49.47.154.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.47.154.45, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac_X_FlRNZ0iDVmJWM1Q9AAAAA4"]
[Fri Apr 03 23:08:44.894122 2026] [proxy_fcgi:error] [pid 33445:tid 33464] [client 49.47.154.45:60869] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 23:23:34.127313 2026] [:error] [pid 55174:tid 55182] [client 77.220.193.133:20079] [client 77.220.193.133] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac_bdp_WKqUonPNUHYwQ2AAAAcY"]
[Fri Apr 03 23:23:34.127647 2026] [:error] [pid 55174:tid 55182] [client 77.220.193.133:20079] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.220.193.133, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac_bdp_WKqUonPNUHYwQ2AAAAcY"]
[Fri Apr 03 23:23:34.139352 2026] [proxy_fcgi:error] [pid 55174:tid 55182] [client 77.220.193.133:20079] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 23:23:35.473467 2026] [:error] [pid 33445:tid 33467] [client 77.220.193.133:47947] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.220.193.133, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ac_bd1lRNZ0iDVmJWM1b5wAAABE"], referer: https://www.google.com
[Fri Apr 03 23:23:35.477345 2026] [proxy_fcgi:error] [pid 33445:tid 33467] [client 77.220.193.133:47947] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 03 23:23:36.815398 2026] [:error] [pid 35469:tid 35478] [client 77.220.193.133:62555] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.220.193.133, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ac_beKGvTIc8-wY3jUTIxgAAAQc"], referer: https://www.google.com
[Fri Apr 03 23:23:36.819520 2026] [proxy_fcgi:error] [pid 35469:tid 35478] [client 77.220.193.133:62555] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 03 23:23:38.166739 2026] [proxy_fcgi:error] [pid 35469:tid 35488] [client 77.220.193.133:17059] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 03 23:23:39.502458 2026] [:error] [pid 40562:tid 40566] [client 77.220.193.133:42285] [client 77.220.193.133] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ac_bezfFMXuP9zvqCeqvNAAAAYE"], referer: https://www.google.com
[Fri Apr 03 23:23:42.172418 2026] [:error] [pid 33445:tid 33467] [client 77.220.193.133:32525] [client 77.220.193.133] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac_bfllRNZ0iDVmJWM1cGgAAABE"]
[Fri Apr 03 23:23:42.172705 2026] [:error] [pid 33445:tid 33467] [client 77.220.193.133:32525] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.220.193.133, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ac_bfllRNZ0iDVmJWM1cGgAAABE"]
[Fri Apr 03 23:23:42.177294 2026] [proxy_fcgi:error] [pid 33445:tid 33467] [client 77.220.193.133:32525] AH01071: Got error 'Primary script unknown'
[Fri Apr 03 23:23:43.919361 2026] [:error] [pid 40533:tid 40542] [client 77.220.193.133:31669] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.220.193.133, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ac_bf_bIAA8AViDmwsvnvgAAAUc"], referer: https://www.google.com
[Fri Apr 03 23:23:43.922528 2026] [proxy_fcgi:error] [pid 40533:tid 40542] [client 77.220.193.133:31669] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 03 23:23:45.260002 2026] [:error] [pid 33445:tid 33458] [client 77.220.193.133:22845] [client 77.220.193.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.220.193.133, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ac_bgVlRNZ0iDVmJWM1cOAAAAAg"], referer: https://www.google.com
[Fri Apr 03 23:23:45.264050 2026] [proxy_fcgi:error] [pid 33445:tid 33458] [client 77.220.193.133:22845] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 03 23:23:46.602899 2026] [proxy_fcgi:error] [pid 40533:tid 40549] [client 77.220.193.133:44671] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Sat Apr 04 00:45:04.467018 2026] [:error] [pid 12097:tid 12174] [client 43.135.183.82:41544] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ac_ukBnkcvJ01y2CY3mWhAAAANM"]
[Sat Apr 04 00:53:58.294608 2026] [:error] [pid 12089:tid 12127] [client 36.138.252.97:34596] [client 36.138.252.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ac_wpkSCG1Z_hi7I_jJawAAAAIA"]
[Sat Apr 04 00:53:58.298713 2026] [:error] [pid 12097:tid 12164] [client 36.138.252.97:34588] [client 36.138.252.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ac_wphnkcvJ01y2CY3mbzAAAAMk"]
[Sat Apr 04 00:53:59.970814 2026] [:error] [pid 12097:tid 12175] [client 36.138.252.97:59584] [client 36.138.252.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ac_wpxnkcvJ01y2CY3mb0wAAANQ"]
[Sat Apr 04 00:53:59.999340 2026] [:error] [pid 12097:tid 12170] [client 36.138.252.97:59580] [client 36.138.252.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ac_wpxnkcvJ01y2CY3mb1AAAAM8"]
[Sat Apr 04 01:09:06.717271 2026] [proxy_fcgi:error] [pid 12097:tid 12168] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:06.983458 2026] [proxy_fcgi:error] [pid 12097:tid 12178] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:07.249581 2026] [proxy_fcgi:error] [pid 12097:tid 12165] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:07.517354 2026] [proxy_fcgi:error] [pid 12097:tid 12160] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:07.782514 2026] [proxy_fcgi:error] [pid 12097:tid 12162] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:08.047952 2026] [proxy_fcgi:error] [pid 12097:tid 12157] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:08.314231 2026] [proxy_fcgi:error] [pid 12097:tid 12161] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:08.580092 2026] [proxy_fcgi:error] [pid 12097:tid 12163] [client 20.240.61.149:9212] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:09:09.372739 2026] [:error] [pid 12097:tid 12159] [client 20.240.61.149:9212] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ac_0NRnkcvJ01y2CY3mj_wAAAMQ"]
[Sat Apr 04 01:09:09.899568 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9206] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ac_0NRQDAzkmdfiSgI2S_AAAAQc"]
[Sat Apr 04 01:09:10.432998 2026] [:error] [pid 12097:tid 12174] [client 20.240.61.149:9161] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ac_0NhnkcvJ01y2CY3mkAAAAANM"]
[Sat Apr 04 01:09:10.959061 2026] [:error] [pid 12097:tid 12161] [client 20.240.61.149:9140] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ac_0NhnkcvJ01y2CY3mkAwAAAMY"]
[Sat Apr 04 01:09:11.491192 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9183] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mail.php"] [unique_id "ac_0NxQDAzkmdfiSgI2TBwAAAQA"]
[Sat Apr 04 01:09:12.031009 2026] [:error] [pid 12233:tid 12245] [client 20.240.61.149:9165] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mail.php"] [unique_id "ac_0OBQDAzkmdfiSgI2TDAAAAQo"]
[Sat Apr 04 01:09:12.574045 2026] [:error] [pid 12089:tid 12127] [client 20.240.61.149:9104] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mail.php"] [unique_id "ac_0OESCG1Z_hi7I_jJguAAAAIA"]
[Sat Apr 04 01:09:13.100994 2026] [:error] [pid 12081:tid 12120] [client 20.240.61.149:9205] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mail.php"] [unique_id "ac_0OaMJBCYerZTQdmLupQAAAFQ"]
[Sat Apr 04 01:09:13.633191 2026] [:error] [pid 12233:tid 12254] [client 20.240.61.149:9202] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ac_0ORQDAzkmdfiSgI2TEgAAARM"]
[Sat Apr 04 01:09:14.161276 2026] [:error] [pid 12097:tid 12165] [client 20.240.61.149:9211] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ac_0OhnkcvJ01y2CY3mkCQAAAMo"]
[Sat Apr 04 01:09:14.693216 2026] [:error] [pid 12081:tid 12101] [client 20.240.61.149:9103] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ac_0OqMJBCYerZTQdmLuqwAAAEE"]
[Sat Apr 04 01:09:15.226172 2026] [:error] [pid 12233:tid 12238] [client 20.240.61.149:9186] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aapig.php"] [unique_id "ac_0OxQDAzkmdfiSgI2TGQAAAQM"]
[Sat Apr 04 01:09:15.776857 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9175] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac_0OxQDAzkmdfiSgI2THAAAARE"]
[Sat Apr 04 01:09:16.318868 2026] [:error] [pid 12233:tid 12246] [client 20.240.61.149:9169] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac_0PBQDAzkmdfiSgI2THwAAAQs"]
[Sat Apr 04 01:09:16.848634 2026] [:error] [pid 12081:tid 12124] [client 20.240.61.149:9108] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac_0PKMJBCYerZTQdmLurwAAAFg"]
[Sat Apr 04 01:09:17.374286 2026] [:error] [pid 12233:tid 12257] [client 20.240.61.149:9189] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web.php"] [unique_id "ac_0PRQDAzkmdfiSgI2TJwAAARY"]
[Sat Apr 04 01:09:17.898833 2026] [:error] [pid 12097:tid 12175] [client 20.240.61.149:9187] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ac_0PRnkcvJ01y2CY3mkEgAAANQ"]
[Sat Apr 04 01:09:18.426292 2026] [:error] [pid 12081:tid 12101] [client 20.240.61.149:9105] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ac_0PqMJBCYerZTQdmLutAAAAEE"]
[Sat Apr 04 01:09:18.962434 2026] [:error] [pid 12081:tid 12107] [client 20.240.61.149:9092] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ac_0PqMJBCYerZTQdmLuvAAAAEc"]
[Sat Apr 04 01:09:19.493117 2026] [:error] [pid 12233:tid 12246] [client 20.240.61.149:9208] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ac_0PxQDAzkmdfiSgI2TLgAAAQs"]
[Sat Apr 04 01:09:20.017695 2026] [:error] [pid 12097:tid 12171] [client 20.240.61.149:9173] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ac_0QBnkcvJ01y2CY3mkGgAAANA"]
[Sat Apr 04 01:09:20.551844 2026] [:error] [pid 12081:tid 12114] [client 20.240.61.149:9207] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ac_0QKMJBCYerZTQdmLuwgAAAE4"]
[Sat Apr 04 01:09:21.078902 2026] [:error] [pid 12089:tid 12127] [client 20.240.61.149:9101] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ac_0QUSCG1Z_hi7I_jJgyAAAAIA"]
[Sat Apr 04 01:09:21.603156 2026] [:error] [pid 12097:tid 12164] [client 20.240.61.149:9200] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "ac_0QRnkcvJ01y2CY3mkHgAAAMk"]
[Sat Apr 04 01:09:22.128141 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:9095] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac_0QhnkcvJ01y2CY3mkIwAAAM0"]
[Sat Apr 04 01:09:22.671390 2026] [:error] [pid 12089:tid 12132] [client 20.240.61.149:9210] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac_0QkSCG1Z_hi7I_jJgzQAAAIU"]
[Sat Apr 04 01:09:23.199918 2026] [:error] [pid 12081:tid 12109] [client 20.240.61.149:9204] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac_0Q6MJBCYerZTQdmLuywAAAEk"]
[Sat Apr 04 01:09:23.724916 2026] [:error] [pid 12081:tid 12122] [client 20.240.61.149:9111] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "ac_0Q6MJBCYerZTQdmLuzAAAAFY"]
[Sat Apr 04 01:09:24.249259 2026] [:error] [pid 12089:tid 12149] [client 20.240.61.149:9184] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac_0RESCG1Z_hi7I_jJg0QAAAJY"]
[Sat Apr 04 01:09:24.776402 2026] [:error] [pid 12089:tid 12139] [client 20.240.61.149:9124] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac_0RESCG1Z_hi7I_jJg1gAAAIw"]
[Sat Apr 04 01:09:25.300689 2026] [:error] [pid 12233:tid 12249] [client 20.240.61.149:9194] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac_0RRQDAzkmdfiSgI2TQAAAAQ4"]
[Sat Apr 04 01:09:25.845887 2026] [:error] [pid 12089:tid 12131] [client 20.240.61.149:9100] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lp6.php"] [unique_id "ac_0RUSCG1Z_hi7I_jJg3QAAAIQ"]
[Sat Apr 04 01:09:26.375494 2026] [:error] [pid 12097:tid 12179] [client 20.240.61.149:9096] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ac_0RhnkcvJ01y2CY3mkLQAAANg"]
[Sat Apr 04 01:09:26.916562 2026] [:error] [pid 12089:tid 12149] [client 20.240.61.149:9089] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ac_0RkSCG1Z_hi7I_jJg4QAAAJY"]
[Sat Apr 04 01:09:27.446145 2026] [:error] [pid 12233:tid 12257] [client 20.240.61.149:9164] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ac_0RxQDAzkmdfiSgI2TRQAAARY"]
[Sat Apr 04 01:09:27.981967 2026] [:error] [pid 12233:tid 12247] [client 20.240.61.149:9209] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ac_0RxQDAzkmdfiSgI2TRgAAAQw"]
[Sat Apr 04 01:09:28.507921 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9147] [client 20.240.61.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac_0SBQDAzkmdfiSgI2TTwAAAQA"]
[Sat Apr 04 01:09:29.041982 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:9123] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aves.php"] [unique_id "ac_0SRnkcvJ01y2CY3mkPAAAAM0"]
[Sat Apr 04 01:09:29.566183 2026] [:error] [pid 12097:tid 12177] [client 20.240.61.149:9193] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aves.php"] [unique_id "ac_0SRnkcvJ01y2CY3mkPgAAANY"]
[Sat Apr 04 01:09:30.094978 2026] [:error] [pid 12089:tid 12138] [client 20.240.61.149:9135] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aves.php"] [unique_id "ac_0SkSCG1Z_hi7I_jJg6wAAAIs"]
[Sat Apr 04 01:09:30.630514 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9026] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aves.php"] [unique_id "ac_0ShQDAzkmdfiSgI2TVQAAARE"]
[Sat Apr 04 01:09:31.155975 2026] [:error] [pid 12097:tid 12154] [client 20.240.61.149:9160] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ac_0SxnkcvJ01y2CY3mkQwAAAMA"]
[Sat Apr 04 01:09:31.690846 2026] [:error] [pid 12097:tid 12179] [client 20.240.61.149:9127] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ac_0SxnkcvJ01y2CY3mkRgAAANg"]
[Sat Apr 04 01:09:32.262770 2026] [:error] [pid 12097:tid 12174] [client 20.240.61.149:9170] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ac_0TBnkcvJ01y2CY3mkRwAAANM"]
[Sat Apr 04 01:09:32.815261 2026] [:error] [pid 12089:tid 12137] [client 20.240.61.149:9149] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webadmin.php"] [unique_id "ac_0TESCG1Z_hi7I_jJg9QAAAIo"]
[Sat Apr 04 01:09:33.409970 2026] [:error] [pid 12089:tid 12149] [client 20.240.61.149:9090] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "ac_0TUSCG1Z_hi7I_jJg9wAAAJY"]
[Sat Apr 04 01:09:34.051785 2026] [:error] [pid 12097:tid 12159] [client 20.240.61.149:9215] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "ac_0ThnkcvJ01y2CY3mkTgAAAMQ"]
[Sat Apr 04 01:09:34.600307 2026] [:error] [pid 12097:tid 12178] [client 20.240.61.149:9102] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "ac_0ThnkcvJ01y2CY3mkVAAAANc"]
[Sat Apr 04 01:09:35.163493 2026] [:error] [pid 12233:tid 12243] [client 20.240.61.149:9197] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/to.php"] [unique_id "ac_0TxQDAzkmdfiSgI2TaAAAAQg"]
[Sat Apr 04 01:09:35.711025 2026] [:error] [pid 12089:tid 12130] [client 20.240.61.149:9155] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_0T0SCG1Z_hi7I_jJhAgAAAIM"]
[Sat Apr 04 01:09:36.251305 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9180] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_0UBQDAzkmdfiSgI2TbwAAARE"]
[Sat Apr 04 01:09:36.832637 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:9048] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_0UBQDAzkmdfiSgI2TdwAAAQE"]
[Sat Apr 04 01:09:37.369486 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9050] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac_0URnkcvJ01y2CY3mkWQAAAME"]
[Sat Apr 04 01:09:37.933732 2026] [:error] [pid 12233:tid 12249] [client 20.240.61.149:9196] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanz.php"] [unique_id "ac_0URQDAzkmdfiSgI2TfQAAAQ4"]
[Sat Apr 04 01:09:38.516149 2026] [:error] [pid 12097:tid 12154] [client 20.240.61.149:9159] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanz.php"] [unique_id "ac_0UhnkcvJ01y2CY3mkXgAAAMA"]
[Sat Apr 04 01:09:39.097464 2026] [:error] [pid 12097:tid 12161] [client 20.240.61.149:9179] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanz.php"] [unique_id "ac_0UxnkcvJ01y2CY3mkXwAAAMY"]
[Sat Apr 04 01:09:39.636510 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9171] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yanz.php"] [unique_id "ac_0UxQDAzkmdfiSgI2ThwAAAQA"]
[Sat Apr 04 01:09:40.213965 2026] [:error] [pid 12089:tid 12146] [client 20.240.61.149:9121] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "ac_0VESCG1Z_hi7I_jJhDgAAAJM"]
[Sat Apr 04 01:09:40.820796 2026] [:error] [pid 12097:tid 12175] [client 20.240.61.149:9120] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "ac_0VBnkcvJ01y2CY3mkZQAAANQ"]
[Sat Apr 04 01:09:41.368728 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9191] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "ac_0VRQDAzkmdfiSgI2TjAAAARE"]
[Sat Apr 04 01:09:41.903499 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9214] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v3.php"] [unique_id "ac_0VRnkcvJ01y2CY3mkZwAAAME"]
[Sat Apr 04 01:09:42.438726 2026] [:error] [pid 12233:tid 12258] [client 20.240.61.149:9139] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ac_0VhQDAzkmdfiSgI2TkgAAARc"]
[Sat Apr 04 01:09:42.982123 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9107] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ac_0VhQDAzkmdfiSgI2TmAAAAQA"]
[Sat Apr 04 01:09:43.534058 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:9178] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ac_0VxQDAzkmdfiSgI2TnwAAAQQ"]
[Sat Apr 04 01:09:44.074764 2026] [:error] [pid 12089:tid 12145] [client 20.240.61.149:9119] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ac_0WESCG1Z_hi7I_jJhFAAAAJI"]
[Sat Apr 04 01:09:44.603140 2026] [:error] [pid 12097:tid 12178] [client 20.240.61.149:9174] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "ac_0WBnkcvJ01y2CY3mkawAAANc"]
[Sat Apr 04 01:09:45.157616 2026] [:error] [pid 12233:tid 12248] [client 20.240.61.149:9068] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "ac_0WRQDAzkmdfiSgI2TqQAAAQ0"]
[Sat Apr 04 01:09:45.697263 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9131] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "ac_0WRQDAzkmdfiSgI2TrgAAAQc"]
[Sat Apr 04 01:09:46.225190 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9176] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24.php"] [unique_id "ac_0WhQDAzkmdfiSgI2TsgAAAQA"]
[Sat Apr 04 01:09:46.752024 2026] [:error] [pid 12233:tid 12244] [client 20.240.61.149:9167] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "ac_0WhQDAzkmdfiSgI2TuAAAAQk"]
[Sat Apr 04 01:09:47.280463 2026] [:error] [pid 12097:tid 12159] [client 20.240.61.149:9137] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "ac_0WxnkcvJ01y2CY3mkbwAAAMQ"]
[Sat Apr 04 01:09:47.848663 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:9106] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "ac_0WxQDAzkmdfiSgI2TvwAAAQE"]
[Sat Apr 04 01:09:48.388782 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:9088] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lock.php"] [unique_id "ac_0XBQDAzkmdfiSgI2TxgAAAQQ"]
[Sat Apr 04 01:09:48.921917 2026] [:error] [pid 12089:tid 12131] [client 20.240.61.149:9099] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj.php"] [unique_id "ac_0XESCG1Z_hi7I_jJhHQAAAIQ"]
[Sat Apr 04 01:09:49.453722 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:9091] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj.php"] [unique_id "ac_0XRQDAzkmdfiSgI2TzQAAAQQ"]
[Sat Apr 04 01:09:49.979766 2026] [:error] [pid 12089:tid 12138] [client 20.240.61.149:9188] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj.php"] [unique_id "ac_0XUSCG1Z_hi7I_jJhIgAAAIs"]
[Sat Apr 04 01:09:50.517782 2026] [:error] [pid 12089:tid 12147] [client 20.240.61.149:9122] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj.php"] [unique_id "ac_0XkSCG1Z_hi7I_jJhJgAAAJQ"]
[Sat Apr 04 01:09:51.055890 2026] [:error] [pid 12089:tid 12130] [client 20.240.61.149:9115] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "ac_0X0SCG1Z_hi7I_jJhKwAAAIM"]
[Sat Apr 04 01:09:51.582816 2026] [:error] [pid 12089:tid 12138] [client 20.240.61.149:9116] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "ac_0X0SCG1Z_hi7I_jJhLwAAAIs"]
[Sat Apr 04 01:09:52.114772 2026] [:error] [pid 12233:tid 12253] [client 20.240.61.149:9172] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "ac_0YBQDAzkmdfiSgI2T0QAAARI"]
[Sat Apr 04 01:09:52.642802 2026] [:error] [pid 12233:tid 12254] [client 20.240.61.149:9198] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "ac_0YBQDAzkmdfiSgI2T2AAAARM"]
[Sat Apr 04 01:09:53.166780 2026] [:error] [pid 12233:tid 12250] [client 20.240.61.149:9036] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wqqs.php"] [unique_id "ac_0YRQDAzkmdfiSgI2T3QAAAQ8"]
[Sat Apr 04 01:09:53.704617 2026] [:error] [pid 12089:tid 12142] [client 20.240.61.149:9154] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wqqs.php"] [unique_id "ac_0YUSCG1Z_hi7I_jJhNwAAAI8"]
[Sat Apr 04 01:09:54.232312 2026] [:error] [pid 12081:tid 12109] [client 20.240.61.149:9151] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wqqs.php"] [unique_id "ac_0YqMJBCYerZTQdmLu7QAAAEk"]
[Sat Apr 04 01:09:54.758589 2026] [:error] [pid 12097:tid 12160] [client 20.240.61.149:9057] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wqqs.php"] [unique_id "ac_0YhnkcvJ01y2CY3mkdwAAAMU"]
[Sat Apr 04 01:09:55.282510 2026] [:error] [pid 12081:tid 12102] [client 20.240.61.149:9110] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "ac_0Y6MJBCYerZTQdmLu-QAAAEI"]
[Sat Apr 04 01:09:55.816867 2026] [:error] [pid 12081:tid 12109] [client 20.240.61.149:9190] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "ac_0Y6MJBCYerZTQdmLvAQAAAEk"]
[Sat Apr 04 01:09:56.345884 2026] [:error] [pid 12233:tid 12247] [client 20.240.61.149:9080] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "ac_0ZBQDAzkmdfiSgI2T4wAAAQw"]
[Sat Apr 04 01:09:56.893631 2026] [:error] [pid 12089:tid 12146] [client 20.240.61.149:9152] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "ac_0ZESCG1Z_hi7I_jJhOwAAAJM"]
[Sat Apr 04 01:09:57.431882 2026] [:error] [pid 12233:tid 12238] [client 20.240.61.149:9094] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "ac_0ZRQDAzkmdfiSgI2T5wAAAQM"]
[Sat Apr 04 01:09:57.977929 2026] [:error] [pid 12233:tid 12241] [client 20.240.61.149:9158] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "ac_0ZRQDAzkmdfiSgI2T6wAAAQY"]
[Sat Apr 04 01:09:58.510826 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9035] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "ac_0ZhQDAzkmdfiSgI2T8gAAAQc"]
[Sat Apr 04 01:09:59.038950 2026] [:error] [pid 12081:tid 12116] [client 20.240.61.149:9199] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "ac_0Z6MJBCYerZTQdmLvDAAAAFA"]
[Sat Apr 04 01:09:59.572428 2026] [:error] [pid 12097:tid 12172] [client 20.240.61.149:9069] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ac_0ZxnkcvJ01y2CY3mkhgAAANE"]
[Sat Apr 04 01:10:00.118072 2026] [:error] [pid 12081:tid 12122] [client 20.240.61.149:9132] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ac_0aKMJBCYerZTQdmLvEQAAAFY"]
[Sat Apr 04 01:10:00.647613 2026] [:error] [pid 12233:tid 12237] [client 20.240.61.149:9024] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ac_0aBQDAzkmdfiSgI2UBgAAAQI"]
[Sat Apr 04 01:10:01.229971 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9168] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xc0252.php"] [unique_id "ac_0aRnkcvJ01y2CY3mkiAAAAME"]
[Sat Apr 04 01:10:01.762353 2026] [:error] [pid 12089:tid 12135] [client 20.240.61.149:9033] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "ac_0aUSCG1Z_hi7I_jJhSAAAAIg"]
[Sat Apr 04 01:10:02.294795 2026] [:error] [pid 12097:tid 12179] [client 20.240.61.149:9032] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "ac_0ahnkcvJ01y2CY3mkiwAAANg"]
[Sat Apr 04 01:10:02.830533 2026] [:error] [pid 12089:tid 12137] [client 20.240.61.149:9157] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "ac_0akSCG1Z_hi7I_jJhTQAAAIo"]
[Sat Apr 04 01:10:03.361083 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9097] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "ac_0axnkcvJ01y2CY3mklwAAAME"]
[Sat Apr 04 01:10:03.889366 2026] [:error] [pid 12097:tid 12157] [client 20.240.61.149:8997] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ac_0axnkcvJ01y2CY3mkmwAAAMI"]
[Sat Apr 04 01:10:04.431506 2026] [:error] [pid 12089:tid 12148] [client 20.240.61.149:9070] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ac_0bESCG1Z_hi7I_jJhUgAAAJU"]
[Sat Apr 04 01:10:04.960308 2026] [:error] [pid 12097:tid 12166] [client 20.240.61.149:9133] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ac_0bBnkcvJ01y2CY3mkpAAAAMs"]
[Sat Apr 04 01:10:05.488566 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:9203] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ac_0bRnkcvJ01y2CY3mkqwAAAM0"]
[Sat Apr 04 01:10:06.025131 2026] [:error] [pid 12097:tid 12169] [client 20.240.61.149:9126] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac_0bhnkcvJ01y2CY3mksQAAAM4"]
[Sat Apr 04 01:10:06.564022 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:8960] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac_0bhnkcvJ01y2CY3mktAAAAM0"]
[Sat Apr 04 01:10:07.089432 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9134] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac_0bxQDAzkmdfiSgI2UFQAAAQc"]
[Sat Apr 04 01:10:07.638554 2026] [:error] [pid 12089:tid 12146] [client 20.240.61.149:9077] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "ac_0b0SCG1Z_hi7I_jJhWgAAAJM"]
[Sat Apr 04 01:10:08.177509 2026] [:error] [pid 12089:tid 12131] [client 20.240.61.149:9129] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac_0cESCG1Z_hi7I_jJhXwAAAIQ"]
[Sat Apr 04 01:10:08.715405 2026] [:error] [pid 12081:tid 12118] [client 20.240.61.149:8982] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/com.php"] [unique_id "ac_0cKMJBCYerZTQdmLvGwAAAFI"]
[Sat Apr 04 01:10:09.250802 2026] [proxy_fcgi:error] [pid 12081:tid 12103] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:09.516543 2026] [proxy_fcgi:error] [pid 12081:tid 12112] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:09.783180 2026] [proxy_fcgi:error] [pid 12081:tid 12114] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:10.049246 2026] [proxy_fcgi:error] [pid 12081:tid 12106] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:10.316087 2026] [proxy_fcgi:error] [pid 12081:tid 12107] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:10.583659 2026] [proxy_fcgi:error] [pid 12081:tid 12114] [client 20.240.61.149:9195] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:10:12.145096 2026] [:error] [pid 12081:tid 12109] [client 20.240.61.149:9195] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ac_0dKMJBCYerZTQdmLvWAAAAEk"]
[Sat Apr 04 01:10:12.673459 2026] [:error] [pid 12089:tid 12130] [client 20.240.61.149:9083] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ac_0dESCG1Z_hi7I_jJhbwAAAIM"]
[Sat Apr 04 01:10:13.285573 2026] [:error] [pid 12097:tid 12154] [client 20.240.61.149:8963] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ac_0dRnkcvJ01y2CY3mkyAAAAMA"]
[Sat Apr 04 01:10:13.833319 2026] [:error] [pid 12081:tid 12108] [client 20.240.61.149:9162] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ac_0daMJBCYerZTQdmLvaAAAAEg"]
[Sat Apr 04 01:10:14.362973 2026] [:error] [pid 12233:tid 12249] [client 20.240.61.149:9112] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac_0dhQDAzkmdfiSgI2UNwAAAQ4"]
[Sat Apr 04 01:10:14.957825 2026] [:error] [pid 12081:tid 12107] [client 20.240.61.149:9028] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac_0dqMJBCYerZTQdmLvbAAAAEc"]
[Sat Apr 04 01:10:15.491528 2026] [:error] [pid 12233:tid 12237] [client 20.240.61.149:9075] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac_0dxQDAzkmdfiSgI2UQAAAAQI"]
[Sat Apr 04 01:10:16.073406 2026] [:error] [pid 12097:tid 12169] [client 20.240.61.149:9192] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ac_0eBnkcvJ01y2CY3mk1QAAAM4"]
[Sat Apr 04 01:10:16.613030 2026] [:error] [pid 12089:tid 12146] [client 20.240.61.149:9074] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac_0eESCG1Z_hi7I_jJhdwAAAJM"]
[Sat Apr 04 01:10:17.148859 2026] [:error] [pid 12089:tid 12149] [client 20.240.61.149:9045] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac_0eUSCG1Z_hi7I_jJhfAAAAJY"]
[Sat Apr 04 01:10:17.708126 2026] [:error] [pid 12089:tid 12127] [client 20.240.61.149:9148] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac_0eUSCG1Z_hi7I_jJhgQAAAIA"]
[Sat Apr 04 01:10:18.286576 2026] [:error] [pid 12089:tid 12145] [client 20.240.61.149:9093] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "ac_0ekSCG1Z_hi7I_jJhgwAAAJI"]
[Sat Apr 04 01:10:18.842454 2026] [:error] [pid 12233:tid 12248] [client 20.240.61.149:9142] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac_0ehQDAzkmdfiSgI2UUwAAAQ0"]
[Sat Apr 04 01:10:19.373211 2026] [:error] [pid 12089:tid 12134] [client 20.240.61.149:9039] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac_0e0SCG1Z_hi7I_jJhhQAAAIc"]
[Sat Apr 04 01:10:19.935192 2026] [:error] [pid 12233:tid 12245] [client 20.240.61.149:9079] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac_0exQDAzkmdfiSgI2UWAAAAQo"]
[Sat Apr 04 01:10:20.477718 2026] [:error] [pid 12233:tid 12254] [client 20.240.61.149:9130] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ac_0fBQDAzkmdfiSgI2UXAAAARM"]
[Sat Apr 04 01:10:21.039276 2026] [:error] [pid 12233:tid 12241] [client 20.240.61.149:9141] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "ac_0fRQDAzkmdfiSgI2UZAAAAQY"]
[Sat Apr 04 01:10:21.625655 2026] [:error] [pid 12233:tid 12251] [client 20.240.61.149:9136] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "ac_0fRQDAzkmdfiSgI2UbQAAARA"]
[Sat Apr 04 01:10:22.263109 2026] [:error] [pid 12233:tid 12247] [client 20.240.61.149:9213] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "ac_0fhQDAzkmdfiSgI2UdwAAAQw"]
[Sat Apr 04 01:10:22.908808 2026] [:error] [pid 12089:tid 12131] [client 20.240.61.149:9066] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "ac_0fkSCG1Z_hi7I_jJhhwAAAIQ"]
[Sat Apr 04 01:10:23.452369 2026] [:error] [pid 12089:tid 12151] [client 20.240.61.149:9143] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ac_0f0SCG1Z_hi7I_jJhigAAAJg"]
[Sat Apr 04 01:10:24.008935 2026] [:error] [pid 12097:tid 12172] [client 20.240.61.149:8966] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ac_0gBnkcvJ01y2CY3mk5AAAANE"]
[Sat Apr 04 01:10:24.539067 2026] [:error] [pid 12081:tid 12120] [client 20.240.61.149:9025] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ac_0gKMJBCYerZTQdmLvjAAAAFQ"]
[Sat Apr 04 01:10:25.089613 2026] [:error] [pid 12081:tid 12110] [client 20.240.61.149:9086] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ac_0gaMJBCYerZTQdmLvkQAAAEo"]
[Sat Apr 04 01:10:25.615863 2026] [:error] [pid 12233:tid 12248] [client 20.240.61.149:9037] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac_0gRQDAzkmdfiSgI2UgQAAAQ0"]
[Sat Apr 04 01:10:26.191994 2026] [:error] [pid 12081:tid 12100] [client 20.240.61.149:9056] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac_0gqMJBCYerZTQdmLvmAAAAEA"]
[Sat Apr 04 01:10:26.717969 2026] [:error] [pid 12089:tid 12129] [client 20.240.61.149:9043] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac_0gkSCG1Z_hi7I_jJhmgAAAII"]
[Sat Apr 04 01:10:27.254997 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:9082] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xvs.php"] [unique_id "ac_0gxnkcvJ01y2CY3mk7gAAAM0"]
[Sat Apr 04 01:10:27.781324 2026] [:error] [pid 12233:tid 12246] [client 20.240.61.149:9201] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac_0gxQDAzkmdfiSgI2UhwAAAQs"]
[Sat Apr 04 01:10:28.310032 2026] [:error] [pid 12233:tid 12251] [client 20.240.61.149:9098] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac_0hBQDAzkmdfiSgI2UjAAAARA"]
[Sat Apr 04 01:10:28.836074 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9146] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac_0hBnkcvJ01y2CY3mk8QAAAME"]
[Sat Apr 04 01:10:29.368443 2026] [:error] [pid 12233:tid 12251] [client 20.240.61.149:9012] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "ac_0hRQDAzkmdfiSgI2UlAAAARA"]
[Sat Apr 04 01:10:29.897686 2026] [:error] [pid 12233:tid 12256] [client 20.240.61.149:9052] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ac_0hRQDAzkmdfiSgI2UnAAAARU"]
[Sat Apr 04 01:10:30.472804 2026] [:error] [pid 12089:tid 12136] [client 20.240.61.149:9153] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ac_0hkSCG1Z_hi7I_jJhoAAAAIk"]
[Sat Apr 04 01:10:31.003562 2026] [:error] [pid 12233:tid 12253] [client 20.240.61.149:9156] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ac_0hxQDAzkmdfiSgI2UrAAAARI"]
[Sat Apr 04 01:10:31.585310 2026] [:error] [pid 12089:tid 12129] [client 20.240.61.149:8897] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ac_0h0SCG1Z_hi7I_jJhowAAAII"]
[Sat Apr 04 01:10:32.110386 2026] [:error] [pid 12089:tid 12147] [client 20.240.61.149:9041] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gorila.php"] [unique_id "ac_0iESCG1Z_hi7I_jJhqAAAAJQ"]
[Sat Apr 04 01:10:32.638284 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:9150] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gorila.php"] [unique_id "ac_0iBQDAzkmdfiSgI2UtAAAAQA"]
[Sat Apr 04 01:10:33.163655 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:8962] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gorila.php"] [unique_id "ac_0iRQDAzkmdfiSgI2UuAAAAQQ"]
[Sat Apr 04 01:10:33.722896 2026] [:error] [pid 12233:tid 12248] [client 20.240.61.149:9058] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gorila.php"] [unique_id "ac_0iRQDAzkmdfiSgI2UvgAAAQ0"]
[Sat Apr 04 01:10:34.255396 2026] [:error] [pid 12097:tid 12177] [client 20.240.61.149:9034] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ac_0ihnkcvJ01y2CY3mlCgAAANY"]
[Sat Apr 04 01:10:34.791400 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:9059] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ac_0ihnkcvJ01y2CY3mlDwAAAME"]
[Sat Apr 04 01:10:35.329137 2026] [:error] [pid 12097:tid 12159] [client 20.240.61.149:8976] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ac_0ixnkcvJ01y2CY3mlJAAAAMQ"]
[Sat Apr 04 01:10:35.865053 2026] [:error] [pid 12089:tid 12133] [client 20.240.61.149:9031] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0.php"] [unique_id "ac_0i0SCG1Z_hi7I_jJhqgAAAIY"]
[Sat Apr 04 01:10:36.392397 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:9112] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "ac_0jBQDAzkmdfiSgI2U_wAAAQE"]
[Sat Apr 04 01:10:36.971609 2026] [:error] [pid 12233:tid 12238] [client 20.240.61.149:9038] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "ac_0jBQDAzkmdfiSgI2VBgAAAQM"]
[Sat Apr 04 01:10:37.510579 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:9138] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "ac_0jRQDAzkmdfiSgI2VDAAAAQE"]
[Sat Apr 04 01:10:38.049869 2026] [:error] [pid 12097:tid 12157] [client 20.240.61.149:9117] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/333.php"] [unique_id "ac_0jhnkcvJ01y2CY3mlMgAAAMI"]
[Sat Apr 04 01:10:38.583250 2026] [:error] [pid 12081:tid 12102] [client 20.240.61.149:9128] [client 20.240.61.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac_0jqMJBCYerZTQdmLvxgAAAEI"]
[Sat Apr 04 01:10:39.112541 2026] [:error] [pid 12081:tid 12114] [client 20.240.61.149:9065] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac_0j6MJBCYerZTQdmLvyQAAAE4"]
[Sat Apr 04 01:10:39.642683 2026] [:error] [pid 12081:tid 12100] [client 20.240.61.149:9061] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac_0j6MJBCYerZTQdmLvywAAAEA"]
[Sat Apr 04 01:10:40.178910 2026] [:error] [pid 12233:tid 12254] [client 20.240.61.149:9144] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac_0kBQDAzkmdfiSgI2VIAAAARM"]
[Sat Apr 04 01:10:40.711781 2026] [:error] [pid 12233:tid 12244] [client 20.240.61.149:9125] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ac_0kBQDAzkmdfiSgI2VJQAAAQk"]
[Sat Apr 04 01:10:41.249145 2026] [:error] [pid 12233:tid 12257] [client 20.240.61.149:8968] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac_0kRQDAzkmdfiSgI2VLQAAARY"]
[Sat Apr 04 01:10:41.797534 2026] [:error] [pid 12097:tid 12175] [client 20.240.61.149:9166] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac_0kRnkcvJ01y2CY3mlPgAAANQ"]
[Sat Apr 04 01:10:42.332615 2026] [:error] [pid 12233:tid 12249] [client 20.240.61.149:9145] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac_0khQDAzkmdfiSgI2VMgAAAQ4"]
[Sat Apr 04 01:10:42.860285 2026] [:error] [pid 12233:tid 12253] [client 20.240.61.149:9029] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "ac_0khQDAzkmdfiSgI2VNwAAARI"]
[Sat Apr 04 01:10:43.388517 2026] [:error] [pid 12089:tid 12135] [client 20.240.61.149:8970] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1.php"] [unique_id "ac_0k0SCG1Z_hi7I_jJhtAAAAIg"]
[Sat Apr 04 01:10:43.918519 2026] [:error] [pid 12233:tid 12256] [client 20.240.61.149:9085] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1.php"] [unique_id "ac_0kxQDAzkmdfiSgI2VSAAAARU"]
[Sat Apr 04 01:10:44.456018 2026] [:error] [pid 12081:tid 12106] [client 20.240.61.149:8975] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1.php"] [unique_id "ac_0lKMJBCYerZTQdmLv5QAAAEY"]
[Sat Apr 04 01:10:44.995912 2026] [:error] [pid 12081:tid 12103] [client 20.240.61.149:8978] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1.php"] [unique_id "ac_0lKMJBCYerZTQdmLv6wAAAEM"]
[Sat Apr 04 01:10:45.527413 2026] [:error] [pid 12081:tid 12102] [client 20.240.61.149:8989] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "ac_0laMJBCYerZTQdmLv8gAAAEI"]
[Sat Apr 04 01:10:46.053183 2026] [:error] [pid 12081:tid 12103] [client 20.240.61.149:9182] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "ac_0lqMJBCYerZTQdmLv-AAAAEM"]
[Sat Apr 04 01:10:46.579552 2026] [:error] [pid 12097:tid 12179] [client 20.240.61.149:9109] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "ac_0lhnkcvJ01y2CY3mlRAAAANg"]
[Sat Apr 04 01:10:47.116084 2026] [:error] [pid 12081:tid 12110] [client 20.240.61.149:9163] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "ac_0l6MJBCYerZTQdmLwAwAAAEo"]
[Sat Apr 04 01:10:47.658950 2026] [:error] [pid 12081:tid 12104] [client 20.240.61.149:9040] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac_0l6MJBCYerZTQdmLwCAAAAEQ"]
[Sat Apr 04 01:10:48.194172 2026] [:error] [pid 12089:tid 12128] [client 20.240.61.149:9044] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac_0mESCG1Z_hi7I_jJhuAAAAIE"]
[Sat Apr 04 01:10:48.750548 2026] [:error] [pid 12081:tid 12110] [client 20.240.61.149:9118] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac_0mKMJBCYerZTQdmLwEgAAAEo"]
[Sat Apr 04 01:10:49.274724 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:8973] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac_0mRnkcvJ01y2CY3mlSgAAAME"]
[Sat Apr 04 01:10:49.817249 2026] [:error] [pid 12081:tid 12115] [client 20.240.61.149:9072] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac_0maMJBCYerZTQdmLwHwAAAE8"]
[Sat Apr 04 01:10:50.346342 2026] [:error] [pid 12081:tid 12113] [client 20.240.61.149:9078] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac_0mqMJBCYerZTQdmLwJQAAAE0"]
[Sat Apr 04 01:10:50.879022 2026] [:error] [pid 12081:tid 12104] [client 20.240.61.149:9076] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac_0mqMJBCYerZTQdmLwKgAAAEQ"]
[Sat Apr 04 01:10:51.406799 2026] [:error] [pid 12081:tid 12122] [client 20.240.61.149:9046] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ac_0m6MJBCYerZTQdmLwMgAAAFY"]
[Sat Apr 04 01:10:51.937622 2026] [:error] [pid 12233:tid 12240] [client 20.240.61.149:8995] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac_0mxQDAzkmdfiSgI2VVwAAAQU"]
[Sat Apr 04 01:10:52.469225 2026] [:error] [pid 12089:tid 12137] [client 20.240.61.149:8971] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac_0nESCG1Z_hi7I_jJhxAAAAIo"]
[Sat Apr 04 01:10:53.019199 2026] [:error] [pid 12097:tid 12179] [client 20.240.61.149:9062] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac_0nRnkcvJ01y2CY3mlTwAAANg"]
[Sat Apr 04 01:10:53.550928 2026] [:error] [pid 12097:tid 12169] [client 20.240.61.149:9000] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "ac_0nRnkcvJ01y2CY3mlUgAAAM4"]
[Sat Apr 04 01:10:54.099060 2026] [:error] [pid 12081:tid 12105] [client 20.240.61.149:9053] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sh3ll.php"] [unique_id "ac_0nqMJBCYerZTQdmLwPAAAAEU"]
[Sat Apr 04 01:10:54.627342 2026] [:error] [pid 12089:tid 12139] [client 20.240.61.149:8987] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sh3ll.php"] [unique_id "ac_0nkSCG1Z_hi7I_jJh0QAAAIw"]
[Sat Apr 04 01:10:55.159672 2026] [:error] [pid 12233:tid 12251] [client 20.240.61.149:9067] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sh3ll.php"] [unique_id "ac_0nxQDAzkmdfiSgI2VWwAAARA"]
[Sat Apr 04 01:10:55.693910 2026] [:error] [pid 12081:tid 12117] [client 20.240.61.149:9084] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sh3ll.php"] [unique_id "ac_0n6MJBCYerZTQdmLwQQAAAFE"]
[Sat Apr 04 01:10:56.239298 2026] [:error] [pid 12233:tid 12255] [client 20.240.61.149:9060] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ac_0oBQDAzkmdfiSgI2VXgAAARQ"]
[Sat Apr 04 01:10:56.770792 2026] [:error] [pid 12089:tid 12128] [client 20.240.61.149:9002] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ac_0oESCG1Z_hi7I_jJh2QAAAIE"]
[Sat Apr 04 01:10:57.295620 2026] [:error] [pid 12233:tid 12256] [client 20.240.61.149:8920] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ac_0oRQDAzkmdfiSgI2VYAAAARU"]
[Sat Apr 04 01:10:57.822184 2026] [:error] [pid 12089:tid 12136] [client 20.240.61.149:9017] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ac_0oUSCG1Z_hi7I_jJh3AAAAIk"]
[Sat Apr 04 01:10:58.346918 2026] [:error] [pid 12081:tid 12105] [client 20.240.61.149:8905] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac_0oqMJBCYerZTQdmLwUAAAAEU"]
[Sat Apr 04 01:10:58.871624 2026] [:error] [pid 12089:tid 12151] [client 20.240.61.149:9113] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac_0okSCG1Z_hi7I_jJh4AAAAJg"]
[Sat Apr 04 01:10:59.399813 2026] [:error] [pid 12233:tid 12259] [client 20.240.61.149:8923] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac_0oxQDAzkmdfiSgI2VbQAAARg"]
[Sat Apr 04 01:10:59.922607 2026] [:error] [pid 12233:tid 12258] [client 20.240.61.149:9015] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goat1.php"] [unique_id "ac_0oxQDAzkmdfiSgI2VcQAAARc"]
[Sat Apr 04 01:11:00.450579 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9001] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac_0pBQDAzkmdfiSgI2VdAAAARE"]
[Sat Apr 04 01:11:00.977855 2026] [:error] [pid 12089:tid 12132] [client 20.240.61.149:8983] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac_0pESCG1Z_hi7I_jJh8QAAAIU"]
[Sat Apr 04 01:11:01.502307 2026] [:error] [pid 12233:tid 12246] [client 20.240.61.149:9071] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac_0pRQDAzkmdfiSgI2VeAAAAQs"]
[Sat Apr 04 01:11:02.031884 2026] [:error] [pid 12233:tid 12243] [client 20.240.61.149:8937] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mis.php"] [unique_id "ac_0phQDAzkmdfiSgI2VfAAAAQg"]
[Sat Apr 04 01:11:02.579638 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:8947] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ac_0phQDAzkmdfiSgI2VhAAAARE"]
[Sat Apr 04 01:11:03.116448 2026] [:error] [pid 12233:tid 12238] [client 20.240.61.149:9027] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ac_0pxQDAzkmdfiSgI2ViwAAAQM"]
[Sat Apr 04 01:11:03.645771 2026] [:error] [pid 12233:tid 12254] [client 20.240.61.149:8964] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ac_0pxQDAzkmdfiSgI2VkgAAARM"]
[Sat Apr 04 01:11:04.177706 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:8998] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "ac_0qBnkcvJ01y2CY3mlbAAAAME"]
[Sat Apr 04 01:11:04.707419 2026] [:error] [pid 12081:tid 12103] [client 20.240.61.149:8999] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admir.php"] [unique_id "ac_0qKMJBCYerZTQdmLwbQAAAEM"]
[Sat Apr 04 01:11:05.231389 2026] [:error] [pid 12081:tid 12123] [client 20.240.61.149:8985] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admir.php"] [unique_id "ac_0qaMJBCYerZTQdmLwcgAAAFc"]
[Sat Apr 04 01:11:05.758901 2026] [:error] [pid 12089:tid 12129] [client 20.240.61.149:8896] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admir.php"] [unique_id "ac_0qUSCG1Z_hi7I_jJiAAAAAII"]
[Sat Apr 04 01:11:06.306162 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9016] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admir.php"] [unique_id "ac_0qhQDAzkmdfiSgI2VrwAAAQc"]
[Sat Apr 04 01:11:06.860519 2026] [:error] [pid 12233:tid 12244] [client 20.240.61.149:8902] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac_0qhQDAzkmdfiSgI2VtAAAAQk"]
[Sat Apr 04 01:11:07.395131 2026] [:error] [pid 12089:tid 12130] [client 20.240.61.149:9049] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac_0q0SCG1Z_hi7I_jJiAgAAAIM"]
[Sat Apr 04 01:11:07.934337 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:8967] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac_0qxQDAzkmdfiSgI2VvAAAAQE"]
[Sat Apr 04 01:11:08.470380 2026] [:error] [pid 12233:tid 12246] [client 20.240.61.149:8990] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ac_0rBQDAzkmdfiSgI2VwQAAAQs"]
[Sat Apr 04 01:11:08.996857 2026] [:error] [pid 12233:tid 12259] [client 20.240.61.149:9042] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac_0rBQDAzkmdfiSgI2VxwAAARg"]
[Sat Apr 04 01:11:09.526068 2026] [:error] [pid 12233:tid 12247] [client 20.240.61.149:8972] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac_0rRQDAzkmdfiSgI2VywAAAQw"]
[Sat Apr 04 01:11:10.053869 2026] [:error] [pid 12233:tid 12245] [client 20.240.61.149:9005] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac_0rhQDAzkmdfiSgI2VzwAAAQo"]
[Sat Apr 04 01:11:10.579434 2026] [:error] [pid 12233:tid 12242] [client 20.240.61.149:9030] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fyiiz.php"] [unique_id "ac_0rhQDAzkmdfiSgI2V0wAAAQc"]
[Sat Apr 04 01:11:11.126800 2026] [proxy_fcgi:error] [pid 12081:tid 12108] [client 20.240.61.149:9051] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:11:11.656645 2026] [proxy_fcgi:error] [pid 12081:tid 12119] [client 20.240.61.149:9051] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:11:11.923919 2026] [proxy_fcgi:error] [pid 12081:tid 12120] [client 20.240.61.149:9051] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:11:12.189482 2026] [proxy_fcgi:error] [pid 12081:tid 12117] [client 20.240.61.149:9051] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:11:12.454523 2026] [proxy_fcgi:error] [pid 12081:tid 12104] [client 20.240.61.149:9051] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:11:12.716284 2026] [:error] [pid 12081:tid 12106] [client 20.240.61.149:9051] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "ac_0sKMJBCYerZTQdmLwmwAAAEY"]
[Sat Apr 04 01:11:13.247482 2026] [:error] [pid 12089:tid 12145] [client 20.240.61.149:9097] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "ac_0sUSCG1Z_hi7I_jJiDQAAAJI"]
[Sat Apr 04 01:11:13.773542 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:8909] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "ac_0sRnkcvJ01y2CY3mligAAAM0"]
[Sat Apr 04 01:11:14.315598 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:8910] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "ac_0shQDAzkmdfiSgI2V5gAAAQE"]
[Sat Apr 04 01:11:14.862448 2026] [:error] [pid 12089:tid 12140] [client 20.240.61.149:8901] [client 20.240.61.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/app.php"] [unique_id "ac_0skSCG1Z_hi7I_jJiFQAAAI0"]
[Sat Apr 04 01:11:15.395172 2026] [:error] [pid 12081:tid 12121] [client 20.240.61.149:8943] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/444.php"] [unique_id "ac_0s6MJBCYerZTQdmLwpQAAAFU"]
[Sat Apr 04 01:11:15.979100 2026] [:error] [pid 12233:tid 12237] [client 20.240.61.149:8903] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/444.php"] [unique_id "ac_0sxQDAzkmdfiSgI2V7AAAAQI"]
[Sat Apr 04 01:11:16.505746 2026] [:error] [pid 12081:tid 12118] [client 20.240.61.149:9011] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/444.php"] [unique_id "ac_0tKMJBCYerZTQdmLwqQAAAFI"]
[Sat Apr 04 01:11:17.031338 2026] [:error] [pid 12097:tid 12170] [client 20.240.61.149:8921] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/444.php"] [unique_id "ac_0tRnkcvJ01y2CY3mllAAAAM8"]
[Sat Apr 04 01:11:17.557928 2026] [:error] [pid 12081:tid 12111] [client 20.240.61.149:8926] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lites.php"] [unique_id "ac_0taMJBCYerZTQdmLwqwAAAEs"]
[Sat Apr 04 01:11:18.085792 2026] [:error] [pid 12097:tid 12166] [client 20.240.61.149:8957] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lites.php"] [unique_id "ac_0thnkcvJ01y2CY3mlmAAAAMs"]
[Sat Apr 04 01:11:18.612298 2026] [:error] [pid 12097:tid 12176] [client 20.240.61.149:8898] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lites.php"] [unique_id "ac_0thnkcvJ01y2CY3mlnAAAANU"]
[Sat Apr 04 01:11:19.175991 2026] [:error] [pid 12089:tid 12141] [client 20.240.61.149:9008] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lites.php"] [unique_id "ac_0t0SCG1Z_hi7I_jJiIgAAAI4"]
[Sat Apr 04 01:11:19.705387 2026] [:error] [pid 12081:tid 12101] [client 20.240.61.149:9009] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac_0t6MJBCYerZTQdmLwsQAAAEE"]
[Sat Apr 04 01:11:20.243977 2026] [:error] [pid 12089:tid 12135] [client 20.240.61.149:8950] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac_0uESCG1Z_hi7I_jJiJQAAAIg"]
[Sat Apr 04 01:11:20.767079 2026] [:error] [pid 12097:tid 12170] [client 20.240.61.149:9006] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac_0uBnkcvJ01y2CY3mlowAAAM8"]
[Sat Apr 04 01:11:21.343536 2026] [:error] [pid 12233:tid 12245] [client 20.240.61.149:8942] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/az.php"] [unique_id "ac_0uRQDAzkmdfiSgI2WBgAAAQo"]
[Sat Apr 04 01:11:21.876431 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:8981] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac_0uRQDAzkmdfiSgI2WCQAAARE"]
[Sat Apr 04 01:11:22.444317 2026] [:error] [pid 12233:tid 12240] [client 20.240.61.149:8953] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac_0uhQDAzkmdfiSgI2WDgAAAQU"]
[Sat Apr 04 01:11:22.969945 2026] [:error] [pid 12233:tid 12252] [client 20.240.61.149:9019] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac_0uhQDAzkmdfiSgI2WFAAAARE"]
[Sat Apr 04 01:11:23.504845 2026] [:error] [pid 12097:tid 12172] [client 20.240.61.149:9081] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ac_0uxnkcvJ01y2CY3mlqwAAANE"]
[Sat Apr 04 01:11:24.035691 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:9014] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "ac_0vBQDAzkmdfiSgI2WHgAAAQQ"]
[Sat Apr 04 01:11:24.569138 2026] [:error] [pid 12233:tid 12235] [client 20.240.61.149:8945] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "ac_0vBQDAzkmdfiSgI2WJAAAAQA"]
[Sat Apr 04 01:11:25.111515 2026] [:error] [pid 12081:tid 12101] [client 20.240.61.149:8916] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "ac_0vaMJBCYerZTQdmLwwAAAAEE"]
[Sat Apr 04 01:11:25.637024 2026] [:error] [pid 12089:tid 12146] [client 20.240.61.149:8915] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "ac_0vUSCG1Z_hi7I_jJiMQAAAJM"]
[Sat Apr 04 01:11:26.187228 2026] [:error] [pid 12233:tid 12239] [client 20.240.61.149:8994] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/he.php"] [unique_id "ac_0vhQDAzkmdfiSgI2WLgAAAQQ"]
[Sat Apr 04 01:11:26.716078 2026] [:error] [pid 12081:tid 12124] [client 20.240.61.149:8927] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/he.php"] [unique_id "ac_0vqMJBCYerZTQdmLwxwAAAFg"]
[Sat Apr 04 01:11:27.252911 2026] [:error] [pid 12233:tid 12240] [client 20.240.61.149:8996] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/he.php"] [unique_id "ac_0vxQDAzkmdfiSgI2WOQAAAQU"]
[Sat Apr 04 01:11:27.779916 2026] [:error] [pid 12089:tid 12137] [client 20.240.61.149:8991] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/he.php"] [unique_id "ac_0v0SCG1Z_hi7I_jJiNQAAAIo"]
[Sat Apr 04 01:11:28.305448 2026] [:error] [pid 12097:tid 12178] [client 20.240.61.149:8932] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ac_0wBnkcvJ01y2CY3mlsgAAANc"]
[Sat Apr 04 01:11:28.837776 2026] [:error] [pid 12097:tid 12160] [client 20.240.61.149:8865] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ac_0wBnkcvJ01y2CY3mltwAAAMU"]
[Sat Apr 04 01:11:29.403656 2026] [:error] [pid 12233:tid 12240] [client 20.240.61.149:9063] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ac_0wRQDAzkmdfiSgI2WQAAAAQU"]
[Sat Apr 04 01:11:29.931665 2026] [:error] [pid 12081:tid 12122] [client 20.240.61.149:8933] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ac_0waMJBCYerZTQdmLw0wAAAFY"]
[Sat Apr 04 01:11:30.474471 2026] [:error] [pid 12081:tid 12113] [client 20.240.61.149:9007] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ac_0wqMJBCYerZTQdmLw1QAAAE0"]
[Sat Apr 04 01:11:31.004455 2026] [:error] [pid 12097:tid 12174] [client 20.240.61.149:8965] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ac_0wxnkcvJ01y2CY3mlwAAAANM"]
[Sat Apr 04 01:11:31.531029 2026] [:error] [pid 12097:tid 12167] [client 20.240.61.149:8928] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ac_0wxnkcvJ01y2CY3mlxQAAAMw"]
[Sat Apr 04 01:11:32.057771 2026] [:error] [pid 12097:tid 12172] [client 20.240.61.149:8855] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwq13.php"] [unique_id "ac_0xBnkcvJ01y2CY3mlygAAANE"]
[Sat Apr 04 01:11:32.604423 2026] [:error] [pid 12233:tid 12255] [client 20.240.61.149:8917] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/marijuana.php"] [unique_id "ac_0xBQDAzkmdfiSgI2WTwAAARQ"]
[Sat Apr 04 01:11:33.145010 2026] [:error] [pid 12081:tid 12121] [client 20.240.61.149:9087] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/marijuana.php"] [unique_id "ac_0xaMJBCYerZTQdmLw3wAAAFU"]
[Sat Apr 04 01:11:33.695885 2026] [:error] [pid 12097:tid 12169] [client 20.240.61.149:8961] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/marijuana.php"] [unique_id "ac_0xRnkcvJ01y2CY3ml2AAAAM4"]
[Sat Apr 04 01:11:34.314377 2026] [:error] [pid 12233:tid 12249] [client 20.240.61.149:8956] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/marijuana.php"] [unique_id "ac_0xhQDAzkmdfiSgI2WUgAAAQ4"]
[Sat Apr 04 01:11:34.838563 2026] [:error] [pid 12097:tid 12160] [client 20.240.61.149:8929] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac_0xhnkcvJ01y2CY3ml4AAAAMU"]
[Sat Apr 04 01:11:35.368464 2026] [:error] [pid 12081:tid 12117] [client 20.240.61.149:8988] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac_0x6MJBCYerZTQdmLw5AAAAFE"]
[Sat Apr 04 01:11:35.898206 2026] [:error] [pid 12097:tid 12162] [client 20.240.61.149:8904] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac_0xxnkcvJ01y2CY3ml5gAAAMc"]
[Sat Apr 04 01:11:36.425122 2026] [:error] [pid 12233:tid 12240] [client 20.240.61.149:9003] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "ac_0yBQDAzkmdfiSgI2WVwAAAQU"]
[Sat Apr 04 01:11:36.954955 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:8984] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "ac_0yBnkcvJ01y2CY3ml6wAAAM0"]
[Sat Apr 04 01:11:37.482030 2026] [:error] [pid 12089:tid 12147] [client 20.240.61.149:9018] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "ac_0yUSCG1Z_hi7I_jJiVQAAAJQ"]
[Sat Apr 04 01:11:38.007428 2026] [:error] [pid 12089:tid 12142] [client 20.240.61.149:8856] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "ac_0ykSCG1Z_hi7I_jJiWAAAAI8"]
[Sat Apr 04 01:11:38.533175 2026] [:error] [pid 12081:tid 12112] [client 20.240.61.149:9114] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "ac_0yqMJBCYerZTQdmLw7QAAAEw"]
[Sat Apr 04 01:11:39.059846 2026] [:error] [pid 12233:tid 12253] [client 20.240.61.149:9055] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ac_0yxQDAzkmdfiSgI2WYgAAARI"]
[Sat Apr 04 01:11:39.586126 2026] [:error] [pid 12081:tid 12109] [client 20.240.61.149:9020] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ac_0y6MJBCYerZTQdmLw8wAAAEk"]
[Sat Apr 04 01:11:40.111291 2026] [:error] [pid 12081:tid 12116] [client 20.240.61.149:9047] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ac_0zKMJBCYerZTQdmLw-gAAAFA"]
[Sat Apr 04 01:11:40.641419 2026] [:error] [pid 12081:tid 12110] [client 20.240.61.149:8930] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ac_0zKMJBCYerZTQdmLxAAAAAEo"]
[Sat Apr 04 01:11:41.172128 2026] [:error] [pid 12233:tid 12236] [client 20.240.61.149:8974] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ac_0zRQDAzkmdfiSgI2WaAAAAQE"]
[Sat Apr 04 01:11:41.709901 2026] [:error] [pid 12089:tid 12134] [client 20.240.61.149:9023] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ac_0zUSCG1Z_hi7I_jJiXwAAAIc"]
[Sat Apr 04 01:11:42.263603 2026] [:error] [pid 12097:tid 12155] [client 20.240.61.149:8838] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ac_0zhnkcvJ01y2CY3ml_gAAAME"]
[Sat Apr 04 01:11:42.791221 2026] [:error] [pid 12081:tid 12112] [client 20.240.61.149:8979] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ac_0zqMJBCYerZTQdmLxCgAAAEw"]
[Sat Apr 04 01:11:43.315669 2026] [:error] [pid 12097:tid 12168] [client 20.240.61.149:9073] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_0zxnkcvJ01y2CY3mmBAAAAM0"]
[Sat Apr 04 01:11:43.850070 2026] [:error] [pid 12081:tid 12122] [client 20.240.61.149:8922] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_0z6MJBCYerZTQdmLxEgAAAFY"]
[Sat Apr 04 01:11:44.399846 2026] [:error] [pid 12081:tid 12119] [client 20.240.61.149:8955] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_00KMJBCYerZTQdmLxFAAAAFM"]
[Sat Apr 04 01:11:44.925674 2026] [:error] [pid 12081:tid 12121] [client 20.240.61.149:8936] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac_00KMJBCYerZTQdmLxGAAAAFU"]
[Sat Apr 04 01:11:45.472556 2026] [:error] [pid 12089:tid 12147] [client 20.240.61.149:8835] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypass.php"] [unique_id "ac_00USCG1Z_hi7I_jJibAAAAJQ"]
[Sat Apr 04 01:11:46.001780 2026] [:error] [pid 12097:tid 12164] [client 20.240.61.149:8908] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypass.php"] [unique_id "ac_00hnkcvJ01y2CY3mmDgAAAMk"]
[Sat Apr 04 01:11:46.535624 2026] [:error] [pid 12233:tid 12238] [client 20.240.61.149:9181] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypass.php"] [unique_id "ac_00hQDAzkmdfiSgI2WfQAAAQM"]
[Sat Apr 04 01:11:47.061900 2026] [:error] [pid 12233:tid 12250] [client 20.240.61.149:8911] [client 20.240.61.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypass.php"] [unique_id "ac_00xQDAzkmdfiSgI2WfwAAAQ8"]
[Sat Apr 04 01:35:46.529465 2026] [proxy_fcgi:error] [pid 12081:tid 12120] [client 20.215.255.154:33300] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:35:46.788698 2026] [proxy_fcgi:error] [pid 12081:tid 12104] [client 20.215.255.154:33300] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 01:35:47.047857 2026] [proxy_fcgi:error] [pid 12081:tid 12101] [client 20.215.255.154:33300] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:41.060134 2026] [proxy_fcgi:error] [pid 44382:tid 44396] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:41.298012 2026] [proxy_fcgi:error] [pid 44382:tid 44388] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:41.544673 2026] [proxy_fcgi:error] [pid 44382:tid 44402] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:41.784029 2026] [proxy_fcgi:error] [pid 44382:tid 44397] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:42.022386 2026] [proxy_fcgi:error] [pid 44382:tid 44406] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:42.261068 2026] [proxy_fcgi:error] [pid 44382:tid 44385] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:42.499057 2026] [proxy_fcgi:error] [pid 44382:tid 44403] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:42.738758 2026] [proxy_fcgi:error] [pid 44382:tid 44390] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:42.977353 2026] [proxy_fcgi:error] [pid 44382:tid 44393] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:43.217536 2026] [proxy_fcgi:error] [pid 44382:tid 44388] [client 20.250.11.224:62530] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 02:45:43.451989 2026] [:error] [pid 44382:tid 44402] [client 20.250.11.224:62530] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAK15pzSLFOX5FpZ8rQOAAAABI"]
[Sat Apr 04 02:45:43.935071 2026] [:error] [pid 44382:tid 44405] [client 20.250.11.224:46303] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAK15pzSLFOX5FpZ8rQPAAAABU"]
[Sat Apr 04 02:45:44.416086 2026] [:error] [pid 44382:tid 44407] [client 20.250.11.224:16294] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAK2JpzSLFOX5FpZ8rQPwAAABc"]
[Sat Apr 04 02:45:44.945192 2026] [:error] [pid 44382:tid 44389] [client 20.250.11.224:62529] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adAK2JpzSLFOX5FpZ8rQRQAAAAU"]
[Sat Apr 04 02:45:45.616831 2026] [:error] [pid 12089:tid 12135] [client 20.250.11.224:61463] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adAK2USCG1Z_hi7I_jKICAAAAIg"]
[Sat Apr 04 02:45:46.087051 2026] [:error] [pid 12233:tid 12245] [client 20.250.11.224:62533] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAK2hQDAzkmdfiSgI3srwAAAQo"]
[Sat Apr 04 02:45:46.556537 2026] [:error] [pid 12097:tid 12174] [client 20.250.11.224:62532] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAK2hnkcvJ01y2CY3nWNQAAANM"]
[Sat Apr 04 02:45:47.028854 2026] [:error] [pid 12081:tid 12111] [client 20.250.11.224:50416] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAK26MJBCYerZTQdmIu1wAAAEs"]
[Sat Apr 04 02:45:47.498915 2026] [:error] [pid 12233:tid 12249] [client 20.250.11.224:50870] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAK2xQDAzkmdfiSgI3stQAAAQ4"]
[Sat Apr 04 02:45:47.970057 2026] [:error] [pid 12081:tid 12100] [client 20.250.11.224:61483] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adAK26MJBCYerZTQdmIu2QAAAEA"]
[Sat Apr 04 02:45:48.460808 2026] [:error] [pid 12089:tid 12146] [client 20.250.11.224:46312] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adAK3ESCG1Z_hi7I_jKICwAAAJM"]
[Sat Apr 04 02:45:48.930185 2026] [:error] [pid 12233:tid 12250] [client 20.250.11.224:45740] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAK3BQDAzkmdfiSgI3svAAAAQ8"]
[Sat Apr 04 02:45:49.397592 2026] [:error] [pid 12081:tid 12115] [client 20.250.11.224:45728] [client 20.250.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAK3aMJBCYerZTQdmIu3gAAAE8"]
[Sat Apr 04 03:19:57.373148 2026] [:error] [pid 44382:tid 44393] [client 49.51.183.84:39948] [client 49.51.183.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adAS3ZpzSLFOX5FpZ8rtqQAAAAk"]
[Sat Apr 04 03:52:20.353342 2026] [:error] [pid 36996:tid 37056] [client 72.146.45.53:29691] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadPZCLPDVmWK8lly4jAAAAFc"]
[Sat Apr 04 03:52:20.354894 2026] [:error] [pid 36995:tid 37023] [client 72.146.45.53:50326] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadCi33-VM1wZicwS_SwAAABE"]
[Sat Apr 04 03:52:20.844549 2026] [:error] [pid 37090:tid 37113] [client 72.146.45.53:31565] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadOOs05xkA3bSxMcX1AAAANQ"]
[Sat Apr 04 03:52:20.844578 2026] [:error] [pid 37090:tid 37108] [client 72.146.45.53:34297] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadOOs05xkA3bSxMcX0wAAAM8"]
[Sat Apr 04 03:52:21.324938 2026] [:error] [pid 36996:tid 37039] [client 72.146.45.53:31589] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadfZCLPDVmWK8lly4kQAAAEY"]
[Sat Apr 04 03:52:21.327451 2026] [:error] [pid 36996:tid 37045] [client 72.146.45.53:31205] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadfZCLPDVmWK8lly4kgAAAEw"]
[Sat Apr 04 03:52:21.809054 2026] [:error] [pid 36997:tid 37060] [client 72.146.45.53:50831] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAaddhdKImeRBAtzlyFtQAAAIA"]
[Sat Apr 04 03:52:21.810153 2026] [:error] [pid 36995:tid 37021] [client 72.146.45.53:50836] [client 72.146.45.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAadSi33-VM1wZicwS_VAAAAA8"]
[Sat Apr 04 03:54:43.228673 2026] [proxy_fcgi:error] [pid 2458:tid 2525] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:43.488230 2026] [proxy_fcgi:error] [pid 2458:tid 2527] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:44.338986 2026] [proxy_fcgi:error] [pid 2458:tid 2518] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:44.601409 2026] [proxy_fcgi:error] [pid 2458:tid 2515] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:44.860549 2026] [proxy_fcgi:error] [pid 2458:tid 2519] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:45.120430 2026] [proxy_fcgi:error] [pid 2458:tid 2514] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:45.380700 2026] [proxy_fcgi:error] [pid 2458:tid 2507] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:45.641493 2026] [proxy_fcgi:error] [pid 2458:tid 2516] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:45.900637 2026] [proxy_fcgi:error] [pid 2458:tid 2525] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:46.162784 2026] [proxy_fcgi:error] [pid 2458:tid 2520] [client 20.215.255.154:40081] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 03:54:46.418787 2026] [:error] [pid 2458:tid 2513] [client 20.215.255.154:40081] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAbBiNozic5SuWqclm2awAAAEk"]
[Sat Apr 04 03:54:46.929488 2026] [:error] [pid 2459:tid 2543] [client 20.215.255.154:33060] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAbBgefyCmu4LR_Plo6xAAAAIs"]
[Sat Apr 04 03:54:47.026331 2026] [:error] [pid 2457:tid 2479] [client 158.158.32.192:5669] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbB0mNHppaMd92Zpc0NQAAAAI"]
[Sat Apr 04 03:54:47.447093 2026] [:error] [pid 2457:tid 2500] [client 20.215.255.154:53991] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAbB0mNHppaMd92Zpc0NwAAABc"]
[Sat Apr 04 03:54:47.525357 2026] [:error] [pid 2457:tid 2497] [client 158.158.32.192:43601] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbB0mNHppaMd92Zpc0OAAAABQ"]
[Sat Apr 04 03:54:47.960621 2026] [:error] [pid 2459:tid 2545] [client 20.215.255.154:54003] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adAbBwefyCmu4LR_Plo6yAAAAI0"]
[Sat Apr 04 03:54:48.004185 2026] [:error] [pid 2457:tid 2495] [client 158.158.32.192:5536] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbCEmNHppaMd92Zpc0OwAAABI"]
[Sat Apr 04 03:54:48.473522 2026] [:error] [pid 2458:tid 2515] [client 20.215.255.154:33078] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adAbCCNozic5SuWqclm2bAAAAEs"]
[Sat Apr 04 03:54:48.482300 2026] [:error] [pid 2458:tid 2519] [client 158.158.32.192:23529] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbCCNozic5SuWqclm2bQAAAE8"]
[Sat Apr 04 03:54:48.984434 2026] [:error] [pid 2457:tid 2493] [client 20.215.255.154:53968] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adAbCEmNHppaMd92Zpc0PwAAABA"]
[Sat Apr 04 03:54:49.496068 2026] [:error] [pid 2457:tid 2501] [client 20.215.255.154:31892] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adAbCUmNHppaMd92Zpc0QAAAABg"]
[Sat Apr 04 03:54:50.006883 2026] [:error] [pid 2459:tid 2532] [client 20.215.255.154:30097] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adAbCgefyCmu4LR_Plo6zQAAAIE"]
[Sat Apr 04 03:54:50.518045 2026] [:error] [pid 2459:tid 2535] [client 20.215.255.154:35971] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adAbCgefyCmu4LR_Plo60AAAAIQ"]
[Sat Apr 04 03:54:51.030903 2026] [:error] [pid 2459:tid 2547] [client 20.215.255.154:53972] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adAbCwefyCmu4LR_Plo61AAAAI8"]
[Sat Apr 04 03:54:51.543454 2026] [:error] [pid 2458:tid 2525] [client 20.215.255.154:31917] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adAbCyNozic5SuWqclm2cQAAAFU"]
[Sat Apr 04 03:54:52.061103 2026] [:error] [pid 2459:tid 2536] [client 20.215.255.154:34715] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adAbDAefyCmu4LR_Plo62gAAAIU"]
[Sat Apr 04 03:54:52.581294 2026] [:error] [pid 2459:tid 2543] [client 20.215.255.154:33068] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adAbDAefyCmu4LR_Plo63gAAAIs"]
[Sat Apr 04 03:54:53.093856 2026] [:error] [pid 2458:tid 2522] [client 20.215.255.154:30100] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adAbDSNozic5SuWqclm2cwAAAFI"]
[Sat Apr 04 03:54:53.614987 2026] [:error] [pid 2459:tid 2554] [client 20.215.255.154:29048] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adAbDQefyCmu4LR_Plo64AAAAJY"]
[Sat Apr 04 03:54:54.137539 2026] [:error] [pid 2457:tid 2496] [client 20.215.255.154:35972] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adAbDkmNHppaMd92Zpc0RAAAABM"]
[Sat Apr 04 03:54:54.652718 2026] [:error] [pid 2567:tid 2592] [client 20.215.255.154:29046] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error_log.php"] [unique_id "adAbDmJJmfRsTrAKjdQGLgAAANI"]
[Sat Apr 04 03:54:55.163996 2026] [:error] [pid 2459:tid 2549] [client 20.215.255.154:33029] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error_log.php"] [unique_id "adAbDwefyCmu4LR_Plo65AAAAJE"]
[Sat Apr 04 03:54:55.678921 2026] [:error] [pid 2458:tid 2512] [client 20.215.255.154:36003] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error_log.php"] [unique_id "adAbDyNozic5SuWqclm2dwAAAEg"]
[Sat Apr 04 03:54:56.190753 2026] [:error] [pid 2458:tid 2517] [client 20.215.255.154:33026] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error_log.php"] [unique_id "adAbECNozic5SuWqclm2eAAAAE0"]
[Sat Apr 04 03:54:56.708262 2026] [:error] [pid 2458:tid 2515] [client 20.215.255.154:29049] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adAbECNozic5SuWqclm2eQAAAEs"]
[Sat Apr 04 03:54:57.219918 2026] [:error] [pid 2459:tid 2542] [client 20.215.255.154:34688] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adAbEQefyCmu4LR_Plo66AAAAIo"]
[Sat Apr 04 03:54:57.733022 2026] [:error] [pid 2458:tid 2519] [client 20.215.255.154:30095] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adAbESNozic5SuWqclm2egAAAE8"]
[Sat Apr 04 03:54:58.245572 2026] [:error] [pid 2567:tid 2597] [client 20.215.255.154:54801] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adAbEmJJmfRsTrAKjdQGMgAAANc"]
[Sat Apr 04 03:54:58.760533 2026] [:error] [pid 2567:tid 2589] [client 20.215.255.154:54145] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAbEmJJmfRsTrAKjdQGMwAAAM8"]
[Sat Apr 04 03:54:59.298233 2026] [:error] [pid 2459:tid 2552] [client 20.215.255.154:53830] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAbEwefyCmu4LR_Plo67wAAAJQ"]
[Sat Apr 04 03:54:59.809140 2026] [:error] [pid 2459:tid 2554] [client 20.215.255.154:30102] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAbEwefyCmu4LR_Plo68AAAAJY"]
[Sat Apr 04 03:55:00.323271 2026] [:error] [pid 2567:tid 2583] [client 20.215.255.154:30120] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adAbFGJJmfRsTrAKjdQGOQAAAMk"]
[Sat Apr 04 03:55:00.835370 2026] [:error] [pid 2459:tid 2542] [client 20.215.255.154:54805] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adAbFAefyCmu4LR_Plo68gAAAIo"]
[Sat Apr 04 03:55:01.348891 2026] [:error] [pid 2567:tid 2597] [client 20.215.255.154:33042] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adAbFWJJmfRsTrAKjdQGOwAAANc"]
[Sat Apr 04 03:55:01.862648 2026] [:error] [pid 2458:tid 2525] [client 20.215.255.154:31900] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adAbFSNozic5SuWqclm2fAAAAFU"]
[Sat Apr 04 03:55:02.379110 2026] [:error] [pid 2567:tid 2579] [client 20.215.255.154:29014] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adAbFmJJmfRsTrAKjdQGQAAAAMU"]
[Sat Apr 04 03:55:02.892493 2026] [:error] [pid 2567:tid 2589] [client 20.215.255.154:31897] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adAbFmJJmfRsTrAKjdQGSQAAAM8"]
[Sat Apr 04 03:55:03.411854 2026] [:error] [pid 2457:tid 2492] [client 20.215.255.154:34698] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adAbF0mNHppaMd92Zpc0VAAAAA8"]
[Sat Apr 04 03:55:03.924130 2026] [:error] [pid 2567:tid 2595] [client 20.215.255.154:30080] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adAbF2JJmfRsTrAKjdQGTgAAANU"]
[Sat Apr 04 03:55:04.439925 2026] [:error] [pid 2459:tid 2531] [client 20.215.255.154:29006] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adAbGAefyCmu4LR_Plo69wAAAIA"]
[Sat Apr 04 03:55:04.957091 2026] [:error] [pid 2459:tid 2544] [client 20.215.255.154:30119] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAbGAefyCmu4LR_Plo6-AAAAIw"]
[Sat Apr 04 03:55:05.468229 2026] [:error] [pid 2567:tid 2593] [client 20.215.255.154:54837] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAbGWJJmfRsTrAKjdQGVAAAANM"]
[Sat Apr 04 03:55:05.979858 2026] [:error] [pid 2567:tid 2595] [client 20.215.255.154:53986] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAbGWJJmfRsTrAKjdQGVgAAANU"]
[Sat Apr 04 03:55:06.494281 2026] [:error] [pid 2567:tid 2590] [client 20.215.255.154:53952] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dczem.php"] [unique_id "adAbGmJJmfRsTrAKjdQGVwAAANA"]
[Sat Apr 04 03:55:07.006312 2026] [:error] [pid 2567:tid 2598] [client 20.215.255.154:33028] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adAbG2JJmfRsTrAKjdQGWwAAANg"]
[Sat Apr 04 03:55:07.519061 2026] [:error] [pid 2567:tid 2579] [client 20.215.255.154:54840] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adAbG2JJmfRsTrAKjdQGXgAAAMU"]
[Sat Apr 04 03:55:08.030759 2026] [:error] [pid 2567:tid 2596] [client 20.215.255.154:30110] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adAbHGJJmfRsTrAKjdQGXwAAANY"]
[Sat Apr 04 03:55:08.544337 2026] [:error] [pid 2567:tid 2598] [client 20.215.255.154:34742] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adAbHGJJmfRsTrAKjdQGYgAAANg"]
[Sat Apr 04 03:55:31.238726 2026] [:error] [pid 2457:tid 2491] [client 20.215.255.154:62987] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbM0mNHppaMd92Zpc0aAAAAA4"]
[Sat Apr 04 03:55:31.750769 2026] [:error] [pid 2457:tid 2500] [client 20.215.255.154:50477] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbM0mNHppaMd92Zpc0aQAAABc"]
[Sat Apr 04 03:55:32.264803 2026] [:error] [pid 2457:tid 2490] [client 20.215.255.154:28170] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbNEmNHppaMd92Zpc0awAAAA0"]
[Sat Apr 04 03:55:32.777018 2026] [:error] [pid 2459:tid 2540] [client 20.215.255.154:28176] [client 20.215.255.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adAbNAefyCmu4LR_Plo7JwAAAIg"]
[Sat Apr 04 04:06:57.460688 2026] [:error] [pid 2458:tid 2518] [client 216.24.210.162:36539] [client 216.24.210.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "adAd4SNozic5SuWqclm8uwAAAE4"]
[Sat Apr 04 04:24:36.401589 2026] [:error] [pid 2457:tid 2483] [client 119.114.231.125:25421] [client 119.114.231.125] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adAiBEmNHppaMd92ZpdBXwAAAAY"], referer: http://switchcreative.net/
[Sat Apr 04 07:51:43.918020 2026] [:error] [pid 2567:tid 2596] [client 175.6.217.4:34938] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adBSj2JJmfRsTrAKjdS1TwAAANY"]
[Sat Apr 04 10:46:30.232057 2026] [:error] [pid 2459:tid 2536] [client 54.37.252.118:51228] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adB7hgefyCmu4LR_Plre6gAAAIU"]
[Sat Apr 04 10:46:32.245075 2026] [:error] [pid 2459:tid 2554] [client 54.37.252.118:49358] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adB7iAefyCmu4LR_Plre9AAAAJY"]
[Sat Apr 04 10:46:34.071739 2026] [:error] [pid 2459:tid 2550] [client 54.37.252.118:49374] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adB7igefyCmu4LR_Plre-QAAAJI"]
[Sat Apr 04 10:46:35.883821 2026] [:error] [pid 2458:tid 2526] [client 54.37.252.118:48512] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adB7iyNozic5SuWqclk2KwAAAFY"]
[Sat Apr 04 10:46:37.905763 2026] [:error] [pid 2567:tid 2588] [client 54.37.252.118:48520] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adB7jWJJmfRsTrAKjdQyRgAAAM4"]
[Sat Apr 04 10:46:39.894177 2026] [:error] [pid 2567:tid 2576] [client 54.37.252.118:48524] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adB7j2JJmfRsTrAKjdQyUgAAAMI"]
[Sat Apr 04 10:46:42.029135 2026] [:error] [pid 2459:tid 2543] [client 54.37.252.118:48532] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adB7kgefyCmu4LR_PlrfBAAAAIs"]
[Sat Apr 04 10:46:44.039256 2026] [:error] [pid 2458:tid 2511] [client 54.37.252.118:48540] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adB7lCNozic5SuWqclk2MQAAAEc"]
[Sat Apr 04 10:46:45.779715 2026] [:error] [pid 2567:tid 2578] [client 54.37.252.118:49172] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adB7lWJJmfRsTrAKjdQycQAAAMQ"]
[Sat Apr 04 10:46:47.672147 2026] [:error] [pid 2459:tid 2549] [client 54.37.252.118:49188] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adB7lwefyCmu4LR_PlrfFQAAAJE"]
[Sat Apr 04 10:46:49.709495 2026] [:error] [pid 2459:tid 2551] [client 54.37.252.118:49204] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adB7mQefyCmu4LR_PlrfHwAAAJM"]
[Sat Apr 04 10:46:51.535092 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:49206] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adB7m2JJmfRsTrAKjdQynAAAANE"]
[Sat Apr 04 10:46:53.510902 2026] [:error] [pid 2458:tid 2505] [client 54.37.252.118:49216] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adB7nSNozic5SuWqclk2PwAAAEE"]
[Sat Apr 04 10:46:55.406101 2026] [:error] [pid 37114:tid 37134] [client 54.37.252.118:46066] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adB7n8-DnSj3fGMexeIRDQAAARI"]
[Sat Apr 04 10:46:57.420472 2026] [:error] [pid 2457:tid 2481] [client 54.37.252.118:46080] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adB7oUmNHppaMd92ZpeemwAAAAQ"]
[Sat Apr 04 10:46:59.201763 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:46092] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adB7o2JJmfRsTrAKjdQyrwAAANE"]
[Sat Apr 04 10:47:01.151462 2026] [:error] [pid 2567:tid 2587] [client 54.37.252.118:46108] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adB7pWJJmfRsTrAKjdQyuAAAAM0"]
[Sat Apr 04 10:47:03.065776 2026] [:error] [pid 37114:tid 37125] [client 54.37.252.118:46110] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adB7p8-DnSj3fGMexeIRJAAAAQk"]
[Sat Apr 04 10:47:04.959922 2026] [:error] [pid 2458:tid 2514] [client 54.37.252.118:50324] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adB7qCNozic5SuWqclk2UAAAAEo"]
[Sat Apr 04 10:47:06.988793 2026] [:error] [pid 37114:tid 37136] [client 54.37.252.118:50340] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adB7qs-DnSj3fGMexeIRLAAAARQ"]
[Sat Apr 04 10:47:08.898527 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:50342] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adB7rGJJmfRsTrAKjdQy0QAAANE"]
[Sat Apr 04 10:47:10.907812 2026] [:error] [pid 37114:tid 37122] [client 54.37.252.118:50352] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adB7rs-DnSj3fGMexeIRMwAAAQY"]
[Sat Apr 04 10:47:12.834607 2026] [:error] [pid 2459:tid 2533] [client 54.37.252.118:50368] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adB7sAefyCmu4LR_PlrfNAAAAII"]
[Sat Apr 04 10:47:14.930442 2026] [:error] [pid 2567:tid 2586] [client 54.37.252.118:58486] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adB7smJJmfRsTrAKjdQy6AAAAMw"]
[Sat Apr 04 10:47:16.874868 2026] [:error] [pid 2459:tid 2546] [client 54.37.252.118:58490] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adB7tAefyCmu4LR_PlrfOgAAAI4"]
[Sat Apr 04 10:47:18.692041 2026] [:error] [pid 37114:tid 37132] [client 54.37.252.118:58498] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adB7ts-DnSj3fGMexeIRQgAAARA"]
[Sat Apr 04 10:47:20.638160 2026] [:error] [pid 2567:tid 2575] [client 54.37.252.118:58500] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adB7uGJJmfRsTrAKjdQzDgAAAME"]
[Sat Apr 04 10:47:22.669883 2026] [:error] [pid 2459:tid 2533] [client 54.37.252.118:58514] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adB7ugefyCmu4LR_PlrfSwAAAII"]
[Sat Apr 04 10:47:24.775495 2026] [:error] [pid 2457:tid 2488] [client 54.37.252.118:52664] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adB7vEmNHppaMd92ZpeeugAAAAs"]
[Sat Apr 04 10:47:49.446026 2026] [:error] [pid 2567:tid 2575] [client 54.37.252.118:38744] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adB71WJJmfRsTrAKjdQzPgAAAME"]
[Sat Apr 04 10:47:51.139953 2026] [:error] [pid 2567:tid 2593] [client 54.37.252.118:41098] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adB712JJmfRsTrAKjdQzRAAAANM"]
[Sat Apr 04 10:47:53.620305 2026] [:error] [pid 2458:tid 2525] [client 54.37.252.118:38752] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adB72SNozic5SuWqclk2kAAAAFU"]
[Sat Apr 04 10:47:55.464824 2026] [:error] [pid 2459:tid 2535] [client 54.37.252.118:50948] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adB72wefyCmu4LR_PlrfdwAAAIQ"]
[Sat Apr 04 10:47:57.483036 2026] [:error] [pid 2458:tid 2508] [client 54.37.252.118:50960] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adB73SNozic5SuWqclk2kgAAAEQ"]
[Sat Apr 04 10:48:00.104603 2026] [:error] [pid 37114:tid 37127] [client 54.37.252.118:43244] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adB74M-DnSj3fGMexeIRjQAAAQs"]
[Sat Apr 04 10:48:02.060520 2026] [:error] [pid 2458:tid 2505] [client 54.37.252.118:50968] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adB74iNozic5SuWqclk2mgAAAEE"]
[Sat Apr 04 10:48:04.091947 2026] [:error] [pid 2567:tid 2598] [client 54.37.252.118:50984] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adB75GJJmfRsTrAKjdQzWgAAANg"]
[Sat Apr 04 10:48:05.979042 2026] [:error] [pid 2458:tid 2510] [client 54.37.252.118:58640] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adB75SNozic5SuWqclk2nQAAAEY"]
[Sat Apr 04 10:48:08.536967 2026] [:error] [pid 2459:tid 2534] [client 54.37.252.118:34630] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adB76AefyCmu4LR_PlrfkAAAAIM"]
[Sat Apr 04 10:48:10.644688 2026] [:error] [pid 2459:tid 2555] [client 54.37.252.118:58648] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adB76gefyCmu4LR_PlrfkwAAAJc"]
[Sat Apr 04 10:48:13.005930 2026] [:error] [pid 2457:tid 2481] [client 54.37.252.118:34646] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adB77UmNHppaMd92ZpefAgAAAAQ"]
[Sat Apr 04 10:48:15.013546 2026] [:error] [pid 2567:tid 2587] [client 54.37.252.118:40954] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adB772JJmfRsTrAKjdQzfwAAAM0"]
[Sat Apr 04 10:48:17.038943 2026] [:error] [pid 2458:tid 2508] [client 54.37.252.118:40956] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adB78SNozic5SuWqclk2pwAAAEQ"]
[Sat Apr 04 10:48:19.104474 2026] [:error] [pid 2457:tid 2480] [client 54.37.252.118:40962] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adB780mNHppaMd92ZpefDQAAAAM"]
[Sat Apr 04 10:48:21.073389 2026] [:error] [pid 2459:tid 2534] [client 54.37.252.118:40964] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adB79QefyCmu4LR_PlrfqQAAAIM"]
[Sat Apr 04 10:48:22.864984 2026] [:error] [pid 37114:tid 37136] [client 54.37.252.118:40966] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adB79s-DnSj3fGMexeIRogAAARQ"]
[Sat Apr 04 10:48:24.869043 2026] [:error] [pid 2457:tid 2480] [client 54.37.252.118:47686] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adB7-EmNHppaMd92ZpefFwAAAAM"]
[Sat Apr 04 10:48:27.524658 2026] [:error] [pid 2459:tid 2538] [client 54.37.252.118:52060] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adB7-wefyCmu4LR_PlrfrgAAAIY"]
[Sat Apr 04 10:48:29.476297 2026] [:error] [pid 37114:tid 37124] [client 54.37.252.118:47690] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adB7_c-DnSj3fGMexeIRsAAAAQg"]
[Sat Apr 04 10:48:31.982665 2026] [:error] [pid 2567:tid 2585] [client 54.37.252.118:52064] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adB7_2JJmfRsTrAKjdQzpwAAAMs"]
[Sat Apr 04 10:48:34.072622 2026] [:error] [pid 2459:tid 2550] [client 54.37.252.118:47698] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adB8AgefyCmu4LR_PlrfugAAAJI"]
[Sat Apr 04 10:48:35.934914 2026] [:error] [pid 2567:tid 2595] [client 54.37.252.118:50538] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adB8A2JJmfRsTrAKjdQzsAAAANU"]
[Sat Apr 04 10:48:38.422893 2026] [:error] [pid 37114:tid 37137] [client 54.37.252.118:56564] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adB8Bs-DnSj3fGMexeIRtgAAARU"]
[Sat Apr 04 10:48:40.266657 2026] [:error] [pid 2458:tid 2505] [client 54.37.252.118:50550] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adB8CCNozic5SuWqclk2yAAAAEE"]
[Sat Apr 04 10:48:42.158589 2026] [:error] [pid 2458:tid 2510] [client 54.37.252.118:50556] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adB8CiNozic5SuWqclk2zQAAAEY"]
[Sat Apr 04 10:48:44.105279 2026] [:error] [pid 2567:tid 2598] [client 54.37.252.118:50572] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adB8DGJJmfRsTrAKjdQzyAAAANg"]
[Sat Apr 04 10:48:46.381564 2026] [:error] [pid 2459:tid 2542] [client 54.37.252.118:40074] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adB8DgefyCmu4LR_Plrf2QAAAIo"]
[Sat Apr 04 10:49:09.272134 2026] [:error] [pid 2567:tid 2590] [client 54.37.252.118:40082] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adB8JWJJmfRsTrAKjdQ0HAAAANA"]
[Sat Apr 04 10:49:11.274532 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:37192] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adB8J2JJmfRsTrAKjdQ0HwAAANE"]
[Sat Apr 04 10:49:13.219747 2026] [:error] [pid 2457:tid 2497] [client 54.37.252.118:37200] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adB8KUmNHppaMd92ZpefSQAAABQ"]
[Sat Apr 04 10:49:15.188930 2026] [:error] [pid 2459:tid 2541] [client 54.37.252.118:49440] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adB8KwefyCmu4LR_Plrf_AAAAIk"]
[Sat Apr 04 10:49:17.149192 2026] [:error] [pid 2567:tid 2587] [client 54.37.252.118:49448] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adB8LWJJmfRsTrAKjdQ0LgAAAM0"]
[Sat Apr 04 10:49:19.036601 2026] [:error] [pid 2459:tid 2553] [client 54.37.252.118:49458] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adB8LwefyCmu4LR_PlrgAwAAAJU"]
[Sat Apr 04 10:49:21.079705 2026] [:error] [pid 2567:tid 2576] [client 54.37.252.118:49460] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adB8MWJJmfRsTrAKjdQ0RQAAAMI"]
[Sat Apr 04 10:49:23.108930 2026] [:error] [pid 2459:tid 2556] [client 54.37.252.118:49462] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adB8MwefyCmu4LR_PlrgCgAAAJg"]
[Sat Apr 04 10:49:25.149527 2026] [:error] [pid 2459:tid 2556] [client 54.37.252.118:42666] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adB8NQefyCmu4LR_PlrgFgAAAJg"]
[Sat Apr 04 10:49:27.088012 2026] [:error] [pid 2459:tid 2551] [client 54.37.252.118:42668] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adB8NwefyCmu4LR_PlrgHQAAAJM"]
[Sat Apr 04 10:49:29.117648 2026] [:error] [pid 2458:tid 2516] [client 54.37.252.118:42674] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "adB8OSNozic5SuWqclk2_QAAAEw"]
[Sat Apr 04 10:49:31.130782 2026] [:error] [pid 37114:tid 37139] [client 54.37.252.118:42688] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adB8O8-DnSj3fGMexeISGQAAARc"]
[Sat Apr 04 10:49:33.151943 2026] [:error] [pid 37114:tid 37118] [client 54.37.252.118:42702] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adB8Pc-DnSj3fGMexeISIgAAAQI"]
[Sat Apr 04 10:49:35.020409 2026] [:error] [pid 37114:tid 37124] [client 54.37.252.118:53906] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adB8P8-DnSj3fGMexeISLAAAAQg"]
[Sat Apr 04 10:49:37.090204 2026] [:error] [pid 2567:tid 2583] [client 54.37.252.118:53910] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adB8QWJJmfRsTrAKjdQ0XAAAAMk"]
[Sat Apr 04 10:49:39.003458 2026] [:error] [pid 37114:tid 37138] [client 54.37.252.118:53926] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adB8Q8-DnSj3fGMexeISNwAAARY"]
[Sat Apr 04 10:49:40.917020 2026] [:error] [pid 2459:tid 2540] [client 54.37.252.118:53940] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adB8RAefyCmu4LR_PlrgNgAAAIg"]
[Sat Apr 04 10:49:42.827740 2026] [:error] [pid 2457:tid 2490] [client 54.37.252.118:53950] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adB8RkmNHppaMd92ZpefZgAAAA0"]
[Sat Apr 04 10:49:44.792297 2026] [:error] [pid 2458:tid 2509] [client 54.37.252.118:39532] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adB8SCNozic5SuWqclk3DAAAAEU"]
[Sat Apr 04 10:49:46.664218 2026] [:error] [pid 2458:tid 2520] [client 54.37.252.118:39540] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adB8SiNozic5SuWqclk3DwAAAFA"]
[Sat Apr 04 10:49:48.585711 2026] [:error] [pid 2458:tid 2517] [client 54.37.252.118:39556] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adB8TCNozic5SuWqclk3FwAAAE0"]
[Sat Apr 04 10:49:50.745556 2026] [:error] [pid 2459:tid 2553] [client 54.37.252.118:39572] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adB8TgefyCmu4LR_PlrgVQAAAJU"]
[Sat Apr 04 10:49:52.837580 2026] [:error] [pid 37114:tid 37134] [client 54.37.252.118:39586] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adB8UM-DnSj3fGMexeISVQAAARI"]
[Sat Apr 04 10:49:54.908321 2026] [:error] [pid 2457:tid 2479] [client 54.37.252.118:41228] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adB8UkmNHppaMd92ZpefeAAAAAI"]
[Sat Apr 04 10:49:56.844148 2026] [:error] [pid 2457:tid 2487] [client 54.37.252.118:41240] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adB8VEmNHppaMd92ZpefegAAAAo"]
[Sat Apr 04 10:49:58.748885 2026] [:error] [pid 2459:tid 2534] [client 54.37.252.118:41248] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adB8VgefyCmu4LR_PlrgaAAAAIM"]
[Sat Apr 04 10:50:00.751655 2026] [:error] [pid 2567:tid 2579] [client 54.37.252.118:41254] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adB8WGJJmfRsTrAKjdQ0fQAAAMU"]
[Sat Apr 04 10:50:02.821427 2026] [:error] [pid 2458:tid 2524] [client 54.37.252.118:41266] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adB8WiNozic5SuWqclk3JwAAAFQ"]
[Sat Apr 04 10:50:04.737799 2026] [:error] [pid 37114:tid 37124] [client 54.37.252.118:38938] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adB8XM-DnSj3fGMexeISdAAAAQg"]
[Sat Apr 04 10:50:06.560880 2026] [:error] [pid 2458:tid 2509] [client 54.37.252.118:38948] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adB8XiNozic5SuWqclk3KwAAAEU"]
[Sat Apr 04 10:50:27.499346 2026] [:error] [pid 37114:tid 37132] [client 54.37.252.118:38960] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adB8c8-DnSj3fGMexeISlwAAARA"]
[Sat Apr 04 10:50:29.453431 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:47320] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adB8dWJJmfRsTrAKjdQ0uwAAANE"]
[Sat Apr 04 10:50:31.510788 2026] [:error] [pid 37114:tid 37131] [client 54.37.252.118:47328] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adB8d8-DnSj3fGMexeISnAAAAQ8"]
[Sat Apr 04 10:50:33.583591 2026] [:error] [pid 2567:tid 2591] [client 54.37.252.118:47332] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adB8eWJJmfRsTrAKjdQ0zgAAANE"]
[Sat Apr 04 10:50:35.517634 2026] [:error] [pid 2459:tid 2556] [client 54.37.252.118:58580] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adB8ewefyCmu4LR_PlrglgAAAJg"]
[Sat Apr 04 10:50:37.393319 2026] [:error] [pid 37114:tid 37137] [client 54.37.252.118:58582] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adB8fc-DnSj3fGMexeISqQAAARU"]
[Sat Apr 04 10:50:39.340276 2026] [:error] [pid 2567:tid 2587] [client 54.37.252.118:58588] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adB8f2JJmfRsTrAKjdQ02gAAAM0"]
[Sat Apr 04 10:50:41.288044 2026] [:error] [pid 2567:tid 2585] [client 54.37.252.118:58604] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adB8gWJJmfRsTrAKjdQ04AAAAMs"]
[Sat Apr 04 10:50:43.233857 2026] [:error] [pid 37114:tid 37118] [client 54.37.252.118:58610] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adB8g8-DnSj3fGMexeISsQAAAQI"]
[Sat Apr 04 10:50:45.022638 2026] [:error] [pid 2458:tid 2519] [client 54.37.252.118:48378] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adB8hSNozic5SuWqclk3YAAAAE8"]
[Sat Apr 04 10:50:47.072999 2026] [:error] [pid 2459:tid 2543] [client 54.37.252.118:48386] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adB8hwefyCmu4LR_PlrgswAAAIs"]
[Sat Apr 04 10:50:48.975955 2026] [:error] [pid 2567:tid 2595] [client 54.37.252.118:48392] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adB8iGJJmfRsTrAKjdQ06wAAANU"]
[Sat Apr 04 10:50:50.906861 2026] [:error] [pid 2567:tid 2596] [client 54.37.252.118:48394] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adB8imJJmfRsTrAKjdQ08wAAANY"]
[Sat Apr 04 10:50:52.825007 2026] [:error] [pid 37114:tid 37134] [client 54.37.252.118:48396] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adB8jM-DnSj3fGMexeISxgAAARI"]
[Sat Apr 04 10:50:54.850455 2026] [:error] [pid 2457:tid 2481] [client 54.37.252.118:48532] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adB8jkmNHppaMd92ZpefnAAAAAQ"]
[Sat Apr 04 10:50:56.854974 2026] [:error] [pid 2457:tid 2482] [client 54.37.252.118:48544] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adB8kEmNHppaMd92ZpefogAAAAU"]
[Sat Apr 04 10:50:58.865077 2026] [:error] [pid 37114:tid 37140] [client 54.37.252.118:48548] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adB8ks-DnSj3fGMexeIS0QAAARg"]
[Sat Apr 04 10:51:00.916199 2026] [:error] [pid 37114:tid 37128] [client 54.37.252.118:48550] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adB8lM-DnSj3fGMexeIS2gAAAQw"]
[Sat Apr 04 10:51:02.955453 2026] [:error] [pid 2458:tid 2525] [client 54.37.252.118:48564] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adB8liNozic5SuWqclk3eQAAAFU"]
[Sat Apr 04 10:51:04.831547 2026] [:error] [pid 2457:tid 2477] [client 54.37.252.118:56312] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adB8mEmNHppaMd92ZpefpgAAAAA"]
[Sat Apr 04 10:51:06.889129 2026] [:error] [pid 37114:tid 37137] [client 54.37.252.118:56322] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adB8ms-DnSj3fGMexeIS6AAAARU"]
[Sat Apr 04 10:51:08.791094 2026] [:error] [pid 2567:tid 2578] [client 54.37.252.118:56330] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adB8nGJJmfRsTrAKjdQ1FQAAAMQ"]
[Sat Apr 04 10:51:10.893917 2026] [:error] [pid 2567:tid 2595] [client 54.37.252.118:56340] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adB8nmJJmfRsTrAKjdQ1IQAAANU"]
[Sat Apr 04 10:51:13.028450 2026] [:error] [pid 2458:tid 2513] [client 54.37.252.118:56346] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adB8oSNozic5SuWqclk3fQAAAEk"]
[Sat Apr 04 10:51:14.884744 2026] [:error] [pid 2459:tid 2549] [client 54.37.252.118:52786] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adB8ogefyCmu4LR_Plrg2gAAAJE"]
[Sat Apr 04 10:51:16.873060 2026] [:error] [pid 2567:tid 2581] [client 54.37.252.118:52800] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adB8pGJJmfRsTrAKjdQ1MgAAAMc"]
[Sat Apr 04 10:51:18.974070 2026] [:error] [pid 2458:tid 2505] [client 54.37.252.118:52810] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adB8piNozic5SuWqclk3ggAAAEE"]
[Sat Apr 04 10:51:20.830549 2026] [:error] [pid 37114:tid 37128] [client 54.37.252.118:52818] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adB8qM-DnSj3fGMexeITBQAAAQw"]
[Sat Apr 04 10:51:22.785688 2026] [:error] [pid 2459:tid 2533] [client 54.37.252.118:52820] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adB8qgefyCmu4LR_Plrg5AAAAII"]
[Sat Apr 04 10:51:24.558334 2026] [:error] [pid 2567:tid 2584] [client 54.37.252.118:51362] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adB8rGJJmfRsTrAKjdQ1QgAAAMo"]
[Sat Apr 04 12:26:06.499554 2026] [:error] [pid 2567:tid 2583] [client 147.135.213.107:58090] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adCS3mJJmfRsTrAKjdRwzwAAAMk"]
[Sat Apr 04 12:26:08.244142 2026] [:error] [pid 2459:tid 2548] [client 147.135.213.107:53868] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adCS4AefyCmu4LR_PloEhAAAAJA"]
[Sat Apr 04 12:26:10.092868 2026] [:error] [pid 2458:tid 2524] [client 147.135.213.107:35486] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adCS4iNozic5SuWqcllS2wAAAFQ"]
[Sat Apr 04 12:26:12.654940 2026] [:error] [pid 2567:tid 2597] [client 147.135.213.107:33420] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adCS5GJJmfRsTrAKjdRw2AAAANc"]
[Sat Apr 04 12:26:15.061179 2026] [:error] [pid 2457:tid 2482] [client 147.135.213.107:33424] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adCS50mNHppaMd92Zpe3kgAAAAU"]
[Sat Apr 04 12:26:17.105683 2026] [:error] [pid 37114:tid 37122] [client 147.135.213.107:59640] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adCS6c-DnSj3fGMexeJFnQAAAQY"]
[Sat Apr 04 12:26:18.987498 2026] [:error] [pid 37114:tid 37137] [client 147.135.213.107:59642] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adCS6s-DnSj3fGMexeJFqAAAARU"]
[Sat Apr 04 12:26:21.510140 2026] [:error] [pid 2567:tid 2576] [client 147.135.213.107:40546] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adCS7WJJmfRsTrAKjdRw5wAAAMI"]
[Sat Apr 04 12:26:23.529658 2026] [:error] [pid 2457:tid 2486] [client 147.135.213.107:42374] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adCS70mNHppaMd92Zpe3lAAAAAk"]
[Sat Apr 04 12:26:25.413908 2026] [:error] [pid 2459:tid 2540] [client 147.135.213.107:42388] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adCS8QefyCmu4LR_PloEmwAAAIg"]
[Sat Apr 04 12:26:27.795698 2026] [:error] [pid 2457:tid 2488] [client 147.135.213.107:40562] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adCS80mNHppaMd92Zpe3pAAAAAs"]
[Sat Apr 04 12:26:29.629731 2026] [:error] [pid 2457:tid 2499] [client 147.135.213.107:42390] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adCS9UmNHppaMd92Zpe3qgAAABY"]
[Sat Apr 04 12:26:31.508925 2026] [:error] [pid 2459:tid 2536] [client 147.135.213.107:43320] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adCS9wefyCmu4LR_PloEpwAAAIU"]
[Sat Apr 04 12:26:33.534792 2026] [:error] [pid 2457:tid 2491] [client 147.135.213.107:43322] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adCS-UmNHppaMd92Zpe3rQAAAA4"]
[Sat Apr 04 12:26:35.544714 2026] [:error] [pid 2567:tid 2580] [client 147.135.213.107:43334] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adCS-2JJmfRsTrAKjdRw8wAAAMY"]
[Sat Apr 04 12:26:37.544448 2026] [:error] [pid 2567:tid 2578] [client 147.135.213.107:43344] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adCS_WJJmfRsTrAKjdRw9QAAAMQ"]
[Sat Apr 04 12:26:39.566171 2026] [:error] [pid 37114:tid 37136] [client 147.135.213.107:43352] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adCS_8-DnSj3fGMexeJFywAAARQ"]
[Sat Apr 04 12:26:42.068633 2026] [:error] [pid 37114:tid 37123] [client 147.135.213.107:48162] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adCTAs-DnSj3fGMexeJF1QAAAQc"]
[Sat Apr 04 12:26:44.533148 2026] [:error] [pid 2458:tid 2527] [client 147.135.213.107:48174] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "adCTBCNozic5SuWqcllTCwAAAFc"]
[Sat Apr 04 12:26:46.833706 2026] [:error] [pid 2567:tid 2594] [client 147.135.213.107:48190] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adCTBmJJmfRsTrAKjdRxDAAAANQ"]
[Sat Apr 04 12:26:48.658680 2026] [:error] [pid 37114:tid 37139] [client 147.135.213.107:56838] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adCTCM-DnSj3fGMexeJF4AAAARc"]
[Sat Apr 04 12:26:51.163938 2026] [:error] [pid 2459:tid 2555] [client 147.135.213.107:50370] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adCTCwefyCmu4LR_PloEwQAAAJc"]
[Sat Apr 04 12:26:53.639754 2026] [:error] [pid 2457:tid 2485] [client 147.135.213.107:50374] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adCTDUmNHppaMd92Zpe3wgAAAAg"]
[Sat Apr 04 12:26:55.454445 2026] [:error] [pid 37114:tid 37140] [client 147.135.213.107:51032] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adCTD8-DnSj3fGMexeJF5gAAARg"]
[Sat Apr 04 12:26:57.949911 2026] [:error] [pid 37114:tid 37116] [client 147.135.213.107:50386] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adCTEc-DnSj3fGMexeJF7QAAAQA"]
[Sat Apr 04 12:27:00.250604 2026] [:error] [pid 2567:tid 2583] [client 147.135.213.107:50402] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adCTFGJJmfRsTrAKjdRxJAAAAMk"]
[Sat Apr 04 12:27:02.089504 2026] [:error] [pid 37114:tid 37139] [client 147.135.213.107:49380] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adCTFs-DnSj3fGMexeJF-gAAARc"]
[Sat Apr 04 12:27:23.256719 2026] [:error] [pid 2459:tid 2533] [client 147.135.213.107:49394] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adCTKwefyCmu4LR_PloFHQAAAII"]
[Sat Apr 04 12:27:24.955124 2026] [:error] [pid 2459:tid 2551] [client 147.135.213.107:60912] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adCTLAefyCmu4LR_PloFHwAAAJM"]
[Sat Apr 04 12:27:27.361773 2026] [:error] [pid 37114:tid 37137] [client 147.135.213.107:37154] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adCTL8-DnSj3fGMexeJGEgAAARU"]
[Sat Apr 04 12:27:29.811761 2026] [:error] [pid 2459:tid 2546] [client 147.135.213.107:37166] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adCTMQefyCmu4LR_PloFKAAAAI4"]
[Sat Apr 04 12:27:32.286365 2026] [:error] [pid 37114:tid 37120] [client 147.135.213.107:44852] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adCTNM-DnSj3fGMexeJGIAAAAQQ"]
[Sat Apr 04 12:27:34.595118 2026] [:error] [pid 37114:tid 37122] [client 147.135.213.107:44854] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adCTNs-DnSj3fGMexeJGKwAAAQY"]
[Sat Apr 04 12:27:36.422588 2026] [:error] [pid 2459:tid 2538] [client 147.135.213.107:41532] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adCTOAefyCmu4LR_PloFLQAAAIY"]
[Sat Apr 04 12:27:38.898442 2026] [:error] [pid 2567:tid 2578] [client 147.135.213.107:44868] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adCTOmJJmfRsTrAKjdRxdAAAAMQ"]
[Sat Apr 04 12:27:40.738842 2026] [:error] [pid 37114:tid 37131] [client 147.135.213.107:58898] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adCTPM-DnSj3fGMexeJGRAAAAQ8"]
[Sat Apr 04 12:27:43.215900 2026] [:error] [pid 2567:tid 2579] [client 147.135.213.107:56690] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adCTP2JJmfRsTrAKjdRxegAAAMU"]
[Sat Apr 04 12:27:45.681408 2026] [:error] [pid 2567:tid 2574] [client 147.135.213.107:56706] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adCTQWJJmfRsTrAKjdRxgQAAAMA"]
[Sat Apr 04 12:27:48.130659 2026] [:error] [pid 2567:tid 2582] [client 147.135.213.107:56708] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adCTRGJJmfRsTrAKjdRxjAAAAMg"]
[Sat Apr 04 12:27:50.109970 2026] [:error] [pid 37114:tid 37126] [client 147.135.213.107:58900] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adCTRs-DnSj3fGMexeJGXQAAAQo"]
[Sat Apr 04 12:27:52.107178 2026] [:error] [pid 2457:tid 2484] [client 147.135.213.107:55378] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adCTSEmNHppaMd92Zpe39AAAAAc"]
[Sat Apr 04 12:27:53.949632 2026] [:error] [pid 2458:tid 2509] [client 147.135.213.107:55384] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adCTSSNozic5SuWqcllTQAAAAEU"]
[Sat Apr 04 12:27:56.430721 2026] [:error] [pid 2567:tid 2593] [client 147.135.213.107:56378] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adCTTGJJmfRsTrAKjdRxoAAAANM"]
[Sat Apr 04 12:27:58.236524 2026] [:error] [pid 37114:tid 37116] [client 147.135.213.107:55394] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adCTTs-DnSj3fGMexeJGeAAAAQA"]
[Sat Apr 04 12:28:00.233192 2026] [:error] [pid 2567:tid 2581] [client 147.135.213.107:55396] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adCTUGJJmfRsTrAKjdRxpQAAAMc"]
[Sat Apr 04 12:28:02.229007 2026] [:error] [pid 37114:tid 37135] [client 147.135.213.107:58838] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adCTUs-DnSj3fGMexeJGhwAAARM"]
[Sat Apr 04 12:28:04.220863 2026] [:error] [pid 37114:tid 37136] [client 147.135.213.107:58852] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adCTVM-DnSj3fGMexeJGkwAAARQ"]
[Sat Apr 04 12:28:06.224038 2026] [:error] [pid 37114:tid 37124] [client 147.135.213.107:58860] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adCTVs-DnSj3fGMexeJGuwAAAQg"]
[Sat Apr 04 12:28:08.080886 2026] [:error] [pid 37114:tid 37126] [client 147.135.213.107:58870] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adCTWM-DnSj3fGMexeJG5gAAAQo"]
[Sat Apr 04 12:28:10.053168 2026] [:error] [pid 37114:tid 37136] [client 147.135.213.107:58882] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adCTWs-DnSj3fGMexeJHBwAAARQ"]
[Sat Apr 04 12:28:12.039590 2026] [:error] [pid 2567:tid 2577] [client 147.135.213.107:60864] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adCTXGJJmfRsTrAKjdRxwgAAAMM"]
[Sat Apr 04 12:28:14.033702 2026] [:error] [pid 2457:tid 2482] [client 147.135.213.107:60880] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adCTXkmNHppaMd92Zpe4AQAAAAU"]
[Sat Apr 04 12:28:16.507748 2026] [:error] [pid 37114:tid 37134] [client 147.135.213.107:53382] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adCTYM-DnSj3fGMexeJHDwAAARI"]
[Sat Apr 04 12:28:18.463917 2026] [:error] [pid 2567:tid 2595] [client 147.135.213.107:60894] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adCTYmJJmfRsTrAKjdRxywAAANU"]
[Sat Apr 04 12:28:20.445414 2026] [:error] [pid 2567:tid 2594] [client 147.135.213.107:60898] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adCTZGJJmfRsTrAKjdRx0QAAANQ"]
[Sat Apr 04 12:41:27.265003 2026] [:error] [pid 37114:tid 37121] [client 51.75.119.75:33654] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adCWd8-DnSj3fGMexeJOywAAAQU"]
[Sat Apr 04 12:41:28.793359 2026] [:error] [pid 2458:tid 2516] [client 51.75.119.75:50768] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adCWeCNozic5SuWqcllWnQAAAEw"]
[Sat Apr 04 12:41:31.236840 2026] [:error] [pid 2457:tid 2483] [client 51.75.119.75:60946] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adCWe0mNHppaMd92Zpe61wAAAAY"]
[Sat Apr 04 12:41:33.222530 2026] [:error] [pid 37114:tid 37139] [client 51.75.119.75:34448] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adCWfc-DnSj3fGMexeJO1AAAARc"]
[Sat Apr 04 12:41:35.696996 2026] [:error] [pid 2459:tid 2543] [client 51.75.119.75:35224] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adCWfwefyCmu4LR_PloKJAAAAIs"]
[Sat Apr 04 12:41:37.658627 2026] [:error] [pid 2567:tid 2594] [client 51.75.119.75:36474] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adCWgWJJmfRsTrAKjdR4XgAAANQ"]
[Sat Apr 04 12:41:40.147485 2026] [:error] [pid 37114:tid 37137] [client 51.75.119.75:35240] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adCWhM-DnSj3fGMexeJO5QAAARU"]
[Sat Apr 04 12:41:41.961972 2026] [:error] [pid 2457:tid 2492] [client 51.75.119.75:36476] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adCWhUmNHppaMd92Zpe65AAAAA8"]
[Sat Apr 04 12:41:44.428791 2026] [:error] [pid 2459:tid 2552] [client 51.75.119.75:44308] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adCWiAefyCmu4LR_PloKMAAAAJQ"]
[Sat Apr 04 12:41:46.906997 2026] [:error] [pid 2458:tid 2511] [client 51.75.119.75:44322] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adCWiiNozic5SuWqcllWpgAAAEc"]
[Sat Apr 04 12:41:49.383362 2026] [:error] [pid 2457:tid 2481] [client 51.75.119.75:44338] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adCWjUmNHppaMd92Zpe68gAAAAQ"]
[Sat Apr 04 12:41:51.336742 2026] [:error] [pid 37114:tid 37132] [client 51.75.119.75:58946] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adCWj8-DnSj3fGMexeJO_QAAARA"]
[Sat Apr 04 12:41:53.692821 2026] [:error] [pid 37114:tid 37129] [client 51.75.119.75:44350] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adCWkc-DnSj3fGMexeJPBwAAAQ0"]
[Sat Apr 04 12:41:56.024909 2026] [:error] [pid 2567:tid 2588] [client 51.75.119.75:47416] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adCWlGJJmfRsTrAKjdR4eQAAAM4"]
[Sat Apr 04 12:41:57.842081 2026] [:error] [pid 2459:tid 2539] [client 51.75.119.75:57062] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adCWlQefyCmu4LR_PloKRQAAAIc"]
[Sat Apr 04 12:42:00.341330 2026] [:error] [pid 2567:tid 2598] [client 51.75.119.75:47426] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adCWmGJJmfRsTrAKjdR4fgAAANg"]
[Sat Apr 04 12:42:02.316030 2026] [:error] [pid 2459:tid 2547] [client 51.75.119.75:57074] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adCWmgefyCmu4LR_PloKXQAAAI8"]
[Sat Apr 04 12:42:04.796758 2026] [:error] [pid 37114:tid 37139] [client 51.75.119.75:38372] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adCWnM-DnSj3fGMexeJPGgAAARc"]
[Sat Apr 04 12:42:07.248627 2026] [:error] [pid 2567:tid 2592] [client 51.75.119.75:38382] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adCWn2JJmfRsTrAKjdR4ngAAANI"]
[Sat Apr 04 12:42:09.722209 2026] [:error] [pid 2459:tid 2545] [client 51.75.119.75:38390] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adCWoQefyCmu4LR_PloKbwAAAI0"]
[Sat Apr 04 12:42:12.183852 2026] [:error] [pid 37114:tid 37127] [client 51.75.119.75:38394] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adCWpM-DnSj3fGMexeJPKgAAAQs"]
[Sat Apr 04 12:42:14.621317 2026] [:error] [pid 2567:tid 2574] [client 51.75.119.75:49284] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adCWpmJJmfRsTrAKjdR4rgAAAMA"]
[Sat Apr 04 12:42:17.078932 2026] [:error] [pid 37114:tid 37125] [client 51.75.119.75:49286] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adCWqc-DnSj3fGMexeJPOAAAAQk"]
[Sat Apr 04 12:42:19.524989 2026] [:error] [pid 2567:tid 2583] [client 51.75.119.75:49288] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adCWq2JJmfRsTrAKjdR4uwAAAMk"]
[Sat Apr 04 12:42:21.999553 2026] [:error] [pid 2567:tid 2586] [client 51.75.119.75:49302] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adCWrWJJmfRsTrAKjdR4wgAAAMw"]
[Sat Apr 04 12:42:24.280962 2026] [:error] [pid 2457:tid 2478] [client 51.75.119.75:43310] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adCWsEmNHppaMd92Zpe7FQAAAAE"]
[Sat Apr 04 12:42:44.399305 2026] [:error] [pid 37114:tid 37124] [client 51.75.119.75:42496] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adCWxM-DnSj3fGMexeJPfwAAAQg"]
[Sat Apr 04 12:42:46.342375 2026] [:error] [pid 2459:tid 2543] [client 51.75.119.75:57166] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adCWxgefyCmu4LR_PloKiAAAAIs"]
[Sat Apr 04 12:42:48.160511 2026] [:error] [pid 2459:tid 2554] [client 51.75.119.75:57178] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adCWyAefyCmu4LR_PloKjQAAAJY"]
[Sat Apr 04 12:42:50.180279 2026] [:error] [pid 2459:tid 2536] [client 51.75.119.75:57184] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adCWygefyCmu4LR_PloKmQAAAIU"]
[Sat Apr 04 12:42:52.170041 2026] [:error] [pid 37114:tid 37123] [client 51.75.119.75:57188] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adCWzM-DnSj3fGMexeJPkwAAAQc"]
[Sat Apr 04 12:42:54.154142 2026] [:error] [pid 37114:tid 37138] [client 51.75.119.75:44718] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adCWzs-DnSj3fGMexeJPmQAAARY"]
[Sat Apr 04 12:42:56.142761 2026] [:error] [pid 2459:tid 2543] [client 51.75.119.75:44730] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adCW0AefyCmu4LR_PloKnwAAAIs"]
[Sat Apr 04 12:42:58.117502 2026] [:error] [pid 37114:tid 37134] [client 51.75.119.75:44744] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adCW0s-DnSj3fGMexeJPpwAAARI"]
[Sat Apr 04 12:43:00.095868 2026] [:error] [pid 37114:tid 37134] [client 51.75.119.75:44758] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adCW1M-DnSj3fGMexeJPsQAAARI"]
[Sat Apr 04 12:43:02.063143 2026] [:error] [pid 2459:tid 2533] [client 51.75.119.75:44760] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adCW1gefyCmu4LR_PloKqQAAAII"]
[Sat Apr 04 12:43:04.090117 2026] [:error] [pid 2458:tid 2521] [client 51.75.119.75:52874] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adCW2CNozic5SuWqcllW6QAAAFE"]
[Sat Apr 04 12:43:06.109655 2026] [:error] [pid 2457:tid 2487] [client 51.75.119.75:52888] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adCW2kmNHppaMd92Zpe7SgAAAAo"]
[Sat Apr 04 12:43:08.101695 2026] [:error] [pid 2458:tid 2512] [client 51.75.119.75:52898] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adCW3CNozic5SuWqcllW7wAAAEg"]
[Sat Apr 04 12:43:09.941289 2026] [:error] [pid 2458:tid 2505] [client 51.75.119.75:52912] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adCW3SNozic5SuWqcllW-AAAAEE"]
[Sat Apr 04 12:43:11.959471 2026] [:error] [pid 37114:tid 37125] [client 51.75.119.75:52926] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adCW38-DnSj3fGMexeJPvgAAAQk"]
[Sat Apr 04 12:43:13.949259 2026] [:error] [pid 37114:tid 37129] [client 51.75.119.75:33208] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adCW4c-DnSj3fGMexeJPxgAAAQ0"]
[Sat Apr 04 12:43:15.950982 2026] [:error] [pid 2457:tid 2480] [client 51.75.119.75:33210] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adCW40mNHppaMd92Zpe7XwAAAAM"]
[Sat Apr 04 12:43:17.964401 2026] [:error] [pid 2458:tid 2518] [client 51.75.119.75:33224] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adCW5SNozic5SuWqcllW_wAAAE4"]
[Sat Apr 04 12:43:19.961897 2026] [:error] [pid 37114:tid 37126] [client 51.75.119.75:33226] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adCW58-DnSj3fGMexeJP0AAAAQo"]
[Sat Apr 04 12:43:21.974049 2026] [:error] [pid 37114:tid 37122] [client 51.75.119.75:33232] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adCW6c-DnSj3fGMexeJP0wAAAQY"]
[Sat Apr 04 12:43:23.836738 2026] [:error] [pid 2458:tid 2513] [client 51.75.119.75:49226] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adCW6yNozic5SuWqcllXDAAAAEk"]
[Sat Apr 04 12:43:25.848552 2026] [:error] [pid 2459:tid 2556] [client 51.75.119.75:49238] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adCW7QefyCmu4LR_PloKvQAAAJg"]
[Sat Apr 04 12:43:27.849435 2026] [:error] [pid 2458:tid 2514] [client 51.75.119.75:49240] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adCW7yNozic5SuWqcllXEwAAAEo"]
[Sat Apr 04 12:43:29.688656 2026] [:error] [pid 37114:tid 37129] [client 51.75.119.75:49256] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adCW8c-DnSj3fGMexeJP2wAAAQ0"]
[Sat Apr 04 12:43:31.691631 2026] [:error] [pid 37114:tid 37137] [client 51.75.119.75:49272] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adCW88-DnSj3fGMexeJP4AAAARU"]
[Sat Apr 04 12:43:33.687273 2026] [:error] [pid 2459:tid 2552] [client 51.75.119.75:49274] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adCW9QefyCmu4LR_PloKxwAAAJQ"]
[Sat Apr 04 12:43:35.703295 2026] [:error] [pid 2567:tid 2585] [client 51.75.119.75:42452] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adCW92JJmfRsTrAKjdR5MgAAAMs"]
[Sat Apr 04 12:43:37.716062 2026] [:error] [pid 2458:tid 2508] [client 51.75.119.75:42464] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adCW-SNozic5SuWqcllXGwAAAEQ"]
[Sat Apr 04 12:43:39.709116 2026] [:error] [pid 2458:tid 2526] [client 51.75.119.75:42478] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adCW-yNozic5SuWqcllXIQAAAFY"]
[Sat Apr 04 12:43:41.700405 2026] [:error] [pid 37114:tid 37137] [client 51.75.119.75:42494] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adCW_c-DnSj3fGMexeJP5wAAARU"]
[Sat Apr 04 14:27:05.563737 2026] [:error] [pid 37114:tid 37137] [client 141.94.101.142:56438] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adCvOc-DnSj3fGMexeKYJwAAARU"]
[Sat Apr 04 14:27:07.937719 2026] [:error] [pid 37114:tid 37131] [client 141.94.101.142:35528] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adCvO8-DnSj3fGMexeKYQwAAAQ8"]
[Sat Apr 04 14:27:10.300195 2026] [:error] [pid 2458:tid 2516] [client 141.94.101.142:36738] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adCvPiNozic5SuWqcll0RAAAAEw"]
[Sat Apr 04 14:27:12.773163 2026] [:error] [pid 2457:tid 2482] [client 141.94.101.142:36744] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adCvQEmNHppaMd92ZpfTxgAAAAU"]
[Sat Apr 04 14:27:15.360939 2026] [:error] [pid 37114:tid 37125] [client 141.94.101.142:36748] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adCvQ8-DnSj3fGMexeKYYwAAAQk"]
[Sat Apr 04 14:27:17.773752 2026] [:error] [pid 2459:tid 2553] [client 141.94.101.142:36750] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adCvRQefyCmu4LR_PloxOgAAAJU"]
[Sat Apr 04 14:27:20.279154 2026] [:error] [pid 2458:tid 2519] [client 141.94.101.142:59496] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adCvSCNozic5SuWqcll0TgAAAE8"]
[Sat Apr 04 14:27:22.985371 2026] [:error] [pid 37114:tid 37138] [client 141.94.101.142:59502] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adCvSs-DnSj3fGMexeKYdQAAARY"]
[Sat Apr 04 14:27:25.544363 2026] [:error] [pid 2457:tid 2479] [client 141.94.101.142:59504] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adCvTUmNHppaMd92ZpfTzAAAAAI"]
[Sat Apr 04 14:27:28.080855 2026] [:error] [pid 2459:tid 2541] [client 141.94.101.142:59508] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adCvUAefyCmu4LR_PloxUQAAAIk"]
[Sat Apr 04 14:27:30.577354 2026] [:error] [pid 2459:tid 2532] [client 141.94.101.142:42104] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adCvUgefyCmu4LR_PloxUwAAAIE"]
[Sat Apr 04 14:27:33.083361 2026] [:error] [pid 2459:tid 2543] [client 141.94.101.142:42108] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adCvVQefyCmu4LR_PloxXwAAAIs"]
[Sat Apr 04 14:27:35.469580 2026] [:error] [pid 2457:tid 2498] [client 141.94.101.142:42112] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adCvV0mNHppaMd92ZpfT1gAAABU"]
[Sat Apr 04 14:27:37.923576 2026] [:error] [pid 2459:tid 2539] [client 141.94.101.142:42120] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adCvWQefyCmu4LR_PloxbQAAAIc"]
[Sat Apr 04 14:27:40.423207 2026] [:error] [pid 37114:tid 37132] [client 141.94.101.142:39518] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adCvXM-DnSj3fGMexeKYpgAAARA"]
[Sat Apr 04 14:27:42.836349 2026] [:error] [pid 2459:tid 2538] [client 141.94.101.142:39536] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adCvXgefyCmu4LR_PloxdwAAAIY"]
[Sat Apr 04 14:27:45.380656 2026] [:error] [pid 2567:tid 2584] [client 141.94.101.142:39540] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adCvYWJJmfRsTrAKjdStHQAAAMo"]
[Sat Apr 04 14:27:48.468342 2026] [:error] [pid 2458:tid 2521] [client 141.94.101.142:39770] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adCvZCNozic5SuWqcll0egAAAFE"]
[Sat Apr 04 14:27:51.058095 2026] [:error] [pid 2567:tid 2589] [client 141.94.101.142:39778] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adCvZ2JJmfRsTrAKjdStIgAAAM8"]
[Sat Apr 04 14:27:53.469499 2026] [:error] [pid 2458:tid 2504] [client 141.94.101.142:39788] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adCvaSNozic5SuWqcll0gAAAAEA"]
[Sat Apr 04 14:27:55.836332 2026] [:error] [pid 2459:tid 2552] [client 141.94.101.142:39802] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adCvawefyCmu4LR_PloxmAAAAJQ"]
[Sat Apr 04 14:28:00.131851 2026] [:error] [pid 2567:tid 2597] [client 141.94.101.142:57670] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adCvcGJJmfRsTrAKjdStPAAAANc"]
[Sat Apr 04 14:28:02.468807 2026] [:error] [pid 2567:tid 2583] [client 141.94.101.142:57674] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adCvcmJJmfRsTrAKjdStQAAAAMk"]
[Sat Apr 04 14:28:24.563324 2026] [:error] [pid 2458:tid 2513] [client 141.94.101.142:57680] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adCviCNozic5SuWqcll0pgAAAEk"]
[Sat Apr 04 17:04:14.996705 2026] [:error] [pid 2458:tid 2515] [client 160.19.226.171:27984] [client 160.19.226.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.19.226.171, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adDUDiNozic5SuWqclmqzgAAAEs"]
[Sat Apr 04 17:04:15.008336 2026] [proxy_fcgi:error] [pid 2458:tid 2515] [client 160.19.226.171:27984] AH01071: Got error 'Primary script unknown'
[Sat Apr 04 20:53:23.847496 2026] [:error] [pid 2458:tid 2523] [client 182.42.104.32:41552] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adEJwyNozic5SuWqclkd5gAAAFM"]
[Sun Apr 05 02:17:47.567813 2026] [:error] [pid 53819:tid 53885] [client 45.131.195.100:63103] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "adFVy2kolvq4mv6siDP6oQAAAAw"]
[Sun Apr 05 04:02:10.145429 2026] [:error] [pid 45409:tid 45427] [client 65.108.2.171:43056] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adFuQtHt_Oyw03gjCNhvJAAAANA"]
[Sun Apr 05 04:02:12.101781 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:43062] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adFuRNHt_Oyw03gjCNhvKwAAAMw"]
[Sun Apr 05 04:02:14.114861 2026] [:error] [pid 45305:tid 45387] [client 65.108.2.171:43074] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adFuRujDQjr7aWhjflDAdAAAAJA"]
[Sun Apr 05 04:02:16.025716 2026] [:error] [pid 45305:tid 45383] [client 65.108.2.171:5746] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adFuSOjDQjr7aWhjflDAfAAAAIw"]
[Sun Apr 05 04:02:18.136312 2026] [:error] [pid 45305:tid 45388] [client 65.108.2.171:5748] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adFuSujDQjr7aWhjflDAgAAAAJE"]
[Sun Apr 05 04:02:20.096047 2026] [:error] [pid 45409:tid 45433] [client 65.108.2.171:5752] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adFuTNHt_Oyw03gjCNhvPgAAANY"]
[Sun Apr 05 04:02:22.130069 2026] [:error] [pid 45409:tid 45419] [client 65.108.2.171:5760] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adFuTtHt_Oyw03gjCNhvQQAAAMg"]
[Sun Apr 05 04:02:24.161144 2026] [:error] [pid 45409:tid 45425] [client 65.108.2.171:5772] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adFuUNHt_Oyw03gjCNhvTwAAAM4"]
[Sun Apr 05 04:02:26.166552 2026] [:error] [pid 45304:tid 45347] [client 65.108.2.171:47764] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adFuUg5jnqDKKovdRknWoQAAAEM"]
[Sun Apr 05 04:02:28.254330 2026] [:error] [pid 45305:tid 45390] [client 65.108.2.171:47770] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adFuVOjDQjr7aWhjflDAmQAAAJM"]
[Sun Apr 05 04:02:30.344347 2026] [:error] [pid 45409:tid 45433] [client 65.108.2.171:47776] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adFuVtHt_Oyw03gjCNhvZgAAANY"]
[Sun Apr 05 04:02:33.957315 2026] [:error] [pid 45305:tid 45384] [client 65.108.2.171:47784] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adFuWejDQjr7aWhjflDAqAAAAI0"]
[Sun Apr 05 04:02:35.952407 2026] [:error] [pid 45409:tid 45413] [client 65.108.2.171:31566] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adFuW9Ht_Oyw03gjCNhvfgAAAMI"]
[Sun Apr 05 04:02:37.869832 2026] [:error] [pid 45305:tid 45371] [client 65.108.2.171:31578] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adFuXejDQjr7aWhjflDAsAAAAIA"]
[Sun Apr 05 04:02:39.768066 2026] [:error] [pid 45304:tid 45352] [client 65.108.2.171:31598] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adFuXw5jnqDKKovdRknWuwAAAEg"]
[Sun Apr 05 04:02:41.684485 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:31634] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adFuYdHt_Oyw03gjCNhvkgAAAMw"]
[Sun Apr 05 04:02:43.721307 2026] [:error] [pid 45303:tid 45317] [client 65.108.2.171:31644] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adFuY7boQ9eViZ4hdnlWswAAAAA"]
[Sun Apr 05 04:02:45.794407 2026] [:error] [pid 45305:tid 45386] [client 65.108.2.171:17372] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adFuZejDQjr7aWhjflDAvwAAAI8"]
[Sun Apr 05 04:02:47.745561 2026] [:error] [pid 45305:tid 45394] [client 65.108.2.171:17380] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adFuZ-jDQjr7aWhjflDAxwAAAJc"]
[Sun Apr 05 04:02:49.685302 2026] [:error] [pid 45303:tid 45331] [client 65.108.2.171:17382] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adFuabboQ9eViZ4hdnlWuQAAAA4"]
[Sun Apr 05 04:02:51.735781 2026] [:error] [pid 45303:tid 45330] [client 65.108.2.171:17390] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adFua7boQ9eViZ4hdnlWuwAAAA0"]
[Sun Apr 05 04:02:53.806852 2026] [:error] [pid 45305:tid 45386] [client 65.108.2.171:17402] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adFubejDQjr7aWhjflDA_gAAAI8"]
[Sun Apr 05 04:02:55.777195 2026] [:error] [pid 45305:tid 45379] [client 65.108.2.171:42064] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adFub-jDQjr7aWhjflDBAgAAAIg"]
[Sun Apr 05 04:02:57.823686 2026] [:error] [pid 45305:tid 45394] [client 65.108.2.171:42080] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adFucejDQjr7aWhjflDBCgAAAJc"]
[Sun Apr 05 04:02:59.751251 2026] [:error] [pid 45409:tid 45429] [client 65.108.2.171:42092] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adFuc9Ht_Oyw03gjCNhwGwAAANI"]
[Sun Apr 05 04:03:01.765582 2026] [:error] [pid 45305:tid 45372] [client 65.108.2.171:42108] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adFudejDQjr7aWhjflDBHQAAAIE"]
[Sun Apr 05 04:03:03.885566 2026] [:error] [pid 45305:tid 45383] [client 65.108.2.171:42120] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adFud-jDQjr7aWhjflDBJgAAAIw"]
[Sun Apr 05 04:03:06.003554 2026] [:error] [pid 45409:tid 45428] [client 65.108.2.171:61204] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adFuetHt_Oyw03gjCNhwaQAAANE"]
[Sun Apr 05 04:03:07.518753 2026] [:error] [pid 45304:tid 45359] [client 65.108.2.171:22184] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adFuew5jnqDKKovdRknW5wAAAE8"]
[Sun Apr 05 04:03:36.078474 2026] [:error] [pid 45304:tid 45344] [client 65.108.2.171:59092] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adFumA5jnqDKKovdRknXEgAAAEA"]
[Sun Apr 05 04:03:37.983818 2026] [:error] [pid 45304:tid 45347] [client 65.108.2.171:19214] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adFumQ5jnqDKKovdRknXGAAAAEM"]
[Sun Apr 05 04:03:40.433512 2026] [:error] [pid 45409:tid 45435] [client 65.108.2.171:59108] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adFunNHt_Oyw03gjCNhw7wAAANg"]
[Sun Apr 05 04:03:42.314173 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:19224] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adFuntHt_Oyw03gjCNhw_gAAAMw"]
[Sun Apr 05 04:03:44.236668 2026] [:error] [pid 45304:tid 45367] [client 65.108.2.171:19238] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adFuoA5jnqDKKovdRknXJAAAAFc"]
[Sun Apr 05 04:03:46.868081 2026] [:error] [pid 45303:tid 45324] [client 65.108.2.171:21380] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adFuorboQ9eViZ4hdnlXHQAAAAc"]
[Sun Apr 05 04:03:48.758458 2026] [:error] [pid 45305:tid 45387] [client 65.108.2.171:32564] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adFupOjDQjr7aWhjflDBqQAAAJA"]
[Sun Apr 05 04:03:50.715687 2026] [:error] [pid 45305:tid 45378] [client 65.108.2.171:32574] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adFupujDQjr7aWhjflDBswAAAIc"]
[Sun Apr 05 04:03:52.637146 2026] [:error] [pid 45304:tid 45344] [client 65.108.2.171:32576] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adFuqA5jnqDKKovdRknXOwAAAEA"]
[Sun Apr 05 04:03:55.154425 2026] [:error] [pid 45303:tid 45320] [client 65.108.2.171:63492] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adFuq7boQ9eViZ4hdnlXMwAAAAM"]
[Sun Apr 05 04:03:57.011974 2026] [:error] [pid 45304:tid 45352] [client 65.108.2.171:9800] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adFurQ5jnqDKKovdRknXSAAAAEg"]
[Sun Apr 05 04:03:59.513935 2026] [:error] [pid 45304:tid 45363] [client 65.108.2.171:63496] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adFurw5jnqDKKovdRknXUgAAAFM"]
[Sun Apr 05 04:04:01.437968 2026] [:error] [pid 45304:tid 45366] [client 65.108.2.171:9804] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adFusQ5jnqDKKovdRknXVgAAAFY"]
[Sun Apr 05 04:04:03.578168 2026] [:error] [pid 45304:tid 45344] [client 65.108.2.171:9818] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adFusw5jnqDKKovdRknXYAAAAEA"]
[Sun Apr 05 04:04:05.592313 2026] [:error] [pid 45304:tid 45344] [client 65.108.2.171:32382] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adFutQ5jnqDKKovdRknXaQAAAEA"]
[Sun Apr 05 04:04:07.494485 2026] [:error] [pid 45303:tid 45326] [client 65.108.2.171:32390] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adFut7boQ9eViZ4hdnlXQQAAAAk"]
[Sun Apr 05 04:04:09.593894 2026] [:error] [pid 45409:tid 45427] [client 65.108.2.171:32402] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adFuudHt_Oyw03gjCNhxQgAAANA"]
[Sun Apr 05 04:04:12.226599 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:5478] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adFuvNHt_Oyw03gjCNhxawAAAMw"]
[Sun Apr 05 04:04:14.253737 2026] [:error] [pid 45305:tid 45374] [client 65.108.2.171:32414] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adFuvujDQjr7aWhjflDB6gAAAIM"]
[Sun Apr 05 04:04:16.843962 2026] [:error] [pid 45409:tid 45433] [client 65.108.2.171:40996] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adFuwNHt_Oyw03gjCNhxfwAAANY"]
[Sun Apr 05 04:04:18.791000 2026] [:error] [pid 45409:tid 45426] [client 65.108.2.171:2772] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adFuwtHt_Oyw03gjCNhxhQAAAM8"]
[Sun Apr 05 04:04:20.787269 2026] [:error] [pid 45303:tid 45332] [client 65.108.2.171:2780] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adFuxLboQ9eViZ4hdnlXXgAAAA8"]
[Sun Apr 05 04:04:23.396761 2026] [:error] [pid 45303:tid 45321] [client 65.108.2.171:41006] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adFux7boQ9eViZ4hdnlXawAAAAQ"]
[Sun Apr 05 04:04:25.335572 2026] [:error] [pid 45305:tid 45388] [client 65.108.2.171:13508] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adFuyejDQjr7aWhjflDCBwAAAJE"]
[Sun Apr 05 04:04:27.484973 2026] [:error] [pid 45305:tid 45380] [client 65.108.2.171:13520] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adFuy-jDQjr7aWhjflDCCgAAAIk"]
[Sun Apr 05 04:04:29.406907 2026] [:error] [pid 45409:tid 45417] [client 65.108.2.171:13530] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adFuzdHt_Oyw03gjCNhxsgAAAMY"]
[Sun Apr 05 04:04:31.046684 2026] [:error] [pid 45303:tid 45326] [client 65.108.2.171:13536] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adFuz7boQ9eViZ4hdnlXeQAAAAk"]
[Sun Apr 05 04:06:55.524670 2026] [:error] [pid 45303:tid 45329] [client 65.108.2.171:63870] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adFvX7boQ9eViZ4hdnlYVwAAAAw"]
[Sun Apr 05 04:06:57.522670 2026] [:error] [pid 45409:tid 45429] [client 65.108.2.171:63880] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adFvYdHt_Oyw03gjCNh0AQAAANI"]
[Sun Apr 05 04:06:59.523931 2026] [:error] [pid 45304:tid 45356] [client 65.108.2.171:63890] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adFvYw5jnqDKKovdRknZCAAAAEw"]
[Sun Apr 05 04:07:01.357030 2026] [:error] [pid 45304:tid 45359] [client 65.108.2.171:63906] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adFvZQ5jnqDKKovdRknZDQAAAE8"]
[Sun Apr 05 04:07:03.371911 2026] [:error] [pid 45304:tid 45358] [client 65.108.2.171:63918] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adFvZw5jnqDKKovdRknZEgAAAE4"]
[Sun Apr 05 04:07:05.399148 2026] [:error] [pid 45305:tid 45376] [client 65.108.2.171:5914] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adFvaejDQjr7aWhjflDDaQAAAIU"]
[Sun Apr 05 04:07:07.396559 2026] [:error] [pid 45305:tid 45385] [client 65.108.2.171:5920] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "adFva-jDQjr7aWhjflDDcQAAAI4"]
[Sun Apr 05 04:07:09.438312 2026] [:error] [pid 45305:tid 45381] [client 65.108.2.171:5930] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adFvbejDQjr7aWhjflDDgAAAAIo"]
[Sun Apr 05 04:07:11.314586 2026] [:error] [pid 45409:tid 45435] [client 65.108.2.171:5942] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adFvb9Ht_Oyw03gjCNh0LAAAANg"]
[Sun Apr 05 04:07:13.342619 2026] [:error] [pid 45409:tid 45415] [client 65.108.2.171:5950] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adFvcdHt_Oyw03gjCNh0PAAAAMQ"]
[Sun Apr 05 04:07:15.401031 2026] [:error] [pid 45305:tid 45394] [client 65.108.2.171:58662] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adFvc-jDQjr7aWhjflDDjAAAAJc"]
[Sun Apr 05 04:07:17.446976 2026] [:error] [pid 45409:tid 45416] [client 65.108.2.171:58674] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adFvddHt_Oyw03gjCNh0VQAAAMU"]
[Sun Apr 05 04:07:19.506637 2026] [:error] [pid 45303:tid 45323] [client 65.108.2.171:58686] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adFvd7boQ9eViZ4hdnlYcAAAAAY"]
[Sun Apr 05 04:07:21.551027 2026] [:error] [pid 45409:tid 45429] [client 65.108.2.171:58692] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adFvedHt_Oyw03gjCNh0awAAANI"]
[Sun Apr 05 04:07:23.629325 2026] [:error] [pid 45409:tid 45415] [client 65.108.2.171:58696] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adFve9Ht_Oyw03gjCNh0dgAAAMQ"]
[Sun Apr 05 04:07:25.546393 2026] [:error] [pid 45409:tid 45419] [client 65.108.2.171:56022] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adFvfdHt_Oyw03gjCNh0hQAAAMg"]
[Sun Apr 05 04:07:27.411617 2026] [:error] [pid 45409:tid 45416] [client 65.108.2.171:56026] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adFvf9Ht_Oyw03gjCNh0kwAAAMU"]
[Sun Apr 05 04:07:29.416840 2026] [:error] [pid 45409:tid 45417] [client 65.108.2.171:56038] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adFvgdHt_Oyw03gjCNh0nQAAAMY"]
[Sun Apr 05 04:07:31.426762 2026] [:error] [pid 45409:tid 45427] [client 65.108.2.171:56048] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adFvg9Ht_Oyw03gjCNh0owAAANA"]
[Sun Apr 05 04:07:33.429134 2026] [:error] [pid 45305:tid 45389] [client 65.108.2.171:56064] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adFvhejDQjr7aWhjflDDyAAAAJI"]
[Sun Apr 05 04:07:35.453380 2026] [:error] [pid 45304:tid 45367] [client 65.108.2.171:47056] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adFvhw5jnqDKKovdRknZXgAAAFc"]
[Sun Apr 05 04:07:37.439523 2026] [:error] [pid 45304:tid 45349] [client 65.108.2.171:47062] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adFviQ5jnqDKKovdRknZZwAAAEU"]
[Sun Apr 05 04:07:39.466676 2026] [:error] [pid 45409:tid 45431] [client 65.108.2.171:47072] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adFvi9Ht_Oyw03gjCNh0wgAAANQ"]
[Sun Apr 05 04:07:41.478023 2026] [:error] [pid 45409:tid 45430] [client 65.108.2.171:47086] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adFvjdHt_Oyw03gjCNh0zgAAANM"]
[Sun Apr 05 04:07:43.479637 2026] [:error] [pid 45409:tid 45418] [client 65.108.2.171:47098] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adFvj9Ht_Oyw03gjCNh02gAAAMc"]
[Sun Apr 05 04:07:45.362592 2026] [:error] [pid 45305:tid 45393] [client 65.108.2.171:28920] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adFvkejDQjr7aWhjflDD5QAAAJY"]
[Sun Apr 05 04:07:47.352823 2026] [:error] [pid 45303:tid 45338] [client 65.108.2.171:28930] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adFvk7boQ9eViZ4hdnlYhwAAABU"]
[Sun Apr 05 04:08:11.332840 2026] [:error] [pid 45409:tid 45427] [client 65.108.2.171:46358] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adFvq9Ht_Oyw03gjCNh1UgAAANA"]
[Sun Apr 05 04:08:13.350180 2026] [:error] [pid 45305:tid 45381] [client 65.108.2.171:46362] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adFvrejDQjr7aWhjflDELwAAAIo"]
[Sun Apr 05 04:08:15.334619 2026] [:error] [pid 45409:tid 45428] [client 65.108.2.171:29948] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adFvr9Ht_Oyw03gjCNh1ZgAAANE"]
[Sun Apr 05 04:08:17.346663 2026] [:error] [pid 45305:tid 45378] [client 65.108.2.171:29958] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adFvsejDQjr7aWhjflDEOgAAAIc"]
[Sun Apr 05 04:08:19.359149 2026] [:error] [pid 45409:tid 45426] [client 65.108.2.171:29962] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adFvs9Ht_Oyw03gjCNh1hAAAAM8"]
[Sun Apr 05 04:08:21.389992 2026] [:error] [pid 45409:tid 45431] [client 65.108.2.171:29974] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adFvtdHt_Oyw03gjCNh1lgAAANQ"]
[Sun Apr 05 04:08:23.384616 2026] [:error] [pid 45303:tid 45324] [client 65.108.2.171:29976] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adFvt7boQ9eViZ4hdnlYugAAAAc"]
[Sun Apr 05 04:08:25.401406 2026] [:error] [pid 45305:tid 45373] [client 65.108.2.171:30000] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adFvuejDQjr7aWhjflDETQAAAII"]
[Sun Apr 05 04:08:27.410159 2026] [:error] [pid 45305:tid 45384] [client 65.108.2.171:30012] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adFvu-jDQjr7aWhjflDEUwAAAI0"]
[Sun Apr 05 04:08:29.287087 2026] [:error] [pid 45305:tid 45378] [client 65.108.2.171:30018] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adFvvejDQjr7aWhjflDEVwAAAIc"]
[Sun Apr 05 04:08:31.323048 2026] [:error] [pid 45409:tid 45431] [client 65.108.2.171:30032] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adFvv9Ht_Oyw03gjCNh1xgAAANQ"]
[Sun Apr 05 04:08:33.338420 2026] [:error] [pid 45409:tid 45432] [client 65.108.2.171:30048] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adFvwdHt_Oyw03gjCNh10gAAANU"]
[Sun Apr 05 04:08:35.216668 2026] [:error] [pid 45303:tid 45326] [client 65.108.2.171:34230] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adFvw7boQ9eViZ4hdnlYywAAAAk"]
[Sun Apr 05 04:08:37.225900 2026] [:error] [pid 45409:tid 45418] [client 65.108.2.171:34232] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adFvxdHt_Oyw03gjCNh15wAAAMc"]
[Sun Apr 05 04:08:39.261167 2026] [:error] [pid 45409:tid 45432] [client 65.108.2.171:34246] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adFvx9Ht_Oyw03gjCNh1-gAAANU"]
[Sun Apr 05 04:08:41.144085 2026] [:error] [pid 45303:tid 45329] [client 65.108.2.171:34250] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adFvybboQ9eViZ4hdnlYzQAAAAw"]
[Sun Apr 05 04:08:43.159781 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:34254] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adFvy9Ht_Oyw03gjCNh2CwAAAMw"]
[Sun Apr 05 04:08:45.169442 2026] [:error] [pid 45409:tid 45421] [client 65.108.2.171:6136] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adFvzdHt_Oyw03gjCNh2EwAAAMo"]
[Sun Apr 05 04:08:47.186979 2026] [:error] [pid 45409:tid 45424] [client 65.108.2.171:6148] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adFvz9Ht_Oyw03gjCNh2GwAAAM0"]
[Sun Apr 05 04:08:49.192857 2026] [:error] [pid 45409:tid 45417] [client 65.108.2.171:6152] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adFv0dHt_Oyw03gjCNh2JwAAAMY"]
[Sun Apr 05 04:08:51.188583 2026] [:error] [pid 45305:tid 45395] [client 65.108.2.171:6154] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adFv0-jDQjr7aWhjflDEigAAAJg"]
[Sun Apr 05 04:08:53.180375 2026] [:error] [pid 45409:tid 45423] [client 65.108.2.171:6166] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adFv1dHt_Oyw03gjCNh2QgAAAMw"]
[Sun Apr 05 04:08:55.178463 2026] [:error] [pid 45305:tid 45388] [client 65.108.2.171:49216] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adFv1-jDQjr7aWhjflDElQAAAJE"]
[Sun Apr 05 04:08:57.175580 2026] [:error] [pid 45304:tid 45358] [client 65.108.2.171:49230] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adFv2Q5jnqDKKovdRknZ9AAAAE4"]
[Sun Apr 05 04:08:59.188287 2026] [:error] [pid 45304:tid 45363] [client 65.108.2.171:49242] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adFv2w5jnqDKKovdRknZ_QAAAFM"]
[Sun Apr 05 04:09:01.211141 2026] [:error] [pid 45304:tid 45346] [client 65.108.2.171:49246] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adFv3Q5jnqDKKovdRknaAwAAAEI"]
[Sun Apr 05 04:09:03.230315 2026] [:error] [pid 45305:tid 45386] [client 65.108.2.171:49254] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adFv3-jDQjr7aWhjflDEnAAAAI8"]
[Sun Apr 05 04:09:05.080687 2026] [:error] [pid 45305:tid 45394] [client 65.108.2.171:27314] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adFv4ejDQjr7aWhjflDEogAAAJc"]
[Sun Apr 05 04:09:07.083082 2026] [:error] [pid 45409:tid 45414] [client 65.108.2.171:27336] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adFv49Ht_Oyw03gjCNh2jwAAAMM"]
[Sun Apr 05 04:33:44.376564 2026] [proxy_fcgi:error] [pid 45304:tid 45366] [client 74.234.80.3:62842] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:25.164804 2026] [proxy_fcgi:error] [pid 30921:tid 30935] [client 20.89.241.241:2739] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:25.296739 2026] [proxy_fcgi:error] [pid 30921:tid 30947] [client 20.89.241.241:2739] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:25.689837 2026] [proxy_fcgi:error] [pid 30921:tid 30929] [client 20.89.241.241:2739] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:25.814772 2026] [proxy_fcgi:error] [pid 30921:tid 30924] [client 20.89.241.241:2739] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:26.305778 2026] [proxy_fcgi:error] [pid 30921:tid 30939] [client 20.89.241.241:2739] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 05:24:26.553477 2026] [:error] [pid 30921:tid 30940] [client 20.89.241.241:2739] [client 20.89.241.241] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "adGBimFGQVn8Q0ueB25eMwAAARE"]
[Sun Apr 05 05:24:27.057990 2026] [:error] [pid 45304:tid 45360] [client 20.89.241.241:18247] [client 20.89.241.241] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "adGBiw5jnqDKKovdRkn9ggAAAFA"]
[Sun Apr 05 05:24:27.567818 2026] [:error] [pid 30921:tid 30931] [client 20.89.241.241:10170] [client 20.89.241.241] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "adGBi2FGQVn8Q0ueB25eNwAAAQg"]
[Sun Apr 05 05:24:28.382827 2026] [:error] [pid 30921:tid 30935] [client 20.89.241.241:16372] [client 20.89.241.241] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "adGBjGFGQVn8Q0ueB25eOAAAAQw"]
[Sun Apr 05 06:09:52.407594 2026] [proxy_fcgi:error] [pid 45303:tid 45328] [client 20.151.201.236:63518] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:52.623105 2026] [proxy_fcgi:error] [pid 45303:tid 45337] [client 20.151.201.236:63518] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:53.263338 2026] [proxy_fcgi:error] [pid 45303:tid 45326] [client 20.151.201.236:63518] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:53.483251 2026] [proxy_fcgi:error] [pid 45303:tid 45335] [client 20.151.201.236:63518] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:53.689775 2026] [:error] [pid 45303:tid 45321] [client 20.151.201.236:63518] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adGMMbboQ9eViZ4hdnmJsAAAAAQ"]
[Sun Apr 05 06:09:54.976937 2026] [proxy_fcgi:error] [pid 45305:tid 45387] [client 20.151.201.236:56766] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:55.186446 2026] [proxy_fcgi:error] [pid 45305:tid 45377] [client 20.151.201.236:56766] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:55.397672 2026] [proxy_fcgi:error] [pid 45305:tid 45375] [client 20.151.201.236:56766] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:55.607966 2026] [proxy_fcgi:error] [pid 45305:tid 45391] [client 20.151.201.236:56766] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:09:55.823341 2026] [:error] [pid 45305:tid 45386] [client 20.151.201.236:56766] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "adGMM-jDQjr7aWhjflAkvAAAAI8"]
[Sun Apr 05 06:09:56.888043 2026] [:error] [pid 45305:tid 45381] [client 20.151.201.236:63446] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "adGMNOjDQjr7aWhjflAkxAAAAIo"]
[Sun Apr 05 06:10:00.198370 2026] [:error] [pid 45305:tid 45394] [client 20.151.201.236:56914] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "adGMOOjDQjr7aWhjflAk0wAAAJc"]
[Sun Apr 05 06:10:02.358344 2026] [:error] [pid 30921:tid 30946] [client 20.151.201.236:58419] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tem.php"] [unique_id "adGMOmFGQVn8Q0ueB250SwAAARc"]
[Sun Apr 05 06:10:03.994421 2026] [:error] [pid 45305:tid 45389] [client 20.151.201.236:54248] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "adGMO-jDQjr7aWhjflAk2wAAAJI"]
[Sun Apr 05 06:10:05.348943 2026] [:error] [pid 45409:tid 45418] [client 20.151.201.236:58452] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "adGMPdHt_Oyw03gjCNjWrQAAAMc"]
[Sun Apr 05 06:10:07.613360 2026] [:error] [pid 45305:tid 45374] [client 20.151.201.236:63512] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "adGMP-jDQjr7aWhjflAk5QAAAIM"]
[Sun Apr 05 06:10:09.957960 2026] [:error] [pid 45303:tid 45331] [client 20.151.201.236:58449] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "adGMQbboQ9eViZ4hdnmJ0AAAAA4"]
[Sun Apr 05 06:10:10.981737 2026] [:error] [pid 45305:tid 45373] [client 20.151.201.236:54210] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "adGMQujDQjr7aWhjflAk-AAAAII"]
[Sun Apr 05 06:10:14.569343 2026] [:error] [pid 45305:tid 45381] [client 20.151.201.236:56775] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "adGMRujDQjr7aWhjflAlCQAAAIo"]
[Sun Apr 05 06:10:16.560083 2026] [:error] [pid 45409:tid 45422] [client 20.151.201.236:56740] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "adGMSNHt_Oyw03gjCNjWxAAAAMs"]
[Sun Apr 05 06:10:19.094894 2026] [:error] [pid 45409:tid 45419] [client 20.151.201.236:63521] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/agg.php"] [unique_id "adGMS9Ht_Oyw03gjCNjWzgAAAMg"]
[Sun Apr 05 06:10:19.889133 2026] [:error] [pid 30921:tid 30934] [client 20.151.201.236:63495] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "adGMS2FGQVn8Q0ueB250hAAAAQs"]
[Sun Apr 05 06:10:20.501745 2026] [:error] [pid 45409:tid 45433] [client 20.151.201.236:54244] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "adGMTNHt_Oyw03gjCNjW0wAAANY"]
[Sun Apr 05 06:10:21.076691 2026] [:error] [pid 45303:tid 45334] [client 20.151.201.236:58415] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "adGMTbboQ9eViZ4hdnmJ3gAAABE"]
[Sun Apr 05 06:10:21.899355 2026] [:error] [pid 45305:tid 45395] [client 20.151.201.236:56901] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "adGMTejDQjr7aWhjflAlKAAAAJg"]
[Sun Apr 05 06:10:22.758078 2026] [:error] [pid 45305:tid 45393] [client 20.151.201.236:57749] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adGMTujDQjr7aWhjflAlMQAAAJY"]
[Sun Apr 05 06:10:23.346395 2026] [:error] [pid 45304:tid 45351] [client 20.151.201.236:58441] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adGMTw5jnqDKKovdRkkL0wAAAEc"]
[Sun Apr 05 06:10:24.182843 2026] [:error] [pid 45303:tid 45329] [client 20.151.201.236:56825] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adGMULboQ9eViZ4hdnmJ6AAAAAw"]
[Sun Apr 05 06:10:24.676623 2026] [:error] [pid 45303:tid 45320] [client 20.151.201.236:58411] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adGMULboQ9eViZ4hdnmJ6gAAAAM"]
[Sun Apr 05 06:10:25.187055 2026] [:error] [pid 45303:tid 45336] [client 20.151.201.236:54246] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adGMUbboQ9eViZ4hdnmJ6wAAABM"]
[Sun Apr 05 06:10:25.617495 2026] [:error] [pid 45409:tid 45421] [client 20.151.201.236:57744] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adGMUdHt_Oyw03gjCNjW7AAAAMo"]
[Sun Apr 05 06:10:26.388935 2026] [:error] [pid 45409:tid 45430] [client 20.151.201.236:56802] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adGMUtHt_Oyw03gjCNjW7wAAANM"]
[Sun Apr 05 06:10:26.906010 2026] [:error] [pid 45303:tid 45324] [client 20.151.201.236:58358] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adGMUrboQ9eViZ4hdnmJ8QAAAAc"]
[Sun Apr 05 06:10:28.016179 2026] [:error] [pid 30921:tid 30924] [client 20.151.201.236:58444] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adGMVGFGQVn8Q0ueB250lwAAAQE"]
[Sun Apr 05 06:10:29.164197 2026] [:error] [pid 45305:tid 45373] [client 20.151.201.236:63424] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adGMVejDQjr7aWhjflAlRQAAAII"]
[Sun Apr 05 06:10:30.063569 2026] [:error] [pid 45303:tid 45332] [client 20.151.201.236:58385] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adGMVrboQ9eViZ4hdnmJ9AAAAA8"]
[Sun Apr 05 06:10:32.104404 2026] [:error] [pid 45303:tid 45336] [client 20.151.201.236:56787] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adGMWLboQ9eViZ4hdnmJ-wAAABM"]
[Sun Apr 05 06:10:33.527007 2026] [:error] [pid 30921:tid 30928] [client 20.151.201.236:63484] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adGMWWFGQVn8Q0ueB250qQAAAQU"]
[Sun Apr 05 06:10:34.431083 2026] [:error] [pid 30921:tid 30925] [client 20.151.201.236:63483] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adGMWmFGQVn8Q0ueB250rAAAAQI"]
[Sun Apr 05 06:10:35.800294 2026] [:error] [pid 45305:tid 45383] [client 20.151.201.236:63519] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adGMW-jDQjr7aWhjflAlYQAAAIw"]
[Sun Apr 05 06:10:37.339997 2026] [:error] [pid 45409:tid 45426] [client 20.151.201.236:58431] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adGMXdHt_Oyw03gjCNjXDQAAAM8"]
[Sun Apr 05 06:10:38.265172 2026] [:error] [pid 30921:tid 30941] [client 20.151.201.236:57703] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "adGMXmFGQVn8Q0ueB250tQAAARI"]
[Sun Apr 05 06:10:38.875401 2026] [:error] [pid 45305:tid 45379] [client 20.151.201.236:54237] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "adGMXujDQjr7aWhjflAlcAAAAIg"]
[Sun Apr 05 06:10:39.962103 2026] [:error] [pid 45305:tid 45389] [client 20.151.201.236:63463] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "adGMX-jDQjr7aWhjflAldAAAAJI"]
[Sun Apr 05 06:10:42.912020 2026] [:error] [pid 30921:tid 30932] [client 20.151.201.236:58438] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/css/index.php"] [unique_id "adGMYmFGQVn8Q0ueB250ugAAAQk"]
[Sun Apr 05 06:10:44.352075 2026] [:error] [pid 45305:tid 45384] [client 20.151.201.236:54230] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adGMZOjDQjr7aWhjflAljAAAAI0"]
[Sun Apr 05 06:10:45.616108 2026] [:error] [pid 45303:tid 45340] [client 20.151.201.236:56809] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adGMZbboQ9eViZ4hdnmKGwAAABc"]
[Sun Apr 05 06:10:46.918585 2026] [:error] [pid 45305:tid 45392] [client 20.151.201.236:58368] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adGMZujDQjr7aWhjflAlkwAAAJU"]
[Sun Apr 05 06:10:48.221022 2026] [:error] [pid 45409:tid 45421] [client 20.151.201.236:63504] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adGMaNHt_Oyw03gjCNjXKAAAAMo"]
[Sun Apr 05 06:10:49.033757 2026] [:error] [pid 45305:tid 45374] [client 20.151.201.236:56926] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "adGMaejDQjr7aWhjflAlmgAAAIM"]
[Sun Apr 05 06:10:53.689464 2026] [:error] [pid 45305:tid 45378] [client 20.151.201.236:56812] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "adGMbejDQjr7aWhjflAlqAAAAIc"]
[Sun Apr 05 06:10:55.230938 2026] [proxy_fcgi:error] [pid 45409:tid 45417] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:55.652003 2026] [proxy_fcgi:error] [pid 45409:tid 45428] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:55.866839 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:56.080940 2026] [proxy_fcgi:error] [pid 45409:tid 45415] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:56.291785 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:56.500655 2026] [proxy_fcgi:error] [pid 45409:tid 45414] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:56.719791 2026] [proxy_fcgi:error] [pid 45409:tid 45425] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:56.938014 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:57.164535 2026] [proxy_fcgi:error] [pid 45409:tid 45434] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:57.372735 2026] [proxy_fcgi:error] [pid 45409:tid 45424] [client 20.151.201.236:57673] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:10:57.577537 2026] [:error] [pid 45409:tid 45431] [client 20.151.201.236:57673] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/content.php"] [unique_id "adGMcdHt_Oyw03gjCNjXSwAAANQ"]
[Sun Apr 05 06:11:00.430312 2026] [:error] [pid 45305:tid 45376] [client 20.151.201.236:58363] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/content.php"] [unique_id "adGMdOjDQjr7aWhjflAlywAAAIU"]
[Sun Apr 05 06:11:03.762274 2026] [:error] [pid 45305:tid 45395] [client 20.151.201.236:57572] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/content.php"] [unique_id "adGMd-jDQjr7aWhjflAl4gAAAJg"]
[Sun Apr 05 06:11:07.778087 2026] [:error] [pid 45305:tid 45372] [client 20.151.201.236:56805] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/content.php"] [unique_id "adGMe-jDQjr7aWhjflAmAgAAAIE"]
[Sun Apr 05 06:11:09.209527 2026] [:error] [pid 30921:tid 30930] [client 20.151.201.236:58403] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp.php"] [unique_id "adGMfWFGQVn8Q0ueB2507AAAAQc"]
[Sun Apr 05 06:11:09.841391 2026] [:error] [pid 45305:tid 45375] [client 20.151.201.236:56794] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp.php"] [unique_id "adGMfejDQjr7aWhjflAmDgAAAIQ"]
[Sun Apr 05 06:11:10.881411 2026] [:error] [pid 30921:tid 30934] [client 20.151.201.236:54215] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp.php"] [unique_id "adGMfmFGQVn8Q0ueB2508gAAAQs"]
[Sun Apr 05 06:11:12.378519 2026] [:error] [pid 45304:tid 45345] [client 20.151.201.236:63507] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp.php"] [unique_id "adGMgA5jnqDKKovdRkkMGAAAAEE"]
[Sun Apr 05 06:11:13.820123 2026] [:error] [pid 30921:tid 30923] [client 20.151.201.236:56903] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adGMgWFGQVn8Q0ueB250_gAAAQA"]
[Sun Apr 05 06:11:15.592380 2026] [:error] [pid 45305:tid 45380] [client 20.151.201.236:63430] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugin.php"] [unique_id "adGMg-jDQjr7aWhjflAmNQAAAIk"]
[Sun Apr 05 06:11:17.374022 2026] [:error] [pid 45409:tid 45431] [client 20.151.201.236:58453] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugin.php"] [unique_id "adGMhdHt_Oyw03gjCNjXfAAAANQ"]
[Sun Apr 05 06:11:20.105872 2026] [:error] [pid 45305:tid 45386] [client 20.151.201.236:56780] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugin.php"] [unique_id "adGMiOjDQjr7aWhjflAmVwAAAI8"]
[Sun Apr 05 06:11:21.658292 2026] [:error] [pid 45303:tid 45326] [client 20.151.201.236:58401] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugin.php"] [unique_id "adGMibboQ9eViZ4hdnmKWgAAAAk"]
[Sun Apr 05 06:11:23.748828 2026] [:error] [pid 30921:tid 30941] [client 20.151.201.236:58336] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/chosen.php"] [unique_id "adGMi2FGQVn8Q0ueB251CwAAARI"]
[Sun Apr 05 06:11:24.267361 2026] [:error] [pid 45305:tid 45393] [client 20.151.201.236:64305] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGMjOjDQjr7aWhjflAmaQAAAJY"]
[Sun Apr 05 06:11:24.671571 2026] [:error] [pid 45409:tid 45435] [client 20.151.201.236:63290] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/chosen.php"] [unique_id "adGMjNHt_Oyw03gjCNjXlgAAANg"]
[Sun Apr 05 06:11:26.602698 2026] [:error] [pid 30921:tid 30943] [client 20.151.201.236:56906] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/chosen.php"] [unique_id "adGMjmFGQVn8Q0ueB251DgAAARQ"]
[Sun Apr 05 06:11:27.313368 2026] [:error] [pid 45305:tid 45386] [client 20.151.201.236:63679] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGMj-jDQjr7aWhjflAmewAAAI8"]
[Sun Apr 05 06:11:28.941600 2026] [:error] [pid 45305:tid 45387] [client 20.151.201.236:38527] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGMkOjDQjr7aWhjflAmiQAAAJA"]
[Sun Apr 05 06:11:29.758446 2026] [:error] [pid 45305:tid 45376] [client 20.151.201.236:59004] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGMkejDQjr7aWhjflAmjwAAAIU"]
[Sun Apr 05 06:11:30.285435 2026] [:error] [pid 45305:tid 45389] [client 20.151.201.236:58404] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/chosen.php"] [unique_id "adGMkujDQjr7aWhjflAmkwAAAJI"]
[Sun Apr 05 06:11:31.911879 2026] [:error] [pid 45305:tid 45379] [client 20.151.201.236:57599] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/chosen.php"] [unique_id "adGMk-jDQjr7aWhjflAmowAAAIg"]
[Sun Apr 05 06:11:35.650910 2026] [:error] [pid 30921:tid 30931] [client 20.151.201.236:58372] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adGMl2FGQVn8Q0ueB251JAAAAQg"]
[Sun Apr 05 06:11:37.498123 2026] [:error] [pid 45304:tid 45365] [client 20.151.201.236:57712] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adGMmQ5jnqDKKovdRkkMPgAAAFU"]
[Sun Apr 05 06:11:38.746050 2026] [:error] [pid 45303:tid 45340] [client 20.151.201.236:58440] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adGMmrboQ9eViZ4hdnmKhgAAABc"]
[Sun Apr 05 06:11:40.955968 2026] [:error] [pid 45409:tid 45412] [client 20.151.201.236:57702] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adGMnNHt_Oyw03gjCNjXywAAAME"]
[Sun Apr 05 06:11:45.592294 2026] [:error] [pid 45409:tid 45431] [client 20.151.201.236:54354] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "adGModHt_Oyw03gjCNjX2QAAANQ"]
[Sun Apr 05 06:11:50.729022 2026] [:error] [pid 45409:tid 45433] [client 20.151.201.236:56899] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "adGMptHt_Oyw03gjCNjX3gAAANY"]
[Sun Apr 05 06:11:54.108222 2026] [:error] [pid 45409:tid 45413] [client 20.151.201.236:49548] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "adGMqtHt_Oyw03gjCNjX5wAAAMI"]
[Sun Apr 05 06:11:59.492932 2026] [proxy_fcgi:error] [pid 30921:tid 30936] [client 20.151.201.236:57570] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:12:00.833384 2026] [proxy_fcgi:error] [pid 30921:tid 30943] [client 20.151.201.236:57570] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:12:01.901424 2026] [proxy_fcgi:error] [pid 30921:tid 30925] [client 20.151.201.236:57570] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:12:02.111882 2026] [proxy_fcgi:error] [pid 30921:tid 30932] [client 20.151.201.236:57570] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:12:02.533664 2026] [proxy_fcgi:error] [pid 30921:tid 30935] [client 20.151.201.236:57570] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:12:02.751072 2026] [:error] [pid 30921:tid 30944] [client 20.151.201.236:57570] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "adGMsmFGQVn8Q0ueB251fAAAARU"]
[Sun Apr 05 06:12:06.342966 2026] [:error] [pid 45305:tid 45390] [client 20.151.201.236:58366] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "adGMtujDQjr7aWhjflAnNgAAAJM"]
[Sun Apr 05 06:12:08.892896 2026] [:error] [pid 45305:tid 45373] [client 20.151.201.236:58450] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "adGMuOjDQjr7aWhjflAnRAAAAII"]
[Sun Apr 05 06:12:10.210096 2026] [:error] [pid 45304:tid 45354] [client 20.151.201.236:58439] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/edit.php"] [unique_id "adGMug5jnqDKKovdRkkMYAAAAEo"]
[Sun Apr 05 06:12:16.296722 2026] [:error] [pid 45305:tid 45389] [client 20.151.201.236:56800] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adGMwOjDQjr7aWhjflAneAAAAJI"]
[Sun Apr 05 06:12:20.421150 2026] [:error] [pid 30921:tid 30936] [client 20.151.201.236:50887] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adGMxGFGQVn8Q0ueB251mwAAAQ0"]
[Sun Apr 05 06:12:22.356861 2026] [:error] [pid 45305:tid 45383] [client 20.151.201.236:58338] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adGMxujDQjr7aWhjflAnnAAAAIw"]
[Sun Apr 05 06:12:25.426296 2026] [:error] [pid 45303:tid 45335] [client 20.151.201.236:57688] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adGMybboQ9eViZ4hdnmKyQAAABI"]
[Sun Apr 05 06:12:27.467085 2026] [:error] [pid 45409:tid 45412] [client 20.151.201.236:63469] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adGMy9Ht_Oyw03gjCNjYLwAAAME"]
[Sun Apr 05 06:12:28.719791 2026] [:error] [pid 45305:tid 45382] [client 20.151.201.236:54221] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adGMzOjDQjr7aWhjflAntgAAAIs"]
[Sun Apr 05 06:12:30.605142 2026] [:error] [pid 30921:tid 30927] [client 20.151.201.236:57717] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adGMzmFGQVn8Q0ueB251rwAAAQQ"]
[Sun Apr 05 06:12:32.237081 2026] [:error] [pid 45305:tid 45376] [client 20.151.201.236:63468] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adGM0OjDQjr7aWhjflAnyAAAAIU"]
[Sun Apr 05 06:12:33.966446 2026] [:error] [pid 45409:tid 45422] [client 20.151.201.236:58414] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/themes.php"] [unique_id "adGM0dHt_Oyw03gjCNjYOwAAAMs"]
[Sun Apr 05 06:12:35.082117 2026] [:error] [pid 45409:tid 45416] [client 20.151.201.236:56806] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adGM09Ht_Oyw03gjCNjYQAAAAMU"]
[Sun Apr 05 06:12:35.996626 2026] [:error] [pid 45305:tid 45391] [client 20.151.201.236:57755] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adGM0-jDQjr7aWhjflAn3QAAAJQ"]
[Sun Apr 05 06:12:39.141518 2026] [:error] [pid 30921:tid 30929] [client 20.151.201.236:57681] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adGM12FGQVn8Q0ueB251wAAAAQY"]
[Sun Apr 05 06:12:42.618818 2026] [:error] [pid 45409:tid 45415] [client 20.151.201.236:54203] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adGM2tHt_Oyw03gjCNjYVQAAAMQ"]
[Sun Apr 05 06:12:45.073627 2026] [:error] [pid 45303:tid 45325] [client 20.151.201.236:57699] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adGM3bboQ9eViZ4hdnmK6AAAAAg"]
[Sun Apr 05 06:12:47.444337 2026] [:error] [pid 45303:tid 45333] [client 20.151.201.236:63287] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adGM37boQ9eViZ4hdnmK7AAAABA"]
[Sun Apr 05 06:12:48.363851 2026] [:error] [pid 45304:tid 45354] [client 20.151.201.236:63510] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adGM4A5jnqDKKovdRkkMkwAAAEo"]
[Sun Apr 05 06:12:49.970203 2026] [:error] [pid 45305:tid 45375] [client 20.151.201.236:54242] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp.php"] [unique_id "adGM4ejDQjr7aWhjflAoBgAAAIQ"]
[Sun Apr 05 06:12:51.957583 2026] [:error] [pid 45409:tid 45434] [client 20.151.201.236:58387] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "adGM49Ht_Oyw03gjCNjYbwAAANc"]
[Sun Apr 05 06:12:55.295575 2026] [:error] [pid 45409:tid 45428] [client 20.151.201.236:57759] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "adGM59Ht_Oyw03gjCNjYdwAAANE"]
[Sun Apr 05 06:12:58.746631 2026] [:error] [pid 45305:tid 45384] [client 20.151.201.236:56763] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/network.php"] [unique_id "adGM6ujDQjr7aWhjflAoLgAAAI0"]
[Sun Apr 05 06:13:02.784914 2026] [proxy_fcgi:error] [pid 45304:tid 45355] [client 20.151.201.236:50483] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:13:03.199864 2026] [proxy_fcgi:error] [pid 45304:tid 45344] [client 20.151.201.236:50483] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:13:04.141469 2026] [proxy_fcgi:error] [pid 45304:tid 45368] [client 20.151.201.236:50483] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:13:04.347718 2026] [:error] [pid 45304:tid 45353] [client 20.151.201.236:50483] [client 20.151.201.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.201.236, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "adGM8A5jnqDKKovdRkkMqQAAAEk"]
[Sun Apr 05 06:13:04.772267 2026] [:error] [pid 45304:tid 45361] [client 20.151.201.236:50483] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adGM8A5jnqDKKovdRkkMqwAAAFE"]
[Sun Apr 05 06:13:06.916966 2026] [proxy_fcgi:error] [pid 30921:tid 30941] [client 20.151.201.236:54243] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:13:07.127130 2026] [proxy_fcgi:error] [pid 30921:tid 30931] [client 20.151.201.236:54243] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:13:07.363434 2026] [:error] [pid 30921:tid 30935] [client 20.151.201.236:54243] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "adGM82FGQVn8Q0ueB251-gAAAQw"]
[Sun Apr 05 06:13:08.775159 2026] [:error] [pid 45305:tid 45381] [client 20.151.201.236:57596] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "adGM9OjDQjr7aWhjflAoSgAAAIo"]
[Sun Apr 05 06:13:10.173022 2026] [:error] [pid 45304:tid 45366] [client 20.151.201.236:47665] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "adGM9g5jnqDKKovdRkkMswAAAFY"]
[Sun Apr 05 06:13:11.644455 2026] [:error] [pid 45305:tid 45371] [client 20.151.201.236:54216] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "adGM9-jDQjr7aWhjflAoWgAAAIA"]
[Sun Apr 05 06:13:13.509486 2026] [:error] [pid 45305:tid 45386] [client 20.151.201.236:54240] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adGM-ejDQjr7aWhjflAoaQAAAI8"]
[Sun Apr 05 06:13:15.160174 2026] [:error] [pid 30921:tid 30944] [client 20.151.201.236:63482] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adGM-2FGQVn8Q0ueB252DgAAARU"]
[Sun Apr 05 06:13:16.335695 2026] [:error] [pid 45304:tid 45349] [client 20.151.201.236:63456] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adGM_A5jnqDKKovdRkkMvQAAAEU"]
[Sun Apr 05 06:13:20.905162 2026] [:error] [pid 45305:tid 45383] [client 20.151.201.236:63522] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adGNAOjDQjr7aWhjflAoiwAAAIw"]
[Sun Apr 05 06:13:26.248195 2026] [:error] [pid 45305:tid 45394] [client 20.151.201.236:58446] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "adGNBujDQjr7aWhjflAokgAAAJc"]
[Sun Apr 05 06:13:28.751159 2026] [:error] [pid 45409:tid 45414] [client 20.151.201.236:54222] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "adGNCNHt_Oyw03gjCNjY0gAAAMM"]
[Sun Apr 05 06:13:30.014429 2026] [:error] [pid 45304:tid 45361] [client 20.151.201.236:63478] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "adGNCg5jnqDKKovdRkkM2gAAAFE"]
[Sun Apr 05 06:13:31.013034 2026] [:error] [pid 45305:tid 45383] [client 20.151.201.236:56771] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "adGNC-jDQjr7aWhjflAomQAAAIw"]
[Sun Apr 05 06:13:32.078220 2026] [:error] [pid 45409:tid 45434] [client 20.151.201.236:63454] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adGNDNHt_Oyw03gjCNjY3AAAANc"]
[Sun Apr 05 06:13:33.253747 2026] [:error] [pid 45303:tid 45327] [client 20.151.201.236:54239] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adGNDbboQ9eViZ4hdnmLKQAAAAo"]
[Sun Apr 05 06:13:35.640922 2026] [:error] [pid 30921:tid 30932] [client 20.151.201.236:57728] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adGND2FGQVn8Q0ueB252PQAAAQk"]
[Sun Apr 05 06:13:38.156940 2026] [:error] [pid 45409:tid 45412] [client 20.151.201.236:57585] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adGNEtHt_Oyw03gjCNjY8AAAAME"]
[Sun Apr 05 06:13:38.849951 2026] [:error] [pid 45305:tid 45381] [client 20.151.201.236:56790] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/users.php"] [unique_id "adGNEujDQjr7aWhjflAopQAAAIo"]
[Sun Apr 05 06:13:39.302703 2026] [:error] [pid 45304:tid 45358] [client 20.151.201.236:58359] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/users.php"] [unique_id "adGNEw5jnqDKKovdRkkM6wAAAE4"]
[Sun Apr 05 06:13:40.672459 2026] [:error] [pid 45304:tid 45361] [client 20.151.201.236:58460] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/users.php"] [unique_id "adGNFA5jnqDKKovdRkkM8AAAAFE"]
[Sun Apr 05 06:13:42.730121 2026] [:error] [pid 30921:tid 30928] [client 20.151.201.236:54220] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/users.php"] [unique_id "adGNFmFGQVn8Q0ueB252VQAAAQU"]
[Sun Apr 05 06:13:44.265457 2026] [:error] [pid 45409:tid 45417] [client 20.151.201.236:58434] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/index.php"] [unique_id "adGNGNHt_Oyw03gjCNjZAAAAAMY"]
[Sun Apr 05 06:13:45.532145 2026] [:error] [pid 45303:tid 45321] [client 20.151.201.236:63506] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/index.php"] [unique_id "adGNGbboQ9eViZ4hdnmLPAAAAAQ"]
[Sun Apr 05 06:13:49.202501 2026] [:error] [pid 45304:tid 45352] [client 20.151.201.236:63452] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/index.php"] [unique_id "adGNHQ5jnqDKKovdRkkM_AAAAEg"]
[Sun Apr 05 06:13:50.126770 2026] [:error] [pid 30921:tid 30927] [client 20.151.201.236:56911] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/index.php"] [unique_id "adGNHmFGQVn8Q0ueB252cgAAAQQ"]
[Sun Apr 05 06:13:50.918961 2026] [:error] [pid 30921:tid 30928] [client 20.151.201.236:63276] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adGNHmFGQVn8Q0ueB252egAAAQU"]
[Sun Apr 05 06:13:54.377565 2026] [:error] [pid 45303:tid 45322] [client 20.151.201.236:49606] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "adGNIrboQ9eViZ4hdnmLSgAAAAU"]
[Sun Apr 05 06:13:56.085213 2026] [:error] [pid 45305:tid 45372] [client 20.151.201.236:58354] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "adGNJOjDQjr7aWhjflAoyQAAAIE"]
[Sun Apr 05 06:13:56.870966 2026] [:error] [pid 30921:tid 30943] [client 20.151.201.236:50547] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "adGNJGFGQVn8Q0ueB252mwAAARQ"]
[Sun Apr 05 06:13:57.958689 2026] [:error] [pid 45303:tid 45340] [client 20.151.201.236:54263] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.php"] [unique_id "adGNJbboQ9eViZ4hdnmLTQAAABc"]
[Sun Apr 05 06:14:00.200904 2026] [:error] [pid 45305:tid 45380] [client 20.151.201.236:63426] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/fm.php"] [unique_id "adGNKOjDQjr7aWhjflAo2wAAAIk"]
[Sun Apr 05 06:14:01.498550 2026] [:error] [pid 45305:tid 45372] [client 20.151.201.236:56924] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/fm.php"] [unique_id "adGNKejDQjr7aWhjflAo4gAAAIE"]
[Sun Apr 05 06:14:03.539967 2026] [:error] [pid 45409:tid 45423] [client 20.151.201.236:54231] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/fm.php"] [unique_id "adGNK9Ht_Oyw03gjCNjZHQAAAMw"]
[Sun Apr 05 06:14:05.895304 2026] [:error] [pid 45305:tid 45373] [client 20.151.201.236:58447] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/js/fm.php"] [unique_id "adGNLejDQjr7aWhjflAo_AAAAII"]
[Sun Apr 05 06:14:08.015888 2026] [:error] [pid 30921:tid 30945] [client 20.151.201.236:57686] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/network.php"] [unique_id "adGNMGFGQVn8Q0ueB252tgAAARY"]
[Sun Apr 05 06:14:09.391792 2026] [proxy_fcgi:error] [pid 45409:tid 45432] [client 20.151.201.236:56927] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:14:09.815690 2026] [proxy_fcgi:error] [pid 45409:tid 45429] [client 20.151.201.236:56927] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:14:10.888912 2026] [proxy_fcgi:error] [pid 45409:tid 45435] [client 20.151.201.236:56927] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:14:11.094331 2026] [:error] [pid 45409:tid 45423] [client 20.151.201.236:56927] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adGNM9Ht_Oyw03gjCNjZOAAAAMw"]
[Sun Apr 05 06:14:14.030618 2026] [:error] [pid 30921:tid 30927] [client 20.151.201.236:63431] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "adGNNmFGQVn8Q0ueB2520QAAAQQ"]
[Sun Apr 05 06:14:17.637909 2026] [proxy_fcgi:error] [pid 45409:tid 45417] [client 20.151.201.236:58353] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:14:17.846563 2026] [proxy_fcgi:error] [pid 45409:tid 45411] [client 20.151.201.236:58353] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 06:14:18.050966 2026] [:error] [pid 45409:tid 45429] [client 20.151.201.236:58353] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "adGNOtHt_Oyw03gjCNjZSAAAANI"]
[Sun Apr 05 06:14:21.712396 2026] [:error] [pid 45409:tid 45419] [client 20.151.201.236:63467] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/about.php"] [unique_id "adGNPdHt_Oyw03gjCNjZVwAAAMg"]
[Sun Apr 05 06:14:24.206182 2026] [:error] [pid 45305:tid 45384] [client 20.151.201.236:57737] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "adGNQOjDQjr7aWhjflApNQAAAI0"]
[Sun Apr 05 06:14:28.441480 2026] [:error] [pid 45305:tid 45390] [client 20.151.201.236:58445] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "adGNROjDQjr7aWhjflApQAAAAJM"]
[Sun Apr 05 06:14:30.498399 2026] [:error] [pid 45305:tid 45389] [client 20.151.201.236:56736] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "adGNRujDQjr7aWhjflApTwAAAJI"]
[Sun Apr 05 06:14:42.166687 2026] [:error] [pid 45303:tid 45340] [client 20.151.201.236:57675] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adGNUrboQ9eViZ4hdnmLlAAAABc"]
[Sun Apr 05 06:14:48.892823 2026] [:error] [pid 45409:tid 45411] [client 20.151.201.236:63434] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adGNWNHt_Oyw03gjCNjZrQAAAMA"]
[Sun Apr 05 06:14:52.097683 2026] [:error] [pid 45305:tid 45378] [client 20.151.201.236:63505] [client 20.151.201.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-conflg.php"] [unique_id "adGNXOjDQjr7aWhjflApwQAAAIc"]
[Sun Apr 05 06:25:02.886295 2026] [:error] [pid 45305:tid 45381] [client 104.28.157.23:23968] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adGPvujDQjr7aWhjflA0dQAAAIo"]
[Sun Apr 05 06:25:07.037260 2026] [:error] [pid 45409:tid 45423] [client 104.28.157.23:23970] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adGPw9Ht_Oyw03gjCNjhvgAAAMw"]
[Sun Apr 05 06:25:12.653618 2026] [:error] [pid 45305:tid 45394] [client 104.28.157.23:24217] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adGPyOjDQjr7aWhjflA0pQAAAJc"]
[Sun Apr 05 06:25:16.358485 2026] [:error] [pid 30921:tid 30926] [client 104.28.157.23:23991] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adGPzGFGQVn8Q0ueB2594wAAAQM"]
[Sun Apr 05 06:25:19.848155 2026] [:error] [pid 45409:tid 45431] [client 104.28.157.23:22702] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adGPz9Ht_Oyw03gjCNjh1wAAANQ"]
[Sun Apr 05 06:25:24.169963 2026] [:error] [pid 45409:tid 45427] [client 104.28.157.23:22707] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adGP1NHt_Oyw03gjCNjh6QAAANA"]
[Sun Apr 05 06:25:28.768534 2026] [:error] [pid 45304:tid 45350] [client 104.28.157.23:22714] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adGP2A5jnqDKKovdRkkQmgAAAEY"]
[Sun Apr 05 06:25:34.558508 2026] [:error] [pid 30921:tid 30924] [client 104.28.157.23:23800] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adGP3mFGQVn8Q0ueB25-EAAAAQE"]
[Sun Apr 05 06:25:38.479243 2026] [:error] [pid 45409:tid 45414] [client 104.28.157.23:23808] [client 104.28.157.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adGP4tHt_Oyw03gjCNjiOAAAAMM"]
[Sun Apr 05 06:26:43.969323 2026] [:error] [pid 45305:tid 45381] [client 104.28.157.24:11513] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "adGQI-jDQjr7aWhjflA1xQAAAIo"]
[Sun Apr 05 06:26:48.818393 2026] [:error] [pid 45409:tid 45418] [client 104.28.157.24:11067] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adGQKNHt_Oyw03gjCNjjWQAAAMc"]
[Sun Apr 05 06:26:54.414021 2026] [:error] [pid 30921:tid 30930] [client 104.28.157.24:11515] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adGQLmFGQVn8Q0ueB25-9gAAAQc"]
[Sun Apr 05 06:26:58.311710 2026] [:error] [pid 30921:tid 30947] [client 104.28.157.24:10756] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adGQMmFGQVn8Q0ueB25-_wAAARg"]
[Sun Apr 05 06:27:01.704634 2026] [:error] [pid 45305:tid 45378] [client 104.28.157.24:11401] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adGQNejDQjr7aWhjflA2FgAAAIc"]
[Sun Apr 05 06:27:09.285412 2026] [:error] [pid 45305:tid 45390] [client 104.28.157.24:11272] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adGQPejDQjr7aWhjflA2OQAAAJM"]
[Sun Apr 05 06:27:13.447514 2026] [:error] [pid 45305:tid 45371] [client 104.28.157.24:11280] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adGQQejDQjr7aWhjflA2UQAAAIA"]
[Sun Apr 05 06:27:18.280913 2026] [:error] [pid 45305:tid 45372] [client 104.28.157.24:11172] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adGQRujDQjr7aWhjflA2cQAAAIE"]
[Sun Apr 05 06:27:23.418842 2026] [:error] [pid 45305:tid 45390] [client 104.28.157.24:11173] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adGQS-jDQjr7aWhjflA2gwAAAJM"]
[Sun Apr 05 06:27:28.474423 2026] [:error] [pid 30921:tid 30946] [client 104.28.157.24:9359] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adGQUGFGQVn8Q0ueB25_OAAAARc"]
[Sun Apr 05 06:27:32.021643 2026] [:error] [pid 45303:tid 45329] [client 104.28.157.24:9643] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adGQVLboQ9eViZ4hdnmRRQAAAAw"]
[Sun Apr 05 06:27:36.921040 2026] [:error] [pid 30921:tid 30936] [client 104.28.157.24:10401] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adGQWGFGQVn8Q0ueB25_rQAAAQ0"]
[Sun Apr 05 06:28:19.513904 2026] [:error] [pid 45409:tid 45416] [client 104.28.157.24:11179] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adGQg9Ht_Oyw03gjCNjkqAAAAMU"]
[Sun Apr 05 06:28:23.227228 2026] [:error] [pid 45305:tid 45383] [client 104.28.157.24:9996] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adGQh-jDQjr7aWhjflA3jgAAAIw"]
[Sun Apr 05 06:28:26.552298 2026] [:error] [pid 45303:tid 45332] [client 104.28.157.24:9999] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adGQirboQ9eViZ4hdnmR5QAAAA8"]
[Sun Apr 05 06:28:30.145425 2026] [:error] [pid 45409:tid 45434] [client 104.28.157.24:10005] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adGQjtHt_Oyw03gjCNjkzQAAANc"]
[Sun Apr 05 06:28:33.133311 2026] [:error] [pid 30921:tid 30947] [client 104.28.157.24:9234] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adGQkWFGQVn8Q0ueB26AQgAAARg"]
[Sun Apr 05 06:28:36.611580 2026] [:error] [pid 45303:tid 45318] [client 104.28.157.24:9241] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adGQlLboQ9eViZ4hdnmR_AAAAAE"]
[Sun Apr 05 06:28:40.684866 2026] [:error] [pid 30921:tid 30931] [client 104.28.157.24:9780] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adGQmGFGQVn8Q0ueB26AUwAAAQg"]
[Sun Apr 05 06:28:43.834543 2026] [:error] [pid 30921:tid 30939] [client 104.28.157.24:9948] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adGQm2FGQVn8Q0ueB26AWAAAARA"]
[Sun Apr 05 06:28:47.709322 2026] [:error] [pid 30921:tid 30929] [client 104.28.157.24:9952] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adGQn2FGQVn8Q0ueB26AaAAAAQY"]
[Sun Apr 05 06:28:52.542116 2026] [:error] [pid 45303:tid 45321] [client 104.28.157.24:11201] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adGQpLboQ9eViZ4hdnmSIwAAAAQ"]
[Sun Apr 05 06:28:56.786033 2026] [:error] [pid 45305:tid 45377] [client 104.28.157.24:10150] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adGQqOjDQjr7aWhjflA37QAAAIY"]
[Sun Apr 05 06:29:00.342118 2026] [:error] [pid 30921:tid 30941] [client 104.28.157.24:10155] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adGQrGFGQVn8Q0ueB26AhgAAARI"]
[Sun Apr 05 06:29:04.488918 2026] [:error] [pid 45305:tid 45386] [client 104.28.157.24:10102] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adGQsOjDQjr7aWhjflA4EAAAAI8"]
[Sun Apr 05 06:29:08.065064 2026] [:error] [pid 45409:tid 45421] [client 104.28.157.24:10106] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adGQtNHt_Oyw03gjCNjlOQAAAMo"]
[Sun Apr 05 06:29:11.040851 2026] [:error] [pid 30921:tid 30934] [client 104.28.157.24:10109] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adGQt2FGQVn8Q0ueB26AlgAAAQs"]
[Sun Apr 05 06:29:15.891420 2026] [:error] [pid 45409:tid 45423] [client 104.28.157.24:10510] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adGQu9Ht_Oyw03gjCNjlUwAAAMw"]
[Sun Apr 05 06:30:03.869377 2026] [:error] [pid 45304:tid 45350] [client 104.28.157.24:10124] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adGQ6w5jnqDKKovdRkkSLgAAAEY"]
[Sun Apr 05 06:30:06.658490 2026] [:error] [pid 45305:tid 45391] [client 104.28.157.24:11674] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adGQ7ujDQjr7aWhjflA48QAAAJQ"]
[Sun Apr 05 06:30:10.776593 2026] [:error] [pid 45305:tid 45380] [client 104.28.157.24:10128] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adGQ8ujDQjr7aWhjflA4_QAAAIk"]
[Sun Apr 05 06:30:13.627488 2026] [:error] [pid 30921:tid 30926] [client 104.28.157.24:9992] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adGQ9WFGQVn8Q0ueB26BJQAAAQM"]
[Sun Apr 05 06:30:18.405223 2026] [:error] [pid 45305:tid 45393] [client 104.28.157.24:10304] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adGQ-ujDQjr7aWhjflA5HwAAAJY"]
[Sun Apr 05 06:30:23.022084 2026] [:error] [pid 30921:tid 30939] [client 104.28.157.24:10310] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adGQ_2FGQVn8Q0ueB26BMAAAARA"]
[Sun Apr 05 06:30:27.897545 2026] [:error] [pid 30921:tid 30927] [client 104.28.157.24:11414] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adGRA2FGQVn8Q0ueB26BRgAAAQQ"]
[Sun Apr 05 06:30:30.438508 2026] [:error] [pid 45305:tid 45393] [client 104.28.157.24:10966] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adGRBujDQjr7aWhjflA5QwAAAJY"]
[Sun Apr 05 06:30:34.524985 2026] [:error] [pid 45304:tid 45346] [client 104.28.157.24:10882] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adGRCg5jnqDKKovdRkkSUQAAAEI"]
[Sun Apr 05 06:30:40.997574 2026] [:error] [pid 45304:tid 45360] [client 104.28.157.24:10884] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adGREA5jnqDKKovdRkkSYwAAAFA"]
[Sun Apr 05 06:30:43.509856 2026] [:error] [pid 45303:tid 45325] [client 104.28.157.24:9815] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adGRE7boQ9eViZ4hdnmSwwAAAAg"]
[Sun Apr 05 06:30:45.959432 2026] [:error] [pid 45303:tid 45332] [client 104.28.157.24:9822] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adGRFbboQ9eViZ4hdnmSyQAAAA8"]
[Sun Apr 05 06:30:50.116875 2026] [:error] [pid 45305:tid 45390] [client 104.28.157.24:9268] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adGRGujDQjr7aWhjflA5bwAAAJM"]
[Sun Apr 05 06:30:54.560540 2026] [:error] [pid 45303:tid 45323] [client 104.28.157.24:10012] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adGRHrboQ9eViZ4hdnmS4QAAAAY"]
[Sun Apr 05 06:30:58.240715 2026] [:error] [pid 45305:tid 45373] [client 104.28.157.24:10015] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adGRIujDQjr7aWhjflA5gQAAAII"]
[Sun Apr 05 06:31:33.151864 2026] [:error] [pid 45305:tid 45373] [client 104.28.157.24:11173] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adGRRejDQjr7aWhjflA6FgAAAII"]
[Sun Apr 05 06:31:37.042538 2026] [:error] [pid 45304:tid 45367] [client 104.28.157.24:10001] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adGRSQ5jnqDKKovdRkkSzAAAAFc"]
[Sun Apr 05 06:31:40.596062 2026] [:error] [pid 45409:tid 45425] [client 104.28.157.24:10006] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adGRTNHt_Oyw03gjCNjmpwAAAM4"]
[Sun Apr 05 06:31:44.500101 2026] [:error] [pid 45305:tid 45379] [client 104.28.157.24:9777] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adGRUOjDQjr7aWhjflA6JwAAAIg"]
[Sun Apr 05 06:31:48.906709 2026] [:error] [pid 45304:tid 45355] [client 104.28.157.24:9778] [client 104.28.157.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adGRVA5jnqDKKovdRkkS7gAAAEs"]
[Sun Apr 05 07:03:16.773999 2026] [proxy_fcgi:error] [pid 45305:tid 45384] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:17.042522 2026] [proxy_fcgi:error] [pid 45305:tid 45393] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:17.309667 2026] [proxy_fcgi:error] [pid 45305:tid 45391] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:17.576901 2026] [proxy_fcgi:error] [pid 45305:tid 45387] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:18.042624 2026] [proxy_fcgi:error] [pid 45305:tid 45375] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:18.311199 2026] [proxy_fcgi:error] [pid 45305:tid 45376] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:18.583169 2026] [proxy_fcgi:error] [pid 45305:tid 45381] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:18.893598 2026] [proxy_fcgi:error] [pid 45305:tid 45393] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:20.360595 2026] [proxy_fcgi:error] [pid 45305:tid 45392] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:20.635625 2026] [proxy_fcgi:error] [pid 45305:tid 45372] [client 4.225.160.61:65098] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:03:20.919962 2026] [:error] [pid 45305:tid 45374] [client 4.225.160.61:65098] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adGYuOjDQjr7aWhjflBTIQAAAIM"]
[Sun Apr 05 07:03:21.850515 2026] [:error] [pid 30921:tid 30947] [client 4.225.160.61:6649] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adGYuWFGQVn8Q0ueB26OHQAAARg"]
[Sun Apr 05 07:03:22.760840 2026] [:error] [pid 45303:tid 45317] [client 4.225.160.61:51429] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adGYurboQ9eViZ4hdnmc6QAAAAA"]
[Sun Apr 05 07:03:23.397838 2026] [:error] [pid 45305:tid 45379] [client 4.225.160.61:54318] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adGYu-jDQjr7aWhjflBTKwAAAIg"]
[Sun Apr 05 07:03:24.255270 2026] [:error] [pid 45409:tid 45430] [client 4.225.160.61:51438] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adGYvNHt_Oyw03gjCNj4GwAAANM"]
[Sun Apr 05 07:03:24.874283 2026] [:error] [pid 45409:tid 45419] [client 4.225.160.61:54331] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adGYvNHt_Oyw03gjCNj4IAAAAMg"]
[Sun Apr 05 07:03:25.549661 2026] [:error] [pid 45305:tid 45394] [client 4.225.160.61:37501] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adGYvejDQjr7aWhjflBTMAAAAJc"]
[Sun Apr 05 07:03:26.138567 2026] [:error] [pid 45304:tid 45363] [client 4.225.160.61:41184] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adGYvg5jnqDKKovdRkkbWgAAAFM"]
[Sun Apr 05 07:03:26.677099 2026] [:error] [pid 45304:tid 45353] [client 4.225.160.61:32495] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adGYvg5jnqDKKovdRkkbXAAAAEk"]
[Sun Apr 05 07:03:27.265649 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:65058] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adGYv-jDQjr7aWhjflBTNAAAAJI"]
[Sun Apr 05 07:03:27.918175 2026] [:error] [pid 30921:tid 30937] [client 4.225.160.61:54316] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adGYv2FGQVn8Q0ueB26OJwAAAQ4"]
[Sun Apr 05 07:03:28.504957 2026] [:error] [pid 45305:tid 45379] [client 4.225.160.61:51455] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adGYwOjDQjr7aWhjflBTNgAAAIg"]
[Sun Apr 05 07:03:29.327841 2026] [:error] [pid 45409:tid 45423] [client 4.225.160.61:33004] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGYwdHt_Oyw03gjCNj4LAAAAMw"]
[Sun Apr 05 07:03:29.955453 2026] [:error] [pid 45305:tid 45384] [client 4.225.160.61:46811] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGYwejDQjr7aWhjflBTOQAAAI0"]
[Sun Apr 05 07:03:30.748697 2026] [:error] [pid 30921:tid 30946] [client 4.225.160.61:33023] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGYwmFGQVn8Q0ueB26OKgAAARc"]
[Sun Apr 05 07:03:31.370933 2026] [:error] [pid 30921:tid 30936] [client 4.225.160.61:51418] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adGYw2FGQVn8Q0ueB26OLwAAAQ0"]
[Sun Apr 05 07:03:32.138543 2026] [:error] [pid 45303:tid 45331] [client 4.225.160.61:37478] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adGYxLboQ9eViZ4hdnmc9AAAAA4"]
[Sun Apr 05 07:03:32.805972 2026] [:error] [pid 45409:tid 45414] [client 4.225.160.61:6595] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adGYxNHt_Oyw03gjCNj4MgAAAMM"]
[Sun Apr 05 07:03:33.557901 2026] [:error] [pid 45409:tid 45419] [client 4.225.160.61:32474] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adGYxdHt_Oyw03gjCNj4NAAAAMg"]
[Sun Apr 05 07:03:34.385166 2026] [:error] [pid 45409:tid 45435] [client 4.225.160.61:6239] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adGYxtHt_Oyw03gjCNj4OAAAANg"]
[Sun Apr 05 07:03:35.003708 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:6624] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGYx7boQ9eViZ4hdnmc-AAAABY"]
[Sun Apr 05 07:03:35.828325 2026] [:error] [pid 45303:tid 45330] [client 4.225.160.61:46840] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGYx7boQ9eViZ4hdnmc_AAAAA0"]
[Sun Apr 05 07:03:37.011361 2026] [:error] [pid 45303:tid 45326] [client 4.225.160.61:32452] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGYybboQ9eViZ4hdnmdAQAAAAk"]
[Sun Apr 05 07:03:37.720197 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:6630] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adGYyejDQjr7aWhjflBTQQAAAJY"]
[Sun Apr 05 07:03:38.530717 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:32500] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "adGYyujDQjr7aWhjflBTRQAAAJU"]
[Sun Apr 05 07:03:39.329087 2026] [:error] [pid 45305:tid 45386] [client 4.225.160.61:39572] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "adGYy-jDQjr7aWhjflBTTAAAAI8"]
[Sun Apr 05 07:03:40.187554 2026] [:error] [pid 45305:tid 45395] [client 4.225.160.61:48788] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "adGYzOjDQjr7aWhjflBTUQAAAJg"]
[Sun Apr 05 07:03:40.980822 2026] [:error] [pid 45305:tid 45376] [client 4.225.160.61:41186] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "adGYzOjDQjr7aWhjflBTVgAAAIU"]
[Sun Apr 05 07:03:41.898946 2026] [:error] [pid 45409:tid 45416] [client 4.225.160.61:35118] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8daf1238_1774208172.php"] [unique_id "adGYzdHt_Oyw03gjCNj4QAAAAMU"]
[Sun Apr 05 07:03:42.636724 2026] [:error] [pid 45409:tid 45418] [client 4.225.160.61:65174] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8daf1238_1774208172.php"] [unique_id "adGYztHt_Oyw03gjCNj4QQAAAMc"]
[Sun Apr 05 07:03:43.486888 2026] [:error] [pid 45409:tid 45432] [client 4.225.160.61:33011] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8daf1238_1774208172.php"] [unique_id "adGYz9Ht_Oyw03gjCNj4RQAAANU"]
[Sun Apr 05 07:03:44.585922 2026] [:error] [pid 45305:tid 45380] [client 4.225.160.61:37485] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8daf1238_1774208172.php"] [unique_id "adGY0OjDQjr7aWhjflBTYwAAAIk"]
[Sun Apr 05 07:03:45.426497 2026] [:error] [pid 30921:tid 30939] [client 4.225.160.61:47971] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adGY0WFGQVn8Q0ueB26OQQAAARA"]
[Sun Apr 05 07:03:46.615819 2026] [:error] [pid 45409:tid 45427] [client 4.225.160.61:48803] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adGY0tHt_Oyw03gjCNj4SwAAANA"]
[Sun Apr 05 07:03:48.347626 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:61167] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adGY1LboQ9eViZ4hdnmdEwAAABY"]
[Sun Apr 05 07:03:49.098429 2026] [:error] [pid 45409:tid 45428] [client 4.225.160.61:47975] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adGY1dHt_Oyw03gjCNj4UQAAANE"]
[Sun Apr 05 07:03:49.864985 2026] [:error] [pid 45409:tid 45429] [client 4.225.160.61:35109] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adGY1dHt_Oyw03gjCNj4WQAAANI"]
[Sun Apr 05 07:03:50.786129 2026] [:error] [pid 30921:tid 30924] [client 4.225.160.61:54301] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adGY1mFGQVn8Q0ueB26ORwAAAQE"]
[Sun Apr 05 07:03:51.466494 2026] [:error] [pid 30921:tid 30938] [client 4.225.160.61:62872] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adGY12FGQVn8Q0ueB26OSQAAAQ8"]
[Sun Apr 05 07:03:52.139547 2026] [:error] [pid 30921:tid 30930] [client 4.225.160.61:55452] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adGY2GFGQVn8Q0ueB26OSgAAAQc"]
[Sun Apr 05 07:03:53.761809 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:62869] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adGY2WFGQVn8Q0ueB26OUAAAAQg"]
[Sun Apr 05 07:03:54.628305 2026] [:error] [pid 30921:tid 30924] [client 4.225.160.61:35075] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adGY2mFGQVn8Q0ueB26OVQAAAQE"]
[Sun Apr 05 07:03:55.707879 2026] [:error] [pid 45304:tid 45364] [client 4.225.160.61:32973] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adGY2w5jnqDKKovdRkkbcAAAAFQ"]
[Sun Apr 05 07:03:56.318903 2026] [:error] [pid 45305:tid 45388] [client 4.225.160.61:48770] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adGY3OjDQjr7aWhjflBTbgAAAJE"]
[Sun Apr 05 07:03:56.994743 2026] [:error] [pid 30921:tid 30925] [client 4.225.160.61:65038] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adGY3GFGQVn8Q0ueB26OWQAAAQI"]
[Sun Apr 05 07:03:57.820404 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:35121] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adGY3ejDQjr7aWhjflBTcAAAAJU"]
[Sun Apr 05 07:03:58.495346 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:47942] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adGY3ujDQjr7aWhjflBTcgAAAIY"]
[Sun Apr 05 07:03:59.467190 2026] [:error] [pid 45409:tid 45422] [client 4.225.160.61:37481] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adGY39Ht_Oyw03gjCNj4cAAAAMs"]
[Sun Apr 05 07:04:00.193007 2026] [:error] [pid 45304:tid 45365] [client 4.225.160.61:59184] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adGY4A5jnqDKKovdRkkbeAAAAFU"]
[Sun Apr 05 07:04:01.247294 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:62029] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adGY4ejDQjr7aWhjflBTdQAAAJY"]
[Sun Apr 05 07:04:03.314130 2026] [:error] [pid 45409:tid 45417] [client 4.225.160.61:47948] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adGY49Ht_Oyw03gjCNj4eQAAAMY"]
[Sun Apr 05 07:04:04.289259 2026] [:error] [pid 45303:tid 45322] [client 4.225.160.61:61139] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adGY5LboQ9eViZ4hdnmdHgAAAAU"]
[Sun Apr 05 07:04:05.117427 2026] [:error] [pid 45303:tid 45323] [client 4.225.160.61:62878] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adGY5bboQ9eViZ4hdnmdHwAAAAY"]
[Sun Apr 05 07:04:05.900165 2026] [:error] [pid 45303:tid 45334] [client 4.225.160.61:50247] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adGY5bboQ9eViZ4hdnmdIQAAABE"]
[Sun Apr 05 07:04:06.624424 2026] [:error] [pid 45409:tid 45422] [client 4.225.160.61:62028] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adGY5tHt_Oyw03gjCNj4fAAAAMs"]
[Sun Apr 05 07:04:07.861665 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:55433] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adGY5-jDQjr7aWhjflBThwAAAIA"]
[Sun Apr 05 07:04:08.961356 2026] [:error] [pid 45409:tid 45418] [client 4.225.160.61:32898] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adGY6NHt_Oyw03gjCNj4fwAAAMc"]
[Sun Apr 05 07:04:09.676405 2026] [:error] [pid 45409:tid 45432] [client 4.225.160.61:59103] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adGY6dHt_Oyw03gjCNj4gQAAANU"]
[Sun Apr 05 07:04:10.716823 2026] [:error] [pid 45303:tid 45325] [client 4.225.160.61:62344] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adGY6rboQ9eViZ4hdnmdKwAAAAg"]
[Sun Apr 05 07:04:11.313769 2026] [:error] [pid 45409:tid 45415] [client 4.225.160.61:62384] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adGY69Ht_Oyw03gjCNj4hQAAAMQ"]
[Sun Apr 05 07:04:12.262133 2026] [:error] [pid 30921:tid 30929] [client 4.225.160.61:32897] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adGY7GFGQVn8Q0ueB26ObwAAAQY"]
[Sun Apr 05 07:04:13.237197 2026] [:error] [pid 30921:tid 30934] [client 4.225.160.61:50283] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adGY7WFGQVn8Q0ueB26OcAAAAQs"]
[Sun Apr 05 07:04:14.084717 2026] [:error] [pid 30921:tid 30940] [client 4.225.160.61:47941] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adGY7mFGQVn8Q0ueB26OdAAAARE"]
[Sun Apr 05 07:04:14.925422 2026] [:error] [pid 45303:tid 45340] [client 4.225.160.61:62056] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adGY7rboQ9eViZ4hdnmdMAAAABc"]
[Sun Apr 05 07:04:15.502051 2026] [:error] [pid 45304:tid 45350] [client 4.225.160.61:59136] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adGY7w5jnqDKKovdRkkbhAAAAEY"]
[Sun Apr 05 07:04:16.261471 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:32948] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adGY8GFGQVn8Q0ueB26OdgAAAQg"]
[Sun Apr 05 07:04:16.988088 2026] [:error] [pid 45303:tid 45330] [client 4.225.160.61:61553] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adGY8LboQ9eViZ4hdnmdMgAAAA0"]
[Sun Apr 05 07:04:17.762756 2026] [:error] [pid 45305:tid 45372] [client 4.225.160.61:36352] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adGY8ejDQjr7aWhjflBToAAAAIE"]
[Sun Apr 05 07:04:18.544735 2026] [:error] [pid 45409:tid 45415] [client 4.225.160.61:48058] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adGY8tHt_Oyw03gjCNj4lAAAAMQ"]
[Sun Apr 05 07:04:19.516522 2026] [:error] [pid 45303:tid 45317] [client 4.225.160.61:62368] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adGY87boQ9eViZ4hdnmdNQAAAAA"]
[Sun Apr 05 07:04:20.371812 2026] [proxy_fcgi:error] [pid 45305:tid 45378] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:20.638363 2026] [proxy_fcgi:error] [pid 45305:tid 45395] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:20.924648 2026] [proxy_fcgi:error] [pid 45305:tid 45373] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:21.191384 2026] [proxy_fcgi:error] [pid 45305:tid 45380] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:21.463776 2026] [proxy_fcgi:error] [pid 45305:tid 45385] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:21.740158 2026] [proxy_fcgi:error] [pid 45305:tid 45377] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:22.071827 2026] [proxy_fcgi:error] [pid 45305:tid 45394] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:22.389541 2026] [proxy_fcgi:error] [pid 45305:tid 45375] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:22.921380 2026] [proxy_fcgi:error] [pid 45305:tid 45389] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:23.194593 2026] [proxy_fcgi:error] [pid 45305:tid 45393] [client 4.225.160.61:36378] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:04:23.457611 2026] [:error] [pid 45305:tid 45391] [client 4.225.160.61:36378] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adGY9-jDQjr7aWhjflBTtAAAAJQ"]
[Sun Apr 05 07:04:24.215392 2026] [:error] [pid 45305:tid 45382] [client 4.225.160.61:56906] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adGY-OjDQjr7aWhjflBTtQAAAIs"]
[Sun Apr 05 07:04:25.117295 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:56310] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adGY-ejDQjr7aWhjflBTtgAAAJM"]
[Sun Apr 05 07:04:25.726194 2026] [:error] [pid 45305:tid 45395] [client 4.225.160.61:60156] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adGY-ejDQjr7aWhjflBTtwAAAJg"]
[Sun Apr 05 07:04:26.511410 2026] [:error] [pid 45304:tid 45368] [client 4.225.160.61:40343] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adGY-g5jnqDKKovdRkkbjQAAAFg"]
[Sun Apr 05 07:04:27.336867 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:36356] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adGY-2FGQVn8Q0ueB26OhAAAAQg"]
[Sun Apr 05 07:04:28.056930 2026] [:error] [pid 45409:tid 45428] [client 4.225.160.61:53566] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adGY_NHt_Oyw03gjCNj4qgAAANE"]
[Sun Apr 05 07:04:28.812877 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:46116] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adGY_LboQ9eViZ4hdnmdSAAAABY"]
[Sun Apr 05 07:04:29.619151 2026] [:error] [pid 45303:tid 45322] [client 4.225.160.61:35615] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adGY_bboQ9eViZ4hdnmdSwAAAAU"]
[Sun Apr 05 07:04:30.523034 2026] [:error] [pid 30921:tid 30941] [client 4.225.160.61:46115] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adGY_mFGQVn8Q0ueB26OhgAAARI"]
[Sun Apr 05 07:04:31.418977 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:64420] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adGY_-jDQjr7aWhjflBTzQAAAJA"]
[Sun Apr 05 07:04:32.614893 2026] [:error] [pid 30921:tid 30935] [client 4.225.160.61:35611] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adGZAGFGQVn8Q0ueB26OiQAAAQw"]
[Sun Apr 05 07:04:33.370038 2026] [:error] [pid 30921:tid 30937] [client 4.225.160.61:59495] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adGZAWFGQVn8Q0ueB26OigAAAQ4"]
[Sun Apr 05 07:04:34.319581 2026] [:error] [pid 45304:tid 45346] [client 4.225.160.61:58701] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adGZAg5jnqDKKovdRkkbmAAAAEI"]
[Sun Apr 05 07:04:34.977121 2026] [:error] [pid 30921:tid 30942] [client 4.225.160.61:58751] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adGZAmFGQVn8Q0ueB26OjAAAARM"]
[Sun Apr 05 07:04:35.717263 2026] [:error] [pid 45303:tid 45333] [client 4.225.160.61:56248] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adGZA7boQ9eViZ4hdnmdYAAAABA"]
[Sun Apr 05 07:04:37.133273 2026] [:error] [pid 45303:tid 45341] [client 4.225.160.61:53516] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adGZBbboQ9eViZ4hdnmdZQAAABg"]
[Sun Apr 05 07:04:37.910319 2026] [:error] [pid 45305:tid 45379] [client 4.225.160.61:6403] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adGZBejDQjr7aWhjflBT3QAAAIg"]
[Sun Apr 05 07:04:38.903294 2026] [:error] [pid 30921:tid 30941] [client 4.225.160.61:53586] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adGZBmFGQVn8Q0ueB26OkwAAARI"]
[Sun Apr 05 07:04:39.662299 2026] [:error] [pid 30921:tid 30939] [client 4.225.160.61:6443] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adGZB2FGQVn8Q0ueB26OlAAAARA"]
[Sun Apr 05 07:04:40.591034 2026] [:error] [pid 30921:tid 30947] [client 4.225.160.61:38980] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adGZCGFGQVn8Q0ueB26OlwAAARg"]
[Sun Apr 05 07:04:41.534484 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:64863] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adGZCejDQjr7aWhjflBT5QAAAJA"]
[Sun Apr 05 07:04:42.214283 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:64434] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adGZCujDQjr7aWhjflBT6QAAAJM"]
[Sun Apr 05 07:04:43.089614 2026] [:error] [pid 45305:tid 45382] [client 4.225.160.61:17865] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adGZC-jDQjr7aWhjflBT6gAAAIs"]
[Sun Apr 05 07:04:43.832158 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:46134] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adGZC-jDQjr7aWhjflBT8gAAAIA"]
[Sun Apr 05 07:04:44.649610 2026] [:error] [pid 45409:tid 45421] [client 4.225.160.61:6439] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adGZDNHt_Oyw03gjCNj40gAAAMo"]
[Sun Apr 05 07:04:45.307870 2026] [:error] [pid 45305:tid 45385] [client 4.225.160.61:37923] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adGZDejDQjr7aWhjflBT-gAAAI4"]
[Sun Apr 05 07:04:45.964088 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:17904] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adGZDejDQjr7aWhjflBT_AAAAJI"]
[Sun Apr 05 07:04:46.607085 2026] [:error] [pid 45409:tid 45411] [client 4.225.160.61:46130] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adGZDtHt_Oyw03gjCNj41AAAAMA"]
[Sun Apr 05 07:04:47.259556 2026] [:error] [pid 45305:tid 45384] [client 4.225.160.61:37893] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adGZD-jDQjr7aWhjflBUAQAAAI0"]
[Sun Apr 05 07:04:47.895396 2026] [:error] [pid 45305:tid 45373] [client 4.225.160.61:33405] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adGZD-jDQjr7aWhjflBUBQAAAII"]
[Sun Apr 05 07:04:48.634945 2026] [:error] [pid 45409:tid 45422] [client 4.225.160.61:17901] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adGZENHt_Oyw03gjCNj42QAAAMs"]
[Sun Apr 05 07:04:50.020401 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:64862] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adGZEujDQjr7aWhjflBUCAAAAJM"]
[Sun Apr 05 07:04:50.789707 2026] [:error] [pid 45305:tid 45375] [client 4.225.160.61:35619] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adGZEujDQjr7aWhjflBUCwAAAIQ"]
[Sun Apr 05 07:04:51.551855 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:59499] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adGZE-jDQjr7aWhjflBUDQAAAIY"]
[Sun Apr 05 07:04:52.414999 2026] [:error] [pid 45303:tid 45341] [client 4.225.160.61:6451] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adGZFLboQ9eViZ4hdnmdjgAAABg"]
[Sun Apr 05 07:04:53.405067 2026] [:error] [pid 45304:tid 45349] [client 4.225.160.61:53528] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adGZFQ5jnqDKKovdRkkboQAAAEU"]
[Sun Apr 05 07:04:54.244666 2026] [:error] [pid 30921:tid 30945] [client 4.225.160.61:35609] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adGZFmFGQVn8Q0ueB26OogAAARY"]
[Sun Apr 05 07:04:55.256071 2026] [:error] [pid 45409:tid 45419] [client 4.225.160.61:64404] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adGZF9Ht_Oyw03gjCNj45QAAAMg"]
[Sun Apr 05 07:04:56.905202 2026] [:error] [pid 45409:tid 45418] [client 4.225.160.61:64446] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adGZGNHt_Oyw03gjCNj46QAAAMc"]
[Sun Apr 05 07:04:58.169480 2026] [:error] [pid 45303:tid 45334] [client 4.225.160.61:6450] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adGZGrboQ9eViZ4hdnmdnAAAABE"]
[Sun Apr 05 07:04:59.750630 2026] [:error] [pid 45409:tid 45425] [client 4.225.160.61:63770] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adGZG9Ht_Oyw03gjCNj49gAAAM4"]
[Sun Apr 05 07:05:00.616337 2026] [:error] [pid 30921:tid 30926] [client 4.225.160.61:53590] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adGZHGFGQVn8Q0ueB26OqAAAAQM"]
[Sun Apr 05 07:05:01.560704 2026] [:error] [pid 45303:tid 45333] [client 4.225.160.61:35607] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adGZHbboQ9eViZ4hdnmdogAAABA"]
[Sun Apr 05 07:05:02.900447 2026] [:error] [pid 45305:tid 45387] [client 4.225.160.61:63784] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adGZHujDQjr7aWhjflBUHgAAAJA"]
[Sun Apr 05 07:05:04.786671 2026] [:error] [pid 45303:tid 45339] [client 4.225.160.61:64867] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adGZILboQ9eViZ4hdnmdqQAAABY"]
[Sun Apr 05 07:05:06.431543 2026] [:error] [pid 45304:tid 45358] [client 4.225.160.61:56520] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adGZIg5jnqDKKovdRkkbrgAAAE4"]
[Sun Apr 05 07:05:09.408046 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:6547] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adGZJejDQjr7aWhjflBUMgAAAJY"]
[Sun Apr 05 07:05:11.470464 2026] [:error] [pid 45409:tid 45414] [client 4.225.160.61:6932] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGZJ9Ht_Oyw03gjCNj5CAAAAMM"]
[Sun Apr 05 07:05:13.402898 2026] [:error] [pid 45304:tid 45353] [client 4.225.160.61:61593] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGZKQ5jnqDKKovdRkkbtQAAAEk"]
[Sun Apr 05 07:05:14.727804 2026] [:error] [pid 45303:tid 45318] [client 4.225.160.61:61594] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGZKrboQ9eViZ4hdnmdugAAAAE"]
[Sun Apr 05 07:05:15.768949 2026] [:error] [pid 45409:tid 45428] [client 4.225.160.61:56547] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adGZK9Ht_Oyw03gjCNj5EwAAANE"]
[Sun Apr 05 07:05:16.551266 2026] [:error] [pid 45303:tid 45341] [client 4.225.160.61:53232] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adGZLLboQ9eViZ4hdnmdvwAAABg"]
[Sun Apr 05 07:05:17.532268 2026] [:error] [pid 45303:tid 45331] [client 4.225.160.61:52825] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adGZLbboQ9eViZ4hdnmdwwAAAA4"]
[Sun Apr 05 07:05:19.599562 2026] [:error] [pid 45303:tid 45336] [client 4.225.160.61:36793] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adGZL7boQ9eViZ4hdnmdxQAAABM"]
[Sun Apr 05 07:05:20.531121 2026] [:error] [pid 45409:tid 45428] [client 4.225.160.61:46176] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adGZMNHt_Oyw03gjCNj5HgAAANE"]
[Sun Apr 05 07:05:21.466179 2026] [:error] [pid 45304:tid 45367] [client 4.225.160.61:63775] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adGZMQ5jnqDKKovdRkkbwwAAAFc"]
[Sun Apr 05 07:05:22.423992 2026] [:error] [pid 45305:tid 45384] [client 4.225.160.61:51717] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adGZMujDQjr7aWhjflBUVwAAAI0"]
[Sun Apr 05 07:05:23.756035 2026] [proxy_fcgi:error] [pid 45409:tid 45433] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:24.025572 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:24.294171 2026] [proxy_fcgi:error] [pid 45409:tid 45431] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:24.821776 2026] [proxy_fcgi:error] [pid 45409:tid 45416] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:25.087424 2026] [proxy_fcgi:error] [pid 45409:tid 45417] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:25.355084 2026] [proxy_fcgi:error] [pid 45409:tid 45429] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:25.622555 2026] [proxy_fcgi:error] [pid 45409:tid 45427] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:26.076812 2026] [proxy_fcgi:error] [pid 45409:tid 45432] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:26.353672 2026] [proxy_fcgi:error] [pid 45409:tid 45413] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:26.619132 2026] [proxy_fcgi:error] [pid 45409:tid 45434] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:26.888768 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 4.225.160.61:64884] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:05:27.155819 2026] [:error] [pid 45409:tid 45416] [client 4.225.160.61:64884] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "adGZN9Ht_Oyw03gjCNj5OgAAAMU"]
[Sun Apr 05 07:05:28.190498 2026] [:error] [pid 30921:tid 30937] [client 4.225.160.61:56919] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "adGZOGFGQVn8Q0ueB26OvgAAAQ4"]
[Sun Apr 05 07:05:29.181884 2026] [:error] [pid 45304:tid 45361] [client 4.225.160.61:56940] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "adGZOQ5jnqDKKovdRkkb0AAAAFE"]
[Sun Apr 05 07:05:30.453540 2026] [:error] [pid 45305:tid 45389] [client 4.225.160.61:60115] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "adGZOujDQjr7aWhjflBUaQAAAJI"]
[Sun Apr 05 07:05:31.591821 2026] [:error] [pid 45305:tid 45383] [client 4.225.160.61:32922] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adGZO-jDQjr7aWhjflBUcQAAAIw"]
[Sun Apr 05 07:05:32.249168 2026] [:error] [pid 45305:tid 45391] [client 4.225.160.61:32926] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adGZPOjDQjr7aWhjflBUdQAAAJQ"]
[Sun Apr 05 07:05:33.279657 2026] [:error] [pid 45303:tid 45320] [client 4.225.160.61:47992] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adGZPbboQ9eViZ4hdnmd2wAAAAM"]
[Sun Apr 05 07:05:34.006613 2026] [:error] [pid 30921:tid 30941] [client 4.225.160.61:61173] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adGZPmFGQVn8Q0ueB26OxgAAARI"]
[Sun Apr 05 07:05:34.905312 2026] [:error] [pid 45303:tid 45317] [client 4.225.160.61:47999] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adGZPrboQ9eViZ4hdnmd3QAAAAA"]
[Sun Apr 05 07:05:36.640310 2026] [:error] [pid 45409:tid 45411] [client 4.225.160.61:61181] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adGZQNHt_Oyw03gjCNj5SgAAAMA"]
[Sun Apr 05 07:05:40.228775 2026] [:error] [pid 45305:tid 45375] [client 4.225.160.61:46826] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adGZROjDQjr7aWhjflBUjQAAAIQ"]
[Sun Apr 05 07:05:43.299265 2026] [:error] [pid 45303:tid 45320] [client 4.225.160.61:64603] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adGZR7boQ9eViZ4hdnmd5wAAAAM"]
[Sun Apr 05 07:05:48.797996 2026] [:error] [pid 45303:tid 45321] [client 4.225.160.61:48433] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adGZTLboQ9eViZ4hdnmd7wAAAAQ"]
[Sun Apr 05 07:05:50.121711 2026] [:error] [pid 45305:tid 45394] [client 4.225.160.61:33814] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adGZTujDQjr7aWhjflBUqgAAAJc"]
[Sun Apr 05 07:05:53.059495 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:57246] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adGZUejDQjr7aWhjflBUsQAAAJU"]
[Sun Apr 05 07:05:54.569074 2026] [:error] [pid 45409:tid 45435] [client 4.225.160.61:48432] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adGZUtHt_Oyw03gjCNj5hQAAANg"]
[Sun Apr 05 07:05:55.493319 2026] [:error] [pid 45304:tid 45345] [client 4.225.160.61:39644] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adGZUw5jnqDKKovdRkkb5AAAAEE"]
[Sun Apr 05 07:05:56.479674 2026] [:error] [pid 45303:tid 45330] [client 4.225.160.61:7134] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adGZVLboQ9eViZ4hdnmd9AAAAA0"]
[Sun Apr 05 07:05:57.480895 2026] [:error] [pid 45303:tid 45317] [client 4.225.160.61:53946] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adGZVbboQ9eViZ4hdnmd9QAAAAA"]
[Sun Apr 05 07:05:58.419743 2026] [:error] [pid 30921:tid 30925] [client 4.225.160.61:53898] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adGZVmFGQVn8Q0ueB26O4AAAAQI"]
[Sun Apr 05 07:05:59.271617 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:44064] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adGZV-jDQjr7aWhjflBUugAAAJM"]
[Sun Apr 05 07:06:00.389580 2026] [:error] [pid 45305:tid 45378] [client 4.225.160.61:34518] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adGZWOjDQjr7aWhjflBUvgAAAIc"]
[Sun Apr 05 07:06:02.057597 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:63964] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adGZWujDQjr7aWhjflBUyQAAAJU"]
[Sun Apr 05 07:06:03.275653 2026] [:error] [pid 45305:tid 45394] [client 4.225.160.61:30686] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adGZW-jDQjr7aWhjflBUzgAAAJc"]
[Sun Apr 05 07:06:03.981804 2026] [:error] [pid 45305:tid 45377] [client 4.225.160.61:63944] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "adGZW-jDQjr7aWhjflBU0gAAAIY"]
[Sun Apr 05 07:06:04.591461 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:63983] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "adGZXOjDQjr7aWhjflBU0wAAAJM"]
[Sun Apr 05 07:06:06.271955 2026] [:error] [pid 45305:tid 45393] [client 4.225.160.61:38460] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "adGZXujDQjr7aWhjflBU2QAAAJY"]
[Sun Apr 05 07:06:07.263804 2026] [:error] [pid 45305:tid 45385] [client 4.225.160.61:46755] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "adGZX-jDQjr7aWhjflBU4QAAAI4"]
[Sun Apr 05 07:06:08.317726 2026] [:error] [pid 30921:tid 30931] [client 4.225.160.61:50192] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adGZYGFGQVn8Q0ueB26O4wAAAQg"]
[Sun Apr 05 07:06:09.563987 2026] [:error] [pid 45409:tid 45434] [client 4.225.160.61:61863] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adGZYdHt_Oyw03gjCNj5rQAAANc"]
[Sun Apr 05 07:06:10.603789 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:32426] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adGZYujDQjr7aWhjflBU8AAAAJU"]
[Sun Apr 05 07:06:11.262694 2026] [:error] [pid 45305:tid 45394] [client 4.225.160.61:49916] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adGZY-jDQjr7aWhjflBU9QAAAJc"]
[Sun Apr 05 07:06:12.475790 2026] [:error] [pid 45409:tid 45411] [client 4.225.160.61:62312] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adGZZNHt_Oyw03gjCNj5tQAAAMA"]
[Sun Apr 05 07:06:13.211600 2026] [:error] [pid 45409:tid 45420] [client 4.225.160.61:40386] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adGZZdHt_Oyw03gjCNj5uwAAAMk"]
[Sun Apr 05 07:06:13.937772 2026] [:error] [pid 30921:tid 30929] [client 4.225.160.61:49506] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adGZZWFGQVn8Q0ueB26O7gAAAQY"]
[Sun Apr 05 07:06:14.813119 2026] [:error] [pid 30921:tid 30936] [client 4.225.160.61:38441] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adGZZmFGQVn8Q0ueB26O8AAAAQ0"]
[Sun Apr 05 07:06:16.035300 2026] [:error] [pid 45305:tid 45390] [client 4.225.160.61:52782] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adGZaOjDQjr7aWhjflBVBAAAAJM"]
[Sun Apr 05 07:06:17.192855 2026] [:error] [pid 45305:tid 45392] [client 4.225.160.61:61871] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adGZaejDQjr7aWhjflBVCAAAAJU"]
[Sun Apr 05 07:06:18.170026 2026] [:error] [pid 30921:tid 30943] [client 4.225.160.61:46712] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adGZamFGQVn8Q0ueB26O9gAAARQ"]
[Sun Apr 05 07:06:18.828585 2026] [:error] [pid 45305:tid 45371] [client 4.225.160.61:52736] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adGZaujDQjr7aWhjflBVEQAAAIA"]
[Sun Apr 05 07:06:19.557801 2026] [:error] [pid 45305:tid 45384] [client 4.225.160.61:49871] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adGZa-jDQjr7aWhjflBVEwAAAI0"]
[Sun Apr 05 07:06:20.188466 2026] [:error] [pid 30921:tid 30936] [client 4.225.160.61:44106] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adGZbGFGQVn8Q0ueB26O_QAAAQ0"]
[Sun Apr 05 07:06:21.210643 2026] [:error] [pid 45304:tid 45357] [client 4.225.160.61:46686] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adGZbQ5jnqDKKovdRkkb-wAAAE0"]
[Sun Apr 05 07:06:22.098209 2026] [:error] [pid 45303:tid 45328] [client 4.225.160.61:7102] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adGZbrboQ9eViZ4hdnmeHAAAAAs"]
[Sun Apr 05 07:06:22.896746 2026] [:error] [pid 30921:tid 30933] [client 4.225.160.61:45044] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adGZbmFGQVn8Q0ueB26PBwAAAQo"]
[Sun Apr 05 07:06:23.733894 2026] [:error] [pid 45303:tid 45330] [client 4.225.160.61:62552] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adGZb7boQ9eViZ4hdnmeIAAAAA0"]
[Sun Apr 05 07:06:25.041393 2026] [:error] [pid 45303:tid 45338] [client 4.225.160.61:45055] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adGZcbboQ9eViZ4hdnmeJAAAABU"]
[Sun Apr 05 07:06:25.944872 2026] [:error] [pid 45303:tid 45332] [client 4.225.160.61:53168] [client 4.225.160.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adGZcbboQ9eViZ4hdnmeJgAAAA8"]
[Sun Apr 05 07:06:26.844441 2026] [proxy_fcgi:error] [pid 30921:tid 30938] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:27.114495 2026] [proxy_fcgi:error] [pid 30921:tid 30945] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:27.436644 2026] [proxy_fcgi:error] [pid 30921:tid 30926] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:27.710077 2026] [proxy_fcgi:error] [pid 30921:tid 30934] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:27.989200 2026] [proxy_fcgi:error] [pid 30921:tid 30929] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:28.257869 2026] [proxy_fcgi:error] [pid 30921:tid 30936] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:28.524053 2026] [proxy_fcgi:error] [pid 30921:tid 30925] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:28.791539 2026] [proxy_fcgi:error] [pid 30921:tid 30935] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:29.056426 2026] [proxy_fcgi:error] [pid 30921:tid 30923] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:06:29.324532 2026] [proxy_fcgi:error] [pid 30921:tid 30925] [client 4.225.160.61:38438] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:31.492414 2026] [proxy_fcgi:error] [pid 30921:tid 30945] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:31.735373 2026] [proxy_fcgi:error] [pid 30921:tid 30947] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:31.979195 2026] [proxy_fcgi:error] [pid 30921:tid 30928] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:32.232621 2026] [proxy_fcgi:error] [pid 30921:tid 30931] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:32.475587 2026] [proxy_fcgi:error] [pid 30921:tid 30937] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:32.724843 2026] [proxy_fcgi:error] [pid 30921:tid 30927] [client 68.221.137.197:16792] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:45:32.977222 2026] [:error] [pid 30921:tid 30925] [client 68.221.137.197:16792] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "adGinGFGQVn8Q0ueB26djQAAAQI"]
[Sun Apr 05 07:45:35.430339 2026] [:error] [pid 45304:tid 45354] [client 68.221.137.197:45114] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "adGinw5jnqDKKovdRkklxQAAAEo"]
[Sun Apr 05 07:45:38.571669 2026] [:error] [pid 45409:tid 45415] [client 68.221.137.197:59638] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "adGiotHt_Oyw03gjCNgNFgAAAMQ"]
[Sun Apr 05 07:45:39.905184 2026] [:error] [pid 45303:tid 45332] [client 68.221.137.197:44426] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "adGio7boQ9eViZ4hdnmpeQAAAA8"]
[Sun Apr 05 07:45:41.065221 2026] [:error] [pid 45303:tid 45338] [client 68.221.137.197:48095] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxc.php"] [unique_id "adGipbboQ9eViZ4hdnmpewAAABU"]
[Sun Apr 05 07:45:42.804742 2026] [:error] [pid 45305:tid 45389] [client 68.221.137.197:42961] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxc.php"] [unique_id "adGipujDQjr7aWhjflBxfAAAAJI"]
[Sun Apr 05 07:45:43.649961 2026] [:error] [pid 30921:tid 30939] [client 68.221.137.197:42711] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxc.php"] [unique_id "adGip2FGQVn8Q0ueB26dmgAAARA"]
[Sun Apr 05 07:45:44.492084 2026] [:error] [pid 45303:tid 45320] [client 68.221.137.197:32363] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxc.php"] [unique_id "adGiqLboQ9eViZ4hdnmpgQAAAAM"]
[Sun Apr 05 07:45:46.755990 2026] [:error] [pid 45305:tid 45394] [client 68.221.137.197:32370] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "adGiqujDQjr7aWhjflBxjgAAAJc"]
[Sun Apr 05 07:45:50.517898 2026] [:error] [pid 45409:tid 45423] [client 68.221.137.197:48080] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "adGirtHt_Oyw03gjCNgNMAAAAMw"]
[Sun Apr 05 07:45:51.665866 2026] [:error] [pid 45409:tid 45417] [client 68.221.137.197:48109] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "adGir9Ht_Oyw03gjCNgNNQAAAMY"]
[Sun Apr 05 07:45:53.174554 2026] [:error] [pid 45305:tid 45385] [client 68.221.137.197:42707] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "adGisejDQjr7aWhjflBxlwAAAI4"]
[Sun Apr 05 07:45:54.817600 2026] [:error] [pid 45305:tid 45387] [client 68.221.137.197:9671] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "adGisujDQjr7aWhjflBxoAAAAJA"]
[Sun Apr 05 07:45:55.716975 2026] [:error] [pid 30921:tid 30931] [client 68.221.137.197:63159] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "adGis2FGQVn8Q0ueB26doAAAAQg"]
[Sun Apr 05 07:45:58.243264 2026] [:error] [pid 45304:tid 45366] [client 68.221.137.197:63163] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "adGitg5jnqDKKovdRkkl1gAAAFY"]
[Sun Apr 05 07:46:07.539885 2026] [:error] [pid 45409:tid 45417] [client 68.221.137.197:44428] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "adGiv9Ht_Oyw03gjCNgNTwAAAMY"]
[Sun Apr 05 07:46:10.841227 2026] [:error] [pid 45305:tid 45371] [client 68.221.137.197:32368] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adGiwujDQjr7aWhjflBxsQAAAIA"]
[Sun Apr 05 07:46:15.060006 2026] [:error] [pid 45303:tid 45337] [client 68.221.137.197:48121] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adGix7boQ9eViZ4hdnmpngAAABQ"]
[Sun Apr 05 07:46:18.823262 2026] [:error] [pid 30921:tid 30938] [client 68.221.137.197:59587] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adGiymFGQVn8Q0ueB26dyAAAAQ8"]
[Sun Apr 05 07:46:22.487158 2026] [:error] [pid 45303:tid 45324] [client 68.221.137.197:48116] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adGizrboQ9eViZ4hdnmppwAAAAc"]
[Sun Apr 05 07:46:27.188440 2026] [:error] [pid 30921:tid 30946] [client 68.221.137.197:44458] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adGi02FGQVn8Q0ueB26dzwAAARc"]
[Sun Apr 05 07:46:31.063826 2026] [:error] [pid 45409:tid 45433] [client 68.221.137.197:59615] [client 68.221.137.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adGi19Ht_Oyw03gjCNgNcgAAANY"]
[Sun Apr 05 07:46:36.652383 2026] [proxy_fcgi:error] [pid 45305:tid 45376] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:36.909138 2026] [proxy_fcgi:error] [pid 45305:tid 45377] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:37.152520 2026] [proxy_fcgi:error] [pid 45305:tid 45380] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:37.410857 2026] [proxy_fcgi:error] [pid 45305:tid 45392] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:37.656736 2026] [proxy_fcgi:error] [pid 45305:tid 45381] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:37.899700 2026] [proxy_fcgi:error] [pid 45305:tid 45378] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:38.158502 2026] [proxy_fcgi:error] [pid 45305:tid 45371] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:38.401793 2026] [proxy_fcgi:error] [pid 45305:tid 45390] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:38.644440 2026] [proxy_fcgi:error] [pid 45305:tid 45379] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 07:46:38.891380 2026] [proxy_fcgi:error] [pid 45305:tid 45376] [client 68.221.137.197:16791] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 09:26:30.351107 2026] [:error] [pid 30921:tid 30927] [client 116.114.76.183:51764] [client 116.114.76.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adG6RmFGQVn8Q0ueB27DhgAAAQQ"], referer: http://switchcreative.net/
[Sun Apr 05 10:17:12.389485 2026] [proxy_fcgi:error] [pid 45303:tid 45318] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:12.631120 2026] [proxy_fcgi:error] [pid 45303:tid 45331] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:12.881890 2026] [proxy_fcgi:error] [pid 45303:tid 45332] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:13.122340 2026] [proxy_fcgi:error] [pid 45303:tid 45321] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:13.364353 2026] [proxy_fcgi:error] [pid 45303:tid 45317] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:13.605745 2026] [proxy_fcgi:error] [pid 45303:tid 45335] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:13.862216 2026] [proxy_fcgi:error] [pid 45303:tid 45323] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:14.106225 2026] [proxy_fcgi:error] [pid 45303:tid 45337] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:14.356491 2026] [proxy_fcgi:error] [pid 45303:tid 45328] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:14.613336 2026] [proxy_fcgi:error] [pid 45303:tid 45325] [client 20.199.97.195:39291] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:17:14.850515 2026] [:error] [pid 45303:tid 45334] [client 20.199.97.195:39291] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55l453.php"] [unique_id "adHGKrboQ9eViZ4hdnnaJwAAABE"]
[Sun Apr 05 10:17:18.782351 2026] [:error] [pid 45305:tid 45394] [client 20.199.97.195:32777] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xx.php"] [unique_id "adHGLujDQjr7aWhjflDmngAAAJc"]
[Sun Apr 05 10:17:23.210067 2026] [:error] [pid 45305:tid 45373] [client 20.199.97.195:39101] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adHGM-jDQjr7aWhjflDmuAAAAII"]
[Sun Apr 05 10:17:25.961817 2026] [:error] [pid 45303:tid 45338] [client 20.199.97.195:32782] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "adHGNbboQ9eViZ4hdnnaPQAAABU"]
[Sun Apr 05 10:17:29.784292 2026] [:error] [pid 30921:tid 30928] [client 20.199.97.195:39279] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adHGOWFGQVn8Q0ueB27aXAAAAQU"]
[Sun Apr 05 10:17:36.025500 2026] [:error] [pid 45305:tid 45394] [client 20.199.97.195:39103] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adHGQOjDQjr7aWhjflDm-gAAAJc"]
[Sun Apr 05 10:17:37.308744 2026] [:error] [pid 45303:tid 45338] [client 20.199.97.195:39059] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adHGQbboQ9eViZ4hdnnaTAAAABU"]
[Sun Apr 05 10:17:40.089011 2026] [:error] [pid 45305:tid 45395] [client 20.199.97.195:44079] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "adHGROjDQjr7aWhjflDnCwAAAJg"]
[Sun Apr 05 10:17:43.074959 2026] [:error] [pid 45303:tid 45340] [client 20.199.97.195:4973] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adHGR7boQ9eViZ4hdnnaXgAAABc"]
[Sun Apr 05 10:17:45.013636 2026] [:error] [pid 45409:tid 45427] [client 20.199.97.195:39097] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "adHGSdHt_Oyw03gjCNhgKQAAANA"]
[Sun Apr 05 10:17:50.403738 2026] [:error] [pid 45409:tid 45433] [client 20.199.97.195:32808] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adHGTtHt_Oyw03gjCNhgQwAAANY"]
[Sun Apr 05 10:17:53.239655 2026] [:error] [pid 30921:tid 30945] [client 20.199.97.195:37768] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsc.php"] [unique_id "adHGUWFGQVn8Q0ueB27akgAAARY"]
[Sun Apr 05 10:17:54.046631 2026] [:error] [pid 45305:tid 45378] [client 20.199.97.195:23032] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adHGUujDQjr7aWhjflDnTgAAAIc"]
[Sun Apr 05 10:17:54.711619 2026] [:error] [pid 45305:tid 45373] [client 20.199.97.195:41104] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adHGUujDQjr7aWhjflDnUwAAAII"]
[Sun Apr 05 10:17:57.370477 2026] [:error] [pid 45304:tid 45366] [client 20.199.97.195:4165] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adHGVQ5jnqDKKovdRklPVgAAAFY"]
[Sun Apr 05 10:17:59.326194 2026] [:error] [pid 45409:tid 45417] [client 20.199.97.195:39235] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-lvminl.php"] [unique_id "adHGV9Ht_Oyw03gjCNhgXQAAAMY"]
[Sun Apr 05 10:18:01.307886 2026] [:error] [pid 45304:tid 45358] [client 20.199.97.195:39092] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adHGWQ5jnqDKKovdRklPXQAAAE4"]
[Sun Apr 05 10:18:08.285139 2026] [:error] [pid 45409:tid 45424] [client 20.199.97.195:32818] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adHGYNHt_Oyw03gjCNhgfgAAAM0"]
[Sun Apr 05 10:18:25.889040 2026] [proxy_fcgi:error] [pid 45409:tid 45428] [client 20.199.97.195:41141] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 10:18:26.129351 2026] [proxy_fcgi:error] [pid 45409:tid 45420] [client 20.199.97.195:41141] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 12:14:17.289630 2026] [:error] [pid 45303:tid 45322] [client 43.157.188.74:44254] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adHhmbboQ9eViZ4hdnkGoAAAAAU"]
[Sun Apr 05 13:40:31.559077 2026] [proxy_fcgi:error] [pid 45305:tid 45392] [client 4.223.104.110:35906] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 17:15:46.623067 2026] [:error] [pid 45409:tid 45412] [client 188.166.185.130:53695] [client 188.166.185.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.185.130, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adIoQtHt_Oyw03gjCNhO8QAAAME"]
[Sun Apr 05 17:15:46.633047 2026] [proxy_fcgi:error] [pid 45409:tid 45412] [client 188.166.185.130:53695] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 17:15:46.886005 2026] [:error] [pid 45304:tid 45349] [client 188.166.185.130:53694] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feed/"] [unique_id "adIoQg5jnqDKKovdRknKqQAAAEU"]
[Sun Apr 05 17:15:46.886290 2026] [:error] [pid 45409:tid 45411] [client 188.166.185.130:53696] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adIoQtHt_Oyw03gjCNhO9AAAAMA"]
[Sun Apr 05 17:15:46.889771 2026] [:error] [pid 45409:tid 45413] [client 188.166.185.130:53695] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "adIoQtHt_Oyw03gjCNhO9QAAAMI"]
[Sun Apr 05 17:15:47.350263 2026] [:error] [pid 45303:tid 45319] [client 188.166.185.130:53945] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "adIoQ7boQ9eViZ4hdnmWxgAAAAI"]
[Sun Apr 05 17:15:47.663748 2026] [:error] [pid 45303:tid 45330] [client 188.166.185.130:53981] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "adIoQ7boQ9eViZ4hdnmWyAAAAA0"]
[Sun Apr 05 17:15:47.858004 2026] [:error] [pid 45409:tid 45429] [client 188.166.185.130:54022] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "adIoQ9Ht_Oyw03gjCNhO-gAAANI"]
[Sun Apr 05 17:15:48.149582 2026] [:error] [pid 45409:tid 45428] [client 188.166.185.130:54051] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "adIoRNHt_Oyw03gjCNhO_QAAANE"]
[Sun Apr 05 17:15:48.154344 2026] [:error] [pid 45305:tid 45382] [client 188.166.185.130:54064] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "adIoROjDQjr7aWhjflD6LwAAAIs"]
[Sun Apr 05 17:15:48.353806 2026] [:error] [pid 30921:tid 30936] [client 188.166.185.130:54108] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "adIoRGFGQVn8Q0ueB26dqQAAAQ0"]
[Sun Apr 05 17:15:48.361372 2026] [:error] [pid 45305:tid 45378] [client 188.166.185.130:54117] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "adIoROjDQjr7aWhjflD6MAAAAIc"]
[Sun Apr 05 17:15:48.542701 2026] [:error] [pid 45303:tid 45338] [client 188.166.185.130:54154] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "adIoRLboQ9eViZ4hdnmWzwAAABU"]
[Sun Apr 05 17:15:48.552694 2026] [:error] [pid 45409:tid 45430] [client 188.166.185.130:54157] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "adIoRNHt_Oyw03gjCNhO_wAAANM"]
[Sun Apr 05 17:15:48.747786 2026] [:error] [pid 45409:tid 45422] [client 188.166.185.130:54192] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2021/wp-includes/wlwmanifest.xml"] [unique_id "adIoRNHt_Oyw03gjCNhPAAAAAMs"]
[Sun Apr 05 17:15:48.766746 2026] [:error] [pid 45303:tid 45327] [client 188.166.185.130:54195] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "adIoRLboQ9eViZ4hdnmW0AAAAAo"]
[Sun Apr 05 17:15:48.931012 2026] [:error] [pid 45305:tid 45392] [client 188.166.185.130:54239] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "adIoROjDQjr7aWhjflD6MwAAAJU"]
[Sun Apr 05 17:15:48.965653 2026] [:error] [pid 45304:tid 45356] [client 188.166.185.130:54246] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "adIoRA5jnqDKKovdRknKrgAAAEw"]
[Sun Apr 05 17:15:49.247633 2026] [:error] [pid 45304:tid 45359] [client 188.166.185.130:54278] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adIoRQ5jnqDKKovdRknKrwAAAE8"]
[Sun Apr 05 17:15:49.248204 2026] [:error] [pid 45303:tid 45339] [client 188.166.185.130:54281] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2021/wp-includes/wlwmanifest.xml"] [unique_id "adIoRbboQ9eViZ4hdnmW0wAAABY"]
[Sun Apr 05 17:15:49.548108 2026] [:error] [pid 45304:tid 45352] [client 188.166.185.130:54337] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adIoRQ5jnqDKKovdRknKsAAAAEg"]
[Sun Apr 05 17:15:49.549076 2026] [:error] [pid 45303:tid 45329] [client 188.166.185.130:54338] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "adIoRbboQ9eViZ4hdnmW1gAAAAw"]
[Sun Apr 05 17:15:49.769882 2026] [:error] [pid 45304:tid 45344] [client 188.166.185.130:54394] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adIoRQ5jnqDKKovdRknKswAAAEA"]
[Sun Apr 05 17:15:49.771146 2026] [:error] [pid 45304:tid 45361] [client 188.166.185.130:54395] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adIoRQ5jnqDKKovdRknKtAAAAFE"]
[Sun Apr 05 17:15:50.019623 2026] [:error] [pid 45304:tid 45363] [client 188.166.185.130:54436] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adIoRg5jnqDKKovdRknKtQAAAFM"]
[Sun Apr 05 17:15:50.019623 2026] [:error] [pid 45303:tid 45333] [client 188.166.185.130:54439] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adIoRrboQ9eViZ4hdnmW3AAAABA"]
[Sun Apr 05 17:15:50.395529 2026] [:error] [pid 45303:tid 45338] [client 188.166.185.130:54483] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adIoRrboQ9eViZ4hdnmW3wAAABU"]
[Sun Apr 05 17:15:50.604092 2026] [:error] [pid 45303:tid 45325] [client 188.166.185.130:54558] [client 188.166.185.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adIoRrboQ9eViZ4hdnmW4QAAAAg"]
[Sun Apr 05 18:06:12.600357 2026] [:error] [pid 45409:tid 45414] [client 43.128.156.124:38430] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adI0FNHt_Oyw03gjCNhhXQAAAMM"]
[Sun Apr 05 19:39:38.889361 2026] [:error] [pid 45303:tid 45340] [client 51.161.86.195:56770] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ-rboQ9eViZ4hdnkA_QAAABc"]
[Sun Apr 05 19:39:39.797094 2026] [:error] [pid 45305:tid 45379] [client 51.161.86.195:38884] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ--jDQjr7aWhjflA2CgAAAIg"]
[Sun Apr 05 19:39:39.823048 2026] [:error] [pid 30921:tid 30924] [client 51.161.86.195:56762] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adJJ-2FGQVn8Q0ueB27sIQAAAQE"]
[Sun Apr 05 19:39:40.194623 2026] [:error] [pid 45303:tid 45338] [client 51.161.86.195:57702] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adJJ_LboQ9eViZ4hdnkBCQAAABU"]
[Sun Apr 05 19:39:40.405698 2026] [:error] [pid 45304:tid 45357] [client 51.161.86.195:38900] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_A5jnqDKKovdRkn4AgAAAE0"]
[Sun Apr 05 19:39:40.411405 2026] [:error] [pid 45304:tid 45364] [client 51.161.86.195:52072] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_A5jnqDKKovdRkn4AwAAAFQ"]
[Sun Apr 05 19:39:41.603463 2026] [:error] [pid 30921:tid 30923] [client 51.161.86.195:38906] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_WFGQVn8Q0ueB27sKgAAAQA"]
[Sun Apr 05 19:39:41.906581 2026] [:error] [pid 45304:tid 45344] [client 51.161.86.195:52058] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adJJ_Q5jnqDKKovdRkn4BwAAAEA"]
[Sun Apr 05 19:39:42.286506 2026] [:error] [pid 45305:tid 45388] [client 51.161.86.195:52080] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_ujDQjr7aWhjflA2EgAAAJE"]
[Sun Apr 05 19:39:42.907612 2026] [:error] [pid 45305:tid 45392] [client 51.161.86.195:52092] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_ujDQjr7aWhjflA2FAAAAJU"]
[Sun Apr 05 19:39:43.317013 2026] [:error] [pid 45305:tid 45376] [client 51.161.86.195:38918] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJJ_-jDQjr7aWhjflA2GAAAAIU"]
[Sun Apr 05 19:39:44.047583 2026] [:error] [pid 45303:tid 45335] [client 51.161.86.195:38926] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKALboQ9eViZ4hdnkBGwAAABI"]
[Sun Apr 05 19:39:44.631582 2026] [:error] [pid 45303:tid 45323] [client 51.161.86.195:38940] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKALboQ9eViZ4hdnkBIAAAAAY"]
[Sun Apr 05 19:39:44.691020 2026] [:error] [pid 45303:tid 45325] [client 51.161.86.195:38946] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKALboQ9eViZ4hdnkBIQAAAAg"]
[Sun Apr 05 19:39:45.408080 2026] [:error] [pid 45304:tid 45359] [client 51.161.86.195:36964] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKAQ5jnqDKKovdRkn4EgAAAE8"]
[Sun Apr 05 19:39:46.000935 2026] [:error] [pid 45304:tid 45354] [client 51.161.86.195:36976] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKAQ5jnqDKKovdRkn4FAAAAEo"]
[Sun Apr 05 19:39:49.013896 2026] [:error] [pid 45409:tid 45418] [client 51.161.86.195:36994] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKBdHt_Oyw03gjCNinQQAAAMc"]
[Sun Apr 05 19:39:49.715055 2026] [:error] [pid 45409:tid 45432] [client 51.161.86.195:36996] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKBdHt_Oyw03gjCNinRAAAANU"]
[Sun Apr 05 19:39:51.284947 2026] [:error] [pid 45409:tid 45423] [client 51.161.86.195:41318] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKB9Ht_Oyw03gjCNinTAAAAMw"]
[Sun Apr 05 19:39:51.396992 2026] [:error] [pid 45409:tid 45424] [client 51.161.86.195:37002] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKB9Ht_Oyw03gjCNinTQAAAM0"]
[Sun Apr 05 19:39:53.157527 2026] [:error] [pid 45409:tid 45416] [client 51.161.86.195:41334] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKCdHt_Oyw03gjCNinXwAAAMU"]
[Sun Apr 05 19:39:54.984842 2026] [:error] [pid 45303:tid 45328] [client 51.161.86.195:37004] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKCrboQ9eViZ4hdnkBUQAAAAs"]
[Sun Apr 05 19:39:55.258758 2026] [:error] [pid 30921:tid 30945] [client 51.161.86.195:36988] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKC2FGQVn8Q0ueB27sTQAAARY"]
[Sun Apr 05 19:39:56.931860 2026] [:error] [pid 45409:tid 45430] [client 51.161.86.195:35740] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKDNHt_Oyw03gjCNinaQAAANM"]
[Sun Apr 05 19:39:58.165819 2026] [:error] [pid 45303:tid 45319] [client 51.161.86.195:56356] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKDrboQ9eViZ4hdnkBYAAAAAI"]
[Sun Apr 05 19:40:01.444692 2026] [:error] [pid 30921:tid 30936] [client 51.161.86.195:56362] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKEWFGQVn8Q0ueB27sYAAAAQ0"]
[Sun Apr 05 19:40:04.726207 2026] [:error] [pid 45303:tid 45338] [client 51.161.86.195:56364] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKFLboQ9eViZ4hdnkBewAAABU"]
[Sun Apr 05 19:40:06.949848 2026] [:error] [pid 30921:tid 30923] [client 51.161.86.195:42694] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKFmFGQVn8Q0ueB27sYgAAAQA"]
[Sun Apr 05 19:40:08.382954 2026] [:error] [pid 45303:tid 45338] [client 51.161.86.195:42706] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGLboQ9eViZ4hdnkBiAAAABU"]
[Sun Apr 05 19:40:08.951421 2026] [:error] [pid 45305:tid 45377] [client 51.161.86.195:42714] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGOjDQjr7aWhjflA2OgAAAIY"]
[Sun Apr 05 19:40:09.098982 2026] [:error] [pid 45304:tid 45353] [client 51.161.86.195:42716] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGQ5jnqDKKovdRkn4PAAAAEk"]
[Sun Apr 05 19:40:09.187912 2026] [:error] [pid 45304:tid 45359] [client 51.161.86.195:49416] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGQ5jnqDKKovdRkn4PQAAAE8"]
[Sun Apr 05 19:40:10.552434 2026] [:error] [pid 45303:tid 45325] [client 51.161.86.195:42732] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGrboQ9eViZ4hdnkBjwAAAAg"]
[Sun Apr 05 19:40:10.731841 2026] [:error] [pid 45409:tid 45430] [client 51.161.86.195:42734] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKGtHt_Oyw03gjCNinsQAAANM"]
[Sun Apr 05 19:40:11.063040 2026] [:error] [pid 45303:tid 45336] [client 51.161.86.195:42750] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKG7boQ9eViZ4hdnkBkwAAABM"]
[Sun Apr 05 19:40:12.955543 2026] [:error] [pid 45305:tid 45389] [client 51.161.86.195:42766] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKHOjDQjr7aWhjflA2QQAAAJI"]
[Sun Apr 05 19:40:13.814571 2026] [:error] [pid 45409:tid 45425] [client 51.161.86.195:42768] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKHdHt_Oyw03gjCNinuwAAAM4"]
[Sun Apr 05 19:40:14.285425 2026] [:error] [pid 45409:tid 45418] [client 51.161.86.195:42776] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKHtHt_Oyw03gjCNinwwAAAMc"]
[Sun Apr 05 19:40:14.320124 2026] [:error] [pid 45409:tid 45420] [client 51.161.86.195:49422] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adJKHtHt_Oyw03gjCNinxAAAAMk"]
[Sun Apr 05 19:40:14.454809 2026] [:error] [pid 45409:tid 45419] [client 51.161.86.195:42786] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKHtHt_Oyw03gjCNinxgAAAMg"]
[Sun Apr 05 19:40:15.423639 2026] [:error] [pid 45409:tid 45430] [client 51.161.86.195:43120] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKH9Ht_Oyw03gjCNin0QAAANM"]
[Sun Apr 05 19:40:16.982964 2026] [:error] [pid 45409:tid 45428] [client 51.161.86.195:43130] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKINHt_Oyw03gjCNin3gAAANE"]
[Sun Apr 05 19:40:17.268893 2026] [:error] [pid 45305:tid 45371] [client 51.161.86.195:43144] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKIejDQjr7aWhjflA2TAAAAIA"]
[Sun Apr 05 19:40:20.309224 2026] [:error] [pid 45409:tid 45431] [client 51.161.86.195:55684] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKJNHt_Oyw03gjCNin6gAAANQ"]
[Sun Apr 05 19:40:20.769543 2026] [:error] [pid 45303:tid 45318] [client 51.161.86.195:43148] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKJLboQ9eViZ4hdnkBrwAAAAE"]
[Sun Apr 05 19:40:21.334940 2026] [:error] [pid 45303:tid 45341] [client 51.161.86.195:43150] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKJbboQ9eViZ4hdnkBtAAAABg"]
[Sun Apr 05 19:40:22.344271 2026] [:error] [pid 30921:tid 30926] [client 51.161.86.195:43162] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKJmFGQVn8Q0ueB27sdwAAAQM"]
[Sun Apr 05 19:40:26.365795 2026] [:error] [pid 45304:tid 45360] [client 51.161.86.195:55686] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKKg5jnqDKKovdRkn4VQAAAFA"]
[Sun Apr 05 19:40:30.287974 2026] [:error] [pid 45304:tid 45361] [client 51.161.86.195:57552] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKLg5jnqDKKovdRkn4WAAAAFE"]
[Sun Apr 05 19:40:34.246422 2026] [:error] [pid 45303:tid 45337] [client 51.161.86.195:57560] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKMrboQ9eViZ4hdnkB7QAAABQ"]
[Sun Apr 05 19:41:22.012345 2026] [:error] [pid 45303:tid 45322] [client 51.161.86.195:52188] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adJKYrboQ9eViZ4hdnkCpQAAAAU"]
[Sun Apr 05 19:41:23.036807 2026] [:error] [pid 45303:tid 45323] [client 51.161.86.195:52204] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKY7boQ9eViZ4hdnkCrQAAAAY"]
[Sun Apr 05 19:41:26.868951 2026] [:error] [pid 30921:tid 30942] [client 51.161.86.195:56796] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKZmFGQVn8Q0ueB27tDgAAARM"]
[Sun Apr 05 19:41:54.692044 2026] [:error] [pid 45409:tid 45412] [client 51.161.86.195:50582] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKgtHt_Oyw03gjCNipkgAAAME"]
[Sun Apr 05 19:41:59.009091 2026] [:error] [pid 45304:tid 45366] [client 51.161.86.195:36160] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKhw5jnqDKKovdRkn5CAAAAFY"]
[Sun Apr 05 19:42:00.296834 2026] [:error] [pid 30921:tid 30931] [client 51.161.86.195:39694] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKiGFGQVn8Q0ueB27tbAAAAQg"]
[Sun Apr 05 19:42:04.160896 2026] [:error] [pid 45305:tid 45395] [client 51.161.86.195:39710] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKjOjDQjr7aWhjflA25gAAAJg"]
[Sun Apr 05 19:42:06.661455 2026] [:error] [pid 45304:tid 45354] [client 51.161.86.195:32982] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKjg5jnqDKKovdRkn5DgAAAEo"]
[Sun Apr 05 19:42:10.406749 2026] [:error] [pid 30921:tid 30942] [client 51.161.86.195:32994] [client 51.161.86.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJKkmFGQVn8Q0ueB27thAAAARM"]
[Sun Apr 05 20:11:35.904627 2026] [:error] [pid 45409:tid 45413] [client 180.153.236.199:3767] [client 180.153.236.199] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adJRd9Ht_Oyw03gjCNjIswAAAMI"], referer: http://www.switchcreative.net/
[Sun Apr 05 21:58:30.297227 2026] [:error] [pid 45305:tid 45385] [client 104.28.166.114:40488] [client 104.28.166.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "adJqhujDQjr7aWhjflBpIgAAAI4"]
[Sun Apr 05 23:08:47.595022 2026] [:error] [pid 30921:tid 30944] [client 125.94.144.102:37093] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adJ6_2FGQVn8Q0ueB25QcgAAARU"]
[Sun Apr 05 23:15:25.773591 2026] [:error] [pid 45409:tid 45421] [client 62.84.185.67:65368] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adJ8jdHt_Oyw03gjCNhrcQAAAMo"]
[Sun Apr 05 23:15:29.608031 2026] [:error] [pid 45303:tid 45324] [client 62.84.185.67:44306] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adJ8kbboQ9eViZ4hdnmF9wAAAAc"]
[Sun Apr 05 23:15:34.095091 2026] [:error] [pid 45409:tid 45431] [client 62.84.185.67:44308] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adJ8ltHt_Oyw03gjCNhrigAAANQ"]
[Sun Apr 05 23:15:37.607169 2026] [:error] [pid 45303:tid 45332] [client 62.84.185.67:49622] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adJ8mbboQ9eViZ4hdnmGDAAAAA8"]
[Sun Apr 05 23:15:40.784533 2026] [:error] [pid 30921:tid 30931] [client 62.84.185.67:49640] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adJ8nGFGQVn8Q0ueB25UlAAAAQg"]
[Sun Apr 05 23:15:44.981777 2026] [:error] [pid 30921:tid 30946] [client 62.84.185.67:49664] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adJ8oGFGQVn8Q0ueB25UnAAAARc"]
[Sun Apr 05 23:15:48.098546 2026] [:error] [pid 45303:tid 45319] [client 62.84.185.67:64030] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adJ8pLboQ9eViZ4hdnmGIQAAAAI"]
[Sun Apr 05 23:15:51.786444 2026] [:error] [pid 45305:tid 45373] [client 62.84.185.67:64046] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adJ8p-jDQjr7aWhjflCL-wAAAII"]
[Sun Apr 05 23:15:56.108617 2026] [:error] [pid 45409:tid 45422] [client 62.84.185.67:45984] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adJ8rNHt_Oyw03gjCNhrvwAAAMs"]
[Sun Apr 05 23:15:58.995547 2026] [:error] [pid 45303:tid 45341] [client 62.84.185.67:45994] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adJ8rrboQ9eViZ4hdnmGawAAABg"]
[Sun Apr 05 23:16:04.399007 2026] [:error] [pid 45303:tid 45339] [client 62.84.185.67:46000] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adJ8tLboQ9eViZ4hdnmGkwAAABY"]
[Sun Apr 05 23:16:08.187002 2026] [:error] [pid 45305:tid 45390] [client 62.84.185.67:51076] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adJ8uOjDQjr7aWhjflCMGAAAAJM"]
[Sun Apr 05 23:16:13.300868 2026] [:error] [pid 45304:tid 45357] [client 62.84.185.67:51086] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adJ8vQ5jnqDKKovdRklBJAAAAE0"]
[Sun Apr 05 23:16:18.097058 2026] [:error] [pid 45409:tid 45430] [client 62.84.185.67:43368] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adJ8wtHt_Oyw03gjCNhr6wAAANM"]
[Sun Apr 05 23:16:21.597736 2026] [:error] [pid 30921:tid 30943] [client 62.84.185.67:43380] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adJ8xWFGQVn8Q0ueB25VAwAAARQ"]
[Sun Apr 05 23:17:14.177497 2026] [:error] [pid 45304:tid 45367] [client 62.84.185.67:61562] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adJ8-g5jnqDKKovdRklBcAAAAFc"]
[Sun Apr 05 23:17:19.992198 2026] [:error] [pid 45409:tid 45419] [client 62.84.185.67:31248] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adJ8_9Ht_Oyw03gjCNhsvgAAAMg"]
[Sun Apr 05 23:17:24.343957 2026] [proxy_fcgi:error] [pid 45303:tid 45333] [client 40.85.219.177:27643] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:17:24.553016 2026] [proxy_fcgi:error] [pid 45303:tid 45332] [client 40.85.219.177:27643] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:17:24.773499 2026] [:error] [pid 45303:tid 45317] [client 62.84.185.67:31260] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adJ9BLboQ9eViZ4hdnmHqAAAAAA"]
[Sun Apr 05 23:17:25.030679 2026] [:error] [pid 45303:tid 45339] [client 40.85.219.177:27643] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "adJ9BbboQ9eViZ4hdnmHqwAAABY"]
[Sun Apr 05 23:17:30.519495 2026] [proxy_fcgi:error] [pid 45303:tid 45331] [client 40.85.219.177:27595] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:17:32.597188 2026] [:error] [pid 30921:tid 30946] [client 62.84.185.67:23004] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adJ9DGFGQVn8Q0ueB25VbgAAARc"]
[Sun Apr 05 23:17:35.501561 2026] [:error] [pid 30921:tid 30941] [client 62.84.185.67:4748] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJ9D2FGQVn8Q0ueB25VewAAARI"]
[Sun Apr 05 23:17:44.799310 2026] [:error] [pid 45409:tid 45432] [client 62.84.185.67:63754] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adJ9GNHt_Oyw03gjCNhtIgAAANU"]
[Sun Apr 05 23:17:49.608084 2026] [:error] [pid 30921:tid 30947] [client 62.84.185.67:22726] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adJ9HWFGQVn8Q0ueB25VkAAAARg"]
[Sun Apr 05 23:17:54.874096 2026] [:error] [pid 45303:tid 45331] [client 62.84.185.67:22742] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adJ9IrboQ9eViZ4hdnmIGAAAAA4"]
[Sun Apr 05 23:17:59.978151 2026] [:error] [pid 45304:tid 45359] [client 62.84.185.67:22560] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adJ9Jw5jnqDKKovdRklBtAAAAE8"]
[Sun Apr 05 23:18:03.808079 2026] [:error] [pid 45304:tid 45355] [client 62.84.185.67:22568] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adJ9Kw5jnqDKKovdRklBxgAAAEs"]
[Sun Apr 05 23:18:28.768434 2026] [proxy_fcgi:error] [pid 45303:tid 45331] [client 40.85.219.177:27633] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:18:28.976602 2026] [:error] [pid 45303:tid 45338] [client 40.85.219.177:27633] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "adJ9RLboQ9eViZ4hdnmImAAAABU"]
[Sun Apr 05 23:18:30.595511 2026] [:error] [pid 45303:tid 45340] [client 40.85.219.177:27626] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "adJ9RrboQ9eViZ4hdnmInAAAABc"]
[Sun Apr 05 23:18:32.705150 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27641] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "adJ9SNHt_Oyw03gjCNhuIAAAAMA"]
[Sun Apr 05 23:18:34.536618 2026] [:error] [pid 30921:tid 30936] [client 40.85.219.177:27628] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/chosen.php"] [unique_id "adJ9SmFGQVn8Q0ueB25WAQAAAQ0"]
[Sun Apr 05 23:18:36.182323 2026] [:error] [pid 45304:tid 45347] [client 40.85.219.177:27600] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "adJ9TA5jnqDKKovdRklB9AAAAEM"]
[Sun Apr 05 23:18:37.994810 2026] [:error] [pid 45303:tid 45330] [client 40.85.219.177:27524] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "adJ9TbboQ9eViZ4hdnmItAAAAA0"]
[Sun Apr 05 23:18:39.726080 2026] [:error] [pid 45304:tid 45347] [client 40.85.219.177:27528] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "adJ9Tw5jnqDKKovdRklCBAAAAEM"]
[Sun Apr 05 23:18:41.589545 2026] [:error] [pid 45303:tid 45339] [client 40.85.219.177:27584] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "adJ9UbboQ9eViZ4hdnmIwAAAABY"]
[Sun Apr 05 23:18:43.243956 2026] [:error] [pid 45304:tid 45363] [client 40.85.219.177:27637] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "adJ9Uw5jnqDKKovdRklCCwAAAFM"]
[Sun Apr 05 23:18:45.545091 2026] [:error] [pid 45304:tid 45359] [client 40.85.219.177:27615] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "adJ9VQ5jnqDKKovdRklCEAAAAE8"]
[Sun Apr 05 23:18:50.908388 2026] [:error] [pid 30921:tid 30937] [client 40.85.219.177:27630] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "adJ9WmFGQVn8Q0ueB25WLgAAAQ4"]
[Sun Apr 05 23:18:54.172711 2026] [:error] [pid 45409:tid 45413] [client 40.85.219.177:27627] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "adJ9XtHt_Oyw03gjCNhuqwAAAMI"]
[Sun Apr 05 23:18:59.094222 2026] [:error] [pid 45303:tid 45320] [client 40.85.219.177:27556] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "adJ9Y7boQ9eViZ4hdnmI7gAAAAM"]
[Sun Apr 05 23:19:03.501299 2026] [:error] [pid 45303:tid 45319] [client 62.84.185.67:32990] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adJ9Z7boQ9eViZ4hdnmJDwAAAAI"]
[Sun Apr 05 23:19:06.015141 2026] [:error] [pid 45303:tid 45335] [client 40.85.219.177:27598] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "adJ9arboQ9eViZ4hdnmJHAAAABI"]
[Sun Apr 05 23:19:08.988307 2026] [:error] [pid 45409:tid 45423] [client 62.84.185.67:12226] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adJ9bNHt_Oyw03gjCNhuzAAAAMw"]
[Sun Apr 05 23:19:09.866180 2026] [:error] [pid 45303:tid 45326] [client 40.85.219.177:27608] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "adJ9bbboQ9eViZ4hdnmJLgAAAAk"]
[Sun Apr 05 23:19:12.470026 2026] [:error] [pid 45303:tid 45319] [client 62.84.185.67:12242] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adJ9cLboQ9eViZ4hdnmJRwAAAAI"]
[Sun Apr 05 23:19:14.074145 2026] [:error] [pid 45304:tid 45359] [client 40.85.219.177:27557] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "adJ9cg5jnqDKKovdRklClQAAAE8"]
[Sun Apr 05 23:19:16.427413 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27599] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/item.php"] [unique_id "adJ9dLboQ9eViZ4hdnmJVAAAABA"]
[Sun Apr 05 23:19:16.776565 2026] [:error] [pid 45304:tid 45364] [client 62.84.185.67:28382] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adJ9dA5jnqDKKovdRklCmAAAAFQ"]
[Sun Apr 05 23:19:18.177973 2026] [:error] [pid 45303:tid 45323] [client 40.85.219.177:27522] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/item.php"] [unique_id "adJ9drboQ9eViZ4hdnmJWwAAAAY"]
[Sun Apr 05 23:19:20.872486 2026] [:error] [pid 30921:tid 30929] [client 40.85.219.177:27599] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/item.php"] [unique_id "adJ9eGFGQVn8Q0ueB25WigAAAQY"]
[Sun Apr 05 23:19:22.401283 2026] [:error] [pid 45409:tid 45418] [client 62.84.185.67:28392] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adJ9etHt_Oyw03gjCNhu_QAAAMc"]
[Sun Apr 05 23:19:23.228767 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27612] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Assets/item.php"] [unique_id "adJ9e9Ht_Oyw03gjCNhvBQAAAMg"]
[Sun Apr 05 23:19:26.856646 2026] [:error] [pid 45304:tid 45350] [client 40.85.219.177:27546] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop/lock.php"] [unique_id "adJ9fg5jnqDKKovdRklCtAAAAEY"]
[Sun Apr 05 23:19:27.101295 2026] [:error] [pid 30921:tid 30926] [client 62.84.185.67:46688] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adJ9f2FGQVn8Q0ueB25WnAAAAQM"]
[Sun Apr 05 23:19:30.361379 2026] [:error] [pid 45304:tid 45352] [client 40.85.219.177:27569] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/preferences/index.php"] [unique_id "adJ9gg5jnqDKKovdRklCxQAAAEg"]
[Sun Apr 05 23:19:32.058527 2026] [:error] [pid 30921:tid 30927] [client 40.85.219.177:27552] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/index.php"] [unique_id "adJ9hGFGQVn8Q0ueB25WrgAAAQQ"]
[Sun Apr 05 23:19:32.090208 2026] [:error] [pid 45304:tid 45344] [client 62.84.185.67:46696] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adJ9hA5jnqDKKovdRklCywAAAEA"]
[Sun Apr 05 23:19:37.114376 2026] [proxy_fcgi:error] [pid 30921:tid 30925] [client 40.85.219.177:27586] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:19:38.996899 2026] [:error] [pid 45409:tid 45419] [client 62.84.185.67:58310] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adJ9itHt_Oyw03gjCNhvTwAAAMg"]
[Sun Apr 05 23:19:40.642474 2026] [:error] [pid 30921:tid 30930] [client 40.85.219.177:27586] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/content.php"] [unique_id "adJ9jGFGQVn8Q0ueB25WwAAAAQc"]
[Sun Apr 05 23:19:42.183929 2026] [:error] [pid 45409:tid 45418] [client 62.84.185.67:58316] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adJ9jtHt_Oyw03gjCNhvYwAAAMc"]
[Sun Apr 05 23:19:44.251074 2026] [:error] [pid 45305:tid 45376] [client 40.85.219.177:27527] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adJ9kOjDQjr7aWhjflCNdgAAAIU"]
[Sun Apr 05 23:19:45.407252 2026] [:error] [pid 45409:tid 45433] [client 62.84.185.67:58318] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adJ9kdHt_Oyw03gjCNhvcwAAANY"]
[Sun Apr 05 23:19:45.456904 2026] [proxy_fcgi:error] [pid 30921:tid 30943] [client 40.85.219.177:27625] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:19:45.669104 2026] [proxy_fcgi:error] [pid 30921:tid 30925] [client 40.85.219.177:27625] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:19:45.972290 2026] [:error] [pid 30921:tid 30945] [client 40.85.219.177:27625] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/wp-login.php"] [unique_id "adJ9kWFGQVn8Q0ueB25WzAAAARY"]
[Sun Apr 05 23:19:47.079252 2026] [proxy_fcgi:error] [pid 45409:tid 45427] [client 40.85.219.177:27621] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:19:47.459872 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27621] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adJ9k9Ht_Oyw03gjCNhvggAAAMg"]
[Sun Apr 05 23:19:48.366135 2026] [:error] [pid 45409:tid 45428] [client 40.85.219.177:27638] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adJ9lNHt_Oyw03gjCNhvhwAAANE"]
[Sun Apr 05 23:19:49.314967 2026] [:error] [pid 45303:tid 45338] [client 40.85.219.177:27601] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adJ9lbboQ9eViZ4hdnmJnQAAABU"]
[Sun Apr 05 23:19:49.580356 2026] [:error] [pid 45409:tid 45432] [client 62.84.185.67:40418] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJ9ldHt_Oyw03gjCNhvkAAAANU"]
[Sun Apr 05 23:19:50.404922 2026] [:error] [pid 45303:tid 45322] [client 40.85.219.177:27589] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "adJ9lrboQ9eViZ4hdnmJpAAAAAU"]
[Sun Apr 05 23:19:51.432057 2026] [:error] [pid 45409:tid 45425] [client 40.85.219.177:27521] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "adJ9l9Ht_Oyw03gjCNhvnQAAAM4"]
[Sun Apr 05 23:19:52.051457 2026] [:error] [pid 30921:tid 30936] [client 40.85.219.177:27606] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "adJ9mGFGQVn8Q0ueB25W0gAAAQ0"]
[Sun Apr 05 23:19:52.795200 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27614] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "adJ9mNHt_Oyw03gjCNhvqQAAAMg"]
[Sun Apr 05 23:19:53.522030 2026] [:error] [pid 45409:tid 45414] [client 40.85.219.177:27555] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/readme.php"] [unique_id "adJ9mdHt_Oyw03gjCNhvsAAAAMM"]
[Sun Apr 05 23:19:54.762615 2026] [:error] [pid 45304:tid 45350] [client 40.85.219.177:27624] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adJ9mg5jnqDKKovdRklC7gAAAEY"]
[Sun Apr 05 23:19:56.048843 2026] [:error] [pid 45305:tid 45377] [client 40.85.219.177:27520] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adJ9nOjDQjr7aWhjflCNiwAAAIY"]
[Sun Apr 05 23:19:56.590732 2026] [:error] [pid 45305:tid 45385] [client 62.84.185.67:32000] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adJ9nOjDQjr7aWhjflCNjQAAAI4"]
[Sun Apr 05 23:19:57.279517 2026] [:error] [pid 45304:tid 45365] [client 40.85.219.177:27459] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adJ9nQ5jnqDKKovdRklC-gAAAFU"]
[Sun Apr 05 23:19:58.780000 2026] [:error] [pid 45409:tid 45435] [client 40.85.219.177:27525] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adJ9ntHt_Oyw03gjCNhvzAAAANg"]
[Sun Apr 05 23:20:02.278128 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27553] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "adJ9otHt_Oyw03gjCNhv8AAAAMg"]
[Sun Apr 05 23:20:06.438570 2026] [:error] [pid 45409:tid 45412] [client 40.85.219.177:27472] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "adJ9ptHt_Oyw03gjCNhwGQAAAME"]
[Sun Apr 05 23:20:12.714975 2026] [:error] [pid 45303:tid 45329] [client 40.85.219.177:27631] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "adJ9rLboQ9eViZ4hdnmJ5gAAAAw"]
[Sun Apr 05 23:20:16.836570 2026] [:error] [pid 45409:tid 45412] [client 40.85.219.177:27485] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-admin.php"] [unique_id "adJ9sNHt_Oyw03gjCNhwOQAAAME"]
[Sun Apr 05 23:20:18.288655 2026] [:error] [pid 45409:tid 45423] [client 40.85.219.177:27642] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-admin.php"] [unique_id "adJ9stHt_Oyw03gjCNhwQgAAAMw"]
[Sun Apr 05 23:20:19.156986 2026] [:error] [pid 30921:tid 30944] [client 40.85.219.177:27611] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-admin.php"] [unique_id "adJ9s2FGQVn8Q0ueB25XCAAAARU"]
[Sun Apr 05 23:20:19.776195 2026] [:error] [pid 45305:tid 45384] [client 40.85.219.177:27533] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-admin.php"] [unique_id "adJ9s-jDQjr7aWhjflCNsAAAAI0"]
[Sun Apr 05 23:20:25.406917 2026] [:error] [pid 45409:tid 45435] [client 40.85.219.177:27602] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/shell.php"] [unique_id "adJ9udHt_Oyw03gjCNhwYQAAANg"]
[Sun Apr 05 23:20:26.375086 2026] [:error] [pid 30921:tid 30926] [client 40.85.219.177:27564] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/shell.php"] [unique_id "adJ9umFGQVn8Q0ueB25XHwAAAQM"]
[Sun Apr 05 23:20:27.744191 2026] [:error] [pid 45305:tid 45376] [client 40.85.219.177:27640] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/shell.php"] [unique_id "adJ9u-jDQjr7aWhjflCNxgAAAIU"]
[Sun Apr 05 23:20:29.476315 2026] [:error] [pid 45409:tid 45413] [client 40.85.219.177:27474] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/shell.php"] [unique_id "adJ9vdHt_Oyw03gjCNhwdQAAAMI"]
[Sun Apr 05 23:20:31.815400 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27558] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/bak.php"] [unique_id "adJ9v9Ht_Oyw03gjCNhwmQAAANc"]
[Sun Apr 05 23:20:33.411433 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27523] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/bak.php"] [unique_id "adJ9wbboQ9eViZ4hdnmKSgAAABA"]
[Sun Apr 05 23:20:36.301366 2026] [:error] [pid 45409:tid 45433] [client 40.85.219.177:27645] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/bak.php"] [unique_id "adJ9xNHt_Oyw03gjCNhwswAAANY"]
[Sun Apr 05 23:20:37.662807 2026] [:error] [pid 45409:tid 45418] [client 40.85.219.177:27629] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/bak.php"] [unique_id "adJ9xdHt_Oyw03gjCNhwvAAAAMc"]
[Sun Apr 05 23:20:38.915349 2026] [:error] [pid 45409:tid 45429] [client 40.85.219.177:27588] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "adJ9xtHt_Oyw03gjCNhwygAAANI"]
[Sun Apr 05 23:20:39.647322 2026] [:error] [pid 30921:tid 30928] [client 40.85.219.177:27542] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "adJ9x2FGQVn8Q0ueB25XPgAAAQU"]
[Sun Apr 05 23:20:40.209621 2026] [:error] [pid 45303:tid 45330] [client 40.85.219.177:27585] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "adJ9yLboQ9eViZ4hdnmKfQAAAA0"]
[Sun Apr 05 23:20:41.194958 2026] [:error] [pid 45409:tid 45429] [client 40.85.219.177:27545] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "adJ9ydHt_Oyw03gjCNhw1wAAANI"]
[Sun Apr 05 23:20:42.043185 2026] [:error] [pid 45409:tid 45416] [client 40.85.219.177:27539] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "adJ9ytHt_Oyw03gjCNhw4QAAAMU"]
[Sun Apr 05 23:20:42.907023 2026] [:error] [pid 45303:tid 45317] [client 40.85.219.177:27540] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "adJ9yrboQ9eViZ4hdnmKiAAAAAA"]
[Sun Apr 05 23:20:43.771690 2026] [:error] [pid 45409:tid 45431] [client 40.85.219.177:27567] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "adJ9y9Ht_Oyw03gjCNhw_AAAANQ"]
[Sun Apr 05 23:20:44.574791 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27538] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/about.php"] [unique_id "adJ9zNHt_Oyw03gjCNhxBgAAAMA"]
[Sun Apr 05 23:20:45.828798 2026] [:error] [pid 45304:tid 45359] [client 40.85.219.177:27587] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "adJ9zQ5jnqDKKovdRklDYAAAAE8"]
[Sun Apr 05 23:20:46.675883 2026] [:error] [pid 45409:tid 45428] [client 40.85.219.177:27541] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/date.php"] [unique_id "adJ9ztHt_Oyw03gjCNhxGwAAANE"]
[Sun Apr 05 23:20:47.960406 2026] [:error] [pid 45304:tid 45357] [client 40.85.219.177:27529] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/network.php"] [unique_id "adJ9zw5jnqDKKovdRklDaAAAAE0"]
[Sun Apr 05 23:20:49.360386 2026] [:error] [pid 45303:tid 45335] [client 40.85.219.177:27623] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/chosen.php"] [unique_id "adJ90bboQ9eViZ4hdnmKoAAAABI"]
[Sun Apr 05 23:20:50.787914 2026] [proxy_fcgi:error] [pid 30921:tid 30946] [client 40.85.219.177:27582] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:20:51.448624 2026] [:error] [pid 30921:tid 30926] [client 40.85.219.177:27582] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/shell.php"] [unique_id "adJ902FGQVn8Q0ueB25XUwAAAQM"]
[Sun Apr 05 23:20:52.761253 2026] [proxy_fcgi:error] [pid 45303:tid 45337] [client 40.85.219.177:27607] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:20:53.205647 2026] [:error] [pid 45303:tid 45319] [client 40.85.219.177:27607] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/variations.php"] [unique_id "adJ91bboQ9eViZ4hdnmKtAAAAAI"]
[Sun Apr 05 23:20:54.197921 2026] [:error] [pid 45305:tid 45378] [client 40.85.219.177:27646] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/wp-login.php"] [unique_id "adJ91ujDQjr7aWhjflCN9QAAAIc"]
[Sun Apr 05 23:20:55.392568 2026] [proxy_fcgi:error] [pid 45409:tid 45416] [client 40.85.219.177:27531] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:20:55.615477 2026] [proxy_fcgi:error] [pid 45409:tid 45434] [client 40.85.219.177:27531] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:20:55.819942 2026] [:error] [pid 45409:tid 45422] [client 40.85.219.177:27531] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adJ919Ht_Oyw03gjCNhxVwAAAMs"]
[Sun Apr 05 23:20:57.035946 2026] [:error] [pid 45305:tid 45378] [client 40.85.219.177:27597] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adJ92ejDQjr7aWhjflCOAgAAAIc"]
[Sun Apr 05 23:20:58.555705 2026] [:error] [pid 45303:tid 45328] [client 40.85.219.177:27549] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adJ92rboQ9eViZ4hdnmK0QAAAAs"]
[Sun Apr 05 23:20:59.332018 2026] [:error] [pid 45303:tid 45321] [client 40.85.219.177:27594] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adJ927boQ9eViZ4hdnmK1wAAAAQ"]
[Sun Apr 05 23:21:00.116953 2026] [:error] [pid 45305:tid 45393] [client 40.85.219.177:27471] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/siteindex.php"] [unique_id "adJ93OjDQjr7aWhjflCOBwAAAJY"]
[Sun Apr 05 23:21:00.936035 2026] [:error] [pid 45305:tid 45394] [client 40.85.219.177:27460] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/siteindex.php"] [unique_id "adJ93OjDQjr7aWhjflCOCgAAAJc"]
[Sun Apr 05 23:21:02.764958 2026] [:error] [pid 45304:tid 45351] [client 40.85.219.177:27563] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/siteindex.php"] [unique_id "adJ93g5jnqDKKovdRklDeAAAAEc"]
[Sun Apr 05 23:21:03.629538 2026] [:error] [pid 45303:tid 45325] [client 40.85.219.177:27526] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/siteindex.php"] [unique_id "adJ937boQ9eViZ4hdnmK8gAAAAg"]
[Sun Apr 05 23:21:04.719998 2026] [:error] [pid 30921:tid 30943] [client 40.85.219.177:27578] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/DaoZM.php"] [unique_id "adJ94GFGQVn8Q0ueB25XbwAAARQ"]
[Sun Apr 05 23:21:05.776335 2026] [:error] [pid 45303:tid 45340] [client 40.85.219.177:27554] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/DaoZM.php"] [unique_id "adJ94bboQ9eViZ4hdnmLAQAAABc"]
[Sun Apr 05 23:21:07.400111 2026] [:error] [pid 45305:tid 45388] [client 40.85.219.177:27505] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/DaoZM.php"] [unique_id "adJ94-jDQjr7aWhjflCOGgAAAJE"]
[Sun Apr 05 23:21:08.389671 2026] [:error] [pid 45304:tid 45360] [client 40.85.219.177:27618] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugins/DaoZM.php"] [unique_id "adJ95A5jnqDKKovdRklDkwAAAFA"]
[Sun Apr 05 23:21:09.226657 2026] [:error] [pid 30921:tid 30927] [client 40.85.219.177:27468] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/install.php"] [unique_id "adJ95WFGQVn8Q0ueB25XfAAAAQQ"]
[Sun Apr 05 23:21:09.958003 2026] [:error] [pid 30921:tid 30938] [client 40.85.219.177:27616] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/install.php"] [unique_id "adJ95WFGQVn8Q0ueB25XfwAAAQ8"]
[Sun Apr 05 23:21:10.771894 2026] [:error] [pid 45303:tid 45332] [client 40.85.219.177:27562] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/install.php"] [unique_id "adJ95rboQ9eViZ4hdnmLCwAAAA8"]
[Sun Apr 05 23:21:11.325554 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27647] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/install.php"] [unique_id "adJ959Ht_Oyw03gjCNhxegAAANc"]
[Sun Apr 05 23:21:11.884641 2026] [:error] [pid 30921:tid 30944] [client 40.85.219.177:27467] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/1.php"] [unique_id "adJ952FGQVn8Q0ueB25XhwAAARU"]
[Sun Apr 05 23:21:12.770166 2026] [:error] [pid 45304:tid 45362] [client 40.85.219.177:27622] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/1.php"] [unique_id "adJ96A5jnqDKKovdRklDpQAAAFI"]
[Sun Apr 05 23:21:14.662868 2026] [:error] [pid 45409:tid 45432] [client 40.85.219.177:27617] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/1.php"] [unique_id "adJ96tHt_Oyw03gjCNhxjQAAANU"]
[Sun Apr 05 23:21:15.322086 2026] [:error] [pid 45303:tid 45337] [client 40.85.219.177:27609] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/1.php"] [unique_id "adJ967boQ9eViZ4hdnmLJwAAABQ"]
[Sun Apr 05 23:21:16.020784 2026] [:error] [pid 30921:tid 30936] [client 40.85.219.177:27462] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "adJ97GFGQVn8Q0ueB25XlwAAAQ0"]
[Sun Apr 05 23:21:17.201124 2026] [:error] [pid 30921:tid 30933] [client 40.85.219.177:27632] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "adJ97WFGQVn8Q0ueB25XngAAAQo"]
[Sun Apr 05 23:21:18.153466 2026] [:error] [pid 45305:tid 45385] [client 40.85.219.177:27465] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "adJ97ujDQjr7aWhjflCORgAAAI4"]
[Sun Apr 05 23:21:20.610219 2026] [:error] [pid 45304:tid 45366] [client 40.85.219.177:27573] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "adJ98A5jnqDKKovdRklDvgAAAFY"]
[Sun Apr 05 23:21:26.174566 2026] [:error] [pid 45409:tid 45412] [client 40.85.219.177:27535] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/gecko.php"] [unique_id "adJ99tHt_Oyw03gjCNhxsQAAAME"]
[Sun Apr 05 23:21:28.350201 2026] [:error] [pid 45305:tid 45383] [client 40.85.219.177:27590] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/gecko.php"] [unique_id "adJ9-OjDQjr7aWhjflCOYQAAAIw"]
[Sun Apr 05 23:21:30.034573 2026] [:error] [pid 45304:tid 45346] [client 40.85.219.177:27544] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/gecko.php"] [unique_id "adJ9-g5jnqDKKovdRklEAwAAAEI"]
[Sun Apr 05 23:21:31.493997 2026] [:error] [pid 30921:tid 30944] [client 40.85.219.177:27482] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/gecko.php"] [unique_id "adJ9-2FGQVn8Q0ueB25XygAAARU"]
[Sun Apr 05 23:21:32.683716 2026] [:error] [pid 45304:tid 45363] [client 40.85.219.177:27583] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/lock.php"] [unique_id "adJ9_A5jnqDKKovdRklEFgAAAFM"]
[Sun Apr 05 23:21:34.012844 2026] [:error] [pid 30921:tid 30944] [client 40.85.219.177:27636] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/lock.php"] [unique_id "adJ9_mFGQVn8Q0ueB25X1QAAARU"]
[Sun Apr 05 23:21:34.912274 2026] [:error] [pid 30921:tid 30947] [client 40.85.219.177:27547] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/lock.php"] [unique_id "adJ9_mFGQVn8Q0ueB25X2QAAARg"]
[Sun Apr 05 23:21:36.199205 2026] [:error] [pid 30921:tid 30945] [client 40.85.219.177:27492] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/lock.php"] [unique_id "adJ-AGFGQVn8Q0ueB25X4AAAARY"]
[Sun Apr 05 23:21:37.103071 2026] [:error] [pid 45303:tid 45326] [client 40.85.219.177:27515] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/item.php"] [unique_id "adJ-AbboQ9eViZ4hdnmLaQAAAAk"]
[Sun Apr 05 23:21:37.832180 2026] [:error] [pid 45303:tid 45335] [client 40.85.219.177:27605] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/item.php"] [unique_id "adJ-AbboQ9eViZ4hdnmLcAAAABI"]
[Sun Apr 05 23:21:38.309570 2026] [:error] [pid 45303:tid 45318] [client 40.85.219.177:27461] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/item.php"] [unique_id "adJ-ArboQ9eViZ4hdnmLdQAAAAE"]
[Sun Apr 05 23:21:39.401688 2026] [:error] [pid 30921:tid 30928] [client 40.85.219.177:27479] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assets/item.php"] [unique_id "adJ-A2FGQVn8Q0ueB25X6wAAAQU"]
[Sun Apr 05 23:21:43.871597 2026] [:error] [pid 45409:tid 45425] [client 40.85.219.177:27574] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/system.php"] [unique_id "adJ-B9Ht_Oyw03gjCNhyGwAAAM4"]
[Sun Apr 05 23:21:49.464801 2026] [:error] [pid 30921:tid 30924] [client 40.85.219.177:27499] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/wp-conflg.php"] [unique_id "adJ-DWFGQVn8Q0ueB25X_AAAAQE"]
[Sun Apr 05 23:21:53.622084 2026] [:error] [pid 45409:tid 45413] [client 40.85.219.177:27548] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about/wp-conflg.php"] [unique_id "adJ-EdHt_Oyw03gjCNhyXQAAAMI"]
[Sun Apr 05 23:21:55.941617 2026] [:error] [pid 45305:tid 45392] [client 40.85.219.177:27619] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/alfa-rex.php"] [unique_id "adJ-E-jDQjr7aWhjflCOkAAAAJU"]
[Sun Apr 05 23:21:57.605730 2026] [:error] [pid 45303:tid 45339] [client 40.85.219.177:27481] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adJ-FbboQ9eViZ4hdnmLxgAAABY"]
[Sun Apr 05 23:21:58.496867 2026] [proxy_fcgi:error] [pid 45303:tid 45335] [client 40.85.219.177:27479] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:21:58.706529 2026] [proxy_fcgi:error] [pid 45303:tid 45329] [client 40.85.219.177:27479] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:21:59.198046 2026] [proxy_fcgi:error] [pid 45303:tid 45327] [client 40.85.219.177:27479] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:21:59.714024 2026] [:error] [pid 45303:tid 45332] [client 40.85.219.177:27479] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/about.php"] [unique_id "adJ-F7boQ9eViZ4hdnmL3QAAAA8"]
[Sun Apr 05 23:22:00.753451 2026] [proxy_fcgi:error] [pid 45409:tid 45433] [client 40.85.219.177:27560] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:22:01.199683 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 40.85.219.177:27560] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:22:01.404864 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27560] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adJ-GdHt_Oyw03gjCNhyhwAAAMg"]
[Sun Apr 05 23:22:02.307643 2026] [:error] [pid 45305:tid 45372] [client 40.85.219.177:27489] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adJ-GujDQjr7aWhjflCOowAAAIE"]
[Sun Apr 05 23:22:03.189999 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27634] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adJ-G9Ht_Oyw03gjCNhyjgAAAMA"]
[Sun Apr 05 23:22:04.634460 2026] [:error] [pid 45409:tid 45430] [client 40.85.219.177:27407] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adJ-HNHt_Oyw03gjCNhymQAAANM"]
[Sun Apr 05 23:22:05.458917 2026] [:error] [pid 45304:tid 45361] [client 40.85.219.177:27610] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adJ-HQ5jnqDKKovdRklEZwAAAFE"]
[Sun Apr 05 23:22:06.291985 2026] [:error] [pid 45303:tid 45319] [client 40.85.219.177:27473] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/autoload_classmap.php"] [unique_id "adJ-HrboQ9eViZ4hdnmL8QAAAAI"]
[Sun Apr 05 23:22:07.174672 2026] [:error] [pid 45303:tid 45340] [client 40.85.219.177:27543] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/autoload_classmap.php"] [unique_id "adJ-H7boQ9eViZ4hdnmL-QAAABc"]
[Sun Apr 05 23:22:08.216054 2026] [:error] [pid 45303:tid 45328] [client 40.85.219.177:27426] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/autoload_classmap.php"] [unique_id "adJ-ILboQ9eViZ4hdnmMAgAAAAs"]
[Sun Apr 05 23:22:08.972829 2026] [:error] [pid 30921:tid 30940] [client 40.85.219.177:27426] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/autoload_classmap.php"] [unique_id "adJ-IGFGQVn8Q0ueB25YDwAAARE"]
[Sun Apr 05 23:22:10.177838 2026] [:error] [pid 45409:tid 45425] [client 40.85.219.177:27470] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/radio.php"] [unique_id "adJ-ItHt_Oyw03gjCNhyvQAAAM4"]
[Sun Apr 05 23:22:11.454777 2026] [:error] [pid 45305:tid 45373] [client 40.85.219.177:27536] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/radio.php"] [unique_id "adJ-I-jDQjr7aWhjflCOqwAAAII"]
[Sun Apr 05 23:22:12.566169 2026] [:error] [pid 45409:tid 45429] [client 40.85.219.177:27518] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/radio.php"] [unique_id "adJ-JNHt_Oyw03gjCNhyxwAAANI"]
[Sun Apr 05 23:22:13.652853 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27570] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/radio.php"] [unique_id "adJ-JdHt_Oyw03gjCNhy0QAAANc"]
[Sun Apr 05 23:22:14.635694 2026] [:error] [pid 45409:tid 45425] [client 40.85.219.177:27475] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/Cache.php"] [unique_id "adJ-JtHt_Oyw03gjCNhy2QAAAM4"]
[Sun Apr 05 23:22:15.535686 2026] [:error] [pid 30921:tid 30931] [client 40.85.219.177:27530] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/Cache.php"] [unique_id "adJ-J2FGQVn8Q0ueB25YLgAAAQg"]
[Sun Apr 05 23:22:16.394582 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27537] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/Cache.php"] [unique_id "adJ-KNHt_Oyw03gjCNhy3wAAAMg"]
[Sun Apr 05 23:22:17.275416 2026] [:error] [pid 45303:tid 45329] [client 40.85.219.177:27469] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/Cache.php"] [unique_id "adJ-KbboQ9eViZ4hdnmMDQAAAAw"]
[Sun Apr 05 23:22:18.183118 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27495] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "adJ-KtHt_Oyw03gjCNhy7wAAANc"]
[Sun Apr 05 23:22:19.515773 2026] [:error] [pid 45409:tid 45417] [client 40.85.219.177:27503] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "adJ-K9Ht_Oyw03gjCNhy_AAAAMY"]
[Sun Apr 05 23:22:21.694988 2026] [:error] [pid 45409:tid 45414] [client 40.85.219.177:27643] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "adJ-LdHt_Oyw03gjCNhzBAAAAMM"]
[Sun Apr 05 23:22:24.928548 2026] [:error] [pid 45409:tid 45417] [client 40.85.219.177:27417] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "adJ-MNHt_Oyw03gjCNhzDwAAAMY"]
[Sun Apr 05 23:22:27.501069 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27511] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "adJ-M9Ht_Oyw03gjCNhzIQAAAMg"]
[Sun Apr 05 23:22:28.052856 2026] [:error] [pid 45409:tid 45431] [client 40.85.219.177:27457] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "adJ-NNHt_Oyw03gjCNhzJQAAANQ"]
[Sun Apr 05 23:22:29.043784 2026] [:error] [pid 45409:tid 45413] [client 40.85.219.177:27476] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "adJ-NdHt_Oyw03gjCNhzLQAAAMI"]
[Sun Apr 05 23:22:30.400228 2026] [:error] [pid 45304:tid 45345] [client 40.85.219.177:27493] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/packed.php"] [unique_id "adJ-Ng5jnqDKKovdRklEhAAAAEE"]
[Sun Apr 05 23:22:31.214790 2026] [:error] [pid 45409:tid 45435] [client 40.85.219.177:27596] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "adJ-N9Ht_Oyw03gjCNhzPQAAANg"]
[Sun Apr 05 23:22:32.029789 2026] [:error] [pid 45304:tid 45351] [client 40.85.219.177:27635] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "adJ-OA5jnqDKKovdRklEhgAAAEc"]
[Sun Apr 05 23:22:33.820729 2026] [:error] [pid 45409:tid 45414] [client 40.85.219.177:27581] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "adJ-OdHt_Oyw03gjCNhzWgAAAMM"]
[Sun Apr 05 23:22:35.507860 2026] [:error] [pid 45303:tid 45317] [client 40.85.219.177:27532] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/link.php"] [unique_id "adJ-O7boQ9eViZ4hdnmMQQAAAAA"]
[Sun Apr 05 23:22:36.215550 2026] [:error] [pid 45303:tid 45332] [client 40.85.219.177:27644] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adJ-PLboQ9eViZ4hdnmMRgAAAA8"]
[Sun Apr 05 23:22:37.699562 2026] [:error] [pid 45305:tid 45380] [client 40.85.219.177:27394] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adJ-PejDQjr7aWhjflCO5QAAAIk"]
[Sun Apr 05 23:22:38.486133 2026] [:error] [pid 45409:tid 45423] [client 40.85.219.177:27576] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adJ-PtHt_Oyw03gjCNhzagAAAMw"]
[Sun Apr 05 23:22:39.132042 2026] [:error] [pid 45304:tid 45349] [client 40.85.219.177:27456] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "adJ-Pw5jnqDKKovdRklEkwAAAEU"]
[Sun Apr 05 23:22:41.750971 2026] [:error] [pid 45305:tid 45375] [client 40.85.219.177:27400] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "adJ-QejDQjr7aWhjflCO-wAAAIQ"]
[Sun Apr 05 23:22:43.821988 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27508] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "adJ-Q7boQ9eViZ4hdnmMWwAAABA"]
[Sun Apr 05 23:22:45.642580 2026] [:error] [pid 45409:tid 45423] [client 40.85.219.177:27414] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "adJ-RdHt_Oyw03gjCNhzkwAAAMw"]
[Sun Apr 05 23:22:47.157801 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27524] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/plugins.php"] [unique_id "adJ-R9Ht_Oyw03gjCNhzmAAAANc"]
[Sun Apr 05 23:22:47.851048 2026] [:error] [pid 45409:tid 45416] [client 40.85.219.177:27595] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "adJ-R9Ht_Oyw03gjCNhzogAAAMU"]
[Sun Apr 05 23:22:49.411233 2026] [:error] [pid 45304:tid 45368] [client 40.85.219.177:27568] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adJ-SQ5jnqDKKovdRklEqAAAAFg"]
[Sun Apr 05 23:22:50.208748 2026] [:error] [pid 45409:tid 45418] [client 40.85.219.177:27420] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adJ-StHt_Oyw03gjCNhzsAAAAMc"]
[Sun Apr 05 23:22:50.874257 2026] [:error] [pid 30921:tid 30924] [client 40.85.219.177:27550] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adJ-SmFGQVn8Q0ueB25YYQAAAQE"]
[Sun Apr 05 23:22:51.632558 2026] [:error] [pid 30921:tid 30947] [client 40.85.219.177:27478] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adJ-S2FGQVn8Q0ueB25YZQAAARg"]
[Sun Apr 05 23:22:53.893628 2026] [:error] [pid 45304:tid 45367] [client 40.85.219.177:27534] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adJ-TQ5jnqDKKovdRklEtQAAAFc"]
[Sun Apr 05 23:22:55.432517 2026] [:error] [pid 30921:tid 30933] [client 40.85.219.177:27431] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adJ-T2FGQVn8Q0ueB25YegAAAQo"]
[Sun Apr 05 23:22:57.603388 2026] [:error] [pid 45305:tid 45375] [client 40.85.219.177:27396] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adJ-UejDQjr7aWhjflCPFwAAAIQ"]
[Sun Apr 05 23:23:00.074875 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27517] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin.php"] [unique_id "adJ-VNHt_Oyw03gjCNhzwQAAAMA"]
[Sun Apr 05 23:23:01.237524 2026] [:error] [pid 45409:tid 45434] [client 40.85.219.177:27528] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "adJ-VdHt_Oyw03gjCNhzyAAAANc"]
[Sun Apr 05 23:23:02.550043 2026] [:error] [pid 45409:tid 45431] [client 40.85.219.177:27427] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "adJ-VtHt_Oyw03gjCNhz2gAAANQ"]
[Sun Apr 05 23:23:05.097449 2026] [:error] [pid 45303:tid 45337] [client 40.85.219.177:27575] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adJ-WbboQ9eViZ4hdnmMlwAAABQ"]
[Sun Apr 05 23:23:07.131544 2026] [proxy_fcgi:error] [pid 30921:tid 30934] [client 40.85.219.177:27405] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:23:07.345272 2026] [proxy_fcgi:error] [pid 30921:tid 30930] [client 40.85.219.177:27405] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:23:07.604891 2026] [:error] [pid 30921:tid 30923] [client 40.85.219.177:27405] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "adJ-W2FGQVn8Q0ueB25YkgAAAQA"]
[Sun Apr 05 23:23:09.053506 2026] [proxy_fcgi:error] [pid 45303:tid 45327] [client 40.85.219.177:27639] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:23:09.896920 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27639] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "adJ-XbboQ9eViZ4hdnmMtAAAABA"]
[Sun Apr 05 23:23:12.612836 2026] [:error] [pid 45303:tid 45335] [client 40.85.219.177:27480] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Utility/cc.php"] [unique_id "adJ-YLboQ9eViZ4hdnmMvgAAABI"]
[Sun Apr 05 23:23:13.668149 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27637] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "adJ-YdHt_Oyw03gjCNh0DgAAAMA"]
[Sun Apr 05 23:23:15.023520 2026] [:error] [pid 45303:tid 45328] [client 40.85.219.177:27498] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "adJ-Y7boQ9eViZ4hdnmMzwAAAAs"]
[Sun Apr 05 23:23:16.684314 2026] [:error] [pid 45303:tid 45339] [client 40.85.219.177:27458] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "adJ-ZLboQ9eViZ4hdnmM3gAAABY"]
[Sun Apr 05 23:23:18.461588 2026] [:error] [pid 30921:tid 30940] [client 40.85.219.177:27502] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "adJ-ZmFGQVn8Q0ueB25YsAAAARE"]
[Sun Apr 05 23:23:20.605184 2026] [:error] [pid 45409:tid 45427] [client 40.85.219.177:27565] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "adJ-aNHt_Oyw03gjCNh0NAAAANA"]
[Sun Apr 05 23:23:23.048819 2026] [:error] [pid 45409:tid 45427] [client 40.85.219.177:27510] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/update.php"] [unique_id "adJ-a9Ht_Oyw03gjCNh0RQAAANA"]
[Sun Apr 05 23:23:24.303638 2026] [:error] [pid 45303:tid 45336] [client 40.85.219.177:27477] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/update.php"] [unique_id "adJ-bLboQ9eViZ4hdnmM_QAAABM"]
[Sun Apr 05 23:23:26.476961 2026] [:error] [pid 45304:tid 45344] [client 40.85.219.177:27490] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/update.php"] [unique_id "adJ-bg5jnqDKKovdRklE2wAAAEA"]
[Sun Apr 05 23:23:29.091070 2026] [:error] [pid 45304:tid 45359] [client 40.85.219.177:27522] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/update.php"] [unique_id "adJ-cQ5jnqDKKovdRklE4gAAAE8"]
[Sun Apr 05 23:23:31.542664 2026] [:error] [pid 45303:tid 45341] [client 40.85.219.177:27579] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "adJ-c7boQ9eViZ4hdnmNQQAAABg"]
[Sun Apr 05 23:23:34.120738 2026] [:error] [pid 45304:tid 45349] [client 40.85.219.177:27393] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "adJ-dg5jnqDKKovdRklFCQAAAEU"]
[Sun Apr 05 23:23:39.979384 2026] [:error] [pid 45409:tid 45427] [client 40.85.219.177:27566] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/astra/inc/fm.php"] [unique_id "adJ-e9Ht_Oyw03gjCNh0iwAAANA"]
[Sun Apr 05 23:23:48.167704 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27406] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "adJ-hLboQ9eViZ4hdnmNbAAAABA"]
[Sun Apr 05 23:23:50.366617 2026] [:error] [pid 45304:tid 45352] [client 40.85.219.177:27604] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "adJ-hg5jnqDKKovdRklFKAAAAEg"]
[Sun Apr 05 23:23:51.562076 2026] [:error] [pid 30921:tid 30934] [client 40.85.219.177:27557] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "adJ-h2FGQVn8Q0ueB25Y_wAAAQs"]
[Sun Apr 05 23:23:52.769509 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27625] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "adJ-iNHt_Oyw03gjCNh0zAAAAMg"]
[Sun Apr 05 23:23:55.261345 2026] [:error] [pid 45409:tid 45428] [client 40.85.219.177:27561] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "adJ-i9Ht_Oyw03gjCNh05QAAANE"]
[Sun Apr 05 23:23:58.488245 2026] [:error] [pid 45409:tid 45427] [client 40.85.219.177:27501] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "adJ-jtHt_Oyw03gjCNh07gAAANA"]
[Sun Apr 05 23:23:59.997704 2026] [:error] [pid 30921:tid 30938] [client 40.85.219.177:27399] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "adJ-j2FGQVn8Q0ueB25ZEAAAAQ8"]
[Sun Apr 05 23:24:02.185544 2026] [:error] [pid 45409:tid 45426] [client 40.85.219.177:27520] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/mu-plugins/gecko.php"] [unique_id "adJ-ktHt_Oyw03gjCNh0-QAAAM8"]
[Sun Apr 05 23:24:05.172766 2026] [:error] [pid 30921:tid 30927] [client 40.85.219.177:27519] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "adJ-lWFGQVn8Q0ueB25ZIgAAAQQ"]
[Sun Apr 05 23:24:07.646687 2026] [:error] [pid 45409:tid 45431] [client 40.85.219.177:27583] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "adJ-l9Ht_Oyw03gjCNh1CgAAANQ"]
[Sun Apr 05 23:24:08.448396 2026] [:error] [pid 45409:tid 45425] [client 40.85.219.177:27606] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "adJ-mNHt_Oyw03gjCNh1EgAAAM4"]
[Sun Apr 05 23:24:10.544341 2026] [:error] [pid 45409:tid 45416] [client 40.85.219.177:27584] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "adJ-mtHt_Oyw03gjCNh1JwAAAMU"]
[Sun Apr 05 23:24:12.000535 2026] [:error] [pid 45305:tid 45373] [client 40.85.219.177:27628] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adJ-m-jDQjr7aWhjflCP1QAAAII"]
[Sun Apr 05 23:24:12.567173 2026] [proxy_fcgi:error] [pid 45303:tid 45318] [client 40.85.219.177:27552] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:12.776725 2026] [proxy_fcgi:error] [pid 45303:tid 45333] [client 40.85.219.177:27552] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:13.011990 2026] [proxy_fcgi:error] [pid 45303:tid 45321] [client 40.85.219.177:27552] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:13.794344 2026] [:error] [pid 45303:tid 45334] [client 40.85.219.177:27552] [client 40.85.219.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.85.219.177, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adJ-nbboQ9eViZ4hdnmNpQAAABE"]
[Sun Apr 05 23:24:13.799131 2026] [proxy_fcgi:error] [pid 45303:tid 45334] [client 40.85.219.177:27552] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:14.017144 2026] [proxy_fcgi:error] [pid 45303:tid 45332] [client 40.85.219.177:27552] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:14.611273 2026] [:error] [pid 45303:tid 45340] [client 40.85.219.177:27552] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/admin.php"] [unique_id "adJ-nrboQ9eViZ4hdnmNqQAAABc"]
[Sun Apr 05 23:24:15.331685 2026] [proxy_fcgi:error] [pid 45409:tid 45434] [client 40.85.219.177:27614] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:15.650824 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 40.85.219.177:27614] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:16.342444 2026] [:error] [pid 45409:tid 45424] [client 40.85.219.177:27614] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "adJ-oNHt_Oyw03gjCNh1dgAAAM0"]
[Sun Apr 05 23:24:17.401968 2026] [:error] [pid 30921:tid 30942] [client 40.85.219.177:27491] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/install.php"] [unique_id "adJ-oWFGQVn8Q0ueB25ZQgAAARM"]
[Sun Apr 05 23:24:18.122806 2026] [proxy_fcgi:error] [pid 45303:tid 45322] [client 40.85.219.177:27586] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:24:18.566370 2026] [:error] [pid 45303:tid 45335] [client 40.85.219.177:27586] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adJ-orboQ9eViZ4hdnmNtAAAABI"]
[Sun Apr 05 23:24:19.100027 2026] [:error] [pid 30921:tid 30923] [client 40.85.219.177:27592] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adJ-o2FGQVn8Q0ueB25ZSAAAAQA"]
[Sun Apr 05 23:24:20.515589 2026] [:error] [pid 45305:tid 45378] [client 40.85.219.177:27631] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adJ-pOjDQjr7aWhjflCP4gAAAIc"]
[Sun Apr 05 23:24:21.677303 2026] [:error] [pid 45303:tid 45323] [client 40.85.219.177:27601] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/user/chosen.php"] [unique_id "adJ-pbboQ9eViZ4hdnmNwQAAAAY"]
[Sun Apr 05 23:24:22.377673 2026] [:error] [pid 45304:tid 45344] [client 40.85.219.177:27419] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "adJ-pg5jnqDKKovdRklFSgAAAEA"]
[Sun Apr 05 23:24:23.371688 2026] [:error] [pid 45303:tid 45325] [client 40.85.219.177:27630] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "adJ-p7boQ9eViZ4hdnmNyQAAAAg"]
[Sun Apr 05 23:24:24.423902 2026] [:error] [pid 45409:tid 45411] [client 40.85.219.177:27496] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "adJ-qNHt_Oyw03gjCNh1xQAAAMA"]
[Sun Apr 05 23:24:25.977998 2026] [:error] [pid 45303:tid 45320] [client 40.85.219.177:27633] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "adJ-qbboQ9eViZ4hdnmN1QAAAAM"]
[Sun Apr 05 23:24:30.711516 2026] [:error] [pid 45305:tid 45371] [client 40.85.219.177:27577] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "adJ-rujDQjr7aWhjflCP_AAAAIA"]
[Sun Apr 05 23:24:31.742257 2026] [:error] [pid 30921:tid 30929] [client 40.85.219.177:27591] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "adJ-r2FGQVn8Q0ueB25ZZAAAAQY"]
[Sun Apr 05 23:24:34.574668 2026] [:error] [pid 45303:tid 45325] [client 40.85.219.177:27512] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "adJ-srboQ9eViZ4hdnmN_AAAAAg"]
[Sun Apr 05 23:24:35.889440 2026] [:error] [pid 45304:tid 45347] [client 40.85.219.177:27486] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "adJ-sw5jnqDKKovdRklFZAAAAEM"]
[Sun Apr 05 23:24:39.007030 2026] [:error] [pid 45304:tid 45355] [client 40.85.219.177:27564] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "adJ-tw5jnqDKKovdRklFgQAAAEs"]
[Sun Apr 05 23:24:40.115231 2026] [:error] [pid 45303:tid 45328] [client 40.85.219.177:27344] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "adJ-uLboQ9eViZ4hdnmOMgAAAAs"]
[Sun Apr 05 23:24:41.790969 2026] [:error] [pid 45305:tid 45382] [client 40.85.219.177:27553] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "adJ-uejDQjr7aWhjflCQFwAAAIs"]
[Sun Apr 05 23:24:43.086768 2026] [:error] [pid 45303:tid 45334] [client 40.85.219.177:27497] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "adJ-u7boQ9eViZ4hdnmOSwAAABE"]
[Sun Apr 05 23:24:45.246163 2026] [:error] [pid 45409:tid 45427] [client 40.85.219.177:27521] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adJ-vdHt_Oyw03gjCNh2JgAAANA"]
[Sun Apr 05 23:24:47.940961 2026] [:error] [pid 45303:tid 45331] [client 40.85.219.177:27558] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "adJ-v7boQ9eViZ4hdnmOZwAAAA4"]
[Sun Apr 05 23:24:50.686926 2026] [:error] [pid 45304:tid 45349] [client 40.85.219.177:27454] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "adJ-wg5jnqDKKovdRklFvwAAAEU"]
[Sun Apr 05 23:24:54.955413 2026] [:error] [pid 45303:tid 45317] [client 40.85.219.177:27623] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "adJ-xrboQ9eViZ4hdnmOhQAAAAA"]
[Sun Apr 05 23:25:01.170740 2026] [:error] [pid 45305:tid 45378] [client 40.85.219.177:27613] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/about.php"] [unique_id "adJ-zejDQjr7aWhjflCQQAAAAIc"]
[Sun Apr 05 23:25:08.277892 2026] [:error] [pid 45304:tid 45352] [client 40.85.219.177:27629] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "adJ-1A5jnqDKKovdRklGEAAAAEg"]
[Sun Apr 05 23:25:11.307940 2026] [:error] [pid 30921:tid 30930] [client 40.85.219.177:27588] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "adJ-12FGQVn8Q0ueB25ZyQAAAQc"]
[Sun Apr 05 23:25:12.811783 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27555] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "adJ-2NHt_Oyw03gjCNh2ywAAAMg"]
[Sun Apr 05 23:25:13.935513 2026] [:error] [pid 45409:tid 45421] [client 40.85.219.177:27627] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "adJ-2dHt_Oyw03gjCNh22gAAAMo"]
[Sun Apr 05 23:25:14.580613 2026] [:error] [pid 45409:tid 45414] [client 40.85.219.177:27624] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adJ-2tHt_Oyw03gjCNh24gAAAMM"]
[Sun Apr 05 23:25:15.661688 2026] [:error] [pid 45409:tid 45418] [client 40.85.219.177:27620] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/lmfi2.php"] [unique_id "adJ-29Ht_Oyw03gjCNh27QAAAMc"]
[Sun Apr 05 23:25:17.421527 2026] [:error] [pid 45305:tid 45372] [client 40.85.219.177:27488] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/lmfi2.php"] [unique_id "adJ-3ejDQjr7aWhjflCQZwAAAIE"]
[Sun Apr 05 23:25:18.130985 2026] [proxy_fcgi:error] [pid 30921:tid 30929] [client 40.85.219.177:27638] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:18.568552 2026] [:error] [pid 30921:tid 30946] [client 40.85.219.177:27638] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/alfa-rex.php"] [unique_id "adJ-3mFGQVn8Q0ueB25Z1gAAARc"]
[Sun Apr 05 23:25:19.832497 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 40.85.219.177:27410] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:20.048848 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 40.85.219.177:27410] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:20.259875 2026] [proxy_fcgi:error] [pid 45409:tid 45427] [client 40.85.219.177:27410] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:20.696201 2026] [:error] [pid 45409:tid 45426] [client 40.85.219.177:27410] [client 40.85.219.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/alfa-rex.php"] [unique_id "adJ-4NHt_Oyw03gjCNh3EgAAAM8"]
[Sun Apr 05 23:25:24.775648 2026] [proxy_fcgi:error] [pid 30921:tid 30923] [client 40.85.219.177:27462] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:25.499040 2026] [proxy_fcgi:error] [pid 30921:tid 30930] [client 40.85.219.177:27462] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:25.748891 2026] [proxy_fcgi:error] [pid 30921:tid 30929] [client 40.85.219.177:27462] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:25.959100 2026] [proxy_fcgi:error] [pid 30921:tid 30926] [client 40.85.219.177:27462] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:26.203661 2026] [proxy_fcgi:error] [pid 30921:tid 30947] [client 40.85.219.177:27462] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:25:26.460349 2026] [:error] [pid 30921:tid 30933] [client 40.85.219.177:27462] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-decoder.php"] [unique_id "adJ-5mFGQVn8Q0ueB25Z_wAAAQo"]
[Sun Apr 05 23:25:36.304190 2026] [:error] [pid 45305:tid 45384] [client 40.85.219.177:27615] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-decoder.php"] [unique_id "adJ-8OjDQjr7aWhjflCQfgAAAI0"]
[Sun Apr 05 23:25:37.518552 2026] [:error] [pid 45409:tid 45429] [client 40.85.219.177:27554] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-decoder.php"] [unique_id "adJ-8dHt_Oyw03gjCNh3egAAANI"]
[Sun Apr 05 23:25:38.658732 2026] [:error] [pid 45305:tid 45376] [client 40.85.219.177:27549] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-decoder.php"] [unique_id "adJ-8ujDQjr7aWhjflCQhwAAAIU"]
[Sun Apr 05 23:25:40.028307 2026] [:error] [pid 45303:tid 45327] [client 40.85.219.177:27556] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-doctype-info.php"] [unique_id "adJ-9LboQ9eViZ4hdnmO0gAAAAo"]
[Sun Apr 05 23:25:41.859191 2026] [:error] [pid 45409:tid 45419] [client 40.85.219.177:27533] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-doctype-info.php"] [unique_id "adJ-9dHt_Oyw03gjCNh3pwAAAMg"]
[Sun Apr 05 23:25:42.880617 2026] [:error] [pid 45305:tid 45384] [client 40.85.219.177:27602] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-doctype-info.php"] [unique_id "adJ-9ujDQjr7aWhjflCQjAAAAI0"]
[Sun Apr 05 23:25:44.354291 2026] [:error] [pid 30921:tid 30942] [client 40.85.219.177:27642] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-doctype-info.php"] [unique_id "adJ--GFGQVn8Q0ueB25aOQAAARM"]
[Sun Apr 05 23:25:45.594596 2026] [:error] [pid 45305:tid 45384] [client 40.85.219.177:27529] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-open-elements.php"] [unique_id "adJ--ejDQjr7aWhjflCQmAAAAI0"]
[Sun Apr 05 23:25:46.738022 2026] [:error] [pid 45304:tid 45349] [client 40.85.219.177:27494] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-open-elements.php"] [unique_id "adJ--g5jnqDKKovdRklGPwAAAEU"]
[Sun Apr 05 23:25:48.310718 2026] [:error] [pid 45303:tid 45327] [client 40.85.219.177:27527] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-open-elements.php"] [unique_id "adJ-_LboQ9eViZ4hdnmO6wAAAAo"]
[Sun Apr 05 23:25:49.667785 2026] [:error] [pid 45409:tid 45415] [client 40.85.219.177:27540] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-open-elements.php"] [unique_id "adJ-_dHt_Oyw03gjCNh3vQAAAMQ"]
[Sun Apr 05 23:25:50.560269 2026] [:error] [pid 45409:tid 45428] [client 40.85.219.177:27597] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor-state.php"] [unique_id "adJ-_tHt_Oyw03gjCNh3vwAAANE"]
[Sun Apr 05 23:25:52.228261 2026] [:error] [pid 45305:tid 45372] [client 40.85.219.177:27616] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor-state.php"] [unique_id "adJ_AOjDQjr7aWhjflCQowAAAIE"]
[Sun Apr 05 23:25:53.712369 2026] [:error] [pid 45409:tid 45429] [client 40.85.219.177:27567] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor-state.php"] [unique_id "adJ_AdHt_Oyw03gjCNh3xgAAANI"]
[Sun Apr 05 23:25:54.784749 2026] [:error] [pid 30921:tid 30938] [client 40.85.219.177:27538] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor-state.php"] [unique_id "adJ_AmFGQVn8Q0ueB25aVgAAAQ8"]
[Sun Apr 05 23:25:56.182262 2026] [:error] [pid 30921:tid 30943] [client 40.85.219.177:27526] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor.php"] [unique_id "adJ_BGFGQVn8Q0ueB25aXAAAARQ"]
[Sun Apr 05 23:25:57.730547 2026] [:error] [pid 45303:tid 45333] [client 40.85.219.177:27460] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor.php"] [unique_id "adJ_BbboQ9eViZ4hdnmPHgAAABA"]
[Sun Apr 05 23:25:58.784753 2026] [:error] [pid 45303:tid 45337] [client 40.85.219.177:27472] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor.php"] [unique_id "adJ_BrboQ9eViZ4hdnmPJgAAABQ"]
[Sun Apr 05 23:26:00.864662 2026] [:error] [pid 45409:tid 45416] [client 40.85.219.177:27612] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-processor.php"] [unique_id "adJ_CNHt_Oyw03gjCNh33gAAAMU"]
[Sun Apr 05 23:26:02.719152 2026] [:error] [pid 45305:tid 45380] [client 40.85.219.177:27609] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-span.php"] [unique_id "adJ_CujDQjr7aWhjflCQrgAAAIk"]
[Sun Apr 05 23:26:03.550484 2026] [:error] [pid 45409:tid 45433] [client 40.85.219.177:27509] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-span.php"] [unique_id "adJ_C9Ht_Oyw03gjCNh38gAAANY"]
[Sun Apr 05 23:26:06.552812 2026] [:error] [pid 45409:tid 45422] [client 40.85.219.177:27587] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-span.php"] [unique_id "adJ_DtHt_Oyw03gjCNh4BgAAAMs"]
[Sun Apr 05 23:26:09.397632 2026] [:error] [pid 45303:tid 45340] [client 40.85.219.177:27562] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-span.php"] [unique_id "adJ_EbboQ9eViZ4hdnmPNAAAABc"]
[Sun Apr 05 23:26:10.602685 2026] [:error] [pid 45303:tid 45338] [client 40.85.219.177:27506] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-stack-event.php"] [unique_id "adJ_ErboQ9eViZ4hdnmPOwAAABU"]
[Sun Apr 05 23:26:12.299991 2026] [:error] [pid 45409:tid 45424] [client 40.85.219.177:27523] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-stack-event.php"] [unique_id "adJ_FNHt_Oyw03gjCNh4FwAAAM0"]
[Sun Apr 05 23:26:14.212066 2026] [:error] [pid 45409:tid 45421] [client 40.85.219.177:27547] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-stack-event.php"] [unique_id "adJ_FtHt_Oyw03gjCNh4JgAAAMo"]
[Sun Apr 05 23:26:15.004073 2026] [:error] [pid 45409:tid 45418] [client 40.85.219.177:27594] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-stack-event.php"] [unique_id "adJ_F9Ht_Oyw03gjCNh4LgAAAMc"]
[Sun Apr 05 23:26:16.373471 2026] [:error] [pid 45305:tid 45375] [client 40.85.219.177:27569] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-tag-processor.php"] [unique_id "adJ_GOjDQjr7aWhjflCQwgAAAIQ"]
[Sun Apr 05 23:26:17.839219 2026] [:error] [pid 45409:tid 45417] [client 40.85.219.177:27473] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-tag-processor.php"] [unique_id "adJ_GdHt_Oyw03gjCNh4QAAAAMY"]
[Sun Apr 05 23:26:19.033917 2026] [:error] [pid 45409:tid 45417] [client 40.85.219.177:27599] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-tag-processor.php"] [unique_id "adJ_G9Ht_Oyw03gjCNh4SwAAAMY"]
[Sun Apr 05 23:26:19.480379 2026] [:error] [pid 45409:tid 45414] [client 40.85.219.177:27608] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-tag-processor.php"] [unique_id "adJ_G9Ht_Oyw03gjCNh4VQAAAMM"]
[Sun Apr 05 23:26:20.401766 2026] [:error] [pid 45409:tid 45421] [client 40.85.219.177:27560] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-text-replacement.php"] [unique_id "adJ_HNHt_Oyw03gjCNh4ZAAAAMo"]
[Sun Apr 05 23:26:21.130964 2026] [:error] [pid 30921:tid 30944] [client 40.85.219.177:27551] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-text-replacement.php"] [unique_id "adJ_HWFGQVn8Q0ueB25aiwAAARU"]
[Sun Apr 05 23:26:21.838986 2026] [:error] [pid 45303:tid 45339] [client 40.85.219.177:27610] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-text-replacement.php"] [unique_id "adJ_HbboQ9eViZ4hdnmPSwAAABY"]
[Sun Apr 05 23:26:22.760710 2026] [:error] [pid 30921:tid 30937] [client 40.85.219.177:27563] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-text-replacement.php"] [unique_id "adJ_HmFGQVn8Q0ueB25akgAAAQ4"]
[Sun Apr 05 23:26:24.179284 2026] [:error] [pid 45305:tid 45378] [client 40.85.219.177:27641] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-token.php"] [unique_id "adJ_IOjDQjr7aWhjflCQzQAAAIc"]
[Sun Apr 05 23:26:25.411817 2026] [:error] [pid 45409:tid 45432] [client 40.85.219.177:27543] [client 40.85.219.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-html-token.php"] [unique_id "adJ_IdHt_Oyw03gjCNh4cgAAANU"]
[Sun Apr 05 23:26:26.407978 2026] [proxy_fcgi:error] [pid 45409:tid 45424] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:27.457125 2026] [proxy_fcgi:error] [pid 45409:tid 45425] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:27.677195 2026] [proxy_fcgi:error] [pid 45409:tid 45420] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:27.886226 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:28.276284 2026] [proxy_fcgi:error] [pid 45409:tid 45435] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:28.486794 2026] [proxy_fcgi:error] [pid 45409:tid 45421] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Sun Apr 05 23:26:28.705473 2026] [proxy_fcgi:error] [pid 45409:tid 45428] [client 40.85.219.177:27459] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:02.433691 2026] [proxy_fcgi:error] [pid 45409:tid 45411] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:02.716742 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:03.012249 2026] [proxy_fcgi:error] [pid 45409:tid 45431] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:03.496975 2026] [proxy_fcgi:error] [pid 45409:tid 45417] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:03.756615 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:04.015669 2026] [proxy_fcgi:error] [pid 45409:tid 45429] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:04.275525 2026] [proxy_fcgi:error] [pid 45409:tid 45414] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:04.536012 2026] [proxy_fcgi:error] [pid 45409:tid 45433] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:04.796063 2026] [proxy_fcgi:error] [pid 45409:tid 45425] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:05.057128 2026] [proxy_fcgi:error] [pid 45409:tid 45421] [client 74.248.144.66:24987] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:26:05.682844 2026] [:error] [pid 45409:tid 45422] [client 74.248.144.66:24987] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adKNHdHt_Oyw03gjCNi7jQAAAMs"]
[Mon Apr 06 00:26:07.189257 2026] [:error] [pid 45303:tid 45319] [client 74.248.144.66:5216] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adKNH7boQ9eViZ4hdnm77gAAAAI"]
[Mon Apr 06 00:26:08.633879 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:11254] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adKNINHt_Oyw03gjCNi7mAAAAMk"]
[Mon Apr 06 00:26:09.568910 2026] [:error] [pid 30921:tid 30944] [client 74.248.144.66:5247] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adKNIWFGQVn8Q0ueB258BQAAARU"]
[Mon Apr 06 00:26:10.397057 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:5243] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adKNItHt_Oyw03gjCNi7owAAAMQ"]
[Mon Apr 06 00:26:11.076795 2026] [:error] [pid 45303:tid 45319] [client 74.248.144.66:12860] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adKNI7boQ9eViZ4hdnm7-QAAAAI"]
[Mon Apr 06 00:26:11.686136 2026] [:error] [pid 45303:tid 45331] [client 74.248.144.66:9735] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adKNI7boQ9eViZ4hdnm7_AAAAA4"]
[Mon Apr 06 00:26:12.325278 2026] [:error] [pid 45305:tid 45374] [client 74.248.144.66:29102] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adKNJOjDQjr7aWhjflCrwwAAAIM"]
[Mon Apr 06 00:26:13.050090 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:12822] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adKNJdHt_Oyw03gjCNi7rAAAAMQ"]
[Mon Apr 06 00:26:13.808607 2026] [:error] [pid 45305:tid 45380] [client 74.248.144.66:5247] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adKNJejDQjr7aWhjflCrxAAAAIk"]
[Mon Apr 06 00:26:14.685403 2026] [:error] [pid 45305:tid 45393] [client 74.248.144.66:16013] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adKNJujDQjr7aWhjflCryQAAAJY"]
[Mon Apr 06 00:26:15.953902 2026] [:error] [pid 45304:tid 45356] [client 74.248.144.66:16050] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adKNJw5jnqDKKovdRkleCgAAAEw"]
[Mon Apr 06 00:26:17.008978 2026] [:error] [pid 45304:tid 45361] [client 74.248.144.66:46119] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adKNKQ5jnqDKKovdRkleDQAAAFE"]
[Mon Apr 06 00:26:17.698130 2026] [:error] [pid 45305:tid 45383] [client 74.248.144.66:11190] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adKNKejDQjr7aWhjflCr1QAAAIw"]
[Mon Apr 06 00:26:18.423988 2026] [:error] [pid 45305:tid 45375] [client 74.248.144.66:13282] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adKNKujDQjr7aWhjflCr1wAAAIQ"]
[Mon Apr 06 00:26:19.187311 2026] [:error] [pid 45305:tid 45394] [client 74.248.144.66:16034] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adKNK-jDQjr7aWhjflCr2QAAAJc"]
[Mon Apr 06 00:26:19.792226 2026] [:error] [pid 45305:tid 45377] [client 74.248.144.66:16362] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adKNK-jDQjr7aWhjflCr3QAAAIY"]
[Mon Apr 06 00:26:20.327080 2026] [:error] [pid 45304:tid 45344] [client 74.248.144.66:21484] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adKNLA5jnqDKKovdRkleHAAAAEA"]
[Mon Apr 06 00:26:20.906003 2026] [:error] [pid 30921:tid 30924] [client 74.248.144.66:11148] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adKNLGFGQVn8Q0ueB258IQAAAQE"]
[Mon Apr 06 00:26:21.515261 2026] [:error] [pid 30921:tid 30933] [client 74.248.144.66:11195] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nhj6t74aqmkde3hgpCdefault.php"] [unique_id "adKNLWFGQVn8Q0ueB258IgAAAQo"]
[Mon Apr 06 00:26:22.100392 2026] [:error] [pid 30921:tid 30925] [client 74.248.144.66:11173] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adKNLmFGQVn8Q0ueB258JQAAAQI"]
[Mon Apr 06 00:26:22.692883 2026] [:error] [pid 45409:tid 45429] [client 74.248.144.66:21482] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adKNLtHt_Oyw03gjCNi7swAAANI"]
[Mon Apr 06 00:26:23.544401 2026] [:error] [pid 45304:tid 45344] [client 74.248.144.66:1520] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adKNLw5jnqDKKovdRkleKwAAAEA"]
[Mon Apr 06 00:26:24.156464 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:13532] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adKNMNHt_Oyw03gjCNi7twAAAMo"]
[Mon Apr 06 00:26:24.754357 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:1521] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adKNMNHt_Oyw03gjCNi7ugAAANE"]
[Mon Apr 06 00:26:25.333682 2026] [:error] [pid 45304:tid 45362] [client 74.248.144.66:16345] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adKNMQ5jnqDKKovdRkleMwAAAFI"]
[Mon Apr 06 00:26:25.893474 2026] [:error] [pid 45304:tid 45364] [client 74.248.144.66:16006] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adKNMQ5jnqDKKovdRkleNAAAAFQ"]
[Mon Apr 06 00:26:26.669642 2026] [:error] [pid 30921:tid 30945] [client 74.248.144.66:1532] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adKNMmFGQVn8Q0ueB258NgAAARY"]
[Mon Apr 06 00:26:27.358595 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:1474] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adKNM9Ht_Oyw03gjCNi7vgAAAMI"]
[Mon Apr 06 00:26:28.064366 2026] [:error] [pid 45303:tid 45324] [client 74.248.144.66:16355] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adKNNLboQ9eViZ4hdnm8DwAAAAc"]
[Mon Apr 06 00:26:28.878400 2026] [:error] [pid 45303:tid 45338] [client 74.248.144.66:16032] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adKNNLboQ9eViZ4hdnm8EQAAABU"]
[Mon Apr 06 00:26:29.484524 2026] [:error] [pid 45409:tid 45416] [client 74.248.144.66:16352] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/JKydQumkIarjMJ4default.php"] [unique_id "adKNNdHt_Oyw03gjCNi7wwAAAMU"]
[Mon Apr 06 00:26:30.239674 2026] [:error] [pid 45303:tid 45336] [client 74.248.144.66:16363] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adKNNrboQ9eViZ4hdnm8IAAAABM"]
[Mon Apr 06 00:26:30.825415 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:1204] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adKNNtHt_Oyw03gjCNi7xgAAAM0"]
[Mon Apr 06 00:26:31.651798 2026] [:error] [pid 45305:tid 45394] [client 74.248.144.66:1517] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adKNN-jDQjr7aWhjflCr9AAAAJc"]
[Mon Apr 06 00:26:32.507954 2026] [:error] [pid 45409:tid 45434] [client 74.248.144.66:16359] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adKNONHt_Oyw03gjCNi7zgAAANc"]
[Mon Apr 06 00:26:33.204648 2026] [:error] [pid 30921:tid 30936] [client 74.248.144.66:16339] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adKNOWFGQVn8Q0ueB258QwAAAQ0"]
[Mon Apr 06 00:26:34.023594 2026] [:error] [pid 30921:tid 30941] [client 74.248.144.66:1485] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adKNOmFGQVn8Q0ueB258RwAAARI"]
[Mon Apr 06 00:26:34.565941 2026] [:error] [pid 45305:tid 45385] [client 74.248.144.66:16370] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adKNOujDQjr7aWhjflCr-AAAAI4"]
[Mon Apr 06 00:26:35.291448 2026] [:error] [pid 45304:tid 45360] [client 74.248.144.66:16052] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adKNOw5jnqDKKovdRklePwAAAFA"]
[Mon Apr 06 00:26:36.171762 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:16067] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adKNPNHt_Oyw03gjCNi73AAAAM0"]
[Mon Apr 06 00:26:37.015951 2026] [:error] [pid 45409:tid 45434] [client 74.248.144.66:1180] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adKNPdHt_Oyw03gjCNi74AAAANc"]
[Mon Apr 06 00:26:37.701774 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:16055] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adKNPdHt_Oyw03gjCNi75wAAAM0"]
[Mon Apr 06 00:26:38.665751 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:1613] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adKNPtHt_Oyw03gjCNi77AAAANY"]
[Mon Apr 06 00:26:39.307387 2026] [:error] [pid 45303:tid 45335] [client 74.248.144.66:29147] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adKNP7boQ9eViZ4hdnm8NwAAABI"]
[Mon Apr 06 00:26:40.125875 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:6554] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adKNQLboQ9eViZ4hdnm8PwAAAAQ"]
[Mon Apr 06 00:26:40.764994 2026] [:error] [pid 45409:tid 45414] [client 74.248.144.66:6563] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adKNQNHt_Oyw03gjCNi79wAAAMM"]
[Mon Apr 06 00:26:41.595174 2026] [:error] [pid 45409:tid 45426] [client 74.248.144.66:5251] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adKNQdHt_Oyw03gjCNi7_QAAAM8"]
[Mon Apr 06 00:26:42.261449 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:6564] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adKNQtHt_Oyw03gjCNi8AQAAANE"]
[Mon Apr 06 00:26:42.991807 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:1534] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adKNQtHt_Oyw03gjCNi8CgAAANY"]
[Mon Apr 06 00:26:43.594890 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:6565] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adKNQ9Ht_Oyw03gjCNi8EAAAANY"]
[Mon Apr 06 00:26:44.789442 2026] [:error] [pid 45305:tid 45375] [client 74.248.144.66:37735] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adKNROjDQjr7aWhjflCsBQAAAIQ"]
[Mon Apr 06 00:26:45.821340 2026] [:error] [pid 45303:tid 45324] [client 74.248.144.66:37707] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adKNRbboQ9eViZ4hdnm8UwAAAAc"]
[Mon Apr 06 00:26:46.527264 2026] [:error] [pid 45304:tid 45348] [client 74.248.144.66:1163] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adKNRg5jnqDKKovdRkleSgAAAEQ"]
[Mon Apr 06 00:26:48.043311 2026] [:error] [pid 45303:tid 45329] [client 74.248.144.66:1484] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adKNSLboQ9eViZ4hdnm8WAAAAAw"]
[Mon Apr 06 00:26:49.318634 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:37759] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adKNSdHt_Oyw03gjCNi8IwAAAMI"]
[Mon Apr 06 00:26:50.528675 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:6555] [client 74.248.144.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "adKNStHt_Oyw03gjCNi8KwAAANE"]
[Mon Apr 06 00:26:51.768603 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:16624] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adKNS9Ht_Oyw03gjCNi8NAAAAMY"]
[Mon Apr 06 00:26:53.635626 2026] [:error] [pid 45409:tid 45431] [client 74.248.144.66:5307] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adKNTdHt_Oyw03gjCNi8QAAAANQ"]
[Mon Apr 06 00:26:55.671625 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:1181] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adKNT9Ht_Oyw03gjCNi8SAAAAMQ"]
[Mon Apr 06 00:26:58.423115 2026] [:error] [pid 45409:tid 45435] [client 74.248.144.66:1066] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adKNUtHt_Oyw03gjCNi8UwAAANg"]
[Mon Apr 06 00:26:59.678938 2026] [:error] [pid 45303:tid 45336] [client 74.248.144.66:16586] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adKNU7boQ9eViZ4hdnm8cgAAABM"]
[Mon Apr 06 00:27:01.343847 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:21412] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adKNVdHt_Oyw03gjCNi8XAAAAM0"]
[Mon Apr 06 00:27:03.486362 2026] [:error] [pid 30921:tid 30945] [client 74.248.144.66:1026] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adKNV2FGQVn8Q0ueB258agAAARY"]
[Mon Apr 06 00:27:06.876314 2026] [proxy_fcgi:error] [pid 45409:tid 45424] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:07.137313 2026] [proxy_fcgi:error] [pid 45409:tid 45423] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:07.437738 2026] [proxy_fcgi:error] [pid 45409:tid 45412] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:07.695417 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:07.968451 2026] [proxy_fcgi:error] [pid 45409:tid 45428] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:08.226932 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:09.016643 2026] [proxy_fcgi:error] [pid 45409:tid 45435] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:09.273893 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:09.532316 2026] [proxy_fcgi:error] [pid 45409:tid 45415] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:09.790767 2026] [proxy_fcgi:error] [pid 45409:tid 45413] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:10.049295 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 74.248.144.66:21439] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:27:10.314101 2026] [:error] [pid 45409:tid 45425] [client 74.248.144.66:21439] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webx.php"] [unique_id "adKNXtHt_Oyw03gjCNi8jAAAAM4"]
[Mon Apr 06 00:27:12.033450 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:21401] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webx.php"] [unique_id "adKNYNHt_Oyw03gjCNi8mAAAAMQ"]
[Mon Apr 06 00:27:13.000101 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:21377] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webx.php"] [unique_id "adKNYNHt_Oyw03gjCNi8owAAAMg"]
[Mon Apr 06 00:27:14.139978 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:1167] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webx.php"] [unique_id "adKNYrboQ9eViZ4hdnm8jQAAABA"]
[Mon Apr 06 00:27:15.134129 2026] [:error] [pid 45305:tid 45377] [client 74.248.144.66:37758] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adKNY-jDQjr7aWhjflCsJwAAAIY"]
[Mon Apr 06 00:27:16.031693 2026] [:error] [pid 30921:tid 30942] [client 74.248.144.66:24505] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adKNZGFGQVn8Q0ueB258gAAAARM"]
[Mon Apr 06 00:27:16.855915 2026] [:error] [pid 45305:tid 45394] [client 74.248.144.66:1162] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adKNZOjDQjr7aWhjflCsKwAAAJc"]
[Mon Apr 06 00:27:17.809078 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:1261] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adKNZdHt_Oyw03gjCNi8swAAAMo"]
[Mon Apr 06 00:27:18.437597 2026] [:error] [pid 45305:tid 45380] [client 74.248.144.66:1040] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-22.php"] [unique_id "adKNZujDQjr7aWhjflCsLQAAAIk"]
[Mon Apr 06 00:27:19.136438 2026] [:error] [pid 30921:tid 30939] [client 74.248.144.66:14677] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-22.php"] [unique_id "adKNZ2FGQVn8Q0ueB258igAAARA"]
[Mon Apr 06 00:27:19.714449 2026] [:error] [pid 45304:tid 45356] [client 74.248.144.66:1083] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-22.php"] [unique_id "adKNZw5jnqDKKovdRkleawAAAEw"]
[Mon Apr 06 00:27:21.277543 2026] [:error] [pid 30921:tid 30943] [client 74.248.144.66:9839] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-22.php"] [unique_id "adKNaWFGQVn8Q0ueB258kwAAARQ"]
[Mon Apr 06 00:27:22.751769 2026] [:error] [pid 45304:tid 45365] [client 74.248.144.66:37747] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/villain.php"] [unique_id "adKNag5jnqDKKovdRklecAAAAFU"]
[Mon Apr 06 00:27:23.579120 2026] [:error] [pid 45303:tid 45328] [client 74.248.144.66:27523] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/villain.php"] [unique_id "adKNa7boQ9eViZ4hdnm8pwAAAAs"]
[Mon Apr 06 00:27:24.424091 2026] [:error] [pid 30921:tid 30937] [client 74.248.144.66:14681] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/villain.php"] [unique_id "adKNbGFGQVn8Q0ueB258lQAAAQ4"]
[Mon Apr 06 00:27:25.230637 2026] [:error] [pid 45409:tid 45414] [client 74.248.144.66:14673] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/villain.php"] [unique_id "adKNbdHt_Oyw03gjCNi8xQAAAMM"]
[Mon Apr 06 00:27:26.060726 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:21385] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-db.php"] [unique_id "adKNbtHt_Oyw03gjCNi8ygAAAMo"]
[Mon Apr 06 00:27:26.893726 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:9823] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-db.php"] [unique_id "adKNbtHt_Oyw03gjCNi8zgAAAMk"]
[Mon Apr 06 00:27:27.612131 2026] [:error] [pid 45409:tid 45414] [client 74.248.144.66:6529] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-db.php"] [unique_id "adKNb9Ht_Oyw03gjCNi80wAAAMM"]
[Mon Apr 06 00:27:28.359007 2026] [:error] [pid 45303:tid 45320] [client 74.248.144.66:1234] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-db.php"] [unique_id "adKNcLboQ9eViZ4hdnm8rAAAAAM"]
[Mon Apr 06 00:27:28.970752 2026] [:error] [pid 45409:tid 45435] [client 74.248.144.66:26073] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adKNcNHt_Oyw03gjCNi82wAAANg"]
[Mon Apr 06 00:27:29.689701 2026] [:error] [pid 45303:tid 45330] [client 74.248.144.66:1218] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adKNcbboQ9eViZ4hdnm8rwAAAA0"]
[Mon Apr 06 00:27:30.390126 2026] [:error] [pid 45409:tid 45429] [client 74.248.144.66:6544] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adKNctHt_Oyw03gjCNi84gAAANI"]
[Mon Apr 06 00:27:31.171810 2026] [:error] [pid 45303:tid 45335] [client 74.248.144.66:37731] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adKNc7boQ9eViZ4hdnm8swAAABI"]
[Mon Apr 06 00:27:32.160485 2026] [:error] [pid 45304:tid 45363] [client 74.248.144.66:21388] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "adKNdA5jnqDKKovdRkleegAAAFM"]
[Mon Apr 06 00:27:32.719725 2026] [:error] [pid 45304:tid 45360] [client 74.248.144.66:10010] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "adKNdA5jnqDKKovdRklefAAAAFA"]
[Mon Apr 06 00:27:33.542662 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:24448] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "adKNddHt_Oyw03gjCNi8-AAAAMY"]
[Mon Apr 06 00:27:34.203411 2026] [:error] [pid 30921:tid 30937] [client 74.248.144.66:1028] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an7.php"] [unique_id "adKNdmFGQVn8Q0ueB258qQAAAQ4"]
[Mon Apr 06 00:27:34.945520 2026] [:error] [pid 45409:tid 45412] [client 74.248.144.66:9848] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adKNdtHt_Oyw03gjCNi9AwAAAME"]
[Mon Apr 06 00:27:35.547699 2026] [:error] [pid 45304:tid 45368] [client 74.248.144.66:8686] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adKNdw5jnqDKKovdRklefQAAAFg"]
[Mon Apr 06 00:27:36.107764 2026] [:error] [pid 45409:tid 45411] [client 74.248.144.66:13970] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adKNeNHt_Oyw03gjCNi9CQAAAMA"]
[Mon Apr 06 00:27:36.789331 2026] [:error] [pid 30921:tid 30924] [client 74.248.144.66:21404] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adKNeGFGQVn8Q0ueB258rAAAAQE"]
[Mon Apr 06 00:27:37.313784 2026] [:error] [pid 45409:tid 45431] [client 74.248.144.66:9829] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uxijj.php"] [unique_id "adKNedHt_Oyw03gjCNi9DAAAANQ"]
[Mon Apr 06 00:27:37.967490 2026] [:error] [pid 45303:tid 45324] [client 74.248.144.66:8700] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uxijj.php"] [unique_id "adKNebboQ9eViZ4hdnm8wgAAAAc"]
[Mon Apr 06 00:27:38.485122 2026] [:error] [pid 45304:tid 45366] [client 74.248.144.66:8688] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uxijj.php"] [unique_id "adKNeg5jnqDKKovdRklefwAAAFY"]
[Mon Apr 06 00:27:39.040206 2026] [:error] [pid 30921:tid 30929] [client 74.248.144.66:10001] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uxijj.php"] [unique_id "adKNe2FGQVn8Q0ueB258sAAAAQY"]
[Mon Apr 06 00:27:39.552426 2026] [:error] [pid 45303:tid 45330] [client 74.248.144.66:10033] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs7.php"] [unique_id "adKNe7boQ9eViZ4hdnm8zAAAAA0"]
[Mon Apr 06 00:27:40.116473 2026] [:error] [pid 45305:tid 45372] [client 74.248.144.66:1253] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs7.php"] [unique_id "adKNfOjDQjr7aWhjflCsUgAAAIE"]
[Mon Apr 06 00:27:40.791590 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:14671] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs7.php"] [unique_id "adKNfNHt_Oyw03gjCNi9HAAAAMg"]
[Mon Apr 06 00:27:41.449909 2026] [:error] [pid 45305:tid 45380] [client 74.248.144.66:21434] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs7.php"] [unique_id "adKNfejDQjr7aWhjflCsVAAAAIk"]
[Mon Apr 06 00:27:42.136281 2026] [:error] [pid 45304:tid 45358] [client 74.248.144.66:14688] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool2.php"] [unique_id "adKNfg5jnqDKKovdRklehAAAAE4"]
[Mon Apr 06 00:27:42.859551 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:9849] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool2.php"] [unique_id "adKNftHt_Oyw03gjCNi9JQAAAM0"]
[Mon Apr 06 00:27:43.632077 2026] [:error] [pid 45409:tid 45427] [client 74.248.144.66:10041] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool2.php"] [unique_id "adKNf9Ht_Oyw03gjCNi9KAAAANA"]
[Mon Apr 06 00:27:44.152721 2026] [:error] [pid 45409:tid 45423] [client 74.248.144.66:10000] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool2.php"] [unique_id "adKNgNHt_Oyw03gjCNi9LQAAAMw"]
[Mon Apr 06 00:27:44.991346 2026] [:error] [pid 30921:tid 30927] [client 74.248.144.66:26096] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zjllx.php"] [unique_id "adKNgGFGQVn8Q0ueB258uQAAAQQ"]
[Mon Apr 06 00:27:45.761299 2026] [:error] [pid 45305:tid 45392] [client 74.248.144.66:26523] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zjllx.php"] [unique_id "adKNgejDQjr7aWhjflCsWwAAAJU"]
[Mon Apr 06 00:27:46.411588 2026] [:error] [pid 30921:tid 30945] [client 74.248.144.66:24478] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zjllx.php"] [unique_id "adKNgmFGQVn8Q0ueB258wAAAARY"]
[Mon Apr 06 00:27:48.547733 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:14702] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zjllx.php"] [unique_id "adKNhNHt_Oyw03gjCNi9QgAAAMg"]
[Mon Apr 06 00:27:49.638943 2026] [:error] [pid 45303:tid 45331] [client 74.248.144.66:25569] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "adKNhbboQ9eViZ4hdnm86gAAAA4"]
[Mon Apr 06 00:27:50.461862 2026] [:error] [pid 45305:tid 45392] [client 74.248.144.66:1274] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "adKNhujDQjr7aWhjflCsZQAAAJU"]
[Mon Apr 06 00:27:51.553087 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:14657] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "adKNh9Ht_Oyw03gjCNi9SgAAANY"]
[Mon Apr 06 00:27:52.743452 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:26070] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h2.php"] [unique_id "adKNiNHt_Oyw03gjCNi9VwAAAMc"]
[Mon Apr 06 00:27:54.253567 2026] [:error] [pid 45304:tid 45345] [client 74.248.144.66:26069] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adKNig5jnqDKKovdRklekAAAAEE"]
[Mon Apr 06 00:27:55.683356 2026] [:error] [pid 45305:tid 45375] [client 74.248.144.66:32587] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adKNi-jDQjr7aWhjflCsbwAAAIQ"]
[Mon Apr 06 00:27:56.412486 2026] [:error] [pid 45303:tid 45326] [client 74.248.144.66:17869] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adKNjLboQ9eViZ4hdnm8_wAAAAk"]
[Mon Apr 06 00:27:57.200754 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:1755] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adKNjbboQ9eViZ4hdnm9AQAAAAQ"]
[Mon Apr 06 00:27:57.923685 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:32637] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adKNjdHt_Oyw03gjCNi9bgAAAMk"]
[Mon Apr 06 00:27:59.420898 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:9522] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adKNj9Ht_Oyw03gjCNi9dgAAAMk"]
[Mon Apr 06 00:28:02.091362 2026] [:error] [pid 45303:tid 45323] [client 74.248.144.66:26500] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adKNkrboQ9eViZ4hdnm9CAAAAAY"]
[Mon Apr 06 00:28:03.553995 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:50488] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adKNk9Ht_Oyw03gjCNi9kQAAAMQ"]
[Mon Apr 06 00:28:05.182173 2026] [:error] [pid 45303:tid 45338] [client 74.248.144.66:44813] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dbc.php"] [unique_id "adKNlbboQ9eViZ4hdnm9EwAAABU"]
[Mon Apr 06 00:28:06.992006 2026] [:error] [pid 45303:tid 45340] [client 74.248.144.66:10630] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dbc.php"] [unique_id "adKNlrboQ9eViZ4hdnm9FwAAABc"]
[Mon Apr 06 00:28:08.836983 2026] [:error] [pid 45303:tid 45323] [client 74.248.144.66:21984] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dbc.php"] [unique_id "adKNmLboQ9eViZ4hdnm9IwAAAAY"]
[Mon Apr 06 00:28:09.637842 2026] [:error] [pid 45303:tid 45325] [client 74.248.144.66:10673] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dbc.php"] [unique_id "adKNmbboQ9eViZ4hdnm9KAAAAAg"]
[Mon Apr 06 00:28:10.350433 2026] [proxy_fcgi:error] [pid 45409:tid 45416] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:10.609652 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:10.868554 2026] [proxy_fcgi:error] [pid 45409:tid 45432] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:11.128148 2026] [proxy_fcgi:error] [pid 45409:tid 45423] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:11.388085 2026] [proxy_fcgi:error] [pid 45409:tid 45435] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:11.654483 2026] [proxy_fcgi:error] [pid 45409:tid 45417] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:11.943359 2026] [proxy_fcgi:error] [pid 45409:tid 45420] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:12.203586 2026] [proxy_fcgi:error] [pid 45409:tid 45430] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:12.481433 2026] [proxy_fcgi:error] [pid 45409:tid 45428] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:12.746309 2026] [proxy_fcgi:error] [pid 45409:tid 45425] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:13.005669 2026] [proxy_fcgi:error] [pid 45409:tid 45412] [client 74.248.144.66:11289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:28:13.329038 2026] [:error] [pid 45409:tid 45426] [client 74.248.144.66:11289] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adKNndHt_Oyw03gjCNi9vgAAAM8"]
[Mon Apr 06 00:28:14.113623 2026] [:error] [pid 45409:tid 45434] [client 74.248.144.66:12338] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adKNntHt_Oyw03gjCNi9wAAAANc"]
[Mon Apr 06 00:28:14.689142 2026] [:error] [pid 30921:tid 30939] [client 74.248.144.66:18846] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adKNnmFGQVn8Q0ueB2585QAAARA"]
[Mon Apr 06 00:28:15.307593 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:11269] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adKNn9Ht_Oyw03gjCNi9wwAAAMg"]
[Mon Apr 06 00:28:15.924799 2026] [:error] [pid 45305:tid 45378] [client 74.248.144.66:18855] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adKNn-jDQjr7aWhjflCsiwAAAIc"]
[Mon Apr 06 00:28:16.604451 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:14634] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adKNoNHt_Oyw03gjCNi9ywAAANY"]
[Mon Apr 06 00:28:17.612730 2026] [:error] [pid 45305:tid 45372] [client 74.248.144.66:13811] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adKNoejDQjr7aWhjflCskAAAAIE"]
[Mon Apr 06 00:28:18.494556 2026] [:error] [pid 30921:tid 30941] [client 74.248.144.66:18830] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adKNomFGQVn8Q0ueB2586QAAARI"]
[Mon Apr 06 00:28:19.163126 2026] [:error] [pid 45409:tid 45423] [client 74.248.144.66:13770] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adKNo9Ht_Oyw03gjCNi91wAAAMw"]
[Mon Apr 06 00:28:20.486603 2026] [:error] [pid 45305:tid 45390] [client 74.248.144.66:6623] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adKNpOjDQjr7aWhjflCslAAAAJM"]
[Mon Apr 06 00:28:21.627341 2026] [:error] [pid 45409:tid 45431] [client 74.248.144.66:11342] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adKNpdHt_Oyw03gjCNi94wAAANQ"]
[Mon Apr 06 00:28:23.011952 2026] [:error] [pid 45409:tid 45412] [client 74.248.144.66:8396] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adKNp9Ht_Oyw03gjCNi96wAAAME"]
[Mon Apr 06 00:28:23.737909 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:8417] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adKNp9Ht_Oyw03gjCNi98gAAAMc"]
[Mon Apr 06 00:28:24.545930 2026] [:error] [pid 45303:tid 45329] [client 74.248.144.66:46798] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adKNqLboQ9eViZ4hdnm9TQAAAAw"]
[Mon Apr 06 00:28:25.430356 2026] [:error] [pid 45305:tid 45393] [client 74.248.144.66:11361] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adKNqejDQjr7aWhjflCsnAAAAJY"]
[Mon Apr 06 00:28:26.750966 2026] [:error] [pid 45303:tid 45331] [client 74.248.144.66:17344] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adKNqrboQ9eViZ4hdnm9UAAAAA4"]
[Mon Apr 06 00:28:27.674130 2026] [:error] [pid 30921:tid 30927] [client 74.248.144.66:37689] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "adKNq2FGQVn8Q0ueB2589wAAAQQ"]
[Mon Apr 06 00:28:28.372439 2026] [:error] [pid 45303:tid 45319] [client 74.248.144.66:17355] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "adKNrLboQ9eViZ4hdnm9WAAAAAI"]
[Mon Apr 06 00:28:28.999982 2026] [:error] [pid 45304:tid 45359] [client 74.248.144.66:26566] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "adKNrA5jnqDKKovdRkletwAAAE8"]
[Mon Apr 06 00:28:29.566184 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:26565] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "adKNrbboQ9eViZ4hdnm9XgAAAAQ"]
[Mon Apr 06 00:28:30.347065 2026] [:error] [pid 45303:tid 45331] [client 74.248.144.66:4189] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kolda.php"] [unique_id "adKNrrboQ9eViZ4hdnm9XwAAAA4"]
[Mon Apr 06 00:28:30.945232 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:17311] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kolda.php"] [unique_id "adKNrrboQ9eViZ4hdnm9YQAAABA"]
[Mon Apr 06 00:28:31.926689 2026] [:error] [pid 45305:tid 45383] [client 74.248.144.66:8421] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kolda.php"] [unique_id "adKNr-jDQjr7aWhjflCspAAAAIw"]
[Mon Apr 06 00:28:32.578606 2026] [:error] [pid 30921:tid 30926] [client 74.248.144.66:21919] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kolda.php"] [unique_id "adKNsGFGQVn8Q0ueB258_gAAAQM"]
[Mon Apr 06 00:28:33.218376 2026] [:error] [pid 45305:tid 45371] [client 74.248.144.66:6644] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yussef.php"] [unique_id "adKNsejDQjr7aWhjflCspwAAAIA"]
[Mon Apr 06 00:28:33.849912 2026] [:error] [pid 45303:tid 45334] [client 74.248.144.66:37673] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yussef.php"] [unique_id "adKNsbboQ9eViZ4hdnm9ZAAAABE"]
[Mon Apr 06 00:28:34.478886 2026] [:error] [pid 30921:tid 30932] [client 74.248.144.66:17294] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yussef.php"] [unique_id "adKNsmFGQVn8Q0ueB259BgAAAQk"]
[Mon Apr 06 00:28:35.086943 2026] [:error] [pid 30921:tid 30926] [client 74.248.144.66:15329] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yussef.php"] [unique_id "adKNs2FGQVn8Q0ueB259CgAAAQM"]
[Mon Apr 06 00:28:35.715197 2026] [:error] [pid 45409:tid 45415] [client 74.248.144.66:17392] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "adKNs9Ht_Oyw03gjCNi-GQAAAMQ"]
[Mon Apr 06 00:28:36.452668 2026] [:error] [pid 45304:tid 45363] [client 74.248.144.66:17400] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "adKNtA5jnqDKKovdRklevgAAAFM"]
[Mon Apr 06 00:28:37.201816 2026] [:error] [pid 30921:tid 30945] [client 74.248.144.66:1708] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "adKNtWFGQVn8Q0ueB259FQAAARY"]
[Mon Apr 06 00:28:37.885690 2026] [:error] [pid 45303:tid 45317] [client 74.248.144.66:4181] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "adKNtbboQ9eViZ4hdnm9aQAAAAA"]
[Mon Apr 06 00:28:38.534506 2026] [:error] [pid 30921:tid 30923] [client 74.248.144.66:10142] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adKNtmFGQVn8Q0ueB259GQAAAQA"]
[Mon Apr 06 00:28:39.321382 2026] [:error] [pid 45305:tid 45385] [client 74.248.144.66:21938] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adKNt-jDQjr7aWhjflCsuwAAAI4"]
[Mon Apr 06 00:28:40.118040 2026] [:error] [pid 45305:tid 45371] [client 74.248.144.66:21926] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adKNuOjDQjr7aWhjflCsvAAAAIA"]
[Mon Apr 06 00:28:41.032958 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:15311] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adKNudHt_Oyw03gjCNi-LAAAANE"]
[Mon Apr 06 00:28:41.700939 2026] [:error] [pid 30921:tid 30934] [client 74.248.144.66:1727] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "adKNuWFGQVn8Q0ueB259IQAAAQs"]
[Mon Apr 06 00:28:42.447187 2026] [:error] [pid 45305:tid 45374] [client 74.248.144.66:10165] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "adKNuujDQjr7aWhjflCswQAAAIM"]
[Mon Apr 06 00:28:43.277180 2026] [:error] [pid 30921:tid 30947] [client 74.248.144.66:24478] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "adKNu2FGQVn8Q0ueB259KgAAARg"]
[Mon Apr 06 00:28:43.923145 2026] [:error] [pid 45305:tid 45391] [client 74.248.144.66:21908] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/btx25.php"] [unique_id "adKNu-jDQjr7aWhjflCsxQAAAJQ"]
[Mon Apr 06 00:28:44.572869 2026] [:error] [pid 45304:tid 45365] [client 74.248.144.66:46810] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123x.php"] [unique_id "adKNvA5jnqDKKovdRklewAAAAFU"]
[Mon Apr 06 00:28:45.226644 2026] [:error] [pid 30921:tid 30934] [client 74.248.144.66:17316] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123x.php"] [unique_id "adKNvWFGQVn8Q0ueB259MAAAAQs"]
[Mon Apr 06 00:28:45.965444 2026] [:error] [pid 30921:tid 30945] [client 74.248.144.66:46836] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123x.php"] [unique_id "adKNvWFGQVn8Q0ueB259MgAAARY"]
[Mon Apr 06 00:28:46.497833 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:17138] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123x.php"] [unique_id "adKNvtHt_Oyw03gjCNi-OgAAAMo"]
[Mon Apr 06 00:28:47.033915 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:17284] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "adKNv9Ht_Oyw03gjCNi-PAAAANE"]
[Mon Apr 06 00:28:47.556416 2026] [:error] [pid 45303:tid 45338] [client 74.248.144.66:17336] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "adKNv7boQ9eViZ4hdnm9eQAAABU"]
[Mon Apr 06 00:28:48.120843 2026] [:error] [pid 45304:tid 45361] [client 74.248.144.66:15309] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "adKNwA5jnqDKKovdRklezQAAAFE"]
[Mon Apr 06 00:28:48.761841 2026] [:error] [pid 45304:tid 45348] [client 74.248.144.66:6327] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "adKNwA5jnqDKKovdRkle0QAAAEQ"]
[Mon Apr 06 00:28:49.375572 2026] [:error] [pid 45303:tid 45326] [client 74.248.144.66:15332] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adKNwbboQ9eViZ4hdnm9gAAAAAk"]
[Mon Apr 06 00:28:50.071760 2026] [:error] [pid 45303:tid 45339] [client 74.248.144.66:17296] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adKNwrboQ9eViZ4hdnm9gQAAABY"]
[Mon Apr 06 00:28:50.970146 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:46790] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adKNwtHt_Oyw03gjCNi-RQAAAM0"]
[Mon Apr 06 00:28:51.569977 2026] [:error] [pid 45303:tid 45330] [client 74.248.144.66:17314] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adKNw7boQ9eViZ4hdnm9ggAAAA0"]
[Mon Apr 06 00:28:52.307355 2026] [:error] [pid 45409:tid 45426] [client 74.248.144.66:10136] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adKNxNHt_Oyw03gjCNi-TgAAAM8"]
[Mon Apr 06 00:28:52.825334 2026] [:error] [pid 45304:tid 45366] [client 74.248.144.66:26570] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adKNxA5jnqDKKovdRkle3AAAAFY"]
[Mon Apr 06 00:28:53.633332 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:46802] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adKNxdHt_Oyw03gjCNi-UwAAAM0"]
[Mon Apr 06 00:28:54.909684 2026] [:error] [pid 45305:tid 45380] [client 74.248.144.66:47652] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adKNxujDQjr7aWhjflCs2gAAAIk"]
[Mon Apr 06 00:28:56.148576 2026] [:error] [pid 45409:tid 45425] [client 74.248.144.66:6315] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "adKNyNHt_Oyw03gjCNi-YgAAAM4"]
[Mon Apr 06 00:28:56.845929 2026] [:error] [pid 45304:tid 45353] [client 74.248.144.66:26618] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "adKNyA5jnqDKKovdRkle3wAAAEk"]
[Mon Apr 06 00:28:57.538733 2026] [:error] [pid 30921:tid 30939] [client 74.248.144.66:17143] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "adKNyWFGQVn8Q0ueB259SQAAARA"]
[Mon Apr 06 00:28:58.434785 2026] [:error] [pid 45303:tid 45330] [client 74.248.144.66:6309] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "adKNyrboQ9eViZ4hdnm9igAAAA0"]
[Mon Apr 06 00:29:01.570716 2026] [:error] [pid 45409:tid 45422] [client 74.248.144.66:50405] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adKNzdHt_Oyw03gjCNi-dwAAAMs"]
[Mon Apr 06 00:29:03.639971 2026] [:error] [pid 45409:tid 45422] [client 74.248.144.66:50424] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adKNz9Ht_Oyw03gjCNi-fAAAAMs"]
[Mon Apr 06 00:29:05.884874 2026] [:error] [pid 45409:tid 45412] [client 74.248.144.66:6275] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adKN0dHt_Oyw03gjCNi-kgAAAME"]
[Mon Apr 06 00:29:08.753562 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:6333] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adKN1NHt_Oyw03gjCNi-pQAAAMc"]
[Mon Apr 06 00:29:11.550795 2026] [:error] [pid 30921:tid 30934] [client 74.248.144.66:47651] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xdd.php"] [unique_id "adKN12FGQVn8Q0ueB259YwAAAQs"]
[Mon Apr 06 00:29:15.280659 2026] [proxy_fcgi:error] [pid 45303:tid 45329] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:15.571813 2026] [proxy_fcgi:error] [pid 45303:tid 45317] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:15.854413 2026] [proxy_fcgi:error] [pid 45303:tid 45332] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:16.112302 2026] [proxy_fcgi:error] [pid 45303:tid 45324] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:16.377225 2026] [proxy_fcgi:error] [pid 45303:tid 45327] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:16.635448 2026] [proxy_fcgi:error] [pid 45303:tid 45326] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:16.923681 2026] [proxy_fcgi:error] [pid 45303:tid 45335] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:17.182264 2026] [proxy_fcgi:error] [pid 45303:tid 45340] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:17.440905 2026] [proxy_fcgi:error] [pid 45303:tid 45322] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:17.699705 2026] [proxy_fcgi:error] [pid 45303:tid 45339] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:18.004705 2026] [proxy_fcgi:error] [pid 45303:tid 45337] [client 74.248.144.66:6289] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:29:18.259945 2026] [:error] [pid 45303:tid 45320] [client 74.248.144.66:6289] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "adKN3rboQ9eViZ4hdnm9vgAAAAM"]
[Mon Apr 06 00:29:20.811524 2026] [:error] [pid 45305:tid 45390] [client 74.248.144.66:16313] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "adKN4OjDQjr7aWhjflCs-AAAAJM"]
[Mon Apr 06 00:29:22.395433 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:26616] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "adKN4tHt_Oyw03gjCNi-_QAAAMo"]
[Mon Apr 06 00:29:23.478666 2026] [:error] [pid 45409:tid 45430] [client 74.248.144.66:17120] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wo.php"] [unique_id "adKN49Ht_Oyw03gjCNi_BQAAANM"]
[Mon Apr 06 00:29:24.621032 2026] [:error] [pid 30921:tid 30938] [client 74.248.144.66:10121] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adKN5GFGQVn8Q0ueB259igAAAQ8"]
[Mon Apr 06 00:29:25.434642 2026] [:error] [pid 45409:tid 45426] [client 74.248.144.66:47659] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adKN5dHt_Oyw03gjCNi_BwAAAM8"]
[Mon Apr 06 00:29:26.599750 2026] [:error] [pid 45409:tid 45411] [client 74.248.144.66:17104] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adKN5tHt_Oyw03gjCNi_EQAAAMA"]
[Mon Apr 06 00:29:27.596978 2026] [:error] [pid 45303:tid 45335] [client 74.248.144.66:16291] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adKN57boQ9eViZ4hdnm9ywAAABI"]
[Mon Apr 06 00:29:28.676379 2026] [:error] [pid 45303:tid 45341] [client 74.248.144.66:1280] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/floya.php"] [unique_id "adKN6LboQ9eViZ4hdnm90QAAABg"]
[Mon Apr 06 00:29:30.395613 2026] [:error] [pid 45303:tid 45330] [client 74.248.144.66:16310] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/floya.php"] [unique_id "adKN6rboQ9eViZ4hdnm91gAAAA0"]
[Mon Apr 06 00:29:32.018186 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:33663] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/floya.php"] [unique_id "adKN7NHt_Oyw03gjCNi_KwAAAMo"]
[Mon Apr 06 00:29:36.041155 2026] [:error] [pid 45304:tid 45361] [client 74.248.144.66:18901] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/floya.php"] [unique_id "adKN8A5jnqDKKovdRklfEwAAAFE"]
[Mon Apr 06 00:29:37.966608 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:17853] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adKN8dHt_Oyw03gjCNi_RgAAAM0"]
[Mon Apr 06 00:29:39.688326 2026] [:error] [pid 45409:tid 45432] [client 74.248.144.66:10059] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adKN89Ht_Oyw03gjCNi_TQAAANU"]
[Mon Apr 06 00:29:41.183098 2026] [:error] [pid 45304:tid 45346] [client 74.248.144.66:31613] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adKN9Q5jnqDKKovdRklfFwAAAEI"]
[Mon Apr 06 00:29:42.602841 2026] [:error] [pid 45409:tid 45421] [client 74.248.144.66:27595] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adKN9tHt_Oyw03gjCNi_YwAAAMo"]
[Mon Apr 06 00:29:43.976686 2026] [:error] [pid 45409:tid 45429] [client 74.248.144.66:27628] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adKN99Ht_Oyw03gjCNi_bAAAANI"]
[Mon Apr 06 00:29:46.672715 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:20404] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adKN-tHt_Oyw03gjCNi_gQAAAMc"]
[Mon Apr 06 00:29:52.203570 2026] [:error] [pid 30921:tid 30929] [client 74.248.144.66:2010] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adKOAGFGQVn8Q0ueB259tgAAAQY"]
[Mon Apr 06 00:29:53.622455 2026] [:error] [pid 45305:tid 45376] [client 74.248.144.66:14060] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adKOAejDQjr7aWhjflCtJwAAAIU"]
[Mon Apr 06 00:29:57.074361 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:12442] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vdb.php"] [unique_id "adKOBbboQ9eViZ4hdnm-HQAAAAQ"]
[Mon Apr 06 00:30:00.364354 2026] [:error] [pid 45303:tid 45325] [client 74.248.144.66:25073] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vdb.php"] [unique_id "adKOCLboQ9eViZ4hdnm-KgAAAAg"]
[Mon Apr 06 00:30:02.030142 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:16878] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vdb.php"] [unique_id "adKOCtHt_Oyw03gjCNi_8gAAAMk"]
[Mon Apr 06 00:30:03.674592 2026] [:error] [pid 45304:tid 45355] [client 74.248.144.66:20970] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vdb.php"] [unique_id "adKOCw5jnqDKKovdRklfKgAAAEs"]
[Mon Apr 06 00:30:04.730518 2026] [:error] [pid 45303:tid 45317] [client 74.248.144.66:27033] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/om.php"] [unique_id "adKODLboQ9eViZ4hdnm-OAAAAAA"]
[Mon Apr 06 00:30:05.260499 2026] [:error] [pid 45304:tid 45346] [client 74.248.144.66:38971] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/om.php"] [unique_id "adKODQ5jnqDKKovdRklfKwAAAEI"]
[Mon Apr 06 00:30:06.137003 2026] [:error] [pid 45303:tid 45320] [client 74.248.144.66:16858] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/om.php"] [unique_id "adKODrboQ9eViZ4hdnm-QwAAAAM"]
[Mon Apr 06 00:30:06.763003 2026] [:error] [pid 30921:tid 30947] [client 74.248.144.66:20991] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/om.php"] [unique_id "adKODmFGQVn8Q0ueB2592wAAARg"]
[Mon Apr 06 00:30:07.973273 2026] [:error] [pid 45409:tid 45416] [client 74.248.144.66:44617] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ox.php"] [unique_id "adKOD9Ht_Oyw03gjCNjAFwAAAMU"]
[Mon Apr 06 00:30:10.839763 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:20979] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ox.php"] [unique_id "adKOEtHt_Oyw03gjCNjAMgAAAMc"]
[Mon Apr 06 00:30:13.499845 2026] [:error] [pid 30921:tid 30935] [client 74.248.144.66:32557] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ox.php"] [unique_id "adKOFWFGQVn8Q0ueB2594AAAAQw"]
[Mon Apr 06 00:30:16.634039 2026] [:error] [pid 45304:tid 45364] [client 74.248.144.66:38931] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ox.php"] [unique_id "adKOGA5jnqDKKovdRklfMQAAAFQ"]
[Mon Apr 06 00:30:18.743783 2026] [proxy_fcgi:error] [pid 45409:tid 45418] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:19.152872 2026] [proxy_fcgi:error] [pid 45409:tid 45425] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:19.419881 2026] [proxy_fcgi:error] [pid 45409:tid 45427] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:19.686996 2026] [proxy_fcgi:error] [pid 45409:tid 45422] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:19.944986 2026] [proxy_fcgi:error] [pid 45409:tid 45419] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:20.221924 2026] [proxy_fcgi:error] [pid 45409:tid 45432] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:20.485733 2026] [proxy_fcgi:error] [pid 45409:tid 45416] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:20.812582 2026] [proxy_fcgi:error] [pid 45409:tid 45424] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:21.184725 2026] [proxy_fcgi:error] [pid 45409:tid 45433] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:21.443929 2026] [proxy_fcgi:error] [pid 45409:tid 45421] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:21.701707 2026] [proxy_fcgi:error] [pid 45409:tid 45429] [client 74.248.144.66:20958] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 00:30:22.110569 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:20958] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp8.php"] [unique_id "adKOHtHt_Oyw03gjCNjAqgAAAMI"]
[Mon Apr 06 00:30:22.811297 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:38933] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp8.php"] [unique_id "adKOHrboQ9eViZ4hdnm-ZQAAABA"]
[Mon Apr 06 00:30:23.670792 2026] [:error] [pid 45409:tid 45411] [client 74.248.144.66:12385] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp8.php"] [unique_id "adKOH9Ht_Oyw03gjCNjArgAAAMA"]
[Mon Apr 06 00:30:24.279614 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:44628] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp8.php"] [unique_id "adKOINHt_Oyw03gjCNjAsgAAAMI"]
[Mon Apr 06 00:30:24.875169 2026] [:error] [pid 45409:tid 45420] [client 74.248.144.66:9945] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adKOINHt_Oyw03gjCNjAtgAAAMk"]
[Mon Apr 06 00:30:25.429773 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:1897] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adKOIdHt_Oyw03gjCNjAuQAAAMc"]
[Mon Apr 06 00:30:26.035535 2026] [:error] [pid 45305:tid 45387] [client 74.248.144.66:13231] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adKOIujDQjr7aWhjflCtTQAAAJA"]
[Mon Apr 06 00:30:26.794354 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:45481] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CZoaz8QUeQEV.php"] [unique_id "adKOItHt_Oyw03gjCNjAvgAAAMY"]
[Mon Apr 06 00:30:27.345013 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:1809] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ttRc68YLe0tB.php"] [unique_id "adKOI9Ht_Oyw03gjCNjAwQAAAMc"]
[Mon Apr 06 00:30:27.947924 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:8343] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ttRc68YLe0tB.php"] [unique_id "adKOI7boQ9eViZ4hdnm-bQAAAAQ"]
[Mon Apr 06 00:30:28.566611 2026] [:error] [pid 45303:tid 45328] [client 74.248.144.66:9939] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ttRc68YLe0tB.php"] [unique_id "adKOJLboQ9eViZ4hdnm-bwAAAAs"]
[Mon Apr 06 00:30:29.172438 2026] [:error] [pid 45303:tid 45317] [client 74.248.144.66:12810] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ttRc68YLe0tB.php"] [unique_id "adKOJbboQ9eViZ4hdnm-cQAAAAA"]
[Mon Apr 06 00:30:29.819871 2026] [:error] [pid 45303:tid 45318] [client 74.248.144.66:8383] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adKOJbboQ9eViZ4hdnm-cgAAAAE"]
[Mon Apr 06 00:30:30.624096 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:12378] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adKOJtHt_Oyw03gjCNjA1gAAAMg"]
[Mon Apr 06 00:30:31.351297 2026] [:error] [pid 30921:tid 30928] [client 74.248.144.66:15237] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adKOJ2FGQVn8Q0ueB2598wAAAQU"]
[Mon Apr 06 00:30:32.000060 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:17058] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adKOJ7boQ9eViZ4hdnm-eAAAABA"]
[Mon Apr 06 00:30:32.849358 2026] [:error] [pid 45409:tid 45418] [client 74.248.144.66:1936] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ox9eoqdk.php"] [unique_id "adKOKNHt_Oyw03gjCNjA4AAAAMc"]
[Mon Apr 06 00:30:33.766446 2026] [:error] [pid 45304:tid 45356] [client 74.248.144.66:8337] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ox9eoqdk.php"] [unique_id "adKOKQ5jnqDKKovdRklfRQAAAEw"]
[Mon Apr 06 00:30:34.613781 2026] [:error] [pid 45409:tid 45432] [client 74.248.144.66:12384] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ox9eoqdk.php"] [unique_id "adKOKtHt_Oyw03gjCNjA5wAAANU"]
[Mon Apr 06 00:30:35.395091 2026] [:error] [pid 30921:tid 30947] [client 74.248.144.66:31545] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-ox9eoqdk.php"] [unique_id "adKOK2FGQVn8Q0ueB2599gAAARg"]
[Mon Apr 06 00:30:35.953796 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:16878] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-4qtafzz.php"] [unique_id "adKOK9Ht_Oyw03gjCNjA7gAAAMY"]
[Mon Apr 06 00:30:36.657606 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:14183] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-4qtafzz.php"] [unique_id "adKOLLboQ9eViZ4hdnm-fwAAABA"]
[Mon Apr 06 00:30:37.636301 2026] [:error] [pid 45305:tid 45393] [client 74.248.144.66:9628] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-4qtafzz.php"] [unique_id "adKOLejDQjr7aWhjflCtVgAAAJY"]
[Mon Apr 06 00:30:39.267843 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:26038] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-4qtafzz.php"] [unique_id "adKOL9Ht_Oyw03gjCNjA-wAAAM0"]
[Mon Apr 06 00:30:41.923017 2026] [:error] [pid 45305:tid 45380] [client 74.248.144.66:17024] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gilo.php"] [unique_id "adKOMejDQjr7aWhjflCtVwAAAIk"]
[Mon Apr 06 00:30:42.958763 2026] [:error] [pid 45409:tid 45425] [client 74.248.144.66:12829] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gilo.php"] [unique_id "adKOMtHt_Oyw03gjCNjBEQAAAM4"]
[Mon Apr 06 00:30:44.005571 2026] [:error] [pid 30921:tid 30946] [client 74.248.144.66:13558] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gilo.php"] [unique_id "adKONGFGQVn8Q0ueB25-BAAAARc"]
[Mon Apr 06 00:30:45.064171 2026] [:error] [pid 45304:tid 45351] [client 74.248.144.66:13514] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gilo.php"] [unique_id "adKONQ5jnqDKKovdRklfTQAAAEc"]
[Mon Apr 06 00:30:46.211307 2026] [:error] [pid 30921:tid 30940] [client 74.248.144.66:6350] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adKONmFGQVn8Q0ueB25-CgAAARE"]
[Mon Apr 06 00:30:46.785883 2026] [:error] [pid 45303:tid 45328] [client 74.248.144.66:11207] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adKONrboQ9eViZ4hdnm-lAAAAAs"]
[Mon Apr 06 00:30:47.588082 2026] [:error] [pid 45305:tid 45379] [client 74.248.144.66:14157] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adKON-jDQjr7aWhjflCtWAAAAIg"]
[Mon Apr 06 00:30:48.519901 2026] [:error] [pid 30921:tid 30946] [client 74.248.144.66:33068] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adKOOGFGQVn8Q0ueB25-DQAAARc"]
[Mon Apr 06 00:30:49.307071 2026] [:error] [pid 45409:tid 45424] [client 74.248.144.66:46091] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7r.php"] [unique_id "adKOOdHt_Oyw03gjCNjBNgAAAM0"]
[Mon Apr 06 00:30:49.977008 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:13555] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7r.php"] [unique_id "adKOOdHt_Oyw03gjCNjBOgAAAMY"]
[Mon Apr 06 00:30:50.698614 2026] [:error] [pid 45305:tid 45372] [client 74.248.144.66:45481] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7r.php"] [unique_id "adKOOujDQjr7aWhjflCtWwAAAIE"]
[Mon Apr 06 00:30:51.514067 2026] [:error] [pid 45305:tid 45390] [client 74.248.144.66:14180] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x7r.php"] [unique_id "adKOO-jDQjr7aWhjflCtXgAAAJM"]
[Mon Apr 06 00:30:52.332960 2026] [:error] [pid 45305:tid 45381] [client 74.248.144.66:46080] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2kpf7h.php"] [unique_id "adKOPOjDQjr7aWhjflCtYQAAAIo"]
[Mon Apr 06 00:30:53.243576 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:6389] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2kpf7h.php"] [unique_id "adKOPdHt_Oyw03gjCNjBUQAAAMI"]
[Mon Apr 06 00:30:54.254211 2026] [:error] [pid 45409:tid 45426] [client 74.248.144.66:12853] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2kpf7h.php"] [unique_id "adKOPtHt_Oyw03gjCNjBVgAAAM8"]
[Mon Apr 06 00:30:55.035572 2026] [:error] [pid 30921:tid 30929] [client 74.248.144.66:31544] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2kpf7h.php"] [unique_id "adKOP2FGQVn8Q0ueB25-FwAAAQY"]
[Mon Apr 06 00:30:55.999063 2026] [:error] [pid 45303:tid 45331] [client 74.248.144.66:13506] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-3x94erjd.php"] [unique_id "adKOP7boQ9eViZ4hdnm-rwAAAA4"]
[Mon Apr 06 00:30:56.813998 2026] [:error] [pid 45305:tid 45374] [client 74.248.144.66:9615] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-3x94erjd.php"] [unique_id "adKOQOjDQjr7aWhjflCtcAAAAIM"]
[Mon Apr 06 00:30:57.468925 2026] [:error] [pid 45305:tid 45378] [client 74.248.144.66:6371] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-3x94erjd.php"] [unique_id "adKOQejDQjr7aWhjflCtdQAAAIc"]
[Mon Apr 06 00:30:58.124422 2026] [:error] [pid 45303:tid 45320] [client 74.248.144.66:9736] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-3x94erjd.php"] [unique_id "adKOQrboQ9eViZ4hdnm-twAAAAM"]
[Mon Apr 06 00:30:58.761623 2026] [:error] [pid 45409:tid 45419] [client 74.248.144.66:9753] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riz.php"] [unique_id "adKOQtHt_Oyw03gjCNjBewAAAMg"]
[Mon Apr 06 00:30:59.575665 2026] [:error] [pid 30921:tid 30936] [client 74.248.144.66:13252] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riz.php"] [unique_id "adKOQ2FGQVn8Q0ueB25-JgAAAQ0"]
[Mon Apr 06 00:31:00.494042 2026] [:error] [pid 30921:tid 30947] [client 74.248.144.66:16878] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riz.php"] [unique_id "adKORGFGQVn8Q0ueB25-JwAAARg"]
[Mon Apr 06 00:31:01.567254 2026] [:error] [pid 45305:tid 45392] [client 74.248.144.66:20881] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riz.php"] [unique_id "adKORejDQjr7aWhjflCtewAAAJU"]
[Mon Apr 06 00:31:03.075526 2026] [:error] [pid 30921:tid 30925] [client 74.248.144.66:19328] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "adKOR2FGQVn8Q0ueB25-KQAAAQI"]
[Mon Apr 06 00:31:04.500702 2026] [:error] [pid 45303:tid 45333] [client 74.248.144.66:9765] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "adKOSLboQ9eViZ4hdnm-ywAAABA"]
[Mon Apr 06 00:31:05.467324 2026] [:error] [pid 45303:tid 45335] [client 74.248.144.66:46130] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "adKOSbboQ9eViZ4hdnm-0QAAABI"]
[Mon Apr 06 00:31:06.560949 2026] [:error] [pid 45304:tid 45354] [client 74.248.144.66:20926] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp3.php"] [unique_id "adKOSg5jnqDKKovdRklfdAAAAEo"]
[Mon Apr 06 00:31:07.651919 2026] [:error] [pid 45304:tid 45346] [client 74.248.144.66:14158] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adKOSw5jnqDKKovdRklfdwAAAEI"]
[Mon Apr 06 00:31:08.255329 2026] [:error] [pid 45409:tid 45427] [client 74.248.144.66:20886] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adKOTNHt_Oyw03gjCNjBvAAAANA"]
[Mon Apr 06 00:31:08.879446 2026] [:error] [pid 45303:tid 45337] [client 74.248.144.66:13054] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adKOTLboQ9eViZ4hdnm-2wAAABQ"]
[Mon Apr 06 00:31:09.433799 2026] [:error] [pid 30921:tid 30944] [client 74.248.144.66:14161] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adKOTWFGQVn8Q0ueB25-OAAAARU"]
[Mon Apr 06 00:31:10.070669 2026] [:error] [pid 45303:tid 45321] [client 74.248.144.66:6379] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adKOTrboQ9eViZ4hdnm-3gAAAAQ"]
[Mon Apr 06 00:31:10.778954 2026] [:error] [pid 45409:tid 45412] [client 74.248.144.66:33047] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adKOTtHt_Oyw03gjCNjBwgAAAME"]
[Mon Apr 06 00:31:11.348033 2026] [:error] [pid 45409:tid 45433] [client 74.248.144.66:6383] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adKOT9Ht_Oyw03gjCNjBxgAAANY"]
[Mon Apr 06 00:31:11.929153 2026] [:error] [pid 45303:tid 45320] [client 74.248.144.66:31490] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adKOT7boQ9eViZ4hdnm-4gAAAAM"]
[Mon Apr 06 00:31:12.505446 2026] [:error] [pid 45303:tid 45336] [client 74.248.144.66:20904] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ympoo.php"] [unique_id "adKOULboQ9eViZ4hdnm-4wAAABM"]
[Mon Apr 06 00:31:13.122046 2026] [:error] [pid 45409:tid 45428] [client 74.248.144.66:11261] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ympoo.php"] [unique_id "adKOUdHt_Oyw03gjCNjBzgAAANE"]
[Mon Apr 06 00:31:13.665547 2026] [:error] [pid 45305:tid 45394] [client 74.248.144.66:11246] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ympoo.php"] [unique_id "adKOUejDQjr7aWhjflCtjQAAAJc"]
[Mon Apr 06 00:31:14.225298 2026] [:error] [pid 45409:tid 45413] [client 74.248.144.66:11182] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ympoo.php"] [unique_id "adKOUtHt_Oyw03gjCNjB0gAAAMI"]
[Mon Apr 06 00:31:14.987795 2026] [:error] [pid 45409:tid 45417] [client 74.248.144.66:13509] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/she.php"] [unique_id "adKOUtHt_Oyw03gjCNjB1QAAAMY"]
[Mon Apr 06 00:31:15.649857 2026] [:error] [pid 45305:tid 45379] [client 74.248.144.66:29060] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/she.php"] [unique_id "adKOU-jDQjr7aWhjflCtkAAAAIg"]
[Mon Apr 06 00:31:16.412566 2026] [:error] [pid 30921:tid 30923] [client 74.248.144.66:33082] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/she.php"] [unique_id "adKOVGFGQVn8Q0ueB25-SQAAAQA"]
[Mon Apr 06 00:31:17.243769 2026] [:error] [pid 45305:tid 45392] [client 74.248.144.66:1505] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/she.php"] [unique_id "adKOVejDQjr7aWhjflCtlgAAAJU"]
[Mon Apr 06 00:31:17.955219 2026] [:error] [pid 45409:tid 45434] [client 74.248.144.66:20883] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haojj.php"] [unique_id "adKOVdHt_Oyw03gjCNjB3QAAANc"]
[Mon Apr 06 00:31:18.506980 2026] [:error] [pid 45304:tid 45354] [client 74.248.144.66:29067] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haojj.php"] [unique_id "adKOVg5jnqDKKovdRklfpQAAAEo"]
[Mon Apr 06 00:31:19.099814 2026] [:error] [pid 45303:tid 45326] [client 74.248.144.66:19852] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haojj.php"] [unique_id "adKOV7boQ9eViZ4hdnm-7AAAAAk"]
[Mon Apr 06 00:31:19.961275 2026] [:error] [pid 30921:tid 30930] [client 74.248.144.66:5184] [client 74.248.144.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/haojj.php"] [unique_id "adKOV2FGQVn8Q0ueB25-UQAAAQc"]
[Mon Apr 06 01:16:09.410355 2026] [:error] [pid 51580:tid 51657] [client 43.158.91.71:55530] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adKY2VNFl1NiyNgNZAkj5gAAAFI"]
[Mon Apr 06 05:12:29.225769 2026] [:error] [pid 35688:tid 35769] [client 120.217.171.43:19918] [client 120.217.171.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adLQPeZ85qg4jLsRpQydZgAAAJM"], referer: http://switchcreative.net/
[Mon Apr 06 05:25:03.066496 2026] [proxy_fcgi:error] [pid 35686:tid 35697] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:03.305396 2026] [proxy_fcgi:error] [pid 35686:tid 35708] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:03.573599 2026] [proxy_fcgi:error] [pid 35686:tid 35718] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:03.821828 2026] [proxy_fcgi:error] [pid 35686:tid 35720] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:04.063355 2026] [proxy_fcgi:error] [pid 35686:tid 35711] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:04.303801 2026] [proxy_fcgi:error] [pid 35686:tid 35703] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:25:04.546352 2026] [proxy_fcgi:error] [pid 35686:tid 35717] [client 20.216.155.66:9488] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 05:47:16.136822 2026] [:error] [pid 35686:tid 35714] [client 182.40.104.255:42714] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adLYZMMKdea6oORd2fxQvAAAABI"]
[Mon Apr 06 08:29:09.246882 2026] [proxy_fcgi:error] [pid 35688:tid 35752] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:09.496177 2026] [proxy_fcgi:error] [pid 35688:tid 35766] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:09.751064 2026] [proxy_fcgi:error] [pid 35688:tid 35773] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:09.987815 2026] [proxy_fcgi:error] [pid 35688:tid 35751] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:11.590075 2026] [proxy_fcgi:error] [pid 35688:tid 35751] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:11.832066 2026] [proxy_fcgi:error] [pid 35688:tid 35753] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:29:12.082837 2026] [proxy_fcgi:error] [pid 35688:tid 35763] [client 72.146.8.131:63248] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:29.701757 2026] [proxy_fcgi:error] [pid 9442:tid 9446] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:29.948750 2026] [proxy_fcgi:error] [pid 9442:tid 9461] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:30.190875 2026] [proxy_fcgi:error] [pid 9442:tid 9466] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:30.434230 2026] [proxy_fcgi:error] [pid 9442:tid 9463] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:30.682981 2026] [proxy_fcgi:error] [pid 9442:tid 9458] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:30.929854 2026] [proxy_fcgi:error] [pid 9442:tid 9452] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:30:31.172754 2026] [proxy_fcgi:error] [pid 9442:tid 9464] [client 158.158.105.166:46732] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:48.773517 2026] [proxy_fcgi:error] [pid 9442:tid 9459] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:49.033762 2026] [proxy_fcgi:error] [pid 9442:tid 9456] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:49.293911 2026] [proxy_fcgi:error] [pid 9442:tid 9466] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:49.554928 2026] [proxy_fcgi:error] [pid 9442:tid 9457] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:49.813791 2026] [proxy_fcgi:error] [pid 9442:tid 9467] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:50.071562 2026] [proxy_fcgi:error] [pid 9442:tid 9464] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:50.332407 2026] [proxy_fcgi:error] [pid 9442:tid 9454] [client 20.215.186.156:5217] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:55.598012 2026] [proxy_fcgi:error] [pid 35688:tid 35770] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:55.836026 2026] [proxy_fcgi:error] [pid 35688:tid 35751] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:56.074926 2026] [proxy_fcgi:error] [pid 35688:tid 35761] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:56.317507 2026] [proxy_fcgi:error] [pid 35688:tid 35772] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:56.556222 2026] [proxy_fcgi:error] [pid 35688:tid 35762] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:56.795321 2026] [proxy_fcgi:error] [pid 35688:tid 35752] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:57.036720 2026] [proxy_fcgi:error] [pid 35688:tid 35774] [client 20.216.155.66:36318] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:58.152631 2026] [proxy_fcgi:error] [pid 35687:tid 35737] [client 20.216.155.66:5170] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:58.395762 2026] [proxy_fcgi:error] [pid 35687:tid 35723] [client 20.216.155.66:5170] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:31:58.631396 2026] [:error] [pid 35687:tid 35732] [client 20.216.155.66:5170] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adL-_p3LtDozV0i8BivGogAAAEk"]
[Mon Apr 06 08:31:59.139808 2026] [:error] [pid 35687:tid 35725] [client 20.216.155.66:49652] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adL-_53LtDozV0i8BivGpAAAAEI"]
[Mon Apr 06 08:31:59.640150 2026] [:error] [pid 35687:tid 35724] [client 20.216.155.66:49616] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adL-_53LtDozV0i8BivGpgAAAEE"]
[Mon Apr 06 08:32:00.204183 2026] [:error] [pid 35687:tid 35745] [client 20.216.155.66:5156] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adL_AJ3LtDozV0i8BivGpwAAAFY"]
[Mon Apr 06 08:32:00.675579 2026] [:error] [pid 35686:tid 35704] [client 20.216.155.66:5157] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scxy.php"] [unique_id "adL_AMMKdea6oORd2fyRbAAAAAg"]
[Mon Apr 06 08:32:01.215628 2026] [:error] [pid 35686:tid 35701] [client 20.216.155.66:5396] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scxy.php"] [unique_id "adL_AcMKdea6oORd2fyRcAAAAAU"]
[Mon Apr 06 08:32:01.692427 2026] [:error] [pid 35687:tid 35726] [client 20.216.155.66:5145] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scxy.php"] [unique_id "adL_AZ3LtDozV0i8BivGqwAAAEM"]
[Mon Apr 06 08:32:02.227209 2026] [:error] [pid 35688:tid 35757] [client 20.216.155.66:49609] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-scxy.php"] [unique_id "adL_AuZ85qg4jLsRpQzepAAAAIc"]
[Mon Apr 06 08:32:02.793087 2026] [:error] [pid 35686:tid 35702] [client 20.216.155.66:49608] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou1.php"] [unique_id "adL_AsMKdea6oORd2fyRdwAAAAY"]
[Mon Apr 06 08:32:03.288305 2026] [:error] [pid 35686:tid 35719] [client 20.216.155.66:49612] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou1.php"] [unique_id "adL_A8MKdea6oORd2fyRewAAABc"]
[Mon Apr 06 08:32:03.759658 2026] [:error] [pid 35688:tid 35755] [client 20.216.155.66:5159] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou1.php"] [unique_id "adL_A-Z85qg4jLsRpQzepQAAAIU"]
[Mon Apr 06 08:32:04.236665 2026] [:error] [pid 35786:tid 35816] [client 20.216.155.66:5133] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou1.php"] [unique_id "adL_BGgkfCKTaLhwaKR3lwAAANc"]
[Mon Apr 06 08:32:04.803172 2026] [:error] [pid 9442:tid 9455] [client 20.216.155.66:5146] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the1.php"] [unique_id "adL_BEPsNnAJTnmz6sZExgAAAQs"]
[Mon Apr 06 08:32:05.334160 2026] [:error] [pid 9442:tid 9461] [client 20.216.155.66:5177] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the1.php"] [unique_id "adL_BUPsNnAJTnmz6sZEyAAAARE"]
[Mon Apr 06 08:32:05.804908 2026] [:error] [pid 35786:tid 35801] [client 20.216.155.66:49611] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the1.php"] [unique_id "adL_BWgkfCKTaLhwaKR3mwAAAMg"]
[Mon Apr 06 08:32:06.338378 2026] [:error] [pid 35786:tid 35806] [client 20.216.155.66:49617] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the1.php"] [unique_id "adL_BmgkfCKTaLhwaKR3oAAAAM0"]
[Mon Apr 06 08:32:06.812654 2026] [:error] [pid 35786:tid 35799] [client 20.216.155.66:5124] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reyna.php"] [unique_id "adL_BmgkfCKTaLhwaKR3pAAAAMY"]
[Mon Apr 06 08:32:07.305988 2026] [:error] [pid 35687:tid 35745] [client 20.216.155.66:5150] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reyna.php"] [unique_id "adL_B53LtDozV0i8BivGsgAAAFY"]
[Mon Apr 06 08:32:07.797816 2026] [:error] [pid 35686:tid 35712] [client 20.216.155.66:49601] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reyna.php"] [unique_id "adL_B8MKdea6oORd2fyRfwAAABA"]
[Mon Apr 06 08:32:08.344450 2026] [:error] [pid 35686:tid 35704] [client 20.216.155.66:49626] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reyna.php"] [unique_id "adL_CMMKdea6oORd2fyRggAAAAg"]
[Mon Apr 06 08:32:09.456500 2026] [:error] [pid 35688:tid 35753] [client 20.216.155.66:31227] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adL_CeZ85qg4jLsRpQzeqwAAAIM"]
[Mon Apr 06 08:32:09.957979 2026] [:error] [pid 9442:tid 9450] [client 20.216.155.66:31197] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adL_CUPsNnAJTnmz6sZE0AAAAQY"]
[Mon Apr 06 08:32:10.508303 2026] [:error] [pid 9442:tid 9461] [client 20.216.155.66:30843] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adL_CkPsNnAJTnmz6sZE1gAAARE"]
[Mon Apr 06 08:32:11.001442 2026] [:error] [pid 35786:tid 35794] [client 20.216.155.66:30469] [client 20.216.155.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adL_C2gkfCKTaLhwaKR3qQAAAME"]
[Mon Apr 06 08:34:04.530913 2026] [proxy_fcgi:error] [pid 35686:tid 35710] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:04.777546 2026] [proxy_fcgi:error] [pid 35686:tid 35719] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:06.336610 2026] [proxy_fcgi:error] [pid 35686:tid 35703] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:06.573467 2026] [proxy_fcgi:error] [pid 35686:tid 35709] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:06.818918 2026] [proxy_fcgi:error] [pid 35686:tid 35700] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:07.061915 2026] [proxy_fcgi:error] [pid 35686:tid 35707] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:34:07.307585 2026] [proxy_fcgi:error] [pid 35686:tid 35716] [client 72.146.8.131:46638] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:05.803314 2026] [proxy_fcgi:error] [pid 35686:tid 35701] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:06.056449 2026] [proxy_fcgi:error] [pid 35686:tid 35706] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:06.304341 2026] [proxy_fcgi:error] [pid 35686:tid 35707] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:06.555009 2026] [proxy_fcgi:error] [pid 35686:tid 35720] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:06.801450 2026] [proxy_fcgi:error] [pid 35686:tid 35701] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:07.052284 2026] [proxy_fcgi:error] [pid 35686:tid 35718] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:35:07.304904 2026] [proxy_fcgi:error] [pid 35686:tid 35700] [client 158.158.105.166:64043] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:27.008714 2026] [proxy_fcgi:error] [pid 9442:tid 9448] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:27.262642 2026] [proxy_fcgi:error] [pid 9442:tid 9456] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:27.516960 2026] [proxy_fcgi:error] [pid 9442:tid 9467] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:27.770891 2026] [proxy_fcgi:error] [pid 9442:tid 9463] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:28.024966 2026] [proxy_fcgi:error] [pid 9442:tid 9464] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:28.278926 2026] [proxy_fcgi:error] [pid 9442:tid 9445] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 08:41:28.534248 2026] [proxy_fcgi:error] [pid 9442:tid 9448] [client 98.71.81.8:31820] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 11:45:15.140113 2026] [:error] [pid 38562:tid 38570] [client 49.37.35.82:52431] [client 49.37.35.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.35.82, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adMsS6eD6Ohe6wzRuy6I5AAAAUU"]
[Mon Apr 06 11:45:15.150586 2026] [proxy_fcgi:error] [pid 38562:tid 38570] [client 49.37.35.82:52431] AH01071: Got error 'Primary script unknown'
[Mon Apr 06 14:44:26.360704 2026] [:error] [pid 9442:tid 9445] [client 62.84.185.55:41216] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adNWSkPsNnAJTnmz6sYr2gAAAQE"]
[Mon Apr 06 14:44:30.186735 2026] [:error] [pid 35686:tid 35713] [client 62.84.185.55:63198] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adNWTsMKdea6oORd2fwfGwAAABE"]
[Mon Apr 06 14:44:37.809664 2026] [:error] [pid 9442:tid 9460] [client 62.84.185.55:42396] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adNWVUPsNnAJTnmz6sYsCwAAARA"]
[Mon Apr 06 14:44:41.811471 2026] [:error] [pid 35786:tid 35793] [client 62.84.185.55:42400] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adNWWWgkfCKTaLhwaKTgIgAAAMA"]
[Mon Apr 06 14:44:46.183366 2026] [:error] [pid 38562:tid 38582] [client 62.84.185.55:42416] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adNWXqeD6Ohe6wzRuy7fsgAAAVE"]
[Mon Apr 06 14:44:48.999659 2026] [:error] [pid 35686:tid 35710] [client 62.84.185.55:40700] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adNWYMMKdea6oORd2fwfNgAAAA4"]
[Mon Apr 06 14:44:53.069545 2026] [:error] [pid 35687:tid 35727] [client 62.84.185.55:40714] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adNWZZ3LtDozV0i8BisNLAAAAEQ"]
[Mon Apr 06 14:44:57.299904 2026] [:error] [pid 9442:tid 9464] [client 62.84.185.55:4788] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adNWaUPsNnAJTnmz6sYsRgAAARQ"]
[Mon Apr 06 14:45:02.995372 2026] [:error] [pid 38562:tid 38586] [client 62.84.185.55:4790] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adNWbqeD6Ohe6wzRuy7f7AAAAVU"]
[Mon Apr 06 14:45:10.079889 2026] [:error] [pid 35687:tid 35733] [client 62.84.185.55:53494] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adNWdp3LtDozV0i8BisNQQAAAEo"]
[Mon Apr 06 14:45:13.254448 2026] [:error] [pid 38562:tid 38586] [client 62.84.185.55:53502] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adNWeaeD6Ohe6wzRuy7f_gAAAVU"]
[Mon Apr 06 14:45:17.386975 2026] [:error] [pid 38562:tid 38577] [client 62.84.185.55:32614] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adNWfaeD6Ohe6wzRuy7gBwAAAUw"]
[Mon Apr 06 14:45:20.417829 2026] [:error] [pid 35786:tid 35795] [client 62.84.185.55:32624] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adNWgGgkfCKTaLhwaKTgVwAAAMI"]
[Mon Apr 06 14:46:12.293393 2026] [:error] [pid 9442:tid 9458] [client 62.84.185.55:20948] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adNWtEPsNnAJTnmz6sYtRQAAAQ4"]
[Mon Apr 06 14:46:17.446539 2026] [:error] [pid 35688:tid 35755] [client 62.84.185.55:18110] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adNWueZ85qg4jLsRpQw0FgAAAIU"]
[Mon Apr 06 14:46:20.799137 2026] [:error] [pid 9442:tid 9458] [client 62.84.185.55:18116] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adNWvEPsNnAJTnmz6sYtVQAAAQ4"]
[Mon Apr 06 14:46:25.062686 2026] [:error] [pid 9442:tid 9453] [client 62.84.185.55:18132] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adNWwUPsNnAJTnmz6sYtdAAAAQk"]
[Mon Apr 06 14:46:27.495509 2026] [:error] [pid 38562:tid 38588] [client 62.84.185.55:64120] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adNWw6eD6Ohe6wzRuy7giAAAAVc"]
[Mon Apr 06 14:46:33.473469 2026] [:error] [pid 35687:tid 35746] [client 62.84.185.55:19512] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adNWyZ3LtDozV0i8BisNkwAAAFc"]
[Mon Apr 06 14:46:38.878316 2026] [:error] [pid 35786:tid 35817] [client 62.84.185.55:35434] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adNWzmgkfCKTaLhwaKTgxgAAANg"]
[Mon Apr 06 14:46:42.391617 2026] [:error] [pid 35686:tid 35712] [client 62.84.185.55:35446] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adNW0sMKdea6oORd2fwgAAAAABA"]
[Mon Apr 06 14:46:45.804991 2026] [:error] [pid 35786:tid 35805] [client 62.84.185.55:35448] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adNW1WgkfCKTaLhwaKTg0wAAAMw"]
[Mon Apr 06 14:46:48.869951 2026] [:error] [pid 9442:tid 9444] [client 62.84.185.55:60464] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adNW2EPsNnAJTnmz6sYtswAAAQA"]
[Mon Apr 06 14:46:52.775588 2026] [:error] [pid 35686:tid 35700] [client 62.84.185.55:60476] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adNW3MMKdea6oORd2fwgDwAAAAQ"]
[Mon Apr 06 14:46:55.965056 2026] [:error] [pid 9442:tid 9461] [client 62.84.185.55:60486] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adNW30PsNnAJTnmz6sYtvAAAARE"]
[Mon Apr 06 14:47:04.065796 2026] [:error] [pid 35688:tid 35761] [client 62.84.185.55:43662] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adNW6OZ85qg4jLsRpQw0UAAAAIs"]
[Mon Apr 06 14:47:08.575564 2026] [:error] [pid 38562:tid 38569] [client 62.84.185.55:21356] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adNW7KeD6Ohe6wzRuy7g5wAAAUQ"]
[Mon Apr 06 14:47:55.668402 2026] [:error] [pid 35686:tid 35707] [client 62.84.185.55:38154] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adNXG8MKdea6oORd2fwgegAAAAs"]
[Mon Apr 06 14:47:59.697325 2026] [:error] [pid 35688:tid 35768] [client 62.84.185.55:23054] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adNXH-Z85qg4jLsRpQw0sQAAAJI"]
[Mon Apr 06 14:48:06.709636 2026] [:error] [pid 38562:tid 38569] [client 62.84.185.55:23062] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adNXJqeD6Ohe6wzRuy7hxgAAAUQ"]
[Mon Apr 06 14:48:10.072588 2026] [:error] [pid 35687:tid 35736] [client 62.84.185.55:19056] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adNXKp3LtDozV0i8BisOHAAAAE0"]
[Mon Apr 06 14:48:13.823564 2026] [:error] [pid 35686:tid 35715] [client 62.84.185.55:19058] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adNXLcMKdea6oORd2fwgmwAAABM"]
[Mon Apr 06 14:48:17.791117 2026] [:error] [pid 35688:tid 35759] [client 62.84.185.55:21478] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adNXMeZ85qg4jLsRpQw0yAAAAIk"]
[Mon Apr 06 14:48:20.880024 2026] [:error] [pid 9442:tid 9452] [client 62.84.185.55:21494] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adNXNEPsNnAJTnmz6sYvJgAAAQg"]
[Mon Apr 06 14:48:22.689286 2026] [:error] [pid 38562:tid 38585] [client 62.84.185.55:21506] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adNXNqeD6Ohe6wzRuy7h7gAAAVQ"]
[Mon Apr 06 14:48:28.002750 2026] [:error] [pid 35687:tid 35746] [client 62.84.185.55:8986] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adNXPJ3LtDozV0i8BisOKAAAAFc"]
[Mon Apr 06 17:12:13.734486 2026] [:error] [pid 35688:tid 35751] [client 65.108.125.120:24210] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adN47eZ85qg4jLsRpQxOKgAAAIE"]
[Mon Apr 06 17:12:16.239833 2026] [:error] [pid 35687:tid 35733] [client 65.108.125.120:45100] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adN48J3LtDozV0i8Bis_IQAAAEo"]
[Mon Apr 06 17:12:17.987270 2026] [:error] [pid 38562:tid 38583] [client 65.108.125.120:28538] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adN48aeD6Ohe6wzRuy46kgAAAVI"]
[Mon Apr 06 17:12:20.514206 2026] [:error] [pid 10280:tid 10300] [client 65.108.125.120:38904] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adN49F8QUJkf8g-BFfOeiAAAAdE"]
[Mon Apr 06 17:12:22.957810 2026] [:error] [pid 10280:tid 10302] [client 65.108.125.120:38910] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adN49l8QUJkf8g-BFfOekAAAAdM"]
[Mon Apr 06 17:12:24.998454 2026] [:error] [pid 10280:tid 10292] [client 65.108.125.120:28552] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adN4-F8QUJkf8g-BFfOelwAAAck"]
[Mon Apr 06 17:12:27.520572 2026] [:error] [pid 35687:tid 35743] [client 65.108.125.120:38914] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adN4-53LtDozV0i8Bis_KwAAAFQ"]
[Mon Apr 06 17:12:29.561854 2026] [:error] [pid 35686:tid 35697] [client 65.108.125.120:60626] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adN4_cMKdea6oORd2fyN3AAAAAE"]
[Mon Apr 06 17:12:32.069537 2026] [:error] [pid 35686:tid 35698] [client 65.108.125.120:63170] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adN5AMMKdea6oORd2fyN6QAAAAI"]
[Mon Apr 06 17:12:34.699250 2026] [:error] [pid 9413:tid 9418] [client 65.108.125.120:63186] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adN5AnllvEK3chn01wGj4QAAAYM"]
[Mon Apr 06 17:12:36.744620 2026] [:error] [pid 9442:tid 9464] [client 65.108.125.120:60640] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adN5BEPsNnAJTnmz6sZl9QAAARQ"]
[Mon Apr 06 17:12:38.739140 2026] [:error] [pid 35687:tid 35743] [client 65.108.125.120:50530] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adN5Bp3LtDozV0i8Bis_NAAAAFQ"]
[Mon Apr 06 17:12:41.259330 2026] [:error] [pid 38562:tid 38574] [client 65.108.125.120:38378] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adN5CaeD6Ohe6wzRuy46vAAAAUk"]
[Mon Apr 06 17:12:43.291023 2026] [:error] [pid 35686:tid 35702] [client 65.108.125.120:50532] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adN5C8MKdea6oORd2fyOFAAAAAY"]
[Mon Apr 06 17:12:45.267732 2026] [:error] [pid 35688:tid 35755] [client 65.108.125.120:50540] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adN5DeZ85qg4jLsRpQxOPgAAAIU"]
[Mon Apr 06 17:12:47.248665 2026] [:error] [pid 38562:tid 38581] [client 65.108.125.120:50548] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adN5D6eD6Ohe6wzRuy46wwAAAVA"]
[Mon Apr 06 17:12:49.062416 2026] [:error] [pid 38562:tid 38577] [client 65.108.125.120:8506] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adN5EaeD6Ohe6wzRuy46xQAAAUw"]
[Mon Apr 06 17:12:51.041469 2026] [:error] [pid 35687:tid 35738] [client 65.108.125.120:8516] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adN5E53LtDozV0i8Bis_QwAAAE8"]
[Mon Apr 06 17:12:52.862640 2026] [:error] [pid 35686:tid 35720] [client 65.108.125.120:8524] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adN5FMMKdea6oORd2fyOSQAAABg"]
[Mon Apr 06 17:12:55.382214 2026] [:error] [pid 38562:tid 38586] [client 65.108.125.120:48632] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adN5F6eD6Ohe6wzRuy461AAAAVU"]
[Mon Apr 06 17:12:57.807305 2026] [:error] [pid 35687:tid 35748] [client 65.108.125.120:48642] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "adN5GZ3LtDozV0i8Bis_SQAAAFg"]
[Mon Apr 06 17:13:00.385972 2026] [:error] [pid 38562:tid 38585] [client 65.108.125.120:57528] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adN5HKeD6Ohe6wzRuy464wAAAVQ"]
[Mon Apr 06 17:13:02.430642 2026] [:error] [pid 38562:tid 38583] [client 65.108.125.120:7302] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adN5HqeD6Ohe6wzRuy466wAAAVI"]
[Mon Apr 06 17:13:04.946451 2026] [:error] [pid 35686:tid 35720] [client 65.108.125.120:57540] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adN5IMMKdea6oORd2fyOdQAAABg"]
[Mon Apr 06 17:13:07.533750 2026] [:error] [pid 38562:tid 38577] [client 65.108.125.120:57544] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adN5I6eD6Ohe6wzRuy469QAAAUw"]
[Mon Apr 06 17:13:09.580893 2026] [:error] [pid 10280:tid 10300] [client 65.108.125.120:50432] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adN5JV8QUJkf8g-BFfOe2AAAAdE"]
[Mon Apr 06 17:13:41.905655 2026] [:error] [pid 9413:tid 9428] [client 65.108.125.120:18472] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adN5RXllvEK3chn01wGkHgAAAY0"]
[Mon Apr 06 17:13:44.412849 2026] [:error] [pid 9442:tid 9452] [client 65.108.125.120:47964] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adN5SEPsNnAJTnmz6sZmWwAAAQg"]
[Mon Apr 06 17:13:46.861653 2026] [:error] [pid 10280:tid 10287] [client 65.108.125.120:47978] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adN5Sl8QUJkf8g-BFfOfGwAAAcQ"]
[Mon Apr 06 17:13:48.897600 2026] [:error] [pid 35686:tid 35700] [client 65.108.125.120:22370] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adN5TMMKdea6oORd2fyO6gAAAAQ"]
[Mon Apr 06 17:13:51.262753 2026] [:error] [pid 35687:tid 35725] [client 65.108.125.120:9830] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adN5T53LtDozV0i8Bis_gAAAAEI"]
[Mon Apr 06 17:13:53.822559 2026] [:error] [pid 9413:tid 9431] [client 65.108.125.120:9844] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adN5UXllvEK3chn01wGkIwAAAZA"]
[Mon Apr 06 17:13:56.267589 2026] [:error] [pid 38562:tid 38583] [client 65.108.125.120:9860] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adN5VKeD6Ohe6wzRuy47TwAAAVI"]
[Mon Apr 06 17:13:58.844097 2026] [:error] [pid 10280:tid 10301] [client 65.108.125.120:59652] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adN5Vl8QUJkf8g-BFfOfPgAAAdI"]
[Mon Apr 06 17:14:01.274067 2026] [:error] [pid 35688:tid 35767] [client 65.108.125.120:59662] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adN5WeZ85qg4jLsRpQxOdAAAAJE"]
[Mon Apr 06 17:14:03.315728 2026] [:error] [pid 9413:tid 9415] [client 65.108.125.120:25938] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adN5W3llvEK3chn01wGkKQAAAYA"]
[Mon Apr 06 17:14:05.687022 2026] [:error] [pid 9442:tid 9465] [client 65.108.125.120:59664] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adN5XUPsNnAJTnmz6sZmiwAAARU"]
[Mon Apr 06 17:14:08.142775 2026] [:error] [pid 9413:tid 9429] [client 65.108.125.120:51948] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adN5YHllvEK3chn01wGkMwAAAY4"]
[Mon Apr 06 17:14:10.712293 2026] [:error] [pid 35686:tid 35706] [client 65.108.125.120:51954] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adN5YsMKdea6oORd2fyPEgAAAAo"]
[Mon Apr 06 17:14:13.285313 2026] [:error] [pid 35686:tid 35708] [client 65.108.125.120:51956] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adN5ZcMKdea6oORd2fyPIQAAAAw"]
[Mon Apr 06 17:14:15.331715 2026] [:error] [pid 35686:tid 35698] [client 65.108.125.120:30288] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adN5Z8MKdea6oORd2fyPJQAAAAI"]
[Mon Apr 06 17:14:17.828686 2026] [:error] [pid 35786:tid 35805] [client 65.108.125.120:51962] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adN5aWgkfCKTaLhwaKQBfwAAAMw"]
[Mon Apr 06 17:14:19.873520 2026] [:error] [pid 35786:tid 35796] [client 65.108.125.120:32692] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adN5a2gkfCKTaLhwaKQBgwAAAMM"]
[Mon Apr 06 17:14:21.840867 2026] [:error] [pid 10280:tid 10307] [client 65.108.125.120:32694] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adN5bV8QUJkf8g-BFfOfkQAAAdg"]
[Mon Apr 06 17:14:24.357680 2026] [:error] [pid 35686:tid 35702] [client 65.108.125.120:38194] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adN5cMMKdea6oORd2fyPTgAAAAY"]
[Mon Apr 06 17:14:26.410850 2026] [:error] [pid 35687:tid 35739] [client 65.108.125.120:32706] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adN5cp3LtDozV0i8Bis_pgAAAFA"]
[Mon Apr 06 17:14:28.388996 2026] [:error] [pid 35687:tid 35727] [client 65.108.125.120:5594] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adN5dJ3LtDozV0i8Bis_pwAAAEQ"]
[Mon Apr 06 17:14:30.366823 2026] [:error] [pid 35686:tid 35709] [client 65.108.125.120:5600] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adN5dsMKdea6oORd2fyPaAAAAA0"]
[Mon Apr 06 17:14:32.382849 2026] [:error] [pid 9442:tid 9450] [client 65.108.125.120:5604] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adN5eEPsNnAJTnmz6sZmqQAAAQY"]
[Mon Apr 06 17:14:34.367875 2026] [:error] [pid 38562:tid 38588] [client 65.108.125.120:5616] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adN5eqeD6Ohe6wzRuy47pwAAAVc"]
[Mon Apr 06 17:14:36.346481 2026] [:error] [pid 35786:tid 35802] [client 65.108.125.120:5622] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adN5fGgkfCKTaLhwaKQBjgAAAMk"]
[Mon Apr 06 17:14:38.857161 2026] [:error] [pid 35687:tid 35737] [client 65.108.125.120:31606] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adN5fp3LtDozV0i8Bis_ugAAAE4"]
[Mon Apr 06 17:15:04.383963 2026] [:error] [pid 10280:tid 10295] [client 65.108.125.120:13106] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adN5mF8QUJkf8g-BFfOf0AAAAcw"]
[Mon Apr 06 17:15:06.200817 2026] [:error] [pid 38562:tid 38583] [client 65.108.125.120:13116] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adN5mqeD6Ohe6wzRuy476wAAAVI"]
[Mon Apr 06 17:15:08.704156 2026] [:error] [pid 10280:tid 10297] [client 65.108.125.120:37502] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adN5nF8QUJkf8g-BFfOf2gAAAc4"]
[Mon Apr 06 17:15:10.745299 2026] [:error] [pid 35687:tid 35733] [client 65.108.125.120:16540] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adN5np3LtDozV0i8Bis_5wAAAEo"]
[Mon Apr 06 17:15:12.704634 2026] [:error] [pid 9442:tid 9454] [client 65.108.125.120:16556] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adN5oEPsNnAJTnmz6sZm0AAAAQo"]
[Mon Apr 06 17:15:14.680007 2026] [:error] [pid 10280:tid 10294] [client 65.108.125.120:16560] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adN5ol8QUJkf8g-BFfOf9gAAAcs"]
[Mon Apr 06 17:15:16.642103 2026] [:error] [pid 35686:tid 35713] [client 65.108.125.120:16570] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "adN5pMMKdea6oORd2fyPvAAAABE"]
[Mon Apr 06 17:15:19.159003 2026] [:error] [pid 38562:tid 38587] [client 65.108.125.120:23042] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "adN5p6eD6Ohe6wzRuy48BwAAAVY"]
[Mon Apr 06 17:15:21.194746 2026] [:error] [pid 35687:tid 35739] [client 65.108.125.120:15866] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "adN5qZ3LtDozV0i8Bis_-AAAAFA"]
[Mon Apr 06 17:15:23.012479 2026] [:error] [pid 35686:tid 35711] [client 65.108.125.120:15878] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adN5q8MKdea6oORd2fyP1gAAAA8"]
[Mon Apr 06 17:15:25.537123 2026] [:error] [pid 35686:tid 35703] [client 65.108.125.120:23044] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adN5rcMKdea6oORd2fyP4gAAAAc"]
[Mon Apr 06 17:15:28.104411 2026] [:error] [pid 35686:tid 35703] [client 65.108.125.120:41562] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adN5sMMKdea6oORd2fyP8AAAAAc"]
[Mon Apr 06 17:15:30.140837 2026] [:error] [pid 9413:tid 9426] [client 65.108.125.120:56126] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adN5snllvEK3chn01wGkfwAAAYs"]
[Mon Apr 06 17:15:32.639277 2026] [:error] [pid 9442:tid 9454] [client 65.108.125.120:41574] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adN5tEPsNnAJTnmz6sZm6AAAAQo"]
[Mon Apr 06 17:15:34.689313 2026] [:error] [pid 10280:tid 10291] [client 65.108.125.120:56136] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adN5tl8QUJkf8g-BFfOgCAAAAcg"]
[Mon Apr 06 17:15:37.203539 2026] [:error] [pid 35686:tid 35711] [client 65.108.125.120:41590] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adN5ucMKdea6oORd2fyQEgAAAA8"]
[Mon Apr 06 17:15:39.765021 2026] [:error] [pid 35786:tid 35795] [client 65.108.125.120:56068] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adN5u2gkfCKTaLhwaKQBswAAAMI"]
[Mon Apr 06 17:15:41.802381 2026] [:error] [pid 35686:tid 35715] [client 65.108.125.120:19078] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adN5vcMKdea6oORd2fyQJgAAABM"]
[Mon Apr 06 17:15:44.310400 2026] [:error] [pid 10280:tid 10297] [client 65.108.125.120:56074] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adN5wF8QUJkf8g-BFfOgFgAAAc4"]
[Mon Apr 06 17:15:46.360911 2026] [:error] [pid 35687:tid 35740] [client 65.108.125.120:19080] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adN5wp3LtDozV0i8BitABgAAAFE"]
[Mon Apr 06 17:15:48.889050 2026] [:error] [pid 9413:tid 9428] [client 65.108.125.120:29486] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adN5xHllvEK3chn01wGkjgAAAY0"]
[Mon Apr 06 17:15:51.480154 2026] [:error] [pid 35686:tid 35717] [client 65.108.125.120:29494] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adN5x8MKdea6oORd2fyQQAAAABU"]
[Mon Apr 06 17:15:54.065791 2026] [:error] [pid 9442:tid 9468] [client 65.108.125.120:29502] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adN5ykPsNnAJTnmz6sZnDwAAARg"]
[Mon Apr 06 17:15:56.105252 2026] [:error] [pid 38562:tid 38577] [client 65.108.125.120:17328] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adN5zKeD6Ohe6wzRuy48RwAAAUw"]
[Mon Apr 06 17:15:58.616956 2026] [:error] [pid 38562:tid 38587] [client 65.108.125.120:53178] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adN5zqeD6Ohe6wzRuy48SwAAAVY"]
[Mon Apr 06 17:16:00.519519 2026] [:error] [pid 38562:tid 38579] [client 65.108.125.120:6198] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adN50KeD6Ohe6wzRuy48VwAAAU4"]
[Mon Apr 06 17:16:30.620054 2026] [:error] [pid 35687:tid 35736] [client 65.108.125.120:64762] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adN57p3LtDozV0i8BitARQAAAE0"]
[Mon Apr 06 17:16:33.046948 2026] [:error] [pid 35786:tid 35805] [client 65.108.125.120:64772] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adN58WgkfCKTaLhwaKQB6gAAAMw"]
[Mon Apr 06 17:16:35.622949 2026] [:error] [pid 38562:tid 38571] [client 65.108.125.120:64778] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adN586eD6Ohe6wzRuy49FAAAAUY"]
[Mon Apr 06 17:16:38.061387 2026] [:error] [pid 35687:tid 35723] [client 65.108.125.120:3862] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adN59p3LtDozV0i8BitAXwAAAEA"]
[Mon Apr 06 17:16:40.677897 2026] [:error] [pid 35687:tid 35745] [client 65.108.125.120:3876] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adN5-J3LtDozV0i8BitAYgAAAFY"]
[Mon Apr 06 17:16:43.245496 2026] [:error] [pid 10280:tid 10289] [client 65.108.125.120:3888] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adN5-18QUJkf8g-BFfOg8wAAAcY"]
[Mon Apr 06 17:16:45.745040 2026] [:error] [pid 35687:tid 35746] [client 65.108.125.120:3896] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adN5_Z3LtDozV0i8BitAbgAAAFc"]
[Mon Apr 06 17:16:48.221228 2026] [:error] [pid 9413:tid 9438] [client 65.108.125.120:22880] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adN6AHllvEK3chn01wGk1QAAAZc"]
[Mon Apr 06 17:16:50.849953 2026] [:error] [pid 9442:tid 9459] [client 65.108.125.120:22894] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adN6AkPsNnAJTnmz6sZnZwAAAQ8"]
[Mon Apr 06 17:16:51.984914 2026] [:error] [pid 35687:tid 35748] [client 65.108.125.120:3662] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adN6A53LtDozV0i8BitAdwAAAFg"]
[Mon Apr 06 17:16:55.818779 2026] [:error] [pid 35686:tid 35699] [client 65.108.125.120:3672] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adN6B8MKdea6oORd2fyRQgAAAAM"]
[Mon Apr 06 18:47:43.893838 2026] [:error] [pid 9442:tid 9449] [client 79.137.67.86:52600] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adOPT0PsNnAJTnmz6saClAAAAQU"]
[Mon Apr 06 18:47:47.064793 2026] [:error] [pid 35688:tid 35757] [client 79.137.67.86:50744] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adOPU-Z85qg4jLsRpQxv2wAAAIc"]
[Mon Apr 06 18:47:50.281320 2026] [:error] [pid 9442:tid 9461] [client 79.137.67.86:49732] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adOPVkPsNnAJTnmz6saCrAAAARE"]
[Mon Apr 06 18:47:52.795594 2026] [:error] [pid 10280:tid 10298] [client 79.137.67.86:49746] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adOPWF8QUJkf8g-BFfPLoAAAAc8"]
[Mon Apr 06 18:47:55.806622 2026] [:error] [pid 38562:tid 38575] [client 79.137.67.86:49752] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adOPW6eD6Ohe6wzRuy5nHgAAAUo"]
[Mon Apr 06 18:47:58.577688 2026] [:error] [pid 35687:tid 35731] [client 79.137.67.86:52552] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adOPXp3LtDozV0i8BitahwAAAEg"]
[Mon Apr 06 18:48:01.244044 2026] [:error] [pid 35688:tid 35762] [client 79.137.67.86:52566] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adOPYeZ85qg4jLsRpQxwCQAAAIw"]
[Mon Apr 06 18:48:03.908046 2026] [:error] [pid 9442:tid 9444] [client 79.137.67.86:52578] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adOPY0PsNnAJTnmz6saCvAAAAQA"]
[Mon Apr 06 18:48:06.787575 2026] [:error] [pid 9442:tid 9466] [client 79.137.67.86:52586] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adOPZkPsNnAJTnmz6saCwQAAARY"]
[Mon Apr 06 18:48:09.497885 2026] [:error] [pid 10280:tid 10294] [client 79.137.67.86:57272] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adOPaV8QUJkf8g-BFfPLwQAAAcs"]
[Mon Apr 06 18:48:12.099921 2026] [:error] [pid 38562:tid 38569] [client 79.137.67.86:57278] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adOPbKeD6Ohe6wzRuy5nKwAAAUQ"]
[Mon Apr 06 18:48:14.725091 2026] [:error] [pid 35686:tid 35696] [client 79.137.67.86:57290] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adOPbsMKdea6oORd2fzDjQAAAAA"]
[Mon Apr 06 18:48:17.313118 2026] [:error] [pid 9442:tid 9466] [client 79.137.67.86:57292] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adOPcUPsNnAJTnmz6saC3gAAARY"]
[Mon Apr 06 18:48:20.054704 2026] [:error] [pid 10280:tid 10306] [client 79.137.67.86:58894] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adOPdF8QUJkf8g-BFfPL2QAAAdc"]
[Mon Apr 06 18:48:22.504895 2026] [:error] [pid 9442:tid 9451] [client 79.137.67.86:58904] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adOPdkPsNnAJTnmz6saC7gAAAQc"]
[Mon Apr 06 18:48:25.092123 2026] [:error] [pid 1827:tid 1848] [client 79.137.67.86:58906] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adOPeeVeb6S_DnjZ2xH4HwAAAhM"]
[Mon Apr 06 18:48:27.647879 2026] [:error] [pid 38562:tid 38567] [client 79.137.67.86:58908] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adOPe6eD6Ohe6wzRuy5nRwAAAUI"]
[Mon Apr 06 18:48:30.001401 2026] [:error] [pid 38562:tid 38569] [client 79.137.67.86:42216] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adOPfqeD6Ohe6wzRuy5nTgAAAUQ"]
[Mon Apr 06 18:48:32.619664 2026] [:error] [pid 1827:tid 1848] [client 79.137.67.86:42226] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adOPgOVeb6S_DnjZ2xH4NgAAAhM"]
[Mon Apr 06 18:48:34.911826 2026] [:error] [pid 35686:tid 35703] [client 79.137.67.86:42232] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adOPgsMKdea6oORd2fzDpQAAAAc"]
[Mon Apr 06 18:48:37.360577 2026] [:error] [pid 35687:tid 35743] [client 79.137.67.86:42236] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adOPhZ3LtDozV0i8BitaxQAAAFQ"]
[Mon Apr 06 18:48:39.788448 2026] [:error] [pid 38562:tid 38586] [client 79.137.67.86:32850] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adOPh6eD6Ohe6wzRuy5nZAAAAVU"]
[Mon Apr 06 22:25:49.910018 2026] [:error] [pid 9442:tid 9459] [client 61.53.168.195:27104] [client 61.53.168.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adPCbUPsNnAJTnmz6sYzWQAAAQ8"], referer: http://www.switchcreative.net/
[Tue Apr 07 00:10:03.447518 2026] [:error] [pid 35688:tid 35771] [client 67.220.82.27:60508] [client 67.220.82.27] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adPa2-Z85qg4jLsRpQwoNwAAAJU"]
[Tue Apr 07 00:10:03.452161 2026] [core:error] [pid 35688:tid 35771] [client 67.220.82.27:60508] AH00135: Invalid method in request POSTPOST / HTTP/1.1
[Tue Apr 07 03:02:26.575548 2026] [:error] [pid 39748:tid 39766] [client 107.161.174.233:45686] [client 107.161.174.233] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adQDQigic31vPbqmSIrmtgAAAMs"]
[Tue Apr 07 03:02:27.040855 2026] [:error] [pid 39748:tid 39769] [client 107.161.174.233:45686] [client 107.161.174.233] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adQDQygic31vPbqmSIrmuAAAAM4"]
[Tue Apr 07 03:32:06.032281 2026] [:error] [pid 55003:tid 55016] [client 43.157.156.190:42094] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adQKNgiMyAbcUkWpJeBK8gAAAQk"]
[Tue Apr 07 05:18:04.790329 2026] [:error] [pid 12948:tid 12972] [client 134.199.158.247:51956] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adQjDMbeSPAN8LvMqsbvzwAAARU"]
[Tue Apr 07 05:18:04.991814 2026] [:error] [pid 12948:tid 12971] [client 134.199.158.247:40228] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adQjDMbeSPAN8LvMqsbv0QAAARQ"]
[Tue Apr 07 06:56:39.599647 2026] [:error] [pid 37596:tid 37615] [client 106.111.138.40:6000] [client 106.111.138.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adQ6J6paAOZHEjRWjP0J2wAAAAk"], referer: http://switchcreative.net/
[Tue Apr 07 07:24:33.436258 2026] [:error] [pid 37719:tid 37724] [client 134.199.158.247:54430] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adRAsU09Xv52u2xXGLBlngAAAMI"]
[Tue Apr 07 07:24:33.678307 2026] [:error] [pid 37719:tid 37735] [client 134.199.158.247:52194] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adRAsU09Xv52u2xXGLBlnwAAAM0"]
[Tue Apr 07 07:41:10.965616 2026] [:error] [pid 37719:tid 37743] [client 134.199.158.247:37662] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adRElk09Xv52u2xXGLBwOQAAANU"]
[Tue Apr 07 07:41:11.846769 2026] [:error] [pid 37596:tid 37609] [client 134.199.158.247:54438] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adREl6paAOZHEjRWjP0X7gAAAAM"]
[Tue Apr 07 08:56:04.158398 2026] [:error] [pid 37598:tid 37676] [client 43.164.196.57:39032] [client 43.164.196.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adRWJO9g7q_cV2WhPazYFQAAAI8"]
[Tue Apr 07 09:11:58.282162 2026] [:error] [pid 37719:tid 37729] [client 134.199.158.247:43998] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adRZ3k09Xv52u2xXGLCtSgAAAMc"]
[Tue Apr 07 09:12:16.636931 2026] [:error] [pid 12948:tid 12960] [client 134.199.158.247:33206] [client 134.199.158.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "adRZ8MbeSPAN8LvMqsbZFgAAAQk"]
[Tue Apr 07 10:11:25.484032 2026] [:error] [pid 37596:tid 37609] [client 43.135.133.241:59264] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adRnzapaAOZHEjRWjP1ItgAAAAM"]
[Tue Apr 07 10:55:03.567943 2026] [proxy_fcgi:error] [pid 37596:tid 37606] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:03.838019 2026] [proxy_fcgi:error] [pid 37596:tid 37611] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:04.108329 2026] [proxy_fcgi:error] [pid 37596:tid 37619] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:04.381987 2026] [proxy_fcgi:error] [pid 37596:tid 37624] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:05.948058 2026] [proxy_fcgi:error] [pid 37596:tid 37615] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:06.222601 2026] [proxy_fcgi:error] [pid 37596:tid 37629] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:06.494272 2026] [proxy_fcgi:error] [pid 37596:tid 37614] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:06.764420 2026] [proxy_fcgi:error] [pid 37596:tid 37625] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:07.035905 2026] [proxy_fcgi:error] [pid 37596:tid 37626] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:07.577537 2026] [proxy_fcgi:error] [pid 37596:tid 37608] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:07.852125 2026] [proxy_fcgi:error] [pid 37596:tid 37623] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:08.123076 2026] [proxy_fcgi:error] [pid 37596:tid 37610] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:08.395952 2026] [proxy_fcgi:error] [pid 37596:tid 37621] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:08.667763 2026] [proxy_fcgi:error] [pid 37596:tid 37612] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:08.939969 2026] [proxy_fcgi:error] [pid 37596:tid 37613] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:09.213199 2026] [proxy_fcgi:error] [pid 37596:tid 37628] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:09.484207 2026] [proxy_fcgi:error] [pid 37596:tid 37609] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:09.759394 2026] [proxy_fcgi:error] [pid 37596:tid 37624] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:10.029425 2026] [proxy_fcgi:error] [pid 37596:tid 37616] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:12.206216 2026] [proxy_fcgi:error] [pid 37596:tid 37612] [client 145.223.8.16:37374] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:13.858823 2026] [:error] [pid 37596:tid 37609] [client 145.223.8.16:37374] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adRyEapaAOZHEjRWjP1WRQAAAAM"]
[Tue Apr 07 10:55:15.141655 2026] [:error] [pid 37719:tid 37742] [client 145.223.8.16:47540] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adRyE009Xv52u2xXGLDtOAAAANQ"]
[Tue Apr 07 10:55:16.440965 2026] [proxy_fcgi:error] [pid 37597:tid 37643] [client 145.223.8.16:47552] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:17.224768 2026] [:error] [pid 37597:tid 37646] [client 145.223.8.16:47552] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adRyFQ6uAY0QAy-8EEK-ngAAAEw"]
[Tue Apr 07 10:55:18.038707 2026] [proxy_fcgi:error] [pid 12948:tid 12955] [client 145.223.8.16:47570] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:18.310876 2026] [proxy_fcgi:error] [pid 12948:tid 12963] [client 145.223.8.16:47570] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:18.876618 2026] [:error] [pid 12948:tid 12967] [client 145.223.8.16:47570] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "adRyFsbeSPAN8LvMqsY0zAAAARA"]
[Tue Apr 07 10:55:19.648645 2026] [proxy_fcgi:error] [pid 12948:tid 12959] [client 145.223.8.16:37634] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:20.953129 2026] [:error] [pid 12948:tid 12964] [client 145.223.8.16:37634] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adRyGMbeSPAN8LvMqsY01QAAAQ0"]
[Tue Apr 07 10:55:21.727202 2026] [:error] [pid 37598:tid 37663] [client 145.223.8.16:37638] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adRyGe9g7q_cV2WhPawR2AAAAII"]
[Tue Apr 07 10:55:22.240533 2026] [:error] [pid 37719:tid 37734] [client 145.223.8.16:37642] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adRyGk09Xv52u2xXGLDtWQAAAMw"]
[Tue Apr 07 10:55:22.771093 2026] [:error] [pid 37719:tid 37729] [client 145.223.8.16:37656] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adRyGk09Xv52u2xXGLDtXAAAAMc"]
[Tue Apr 07 10:55:23.305110 2026] [:error] [pid 37719:tid 37741] [client 145.223.8.16:37672] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adRyG009Xv52u2xXGLDtXwAAANM"]
[Tue Apr 07 10:55:23.842879 2026] [:error] [pid 37719:tid 37738] [client 145.223.8.16:37688] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adRyG009Xv52u2xXGLDtYgAAANA"]
[Tue Apr 07 10:55:24.603304 2026] [:error] [pid 12948:tid 12962] [client 145.223.8.16:37702] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adRyHMbeSPAN8LvMqsY06AAAAQs"]
[Tue Apr 07 10:55:25.139141 2026] [proxy_fcgi:error] [pid 37598:tid 37668] [client 145.223.8.16:37708] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:27.074301 2026] [:error] [pid 37598:tid 37672] [client 145.223.8.16:37708] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "adRyH-9g7q_cV2WhPawR4gAAAIs"]
[Tue Apr 07 10:55:27.616100 2026] [proxy_fcgi:error] [pid 12948:tid 12974] [client 145.223.8.16:37716] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:27.890219 2026] [proxy_fcgi:error] [pid 12948:tid 12958] [client 145.223.8.16:37716] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:28.155848 2026] [:error] [pid 12948:tid 12969] [client 145.223.8.16:37716] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adRyIMbeSPAN8LvMqsY08QAAARI"]
[Tue Apr 07 10:55:28.927695 2026] [:error] [pid 37719:tid 37722] [client 145.223.8.16:51938] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adRyIE09Xv52u2xXGLDtcAAAAMA"]
[Tue Apr 07 10:55:29.438922 2026] [proxy_fcgi:error] [pid 37719:tid 37740] [client 145.223.8.16:51954] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:29.692584 2026] [:error] [pid 37719:tid 37731] [client 145.223.8.16:51954] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adRyIU09Xv52u2xXGLDtcgAAAMk"]
[Tue Apr 07 10:55:30.225669 2026] [proxy_fcgi:error] [pid 37598:tid 37684] [client 145.223.8.16:51960] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:31.036592 2026] [proxy_fcgi:error] [pid 37598:tid 37682] [client 145.223.8.16:51960] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:31.842618 2026] [:error] [pid 37598:tid 37661] [client 145.223.8.16:51960] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adRyI-9g7q_cV2WhPawR9AAAAIA"]
[Tue Apr 07 10:55:32.359064 2026] [proxy_fcgi:error] [pid 37719:tid 37727] [client 145.223.8.16:51970] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:32.616300 2026] [:error] [pid 37719:tid 37729] [client 145.223.8.16:51970] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adRyJE09Xv52u2xXGLDtgwAAAMc"]
[Tue Apr 07 10:55:33.152000 2026] [proxy_fcgi:error] [pid 37719:tid 37732] [client 145.223.8.16:51976] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:33.690611 2026] [:error] [pid 37719:tid 37743] [client 145.223.8.16:51976] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "adRyJU09Xv52u2xXGLDtiQAAANU"]
[Tue Apr 07 10:55:34.239561 2026] [proxy_fcgi:error] [pid 37598:tid 37671] [client 145.223.8.16:51984] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:34.506743 2026] [:error] [pid 37598:tid 37682] [client 145.223.8.16:51984] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "adRyJu9g7q_cV2WhPawR-wAAAJU"]
[Tue Apr 07 10:55:35.316715 2026] [proxy_fcgi:error] [pid 37719:tid 37723] [client 145.223.8.16:51988] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:35.596451 2026] [proxy_fcgi:error] [pid 37719:tid 37728] [client 145.223.8.16:51988] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:36.134483 2026] [:error] [pid 37719:tid 37724] [client 145.223.8.16:51988] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adRyKE09Xv52u2xXGLDtkwAAAMI"]
[Tue Apr 07 10:55:36.910408 2026] [:error] [pid 37598:tid 37684] [client 145.223.8.16:52002] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adRyKO9g7q_cV2WhPawR_wAAAJc"]
[Tue Apr 07 10:55:37.713452 2026] [:error] [pid 37597:tid 37639] [client 145.223.8.16:52008] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "adRyKQ6uAY0QAy-8EEK-vwAAAEU"]
[Tue Apr 07 10:55:38.304230 2026] [:error] [pid 12948:tid 12972] [client 145.223.8.16:52010] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adRyKsbeSPAN8LvMqsY1BwAAARU"]
[Tue Apr 07 10:55:38.815420 2026] [:error] [pid 37597:tid 37657] [client 145.223.8.16:35104] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "adRyKg6uAY0QAy-8EEK-xAAAAFc"]
[Tue Apr 07 10:55:39.851804 2026] [proxy_fcgi:error] [pid 12948:tid 12951] [client 145.223.8.16:35108] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:40.110773 2026] [:error] [pid 12948:tid 12971] [client 145.223.8.16:35108] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "adRyLMbeSPAN8LvMqsY1EAAAARQ"]
[Tue Apr 07 10:55:40.617202 2026] [:error] [pid 37597:tid 37655] [client 145.223.8.16:35120] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "adRyLA6uAY0QAy-8EEK-yAAAAFU"]
[Tue Apr 07 10:55:41.126109 2026] [:error] [pid 37719:tid 37743] [client 145.223.8.16:35128] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "adRyLU09Xv52u2xXGLDtqAAAANU"]
[Tue Apr 07 10:55:43.750677 2026] [proxy_fcgi:error] [pid 12948:tid 12970] [client 145.223.8.16:35134] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:44.021025 2026] [proxy_fcgi:error] [pid 12948:tid 12963] [client 145.223.8.16:35134] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:44.297539 2026] [proxy_fcgi:error] [pid 12948:tid 12955] [client 145.223.8.16:35134] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:44.566479 2026] [proxy_fcgi:error] [pid 12948:tid 12964] [client 145.223.8.16:35134] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:45.370622 2026] [:error] [pid 12948:tid 12954] [client 145.223.8.16:35134] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "adRyMcbeSPAN8LvMqsY1JwAAAQM"]
[Tue Apr 07 10:55:46.720066 2026] [:error] [pid 37596:tid 37615] [client 145.223.8.16:35150] [client 145.223.8.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 145.223.8.16, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adRyMqpaAOZHEjRWjP1WfQAAAAk"]
[Tue Apr 07 10:55:46.995872 2026] [proxy_fcgi:error] [pid 37596:tid 37616] [client 145.223.8.16:35150] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:47.536298 2026] [proxy_fcgi:error] [pid 37596:tid 37629] [client 145.223.8.16:35150] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:48.351902 2026] [proxy_fcgi:error] [pid 37596:tid 37612] [client 145.223.8.16:35150] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:48.624290 2026] [proxy_fcgi:error] [pid 37596:tid 37628] [client 145.223.8.16:35150] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:49.972824 2026] [:error] [pid 37596:tid 37630] [client 145.223.8.16:35150] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adRyNapaAOZHEjRWjP1WjQAAABg"]
[Tue Apr 07 10:55:50.748160 2026] [proxy_fcgi:error] [pid 12948:tid 12952] [client 145.223.8.16:44140] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:51.003526 2026] [:error] [pid 12948:tid 12958] [client 145.223.8.16:44140] [client 145.223.8.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 145.223.8.16, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adRyN8beSPAN8LvMqsY1QgAAAQc"]
[Tue Apr 07 10:55:51.530269 2026] [:error] [pid 12948:tid 12971] [client 145.223.8.16:44140] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "adRyN8beSPAN8LvMqsY1RwAAARQ"]
[Tue Apr 07 10:55:52.300039 2026] [proxy_fcgi:error] [pid 37596:tid 37610] [client 145.223.8.16:44144] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:53.069425 2026] [proxy_fcgi:error] [pid 37596:tid 37607] [client 145.223.8.16:44144] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:53.583080 2026] [proxy_fcgi:error] [pid 37596:tid 37621] [client 145.223.8.16:44144] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:54.105149 2026] [:error] [pid 37596:tid 37619] [client 145.223.8.16:44144] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adRyOqpaAOZHEjRWjP1WnQAAAA0"]
[Tue Apr 07 10:55:54.616182 2026] [proxy_fcgi:error] [pid 37598:tid 37664] [client 145.223.8.16:44152] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:55.386867 2026] [proxy_fcgi:error] [pid 37598:tid 37665] [client 145.223.8.16:44152] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:55.898354 2026] [proxy_fcgi:error] [pid 37598:tid 37672] [client 145.223.8.16:44152] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:56.411181 2026] [proxy_fcgi:error] [pid 37598:tid 37664] [client 145.223.8.16:44152] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:56.662544 2026] [:error] [pid 37598:tid 37680] [client 145.223.8.16:44152] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adRyPO9g7q_cV2WhPawSIgAAAJM"]
[Tue Apr 07 10:55:57.198219 2026] [proxy_fcgi:error] [pid 12948:tid 12955] [client 145.223.8.16:44154] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:57.469064 2026] [proxy_fcgi:error] [pid 12948:tid 12963] [client 145.223.8.16:44154] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:57.735457 2026] [:error] [pid 12948:tid 12953] [client 145.223.8.16:44154] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adRyPcbeSPAN8LvMqsY1aAAAAQI"]
[Tue Apr 07 10:55:58.503420 2026] [proxy_fcgi:error] [pid 12948:tid 12955] [client 145.223.8.16:44156] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:55:59.023102 2026] [:error] [pid 12948:tid 12952] [client 145.223.8.16:44156] [client 145.223.8.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 145.223.8.16, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "adRyP8beSPAN8LvMqsY1bwAAAQE"]
[Tue Apr 07 10:55:59.280888 2026] [:error] [pid 12948:tid 12973] [client 145.223.8.16:44156] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adRyP8beSPAN8LvMqsY1cAAAARY"]
[Tue Apr 07 10:56:03.386005 2026] [proxy_fcgi:error] [pid 37598:tid 37685] [client 145.223.8.16:45338] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:03.929021 2026] [proxy_fcgi:error] [pid 37598:tid 37673] [client 145.223.8.16:45338] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:04.479731 2026] [proxy_fcgi:error] [pid 37598:tid 37664] [client 145.223.8.16:45338] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:05.024799 2026] [proxy_fcgi:error] [pid 37598:tid 37672] [client 145.223.8.16:45338] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:05.567669 2026] [proxy_fcgi:error] [pid 37598:tid 37684] [client 145.223.8.16:45338] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:05.834588 2026] [:error] [pid 37598:tid 37682] [client 145.223.8.16:45338] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adRyRe9g7q_cV2WhPawSPQAAAJU"]
[Tue Apr 07 10:56:06.352315 2026] [proxy_fcgi:error] [pid 12948:tid 12963] [client 145.223.8.16:45352] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:07.130042 2026] [:error] [pid 12948:tid 12970] [client 145.223.8.16:45352] [client 145.223.8.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 145.223.8.16, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adRyR8beSPAN8LvMqsY1lQAAARM"]
[Tue Apr 07 10:56:07.401832 2026] [proxy_fcgi:error] [pid 12948:tid 12975] [client 145.223.8.16:45352] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:07.662494 2026] [proxy_fcgi:error] [pid 12948:tid 12960] [client 145.223.8.16:45352] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:07.922465 2026] [proxy_fcgi:error] [pid 12948:tid 12954] [client 145.223.8.16:45352] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:08.183032 2026] [:error] [pid 12948:tid 12969] [client 145.223.8.16:45352] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "adRySMbeSPAN8LvMqsY1mgAAARI"]
[Tue Apr 07 10:56:08.695303 2026] [proxy_fcgi:error] [pid 37719:tid 37732] [client 145.223.8.16:37012] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:08.951200 2026] [:error] [pid 37719:tid 37731] [client 145.223.8.16:37012] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/infi.php"] [unique_id "adRySE09Xv52u2xXGLDuFgAAAMk"]
[Tue Apr 07 10:56:09.720867 2026] [proxy_fcgi:error] [pid 12948:tid 12959] [client 145.223.8.16:37020] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:09.974322 2026] [:error] [pid 12948:tid 12973] [client 145.223.8.16:37020] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "adRyScbeSPAN8LvMqsY1ogAAARY"]
[Tue Apr 07 10:56:10.749080 2026] [proxy_fcgi:error] [pid 37597:tid 37648] [client 145.223.8.16:37032] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:11.009046 2026] [proxy_fcgi:error] [pid 37597:tid 37656] [client 145.223.8.16:37032] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:11.264838 2026] [:error] [pid 37597:tid 37651] [client 145.223.8.16:37032] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "adRySw6uAY0QAy-8EEK--AAAAFE"]
[Tue Apr 07 10:56:11.772565 2026] [:error] [pid 37719:tid 37731] [client 145.223.8.16:37048] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "adRyS009Xv52u2xXGLDuJwAAAMk"]
[Tue Apr 07 10:56:12.299246 2026] [proxy_fcgi:error] [pid 12948:tid 12973] [client 145.223.8.16:37064] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:12.559140 2026] [proxy_fcgi:error] [pid 12948:tid 12958] [client 145.223.8.16:37064] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:13.596573 2026] [:error] [pid 12948:tid 12956] [client 145.223.8.16:37064] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adRyTcbeSPAN8LvMqsY1yQAAAQU"]
[Tue Apr 07 10:56:14.398610 2026] [:error] [pid 37719:tid 37724] [client 145.223.8.16:37066] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "adRyTk09Xv52u2xXGLDuRwAAAMI"]
[Tue Apr 07 10:56:14.909534 2026] [proxy_fcgi:error] [pid 12948:tid 12952] [client 145.223.8.16:37076] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:16.325246 2026] [:error] [pid 12948:tid 12958] [client 145.223.8.16:37076] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit.php"] [unique_id "adRyUMbeSPAN8LvMqsY11gAAAQc"]
[Tue Apr 07 10:56:16.860480 2026] [proxy_fcgi:error] [pid 12948:tid 12974] [client 145.223.8.16:37086] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:17.400749 2026] [proxy_fcgi:error] [pid 12948:tid 12971] [client 145.223.8.16:37086] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:17.673099 2026] [:error] [pid 12948:tid 12953] [client 145.223.8.16:37086] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adRyUcbeSPAN8LvMqsY15AAAAQI"]
[Tue Apr 07 10:56:18.216941 2026] [proxy_fcgi:error] [pid 12948:tid 12967] [client 145.223.8.16:37102] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:18.755057 2026] [:error] [pid 12948:tid 12966] [client 145.223.8.16:37102] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/click.php"] [unique_id "adRyUsbeSPAN8LvMqsY17wAAAQ8"]
[Tue Apr 07 10:56:19.263792 2026] [proxy_fcgi:error] [pid 37598:tid 37663] [client 145.223.8.16:42232] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:20.607305 2026] [:error] [pid 37598:tid 37678] [client 145.223.8.16:42232] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adRyVO9g7q_cV2WhPawSVQAAAJE"]
[Tue Apr 07 10:56:23.209839 2026] [proxy_fcgi:error] [pid 37597:tid 37635] [client 145.223.8.16:42244] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:23.736494 2026] [proxy_fcgi:error] [pid 37597:tid 37641] [client 145.223.8.16:42244] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:23.998184 2026] [proxy_fcgi:error] [pid 37597:tid 37648] [client 145.223.8.16:42244] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:24.522264 2026] [proxy_fcgi:error] [pid 37597:tid 37639] [client 145.223.8.16:42244] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:24.779468 2026] [:error] [pid 37597:tid 37643] [client 145.223.8.16:42244] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adRyWA6uAY0QAy-8EEK_JwAAAEk"]
[Tue Apr 07 10:56:25.289734 2026] [:error] [pid 12948:tid 12975] [client 145.223.8.16:42248] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/xl2023.php"] [unique_id "adRyWcbeSPAN8LvMqsY2BQAAARg"]
[Tue Apr 07 10:56:25.819718 2026] [:error] [pid 12948:tid 12973] [client 145.223.8.16:42258] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adRyWcbeSPAN8LvMqsY2CQAAARY"]
[Tue Apr 07 10:56:26.326206 2026] [:error] [pid 37597:tid 37640] [client 145.223.8.16:42260] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adRyWg6uAY0QAy-8EEK_KQAAAEY"]
[Tue Apr 07 10:56:26.834476 2026] [proxy_fcgi:error] [pid 37597:tid 37648] [client 145.223.8.16:42264] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:27.092353 2026] [:error] [pid 37597:tid 37638] [client 145.223.8.16:42264] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adRyWw6uAY0QAy-8EEK_LQAAAEQ"]
[Tue Apr 07 10:56:27.598918 2026] [:error] [pid 37596:tid 37615] [client 145.223.8.16:42268] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "adRyW6paAOZHEjRWjP1W0gAAAAk"]
[Tue Apr 07 10:56:28.133799 2026] [proxy_fcgi:error] [pid 12948:tid 12975] [client 145.223.8.16:42270] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:28.671294 2026] [:error] [pid 12948:tid 12962] [client 145.223.8.16:42270] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "adRyXMbeSPAN8LvMqsY2EAAAAQs"]
[Tue Apr 07 10:56:29.203584 2026] [:error] [pid 12948:tid 12971] [client 145.223.8.16:45318] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "adRyXcbeSPAN8LvMqsY2FQAAARQ"]
[Tue Apr 07 10:56:29.715372 2026] [:error] [pid 37719:tid 37723] [client 145.223.8.16:45324] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adRyXU09Xv52u2xXGLDuZQAAAME"]
[Tue Apr 07 10:56:30.247774 2026] [:error] [pid 37719:tid 37736] [client 145.223.8.16:45326] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "adRyXk09Xv52u2xXGLDuagAAAM4"]
[Tue Apr 07 10:56:31.076643 2026] [:error] [pid 37597:tid 37639] [client 145.223.8.16:45336] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adRyXw6uAY0QAy-8EEK_OQAAAEU"]
[Tue Apr 07 10:56:32.146649 2026] [:error] [pid 37597:tid 37635] [client 145.223.8.16:45346] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "adRyYA6uAY0QAy-8EEK_QwAAAEE"]
[Tue Apr 07 10:56:32.662516 2026] [proxy_fcgi:error] [pid 37597:tid 37658] [client 145.223.8.16:45348] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:33.442739 2026] [proxy_fcgi:error] [pid 37597:tid 37646] [client 145.223.8.16:45348] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:33.699440 2026] [:error] [pid 37597:tid 37655] [client 145.223.8.16:45348] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adRyYQ6uAY0QAy-8EEK_TwAAAFU"]
[Tue Apr 07 10:56:34.467481 2026] [proxy_fcgi:error] [pid 37598:tid 37676] [client 145.223.8.16:45360] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:34.725066 2026] [proxy_fcgi:error] [pid 37598:tid 37674] [client 145.223.8.16:45360] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:35.754214 2026] [proxy_fcgi:error] [pid 37598:tid 37677] [client 145.223.8.16:45360] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:36.008390 2026] [:error] [pid 37598:tid 37679] [client 145.223.8.16:45360] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "adRyZO9g7q_cV2WhPawSiwAAAJI"]
[Tue Apr 07 10:56:36.549051 2026] [proxy_fcgi:error] [pid 12948:tid 12970] [client 145.223.8.16:45362] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:37.356307 2026] [:error] [pid 12948:tid 12959] [client 145.223.8.16:45362] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adRyZcbeSPAN8LvMqsY2JwAAAQg"]
[Tue Apr 07 10:56:37.886826 2026] [:error] [pid 37597:tid 37637] [client 145.223.8.16:45366] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adRyZQ6uAY0QAy-8EEK_ZgAAAEM"]
[Tue Apr 07 10:56:39.563816 2026] [:error] [pid 37598:tid 37679] [client 145.223.8.16:45370] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adRyZ-9g7q_cV2WhPawSlgAAAJI"]
[Tue Apr 07 10:56:40.605617 2026] [proxy_fcgi:error] [pid 12948:tid 12974] [client 145.223.8.16:51472] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:40.865511 2026] [proxy_fcgi:error] [pid 12948:tid 12969] [client 145.223.8.16:51472] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:41.126167 2026] [proxy_fcgi:error] [pid 12948:tid 12968] [client 145.223.8.16:51472] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:41.388511 2026] [proxy_fcgi:error] [pid 12948:tid 12961] [client 145.223.8.16:51472] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:42.688111 2026] [:error] [pid 12948:tid 12951] [client 145.223.8.16:51472] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "adRyasbeSPAN8LvMqsY2UgAAAQA"]
[Tue Apr 07 10:56:43.200611 2026] [:error] [pid 37596:tid 37613] [client 145.223.8.16:51484] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adRya6paAOZHEjRWjP1W7AAAAAc"]
[Tue Apr 07 10:56:43.730683 2026] [:error] [pid 37596:tid 37618] [client 145.223.8.16:51490] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adRya6paAOZHEjRWjP1W7gAAAAw"]
[Tue Apr 07 10:56:44.259270 2026] [:error] [pid 37598:tid 37671] [client 145.223.8.16:51498] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adRybO9g7q_cV2WhPawS0wAAAIo"]
[Tue Apr 07 10:56:44.790930 2026] [:error] [pid 12948:tid 12974] [client 145.223.8.16:51514] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adRybMbeSPAN8LvMqsY2XwAAARc"]
[Tue Apr 07 10:56:45.322571 2026] [:error] [pid 37598:tid 37673] [client 145.223.8.16:51518] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adRybe9g7q_cV2WhPawS2QAAAIw"]
[Tue Apr 07 10:56:46.125300 2026] [:error] [pid 12948:tid 12967] [client 145.223.8.16:51522] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "adRybsbeSPAN8LvMqsY2ZgAAARA"]
[Tue Apr 07 10:56:46.656403 2026] [:error] [pid 37598:tid 37665] [client 145.223.8.16:51530] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adRybu9g7q_cV2WhPawS5QAAAIQ"]
[Tue Apr 07 10:56:47.172303 2026] [:error] [pid 12948:tid 12962] [client 145.223.8.16:51536] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adRyb8beSPAN8LvMqsY2dAAAAQs"]
[Tue Apr 07 10:56:47.682335 2026] [:error] [pid 12948:tid 12964] [client 145.223.8.16:51540] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adRyb8beSPAN8LvMqsY2dgAAAQ0"]
[Tue Apr 07 10:56:48.750365 2026] [:error] [pid 37719:tid 37724] [client 145.223.8.16:51554] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adRycE09Xv52u2xXGLDu9QAAAMI"]
[Tue Apr 07 10:56:49.551380 2026] [:error] [pid 37598:tid 37671] [client 145.223.8.16:44306] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "adRyce9g7q_cV2WhPawS9QAAAIo"]
[Tue Apr 07 10:56:50.061697 2026] [proxy_fcgi:error] [pid 12948:tid 12967] [client 145.223.8.16:44320] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:50.574671 2026] [:error] [pid 12948:tid 12964] [client 145.223.8.16:44320] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adRycsbeSPAN8LvMqsY2iAAAAQ0"]
[Tue Apr 07 10:56:51.595604 2026] [:error] [pid 37719:tid 37731] [client 145.223.8.16:44332] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "adRyc009Xv52u2xXGLDvAQAAAMk"]
[Tue Apr 07 10:56:52.131231 2026] [proxy_fcgi:error] [pid 12948:tid 12962] [client 145.223.8.16:44346] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:53.531147 2026] [proxy_fcgi:error] [pid 12948:tid 12962] [client 145.223.8.16:44346] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:54.735495 2026] [:error] [pid 12948:tid 12971] [client 145.223.8.16:44346] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adRydsbeSPAN8LvMqsY2vQAAARQ"]
[Tue Apr 07 10:56:54.804411 2026] [:error] [pid 37598:tid 37669] [client 217.216.72.68:53973] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adRydu9g7q_cV2WhPawTFwAAAIg"]
[Tue Apr 07 10:56:55.544434 2026] [proxy_fcgi:error] [pid 37719:tid 37746] [client 145.223.8.16:44362] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:55.813828 2026] [proxy_fcgi:error] [pid 37719:tid 37738] [client 145.223.8.16:44362] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:56.082639 2026] [proxy_fcgi:error] [pid 37719:tid 37730] [client 145.223.8.16:44362] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:56.346789 2026] [:error] [pid 37719:tid 37732] [client 145.223.8.16:44362] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "adRyeE09Xv52u2xXGLDvIwAAAMo"]
[Tue Apr 07 10:56:56.868105 2026] [proxy_fcgi:error] [pid 59490:tid 59492] [client 145.223.8.16:44364] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:57.121315 2026] [:error] [pid 59490:tid 59493] [client 145.223.8.16:44364] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "adRyeUcw8OFbiUZ7Rx0RtgAAAUE"]
[Tue Apr 07 10:56:58.151584 2026] [proxy_fcgi:error] [pid 37598:tid 37680] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:58.395912 2026] [:error] [pid 37597:tid 37642] [client 217.216.72.68:50280] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "adRyeg6uAY0QAy-8EEK_xwAAAEg"]
[Tue Apr 07 10:56:58.412846 2026] [proxy_fcgi:error] [pid 37598:tid 37663] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:58.536511 2026] [:error] [pid 59490:tid 59497] [client 217.216.72.68:54577] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/"] [unique_id "adRyekcw8OFbiUZ7Rx0RuAAAAUU"]
[Tue Apr 07 10:56:58.670693 2026] [proxy_fcgi:error] [pid 37598:tid 37672] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:59.187875 2026] [proxy_fcgi:error] [pid 37598:tid 37670] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:56:59.963725 2026] [proxy_fcgi:error] [pid 37598:tid 37675] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:00.223486 2026] [proxy_fcgi:error] [pid 37598:tid 37666] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:00.490617 2026] [proxy_fcgi:error] [pid 37598:tid 37667] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:00.750010 2026] [proxy_fcgi:error] [pid 37598:tid 37665] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:01.529590 2026] [proxy_fcgi:error] [pid 37598:tid 37681] [client 145.223.8.16:44372] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:01.784390 2026] [:error] [pid 37598:tid 37674] [client 145.223.8.16:44372] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adRyfe9g7q_cV2WhPawTYwAAAI0"]
[Tue Apr 07 10:57:02.288091 2026] [:error] [pid 12948:tid 12951] [client 145.223.8.16:54588] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adRyfsbeSPAN8LvMqsY2-wAAAQA"]
[Tue Apr 07 10:57:02.821736 2026] [proxy_fcgi:error] [pid 59490:tid 59506] [client 145.223.8.16:54598] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:03.090373 2026] [:error] [pid 59490:tid 59511] [client 145.223.8.16:54598] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adRyf0cw8OFbiUZ7Rx0R1AAAAVM"]
[Tue Apr 07 10:57:05.628728 2026] [proxy_fcgi:error] [pid 37597:tid 37656] [client 145.223.8.16:54608] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:05.881926 2026] [:error] [pid 37597:tid 37652] [client 145.223.8.16:54608] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adRygQ6uAY0QAy-8EEK_8wAAAFI"]
[Tue Apr 07 10:57:06.387554 2026] [:error] [pid 37719:tid 37725] [client 145.223.8.16:54616] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adRygk09Xv52u2xXGLDvdgAAAMM"]
[Tue Apr 07 10:57:07.836033 2026] [:error] [pid 37598:tid 37661] [client 217.216.72.68:56565] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adRyg-9g7q_cV2WhPawTeQAAAIA"]
[Tue Apr 07 10:57:07.938282 2026] [:error] [pid 59551:tid 59567] [client 145.223.8.16:54632] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adRyg17LN7Ubyqs-sVsfyQAAAY4"]
[Tue Apr 07 10:57:08.443253 2026] [:error] [pid 59490:tid 59493] [client 145.223.8.16:54640] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "adRyhEcw8OFbiUZ7Rx0R7gAAAUE"]
[Tue Apr 07 10:57:09.794504 2026] [proxy_fcgi:error] [pid 37719:tid 37722] [client 145.223.8.16:58052] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:10.334297 2026] [:error] [pid 37719:tid 37724] [client 145.223.8.16:58052] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adRyhk09Xv52u2xXGLDvmQAAAMI"]
[Tue Apr 07 10:57:11.150778 2026] [proxy_fcgi:error] [pid 37597:tid 37637] [client 145.223.8.16:58064] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:11.306652 2026] [:error] [pid 59551:tid 59571] [client 217.216.72.68:63666] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adRyh17LN7Ubyqs-sVsf4AAAAZI"]
[Tue Apr 07 10:57:11.687310 2026] [:error] [pid 37597:tid 37648] [client 145.223.8.16:58064] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "adRyhw6uAY0QAy-8EELABwAAAE4"]
[Tue Apr 07 10:57:12.198509 2026] [:error] [pid 59551:tid 59562] [client 145.223.8.16:58070] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugins.php"] [unique_id "adRyiF7LN7Ubyqs-sVsf5AAAAYk"]
[Tue Apr 07 10:57:13.002480 2026] [proxy_fcgi:error] [pid 37719:tid 37744] [client 145.223.8.16:58076] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:13.267719 2026] [:error] [pid 37719:tid 37738] [client 145.223.8.16:58076] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "adRyiU09Xv52u2xXGLDvrAAAANA"]
[Tue Apr 07 10:57:13.800337 2026] [:error] [pid 37719:tid 37722] [client 145.223.8.16:58080] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adRyiU09Xv52u2xXGLDvrwAAAMA"]
[Tue Apr 07 10:57:14.870349 2026] [proxy_fcgi:error] [pid 37719:tid 37735] [client 145.223.8.16:58084] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:15.141290 2026] [proxy_fcgi:error] [pid 37719:tid 37727] [client 145.223.8.16:58084] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:15.684669 2026] [proxy_fcgi:error] [pid 37719:tid 37725] [client 145.223.8.16:58084] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:16.220724 2026] [:error] [pid 37719:tid 37732] [client 145.223.8.16:58084] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/atomlib.php"] [unique_id "adRyjE09Xv52u2xXGLDv2QAAAMo"]
[Tue Apr 07 10:57:16.735164 2026] [:error] [pid 59551:tid 59562] [client 145.223.8.16:58094] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adRyjF7LN7Ubyqs-sVsf-wAAAYk"]
[Tue Apr 07 10:57:17.250515 2026] [proxy_fcgi:error] [pid 37597:tid 37654] [client 145.223.8.16:58106] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:17.510911 2026] [proxy_fcgi:error] [pid 37597:tid 37651] [client 145.223.8.16:58106] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:18.033257 2026] [proxy_fcgi:error] [pid 37597:tid 37635] [client 145.223.8.16:58106] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:18.290278 2026] [:error] [pid 37597:tid 37648] [client 145.223.8.16:58106] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "adRyjg6uAY0QAy-8EELAIQAAAE4"]
[Tue Apr 07 10:57:18.799511 2026] [:error] [pid 37719:tid 37745] [client 145.223.8.16:35852] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adRyjk09Xv52u2xXGLDwCwAAANc"]
[Tue Apr 07 10:57:19.309968 2026] [:error] [pid 59490:tid 59511] [client 145.223.8.16:35860] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adRyj0cw8OFbiUZ7Rx0SMQAAAVM"]
[Tue Apr 07 10:57:22.266945 2026] [proxy_fcgi:error] [pid 37719:tid 37746] [client 145.223.8.16:35866] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:22.532405 2026] [:error] [pid 37719:tid 37743] [client 145.223.8.16:35866] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adRykk09Xv52u2xXGLDwHwAAANU"]
[Tue Apr 07 10:57:23.331751 2026] [:error] [pid 37598:tid 37669] [client 145.223.8.16:35878] [client 145.223.8.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adRyk-9g7q_cV2WhPawTzgAAAIg"]
[Tue Apr 07 10:57:23.838947 2026] [proxy_fcgi:error] [pid 12948:tid 12967] [client 145.223.8.16:35888] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:24.095375 2026] [proxy_fcgi:error] [pid 12948:tid 12966] [client 145.223.8.16:35888] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:24.432386 2026] [:error] [pid 37597:tid 37655] [client 217.216.72.68:53634] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/"] [unique_id "adRylA6uAY0QAy-8EELAMAAAAFU"]
[Tue Apr 07 10:57:24.607680 2026] [proxy_fcgi:error] [pid 12948:tid 12957] [client 145.223.8.16:35888] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 10:57:24.859404 2026] [:error] [pid 12948:tid 12957] [client 145.223.8.16:35888] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "adRylMbeSPAN8LvMqsY3jwAAAQY"]
[Tue Apr 07 10:57:25.387120 2026] [:error] [pid 37597:tid 37635] [client 145.223.8.16:35890] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "adRylQ6uAY0QAy-8EELAMQAAAEE"]
[Tue Apr 07 10:57:25.888824 2026] [:error] [pid 12948:tid 12958] [client 145.223.8.16:35896] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "adRylcbeSPAN8LvMqsY3kQAAAQc"]
[Tue Apr 07 10:57:25.952196 2026] [:error] [pid 12948:tid 12960] [client 217.216.72.68:53607] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/readme.html"] [unique_id "adRylcbeSPAN8LvMqsY3kgAAAQk"]
[Tue Apr 07 10:57:26.419312 2026] [:error] [pid 37596:tid 37616] [client 145.223.8.16:35898] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "adRylqpaAOZHEjRWjP1XXwAAAAo"]
[Tue Apr 07 10:57:26.949893 2026] [:error] [pid 59660:tid 59685] [client 145.223.8.16:35906] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/bypass.php"] [unique_id "adRyljp3-oiX2o5bTsywxAAAAdc"]
[Tue Apr 07 10:57:29.149509 2026] [autoindex:error] [pid 37597:tid 37652] [client 145.223.8.16:35920] AH01276: Cannot serve directory /home/switchcreative/public_html/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 07 10:57:32.744113 2026] [autoindex:error] [pid 37597:tid 37642] [client 145.223.8.16:35920] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 07 10:57:33.771939 2026] [:error] [pid 37597:tid 37648] [client 145.223.8.16:35920] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "adRynQ6uAY0QAy-8EELAbQAAAE4"]
[Tue Apr 07 10:57:34.273999 2026] [:error] [pid 12948:tid 12952] [client 145.223.8.16:54902] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "adRynsbeSPAN8LvMqsY3vQAAAQE"]
[Tue Apr 07 10:57:34.804254 2026] [:error] [pid 12948:tid 12953] [client 145.223.8.16:54908] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "adRynsbeSPAN8LvMqsY3vgAAAQI"]
[Tue Apr 07 10:57:35.332880 2026] [:error] [pid 59660:tid 59677] [client 145.223.8.16:54920] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "adRynzp3-oiX2o5bTsyw5QAAAc8"]
[Tue Apr 07 10:57:35.844259 2026] [:error] [pid 37598:tid 37661] [client 145.223.8.16:54934] [client 145.223.8.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "adRyn-9g7q_cV2WhPawULwAAAIA"]
[Tue Apr 07 10:57:36.045510 2026] [:error] [pid 59660:tid 59675] [client 217.216.72.68:60302] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adRyoDp3-oiX2o5bTsyw6wAAAc0"]
[Tue Apr 07 15:17:15.907803 2026] [:error] [pid 59551:tid 59553] [client 43.153.26.165:58938] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adSve17LN7Ubyqs-sVuCpAAAAYA"]
[Tue Apr 07 15:58:50.780128 2026] [:error] [pid 59551:tid 59577] [client 88.147.152.63:1568] [client 88.147.152.63] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adS5Ol7LN7Ubyqs-sVuP8QAAAZg"]
[Tue Apr 07 15:58:50.780354 2026] [:error] [pid 59551:tid 59577] [client 88.147.152.63:1568] [client 88.147.152.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adS5Ol7LN7Ubyqs-sVuP8QAAAZg"]
[Tue Apr 07 16:23:55.622590 2026] [:error] [pid 12948:tid 12951] [client 43.163.118.136:60238] [client 43.163.118.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adS_G8beSPAN8LvMqsZ3DgAAAQA"]
[Tue Apr 07 19:51:19.100946 2026] [proxy_fcgi:error] [pid 59660:tid 59674] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:19.398685 2026] [proxy_fcgi:error] [pid 59660:tid 59663] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:19.681849 2026] [proxy_fcgi:error] [pid 59660:tid 59672] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:20.008982 2026] [proxy_fcgi:error] [pid 59660:tid 59669] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:20.424212 2026] [proxy_fcgi:error] [pid 59660:tid 59685] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:20.683503 2026] [proxy_fcgi:error] [pid 59660:tid 59675] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:20.941905 2026] [proxy_fcgi:error] [pid 59660:tid 59678] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:21.327361 2026] [proxy_fcgi:error] [pid 59660:tid 59686] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:21.641459 2026] [proxy_fcgi:error] [pid 59660:tid 59673] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:21.919728 2026] [proxy_fcgi:error] [pid 59660:tid 59682] [client 20.215.51.202:49765] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:51:22.205764 2026] [:error] [pid 59660:tid 59677] [client 20.215.51.202:49765] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "adTvujp3-oiX2o5bTswOMgAAAc8"]
[Tue Apr 07 19:51:22.967112 2026] [:error] [pid 59804:tid 59816] [client 20.215.51.202:49169] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "adTvunYVIXiPh5_eJTmehQAAAgo"]
[Tue Apr 07 19:51:23.678381 2026] [:error] [pid 37598:tid 37671] [client 20.215.51.202:34675] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "adTvu-9g7q_cV2WhPaywCAAAAIo"]
[Tue Apr 07 19:51:24.315361 2026] [:error] [pid 37596:tid 37607] [client 20.215.51.202:56189] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "adTvvKpaAOZHEjRWjP2Y7AAAAAE"]
[Tue Apr 07 19:51:25.126758 2026] [:error] [pid 37719:tid 37730] [client 20.215.51.202:51018] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adTvvU09Xv52u2xXGLAJXgAAAMg"]
[Tue Apr 07 19:51:25.724030 2026] [:error] [pid 59804:tid 59814] [client 20.215.51.202:51028] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adTvvXYVIXiPh5_eJTmeiAAAAgg"]
[Tue Apr 07 19:51:26.490600 2026] [:error] [pid 37719:tid 37745] [client 20.215.51.202:34647] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adTvvk09Xv52u2xXGLAJYAAAANc"]
[Tue Apr 07 19:51:27.357325 2026] [:error] [pid 59490:tid 59513] [client 20.215.51.202:34648] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adTvv0cw8OFbiUZ7Rx1k1gAAAVU"]
[Tue Apr 07 19:51:27.987210 2026] [:error] [pid 37597:tid 37644] [client 20.215.51.202:49173] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "adTvvw6uAY0QAy-8EEJgYgAAAEo"]
[Tue Apr 07 19:51:28.677205 2026] [:error] [pid 37596:tid 37610] [client 20.215.51.202:47300] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "adTvwKpaAOZHEjRWjP2Y8QAAAAQ"]
[Tue Apr 07 19:51:29.556231 2026] [:error] [pid 12948:tid 12952] [client 20.215.51.202:56134] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "adTvwcbeSPAN8LvMqsan4wAAAQE"]
[Tue Apr 07 19:51:30.416465 2026] [:error] [pid 37598:tid 37672] [client 20.215.51.202:49199] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "adTvwu9g7q_cV2WhPaywEwAAAIs"]
[Tue Apr 07 19:51:31.072710 2026] [:error] [pid 59490:tid 59503] [client 20.215.51.202:56169] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "adTvw0cw8OFbiUZ7Rx1k2AAAAUs"]
[Tue Apr 07 19:52:24.243596 2026] [proxy_fcgi:error] [pid 59804:tid 59823] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:24.569767 2026] [proxy_fcgi:error] [pid 59804:tid 59820] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:24.828284 2026] [proxy_fcgi:error] [pid 59804:tid 59808] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:25.221960 2026] [proxy_fcgi:error] [pid 59804:tid 59819] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:25.528318 2026] [proxy_fcgi:error] [pid 59804:tid 59829] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:25.837883 2026] [proxy_fcgi:error] [pid 59804:tid 59830] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:26.111073 2026] [proxy_fcgi:error] [pid 59804:tid 59813] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:26.407331 2026] [proxy_fcgi:error] [pid 59804:tid 59827] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:26.665966 2026] [proxy_fcgi:error] [pid 59804:tid 59821] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:26.939379 2026] [proxy_fcgi:error] [pid 59804:tid 59826] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:27.378248 2026] [proxy_fcgi:error] [pid 59804:tid 59815] [client 20.215.51.202:34629] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:52:27.704386 2026] [:error] [pid 59804:tid 59824] [client 20.215.51.202:34629] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adTv-3YVIXiPh5_eJTme3wAAAhI"]
[Tue Apr 07 19:52:28.412677 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:56166] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adTv_A6uAY0QAy-8EEJgqAAAAFA"]
[Tue Apr 07 19:52:29.153862 2026] [:error] [pid 37597:tid 37635] [client 20.215.51.202:51067] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adTv_Q6uAY0QAy-8EEJgqwAAAEE"]
[Tue Apr 07 19:52:29.823478 2026] [:error] [pid 59804:tid 59810] [client 20.215.51.202:51050] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adTv_XYVIXiPh5_eJTme4gAAAgQ"]
[Tue Apr 07 19:52:30.846168 2026] [:error] [pid 59660:tid 59674] [client 20.215.51.202:47313] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "adTv_jp3-oiX2o5bTswOcgAAAcw"]
[Tue Apr 07 19:52:31.478385 2026] [:error] [pid 37597:tid 37649] [client 20.215.51.202:49729] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "adTv_w6uAY0QAy-8EEJgsQAAAE8"]
[Tue Apr 07 19:52:32.173778 2026] [:error] [pid 59660:tid 59670] [client 20.215.51.202:47331] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "adTwADp3-oiX2o5bTswOdAAAAcg"]
[Tue Apr 07 19:52:32.881640 2026] [:error] [pid 37719:tid 37729] [client 20.215.51.202:46606] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file31.php"] [unique_id "adTwAE09Xv52u2xXGLAJlAAAAMc"]
[Tue Apr 07 19:52:33.648462 2026] [:error] [pid 59551:tid 59574] [client 20.215.51.202:51040] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adTwAV7LN7Ubyqs-sVv8DgAAAZU"]
[Tue Apr 07 19:52:34.299556 2026] [:error] [pid 37719:tid 37736] [client 20.215.51.202:51064] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adTwAk09Xv52u2xXGLAJnAAAAM4"]
[Tue Apr 07 19:52:34.954779 2026] [:error] [pid 37598:tid 37663] [client 20.215.51.202:47297] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adTwAu9g7q_cV2WhPaywPwAAAII"]
[Tue Apr 07 19:52:35.590410 2026] [:error] [pid 59551:tid 59564] [client 20.215.51.202:47325] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adTwA17LN7Ubyqs-sVv8EgAAAYs"]
[Tue Apr 07 19:52:36.533502 2026] [:error] [pid 37598:tid 37679] [client 20.215.51.202:51051] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "adTwBO9g7q_cV2WhPaywQwAAAJI"]
[Tue Apr 07 19:52:37.181545 2026] [:error] [pid 37598:tid 37666] [client 20.215.51.202:47332] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "adTwBe9g7q_cV2WhPaywRQAAAIU"]
[Tue Apr 07 19:52:38.002901 2026] [:error] [pid 37719:tid 37741] [client 20.215.51.202:49211] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "adTwBk09Xv52u2xXGLAJpgAAANM"]
[Tue Apr 07 19:52:38.691624 2026] [:error] [pid 37719:tid 37736] [client 20.215.51.202:47339] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/control.php"] [unique_id "adTwBk09Xv52u2xXGLAJqwAAAM4"]
[Tue Apr 07 19:52:39.453898 2026] [:error] [pid 37598:tid 37664] [client 20.215.51.202:56163] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "adTwB-9g7q_cV2WhPaywSQAAAIM"]
[Tue Apr 07 19:52:40.043691 2026] [:error] [pid 59660:tid 59675] [client 20.215.51.202:56149] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "adTwCDp3-oiX2o5bTswOeQAAAc0"]
[Tue Apr 07 19:52:40.648404 2026] [:error] [pid 59490:tid 59504] [client 20.215.51.202:47319] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "adTwCEcw8OFbiUZ7Rx1k8AAAAUw"]
[Tue Apr 07 19:52:41.284813 2026] [:error] [pid 59660:tid 59665] [client 20.215.51.202:51015] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "adTwCTp3-oiX2o5bTswOfwAAAcM"]
[Tue Apr 07 19:52:41.831113 2026] [:error] [pid 59660:tid 59667] [client 20.215.51.202:47341] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adTwCTp3-oiX2o5bTswOggAAAcU"]
[Tue Apr 07 19:52:42.505410 2026] [:error] [pid 59551:tid 59553] [client 20.215.51.202:46641] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adTwCl7LN7Ubyqs-sVv8GQAAAYA"]
[Tue Apr 07 19:52:43.118251 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:49781] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adTwCw6uAY0QAy-8EEJg0wAAAFA"]
[Tue Apr 07 19:52:43.879800 2026] [:error] [pid 59660:tid 59669] [client 20.215.51.202:54576] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adTwCzp3-oiX2o5bTswOhAAAAcc"]
[Tue Apr 07 19:52:44.432853 2026] [:error] [pid 59490:tid 59501] [client 20.215.51.202:47306] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adTwDEcw8OFbiUZ7Rx1lAwAAAUk"]
[Tue Apr 07 19:52:45.027558 2026] [:error] [pid 12948:tid 12955] [client 20.215.51.202:49774] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adTwDcbeSPAN8LvMqsaoHAAAAQQ"]
[Tue Apr 07 19:52:45.643398 2026] [:error] [pid 37596:tid 37612] [client 20.215.51.202:51010] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adTwDapaAOZHEjRWjP2ZEAAAAAY"]
[Tue Apr 07 19:52:46.263613 2026] [:error] [pid 37597:tid 37653] [client 20.215.51.202:56157] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adTwDg6uAY0QAy-8EEJg5QAAAFM"]
[Tue Apr 07 19:52:46.910779 2026] [:error] [pid 59490:tid 59496] [client 20.215.51.202:56146] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adTwDkcw8OFbiUZ7Rx1lDwAAAUQ"]
[Tue Apr 07 19:52:47.497185 2026] [:error] [pid 12948:tid 12954] [client 20.215.51.202:49769] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adTwD8beSPAN8LvMqsaoKQAAAQM"]
[Tue Apr 07 19:52:48.058702 2026] [:error] [pid 59490:tid 59515] [client 20.215.51.202:56144] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adTwEEcw8OFbiUZ7Rx1lFQAAAVc"]
[Tue Apr 07 19:52:48.709273 2026] [:error] [pid 59804:tid 59829] [client 20.215.51.202:43567] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adTwEHYVIXiPh5_eJTme7gAAAhc"]
[Tue Apr 07 19:52:49.906568 2026] [:error] [pid 59490:tid 59509] [client 20.215.51.202:54544] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "adTwEUcw8OFbiUZ7Rx1lHAAAAVE"]
[Tue Apr 07 19:52:50.561678 2026] [:error] [pid 37596:tid 37620] [client 20.215.51.202:51037] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "adTwEqpaAOZHEjRWjP2ZEwAAAA4"]
[Tue Apr 07 19:52:51.293394 2026] [:error] [pid 59551:tid 59568] [client 20.215.51.202:54571] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "adTwE17LN7Ubyqs-sVv8LQAAAY8"]
[Tue Apr 07 19:52:51.869090 2026] [:error] [pid 59804:tid 59821] [client 20.215.51.202:34670] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "adTwE3YVIXiPh5_eJTme8gAAAg8"]
[Tue Apr 07 19:52:52.551783 2026] [:error] [pid 37597:tid 37636] [client 20.215.51.202:34635] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "adTwFA6uAY0QAy-8EEJg8QAAAEI"]
[Tue Apr 07 19:52:53.328122 2026] [:error] [pid 59804:tid 59814] [client 20.215.51.202:56151] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "adTwFXYVIXiPh5_eJTme9QAAAgg"]
[Tue Apr 07 19:52:54.074182 2026] [:error] [pid 59490:tid 59510] [client 20.215.51.202:54549] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "adTwFkcw8OFbiUZ7Rx1lJAAAAVI"]
[Tue Apr 07 19:52:55.342988 2026] [:error] [pid 37597:tid 37656] [client 20.215.51.202:54587] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "adTwFw6uAY0QAy-8EEJg9QAAAFY"]
[Tue Apr 07 19:52:55.954120 2026] [:error] [pid 59660:tid 59681] [client 20.215.51.202:56155] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "adTwFzp3-oiX2o5bTswOigAAAdM"]
[Tue Apr 07 19:52:56.552264 2026] [:error] [pid 59551:tid 59575] [client 20.215.51.202:51026] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "adTwGF7LN7Ubyqs-sVv8LgAAAZY"]
[Tue Apr 07 19:52:57.264074 2026] [:error] [pid 59551:tid 59572] [client 20.215.51.202:54581] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "adTwGV7LN7Ubyqs-sVv8MgAAAZM"]
[Tue Apr 07 19:52:57.851350 2026] [:error] [pid 59551:tid 59559] [client 20.215.51.202:49733] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "adTwGV7LN7Ubyqs-sVv8NgAAAYY"]
[Tue Apr 07 19:52:58.391414 2026] [:error] [pid 59551:tid 59562] [client 20.215.51.202:56150] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "adTwGl7LN7Ubyqs-sVv8OgAAAYk"]
[Tue Apr 07 19:52:59.011636 2026] [:error] [pid 12948:tid 12971] [client 20.215.51.202:34624] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "adTwG8beSPAN8LvMqsaoMAAAARQ"]
[Tue Apr 07 19:52:59.650116 2026] [:error] [pid 59551:tid 59577] [client 20.215.51.202:49746] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "adTwG17LN7Ubyqs-sVv8QAAAAZg"]
[Tue Apr 07 19:53:00.499572 2026] [:error] [pid 59551:tid 59572] [client 20.215.51.202:54534] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "adTwHF7LN7Ubyqs-sVv8QwAAAZM"]
[Tue Apr 07 19:53:01.156856 2026] [:error] [pid 59660:tid 59670] [client 20.215.51.202:54545] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "adTwHTp3-oiX2o5bTswOjQAAAcg"]
[Tue Apr 07 19:53:01.805330 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:51066] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "adTwHQ6uAY0QAy-8EEJhAQAAAFA"]
[Tue Apr 07 19:53:02.423112 2026] [:error] [pid 59551:tid 59569] [client 20.215.51.202:34677] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "adTwHl7LN7Ubyqs-sVv8SQAAAZA"]
[Tue Apr 07 19:53:03.342217 2026] [:error] [pid 59551:tid 59564] [client 20.215.51.202:51020] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "adTwH17LN7Ubyqs-sVv8SwAAAYs"]
[Tue Apr 07 19:53:04.135530 2026] [:error] [pid 12948:tid 12973] [client 20.215.51.202:54528] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "adTwIMbeSPAN8LvMqsaoNQAAARY"]
[Tue Apr 07 19:53:04.964447 2026] [:error] [pid 37719:tid 37731] [client 20.215.51.202:46631] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "adTwIE09Xv52u2xXGLAJvwAAAMk"]
[Tue Apr 07 19:53:06.703450 2026] [:error] [pid 59551:tid 59570] [client 20.215.51.202:49177] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "adTwIl7LN7Ubyqs-sVv8TQAAAZE"]
[Tue Apr 07 19:53:07.825549 2026] [:error] [pid 37597:tid 37645] [client 20.215.51.202:34664] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "adTwIw6uAY0QAy-8EEJhCwAAAEs"]
[Tue Apr 07 19:53:08.672992 2026] [:error] [pid 59490:tid 59497] [client 20.215.51.202:49752] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/read.php"] [unique_id "adTwJEcw8OFbiUZ7Rx1lMAAAAUU"]
[Tue Apr 07 19:53:09.248600 2026] [:error] [pid 59551:tid 59564] [client 20.215.51.202:47329] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/read.php"] [unique_id "adTwJV7LN7Ubyqs-sVv8TwAAAYs"]
[Tue Apr 07 19:53:09.970650 2026] [:error] [pid 59551:tid 59573] [client 20.215.51.202:43570] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/read.php"] [unique_id "adTwJV7LN7Ubyqs-sVv8UAAAAZQ"]
[Tue Apr 07 19:53:10.802262 2026] [:error] [pid 59551:tid 59568] [client 20.215.51.202:49196] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/read.php"] [unique_id "adTwJl7LN7Ubyqs-sVv8UQAAAY8"]
[Tue Apr 07 19:53:11.483682 2026] [:error] [pid 59551:tid 59566] [client 20.215.51.202:49189] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTwJ17LN7Ubyqs-sVv8UwAAAY0"]
[Tue Apr 07 19:53:12.296061 2026] [:error] [pid 59551:tid 59565] [client 20.215.51.202:54559] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTwKF7LN7Ubyqs-sVv8WwAAAYw"]
[Tue Apr 07 19:53:13.067081 2026] [:error] [pid 37597:tid 37638] [client 20.215.51.202:47337] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTwKQ6uAY0QAy-8EEJhIgAAAEQ"]
[Tue Apr 07 19:53:13.829757 2026] [:error] [pid 37597:tid 37645] [client 20.215.51.202:46593] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "adTwKQ6uAY0QAy-8EEJhKAAAAEs"]
[Tue Apr 07 19:53:15.366525 2026] [:error] [pid 59551:tid 59574] [client 20.215.51.202:43566] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "adTwK17LN7Ubyqs-sVv8XgAAAZU"]
[Tue Apr 07 19:53:15.926762 2026] [:error] [pid 37597:tid 37643] [client 20.215.51.202:34683] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "adTwKw6uAY0QAy-8EEJhNgAAAEk"]
[Tue Apr 07 19:53:16.508448 2026] [:error] [pid 59490:tid 59500] [client 20.215.51.202:49174] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "adTwLEcw8OFbiUZ7Rx1lMQAAAUg"]
[Tue Apr 07 19:53:17.032861 2026] [:error] [pid 37597:tid 37658] [client 20.215.51.202:47341] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "adTwLQ6uAY0QAy-8EEJhPwAAAFg"]
[Tue Apr 07 19:53:17.584052 2026] [:error] [pid 37719:tid 37741] [client 20.215.51.202:49164] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "adTwLU09Xv52u2xXGLAJzwAAANM"]
[Tue Apr 07 19:53:18.246252 2026] [:error] [pid 37597:tid 37643] [client 20.215.51.202:49745] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "adTwLg6uAY0QAy-8EEJhRwAAAEk"]
[Tue Apr 07 19:53:18.931052 2026] [:error] [pid 37719:tid 37734] [client 20.215.51.202:34627] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "adTwLk09Xv52u2xXGLAJ0gAAAMw"]
[Tue Apr 07 19:53:19.506586 2026] [:error] [pid 59660:tid 59668] [client 20.215.51.202:47343] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "adTwLzp3-oiX2o5bTswOmAAAAcY"]
[Tue Apr 07 19:53:20.272601 2026] [:error] [pid 37719:tid 37726] [client 20.215.51.202:51055] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "adTwME09Xv52u2xXGLAJ2QAAAMQ"]
[Tue Apr 07 19:53:20.919361 2026] [:error] [pid 37719:tid 37732] [client 20.215.51.202:49156] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "adTwME09Xv52u2xXGLAJ4AAAAMo"]
[Tue Apr 07 19:53:21.608862 2026] [:error] [pid 37719:tid 37724] [client 20.215.51.202:46630] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "adTwMU09Xv52u2xXGLAJ5QAAAMI"]
[Tue Apr 07 19:53:22.473967 2026] [:error] [pid 59551:tid 59575] [client 20.215.51.202:34646] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "adTwMl7LN7Ubyqs-sVv8YwAAAZY"]
[Tue Apr 07 19:53:23.067302 2026] [:error] [pid 37598:tid 37670] [client 20.215.51.202:54565] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mter.php"] [unique_id "adTwM-9g7q_cV2WhPaywYwAAAIk"]
[Tue Apr 07 19:53:23.641727 2026] [:error] [pid 59804:tid 59820] [client 20.215.51.202:49735] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mter.php"] [unique_id "adTwM3YVIXiPh5_eJTmfAgAAAg4"]
[Tue Apr 07 19:53:24.298655 2026] [:error] [pid 37719:tid 37732] [client 20.215.51.202:47359] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mter.php"] [unique_id "adTwNE09Xv52u2xXGLAJ7wAAAMo"]
[Tue Apr 07 19:53:25.042785 2026] [:error] [pid 37719:tid 37729] [client 20.215.51.202:51048] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mter.php"] [unique_id "adTwNU09Xv52u2xXGLAJ9AAAAMc"]
[Tue Apr 07 19:53:25.651215 2026] [:error] [pid 59490:tid 59509] [client 20.215.51.202:49758] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adTwNUcw8OFbiUZ7Rx1lNAAAAVE"]
[Tue Apr 07 19:53:26.272395 2026] [:error] [pid 37598:tid 37684] [client 20.215.51.202:49770] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adTwNu9g7q_cV2WhPaywbAAAAJc"]
[Tue Apr 07 19:53:26.932832 2026] [:error] [pid 37719:tid 37739] [client 20.215.51.202:34632] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adTwNk09Xv52u2xXGLAJ-gAAANE"]
[Tue Apr 07 19:53:27.574521 2026] [proxy_fcgi:error] [pid 37719:tid 37729] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:27.833701 2026] [proxy_fcgi:error] [pid 37719:tid 37726] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:28.094293 2026] [proxy_fcgi:error] [pid 37719:tid 37725] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:28.411282 2026] [proxy_fcgi:error] [pid 37719:tid 37742] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:28.687994 2026] [proxy_fcgi:error] [pid 37719:tid 37722] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:29.002941 2026] [proxy_fcgi:error] [pid 37719:tid 37743] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:29.261524 2026] [proxy_fcgi:error] [pid 37719:tid 37731] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:29.530069 2026] [proxy_fcgi:error] [pid 37719:tid 37739] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:29.812282 2026] [proxy_fcgi:error] [pid 37719:tid 37745] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:30.111527 2026] [proxy_fcgi:error] [pid 37719:tid 37740] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:30.371791 2026] [proxy_fcgi:error] [pid 37719:tid 37724] [client 20.215.51.202:34661] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:53:30.682808 2026] [:error] [pid 37719:tid 37746] [client 20.215.51.202:34661] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adTwOk09Xv52u2xXGLAKCwAAANg"]
[Tue Apr 07 19:53:31.261824 2026] [:error] [pid 37597:tid 37656] [client 20.215.51.202:34665] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adTwOw6uAY0QAy-8EEJhTQAAAFY"]
[Tue Apr 07 19:53:32.180763 2026] [:error] [pid 37597:tid 37658] [client 20.215.51.202:56159] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adTwPA6uAY0QAy-8EEJhUwAAAFg"]
[Tue Apr 07 19:53:32.876195 2026] [:error] [pid 37598:tid 37664] [client 20.215.51.202:51044] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adTwPO9g7q_cV2WhPaywcQAAAIM"]
[Tue Apr 07 19:53:33.419607 2026] [:error] [pid 12948:tid 12974] [client 20.215.51.202:56190] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adTwPcbeSPAN8LvMqsaoTgAAARc"]
[Tue Apr 07 19:53:34.473890 2026] [:error] [pid 37596:tid 37624] [client 20.215.51.202:49161] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adTwPqpaAOZHEjRWjP2ZJQAAABI"]
[Tue Apr 07 19:53:35.086926 2026] [:error] [pid 37719:tid 37725] [client 20.215.51.202:51038] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adTwP009Xv52u2xXGLAKDgAAAMM"]
[Tue Apr 07 19:53:35.654713 2026] [:error] [pid 59490:tid 59515] [client 20.215.51.202:46617] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adTwP0cw8OFbiUZ7Rx1lQAAAAVc"]
[Tue Apr 07 19:53:36.259050 2026] [:error] [pid 12948:tid 12959] [client 20.215.51.202:34666] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adTwQMbeSPAN8LvMqsaoUwAAAQg"]
[Tue Apr 07 19:53:37.641278 2026] [:error] [pid 59551:tid 59565] [client 20.215.51.202:43554] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adTwQV7LN7Ubyqs-sVv8bQAAAYw"]
[Tue Apr 07 19:53:38.292952 2026] [:error] [pid 59551:tid 59561] [client 20.215.51.202:44684] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adTwQl7LN7Ubyqs-sVv8cAAAAYg"]
[Tue Apr 07 19:53:38.973691 2026] [:error] [pid 59551:tid 59557] [client 20.215.51.202:47352] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adTwQl7LN7Ubyqs-sVv8cQAAAYQ"]
[Tue Apr 07 19:53:39.863616 2026] [:error] [pid 59490:tid 59514] [client 20.215.51.202:49759] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adTwQ0cw8OFbiUZ7Rx1lQwAAAVY"]
[Tue Apr 07 19:53:40.571276 2026] [:error] [pid 59551:tid 59562] [client 20.215.51.202:37600] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adTwRF7LN7Ubyqs-sVv8dAAAAYk"]
[Tue Apr 07 19:53:41.118407 2026] [:error] [pid 59551:tid 59558] [client 20.215.51.202:34678] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adTwRV7LN7Ubyqs-sVv8dQAAAYU"]
[Tue Apr 07 19:53:41.703704 2026] [:error] [pid 37598:tid 37668] [client 20.215.51.202:34628] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adTwRe9g7q_cV2WhPaywiwAAAIc"]
[Tue Apr 07 19:53:42.417957 2026] [:error] [pid 37719:tid 37734] [client 20.215.51.202:37532] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adTwRk09Xv52u2xXGLAKEAAAAMw"]
[Tue Apr 07 19:53:43.283593 2026] [:error] [pid 37719:tid 37741] [client 20.215.51.202:49734] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adTwR009Xv52u2xXGLAKEgAAANM"]
[Tue Apr 07 19:53:43.991503 2026] [:error] [pid 37598:tid 37661] [client 20.215.51.202:46642] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adTwR-9g7q_cV2WhPaywswAAAIA"]
[Tue Apr 07 19:53:44.681179 2026] [:error] [pid 37598:tid 37666] [client 20.215.51.202:47312] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adTwSO9g7q_cV2WhPaywtwAAAIU"]
[Tue Apr 07 19:53:46.478385 2026] [:error] [pid 59551:tid 59562] [client 20.215.51.202:46627] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adTwSl7LN7Ubyqs-sVv8fQAAAYk"]
[Tue Apr 07 19:53:47.341589 2026] [:error] [pid 59551:tid 59554] [client 20.215.51.202:44714] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adTwS17LN7Ubyqs-sVv8gQAAAYE"]
[Tue Apr 07 19:53:48.065772 2026] [:error] [pid 59804:tid 59819] [client 20.215.51.202:54588] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adTwTHYVIXiPh5_eJTmfDwAAAg0"]
[Tue Apr 07 19:53:48.939641 2026] [:error] [pid 12948:tid 12969] [client 20.215.51.202:50396] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adTwTMbeSPAN8LvMqsaoZAAAARI"]
[Tue Apr 07 19:53:50.710087 2026] [:error] [pid 59804:tid 59829] [client 20.215.51.202:54530] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "adTwTnYVIXiPh5_eJTmfEwAAAhc"]
[Tue Apr 07 19:53:51.495816 2026] [:error] [pid 59551:tid 59561] [client 20.215.51.202:54538] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "adTwT17LN7Ubyqs-sVv8hQAAAYg"]
[Tue Apr 07 19:53:52.601404 2026] [:error] [pid 37597:tid 37656] [client 20.215.51.202:51057] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "adTwUA6uAY0QAy-8EEJhdAAAAFY"]
[Tue Apr 07 19:53:53.178588 2026] [:error] [pid 12948:tid 12956] [client 20.215.51.202:49158] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "adTwUcbeSPAN8LvMqsaoaQAAAQU"]
[Tue Apr 07 19:53:53.747206 2026] [:error] [pid 12948:tid 12962] [client 20.215.51.202:43562] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "adTwUcbeSPAN8LvMqsaoawAAAQs"]
[Tue Apr 07 19:53:54.428949 2026] [:error] [pid 59551:tid 59568] [client 20.215.51.202:49789] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "adTwUl7LN7Ubyqs-sVv8jAAAAY8"]
[Tue Apr 07 19:53:55.086175 2026] [:error] [pid 59551:tid 59558] [client 20.215.51.202:49193] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "adTwU17LN7Ubyqs-sVv8jgAAAYU"]
[Tue Apr 07 19:53:55.761107 2026] [:error] [pid 37719:tid 37743] [client 20.215.51.202:1082] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "adTwU009Xv52u2xXGLAKaAAAANU"]
[Tue Apr 07 19:53:56.287210 2026] [:error] [pid 37596:tid 37619] [client 20.215.51.202:47303] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adTwVKpaAOZHEjRWjP2ZLgAAAA0"]
[Tue Apr 07 19:53:56.988662 2026] [:error] [pid 59660:tid 59669] [client 20.215.51.202:54554] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adTwVDp3-oiX2o5bTswOtgAAAcc"]
[Tue Apr 07 19:53:57.956301 2026] [:error] [pid 12948:tid 12961] [client 20.215.51.202:54579] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adTwVcbeSPAN8LvMqsaobwAAAQo"]
[Tue Apr 07 19:53:58.839154 2026] [:error] [pid 59490:tid 59498] [client 20.215.51.202:49166] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adTwVkcw8OFbiUZ7Rx1laAAAAUY"]
[Tue Apr 07 19:53:59.664492 2026] [:error] [pid 59551:tid 59569] [client 20.215.51.202:41847] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adTwV17LN7Ubyqs-sVv8lgAAAZA"]
[Tue Apr 07 19:54:00.371668 2026] [:error] [pid 37719:tid 37736] [client 20.215.51.202:44733] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adTwWE09Xv52u2xXGLAKcQAAAM4"]
[Tue Apr 07 19:54:01.083547 2026] [:error] [pid 37719:tid 37730] [client 20.215.51.202:47308] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adTwWU09Xv52u2xXGLAKcwAAAMg"]
[Tue Apr 07 19:54:01.677535 2026] [:error] [pid 37597:tid 37639] [client 20.215.51.202:47309] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adTwWQ6uAY0QAy-8EEJhiwAAAEU"]
[Tue Apr 07 19:54:02.290563 2026] [:error] [pid 37597:tid 37649] [client 20.215.51.202:51059] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "adTwWg6uAY0QAy-8EEJhkgAAAE8"]
[Tue Apr 07 19:54:02.862582 2026] [:error] [pid 37596:tid 37621] [client 20.215.51.202:54537] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "adTwWqpaAOZHEjRWjP2ZNQAAAA8"]
[Tue Apr 07 19:54:03.465642 2026] [:error] [pid 37597:tid 37639] [client 20.215.51.202:49782] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "adTwWw6uAY0QAy-8EEJhmwAAAEU"]
[Tue Apr 07 19:54:04.189954 2026] [:error] [pid 37719:tid 37741] [client 20.215.51.202:34679] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "adTwXE09Xv52u2xXGLAKeQAAANM"]
[Tue Apr 07 19:54:04.975403 2026] [:error] [pid 37597:tid 37657] [client 20.215.51.202:34631] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwXA6uAY0QAy-8EEJhnwAAAFc"]
[Tue Apr 07 19:54:05.625906 2026] [:error] [pid 59551:tid 59561] [client 20.215.51.202:50373] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwXV7LN7Ubyqs-sVv8mwAAAYg"]
[Tue Apr 07 19:54:06.275603 2026] [:error] [pid 37598:tid 37669] [client 20.215.51.202:54535] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwXu9g7q_cV2WhPayw0wAAAIg"]
[Tue Apr 07 19:54:06.996112 2026] [:error] [pid 37597:tid 37654] [client 20.215.51.202:43578] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwXg6uAY0QAy-8EEJhqAAAAFQ"]
[Tue Apr 07 19:54:08.094717 2026] [:error] [pid 37719:tid 37740] [client 20.215.51.202:41850] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTwYE09Xv52u2xXGLAKfwAAANI"]
[Tue Apr 07 19:54:09.024252 2026] [:error] [pid 59804:tid 59807] [client 20.215.51.202:34680] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTwYXYVIXiPh5_eJTmfLAAAAgE"]
[Tue Apr 07 19:54:09.755009 2026] [:error] [pid 59490:tid 59496] [client 20.215.51.202:49200] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTwYUcw8OFbiUZ7Rx1lbQAAAUQ"]
[Tue Apr 07 19:54:10.435743 2026] [:error] [pid 59551:tid 59563] [client 20.215.51.202:43542] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adTwYl7LN7Ubyqs-sVv8rAAAAYo"]
[Tue Apr 07 19:54:11.258313 2026] [:error] [pid 59804:tid 59819] [client 20.215.51.202:1057] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "adTwY3YVIXiPh5_eJTmfMwAAAg0"]
[Tue Apr 07 19:54:11.981709 2026] [:error] [pid 37598:tid 37661] [client 20.215.51.202:47354] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "adTwY-9g7q_cV2WhPayw4gAAAIA"]
[Tue Apr 07 19:54:12.729531 2026] [:error] [pid 37598:tid 37681] [client 20.215.51.202:49785] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "adTwZO9g7q_cV2WhPayw4wAAAJQ"]
[Tue Apr 07 19:54:13.501781 2026] [:error] [pid 37598:tid 37667] [client 20.215.51.202:49782] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "adTwZe9g7q_cV2WhPayw5gAAAIY"]
[Tue Apr 07 19:54:14.682368 2026] [:error] [pid 59551:tid 59572] [client 20.215.51.202:44718] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "adTwZl7LN7Ubyqs-sVv8rQAAAZM"]
[Tue Apr 07 19:54:15.428684 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:47350] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "adTwZw6uAY0QAy-8EEJhrQAAAFA"]
[Tue Apr 07 19:54:16.222653 2026] [:error] [pid 12948:tid 12966] [client 20.215.51.202:43536] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "adTwaMbeSPAN8LvMqsaogQAAAQ8"]
[Tue Apr 07 19:54:16.875353 2026] [:error] [pid 59490:tid 59507] [client 20.215.51.202:43579] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "adTwaEcw8OFbiUZ7Rx1ldAAAAU8"]
[Tue Apr 07 19:54:18.724743 2026] [:error] [pid 37719:tid 37746] [client 20.215.51.202:54573] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "adTwak09Xv52u2xXGLAKkQAAANg"]
[Tue Apr 07 19:54:19.693864 2026] [:error] [pid 59804:tid 59815] [client 20.215.51.202:43538] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "adTwa3YVIXiPh5_eJTmfQQAAAgk"]
[Tue Apr 07 19:54:20.294214 2026] [:error] [pid 59804:tid 59820] [client 20.215.51.202:49753] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "adTwbHYVIXiPh5_eJTmfQwAAAg4"]
[Tue Apr 07 19:54:20.919943 2026] [:error] [pid 59804:tid 59816] [client 20.215.51.202:56131] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "adTwbHYVIXiPh5_eJTmfRgAAAgo"]
[Tue Apr 07 19:54:21.597592 2026] [:error] [pid 59804:tid 59828] [client 20.215.51.202:49215] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adTwbXYVIXiPh5_eJTmfSAAAAhY"]
[Tue Apr 07 19:54:22.219019 2026] [:error] [pid 37719:tid 37726] [client 20.215.51.202:56135] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adTwbk09Xv52u2xXGLAKmwAAAMQ"]
[Tue Apr 07 19:54:22.932039 2026] [:error] [pid 37597:tid 37640] [client 20.215.51.202:56185] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adTwbg6uAY0QAy-8EEJhugAAAEY"]
[Tue Apr 07 19:54:24.988458 2026] [:error] [pid 37597:tid 37641] [client 20.215.51.202:49208] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adTwcA6uAY0QAy-8EEJhxQAAAEc"]
[Tue Apr 07 19:54:26.354640 2026] [:error] [pid 37719:tid 37733] [client 20.215.51.202:56174] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adTwck09Xv52u2xXGLAKpgAAAMs"]
[Tue Apr 07 19:54:26.975901 2026] [:error] [pid 12948:tid 12960] [client 20.215.51.202:37522] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adTwcsbeSPAN8LvMqsaoiAAAAQk"]
[Tue Apr 07 19:54:27.526693 2026] [:error] [pid 37598:tid 37664] [client 20.215.51.202:49186] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adTwc-9g7q_cV2WhPayw8gAAAIM"]
[Tue Apr 07 19:54:28.159749 2026] [:error] [pid 37598:tid 37661] [client 20.215.51.202:34686] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adTwdO9g7q_cV2WhPayw8wAAAIA"]
[Tue Apr 07 19:54:29.150647 2026] [:error] [pid 12948:tid 12973] [client 20.215.51.202:47335] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adTwdcbeSPAN8LvMqsaolAAAARY"]
[Tue Apr 07 19:54:29.891311 2026] [:error] [pid 37719:tid 37727] [client 20.215.51.202:1085] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adTwdU09Xv52u2xXGLAKrAAAAMU"]
[Tue Apr 07 19:54:30.565266 2026] [proxy_fcgi:error] [pid 59660:tid 59675] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:31.148169 2026] [proxy_fcgi:error] [pid 59660:tid 59679] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:31.418135 2026] [proxy_fcgi:error] [pid 59660:tid 59678] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:31.676834 2026] [proxy_fcgi:error] [pid 59660:tid 59680] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:31.934860 2026] [proxy_fcgi:error] [pid 59660:tid 59676] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:32.872207 2026] [proxy_fcgi:error] [pid 59660:tid 59666] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:33.176452 2026] [proxy_fcgi:error] [pid 59660:tid 59686] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:33.436342 2026] [proxy_fcgi:error] [pid 59660:tid 59667] [client 20.215.51.202:34659] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:54:33.765886 2026] [:error] [pid 59660:tid 59681] [client 20.215.51.202:34659] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adTweTp3-oiX2o5bTswO5AAAAdM"]
[Tue Apr 07 19:54:34.397482 2026] [:error] [pid 37719:tid 37737] [client 20.215.51.202:46599] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adTwek09Xv52u2xXGLAKswAAAM8"]
[Tue Apr 07 19:54:35.009192 2026] [:error] [pid 37719:tid 37728] [client 20.215.51.202:43529] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adTwe009Xv52u2xXGLAKuwAAAMY"]
[Tue Apr 07 19:54:35.579328 2026] [:error] [pid 59551:tid 59567] [client 20.215.51.202:46605] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adTwe17LN7Ubyqs-sVv8uAAAAY4"]
[Tue Apr 07 19:54:36.256973 2026] [:error] [pid 37596:tid 37610] [client 20.215.51.202:49160] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adTwfKpaAOZHEjRWjP2ZWAAAAAQ"]
[Tue Apr 07 19:54:36.875001 2026] [:error] [pid 59490:tid 59515] [client 20.215.51.202:56172] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adTwfEcw8OFbiUZ7Rx1lgAAAAVc"]
[Tue Apr 07 19:54:37.492293 2026] [:error] [pid 59490:tid 59503] [client 20.215.51.202:49204] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adTwfUcw8OFbiUZ7Rx1lgQAAAUs"]
[Tue Apr 07 19:54:38.090760 2026] [:error] [pid 37597:tid 37657] [client 20.215.51.202:49744] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adTwfg6uAY0QAy-8EEJh0wAAAFc"]
[Tue Apr 07 19:54:38.825497 2026] [:error] [pid 37719:tid 37729] [client 20.215.51.202:44724] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "adTwfk09Xv52u2xXGLAKvwAAAMc"]
[Tue Apr 07 19:54:39.443039 2026] [:error] [pid 12948:tid 12961] [client 20.215.51.202:1065] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "adTwf8beSPAN8LvMqsaoowAAAQo"]
[Tue Apr 07 19:54:40.029837 2026] [:error] [pid 37598:tid 37674] [client 20.215.51.202:54590] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "adTwgO9g7q_cV2WhPayw_gAAAI0"]
[Tue Apr 07 19:54:40.611116 2026] [:error] [pid 59551:tid 59556] [client 20.215.51.202:49754] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "adTwgF7LN7Ubyqs-sVv8wgAAAYM"]
[Tue Apr 07 19:54:41.162792 2026] [:error] [pid 59551:tid 59562] [client 20.215.51.202:54541] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adTwgV7LN7Ubyqs-sVv8yAAAAYk"]
[Tue Apr 07 19:54:41.891016 2026] [:error] [pid 59660:tid 59683] [client 20.215.51.202:50404] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adTwgTp3-oiX2o5bTswO7AAAAdU"]
[Tue Apr 07 19:54:42.625345 2026] [:error] [pid 59660:tid 59675] [client 20.215.51.202:49165] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adTwgjp3-oiX2o5bTswO7gAAAc0"]
[Tue Apr 07 19:54:43.351876 2026] [:error] [pid 59490:tid 59499] [client 20.215.51.202:44226] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "adTwg0cw8OFbiUZ7Rx1lhQAAAUc"]
[Tue Apr 07 19:54:43.960570 2026] [:error] [pid 37719:tid 37735] [client 20.215.51.202:49732] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTwg009Xv52u2xXGLAKwwAAAM0"]
[Tue Apr 07 19:54:44.606136 2026] [:error] [pid 59551:tid 59565] [client 20.215.51.202:34655] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTwhF7LN7Ubyqs-sVv8zAAAAYw"]
[Tue Apr 07 19:54:45.143749 2026] [:error] [pid 37598:tid 37673] [client 20.215.51.202:43556] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTwhe9g7q_cV2WhPayxAwAAAIw"]
[Tue Apr 07 19:54:45.750515 2026] [:error] [pid 37719:tid 37730] [client 20.215.51.202:54552] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTwhU09Xv52u2xXGLAKxgAAAMg"]
[Tue Apr 07 19:54:46.319813 2026] [:error] [pid 37719:tid 37726] [client 20.215.51.202:49190] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "adTwhk09Xv52u2xXGLAKyQAAAMQ"]
[Tue Apr 07 19:54:47.384318 2026] [:error] [pid 37719:tid 37724] [client 20.215.51.202:51032] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "adTwh009Xv52u2xXGLAKzAAAAMI"]
[Tue Apr 07 19:54:47.994724 2026] [:error] [pid 12948:tid 12953] [client 20.215.51.202:54551] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "adTwh8beSPAN8LvMqsaoqAAAAQI"]
[Tue Apr 07 19:54:48.633125 2026] [:error] [pid 37598:tid 37685] [client 20.215.51.202:54572] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "adTwiO9g7q_cV2WhPayxBQAAAJg"]
[Tue Apr 07 19:54:49.299078 2026] [:error] [pid 12948:tid 12963] [client 20.215.51.202:1043] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "adTwicbeSPAN8LvMqsaorAAAAQw"]
[Tue Apr 07 19:54:50.018730 2026] [:error] [pid 12948:tid 12957] [client 20.215.51.202:43547] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "adTwisbeSPAN8LvMqsaorwAAAQY"]
[Tue Apr 07 19:54:50.909855 2026] [:error] [pid 37597:tid 37652] [client 20.215.51.202:43534] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "adTwig6uAY0QAy-8EEJh3gAAAFI"]
[Tue Apr 07 19:54:51.517172 2026] [:error] [pid 37598:tid 37672] [client 20.215.51.202:54583] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "adTwi-9g7q_cV2WhPayxDAAAAIs"]
[Tue Apr 07 19:54:52.093777 2026] [:error] [pid 59551:tid 59557] [client 20.215.51.202:51023] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "adTwjF7LN7Ubyqs-sVv80wAAAYQ"]
[Tue Apr 07 19:54:52.753558 2026] [:error] [pid 37598:tid 37674] [client 20.215.51.202:46602] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "adTwjO9g7q_cV2WhPayxDQAAAI0"]
[Tue Apr 07 19:54:53.344311 2026] [:error] [pid 59551:tid 59556] [client 20.215.51.202:56161] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "adTwjV7LN7Ubyqs-sVv81AAAAYM"]
[Tue Apr 07 19:54:53.994731 2026] [:error] [pid 59551:tid 59562] [client 20.215.51.202:41792] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "adTwjV7LN7Ubyqs-sVv82AAAAYk"]
[Tue Apr 07 19:54:54.863014 2026] [:error] [pid 37598:tid 37666] [client 20.215.51.202:34574] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "adTwju9g7q_cV2WhPayxDgAAAIU"]
[Tue Apr 07 19:54:55.425324 2026] [:error] [pid 37598:tid 37670] [client 20.215.51.202:48515] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "adTwj-9g7q_cV2WhPayxEAAAAIk"]
[Tue Apr 07 19:54:56.233549 2026] [:error] [pid 59551:tid 59566] [client 20.215.51.202:43548] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "adTwkF7LN7Ubyqs-sVv83AAAAY0"]
[Tue Apr 07 19:54:56.927482 2026] [:error] [pid 59804:tid 59809] [client 20.215.51.202:46647] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "adTwkHYVIXiPh5_eJTmfXAAAAgM"]
[Tue Apr 07 19:54:57.498400 2026] [:error] [pid 12948:tid 12963] [client 20.215.51.202:46615] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adTwkcbeSPAN8LvMqsaotgAAAQw"]
[Tue Apr 07 19:54:58.079552 2026] [:error] [pid 37598:tid 37682] [client 20.215.51.202:49777] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adTwku9g7q_cV2WhPayxFgAAAJU"]
[Tue Apr 07 19:54:58.632295 2026] [:error] [pid 37596:tid 37628] [client 20.215.51.202:41815] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adTwkqpaAOZHEjRWjP2ZYwAAABY"]
[Tue Apr 07 19:54:59.215387 2026] [:error] [pid 59804:tid 59823] [client 20.215.51.202:49155] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adTwk3YVIXiPh5_eJTmfaAAAAhE"]
[Tue Apr 07 19:54:59.882613 2026] [:error] [pid 12948:tid 12962] [client 20.215.51.202:54586] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "adTwk8beSPAN8LvMqsaougAAAQs"]
[Tue Apr 07 19:55:00.863531 2026] [:error] [pid 59660:tid 59663] [client 20.215.51.202:54558] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "adTwlDp3-oiX2o5bTswO-wAAAcE"]
[Tue Apr 07 19:55:01.671746 2026] [:error] [pid 37719:tid 37724] [client 20.215.51.202:50430] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "adTwlU09Xv52u2xXGLAK0gAAAMI"]
[Tue Apr 07 19:55:02.196390 2026] [:error] [pid 59551:tid 59553] [client 20.215.51.202:49213] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "adTwll7LN7Ubyqs-sVv84gAAAYA"]
[Tue Apr 07 19:55:02.848543 2026] [:error] [pid 59551:tid 59554] [client 20.215.51.202:49761] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adTwll7LN7Ubyqs-sVv85AAAAYE"]
[Tue Apr 07 19:55:03.402212 2026] [:error] [pid 37719:tid 37722] [client 20.215.51.202:49179] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adTwl009Xv52u2xXGLAK1gAAAMA"]
[Tue Apr 07 19:55:03.932133 2026] [:error] [pid 37597:tid 37647] [client 20.215.51.202:50414] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adTwlw6uAY0QAy-8EEJh-AAAAE0"]
[Tue Apr 07 19:55:05.060661 2026] [:error] [pid 37597:tid 37648] [client 20.215.51.202:50426] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adTwmQ6uAY0QAy-8EEJh_wAAAE4"]
[Tue Apr 07 19:55:05.742565 2026] [:error] [pid 37597:tid 37657] [client 20.215.51.202:43524] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adTwmQ6uAY0QAy-8EEJiAQAAAFc"]
[Tue Apr 07 19:55:06.355345 2026] [:error] [pid 59551:tid 59576] [client 20.215.51.202:43565] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adTwml7LN7Ubyqs-sVv86gAAAZc"]
[Tue Apr 07 19:55:07.119714 2026] [:error] [pid 37719:tid 37742] [client 20.215.51.202:34633] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adTwm009Xv52u2xXGLAK3wAAANQ"]
[Tue Apr 07 19:55:07.690125 2026] [:error] [pid 37719:tid 37740] [client 20.215.51.202:47338] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adTwm009Xv52u2xXGLAK4QAAANI"]
[Tue Apr 07 19:55:08.242015 2026] [:error] [pid 37598:tid 37671] [client 20.215.51.202:44693] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adTwnO9g7q_cV2WhPayxGgAAAIo"]
[Tue Apr 07 19:55:08.825633 2026] [:error] [pid 37719:tid 37743] [client 20.215.51.202:47323] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adTwnE09Xv52u2xXGLAK5gAAANU"]
[Tue Apr 07 19:55:09.388631 2026] [:error] [pid 59490:tid 59516] [client 20.215.51.202:51021] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adTwnUcw8OFbiUZ7Rx1liQAAAVg"]
[Tue Apr 07 19:55:10.080140 2026] [:error] [pid 37719:tid 37732] [client 20.215.51.202:51034] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adTwnk09Xv52u2xXGLAK6gAAAMo"]
[Tue Apr 07 19:55:10.750445 2026] [:error] [pid 59490:tid 59515] [client 20.215.51.202:50416] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adTwnkcw8OFbiUZ7Rx1liwAAAVc"]
[Tue Apr 07 19:55:11.301746 2026] [:error] [pid 59804:tid 59820] [client 20.215.51.202:34637] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adTwn3YVIXiPh5_eJTmfbgAAAg4"]
[Tue Apr 07 19:55:11.942784 2026] [:error] [pid 59804:tid 59828] [client 20.215.51.202:54567] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adTwn3YVIXiPh5_eJTmfbwAAAhY"]
[Tue Apr 07 19:55:12.502223 2026] [:error] [pid 59490:tid 59500] [client 20.215.51.202:49206] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adTwoEcw8OFbiUZ7Rx1ljQAAAUg"]
[Tue Apr 07 19:55:13.099756 2026] [:error] [pid 59804:tid 59829] [client 20.215.51.202:56138] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adTwoXYVIXiPh5_eJTmfcgAAAhc"]
[Tue Apr 07 19:55:13.729952 2026] [:error] [pid 59490:tid 59502] [client 20.215.51.202:51008] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adTwoUcw8OFbiUZ7Rx1ljgAAAUo"]
[Tue Apr 07 19:55:14.284137 2026] [:error] [pid 59660:tid 59686] [client 20.215.51.202:51068] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adTwojp3-oiX2o5bTswPCQAAAdg"]
[Tue Apr 07 19:55:14.829343 2026] [:error] [pid 59660:tid 59663] [client 20.215.51.202:49773] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adTwojp3-oiX2o5bTswPCwAAAcE"]
[Tue Apr 07 19:55:15.828735 2026] [:error] [pid 59551:tid 59557] [client 20.215.51.202:47343] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adTwo17LN7Ubyqs-sVv89wAAAYQ"]
[Tue Apr 07 19:55:16.406707 2026] [:error] [pid 37719:tid 37734] [client 20.215.51.202:47349] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adTwpE09Xv52u2xXGLAK_wAAAMw"]
[Tue Apr 07 19:55:17.017598 2026] [:error] [pid 12948:tid 12965] [client 20.215.51.202:50402] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adTwpcbeSPAN8LvMqsaoxQAAAQ4"]
[Tue Apr 07 19:55:17.646449 2026] [:error] [pid 59551:tid 59553] [client 20.215.51.202:49736] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adTwpV7LN7Ubyqs-sVv8-wAAAYA"]
[Tue Apr 07 19:55:18.197165 2026] [:error] [pid 59551:tid 59573] [client 20.215.51.202:54570] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adTwpl7LN7Ubyqs-sVv8_AAAAZQ"]
[Tue Apr 07 19:55:18.954953 2026] [:error] [pid 59490:tid 59501] [client 20.215.51.202:48520] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adTwpkcw8OFbiUZ7Rx1lkQAAAUk"]
[Tue Apr 07 19:55:19.479882 2026] [:error] [pid 37596:tid 37627] [client 20.215.51.202:49184] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adTwp6paAOZHEjRWjP2ZbQAAABU"]
[Tue Apr 07 19:55:20.031464 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:46625] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adTwqA6uAY0QAy-8EEJiJgAAAFA"]
[Tue Apr 07 19:55:20.582526 2026] [:error] [pid 59551:tid 59572] [client 20.215.51.202:46628] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adTwqF7LN7Ubyqs-sVv8_wAAAZM"]
[Tue Apr 07 19:55:21.128310 2026] [:error] [pid 37597:tid 37639] [client 20.215.51.202:47317] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adTwqQ6uAY0QAy-8EEJiKAAAAEU"]
[Tue Apr 07 19:55:21.666454 2026] [:error] [pid 37597:tid 37654] [client 20.215.51.202:54529] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adTwqQ6uAY0QAy-8EEJiLAAAAFQ"]
[Tue Apr 07 19:55:22.184653 2026] [:error] [pid 37719:tid 37734] [client 20.215.51.202:43544] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adTwqk09Xv52u2xXGLALCQAAAMw"]
[Tue Apr 07 19:55:22.970819 2026] [:error] [pid 59660:tid 59680] [client 20.215.51.202:51016] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwqjp3-oiX2o5bTswPGgAAAdI"]
[Tue Apr 07 19:55:23.494961 2026] [:error] [pid 59551:tid 59555] [client 20.215.51.202:49766] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwq17LN7Ubyqs-sVv9AQAAAYI"]
[Tue Apr 07 19:55:24.058125 2026] [:error] [pid 59490:tid 59510] [client 20.215.51.202:49209] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwrEcw8OFbiUZ7Rx1lkgAAAVI"]
[Tue Apr 07 19:55:24.946329 2026] [:error] [pid 59660:tid 59667] [client 20.215.51.202:51026] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adTwrDp3-oiX2o5bTswPHAAAAcU"]
[Tue Apr 07 19:55:26.279931 2026] [:error] [pid 12948:tid 12963] [client 20.215.51.202:49167] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adTwrsbeSPAN8LvMqsaozAAAAQw"]
[Tue Apr 07 19:55:26.984676 2026] [:error] [pid 59660:tid 59676] [client 20.215.51.202:50380] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adTwrjp3-oiX2o5bTswPHQAAAc4"]
[Tue Apr 07 19:55:27.668195 2026] [:error] [pid 37719:tid 37734] [client 20.215.51.202:47305] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adTwr009Xv52u2xXGLALFQAAAMw"]
[Tue Apr 07 19:55:28.312684 2026] [:error] [pid 37597:tid 37637] [client 20.215.51.202:51019] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adTwsA6uAY0QAy-8EEJiNAAAAEM"]
[Tue Apr 07 19:55:29.069536 2026] [:error] [pid 37597:tid 37658] [client 20.215.51.202:49194] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "adTwsQ6uAY0QAy-8EEJiOQAAAFg"]
[Tue Apr 07 19:55:30.007215 2026] [:error] [pid 37597:tid 37640] [client 20.215.51.202:50401] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "adTwsg6uAY0QAy-8EEJiPAAAAEY"]
[Tue Apr 07 19:55:31.196769 2026] [:error] [pid 37719:tid 37743] [client 20.215.51.202:51071] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "adTws009Xv52u2xXGLALGQAAANU"]
[Tue Apr 07 19:55:31.849836 2026] [:error] [pid 37597:tid 37656] [client 20.215.51.202:34642] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about2.php"] [unique_id "adTwsw6uAY0QAy-8EEJiQQAAAFY"]
[Tue Apr 07 19:55:32.616002 2026] [:error] [pid 59551:tid 59557] [client 20.215.51.202:51053] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "adTwtF7LN7Ubyqs-sVv9CgAAAYQ"]
[Tue Apr 07 19:55:33.335281 2026] [proxy_fcgi:error] [pid 37719:tid 37744] [client 20.215.51.202:50431] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:33.597008 2026] [proxy_fcgi:error] [pid 37719:tid 37740] [client 20.215.51.202:50431] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:34.116196 2026] [:error] [pid 37719:tid 37736] [client 20.215.51.202:50431] [client 20.215.51.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adTwtk09Xv52u2xXGLALIwAAAM4"]
[Tue Apr 07 19:55:36.290134 2026] [proxy_fcgi:error] [pid 37719:tid 37722] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:37.091714 2026] [proxy_fcgi:error] [pid 37719:tid 37725] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:37.351345 2026] [proxy_fcgi:error] [pid 37719:tid 37733] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:37.612209 2026] [proxy_fcgi:error] [pid 37719:tid 37728] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:37.889928 2026] [proxy_fcgi:error] [pid 37719:tid 37739] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:38.148469 2026] [proxy_fcgi:error] [pid 37719:tid 37738] [client 20.215.51.202:49168] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:55:38.405439 2026] [:error] [pid 37719:tid 37745] [client 20.215.51.202:49168] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "adTwuk09Xv52u2xXGLALQAAAANc"]
[Tue Apr 07 19:55:38.936537 2026] [:error] [pid 59551:tid 59561] [client 20.215.51.202:43580] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "adTwul7LN7Ubyqs-sVv9GgAAAYg"]
[Tue Apr 07 19:55:39.474470 2026] [:error] [pid 37719:tid 37744] [client 20.215.51.202:51011] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "adTwu009Xv52u2xXGLALRAAAANY"]
[Tue Apr 07 19:55:40.021247 2026] [:error] [pid 12948:tid 12955] [client 20.215.51.202:46621] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "adTwvMbeSPAN8LvMqsaozQAAAQQ"]
[Tue Apr 07 19:55:40.660399 2026] [:error] [pid 59551:tid 59560] [client 20.215.51.202:44676] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adTwvF7LN7Ubyqs-sVv9HwAAAYc"]
[Tue Apr 07 19:55:41.287722 2026] [:error] [pid 12948:tid 12972] [client 20.215.51.202:49741] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adTwvcbeSPAN8LvMqsaozwAAARU"]
[Tue Apr 07 19:55:41.819466 2026] [:error] [pid 59551:tid 59558] [client 20.215.51.202:51009] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adTwvV7LN7Ubyqs-sVv9IQAAAYU"]
[Tue Apr 07 19:55:42.435963 2026] [:error] [pid 59490:tid 59509] [client 20.215.51.202:43523] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adTwvkcw8OFbiUZ7Rx1logAAAVE"]
[Tue Apr 07 19:55:43.063865 2026] [:error] [pid 59490:tid 59508] [client 20.215.51.202:44688] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "adTwv0cw8OFbiUZ7Rx1lpQAAAVA"]
[Tue Apr 07 19:55:43.635007 2026] [:error] [pid 59551:tid 59556] [client 20.215.51.202:47334] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "adTwv17LN7Ubyqs-sVv9IwAAAYM"]
[Tue Apr 07 19:55:44.228003 2026] [:error] [pid 37719:tid 37722] [client 20.215.51.202:49750] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "adTwwE09Xv52u2xXGLALTQAAAMA"]
[Tue Apr 07 19:55:44.780683 2026] [:error] [pid 59551:tid 59573] [client 20.215.51.202:54585] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "adTwwF7LN7Ubyqs-sVv9KQAAAZQ"]
[Tue Apr 07 19:55:45.389203 2026] [:error] [pid 59551:tid 59563] [client 20.215.51.202:46604] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adTwwV7LN7Ubyqs-sVv9KwAAAYo"]
[Tue Apr 07 19:55:45.909862 2026] [:error] [pid 59490:tid 59497] [client 20.215.51.202:51030] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adTwwUcw8OFbiUZ7Rx1lqwAAAUU"]
[Tue Apr 07 19:55:46.450797 2026] [:error] [pid 59804:tid 59825] [client 20.215.51.202:41818] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adTwwnYVIXiPh5_eJTmfmwAAAhM"]
[Tue Apr 07 19:55:47.036508 2026] [:error] [pid 59551:tid 59570] [client 20.215.51.202:46635] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adTww17LN7Ubyqs-sVv9MAAAAZE"]
[Tue Apr 07 19:55:47.652421 2026] [:error] [pid 37596:tid 37616] [client 20.215.51.202:47355] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTww6paAOZHEjRWjP2ZcgAAAAo"]
[Tue Apr 07 19:55:48.190841 2026] [:error] [pid 59490:tid 59511] [client 20.215.51.202:47310] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTwxEcw8OFbiUZ7Rx1lsQAAAVM"]
[Tue Apr 07 19:55:48.722545 2026] [:error] [pid 37596:tid 37622] [client 20.215.51.202:48545] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTwxKpaAOZHEjRWjP2ZcwAAABA"]
[Tue Apr 07 19:55:49.324360 2026] [:error] [pid 59804:tid 59808] [client 20.215.51.202:44678] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adTwxXYVIXiPh5_eJTmfnQAAAgI"]
[Tue Apr 07 19:55:49.872213 2026] [:error] [pid 59551:tid 59565] [client 20.215.51.202:54546] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adTwxV7LN7Ubyqs-sVv9NwAAAYw"]
[Tue Apr 07 19:55:50.452540 2026] [:error] [pid 37598:tid 37665] [client 20.215.51.202:54548] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adTwxu9g7q_cV2WhPayxLAAAAIQ"]
[Tue Apr 07 19:55:51.060296 2026] [:error] [pid 59490:tid 59506] [client 20.215.51.202:43583] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adTwx0cw8OFbiUZ7Rx1ltAAAAU4"]
[Tue Apr 07 19:55:51.651297 2026] [:error] [pid 59804:tid 59819] [client 20.215.51.202:49762] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adTwx3YVIXiPh5_eJTmfpQAAAg0"]
[Tue Apr 07 19:55:52.260407 2026] [:error] [pid 37596:tid 37611] [client 20.215.51.202:46645] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adTwyKpaAOZHEjRWjP2ZdwAAAAU"]
[Tue Apr 07 19:55:52.862112 2026] [:error] [pid 59490:tid 59516] [client 20.215.51.202:54577] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adTwyEcw8OFbiUZ7Rx1ltgAAAVg"]
[Tue Apr 07 19:55:53.512785 2026] [:error] [pid 37596:tid 37625] [client 20.215.51.202:47307] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adTwyapaAOZHEjRWjP2ZegAAABM"]
[Tue Apr 07 19:55:54.167697 2026] [:error] [pid 37719:tid 37724] [client 20.215.51.202:48575] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adTwyk09Xv52u2xXGLALVAAAAMI"]
[Tue Apr 07 19:55:54.705534 2026] [:error] [pid 37719:tid 37738] [client 20.215.51.202:37563] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adTwyk09Xv52u2xXGLALVwAAANA"]
[Tue Apr 07 19:55:55.308792 2026] [:error] [pid 37597:tid 37635] [client 20.215.51.202:45475] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adTwyw6uAY0QAy-8EEJiagAAAEE"]
[Tue Apr 07 19:55:55.840270 2026] [:error] [pid 12948:tid 12972] [client 20.215.51.202:51056] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adTwy8beSPAN8LvMqsao5gAAARU"]
[Tue Apr 07 19:55:56.735710 2026] [:error] [pid 37719:tid 37742] [client 20.215.51.202:54536] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adTwzE09Xv52u2xXGLALWwAAANQ"]
[Tue Apr 07 19:55:57.371847 2026] [:error] [pid 12948:tid 12964] [client 20.215.51.202:44286] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adTwzcbeSPAN8LvMqsao8AAAAQ0"]
[Tue Apr 07 19:55:58.007539 2026] [:error] [pid 59490:tid 59504] [client 20.215.51.202:54542] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adTwzkcw8OFbiUZ7Rx1lwAAAAUw"]
[Tue Apr 07 19:55:58.573219 2026] [:error] [pid 59551:tid 59575] [client 20.215.51.202:46597] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adTwzl7LN7Ubyqs-sVv9OgAAAZY"]
[Tue Apr 07 19:55:59.139121 2026] [:error] [pid 37719:tid 37733] [client 20.215.51.202:47315] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adTwz009Xv52u2xXGLALYQAAAMs"]
[Tue Apr 07 19:55:59.673730 2026] [:error] [pid 59551:tid 59574] [client 20.215.51.202:37617] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adTwz17LN7Ubyqs-sVv9PAAAAZU"]
[Tue Apr 07 19:56:00.239844 2026] [:error] [pid 59490:tid 59507] [client 20.215.51.202:37555] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adTw0Ecw8OFbiUZ7Rx1lwwAAAU8"]
[Tue Apr 07 19:56:00.859946 2026] [:error] [pid 59551:tid 59568] [client 20.215.51.202:48562] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adTw0F7LN7Ubyqs-sVv9PQAAAY8"]
[Tue Apr 07 19:56:01.503669 2026] [:error] [pid 37597:tid 37649] [client 20.215.51.202:51049] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adTw0Q6uAY0QAy-8EEJikwAAAE8"]
[Tue Apr 07 19:56:02.145183 2026] [:error] [pid 37719:tid 37733] [client 20.215.51.202:44720] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adTw0k09Xv52u2xXGLALaQAAAMs"]
[Tue Apr 07 19:56:02.925895 2026] [:error] [pid 37719:tid 37744] [client 20.215.51.202:37571] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adTw0k09Xv52u2xXGLALcgAAANY"]
[Tue Apr 07 19:56:03.487204 2026] [:error] [pid 37719:tid 37745] [client 20.215.51.202:44188] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adTw0009Xv52u2xXGLALdAAAANc"]
[Tue Apr 07 19:56:04.013492 2026] [:error] [pid 59551:tid 59566] [client 20.215.51.202:50418] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adTw1F7LN7Ubyqs-sVv9QgAAAY0"]
[Tue Apr 07 19:56:04.592250 2026] [:error] [pid 59551:tid 59576] [client 20.215.51.202:1030] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTw1F7LN7Ubyqs-sVv9QwAAAZc"]
[Tue Apr 07 19:56:05.175631 2026] [:error] [pid 37719:tid 37725] [client 20.215.51.202:34576] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTw1U09Xv52u2xXGLALeQAAAMM"]
[Tue Apr 07 19:56:05.806873 2026] [:error] [pid 37597:tid 37650] [client 20.215.51.202:34656] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTw1Q6uAY0QAy-8EEJinQAAAFA"]
[Tue Apr 07 19:56:06.353851 2026] [:error] [pid 37597:tid 37654] [client 20.215.51.202:49738] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adTw1g6uAY0QAy-8EEJinwAAAFQ"]
[Tue Apr 07 19:56:06.969967 2026] [:error] [pid 59551:tid 59564] [client 20.215.51.202:46632] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adTw1l7LN7Ubyqs-sVv9SAAAAYs"]
[Tue Apr 07 19:56:07.619630 2026] [:error] [pid 59490:tid 59501] [client 20.215.51.202:54564] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adTw10cw8OFbiUZ7Rx1lxQAAAUk"]
[Tue Apr 07 19:56:08.153784 2026] [:error] [pid 59551:tid 59568] [client 20.215.51.202:34671] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adTw2F7LN7Ubyqs-sVv9SwAAAY8"]
[Tue Apr 07 19:56:09.013117 2026] [:error] [pid 37719:tid 37722] [client 20.215.51.202:49188] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adTw2U09Xv52u2xXGLALkgAAAMA"]
[Tue Apr 07 19:56:09.680109 2026] [:error] [pid 37597:tid 37638] [client 20.215.51.202:43555] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adTw2Q6uAY0QAy-8EEJipAAAAEQ"]
[Tue Apr 07 19:56:10.516538 2026] [:error] [pid 59551:tid 59554] [client 20.215.51.202:47328] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adTw2l7LN7Ubyqs-sVv9UAAAAYE"]
[Tue Apr 07 19:56:11.257277 2026] [:error] [pid 37719:tid 37731] [client 20.215.51.202:46624] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adTw2009Xv52u2xXGLALpgAAAMk"]
[Tue Apr 07 19:56:11.853378 2026] [:error] [pid 37597:tid 37657] [client 20.215.51.202:51033] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adTw2w6uAY0QAy-8EEJiqQAAAFc"]
[Tue Apr 07 19:56:12.619944 2026] [:error] [pid 37597:tid 37644] [client 20.215.51.202:56132] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adTw3A6uAY0QAy-8EEJisAAAAEo"]
[Tue Apr 07 19:56:13.148060 2026] [:error] [pid 37597:tid 37645] [client 20.215.51.202:49187] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adTw3Q6uAY0QAy-8EEJitAAAAEs"]
[Tue Apr 07 19:56:13.737598 2026] [:error] [pid 59551:tid 59564] [client 20.215.51.202:43559] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adTw3V7LN7Ubyqs-sVv9VQAAAYs"]
[Tue Apr 07 19:56:14.300039 2026] [:error] [pid 37597:tid 37643] [client 20.215.51.202:34645] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adTw3g6uAY0QAy-8EEJivAAAAEk"]
[Tue Apr 07 19:56:14.891161 2026] [:error] [pid 59551:tid 59559] [client 20.215.51.202:49154] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adTw3l7LN7Ubyqs-sVv9WAAAAYY"]
[Tue Apr 07 19:56:15.545920 2026] [:error] [pid 59804:tid 59825] [client 20.215.51.202:56137] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adTw33YVIXiPh5_eJTmf0AAAAhM"]
[Tue Apr 07 19:56:16.534745 2026] [:error] [pid 37597:tid 37654] [client 20.215.51.202:56167] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adTw4A6uAY0QAy-8EEJiyQAAAFQ"]
[Tue Apr 07 19:56:17.308761 2026] [:error] [pid 59660:tid 59673] [client 20.215.51.202:46612] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adTw4Tp3-oiX2o5bTswPRgAAAcs"]
[Tue Apr 07 19:56:18.091807 2026] [:error] [pid 37597:tid 37645] [client 20.215.51.202:50370] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adTw4g6uAY0QAy-8EEJi2QAAAEs"]
[Tue Apr 07 19:56:19.006833 2026] [:error] [pid 37597:tid 37658] [client 20.215.51.202:44677] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adTw4w6uAY0QAy-8EEJi4AAAAFg"]
[Tue Apr 07 19:56:19.755439 2026] [:error] [pid 37597:tid 37641] [client 20.215.51.202:46623] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adTw4w6uAY0QAy-8EEJi5wAAAEc"]
[Tue Apr 07 19:56:20.349978 2026] [:error] [pid 59660:tid 59670] [client 20.215.51.202:44709] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adTw5Dp3-oiX2o5bTswPSAAAAcg"]
[Tue Apr 07 19:56:20.908265 2026] [:error] [pid 37597:tid 37636] [client 20.215.51.202:56152] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "adTw5A6uAY0QAy-8EEJi8gAAAEI"]
[Tue Apr 07 19:56:22.074105 2026] [:error] [pid 37597:tid 37636] [client 20.215.51.202:48519] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "adTw5g6uAY0QAy-8EEJi_gAAAEI"]
[Tue Apr 07 19:56:22.889277 2026] [:error] [pid 59490:tid 59504] [client 20.215.51.202:46595] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "adTw5kcw8OFbiUZ7Rx1lxwAAAUw"]
[Tue Apr 07 19:56:23.635658 2026] [:error] [pid 59551:tid 59574] [client 20.215.51.202:34639] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "adTw517LN7Ubyqs-sVv9YwAAAZU"]
[Tue Apr 07 19:56:25.004499 2026] [:error] [pid 37597:tid 37645] [client 20.215.51.202:49780] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "adTw6Q6uAY0QAy-8EEJjDgAAAEs"]
[Tue Apr 07 19:56:25.694051 2026] [:error] [pid 59804:tid 59828] [client 20.215.51.202:41834] [client 20.215.51.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "adTw6XYVIXiPh5_eJTmf3QAAAhY"]
[Tue Apr 07 19:57:10.331236 2026] [proxy_fcgi:error] [pid 37719:tid 37734] [client 20.215.51.202:46592] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:57:10.593048 2026] [proxy_fcgi:error] [pid 37719:tid 37746] [client 20.215.51.202:46592] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:57:10.922540 2026] [proxy_fcgi:error] [pid 37719:tid 37742] [client 20.215.51.202:46592] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:57:11.227655 2026] [proxy_fcgi:error] [pid 37719:tid 37726] [client 20.215.51.202:46592] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 19:57:11.565308 2026] [proxy_fcgi:error] [pid 37719:tid 37735] [client 20.215.51.202:46592] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 20:23:35.739011 2026] [:error] [pid 59804:tid 59820] [client 175.44.117.1:28254] [client 175.44.117.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adT3R3YVIXiPh5_eJTmnIAAAAg4"], referer: http://www.switchcreative.net/
[Tue Apr 07 20:29:37.206860 2026] [:error] [pid 37596:tid 37623] [client 112.207.213.251:45049] [client 112.207.213.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.207.213.251, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adT4sapaAOZHEjRWjP2csQAAABE"]
[Tue Apr 07 20:29:37.218145 2026] [proxy_fcgi:error] [pid 37596:tid 37623] [client 112.207.213.251:45049] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 20:48:30.137074 2026] [:error] [pid 59804:tid 59826] [client 182.42.110.255:54915] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adT9HnYVIXiPh5_eJTmtzQAAAhQ"]
[Tue Apr 07 21:16:11.686664 2026] [:error] [pid 37597:tid 37647] [client 170.106.193.108:52274] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adUDmw6uAY0QAy-8EEKVdAAAAE0"]
[Wed Apr 08 03:43:27.549891 2026] [:error] [pid 43738:tid 43750] [client 170.106.180.153:59324] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adVeXwjwY_KYpD8o1SfBmwAAAMo"]
[Wed Apr 08 03:54:01.965185 2026] [proxy_fcgi:error] [pid 16643:tid 16694] [client 66.249.69.141:58407] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:49.370350 2026] [proxy_fcgi:error] [pid 47625:tid 47642] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:49.613918 2026] [proxy_fcgi:error] [pid 47625:tid 47650] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:49.857387 2026] [proxy_fcgi:error] [pid 47625:tid 47639] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:50.100695 2026] [proxy_fcgi:error] [pid 47625:tid 47644] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:50.346006 2026] [proxy_fcgi:error] [pid 47625:tid 47647] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:50.590884 2026] [proxy_fcgi:error] [pid 47625:tid 47640] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:51.078362 2026] [proxy_fcgi:error] [pid 47625:tid 47641] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:10:51.324244 2026] [proxy_fcgi:error] [pid 47625:tid 47638] [client 68.221.128.217:43562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 04:54:54.038104 2026] [:error] [pid 47627:tid 47720] [client 49.51.141.76:59208] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adVvHnOljf1Quv_kDjmBfAAAAJU"]
[Wed Apr 08 05:16:00.611167 2026] [:error] [pid 47732:tid 47750] [client 104.28.163.34:41591] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adV0EIm4N5QW9Mh7G10r-wAAANA"]
[Wed Apr 08 05:16:00.948282 2026] [:error] [pid 47627:tid 47716] [client 104.28.163.34:41595] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adV0EHOljf1Quv_kDjmNogAAAJE"]
[Wed Apr 08 05:16:01.840196 2026] [:error] [pid 16630:tid 16633] [client 104.28.163.34:40338] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adV0ESjfVAkPG-jgJEqD5wAAAQE"]
[Wed Apr 08 08:31:29.935964 2026] [proxy_fcgi:error] [pid 47732:tid 47740] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:30.178952 2026] [proxy_fcgi:error] [pid 47732:tid 47746] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:30.424464 2026] [proxy_fcgi:error] [pid 47732:tid 47737] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:30.666915 2026] [proxy_fcgi:error] [pid 47732:tid 47741] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:30.911279 2026] [proxy_fcgi:error] [pid 47732:tid 47749] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:31.154504 2026] [proxy_fcgi:error] [pid 47732:tid 47748] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:31.639521 2026] [proxy_fcgi:error] [pid 47732:tid 47758] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 08:31:31.882656 2026] [proxy_fcgi:error] [pid 47732:tid 47755] [client 68.221.128.217:8562] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 09:25:39.736479 2026] [:error] [pid 47627:tid 47723] [client 103.168.67.159:7754] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adWuk3Oljf1Quv_kDjn0-wAAAJg"]
[Wed Apr 08 09:25:40.436822 2026] [:error] [pid 49984:tid 50004] [client 103.168.67.159:8142] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adWulOYY_Bz5lRHcJIE-rQAAAU4"]
[Wed Apr 08 09:25:41.146565 2026] [:error] [pid 544:tid 568] [client 103.168.67.159:8460] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adWulTieLKSoiLVA6YfDSQAAAZM"]
[Wed Apr 08 09:25:41.850974 2026] [:error] [pid 16630:tid 16652] [client 103.168.67.159:64062] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adWulSjfVAkPG-jgJEpRUgAAARQ"]
[Wed Apr 08 09:25:42.562749 2026] [:error] [pid 47626:tid 47682] [client 103.168.67.159:64424] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dashboard"] [unique_id "adWulqjWI8TWtHx2sdZKkQAAAE4"]
[Wed Apr 08 09:25:43.261138 2026] [:error] [pid 544:tid 554] [client 103.168.67.159:64844] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dashboard"] [unique_id "adWulzieLKSoiLVA6YfDZgAAAYU"]
[Wed Apr 08 09:25:43.969164 2026] [:error] [pid 47625:tid 47654] [client 103.168.67.159:65222] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dashboard"] [unique_id "adWulyVuHyNWzZlE8PA3ZAAAABQ"]
[Wed Apr 08 09:25:44.688435 2026] [:error] [pid 16630:tid 16634] [client 103.168.67.159:1060] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dashboard"] [unique_id "adWumCjfVAkPG-jgJEpRbQAAAQI"]
[Wed Apr 08 09:41:07.911129 2026] [:error] [pid 47625:tid 47653] [client 120.71.59.24:37776] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adWyMyVuHyNWzZlE8PBEBAAAABM"]
[Wed Apr 08 10:48:33.040366 2026] [:error] [pid 47625:tid 47652] [client 147.224.191.79:57618] [client 147.224.191.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.224.191.79, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adXCASVuHyNWzZlE8PB8hwAAABI"]
[Wed Apr 08 10:48:33.052121 2026] [proxy_fcgi:error] [pid 47625:tid 47652] [client 147.224.191.79:57618] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 10:48:33.445192 2026] [:error] [pid 49984:tid 50002] [client 147.224.191.79:57954] [client 147.224.191.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.224.191.79, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adXCAeYY_Bz5lRHcJIFMywAAAUw"], referer: https://www.google.com/search?q=wordpress
[Wed Apr 08 10:48:33.448886 2026] [proxy_fcgi:error] [pid 49984:tid 50002] [client 147.224.191.79:57954] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/search?q=wordpress
[Wed Apr 08 11:02:44.193128 2026] [proxy_fcgi:error] [pid 47625:tid 47655] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:44.454138 2026] [proxy_fcgi:error] [pid 47625:tid 47650] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:44.714339 2026] [proxy_fcgi:error] [pid 47625:tid 47652] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:44.975837 2026] [proxy_fcgi:error] [pid 47625:tid 47656] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:45.237050 2026] [proxy_fcgi:error] [pid 47625:tid 47643] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:45.494755 2026] [proxy_fcgi:error] [pid 47625:tid 47645] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:46.013777 2026] [proxy_fcgi:error] [pid 47625:tid 47649] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:02:46.274007 2026] [proxy_fcgi:error] [pid 47625:tid 47634] [client 20.215.49.238:38914] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 11:27:56.180335 2026] [:error] [pid 544:tid 571] [client 170.106.82.209:47626] [client 170.106.82.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adXLPDieLKSoiLVA6Yfj-gAAAZY"]
[Wed Apr 08 13:27:49.835153 2026] [:error] [pid 12453:tid 12477] [client 170.233.245.126:24532] [client 170.233.245.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.233.245.126, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adXnVRjtW7S6XsLPvrQUNAAAAJY"]
[Wed Apr 08 13:27:49.846529 2026] [proxy_fcgi:error] [pid 12453:tid 12477] [client 170.233.245.126:24532] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 13:50:32.711185 2026] [:error] [pid 12490:tid 12502] [client 216.24.210.41:64953] [client 216.24.210.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "adXsqG1Fea4F4fbumr16FAAAAMo"]
[Wed Apr 08 15:46:45.343462 2026] [:error] [pid 35642:tid 35663] [client 185.244.21.213:4167] [client 185.244.21.213] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=audio/x-ms-wma"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adYH5Q-CqryxdEs5DN-x2gAAAFM"]
[Wed Apr 08 15:46:45.721752 2026] [:error] [pid 35642:tid 35659] [client 185.244.21.213:4167] [client 185.244.21.213] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=audio/x-ms-wma"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adYH5Q-CqryxdEs5DN-x3AAAAE8"]
[Wed Apr 08 16:58:17.955751 2026] [:error] [pid 12453:tid 12466] [client 43.153.123.4:41878] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adYYqRjtW7S6XsLPvrSi2gAAAIs"]
[Wed Apr 08 17:07:58.059474 2026] [:error] [pid 12386:tid 12435] [client 54.37.252.192:56246] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adYa7hLhhLtqHi2gK7XHfwAAARM"]
[Wed Apr 08 17:08:00.017706 2026] [:error] [pid 12490:tid 12508] [client 54.37.252.192:46958] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adYa8G1Fea4F4fbumr1z_wAAANA"]
[Wed Apr 08 17:08:01.896665 2026] [:error] [pid 12386:tid 12427] [client 54.37.252.192:39346] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adYa8RLhhLtqHi2gK7XHgwAAAQs"]
[Wed Apr 08 17:08:03.893415 2026] [:error] [pid 12385:tid 12397] [client 54.37.252.192:39358] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adYa8yAjtvRQEkLosq1cqAAAAAg"]
[Wed Apr 08 17:08:05.947606 2026] [:error] [pid 12385:tid 12407] [client 54.37.252.192:39374] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adYa9SAjtvRQEkLosq1crAAAABI"]
[Wed Apr 08 17:08:07.821944 2026] [:error] [pid 12385:tid 12397] [client 54.37.252.192:39382] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adYa9yAjtvRQEkLosq1cswAAAAg"]
[Wed Apr 08 17:08:09.842475 2026] [:error] [pid 12385:tid 12402] [client 54.37.252.192:39392] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adYa-SAjtvRQEkLosq1ctwAAAA0"]
[Wed Apr 08 17:08:11.861230 2026] [:error] [pid 12453:tid 12472] [client 54.37.252.192:57574] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adYa-xjtW7S6XsLPvrSnDQAAAJE"]
[Wed Apr 08 17:08:13.584577 2026] [:error] [pid 12490:tid 12494] [client 54.37.252.192:57588] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adYa_W1Fea4F4fbumr10WQAAAMI"]
[Wed Apr 08 17:08:15.595913 2026] [:error] [pid 12453:tid 12459] [client 54.37.252.192:57592] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adYa_xjtW7S6XsLPvrSnIgAAAIQ"]
[Wed Apr 08 17:08:17.607124 2026] [:error] [pid 35642:tid 35661] [client 54.37.252.192:57594] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adYbAQ-CqryxdEs5DN_ttAAAAFE"]
[Wed Apr 08 17:08:19.610901 2026] [:error] [pid 12385:tid 12389] [client 54.37.252.192:57596] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adYbAyAjtvRQEkLosq1cvwAAAAA"]
[Wed Apr 08 17:08:21.614853 2026] [:error] [pid 12490:tid 12495] [client 54.37.252.192:58750] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adYbBW1Fea4F4fbumr10jgAAAMM"]
[Wed Apr 08 17:08:23.629538 2026] [:error] [pid 12490:tid 12508] [client 54.37.252.192:58764] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adYbB21Fea4F4fbumr10qQAAANA"]
[Wed Apr 08 17:08:25.639138 2026] [:error] [pid 12453:tid 12468] [client 54.37.252.192:58776] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adYbCRjtW7S6XsLPvrSnMAAAAI0"]
[Wed Apr 08 17:08:27.645594 2026] [:error] [pid 12490:tid 12500] [client 54.37.252.192:58780] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adYbC21Fea4F4fbumr10zQAAAMg"]
[Wed Apr 08 17:08:29.659143 2026] [:error] [pid 12490:tid 12492] [client 54.37.252.192:58784] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adYbDW1Fea4F4fbumr103AAAAMA"]
[Wed Apr 08 17:08:31.679760 2026] [:error] [pid 12453:tid 12470] [client 54.37.252.192:42862] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adYbDxjtW7S6XsLPvrSnOwAAAI8"]
[Wed Apr 08 17:08:33.685720 2026] [:error] [pid 12490:tid 12504] [client 54.37.252.192:42878] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adYbEW1Fea4F4fbumr107AAAAMw"]
[Wed Apr 08 17:08:35.673645 2026] [:error] [pid 12490:tid 12503] [client 54.37.252.192:42892] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adYbE21Fea4F4fbumr109AAAAMs"]
[Wed Apr 08 17:08:37.687084 2026] [:error] [pid 12385:tid 12406] [client 54.37.252.192:42902] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adYbFSAjtvRQEkLosq1c0wAAABE"]
[Wed Apr 08 17:08:39.673030 2026] [:error] [pid 35642:tid 35653] [client 54.37.252.192:42910] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adYbFw-CqryxdEs5DN_uFwAAAEk"]
[Wed Apr 08 17:08:41.668141 2026] [:error] [pid 12386:tid 12424] [client 54.37.252.192:44188] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adYbGRLhhLtqHi2gK7XHqQAAAQg"]
[Wed Apr 08 17:08:43.505217 2026] [:error] [pid 35642:tid 35652] [client 54.37.252.192:44204] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adYbGw-CqryxdEs5DN_uLgAAAEg"]
[Wed Apr 08 17:08:45.498138 2026] [:error] [pid 12386:tid 12427] [client 54.37.252.192:44214] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adYbHRLhhLtqHi2gK7XHrQAAAQs"]
[Wed Apr 08 17:08:47.737518 2026] [:error] [pid 12453:tid 12458] [client 54.37.252.192:36318] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adYbHxjtW7S6XsLPvrSnaAAAAIM"]
[Wed Apr 08 17:08:51.986869 2026] [:error] [pid 12490:tid 12502] [client 54.37.252.192:58150] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "adYbI21Fea4F4fbumr11HAAAAMo"]
[Wed Apr 08 17:08:54.413186 2026] [:error] [pid 35642:tid 35661] [client 54.37.252.192:39714] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adYbJg-CqryxdEs5DN_ucgAAAFE"]
[Wed Apr 08 17:09:16.965252 2026] [:error] [pid 12490:tid 12499] [client 54.37.252.192:39720] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adYbPG1Fea4F4fbumr110QAAAMc"]
[Wed Apr 08 17:09:19.196387 2026] [:error] [pid 12385:tid 12405] [client 54.37.252.192:33662] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adYbPyAjtvRQEkLosq1c_QAAABA"]
[Wed Apr 08 17:09:21.645336 2026] [:error] [pid 12453:tid 12467] [client 54.37.252.192:60988] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adYbQRjtW7S6XsLPvrSnmgAAAIw"]
[Wed Apr 08 17:09:23.642206 2026] [:error] [pid 12453:tid 12468] [client 54.37.252.192:32770] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adYbQxjtW7S6XsLPvrSnnwAAAI0"]
[Wed Apr 08 17:09:25.645205 2026] [:error] [pid 12490:tid 12495] [client 54.37.252.192:32780] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adYbRW1Fea4F4fbumr12FwAAAMM"]
[Wed Apr 08 17:09:27.639291 2026] [:error] [pid 12490:tid 12508] [client 54.37.252.192:32786] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adYbR21Fea4F4fbumr12GwAAANA"]
[Wed Apr 08 17:09:29.648798 2026] [:error] [pid 12385:tid 12410] [client 54.37.252.192:32788] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adYbSSAjtvRQEkLosq1dEQAAABU"]
[Wed Apr 08 17:09:31.648694 2026] [:error] [pid 35642:tid 35655] [client 54.37.252.192:52764] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adYbSw-CqryxdEs5DN_uzAAAAEs"]
[Wed Apr 08 17:09:34.105008 2026] [:error] [pid 35642:tid 35661] [client 54.37.252.192:52766] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adYbTg-CqryxdEs5DN_u1wAAAFE"]
[Wed Apr 08 17:09:36.577468 2026] [:error] [pid 12453:tid 12473] [client 54.37.252.192:52778] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adYbUBjtW7S6XsLPvrSnvQAAAJI"]
[Wed Apr 08 17:09:38.565202 2026] [:error] [pid 35642:tid 35663] [client 54.37.252.192:52782] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adYbUg-CqryxdEs5DN_u7AAAAFM"]
[Wed Apr 08 17:09:41.021637 2026] [:error] [pid 12385:tid 12390] [client 54.37.252.192:52794] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adYbVSAjtvRQEkLosq1dHgAAAAE"]
[Wed Apr 08 17:09:43.011251 2026] [:error] [pid 12386:tid 12425] [client 54.37.252.192:42430] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adYbVxLhhLtqHi2gK7XIJAAAAQk"]
[Wed Apr 08 17:09:44.993044 2026] [:error] [pid 12386:tid 12422] [client 54.37.252.192:42438] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adYbWBLhhLtqHi2gK7XIMQAAAQY"]
[Wed Apr 08 17:09:47.658014 2026] [:error] [pid 12386:tid 12418] [client 54.37.252.192:42454] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adYbWxLhhLtqHi2gK7XIQQAAAQI"]
[Wed Apr 08 17:09:51.398455 2026] [:error] [pid 12490:tid 12509] [client 54.37.252.192:53530] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adYbX21Fea4F4fbumr12YQAAANE"]
[Wed Apr 08 19:04:20.536801 2026] [:error] [pid 7047:tid 7055] [client 135.181.180.59:22292] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "adY2NONh3oGO3pKiCzzZiAAAAYY"]
[Wed Apr 08 19:04:22.363616 2026] [:error] [pid 7047:tid 7055] [client 135.181.180.59:62088] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "adY2NuNh3oGO3pKiCzzZlQAAAYY"]
[Wed Apr 08 19:04:24.933345 2026] [:error] [pid 64066:tid 64080] [client 135.181.180.59:22302] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "adY2OFR3WucJgr2vZGYimwAAAUs"]
[Wed Apr 08 19:04:26.895209 2026] [:error] [pid 64066:tid 64076] [client 135.181.180.59:43864] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adY2OlR3WucJgr2vZGYioAAAAUc"]
[Wed Apr 08 19:04:29.337594 2026] [:error] [pid 64066:tid 64078] [client 135.181.180.59:10082] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adY2PVR3WucJgr2vZGYipwAAAUk"]
[Wed Apr 08 19:04:31.348569 2026] [:error] [pid 7047:tid 7062] [client 135.181.180.59:43866] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adY2P-Nh3oGO3pKiCzzZowAAAY0"]
[Wed Apr 08 19:04:33.961768 2026] [:error] [pid 7047:tid 7053] [client 135.181.180.59:10088] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adY2QeNh3oGO3pKiCzzZtAAAAYQ"]
[Wed Apr 08 19:04:36.529565 2026] [:error] [pid 7047:tid 7060] [client 135.181.180.59:55300] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adY2RONh3oGO3pKiCzzZxQAAAYs"]
[Wed Apr 08 19:04:38.390896 2026] [:error] [pid 7189:tid 7204] [client 135.181.180.59:25430] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adY2RhaBqhBSu0L37lqvjwAAAc0"]
[Wed Apr 08 19:04:40.810655 2026] [:error] [pid 7189:tid 7194] [client 135.181.180.59:55308] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adY2SBaBqhBSu0L37lqvlAAAAcM"]
[Wed Apr 08 19:04:44.572121 2026] [:error] [pid 12453:tid 12478] [client 135.181.180.59:25434] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adY2TBjtW7S6XsLPvrT9QgAAAJc"]
[Wed Apr 08 19:04:47.168432 2026] [:error] [pid 7047:tid 7057] [client 135.181.180.59:42798] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adY2T-Nh3oGO3pKiCzzZ5QAAAYg"]
[Wed Apr 08 19:04:49.688058 2026] [:error] [pid 7189:tid 7197] [client 135.181.180.59:42814] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adY2URaBqhBSu0L37lqvoQAAAcY"]
[Wed Apr 08 19:04:51.541298 2026] [:error] [pid 7047:tid 7062] [client 135.181.180.59:59646] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adY2U-Nh3oGO3pKiCzzZ8wAAAY0"]
[Wed Apr 08 19:04:54.160961 2026] [:error] [pid 12385:tid 12397] [client 135.181.180.59:42818] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adY2ViAjtvRQEkLosq2QOwAAAAg"]
[Wed Apr 08 19:04:56.025389 2026] [:error] [pid 12453:tid 12465] [client 135.181.180.59:33106] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adY2WBjtW7S6XsLPvrT9agAAAIo"]
[Wed Apr 08 19:04:58.482650 2026] [:error] [pid 7047:tid 7055] [client 135.181.180.59:12136] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adY2WuNh3oGO3pKiCzzaFAAAAYY"]
[Wed Apr 08 19:05:00.984706 2026] [:error] [pid 7047:tid 7049] [client 135.181.180.59:12146] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adY2XONh3oGO3pKiCzzaMQAAAYA"]
[Wed Apr 08 19:05:02.866687 2026] [:error] [pid 7047:tid 7056] [client 135.181.180.59:33142] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adY2XuNh3oGO3pKiCzzaQAAAAYc"]
[Wed Apr 08 19:05:05.314695 2026] [:error] [pid 64066:tid 64087] [client 135.181.180.59:33214] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adY2YVR3WucJgr2vZGYi1gAAAVI"]
[Wed Apr 08 19:05:07.182875 2026] [:error] [pid 35642:tid 35647] [client 135.181.180.59:39050] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adY2Yw-CqryxdEs5DN9GwwAAAEM"]
[Wed Apr 08 19:05:09.821998 2026] [:error] [pid 7189:tid 7207] [client 135.181.180.59:33226] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adY2ZRaBqhBSu0L37lqv5gAAAdA"]
[Wed Apr 08 19:05:11.809398 2026] [:error] [pid 35642:tid 35660] [client 135.181.180.59:39058] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adY2Zw-CqryxdEs5DN9GyQAAAFA"]
[Wed Apr 08 19:05:14.265740 2026] [:error] [pid 12386:tid 12434] [client 135.181.180.59:33238] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adY2ahLhhLtqHi2gK7UImwAAARI"]
[Wed Apr 08 19:05:48.539185 2026] [:error] [pid 12386:tid 12417] [client 135.181.180.59:61042] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adY2jBLhhLtqHi2gK7UIuwAAAQE"]
[Wed Apr 08 19:05:51.134757 2026] [:error] [pid 12453:tid 12467] [client 135.181.180.59:61050] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adY2jxjtW7S6XsLPvrT98wAAAIw"]
[Wed Apr 08 19:05:53.089564 2026] [:error] [pid 12385:tid 12403] [client 135.181.180.59:24808] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "adY2kSAjtvRQEkLosq2QXQAAAA4"]
[Wed Apr 08 19:05:55.073343 2026] [:error] [pid 7047:tid 7052] [client 135.181.180.59:14494] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "adY2k-Nh3oGO3pKiCzza4gAAAYM"]
[Wed Apr 08 19:05:57.552970 2026] [:error] [pid 64066:tid 64076] [client 135.181.180.59:20718] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "adY2lVR3WucJgr2vZGYjBQAAAUc"]
[Wed Apr 08 19:06:03.191363 2026] [:error] [pid 7047:tid 7073] [client 135.181.180.59:14498] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adY2m-Nh3oGO3pKiCzza-wAAAZg"]
[Wed Apr 08 19:06:05.647995 2026] [:error] [pid 12453:tid 12467] [client 135.181.180.59:29462] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "adY2nRjtW7S6XsLPvrT-BwAAAIw"]
[Wed Apr 08 19:06:08.066568 2026] [:error] [pid 12385:tid 12399] [client 135.181.180.59:29466] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adY2oCAjtvRQEkLosq2QYwAAAAo"]
[Wed Apr 08 19:06:09.995625 2026] [:error] [pid 7189:tid 7209] [client 135.181.180.59:25346] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adY2oRaBqhBSu0L37lqwNgAAAdI"]
[Wed Apr 08 19:06:12.435186 2026] [:error] [pid 7189:tid 7204] [client 135.181.180.59:29480] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adY2pBaBqhBSu0L37lqwOQAAAc0"]
[Wed Apr 08 19:06:14.902894 2026] [:error] [pid 12453:tid 12477] [client 135.181.180.59:29490] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adY2phjtW7S6XsLPvrT-GgAAAJY"]
[Wed Apr 08 19:06:17.351287 2026] [:error] [pid 12453:tid 12471] [client 135.181.180.59:5614] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adY2qRjtW7S6XsLPvrT-HQAAAJA"]
[Wed Apr 08 19:06:25.733846 2026] [:error] [pid 7047:tid 7055] [client 135.181.180.59:25154] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adY2seNh3oGO3pKiCzzbLAAAAYY"]
[Wed Apr 08 19:06:27.713732 2026] [:error] [pid 7047:tid 7068] [client 135.181.180.59:44128] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adY2s-Nh3oGO3pKiCzzbNwAAAZM"]
[Wed Apr 08 19:06:29.610714 2026] [:error] [pid 7047:tid 7055] [client 135.181.180.59:44130] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adY2teNh3oGO3pKiCzzbQgAAAYY"]
[Wed Apr 08 19:06:32.285792 2026] [:error] [pid 35642:tid 35644] [client 135.181.180.59:25166] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adY2uA-CqryxdEs5DN9G7gAAAEA"]
[Wed Apr 08 19:06:34.241163 2026] [:error] [pid 7047:tid 7050] [client 135.181.180.59:44132] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adY2uuNh3oGO3pKiCzzbUgAAAYE"]
[Wed Apr 08 19:06:36.279057 2026] [:error] [pid 12490:tid 12498] [client 135.181.180.59:64164] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adY2vG1Fea4F4fbumr3qQwAAAMY"]
[Wed Apr 08 19:06:38.414413 2026] [:error] [pid 12386:tid 12433] [client 135.181.180.59:64168] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adY2vhLhhLtqHi2gK7UIywAAARE"]
[Wed Apr 08 19:06:42.131567 2026] [:error] [pid 64066:tid 64090] [client 135.181.180.59:15758] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adY2wlR3WucJgr2vZGYjMwAAAVU"]
[Wed Apr 08 19:06:44.681504 2026] [:error] [pid 7189:tid 7205] [client 135.181.180.59:15760] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adY2xBaBqhBSu0L37lqwawAAAc4"]
[Wed Apr 08 19:07:13.592631 2026] [:error] [pid 7047:tid 7072] [client 135.181.180.59:27582] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adY24eNh3oGO3pKiCzzbdAAAAZc"]
[Wed Apr 08 19:07:15.552009 2026] [:error] [pid 35642:tid 35650] [client 135.181.180.59:38762] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adY24w-CqryxdEs5DN9HCQAAAEY"]
[Wed Apr 08 19:07:18.137273 2026] [:error] [pid 7189:tid 7201] [client 135.181.180.59:25428] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adY25haBqhBSu0L37lqwcgAAAco"]
[Wed Apr 08 19:07:19.978954 2026] [:error] [pid 64066:tid 64074] [client 135.181.180.59:38768] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adY251R3WucJgr2vZGYjegAAAUU"]
[Wed Apr 08 19:07:22.472213 2026] [:error] [pid 35642:tid 35645] [client 135.181.180.59:25440] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adY26g-CqryxdEs5DN9HFQAAAEE"]
[Wed Apr 08 19:07:24.390205 2026] [:error] [pid 12385:tid 12412] [client 135.181.180.59:38774] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adY27CAjtvRQEkLosq2QhgAAABc"]
[Wed Apr 08 19:07:26.375207 2026] [:error] [pid 7189:tid 7195] [client 135.181.180.59:33180] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adY27haBqhBSu0L37lqwfgAAAcQ"]
[Wed Apr 08 19:07:28.494499 2026] [:error] [pid 64066:tid 64092] [client 135.181.180.59:33182] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adY28FR3WucJgr2vZGYjiAAAAVc"]
[Wed Apr 08 19:07:30.939661 2026] [:error] [pid 7047:tid 7063] [client 135.181.180.59:13100] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adY28uNh3oGO3pKiCzzbiQAAAY4"]
[Wed Apr 08 19:07:32.961263 2026] [:error] [pid 35642:tid 35653] [client 135.181.180.59:33194] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adY29A-CqryxdEs5DN9HKgAAAEk"]
[Wed Apr 08 19:07:35.255973 2026] [:error] [pid 12386:tid 12424] [client 135.181.180.59:40034] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adY29xLhhLtqHi2gK7UI-gAAAQg"]
[Wed Apr 08 19:07:37.203680 2026] [:error] [pid 7189:tid 7206] [client 135.181.180.59:40044] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adY2-RaBqhBSu0L37lqwjQAAAc8"]
[Wed Apr 08 19:07:39.236545 2026] [:error] [pid 7189:tid 7211] [client 135.181.180.59:40054] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adY2-xaBqhBSu0L37lqwkQAAAdQ"]
[Wed Apr 08 19:07:41.787633 2026] [:error] [pid 7047:tid 7070] [client 135.181.180.59:24564] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adY2_eNh3oGO3pKiCzzbpAAAAZU"]
[Wed Apr 08 19:07:43.768327 2026] [:error] [pid 7047:tid 7059] [client 135.181.180.59:40068] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adY2_-Nh3oGO3pKiCzzbsAAAAYo"]
[Wed Apr 08 19:07:45.851672 2026] [:error] [pid 12453:tid 12456] [client 135.181.180.59:31814] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adY3ARjtW7S6XsLPvrT-aAAAAIE"]
[Wed Apr 08 19:07:47.920313 2026] [:error] [pid 7047:tid 7058] [client 135.181.180.59:31818] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adY3A-Nh3oGO3pKiCzzbuAAAAYk"]
[Wed Apr 08 19:07:49.994470 2026] [:error] [pid 64066:tid 64088] [client 135.181.180.59:31830] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "adY3BVR3WucJgr2vZGYjmgAAAVM"]
[Wed Apr 08 19:07:51.949366 2026] [:error] [pid 12453:tid 12479] [client 135.181.180.59:31840] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adY3BxjtW7S6XsLPvrT-bwAAAJg"]
[Wed Apr 08 19:07:54.470746 2026] [:error] [pid 7189:tid 7204] [client 135.181.180.59:35292] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adY3ChaBqhBSu0L37lqwoQAAAc0"]
[Wed Apr 08 19:07:57.051093 2026] [:error] [pid 12385:tid 12413] [client 135.181.180.59:50472] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adY3DSAjtvRQEkLosq2QmAAAABg"]
[Wed Apr 08 19:07:59.044220 2026] [:error] [pid 7189:tid 7193] [client 135.181.180.59:3610] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adY3DxaBqhBSu0L37lqwpAAAAcI"]
[Wed Apr 08 19:08:00.997569 2026] [:error] [pid 35642:tid 35648] [client 135.181.180.59:3612] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adY3EA-CqryxdEs5DN9HNQAAAEQ"]
[Wed Apr 08 19:08:03.461015 2026] [:error] [pid 35642:tid 35660] [client 135.181.180.59:50478] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adY3Ew-CqryxdEs5DN9HNgAAAFA"]
[Wed Apr 08 19:08:06.142626 2026] [:error] [pid 12385:tid 12391] [client 135.181.180.59:16646] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adY3FiAjtvRQEkLosq2QnwAAAAI"]
[Wed Apr 08 19:08:08.168066 2026] [:error] [pid 12385:tid 12400] [client 135.181.180.59:26554] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adY3GCAjtvRQEkLosq2QoQAAAAs"]
[Wed Apr 08 19:08:36.584876 2026] [:error] [pid 12386:tid 12426] [client 135.181.180.59:47692] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adY3NBLhhLtqHi2gK7UJHwAAAQo"]
[Wed Apr 08 19:08:39.129512 2026] [:error] [pid 7047:tid 7054] [client 135.181.180.59:47696] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adY3N-Nh3oGO3pKiCzzb4gAAAYU"]
[Wed Apr 08 19:08:41.652867 2026] [:error] [pid 12385:tid 12394] [client 135.181.180.59:47708] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adY3OSAjtvRQEkLosq2QvgAAAAU"]
[Wed Apr 08 19:08:44.188463 2026] [:error] [pid 7189:tid 7205] [client 135.181.180.59:47716] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adY3PBaBqhBSu0L37lqw0wAAAc4"]
[Wed Apr 08 19:08:46.808117 2026] [:error] [pid 7047:tid 7054] [client 135.181.180.59:63620] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adY3PuNh3oGO3pKiCzzb8gAAAYU"]
[Wed Apr 08 19:08:49.293377 2026] [:error] [pid 12385:tid 12412] [client 135.181.180.59:63624] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adY3QSAjtvRQEkLosq2QwgAAABc"]
[Wed Apr 08 19:08:51.695605 2026] [:error] [pid 7047:tid 7065] [client 135.181.180.59:63636] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adY3Q-Nh3oGO3pKiCzzcAQAAAZA"]
[Wed Apr 08 19:08:54.226063 2026] [:error] [pid 7047:tid 7063] [client 135.181.180.59:63638] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adY3RuNh3oGO3pKiCzzcDQAAAY4"]
[Wed Apr 08 19:08:56.721610 2026] [:error] [pid 7189:tid 7203] [client 135.181.180.59:20988] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adY3SBaBqhBSu0L37lqw8gAAAcw"]
[Wed Apr 08 19:08:59.256024 2026] [:error] [pid 7047:tid 7053] [client 135.181.180.59:20994] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adY3S-Nh3oGO3pKiCzzcJgAAAYQ"]
[Wed Apr 08 19:09:01.741877 2026] [:error] [pid 64066:tid 64077] [client 135.181.180.59:21008] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adY3TVR3WucJgr2vZGYj3gAAAUg"]
[Wed Apr 08 19:09:04.221993 2026] [:error] [pid 7047:tid 7060] [client 135.181.180.59:21012] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adY3UONh3oGO3pKiCzzcNAAAAYs"]
[Wed Apr 08 19:09:06.705997 2026] [:error] [pid 7047:tid 7061] [client 135.181.180.59:20380] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adY3UuNh3oGO3pKiCzzcNwAAAYw"]
[Wed Apr 08 19:09:09.209097 2026] [:error] [pid 7047:tid 7070] [client 135.181.180.59:20386] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adY3VeNh3oGO3pKiCzzcQwAAAZU"]
[Wed Apr 08 19:09:11.683832 2026] [:error] [pid 12453:tid 12464] [client 135.181.180.59:20400] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adY3VxjtW7S6XsLPvrT_BAAAAIk"]
[Wed Apr 08 19:09:14.203325 2026] [:error] [pid 7047:tid 7065] [client 135.181.180.59:20402] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adY3WuNh3oGO3pKiCzzcWgAAAZA"]
[Wed Apr 08 19:09:16.539024 2026] [:error] [pid 12453:tid 12460] [client 135.181.180.59:11460] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adY3XBjtW7S6XsLPvrT_CQAAAIU"]
[Wed Apr 08 19:09:18.347470 2026] [:error] [pid 7047:tid 7049] [client 135.181.180.59:27590] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adY3XuNh3oGO3pKiCzzcZAAAAYA"]
[Wed Apr 08 19:09:22.244985 2026] [:error] [pid 12453:tid 12475] [client 135.181.180.59:27596] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adY3YhjtW7S6XsLPvrT_DgAAAJQ"]
[Wed Apr 08 21:39:55.846979 2026] [proxy_fcgi:error] [pid 64066:tid 64080] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:56.478417 2026] [proxy_fcgi:error] [pid 64066:tid 64085] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:57.367390 2026] [proxy_fcgi:error] [pid 64066:tid 64078] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:57.626251 2026] [proxy_fcgi:error] [pid 64066:tid 64089] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:57.884980 2026] [proxy_fcgi:error] [pid 64066:tid 64076] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:58.148857 2026] [proxy_fcgi:error] [pid 64066:tid 64077] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:58.726109 2026] [proxy_fcgi:error] [pid 64066:tid 64090] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:58.986972 2026] [proxy_fcgi:error] [pid 64066:tid 64073] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:59.248057 2026] [proxy_fcgi:error] [pid 64066:tid 64085] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:59.510031 2026] [proxy_fcgi:error] [pid 64066:tid 64079] [client 74.248.135.90:25295] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:39:59.775606 2026] [:error] [pid 64066:tid 64078] [client 74.248.135.90:25295] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shout.php"] [unique_id "adZar1R3WucJgr2vZGZNgAAAAUk"]
[Wed Apr 08 21:40:02.918604 2026] [:error] [pid 64066:tid 64090] [client 74.248.135.90:38284] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shout.php"] [unique_id "adZaslR3WucJgr2vZGZNlwAAAVU"]
[Wed Apr 08 21:40:06.247007 2026] [:error] [pid 7189:tid 7201] [client 74.248.135.90:25765] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shout.php"] [unique_id "adZathaBqhBSu0L37lrl-gAAAco"]
[Wed Apr 08 21:40:10.250704 2026] [:error] [pid 64066:tid 64073] [client 74.248.135.90:32360] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shout.php"] [unique_id "adZaulR3WucJgr2vZGZNvgAAAUQ"]
[Wed Apr 08 21:40:13.453412 2026] [:error] [pid 12386:tid 12427] [client 74.248.135.90:32341] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "adZavRLhhLtqHi2gK7UgegAAAQs"]
[Wed Apr 08 21:40:16.931901 2026] [:error] [pid 12490:tid 12495] [client 74.248.135.90:5083] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "adZawG1Fea4F4fbumr0OSgAAAMM"]
[Wed Apr 08 21:40:25.452029 2026] [:error] [pid 35642:tid 35646] [client 74.248.135.90:25741] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/size.php"] [unique_id "adZayQ-CqryxdEs5DN9jcAAAAEI"]
[Wed Apr 08 21:40:28.311347 2026] [:error] [pid 12453:tid 12472] [client 74.248.135.90:5091] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "adZazBjtW7S6XsLPvrRDpQAAAJE"]
[Wed Apr 08 21:40:32.898440 2026] [:error] [pid 35642:tid 35644] [client 74.248.135.90:5094] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "adZa0A-CqryxdEs5DN9jcwAAAEA"]
[Wed Apr 08 21:40:36.958463 2026] [:error] [pid 12453:tid 12474] [client 74.248.135.90:24112] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-gr.php"] [unique_id "adZa1BjtW7S6XsLPvrRDrQAAAJM"]
[Wed Apr 08 21:40:45.974207 2026] [:error] [pid 64066:tid 64072] [client 74.248.135.90:4859] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "adZa3VR3WucJgr2vZGZOYwAAAUM"]
[Wed Apr 08 21:40:49.142368 2026] [:error] [pid 64066:tid 64090] [client 74.248.135.90:51407] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "adZa4VR3WucJgr2vZGZOdAAAAVU"]
[Wed Apr 08 21:40:50.191252 2026] [:error] [pid 12453:tid 12474] [client 74.248.135.90:22599] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "adZa4hjtW7S6XsLPvrRDxAAAAJM"]
[Wed Apr 08 21:40:53.232068 2026] [:error] [pid 12490:tid 12514] [client 74.248.135.90:51425] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mn.php"] [unique_id "adZa5W1Fea4F4fbumr0OrAAAANY"]
[Wed Apr 08 21:40:54.678075 2026] [:error] [pid 12386:tid 12440] [client 74.248.135.90:59933] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mt.php"] [unique_id "adZa5hLhhLtqHi2gK7UgqAAAARg"]
[Wed Apr 08 21:40:56.811979 2026] [:error] [pid 64066:tid 64084] [client 74.248.135.90:4128] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mt.php"] [unique_id "adZa6FR3WucJgr2vZGZOhAAAAU8"]
[Wed Apr 08 21:40:58.385540 2026] [:error] [pid 12453:tid 12465] [client 74.248.135.90:65493] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mt.php"] [unique_id "adZa6hjtW7S6XsLPvrRD1QAAAIo"]
[Wed Apr 08 21:41:04.708784 2026] [proxy_fcgi:error] [pid 64066:tid 64093] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:04.968844 2026] [proxy_fcgi:error] [pid 64066:tid 64092] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:05.371194 2026] [proxy_fcgi:error] [pid 64066:tid 64084] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:05.631286 2026] [proxy_fcgi:error] [pid 64066:tid 64087] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:05.936018 2026] [proxy_fcgi:error] [pid 64066:tid 64070] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:06.205985 2026] [proxy_fcgi:error] [pid 64066:tid 64071] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:06.468456 2026] [proxy_fcgi:error] [pid 64066:tid 64091] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:06.727011 2026] [proxy_fcgi:error] [pid 64066:tid 64081] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:06.986452 2026] [proxy_fcgi:error] [pid 64066:tid 64070] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:07.245838 2026] [proxy_fcgi:error] [pid 64066:tid 64080] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:07.504924 2026] [proxy_fcgi:error] [pid 64066:tid 64083] [client 74.248.135.90:45022] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:41:07.783348 2026] [:error] [pid 64066:tid 64089] [client 74.248.135.90:45022] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ar.php"] [unique_id "adZa81R3WucJgr2vZGZOwAAAAVQ"]
[Wed Apr 08 21:41:17.659008 2026] [:error] [pid 12490:tid 12495] [client 74.248.135.90:4384] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ar.php"] [unique_id "adZa_W1Fea4F4fbumr0PBgAAAMM"]
[Wed Apr 08 21:41:34.740509 2026] [:error] [pid 64066:tid 64089] [client 74.248.135.90:41935] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qing.php"] [unique_id "adZbDlR3WucJgr2vZGZPAwAAAVQ"]
[Wed Apr 08 21:41:39.225156 2026] [:error] [pid 12386:tid 12416] [client 74.248.135.90:37119] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adZbExLhhLtqHi2gK7UgtgAAAQA"]
[Wed Apr 08 21:41:40.194830 2026] [:error] [pid 7047:tid 7051] [client 74.248.135.90:33501] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adZbFONh3oGO3pKiCzw1lwAAAYI"]
[Wed Apr 08 21:41:40.997326 2026] [:error] [pid 64066:tid 64076] [client 74.248.135.90:40751] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adZbFFR3WucJgr2vZGZPDwAAAUc"]
[Wed Apr 08 21:41:42.702567 2026] [:error] [pid 12386:tid 12437] [client 74.248.135.90:4420] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adZbFhLhhLtqHi2gK7UguQAAARU"]
[Wed Apr 08 21:41:43.604950 2026] [:error] [pid 64066:tid 64087] [client 74.248.135.90:26963] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mms.php"] [unique_id "adZbF1R3WucJgr2vZGZPHwAAAVI"]
[Wed Apr 08 21:41:46.249592 2026] [:error] [pid 35642:tid 35667] [client 74.248.135.90:40159] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mms.php"] [unique_id "adZbGg-CqryxdEs5DN9jkAAAAFc"]
[Wed Apr 08 21:41:48.486072 2026] [:error] [pid 12453:tid 12477] [client 74.248.135.90:33477] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mms.php"] [unique_id "adZbHBjtW7S6XsLPvrREkAAAAJY"]
[Wed Apr 08 21:41:53.501224 2026] [:error] [pid 64066:tid 64072] [client 74.248.135.90:26968] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mms.php"] [unique_id "adZbIVR3WucJgr2vZGZPXQAAAUM"]
[Wed Apr 08 21:42:00.035063 2026] [:error] [pid 12386:tid 12435] [client 74.248.135.90:5037] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gmo.php"] [unique_id "adZbKBLhhLtqHi2gK7UgvQAAARM"]
[Wed Apr 08 21:42:09.306049 2026] [proxy_fcgi:error] [pid 12490:tid 12501] [client 74.248.135.90:39628] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:12.209589 2026] [proxy_fcgi:error] [pid 7047:tid 7067] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:12.471554 2026] [proxy_fcgi:error] [pid 7047:tid 7055] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:12.732759 2026] [proxy_fcgi:error] [pid 7047:tid 7050] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:12.996766 2026] [proxy_fcgi:error] [pid 7047:tid 7072] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:13.271942 2026] [proxy_fcgi:error] [pid 7047:tid 7060] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:13.673942 2026] [proxy_fcgi:error] [pid 7047:tid 7062] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:13.933880 2026] [proxy_fcgi:error] [pid 7047:tid 7051] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:14.201077 2026] [proxy_fcgi:error] [pid 7047:tid 7058] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:14.473706 2026] [proxy_fcgi:error] [pid 7047:tid 7052] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:14.733291 2026] [proxy_fcgi:error] [pid 7047:tid 7063] [client 74.248.135.90:39650] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:42:15.591433 2026] [:error] [pid 7047:tid 7059] [client 74.248.135.90:39650] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adZbN-Nh3oGO3pKiCzw1qwAAAYo"]
[Wed Apr 08 21:42:21.468632 2026] [:error] [pid 64066:tid 64083] [client 74.248.135.90:61427] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adZbPVR3WucJgr2vZGZP1wAAAU4"]
[Wed Apr 08 21:42:36.061276 2026] [:error] [pid 12490:tid 12513] [client 74.248.135.90:31704] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/02.php"] [unique_id "adZbTG1Fea4F4fbumr0PqgAAANU"]
[Wed Apr 08 21:42:38.016956 2026] [:error] [pid 35642:tid 35644] [client 74.248.135.90:31730] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/02.php"] [unique_id "adZbTg-CqryxdEs5DN9j_QAAAEA"]
[Wed Apr 08 21:42:41.162518 2026] [:error] [pid 12490:tid 12500] [client 74.248.135.90:4721] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/02.php"] [unique_id "adZbUW1Fea4F4fbumr0PyAAAAMg"]
[Wed Apr 08 21:42:43.200084 2026] [:error] [pid 12490:tid 12499] [client 74.248.135.90:26524] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/02.php"] [unique_id "adZbU21Fea4F4fbumr0P0QAAAMc"]
[Wed Apr 08 21:42:46.560698 2026] [:error] [pid 64066:tid 64070] [client 74.248.135.90:46416] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adZbVlR3WucJgr2vZGZQEgAAAUE"]
[Wed Apr 08 21:42:49.341957 2026] [:error] [pid 35642:tid 35650] [client 74.248.135.90:42782] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adZbWQ-CqryxdEs5DN9kAAAAAEY"]
[Wed Apr 08 21:42:51.207062 2026] [:error] [pid 12453:tid 12471] [client 74.248.135.90:28799] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adZbWxjtW7S6XsLPvrRFDAAAAJA"]
[Wed Apr 08 21:42:53.332707 2026] [:error] [pid 64066:tid 64085] [client 74.248.135.90:26516] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adZbXVR3WucJgr2vZGZQJAAAAVA"]
[Wed Apr 08 21:42:54.532812 2026] [:error] [pid 35642:tid 35654] [client 74.248.135.90:26882] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adZbXg-CqryxdEs5DN9kAwAAAEo"]
[Wed Apr 08 21:42:56.214472 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:45902] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adZbYFR3WucJgr2vZGZQNQAAAVg"]
[Wed Apr 08 21:42:57.935062 2026] [:error] [pid 64066:tid 64091] [client 74.248.135.90:37755] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adZbYVR3WucJgr2vZGZQQQAAAVY"]
[Wed Apr 08 21:43:00.209470 2026] [:error] [pid 64066:tid 64074] [client 74.248.135.90:36604] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adZbZFR3WucJgr2vZGZQTAAAAUU"]
[Wed Apr 08 21:43:01.205529 2026] [:error] [pid 12490:tid 12510] [client 74.248.135.90:36564] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13k.php"] [unique_id "adZbZW1Fea4F4fbumr0P-wAAANI"]
[Wed Apr 08 21:43:02.948488 2026] [:error] [pid 7189:tid 7195] [client 74.248.135.90:36544] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13k.php"] [unique_id "adZbZhaBqhBSu0L37lrmZQAAAcQ"]
[Wed Apr 08 21:43:07.733087 2026] [:error] [pid 12490:tid 12513] [client 74.248.135.90:36576] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13k.php"] [unique_id "adZba21Fea4F4fbumr0QBwAAANU"]
[Wed Apr 08 21:43:09.871380 2026] [:error] [pid 64066:tid 64071] [client 74.248.135.90:4215] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13k.php"] [unique_id "adZbbVR3WucJgr2vZGZQXQAAAUI"]
[Wed Apr 08 21:43:11.751507 2026] [:error] [pid 7047:tid 7071] [client 74.248.135.90:4213] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css.php"] [unique_id "adZbb-Nh3oGO3pKiCzw14gAAAZY"]
[Wed Apr 08 21:43:15.266248 2026] [proxy_fcgi:error] [pid 64066:tid 64085] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:15.525087 2026] [proxy_fcgi:error] [pid 64066:tid 64079] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:15.786783 2026] [proxy_fcgi:error] [pid 64066:tid 64071] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:16.185818 2026] [proxy_fcgi:error] [pid 64066:tid 64080] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:16.445093 2026] [proxy_fcgi:error] [pid 64066:tid 64078] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:17.412602 2026] [proxy_fcgi:error] [pid 64066:tid 64083] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:17.945659 2026] [proxy_fcgi:error] [pid 64066:tid 64090] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:18.705289 2026] [proxy_fcgi:error] [pid 64066:tid 64077] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:18.967401 2026] [proxy_fcgi:error] [pid 64066:tid 64084] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:19.233056 2026] [proxy_fcgi:error] [pid 64066:tid 64088] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:19.513826 2026] [proxy_fcgi:error] [pid 64066:tid 64093] [client 74.248.135.90:34465] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:43:19.787129 2026] [:error] [pid 64066:tid 64086] [client 74.248.135.90:34465] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "adZbd1R3WucJgr2vZGZQqwAAAVE"]
[Wed Apr 08 21:43:20.691120 2026] [:error] [pid 12490:tid 12507] [client 74.248.135.90:29215] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "adZbeG1Fea4F4fbumr0QQAAAAM8"]
[Wed Apr 08 21:43:21.462526 2026] [:error] [pid 12490:tid 12506] [client 74.248.135.90:28716] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "adZbeW1Fea4F4fbumr0QQwAAAM4"]
[Wed Apr 08 21:43:22.350200 2026] [:error] [pid 64066:tid 64074] [client 74.248.135.90:30569] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pepe.php"] [unique_id "adZbelR3WucJgr2vZGZQrwAAAUU"]
[Wed Apr 08 21:43:23.138619 2026] [:error] [pid 12386:tid 12416] [client 74.248.135.90:22953] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "adZbexLhhLtqHi2gK7Ug1wAAAQA"]
[Wed Apr 08 21:43:24.298106 2026] [:error] [pid 12386:tid 12420] [client 74.248.135.90:22943] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "adZbfBLhhLtqHi2gK7Ug2AAAAQQ"]
[Wed Apr 08 21:43:25.450256 2026] [:error] [pid 12386:tid 12417] [client 74.248.135.90:50939] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "adZbfRLhhLtqHi2gK7Ug2gAAAQE"]
[Wed Apr 08 21:43:27.838459 2026] [:error] [pid 64066:tid 64069] [client 74.248.135.90:28733] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "adZbf1R3WucJgr2vZGZQtQAAAUA"]
[Wed Apr 08 21:43:29.747272 2026] [:error] [pid 12386:tid 12419] [client 74.248.135.90:22912] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adZbgRLhhLtqHi2gK7Ug3gAAAQM"]
[Wed Apr 08 21:43:31.695536 2026] [:error] [pid 12386:tid 12427] [client 74.248.135.90:29246] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adZbgxLhhLtqHi2gK7Ug4AAAAQs"]
[Wed Apr 08 21:43:36.258031 2026] [:error] [pid 7189:tid 7208] [client 74.248.135.90:26113] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adZbiBaBqhBSu0L37lrmbQAAAdE"]
[Wed Apr 08 21:43:39.171728 2026] [:error] [pid 12453:tid 12461] [client 74.248.135.90:22014] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adZbixjtW7S6XsLPvrRFWgAAAIY"]
[Wed Apr 08 21:43:46.479868 2026] [:error] [pid 12490:tid 12505] [client 74.248.135.90:26620] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "adZbkm1Fea4F4fbumr0QfgAAAM0"]
[Wed Apr 08 21:43:58.322482 2026] [:error] [pid 64066:tid 64093] [client 74.248.135.90:46519] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adZbnlR3WucJgr2vZGZRkwAAAVg"]
[Wed Apr 08 21:43:59.628025 2026] [:error] [pid 12453:tid 12460] [client 74.248.135.90:44935] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adZbnxjtW7S6XsLPvrRFdgAAAIU"]
[Wed Apr 08 21:44:00.570535 2026] [:error] [pid 64066:tid 64084] [client 74.248.135.90:38368] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adZboFR3WucJgr2vZGZRogAAAU8"]
[Wed Apr 08 21:44:03.947106 2026] [:error] [pid 64066:tid 64072] [client 74.248.135.90:41380] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adZbo1R3WucJgr2vZGZRtQAAAUM"]
[Wed Apr 08 21:44:05.527697 2026] [:error] [pid 12453:tid 12458] [client 74.248.135.90:38392] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adZbpRjtW7S6XsLPvrRFeQAAAIM"]
[Wed Apr 08 21:44:09.043206 2026] [:error] [pid 12385:tid 12391] [client 74.248.135.90:41386] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adZbqSAjtvRQEkLosq2lYgAAAAI"]
[Wed Apr 08 21:44:20.939632 2026] [proxy_fcgi:error] [pid 64066:tid 64089] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:21.555826 2026] [proxy_fcgi:error] [pid 64066:tid 64093] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:21.814369 2026] [proxy_fcgi:error] [pid 64066:tid 64081] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:22.087904 2026] [proxy_fcgi:error] [pid 64066:tid 64082] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:22.373384 2026] [proxy_fcgi:error] [pid 64066:tid 64091] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:22.632098 2026] [proxy_fcgi:error] [pid 64066:tid 64088] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:22.994354 2026] [proxy_fcgi:error] [pid 64066:tid 64076] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:23.411853 2026] [proxy_fcgi:error] [pid 64066:tid 64087] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:23.962666 2026] [proxy_fcgi:error] [pid 64066:tid 64086] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:24.285499 2026] [proxy_fcgi:error] [pid 64066:tid 64078] [client 74.248.135.90:30471] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 21:44:24.541104 2026] [:error] [pid 64066:tid 64085] [client 74.248.135.90:30471] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adZbuFR3WucJgr2vZGZSFQAAAVA"]
[Wed Apr 08 21:44:25.753725 2026] [:error] [pid 7047:tid 7064] [client 74.248.135.90:30498] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adZbueNh3oGO3pKiCzw2DQAAAY8"]
[Wed Apr 08 21:44:27.538524 2026] [:error] [pid 35642:tid 35659] [client 74.248.135.90:24963] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adZbuw-CqryxdEs5DN9kOwAAAE8"]
[Wed Apr 08 21:44:31.070290 2026] [:error] [pid 7047:tid 7056] [client 74.248.135.90:32697] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "adZbv-Nh3oGO3pKiCzw2DwAAAYc"]
[Wed Apr 08 21:44:33.423530 2026] [:error] [pid 7047:tid 7050] [client 74.248.135.90:43713] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/html.php"] [unique_id "adZbweNh3oGO3pKiCzw2EwAAAYE"]
[Wed Apr 08 21:44:35.863046 2026] [:error] [pid 64066:tid 64080] [client 74.248.135.90:29269] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/html.php"] [unique_id "adZbw1R3WucJgr2vZGZSPAAAAUs"]
[Wed Apr 08 21:44:39.458682 2026] [:error] [pid 64066:tid 64078] [client 74.248.135.90:43768] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/html.php"] [unique_id "adZbx1R3WucJgr2vZGZSSwAAAUk"]
[Wed Apr 08 21:44:41.037345 2026] [:error] [pid 64066:tid 64074] [client 74.248.135.90:32308] [client 74.248.135.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/html.php"] [unique_id "adZbyVR3WucJgr2vZGZSTwAAAUU"]
[Wed Apr 08 22:57:45.543821 2026] [:error] [pid 12386:tid 12436] [client 49.233.45.47:34450] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adZs6RLhhLtqHi2gK7UqvAAAARQ"]
[Wed Apr 08 23:17:32.374019 2026] [:error] [pid 12453:tid 12478] [client 95.111.234.66:37478] [client 95.111.234.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adZxjBjtW7S6XsLPvrRkHwAAAJc"]
[Wed Apr 08 23:54:43.340489 2026] [:error] [pid 7047:tid 7072] [client 49.51.195.195:36500] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adZ6Q-Nh3oGO3pKiCzxa1AAAAZc"]
[Thu Apr 09 05:11:07.228556 2026] [proxy_fcgi:error] [pid 20641:tid 20656] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:07.497512 2026] [proxy_fcgi:error] [pid 20641:tid 20655] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:07.763145 2026] [proxy_fcgi:error] [pid 20641:tid 20663] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:08.028752 2026] [proxy_fcgi:error] [pid 20641:tid 20659] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:08.296316 2026] [proxy_fcgi:error] [pid 20641:tid 20664] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:08.563619 2026] [proxy_fcgi:error] [pid 20641:tid 20649] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:08.829082 2026] [proxy_fcgi:error] [pid 20641:tid 20662] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:09.096099 2026] [proxy_fcgi:error] [pid 20641:tid 20652] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:09.628360 2026] [proxy_fcgi:error] [pid 20641:tid 20658] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:09.896104 2026] [proxy_fcgi:error] [pid 20641:tid 20666] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:10.164222 2026] [proxy_fcgi:error] [pid 20641:tid 20667] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:10.430591 2026] [proxy_fcgi:error] [pid 20641:tid 20656] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:10.706132 2026] [proxy_fcgi:error] [pid 20641:tid 20668] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:10.976721 2026] [proxy_fcgi:error] [pid 20641:tid 20657] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:11.245929 2026] [proxy_fcgi:error] [pid 20641:tid 20669] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:11.542279 2026] [proxy_fcgi:error] [pid 20641:tid 20659] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:11.812444 2026] [proxy_fcgi:error] [pid 20641:tid 20664] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:12.076574 2026] [proxy_fcgi:error] [pid 20641:tid 20654] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:14.212152 2026] [proxy_fcgi:error] [pid 20641:tid 20668] [client 138.199.29.196:60338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:15.813199 2026] [:error] [pid 20641:tid 20647] [client 138.199.29.196:60338] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adbEc23LksBSF-6rlkZbQwAAAMI"]
[Thu Apr 09 05:11:17.213203 2026] [:error] [pid 20535:tid 20551] [client 138.199.29.196:50872] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adbEdQWiD9hWnEUHWdMOkgAAAAc"]
[Thu Apr 09 05:11:18.566045 2026] [proxy_fcgi:error] [pid 20641:tid 20645] [client 138.199.29.196:50886] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:19.371721 2026] [:error] [pid 20641:tid 20664] [client 138.199.29.196:50886] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adbEd23LksBSF-6rlkZbUgAAANM"]
[Thu Apr 09 05:11:20.179394 2026] [proxy_fcgi:error] [pid 20535:tid 20551] [client 138.199.29.196:50894] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:20.449867 2026] [proxy_fcgi:error] [pid 20535:tid 20545] [client 138.199.29.196:50894] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:20.719574 2026] [:error] [pid 20535:tid 20565] [client 138.199.29.196:50894] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "adbEeAWiD9hWnEUHWdMOngAAABU"]
[Thu Apr 09 05:11:21.540164 2026] [proxy_fcgi:error] [pid 22627:tid 22644] [client 138.199.29.196:50910] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:22.907981 2026] [:error] [pid 22627:tid 22634] [client 138.199.29.196:50910] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adbEevr8glsF_jKQpr7dzgAAAQQ"]
[Thu Apr 09 05:11:23.705077 2026] [:error] [pid 20535:tid 20557] [client 138.199.29.196:50926] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adbEewWiD9hWnEUHWdMOqwAAAA0"]
[Thu Apr 09 05:11:24.288622 2026] [:error] [pid 20535:tid 20550] [client 138.199.29.196:50934] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adbEfAWiD9hWnEUHWdMOrAAAAAY"]
[Thu Apr 09 05:11:24.831249 2026] [:error] [pid 20535:tid 20545] [client 138.199.29.196:56388] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adbEfAWiD9hWnEUHWdMOsgAAAAE"]
[Thu Apr 09 05:11:25.382358 2026] [:error] [pid 20641:tid 20654] [client 138.199.29.196:56398] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adbEfW3LksBSF-6rlkZbXwAAAMk"]
[Thu Apr 09 05:11:25.932974 2026] [:error] [pid 20536:tid 20589] [client 138.199.29.196:56402] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adbEfcPqyUJM1s3YpIYWxAAAAFI"]
[Thu Apr 09 05:11:26.903107 2026] [:error] [pid 20537:tid 20599] [client 138.199.29.196:56414] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adbEfsSTjpSeyrxLmN4HDAAAAIE"]
[Thu Apr 09 05:11:27.436839 2026] [proxy_fcgi:error] [pid 20537:tid 20611] [client 138.199.29.196:56418] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:27.979575 2026] [:error] [pid 20537:tid 20615] [client 138.199.29.196:56418] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "adbEf8STjpSeyrxLmN4HEAAAAJE"]
[Thu Apr 09 05:11:28.531741 2026] [proxy_fcgi:error] [pid 20536:tid 20577] [client 138.199.29.196:56434] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:28.804467 2026] [proxy_fcgi:error] [pid 20536:tid 20575] [client 138.199.29.196:56434] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:29.072355 2026] [:error] [pid 20536:tid 20588] [client 138.199.29.196:56434] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adbEgcPqyUJM1s3YpIYWzQAAAFE"]
[Thu Apr 09 05:11:29.881888 2026] [:error] [pid 22627:tid 22642] [client 138.199.29.196:56438] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adbEgfr8glsF_jKQpr7d8QAAAQw"]
[Thu Apr 09 05:11:30.451629 2026] [proxy_fcgi:error] [pid 22627:tid 22638] [client 138.199.29.196:56442] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:30.725092 2026] [:error] [pid 22627:tid 22654] [client 138.199.29.196:56442] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adbEgvr8glsF_jKQpr7d9wAAARg"]
[Thu Apr 09 05:11:31.258671 2026] [proxy_fcgi:error] [pid 22627:tid 22639] [client 138.199.29.196:56446] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:32.590056 2026] [proxy_fcgi:error] [pid 22627:tid 22651] [client 138.199.29.196:56446] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:33.393912 2026] [:error] [pid 22627:tid 22652] [client 138.199.29.196:56446] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adbEhfr8glsF_jKQpr7eBwAAARY"]
[Thu Apr 09 05:11:33.929273 2026] [proxy_fcgi:error] [pid 22627:tid 22633] [client 138.199.29.196:56462] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:34.196409 2026] [:error] [pid 22627:tid 22649] [client 138.199.29.196:56462] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adbEhvr8glsF_jKQpr7eCgAAARM"]
[Thu Apr 09 05:11:34.746592 2026] [proxy_fcgi:error] [pid 20535:tid 20564] [client 138.199.29.196:44818] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:35.283941 2026] [:error] [pid 20535:tid 20551] [client 138.199.29.196:44818] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "adbEhwWiD9hWnEUHWdMOxgAAAAc"]
[Thu Apr 09 05:11:35.821661 2026] [proxy_fcgi:error] [pid 20641:tid 20647] [client 138.199.29.196:44820] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:36.093379 2026] [:error] [pid 20641:tid 20645] [client 138.199.29.196:44820] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "adbEiG3LksBSF-6rlkZbdgAAAMA"]
[Thu Apr 09 05:11:36.911349 2026] [proxy_fcgi:error] [pid 20535:tid 20553] [client 138.199.29.196:44832] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:37.181679 2026] [proxy_fcgi:error] [pid 20535:tid 20544] [client 138.199.29.196:44832] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:37.717454 2026] [:error] [pid 20535:tid 20558] [client 138.199.29.196:44832] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adbEiQWiD9hWnEUHWdMO0AAAAA4"]
[Thu Apr 09 05:11:38.558718 2026] [:error] [pid 20535:tid 20547] [client 138.199.29.196:44834] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adbEigWiD9hWnEUHWdMO0wAAAAM"]
[Thu Apr 09 05:11:39.352761 2026] [:error] [pid 20536:tid 20589] [client 138.199.29.196:44838] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "adbEi8PqyUJM1s3YpIYW2wAAAFI"]
[Thu Apr 09 05:11:39.887128 2026] [:error] [pid 20535:tid 20544] [client 138.199.29.196:44850] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adbEiwWiD9hWnEUHWdMO2QAAAAA"]
[Thu Apr 09 05:11:40.414667 2026] [:error] [pid 20535:tid 20558] [client 138.199.29.196:44854] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "adbEjAWiD9hWnEUHWdMO2gAAAA4"]
[Thu Apr 09 05:11:41.474531 2026] [proxy_fcgi:error] [pid 20535:tid 20563] [client 138.199.29.196:44858] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:41.736062 2026] [:error] [pid 20535:tid 20545] [client 138.199.29.196:44858] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "adbEjQWiD9hWnEUHWdMO3wAAAAE"]
[Thu Apr 09 05:11:42.267801 2026] [:error] [pid 22627:tid 22646] [client 138.199.29.196:44872] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "adbEjvr8glsF_jKQpr7eLwAAARA"]
[Thu Apr 09 05:11:42.792441 2026] [:error] [pid 22627:tid 22653] [client 138.199.29.196:44876] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "adbEjvr8glsF_jKQpr7eNwAAARc"]
[Thu Apr 09 05:11:43.850912 2026] [proxy_fcgi:error] [pid 20641:tid 20652] [client 138.199.29.196:44882] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:44.116298 2026] [proxy_fcgi:error] [pid 20641:tid 20660] [client 138.199.29.196:44882] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:44.387410 2026] [proxy_fcgi:error] [pid 20641:tid 20657] [client 138.199.29.196:44882] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:44.655114 2026] [proxy_fcgi:error] [pid 20641:tid 20659] [client 138.199.29.196:44882] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:45.458606 2026] [:error] [pid 20641:tid 20666] [client 138.199.29.196:44882] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "adbEkW3LksBSF-6rlkZbigAAANU"]
[Thu Apr 09 05:11:48.069014 2026] [:error] [pid 20536:tid 20590] [client 138.199.29.196:60318] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adbElMPqyUJM1s3YpIYW5AAAAFM"]
[Thu Apr 09 05:11:48.345565 2026] [proxy_fcgi:error] [pid 20536:tid 20579] [client 138.199.29.196:60318] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:48.900707 2026] [proxy_fcgi:error] [pid 20536:tid 20591] [client 138.199.29.196:60318] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:49.713939 2026] [proxy_fcgi:error] [pid 20536:tid 20574] [client 138.199.29.196:60318] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:49.986271 2026] [proxy_fcgi:error] [pid 20536:tid 20589] [client 138.199.29.196:60318] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:51.355430 2026] [:error] [pid 20536:tid 20595] [client 138.199.29.196:60318] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adbEl8PqyUJM1s3YpIYW8QAAAFg"]
[Thu Apr 09 05:11:52.186392 2026] [proxy_fcgi:error] [pid 22627:tid 22636] [client 138.199.29.196:60322] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:52.460928 2026] [:error] [pid 22627:tid 22642] [client 138.199.29.196:60322] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adbEmPr8glsF_jKQpr7ecgAAAQw"]
[Thu Apr 09 05:11:53.017307 2026] [:error] [pid 22627:tid 22653] [client 138.199.29.196:60322] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "adbEmfr8glsF_jKQpr7edwAAARc"]
[Thu Apr 09 05:11:53.822316 2026] [proxy_fcgi:error] [pid 22627:tid 22652] [client 138.199.29.196:60334] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:54.638321 2026] [proxy_fcgi:error] [pid 22627:tid 22635] [client 138.199.29.196:60334] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:55.188540 2026] [proxy_fcgi:error] [pid 22627:tid 22633] [client 138.199.29.196:60334] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:55.733569 2026] [:error] [pid 22627:tid 22637] [client 138.199.29.196:60334] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adbEm_r8glsF_jKQpr7egwAAAQc"]
[Thu Apr 09 05:11:56.274006 2026] [proxy_fcgi:error] [pid 20536:tid 20588] [client 138.199.29.196:45874] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:57.091105 2026] [proxy_fcgi:error] [pid 20536:tid 20587] [client 138.199.29.196:45874] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:57.672449 2026] [proxy_fcgi:error] [pid 20536:tid 20589] [client 138.199.29.196:45874] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:58.210805 2026] [proxy_fcgi:error] [pid 20536:tid 20578] [client 138.199.29.196:45874] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:58.477714 2026] [:error] [pid 20536:tid 20584] [client 138.199.29.196:45874] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adbEnsPqyUJM1s3YpIYW_wAAAE0"]
[Thu Apr 09 05:11:59.035048 2026] [proxy_fcgi:error] [pid 20536:tid 20571] [client 138.199.29.196:45878] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:59.308460 2026] [proxy_fcgi:error] [pid 20536:tid 20583] [client 138.199.29.196:45878] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:11:59.607620 2026] [:error] [pid 20536:tid 20576] [client 138.199.29.196:45878] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adbEn8PqyUJM1s3YpIYXAwAAAEU"]
[Thu Apr 09 05:12:00.451302 2026] [proxy_fcgi:error] [pid 22627:tid 22642] [client 138.199.29.196:45892] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:01.030803 2026] [:error] [pid 22627:tid 22639] [client 138.199.29.196:45892] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "adbEofr8glsF_jKQpr7elQAAAQk"]
[Thu Apr 09 05:12:01.301630 2026] [:error] [pid 22627:tid 22640] [client 138.199.29.196:45892] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adbEofr8glsF_jKQpr7elgAAAQo"]
[Thu Apr 09 05:12:04.093138 2026] [proxy_fcgi:error] [pid 22627:tid 22647] [client 138.199.29.196:45898] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:05.723191 2026] [proxy_fcgi:error] [pid 22627:tid 22649] [client 138.199.29.196:45898] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:06.272604 2026] [proxy_fcgi:error] [pid 22627:tid 22654] [client 138.199.29.196:45898] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:06.910427 2026] [proxy_fcgi:error] [pid 22627:tid 22642] [client 138.199.29.196:45898] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:07.504184 2026] [proxy_fcgi:error] [pid 22627:tid 22630] [client 138.199.29.196:45898] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:07.787872 2026] [:error] [pid 22627:tid 22644] [client 138.199.29.196:45898] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adbEp_r8glsF_jKQpr7euwAAAQ4"]
[Thu Apr 09 05:12:08.351617 2026] [proxy_fcgi:error] [pid 22627:tid 22633] [client 138.199.29.196:38296] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:09.269022 2026] [:error] [pid 22627:tid 22650] [client 138.199.29.196:38296] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adbEqfr8glsF_jKQpr7exAAAARQ"]
[Thu Apr 09 05:12:09.554896 2026] [proxy_fcgi:error] [pid 22627:tid 22648] [client 138.199.29.196:38296] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:09.835545 2026] [proxy_fcgi:error] [pid 22627:tid 22653] [client 138.199.29.196:38296] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:10.134768 2026] [proxy_fcgi:error] [pid 22627:tid 22646] [client 138.199.29.196:38296] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:10.430203 2026] [:error] [pid 22627:tid 22654] [client 138.199.29.196:38296] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "adbEqvr8glsF_jKQpr7ezAAAARg"]
[Thu Apr 09 05:12:10.977120 2026] [proxy_fcgi:error] [pid 20535:tid 20560] [client 138.199.29.196:38304] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:11.238201 2026] [:error] [pid 20535:tid 20567] [client 138.199.29.196:38304] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/infi.php"] [unique_id "adbEqwWiD9hWnEUHWdMPGAAAABc"]
[Thu Apr 09 05:12:12.111547 2026] [proxy_fcgi:error] [pid 20536:tid 20576] [client 138.199.29.196:38316] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:12.431403 2026] [:error] [pid 20536:tid 20588] [client 138.199.29.196:38316] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "adbErMPqyUJM1s3YpIYXDwAAAFE"]
[Thu Apr 09 05:12:13.247199 2026] [proxy_fcgi:error] [pid 20536:tid 20575] [client 138.199.29.196:38326] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:13.529928 2026] [proxy_fcgi:error] [pid 20536:tid 20591] [client 138.199.29.196:38326] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:13.829002 2026] [:error] [pid 20536:tid 20579] [client 138.199.29.196:38326] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "adbErcPqyUJM1s3YpIYXFAAAAEg"]
[Thu Apr 09 05:12:14.368758 2026] [:error] [pid 22627:tid 22632] [client 138.199.29.196:38340] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "adbErvr8glsF_jKQpr7e1AAAAQI"]
[Thu Apr 09 05:12:14.912022 2026] [proxy_fcgi:error] [pid 20537:tid 20607] [client 138.199.29.196:33054] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:15.219451 2026] [proxy_fcgi:error] [pid 20537:tid 20599] [client 138.199.29.196:33054] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:16.339851 2026] [:error] [pid 20537:tid 20606] [client 138.199.29.196:33054] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adbEsMSTjpSeyrxLmN4HWwAAAIg"]
[Thu Apr 09 05:12:17.216232 2026] [:error] [pid 20537:tid 20619] [client 138.199.29.196:33060] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "adbEscSTjpSeyrxLmN4HXgAAAJU"]
[Thu Apr 09 05:12:17.758509 2026] [proxy_fcgi:error] [pid 20641:tid 20658] [client 138.199.29.196:33066] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:18.663628 2026] [:error] [pid 20641:tid 20656] [client 138.199.29.196:33066] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit.php"] [unique_id "adbEsm3LksBSF-6rlkZbxAAAAMs"]
[Thu Apr 09 05:12:19.234724 2026] [proxy_fcgi:error] [pid 20641:tid 20661] [client 138.199.29.196:33078] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:19.806652 2026] [proxy_fcgi:error] [pid 20641:tid 20664] [client 138.199.29.196:33078] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:20.077214 2026] [:error] [pid 20641:tid 20666] [client 138.199.29.196:33078] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adbEtG3LksBSF-6rlkZbzgAAANU"]
[Thu Apr 09 05:12:20.639974 2026] [proxy_fcgi:error] [pid 20537:tid 20615] [client 138.199.29.196:33082] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:21.212027 2026] [:error] [pid 20537:tid 20614] [client 138.199.29.196:33082] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/click.php"] [unique_id "adbEtcSTjpSeyrxLmN4HawAAAJA"]
[Thu Apr 09 05:12:21.782664 2026] [proxy_fcgi:error] [pid 20536:tid 20575] [client 138.199.29.196:33090] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:22.652125 2026] [:error] [pid 20536:tid 20582] [client 138.199.29.196:33090] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adbEtsPqyUJM1s3YpIYXIwAAAEs"]
[Thu Apr 09 05:12:23.554536 2026] [proxy_fcgi:error] [pid 20536:tid 20571] [client 138.199.29.196:33106] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:24.148075 2026] [proxy_fcgi:error] [pid 20536:tid 20575] [client 138.199.29.196:33106] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:24.421292 2026] [proxy_fcgi:error] [pid 20536:tid 20591] [client 138.199.29.196:33106] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:24.958928 2026] [proxy_fcgi:error] [pid 20536:tid 20589] [client 138.199.29.196:33106] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:25.232816 2026] [:error] [pid 20536:tid 20584] [client 138.199.29.196:33106] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adbEucPqyUJM1s3YpIYXMwAAAE0"]
[Thu Apr 09 05:12:25.767131 2026] [:error] [pid 20641:tid 20647] [client 138.199.29.196:39554] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/xl2023.php"] [unique_id "adbEuW3LksBSF-6rlkZb4AAAAMI"]
[Thu Apr 09 05:12:26.344668 2026] [:error] [pid 22627:tid 22637] [client 138.199.29.196:39570] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adbEuvr8glsF_jKQpr7e4AAAAQc"]
[Thu Apr 09 05:12:26.931735 2026] [:error] [pid 22627:tid 22641] [client 138.199.29.196:39578] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adbEuvr8glsF_jKQpr7e4gAAAQs"]
[Thu Apr 09 05:12:27.484359 2026] [proxy_fcgi:error] [pid 20535:tid 20552] [client 138.199.29.196:39580] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:27.763562 2026] [:error] [pid 20535:tid 20559] [client 138.199.29.196:39580] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adbEuwWiD9hWnEUHWdMPOwAAAA8"]
[Thu Apr 09 05:12:28.368561 2026] [:error] [pid 20537:tid 20600] [client 138.199.29.196:39586] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "adbEvMSTjpSeyrxLmN4HnwAAAII"]
[Thu Apr 09 05:12:28.927230 2026] [proxy_fcgi:error] [pid 22627:tid 22635] [client 138.199.29.196:39602] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:29.517083 2026] [:error] [pid 22627:tid 22632] [client 138.199.29.196:39602] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "adbEvfr8glsF_jKQpr7e7QAAAQI"]
[Thu Apr 09 05:12:30.109877 2026] [:error] [pid 20641:tid 20657] [client 138.199.29.196:39614] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "adbEvm3LksBSF-6rlkZb7gAAAMw"]
[Thu Apr 09 05:12:30.717760 2026] [:error] [pid 20535:tid 20557] [client 138.199.29.196:39616] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adbEvgWiD9hWnEUHWdMPQwAAAA0"]
[Thu Apr 09 05:12:31.339573 2026] [:error] [pid 22627:tid 22636] [client 138.199.29.196:39624] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "adbEv_r8glsF_jKQpr7e-AAAAQY"]
[Thu Apr 09 05:12:32.159530 2026] [:error] [pid 22627:tid 22647] [client 138.199.29.196:39636] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adbEwPr8glsF_jKQpr7e_QAAARE"]
[Thu Apr 09 05:12:33.247659 2026] [:error] [pid 20535:tid 20561] [client 138.199.29.196:39650] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "adbEwQWiD9hWnEUHWdMPSQAAABE"]
[Thu Apr 09 05:12:33.876517 2026] [proxy_fcgi:error] [pid 20536:tid 20575] [client 138.199.29.196:39664] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:34.763681 2026] [proxy_fcgi:error] [pid 20536:tid 20583] [client 138.199.29.196:39664] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:35.059292 2026] [:error] [pid 20536:tid 20579] [client 138.199.29.196:39664] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adbEw8PqyUJM1s3YpIYXSgAAAEg"]
[Thu Apr 09 05:12:35.898872 2026] [proxy_fcgi:error] [pid 20535:tid 20562] [client 138.199.29.196:60462] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:36.203747 2026] [proxy_fcgi:error] [pid 20535:tid 20544] [client 138.199.29.196:60462] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:40.184493 2026] [proxy_fcgi:error] [pid 20535:tid 20555] [client 138.199.29.196:60462] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:40.492983 2026] [:error] [pid 20535:tid 20562] [client 138.199.29.196:60462] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "adbEyAWiD9hWnEUHWdMPXQAAABI"]
[Thu Apr 09 05:12:41.096889 2026] [proxy_fcgi:error] [pid 20641:tid 20667] [client 138.199.29.196:60478] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:41.944936 2026] [:error] [pid 20641:tid 20665] [client 138.199.29.196:60478] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adbEyW3LksBSF-6rlkZcDAAAANQ"]
[Thu Apr 09 05:12:42.471779 2026] [:error] [pid 20641:tid 20664] [client 138.199.29.196:60482] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adbEym3LksBSF-6rlkZcDgAAANM"]
[Thu Apr 09 05:12:44.153467 2026] [:error] [pid 20537:tid 20607] [client 138.199.29.196:60492] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adbEzMSTjpSeyrxLmN4HwwAAAIk"]
[Thu Apr 09 05:12:45.224001 2026] [proxy_fcgi:error] [pid 22627:tid 22636] [client 138.199.29.196:39876] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:45.491465 2026] [proxy_fcgi:error] [pid 22627:tid 22640] [client 138.199.29.196:39876] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:45.760689 2026] [proxy_fcgi:error] [pid 22627:tid 22648] [client 138.199.29.196:39876] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:46.028644 2026] [proxy_fcgi:error] [pid 22627:tid 22635] [client 138.199.29.196:39876] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:47.370522 2026] [:error] [pid 22627:tid 22644] [client 138.199.29.196:39876] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "adbEz_r8glsF_jKQpr7fMAAAAQ4"]
[Thu Apr 09 05:12:47.927375 2026] [:error] [pid 20535:tid 20562] [client 138.199.29.196:39884] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adbEzwWiD9hWnEUHWdMPaAAAABI"]
[Thu Apr 09 05:12:48.466489 2026] [:error] [pid 20535:tid 20559] [client 138.199.29.196:39890] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adbE0AWiD9hWnEUHWdMPbQAAAA8"]
[Thu Apr 09 05:12:49.010507 2026] [:error] [pid 20535:tid 20549] [client 138.199.29.196:39896] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adbE0QWiD9hWnEUHWdMPcAAAAAU"]
[Thu Apr 09 05:12:49.575031 2026] [:error] [pid 20535:tid 20563] [client 138.199.29.196:39900] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adbE0QWiD9hWnEUHWdMPdAAAABM"]
[Thu Apr 09 05:12:50.127395 2026] [:error] [pid 22627:tid 22632] [client 138.199.29.196:39916] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adbE0vr8glsF_jKQpr7fOgAAAQI"]
[Thu Apr 09 05:12:50.964379 2026] [:error] [pid 20641:tid 20668] [client 138.199.29.196:39926] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "adbE0m3LksBSF-6rlkZcFAAAANc"]
[Thu Apr 09 05:12:51.517047 2026] [:error] [pid 20537:tid 20608] [client 138.199.29.196:39934] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adbE08STjpSeyrxLmN4HyQAAAIo"]
[Thu Apr 09 05:12:52.044028 2026] [:error] [pid 20641:tid 20653] [client 138.199.29.196:39936] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adbE1G3LksBSF-6rlkZcFQAAAMg"]
[Thu Apr 09 05:12:52.578297 2026] [:error] [pid 20536:tid 20594] [client 138.199.29.196:39940] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adbE1MPqyUJM1s3YpIYXVQAAAFc"]
[Thu Apr 09 05:12:53.640305 2026] [:error] [pid 20537:tid 20621] [client 138.199.29.196:39946] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adbE1cSTjpSeyrxLmN4H0QAAAJc"]
[Thu Apr 09 05:12:54.443133 2026] [:error] [pid 20641:tid 20646] [client 138.199.29.196:39954] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "adbE1m3LksBSF-6rlkZcGgAAAME"]
[Thu Apr 09 05:12:56.544200 2026] [proxy_fcgi:error] [pid 20641:tid 20663] [client 138.199.29.196:38960] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:57.084042 2026] [:error] [pid 20641:tid 20669] [client 138.199.29.196:38960] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adbE2W3LksBSF-6rlkZcIwAAANg"]
[Thu Apr 09 05:12:58.144392 2026] [:error] [pid 20641:tid 20656] [client 138.199.29.196:38972] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "adbE2m3LksBSF-6rlkZcKQAAAMs"]
[Thu Apr 09 05:12:58.688354 2026] [proxy_fcgi:error] [pid 22627:tid 22638] [client 138.199.29.196:38982] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:59.226979 2026] [proxy_fcgi:error] [pid 22627:tid 22643] [client 138.199.29.196:38982] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:12:59.497982 2026] [:error] [pid 22627:tid 22652] [client 138.199.29.196:38982] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adbE2_r8glsF_jKQpr7fTgAAARY"]
[Thu Apr 09 05:13:00.344165 2026] [proxy_fcgi:error] [pid 22627:tid 22648] [client 138.199.29.196:38988] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:00.623182 2026] [proxy_fcgi:error] [pid 22627:tid 22651] [client 138.199.29.196:38988] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:00.901658 2026] [proxy_fcgi:error] [pid 22627:tid 22652] [client 138.199.29.196:38988] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:01.175973 2026] [:error] [pid 22627:tid 22650] [client 138.199.29.196:38988] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "adbE3fr8glsF_jKQpr7fVwAAARQ"]
[Thu Apr 09 05:13:01.743749 2026] [proxy_fcgi:error] [pid 20535:tid 20554] [client 138.199.29.196:38996] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:02.011097 2026] [:error] [pid 20535:tid 20560] [client 138.199.29.196:38996] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "adbE3gWiD9hWnEUHWdMPkwAAABA"]
[Thu Apr 09 05:13:04.324090 2026] [proxy_fcgi:error] [pid 20537:tid 20598] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:04.606068 2026] [proxy_fcgi:error] [pid 20537:tid 20621] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:04.886611 2026] [proxy_fcgi:error] [pid 20537:tid 20610] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:05.447522 2026] [proxy_fcgi:error] [pid 20537:tid 20619] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:06.302458 2026] [proxy_fcgi:error] [pid 20537:tid 20603] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:06.582145 2026] [proxy_fcgi:error] [pid 20537:tid 20607] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:06.862050 2026] [proxy_fcgi:error] [pid 20537:tid 20599] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:08.389956 2026] [proxy_fcgi:error] [pid 20537:tid 20610] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:09.223725 2026] [proxy_fcgi:error] [pid 20537:tid 20601] [client 138.199.29.196:39006] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:09.500601 2026] [:error] [pid 20537:tid 20614] [client 138.199.29.196:39006] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adbE5cSTjpSeyrxLmN4H7QAAAJA"]
[Thu Apr 09 05:13:10.068334 2026] [:error] [pid 22627:tid 22646] [client 138.199.29.196:35060] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adbE5vr8glsF_jKQpr7fcwAAARA"]
[Thu Apr 09 05:13:10.603208 2026] [proxy_fcgi:error] [pid 22627:tid 22644] [client 138.199.29.196:35068] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:10.868841 2026] [:error] [pid 22627:tid 22636] [client 138.199.29.196:35068] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adbE5vr8glsF_jKQpr7feAAAAQY"]
[Thu Apr 09 05:13:11.706876 2026] [proxy_fcgi:error] [pid 22627:tid 22645] [client 138.199.29.196:35080] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:11.989304 2026] [:error] [pid 22627:tid 22634] [client 138.199.29.196:35080] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adbE5_r8glsF_jKQpr7ffwAAAQQ"]
[Thu Apr 09 05:13:12.515441 2026] [:error] [pid 22627:tid 22637] [client 138.199.29.196:35086] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adbE6Pr8glsF_jKQpr7fgQAAAQc"]
[Thu Apr 09 05:13:14.121295 2026] [:error] [pid 22627:tid 22652] [client 138.199.29.196:35092] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adbE6vr8glsF_jKQpr7fjgAAARY"]
[Thu Apr 09 05:13:14.651653 2026] [:error] [pid 20536:tid 20589] [client 138.199.29.196:60156] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "adbE6sPqyUJM1s3YpIYXZQAAAFI"]
[Thu Apr 09 05:13:15.993547 2026] [proxy_fcgi:error] [pid 22627:tid 22635] [client 138.199.29.196:60170] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:16.528619 2026] [:error] [pid 22627:tid 22639] [client 138.199.29.196:60170] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adbE7Pr8glsF_jKQpr7flQAAAQk"]
[Thu Apr 09 05:13:18.532337 2026] [proxy_fcgi:error] [pid 22627:tid 22644] [client 138.199.29.196:60186] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:19.066817 2026] [:error] [pid 22627:tid 22647] [client 138.199.29.196:60186] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "adbE7_r8glsF_jKQpr7fngAAARE"]
[Thu Apr 09 05:13:19.626163 2026] [:error] [pid 20536:tid 20578] [client 138.199.29.196:60196] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugins.php"] [unique_id "adbE78PqyUJM1s3YpIYXagAAAEc"]
[Thu Apr 09 05:13:20.444392 2026] [proxy_fcgi:error] [pid 20536:tid 20588] [client 138.199.29.196:60208] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:20.713002 2026] [:error] [pid 20536:tid 20593] [client 138.199.29.196:60208] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "adbE8MPqyUJM1s3YpIYXbwAAAFY"]
[Thu Apr 09 05:13:21.256835 2026] [:error] [pid 20536:tid 20573] [client 138.199.29.196:60212] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adbE8cPqyUJM1s3YpIYXcAAAAEI"]
[Thu Apr 09 05:13:22.325697 2026] [proxy_fcgi:error] [pid 20535:tid 20555] [client 138.199.29.196:60224] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:22.595600 2026] [proxy_fcgi:error] [pid 20535:tid 20556] [client 138.199.29.196:60224] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:23.133926 2026] [proxy_fcgi:error] [pid 20535:tid 20548] [client 138.199.29.196:60224] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:23.664577 2026] [:error] [pid 20535:tid 20551] [client 138.199.29.196:60224] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/atomlib.php"] [unique_id "adbE8wWiD9hWnEUHWdMPxQAAAAc"]
[Thu Apr 09 05:13:24.192465 2026] [:error] [pid 20641:tid 20667] [client 138.199.29.196:60228] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adbE9G3LksBSF-6rlkZcPgAAANY"]
[Thu Apr 09 05:13:24.732079 2026] [proxy_fcgi:error] [pid 20535:tid 20555] [client 138.199.29.196:47292] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:25.003598 2026] [proxy_fcgi:error] [pid 20535:tid 20556] [client 138.199.29.196:47292] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:25.546209 2026] [proxy_fcgi:error] [pid 20535:tid 20567] [client 138.199.29.196:47292] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:25.812745 2026] [:error] [pid 20535:tid 20553] [client 138.199.29.196:47292] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "adbE9QWiD9hWnEUHWdMP0AAAAAk"]
[Thu Apr 09 05:13:26.368148 2026] [:error] [pid 20535:tid 20554] [client 138.199.29.196:47294] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adbE9gWiD9hWnEUHWdMP0wAAAAo"]
[Thu Apr 09 05:13:26.910960 2026] [:error] [pid 22627:tid 22654] [client 138.199.29.196:47306] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adbE9vr8glsF_jKQpr7foAAAARg"]
[Thu Apr 09 05:13:28.528006 2026] [proxy_fcgi:error] [pid 20535:tid 20557] [client 138.199.29.196:47318] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:28.795156 2026] [:error] [pid 20535:tid 20551] [client 138.199.29.196:47318] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adbE-AWiD9hWnEUHWdMP3gAAAAc"]
[Thu Apr 09 05:13:29.609974 2026] [:error] [pid 22627:tid 22647] [client 138.199.29.196:47332] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adbE-fr8glsF_jKQpr7fpQAAARE"]
[Thu Apr 09 05:13:30.145371 2026] [proxy_fcgi:error] [pid 22627:tid 22642] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:30.415306 2026] [proxy_fcgi:error] [pid 22627:tid 22654] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:30.952628 2026] [proxy_fcgi:error] [pid 22627:tid 22647] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:32.033269 2026] [:error] [pid 22627:tid 22637] [client 138.199.29.196:47338] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/js/wp-login.php"] [unique_id "adbE_Pr8glsF_jKQpr7fvQAAAQc"]
[Thu Apr 09 05:13:32.571264 2026] [:error] [pid 22627:tid 22633] [client 138.199.29.196:47338] File does not exist: /home/switchcreative/public_html/worm.PhP
[Thu Apr 09 05:13:32.841878 2026] [proxy_fcgi:error] [pid 22627:tid 22636] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:33.112609 2026] [proxy_fcgi:error] [pid 22627:tid 22634] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:33.380447 2026] [proxy_fcgi:error] [pid 22627:tid 22653] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:33.645568 2026] [:error] [pid 22627:tid 22639] [client 138.199.29.196:47338] [client 138.199.29.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.29.196, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adbE_fr8glsF_jKQpr7fxgAAAQk"]
[Thu Apr 09 05:13:33.919018 2026] [proxy_fcgi:error] [pid 22627:tid 22635] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:34.454617 2026] [proxy_fcgi:error] [pid 22627:tid 22647] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:34.721683 2026] [proxy_fcgi:error] [pid 22627:tid 22636] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:35.255798 2026] [proxy_fcgi:error] [pid 22627:tid 22638] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:35.793347 2026] [proxy_fcgi:error] [pid 22627:tid 22654] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:36.600865 2026] [proxy_fcgi:error] [pid 22627:tid 22641] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:38.530928 2026] [proxy_fcgi:error] [pid 22627:tid 22644] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:38.798542 2026] [proxy_fcgi:error] [pid 22627:tid 22638] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:39.620278 2026] [proxy_fcgi:error] [pid 22627:tid 22652] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:41.324003 2026] [proxy_fcgi:error] [pid 22627:tid 22641] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:41.590570 2026] [proxy_fcgi:error] [pid 22627:tid 22631] [client 138.199.29.196:47338] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:41.864886 2026] [:error] [pid 22627:tid 22632] [client 138.199.29.196:47338] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/about.php"] [unique_id "adbFBfr8glsF_jKQpr7f_gAAAQI"]
[Thu Apr 09 05:13:42.655729 2026] [proxy_fcgi:error] [pid 20535:tid 20566] [client 138.199.29.196:40646] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:42.923421 2026] [proxy_fcgi:error] [pid 20535:tid 20553] [client 138.199.29.196:40646] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:43.190018 2026] [:error] [pid 20535:tid 20567] [client 138.199.29.196:40646] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adbFBwWiD9hWnEUHWdMQAQAAABc"]
[Thu Apr 09 05:13:43.992328 2026] [proxy_fcgi:error] [pid 20535:tid 20562] [client 138.199.29.196:40650] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:44.256647 2026] [:error] [pid 20535:tid 20556] [client 138.199.29.196:40650] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adbFCAWiD9hWnEUHWdMQBQAAAAw"]
[Thu Apr 09 05:13:45.325342 2026] [proxy_fcgi:error] [pid 20535:tid 20565] [client 138.199.29.196:50908] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:45.865286 2026] [proxy_fcgi:error] [pid 20535:tid 20551] [client 138.199.29.196:50908] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:46.134794 2026] [proxy_fcgi:error] [pid 20535:tid 20554] [client 138.199.29.196:50908] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:46.404405 2026] [proxy_fcgi:error] [pid 20535:tid 20548] [client 138.199.29.196:50908] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:46.683917 2026] [proxy_fcgi:error] [pid 20535:tid 20562] [client 138.199.29.196:50908] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:47.220420 2026] [:error] [pid 20535:tid 20568] [client 138.199.29.196:50908] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adbFCwWiD9hWnEUHWdMQFAAAABg"]
[Thu Apr 09 05:13:47.769635 2026] [proxy_fcgi:error] [pid 22627:tid 22645] [client 138.199.29.196:50916] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:48.048020 2026] [proxy_fcgi:error] [pid 22627:tid 22649] [client 138.199.29.196:50916] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:48.318419 2026] [:error] [pid 22627:tid 22633] [client 138.199.29.196:50916] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adbFDPr8glsF_jKQpr7gCQAAAQM"]
[Thu Apr 09 05:13:49.114407 2026] [:error] [pid 22627:tid 22639] [client 138.199.29.196:50930] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adbFDfr8glsF_jKQpr7gDwAAAQk"]
[Thu Apr 09 05:13:49.951850 2026] [proxy_fcgi:error] [pid 22627:tid 22648] [client 138.199.29.196:50934] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:50.234606 2026] [proxy_fcgi:error] [pid 22627:tid 22647] [client 138.199.29.196:50934] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:50.788194 2026] [proxy_fcgi:error] [pid 22627:tid 22643] [client 138.199.29.196:50934] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:51.064030 2026] [proxy_fcgi:error] [pid 22627:tid 22650] [client 138.199.29.196:50934] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:51.339560 2026] [:error] [pid 22627:tid 22645] [client 138.199.29.196:50934] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adbFD_r8glsF_jKQpr7gIwAAAQ8"]
[Thu Apr 09 05:13:51.872517 2026] [:error] [pid 20537:tid 20619] [client 138.199.29.196:50938] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adbFD8STjpSeyrxLmN4IGQAAAJU"]
[Thu Apr 09 05:13:53.743530 2026] [proxy_fcgi:error] [pid 20641:tid 20653] [client 138.199.29.196:50942] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:54.279972 2026] [:error] [pid 20641:tid 20650] [client 138.199.29.196:50942] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adbFEm3LksBSF-6rlkZcbQAAAMU"]
[Thu Apr 09 05:13:55.077891 2026] [:error] [pid 20535:tid 20565] [client 138.199.29.196:50558] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "adbFEwWiD9hWnEUHWdMQHgAAABU"]
[Thu Apr 09 05:13:55.908395 2026] [proxy_fcgi:error] [pid 22627:tid 22648] [client 138.199.29.196:50568] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:56.185337 2026] [proxy_fcgi:error] [pid 22627:tid 22645] [client 138.199.29.196:50568] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:56.460017 2026] [:error] [pid 22627:tid 22640] [client 138.199.29.196:50568] [client 138.199.29.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adbFFPr8glsF_jKQpr7gOwAAAQo"]
[Thu Apr 09 05:13:57.267840 2026] [proxy_fcgi:error] [pid 20641:tid 20652] [client 138.199.29.196:50580] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 05:13:57.535508 2026] [:error] [pid 20641:tid 20663] [client 138.199.29.196:50580] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/waf_defender.php"] [unique_id "adbFFW3LksBSF-6rlkZccgAAANI"]
[Thu Apr 09 05:13:58.067482 2026] [:error] [pid 20641:tid 20651] [client 138.199.29.196:50592] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/waf_defender.php"] [unique_id "adbFFm3LksBSF-6rlkZcdAAAAMY"]
[Thu Apr 09 05:13:58.596283 2026] [:error] [pid 20535:tid 20559] [client 138.199.29.196:50594] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/waf_defender.php"] [unique_id "adbFFgWiD9hWnEUHWdMQIgAAAA8"]
[Thu Apr 09 05:13:59.127198 2026] [:error] [pid 20537:tid 20621] [client 138.199.29.196:50608] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/waf_defender.php"] [unique_id "adbFF8STjpSeyrxLmN4IIQAAAJc"]
[Thu Apr 09 05:13:59.657200 2026] [:error] [pid 20537:tid 20619] [client 138.199.29.196:50616] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/waf_defender.php"] [unique_id "adbFF8STjpSeyrxLmN4IIwAAAJU"]
[Thu Apr 09 05:14:01.828490 2026] [autoindex:error] [pid 20641:tid 20665] [client 138.199.29.196:50630] AH01276: Cannot serve directory /home/switchcreative/public_html/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 05:14:04.818948 2026] [:error] [pid 20641:tid 20648] [client 138.199.29.196:50630] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/"] [unique_id "adbFHG3LksBSF-6rlkZckgAAAMM"]
[Thu Apr 09 05:14:05.370348 2026] [:error] [pid 22627:tid 22630] [client 138.199.29.196:50486] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/"] [unique_id "adbFHfr8glsF_jKQpr7gTwAAAQA"]
[Thu Apr 09 05:14:05.896058 2026] [:error] [pid 20535:tid 20559] [client 138.199.29.196:50502] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/"] [unique_id "adbFHQWiD9hWnEUHWdMQLgAAAA8"]
[Thu Apr 09 05:14:06.440739 2026] [:error] [pid 20641:tid 20649] [client 138.199.29.196:50514] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/"] [unique_id "adbFHm3LksBSF-6rlkZckwAAAMQ"]
[Thu Apr 09 05:14:06.985904 2026] [:error] [pid 20537:tid 20619] [client 138.199.29.196:50518] [client 138.199.29.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/"] [unique_id "adbFHsSTjpSeyrxLmN4ILQAAAJU"]
[Thu Apr 09 09:17:14.806749 2026] [:error] [pid 20535:tid 20545] [client 152.32.98.194:15182] [client 152.32.98.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.32.98.194, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adb-GgWiD9hWnEUHWdO5VAAAAAE"]
[Thu Apr 09 09:17:14.820602 2026] [proxy_fcgi:error] [pid 20535:tid 20545] [client 152.32.98.194:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 09:31:29.768512 2026] [:error] [pid 20641:tid 20652] [client 195.201.199.99:58952] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adcBcW3LksBSF-6rlkbR_gAAAMc"]
[Thu Apr 09 13:57:43.413948 2026] [:error] [pid 24927:tid 24930] [client 43.157.142.101:58332] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adc_1zXObuzEuw8mNJtklgAAAQA"]
[Thu Apr 09 14:04:50.775000 2026] [:error] [pid 24624:tid 24637] [client 143.198.204.168:63454] [client 143.198.204.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "addBgu4Jn-WvK1ZBTvhx2QAAAMs"]
[Thu Apr 09 14:32:31.151910 2026] [:error] [pid 24624:tid 24650] [client 51.77.216.36:58590] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "addH_-4Jn-WvK1ZBTvh8MAAAANg"]
[Thu Apr 09 14:32:34.148167 2026] [:error] [pid 24517:tid 24592] [client 51.77.216.36:41510] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "addIAnboYEn2ZFM_PS9JRAAAAJI"]
[Thu Apr 09 14:32:37.199321 2026] [:error] [pid 24927:tid 24931] [client 51.77.216.36:41512] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "addIBTXObuzEuw8mNJt0mQAAAQE"]
[Thu Apr 09 14:32:39.598016 2026] [:error] [pid 24517:tid 24579] [client 51.77.216.36:41526] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "addIB3boYEn2ZFM_PS9JSQAAAIU"]
[Thu Apr 09 14:32:42.593616 2026] [:error] [pid 24927:tid 24931] [client 51.77.216.36:47832] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "addICjXObuzEuw8mNJt0pgAAAQE"]
[Thu Apr 09 14:32:45.586557 2026] [:error] [pid 24927:tid 24950] [client 51.77.216.36:47848] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "addIDTXObuzEuw8mNJt0rAAAARQ"]
[Thu Apr 09 14:32:48.511466 2026] [:error] [pid 24516:tid 24562] [client 51.77.216.36:47854] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "addIENhW7vSS-UkeWCX3eQAAAE8"]
[Thu Apr 09 14:32:52.500126 2026] [:error] [pid 24624:tid 24637] [client 51.77.216.36:39648] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "addIFO4Jn-WvK1ZBTvh8QQAAAMs"]
[Thu Apr 09 14:32:54.796104 2026] [:error] [pid 24517:tid 24574] [client 51.77.216.36:39654] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "addIFnboYEn2ZFM_PS9JYQAAAIA"]
[Thu Apr 09 14:32:57.751619 2026] [:error] [pid 24515:tid 24534] [client 51.77.216.36:39668] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "addIGa1OMnvM2fMnB1M5sgAAAA8"]
[Thu Apr 09 14:33:00.624947 2026] [:error] [pid 24927:tid 24952] [client 51.77.216.36:39680] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "addIHDXObuzEuw8mNJt0zQAAARY"]
[Thu Apr 09 14:40:30.296889 2026] [:error] [pid 24624:tid 24647] [client 51.77.216.36:46116] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "addJ3u4Jn-WvK1ZBTvh9-gAAANU"]
[Thu Apr 09 14:40:35.578009 2026] [:error] [pid 24927:tid 24943] [client 51.77.216.36:35316] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "addJ4zXObuzEuw8mNJt4JgAAAQ0"]
[Thu Apr 09 14:40:37.873213 2026] [:error] [pid 24927:tid 24952] [client 51.77.216.36:35328] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "addJ5TXObuzEuw8mNJt4KgAAARY"]
[Thu Apr 09 14:40:40.448886 2026] [:error] [pid 24624:tid 24631] [client 51.77.216.36:35340] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "addJ6O4Jn-WvK1ZBTvh-AQAAAMU"]
[Thu Apr 09 14:40:43.212381 2026] [:error] [pid 24517:tid 24596] [client 51.77.216.36:50286] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "addJ63boYEn2ZFM_PS9LoAAAAJY"]
[Thu Apr 09 14:40:45.500317 2026] [:error] [pid 24624:tid 24647] [client 51.77.216.36:50292] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "addJ7e4Jn-WvK1ZBTvh-BQAAANU"]
[Thu Apr 09 14:40:48.446080 2026] [:error] [pid 24624:tid 24642] [client 51.77.216.36:50294] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "addJ8O4Jn-WvK1ZBTvh-CAAAANA"]
[Thu Apr 09 14:40:52.727273 2026] [:error] [pid 24927:tid 24931] [client 51.77.216.36:58924] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "addJ9DXObuzEuw8mNJt4PQAAAQE"]
[Thu Apr 09 14:40:57.119161 2026] [:error] [pid 24624:tid 24648] [client 51.77.216.36:58936] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "addJ-e4Jn-WvK1ZBTvh-EAAAANY"]
[Thu Apr 09 14:41:01.862134 2026] [:error] [pid 24927:tid 24937] [client 51.77.216.36:53016] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "addJ_TXObuzEuw8mNJt4SAAAAQc"]
[Thu Apr 09 14:41:04.175091 2026] [:error] [pid 24927:tid 24954] [client 51.77.216.36:53020] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "addKADXObuzEuw8mNJt4TwAAARg"]
[Thu Apr 09 14:41:07.475941 2026] [:error] [pid 24515:tid 24535] [client 51.77.216.36:53028] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "addKA61OMnvM2fMnB1M6UwAAABA"]
[Thu Apr 09 14:41:09.816225 2026] [:error] [pid 24516:tid 24556] [client 51.77.216.36:53036] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "addKBdhW7vSS-UkeWCX5KAAAAEk"]
[Thu Apr 09 14:41:12.784341 2026] [:error] [pid 24517:tid 24582] [client 51.77.216.36:42508] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "addKCHboYEn2ZFM_PS9LpwAAAIg"]
[Thu Apr 09 14:41:15.686835 2026] [:error] [pid 24516:tid 24549] [client 51.77.216.36:42516] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "addKC9hW7vSS-UkeWCX5KgAAAEI"]
[Thu Apr 09 14:41:18.612566 2026] [:error] [pid 24624:tid 24645] [client 51.77.216.36:42518] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "addKDu4Jn-WvK1ZBTvh-JgAAANM"]
[Thu Apr 09 14:41:21.179101 2026] [:error] [pid 24927:tid 24949] [client 51.77.216.36:46878] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "addKETXObuzEuw8mNJt4nwAAARM"]
[Thu Apr 09 14:41:24.104485 2026] [:error] [pid 24927:tid 24945] [client 51.77.216.36:46894] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "addKFDXObuzEuw8mNJt4vAAAAQ8"]
[Thu Apr 09 14:41:26.905572 2026] [:error] [pid 24927:tid 24951] [client 51.77.216.36:46902] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "addKFjXObuzEuw8mNJt40gAAARU"]
[Thu Apr 09 14:41:48.135934 2026] [:error] [pid 24624:tid 24632] [client 51.77.216.36:46906] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "addKLO4Jn-WvK1ZBTvh-TAAAAMY"]
[Thu Apr 09 14:41:50.525722 2026] [:error] [pid 24927:tid 24934] [client 51.77.216.36:53208] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "addKLjXObuzEuw8mNJt5AgAAAQQ"]
[Thu Apr 09 14:41:52.832590 2026] [:error] [pid 24927:tid 24952] [client 51.77.216.36:45326] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "addKMDXObuzEuw8mNJt5BwAAARY"]
[Thu Apr 09 14:41:55.108768 2026] [:error] [pid 24927:tid 24953] [client 51.77.216.36:45330] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "addKMzXObuzEuw8mNJt5CgAAARc"]
[Thu Apr 09 14:41:57.524051 2026] [:error] [pid 24624:tid 24630] [client 51.77.216.36:45346] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "addKNe4Jn-WvK1ZBTvh-UwAAAMQ"]
[Thu Apr 09 14:41:59.859550 2026] [:error] [pid 24517:tid 24597] [client 51.77.216.36:45354] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "addKN3boYEn2ZFM_PS9L5gAAAJc"]
[Thu Apr 09 14:42:02.278175 2026] [:error] [pid 24624:tid 24633] [client 51.77.216.36:53138] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "addKOu4Jn-WvK1ZBTvh-VAAAAMc"]
[Thu Apr 09 14:42:06.153209 2026] [:error] [pid 24517:tid 24575] [client 51.77.216.36:53140] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "addKPnboYEn2ZFM_PS9L8wAAAIE"]
[Thu Apr 09 16:54:56.703641 2026] [:error] [pid 24624:tid 24647] [client 213.35.105.89:64169] [client 213.35.105.89] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "addpYO4Jn-WvK1ZBTvifqAAAANU"]
[Thu Apr 09 18:13:58.042838 2026] [:error] [pid 24927:tid 24952] [client 114.96.103.33:39190] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "add75jXObuzEuw8mNJvp7wAAARY"]
[Thu Apr 09 19:22:00.766123 2026] [:error] [pid 24927:tid 24943] [client 135.181.180.59:53040] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adeL2DXObuzEuw8mNJsScQAAAQ0"]
[Thu Apr 09 19:22:03.301305 2026] [:error] [pid 24624:tid 24650] [client 135.181.180.59:53054] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adeL2-4Jn-WvK1ZBTvjEcgAAANg"]
[Thu Apr 09 19:22:05.725467 2026] [:error] [pid 20837:tid 20857] [client 135.181.180.59:60454] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adeL3fSL71FHZkjrGzPVPwAAAZI"]
[Thu Apr 09 19:22:08.201550 2026] [:error] [pid 24927:tid 24946] [client 135.181.180.59:60470] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adeL4DXObuzEuw8mNJsSewAAARA"]
[Thu Apr 09 19:22:10.708412 2026] [:error] [pid 24927:tid 24942] [client 135.181.180.59:60486] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adeL4jXObuzEuw8mNJsSfQAAAQw"]
[Thu Apr 09 19:22:13.083011 2026] [:error] [pid 24517:tid 24590] [client 135.181.180.59:60502] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adeL5XboYEn2ZFM_PS93egAAAJA"]
[Thu Apr 09 19:22:15.535659 2026] [:error] [pid 18477:tid 18483] [client 135.181.180.59:18954] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adeL58De826HlFeoLPKOEQAAAUQ"]
[Thu Apr 09 19:22:18.029298 2026] [:error] [pid 24516:tid 24569] [client 135.181.180.59:18968] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adeL6thW7vSS-UkeWCUmTQAAAFY"]
[Thu Apr 09 19:22:20.480858 2026] [:error] [pid 24927:tid 24940] [client 135.181.180.59:18980] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adeL7DXObuzEuw8mNJsSiAAAAQo"]
[Thu Apr 09 19:22:23.109886 2026] [:error] [pid 24624:tid 24638] [client 135.181.180.59:18992] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adeL7-4Jn-WvK1ZBTvjEfwAAAMw"]
[Thu Apr 09 19:22:25.661619 2026] [:error] [pid 20837:tid 20840] [client 135.181.180.59:17128] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adeL8fSL71FHZkjrGzPVSQAAAYE"]
[Thu Apr 09 19:22:28.293367 2026] [:error] [pid 24516:tid 24560] [client 135.181.180.59:17130] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adeL9NhW7vSS-UkeWCUmUwAAAE0"]
[Thu Apr 09 19:22:30.920463 2026] [:error] [pid 24927:tid 24952] [client 135.181.180.59:17144] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adeL9jXObuzEuw8mNJsSkAAAARY"]
[Thu Apr 09 19:22:33.399568 2026] [:error] [pid 24515:tid 24526] [client 135.181.180.59:17158] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adeL-a1OMnvM2fMnB1OLggAAAAc"]
[Thu Apr 09 19:22:35.936111 2026] [:error] [pid 24927:tid 24947] [client 135.181.180.59:31338] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adeL-zXObuzEuw8mNJsSlgAAARE"]
[Thu Apr 09 19:22:38.393851 2026] [:error] [pid 24927:tid 24941] [client 135.181.180.59:31342] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adeL_jXObuzEuw8mNJsSmQAAAQs"]
[Thu Apr 09 19:22:40.846589 2026] [:error] [pid 24515:tid 24523] [client 135.181.180.59:31344] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adeMAK1OMnvM2fMnB1OLiwAAAAQ"]
[Thu Apr 09 19:22:43.327844 2026] [:error] [pid 24927:tid 24941] [client 135.181.180.59:31354] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adeMAzXObuzEuw8mNJsSpwAAAQs"]
[Thu Apr 09 19:22:45.920209 2026] [:error] [pid 18477:tid 18497] [client 135.181.180.59:60218] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adeMBcDe826HlFeoLPKOKQAAAVI"]
[Thu Apr 09 19:22:48.386153 2026] [:error] [pid 18477:tid 18489] [client 135.181.180.59:60220] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adeMCMDe826HlFeoLPKOLgAAAUo"]
[Thu Apr 09 19:22:51.010777 2026] [:error] [pid 24515:tid 24531] [client 135.181.180.59:60224] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adeMC61OMnvM2fMnB1OLkwAAAAw"]
[Thu Apr 09 19:22:53.529798 2026] [:error] [pid 20837:tid 20845] [client 135.181.180.59:60240] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adeMDfSL71FHZkjrGzPVTgAAAYY"]
[Thu Apr 09 19:22:55.986712 2026] [:error] [pid 24517:tid 24583] [client 135.181.180.59:28290] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adeMD3boYEn2ZFM_PS93gwAAAIk"]
[Thu Apr 09 20:06:37.133413 2026] [:error] [pid 20837:tid 20857] [client 43.153.192.98:41686] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adeWTfSL71FHZkjrGzPjLwAAAZI"]
[Thu Apr 09 20:27:14.468328 2026] [:error] [pid 24624:tid 24647] [client 185.202.108.169:40771] [client 185.202.108.169] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adebIu4Jn-WvK1ZBTvjVKwAAANU"], referer: https://www.google.com
[Thu Apr 09 20:27:18.665061 2026] [:error] [pid 24927:tid 24943] [client 185.202.108.169:33297] [client 185.202.108.169] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adebJjXObuzEuw8mNJse_AAAAQ0"]
[Thu Apr 09 20:27:18.665430 2026] [:error] [pid 24927:tid 24943] [client 185.202.108.169:33297] [client 185.202.108.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.202.108.169, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adebJjXObuzEuw8mNJse_AAAAQ0"]
[Thu Apr 09 20:27:18.676259 2026] [proxy_fcgi:error] [pid 24927:tid 24943] [client 185.202.108.169:33297] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 20:27:20.907462 2026] [:error] [pid 63331:tid 63356] [client 185.202.108.169:56097] [client 185.202.108.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.202.108.169, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adebKCbKfIYuVjWbE4VeWAAAAdc"], referer: https://www.google.com
[Thu Apr 09 20:27:20.911672 2026] [proxy_fcgi:error] [pid 63331:tid 63356] [client 185.202.108.169:56097] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Thu Apr 09 20:27:22.986845 2026] [:error] [pid 20837:tid 20847] [client 185.202.108.169:35067] [client 185.202.108.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.202.108.169, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adebKvSL71FHZkjrGzPpugAAAYg"], referer: https://www.google.com
[Thu Apr 09 20:27:22.991057 2026] [proxy_fcgi:error] [pid 20837:tid 20847] [client 185.202.108.169:35067] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Thu Apr 09 21:19:38.868519 2026] [proxy_fcgi:error] [pid 24515:tid 24521] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:39.120596 2026] [proxy_fcgi:error] [pid 24515:tid 24522] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:39.360806 2026] [proxy_fcgi:error] [pid 24515:tid 24535] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:40.782472 2026] [proxy_fcgi:error] [pid 24515:tid 24532] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:41.026982 2026] [proxy_fcgi:error] [pid 24515:tid 24519] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:41.303791 2026] [proxy_fcgi:error] [pid 24515:tid 24534] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:41.550995 2026] [proxy_fcgi:error] [pid 24515:tid 24541] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:41.810324 2026] [proxy_fcgi:error] [pid 24515:tid 24540] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:42.953994 2026] [proxy_fcgi:error] [pid 24515:tid 24526] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:43.196191 2026] [proxy_fcgi:error] [pid 24515:tid 24521] [client 20.203.163.149:53683] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:19:43.432090 2026] [:error] [pid 24515:tid 24535] [client 20.203.163.149:53683] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adenb61OMnvM2fMnB1PAMQAAABA"]
[Thu Apr 09 21:19:44.603173 2026] [:error] [pid 20837:tid 20839] [client 20.203.163.149:48205] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adencPSL71FHZkjrGzP3TgAAAYA"]
[Thu Apr 09 21:19:45.510866 2026] [:error] [pid 20837:tid 20853] [client 20.203.163.149:48217] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adencfSL71FHZkjrGzP3UAAAAY4"]
[Thu Apr 09 21:19:46.204606 2026] [:error] [pid 18477:tid 18492] [client 20.203.163.149:44287] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adencsDe826HlFeoLPKf-AAAAU0"]
[Thu Apr 09 21:19:47.094294 2026] [:error] [pid 24515:tid 24532] [client 20.203.163.149:52386] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adenc61OMnvM2fMnB1PAMgAAAA0"]
[Thu Apr 09 21:19:48.618385 2026] [:error] [pid 18477:tid 18486] [client 20.203.163.149:53178] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adendMDe826HlFeoLPKf-gAAAUc"]
[Thu Apr 09 21:19:49.777327 2026] [:error] [pid 24515:tid 24528] [client 20.203.163.149:51791] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adenda1OMnvM2fMnB1PAOAAAAAk"]
[Thu Apr 09 21:19:50.648516 2026] [:error] [pid 63331:tid 63351] [client 20.203.163.149:56384] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adendibKfIYuVjWbE4V1ogAAAdI"]
[Thu Apr 09 21:19:52.009024 2026] [:error] [pid 20837:tid 20848] [client 20.203.163.149:47222] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adenePSL71FHZkjrGzP3VwAAAYk"]
[Thu Apr 09 21:19:53.945690 2026] [:error] [pid 24624:tid 24640] [client 20.203.163.149:48202] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adenee4Jn-WvK1ZBTvjg3QAAAM4"]
[Thu Apr 09 21:19:55.880295 2026] [:error] [pid 24624:tid 24634] [client 20.203.163.149:45991] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adene-4Jn-WvK1ZBTvjg4gAAAMg"]
[Thu Apr 09 21:19:56.933454 2026] [:error] [pid 24517:tid 24587] [client 20.203.163.149:49199] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adenfHboYEn2ZFM_PS-CMgAAAI0"]
[Thu Apr 09 21:19:59.180930 2026] [:error] [pid 24517:tid 24583] [client 20.203.163.149:46234] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adenf3boYEn2ZFM_PS-CMwAAAIk"]
[Thu Apr 09 21:20:05.845548 2026] [:error] [pid 24515:tid 24537] [client 20.203.163.149:55206] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adenha1OMnvM2fMnB1PARAAAABI"]
[Thu Apr 09 21:20:06.153862 2026] [:error] [pid 63331:tid 63351] [client 20.203.163.149:45981] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adenhibKfIYuVjWbE4V1rgAAAdI"]
[Thu Apr 09 21:20:07.251095 2026] [:error] [pid 63331:tid 63357] [client 20.203.163.149:5347] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adenhybKfIYuVjWbE4V1sgAAAdg"]
[Thu Apr 09 21:20:09.370340 2026] [:error] [pid 24516:tid 24551] [client 20.203.163.149:5541] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adenidhW7vSS-UkeWCU0gAAAAEQ"]
[Thu Apr 09 21:20:10.275553 2026] [:error] [pid 24624:tid 24633] [client 20.203.163.149:49172] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeniu4Jn-WvK1ZBTvjg7gAAAMc"]
[Thu Apr 09 21:20:27.930725 2026] [:error] [pid 24624:tid 24650] [client 20.203.163.149:5369] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adenm-4Jn-WvK1ZBTvjhFgAAANg"]
[Thu Apr 09 21:20:40.400274 2026] [:error] [pid 63331:tid 63349] [client 20.203.163.149:50845] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adenqCbKfIYuVjWbE4V1uQAAAdA"]
[Thu Apr 09 21:21:00.208113 2026] [proxy_fcgi:error] [pid 24515:tid 24527] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:00.485754 2026] [proxy_fcgi:error] [pid 24515:tid 24543] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:00.754553 2026] [proxy_fcgi:error] [pid 24515:tid 24530] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:02.272045 2026] [proxy_fcgi:error] [pid 24515:tid 24526] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:02.511832 2026] [proxy_fcgi:error] [pid 24515:tid 24520] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:02.772448 2026] [proxy_fcgi:error] [pid 24515:tid 24535] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:03.039914 2026] [proxy_fcgi:error] [pid 24515:tid 24532] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:03.299446 2026] [proxy_fcgi:error] [pid 24515:tid 24533] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:03.552760 2026] [proxy_fcgi:error] [pid 24515:tid 24531] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:03.816598 2026] [proxy_fcgi:error] [pid 24515:tid 24529] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:04.060364 2026] [proxy_fcgi:error] [pid 24515:tid 24530] [client 20.203.163.149:53707] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:21:04.324657 2026] [:error] [pid 24515:tid 24522] [client 20.203.163.149:53707] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adenwK1OMnvM2fMnB1PAegAAAAM"]
[Thu Apr 09 21:21:21.113595 2026] [:error] [pid 18477:tid 18492] [client 20.203.163.149:49810] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "aden0cDe826HlFeoLPKgMQAAAU0"]
[Thu Apr 09 21:21:21.904718 2026] [:error] [pid 24927:tid 24951] [client 20.203.163.149:50676] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "aden0TXObuzEuw8mNJsnNAAAARU"]
[Thu Apr 09 21:21:23.678644 2026] [:error] [pid 63331:tid 63351] [client 20.203.163.149:49810] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "aden0ybKfIYuVjWbE4V1xAAAAdI"]
[Thu Apr 09 21:21:24.553687 2026] [:error] [pid 18477:tid 18495] [client 20.203.163.149:56056] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "aden1MDe826HlFeoLPKgOwAAAVA"]
[Thu Apr 09 21:21:25.589094 2026] [:error] [pid 20837:tid 20850] [client 20.203.163.149:53256] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aden1fSL71FHZkjrGzP3twAAAYs"]
[Thu Apr 09 21:21:26.252999 2026] [:error] [pid 18477:tid 18481] [client 20.203.163.149:52998] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aden1sDe826HlFeoLPKgPAAAAUI"]
[Thu Apr 09 21:21:27.173162 2026] [:error] [pid 24927:tid 24934] [client 20.203.163.149:57867] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aden1zXObuzEuw8mNJsnPAAAAQQ"]
[Thu Apr 09 21:21:28.230674 2026] [:error] [pid 63331:tid 63352] [client 20.203.163.149:52101] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aden2CbKfIYuVjWbE4V1ywAAAdM"]
[Thu Apr 09 21:21:29.192309 2026] [:error] [pid 63331:tid 63348] [client 20.203.163.149:49037] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aden2SbKfIYuVjWbE4V1zAAAAc8"]
[Thu Apr 09 21:21:29.876890 2026] [:error] [pid 20837:tid 20860] [client 20.203.163.149:47754] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aden2fSL71FHZkjrGzP3uQAAAZU"]
[Thu Apr 09 21:21:30.625982 2026] [:error] [pid 63331:tid 63345] [client 20.203.163.149:45654] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aden2ibKfIYuVjWbE4V1zwAAAcw"]
[Thu Apr 09 21:21:31.463882 2026] [:error] [pid 24927:tid 24944] [client 20.203.163.149:49065] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aden2zXObuzEuw8mNJsnPwAAAQ4"]
[Thu Apr 09 21:21:32.788328 2026] [:error] [pid 24624:tid 24645] [client 20.203.163.149:50047] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "aden3O4Jn-WvK1ZBTvjheQAAANM"]
[Thu Apr 09 21:21:34.382787 2026] [:error] [pid 24516:tid 24547] [client 20.203.163.149:52134] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "aden3thW7vSS-UkeWCU0xAAAAEA"]
[Thu Apr 09 21:21:37.480533 2026] [:error] [pid 18477:tid 18481] [client 20.203.163.149:45194] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "aden4cDe826HlFeoLPKgSQAAAUI"]
[Thu Apr 09 21:21:39.730711 2026] [:error] [pid 24927:tid 24949] [client 20.203.163.149:46904] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "aden4zXObuzEuw8mNJsnQgAAARM"]
[Thu Apr 09 21:21:40.944281 2026] [:error] [pid 18477:tid 18479] [client 20.203.163.149:44979] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aden5MDe826HlFeoLPKgSwAAAUA"]
[Thu Apr 09 21:21:42.534316 2026] [:error] [pid 18477:tid 18487] [client 20.203.163.149:44298] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aden5sDe826HlFeoLPKgTwAAAUg"]
[Thu Apr 09 21:21:44.678602 2026] [:error] [pid 24517:tid 24584] [client 20.203.163.149:53298] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aden6HboYEn2ZFM_PS-CdAAAAIo"]
[Thu Apr 09 21:21:46.310369 2026] [:error] [pid 24517:tid 24595] [client 20.203.163.149:5847] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aden6nboYEn2ZFM_PS-CdgAAAJU"]
[Thu Apr 09 21:21:47.451795 2026] [:error] [pid 24517:tid 24588] [client 20.203.163.149:5973] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aden63boYEn2ZFM_PS-CeQAAAI4"]
[Thu Apr 09 21:21:48.866184 2026] [:error] [pid 24515:tid 24525] [client 20.203.163.149:44963] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aden7K1OMnvM2fMnB1PAugAAAAY"]
[Thu Apr 09 21:21:49.926708 2026] [:error] [pid 24515:tid 24536] [client 20.203.163.149:43587] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aden7a1OMnvM2fMnB1PAvAAAABE"]
[Thu Apr 09 21:21:51.762125 2026] [:error] [pid 24515:tid 24519] [client 20.203.163.149:55948] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aden761OMnvM2fMnB1PAwAAAAAA"]
[Thu Apr 09 21:21:54.419521 2026] [:error] [pid 18477:tid 18497] [client 20.203.163.149:55496] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "aden8sDe826HlFeoLPKgUQAAAVI"]
[Thu Apr 09 21:22:01.747050 2026] [:error] [pid 24515:tid 24531] [client 20.203.163.149:48492] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "aden-a1OMnvM2fMnB1PAyAAAAAw"]
[Thu Apr 09 21:22:03.909851 2026] [:error] [pid 20837:tid 20862] [client 20.203.163.149:55501] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "aden-_SL71FHZkjrGzP3vQAAAZc"]
[Thu Apr 09 21:22:06.702018 2026] [proxy_fcgi:error] [pid 20837:tid 20843] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:07.669662 2026] [proxy_fcgi:error] [pid 20837:tid 20851] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:07.930603 2026] [proxy_fcgi:error] [pid 20837:tid 20847] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:08.170781 2026] [proxy_fcgi:error] [pid 20837:tid 20840] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:08.433516 2026] [proxy_fcgi:error] [pid 20837:tid 20858] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:08.673935 2026] [proxy_fcgi:error] [pid 20837:tid 20861] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:08.922917 2026] [proxy_fcgi:error] [pid 20837:tid 20845] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:12.319885 2026] [proxy_fcgi:error] [pid 20837:tid 20844] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:12.574923 2026] [proxy_fcgi:error] [pid 20837:tid 20859] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:12.815795 2026] [proxy_fcgi:error] [pid 20837:tid 20862] [client 20.203.163.149:49250] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:22:13.063752 2026] [:error] [pid 20837:tid 20851] [client 20.203.163.149:49250] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeoBfSL71FHZkjrGzP30gAAAYw"]
[Thu Apr 09 21:22:19.340955 2026] [:error] [pid 24624:tid 24649] [client 20.203.163.149:58155] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeoC-4Jn-WvK1ZBTvjhigAAANc"]
[Thu Apr 09 21:22:31.987545 2026] [:error] [pid 24515:tid 24529] [client 20.203.163.149:52897] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeoF61OMnvM2fMnB1PA9QAAAAo"]
[Thu Apr 09 21:22:41.713339 2026] [:error] [pid 24624:tid 24646] [client 20.203.163.149:47585] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeoIe4Jn-WvK1ZBTvjhnQAAANQ"]
[Thu Apr 09 21:22:42.320380 2026] [:error] [pid 24516:tid 24560] [client 20.203.163.149:48985] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeoIthW7vSS-UkeWCU02gAAAE0"]
[Thu Apr 09 21:22:45.162500 2026] [:error] [pid 24927:tid 24951] [client 20.203.163.149:55293] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeoJTXObuzEuw8mNJsnXAAAARU"]
[Thu Apr 09 21:22:45.855989 2026] [:error] [pid 24515:tid 24523] [client 20.203.163.149:55243] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adeoJa1OMnvM2fMnB1PBBwAAAAQ"]
[Thu Apr 09 21:22:47.667982 2026] [:error] [pid 63331:tid 63342] [client 20.203.163.149:48961] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adeoJybKfIYuVjWbE4V2FQAAAck"]
[Thu Apr 09 21:22:49.359058 2026] [:error] [pid 24927:tid 24953] [client 20.203.163.149:55280] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adeoKTXObuzEuw8mNJsnYQAAARc"]
[Thu Apr 09 21:22:50.191369 2026] [:error] [pid 18477:tid 18495] [client 20.203.163.149:5457] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adeoKsDe826HlFeoLPKgXwAAAVA"]
[Thu Apr 09 21:22:51.254355 2026] [:error] [pid 24517:tid 24590] [client 20.203.163.149:51688] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adeoK3boYEn2ZFM_PS-ChQAAAJA"]
[Thu Apr 09 21:22:52.719802 2026] [:error] [pid 24624:tid 24629] [client 20.203.163.149:56298] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adeoLO4Jn-WvK1ZBTvjhqQAAAMM"]
[Thu Apr 09 21:22:53.927415 2026] [:error] [pid 24927:tid 24954] [client 20.203.163.149:60652] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adeoLTXObuzEuw8mNJsnYwAAARg"]
[Thu Apr 09 21:22:54.958962 2026] [:error] [pid 24624:tid 24650] [client 20.203.163.149:48558] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adeoLu4Jn-WvK1ZBTvjhrQAAANg"]
[Thu Apr 09 21:22:55.892819 2026] [:error] [pid 24515:tid 24537] [client 20.203.163.149:50714] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeoL61OMnvM2fMnB1PBCQAAABI"]
[Thu Apr 09 21:22:56.887447 2026] [:error] [pid 20837:tid 20840] [client 20.203.163.149:5653] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeoMPSL71FHZkjrGzP4LgAAAYE"]
[Thu Apr 09 21:23:02.483035 2026] [:error] [pid 24515:tid 24538] [client 20.203.163.149:48571] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeoNq1OMnvM2fMnB1PBEQAAABM"]
[Thu Apr 09 21:23:13.050364 2026] [proxy_fcgi:error] [pid 63331:tid 63351] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:13.297135 2026] [proxy_fcgi:error] [pid 63331:tid 63342] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:13.544121 2026] [proxy_fcgi:error] [pid 63331:tid 63354] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:13.784982 2026] [proxy_fcgi:error] [pid 63331:tid 63352] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:14.027090 2026] [proxy_fcgi:error] [pid 63331:tid 63348] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:14.279388 2026] [proxy_fcgi:error] [pid 63331:tid 63340] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:14.536560 2026] [proxy_fcgi:error] [pid 63331:tid 63334] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:14.776358 2026] [proxy_fcgi:error] [pid 63331:tid 63349] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:15.019333 2026] [proxy_fcgi:error] [pid 63331:tid 63345] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:15.292704 2026] [proxy_fcgi:error] [pid 63331:tid 63344] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:15.545941 2026] [proxy_fcgi:error] [pid 63331:tid 63353] [client 20.203.163.149:45169] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:23:15.782484 2026] [:error] [pid 63331:tid 63357] [client 20.203.163.149:45169] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "adeoQybKfIYuVjWbE4V2MQAAAdg"]
[Thu Apr 09 21:23:17.949766 2026] [:error] [pid 24515:tid 24533] [client 20.203.163.149:44356] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "adeoRa1OMnvM2fMnB1PBLwAAAA4"]
[Thu Apr 09 21:23:23.936714 2026] [:error] [pid 20837:tid 20851] [client 20.203.163.149:47845] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "adeoS_SL71FHZkjrGzP4QgAAAYw"]
[Thu Apr 09 21:23:26.073334 2026] [:error] [pid 20837:tid 20860] [client 20.203.163.149:47704] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "adeoTvSL71FHZkjrGzP4RAAAAZU"]
[Thu Apr 09 21:23:28.085388 2026] [:error] [pid 20837:tid 20846] [client 20.203.163.149:6022] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adeoUPSL71FHZkjrGzP4TAAAAYc"]
[Thu Apr 09 21:23:30.372074 2026] [:error] [pid 20837:tid 20848] [client 20.203.163.149:53356] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adeoUvSL71FHZkjrGzP4TwAAAYk"]
[Thu Apr 09 21:23:32.228328 2026] [:error] [pid 20837:tid 20853] [client 20.203.163.149:5245] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adeoVPSL71FHZkjrGzP4VQAAAY4"]
[Thu Apr 09 21:23:34.722506 2026] [:error] [pid 20837:tid 20845] [client 20.203.163.149:43539] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adeoVvSL71FHZkjrGzP4YAAAAYY"]
[Thu Apr 09 21:23:35.809542 2026] [:error] [pid 18477:tid 18492] [client 20.203.163.149:56753] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adeoV8De826HlFeoLPKgbAAAAU0"]
[Thu Apr 09 21:23:36.662592 2026] [:error] [pid 63331:tid 63338] [client 20.203.163.149:6046] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adeoWCbKfIYuVjWbE4V2NwAAAcU"]
[Thu Apr 09 21:23:38.623734 2026] [:error] [pid 24515:tid 24532] [client 20.203.163.149:43545] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adeoWq1OMnvM2fMnB1PBNAAAAA0"]
[Thu Apr 09 21:23:42.795176 2026] [:error] [pid 63331:tid 63350] [client 20.203.163.149:47081] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adeoXibKfIYuVjWbE4V2PAAAAdE"]
[Thu Apr 09 21:24:17.844470 2026] [proxy_fcgi:error] [pid 63331:tid 63352] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:18.084007 2026] [proxy_fcgi:error] [pid 63331:tid 63348] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:18.331657 2026] [proxy_fcgi:error] [pid 63331:tid 63338] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:18.579227 2026] [proxy_fcgi:error] [pid 63331:tid 63337] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:18.820068 2026] [proxy_fcgi:error] [pid 63331:tid 63334] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:19.059224 2026] [proxy_fcgi:error] [pid 63331:tid 63346] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:19.304063 2026] [proxy_fcgi:error] [pid 63331:tid 63345] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:19.543794 2026] [proxy_fcgi:error] [pid 63331:tid 63344] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:19.783593 2026] [proxy_fcgi:error] [pid 63331:tid 63353] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:20.028663 2026] [proxy_fcgi:error] [pid 63331:tid 63336] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:20.267532 2026] [proxy_fcgi:error] [pid 63331:tid 63347] [client 20.203.163.149:55944] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:24:20.503248 2026] [:error] [pid 63331:tid 63352] [client 20.203.163.149:55944] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeohCbKfIYuVjWbE4V2ZQAAAdM"]
[Thu Apr 09 21:24:32.424307 2026] [:error] [pid 24515:tid 24541] [client 20.203.163.149:49547] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeokK1OMnvM2fMnB1PBcgAAABY"]
[Thu Apr 09 21:24:35.191349 2026] [:error] [pid 24624:tid 24630] [client 20.203.163.149:47953] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeok-4Jn-WvK1ZBTvjh4wAAAMQ"]
[Thu Apr 09 21:24:36.729038 2026] [:error] [pid 20837:tid 20841] [client 20.203.163.149:47453] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeolPSL71FHZkjrGzP4awAAAYI"]
[Thu Apr 09 21:24:37.883736 2026] [:error] [pid 24624:tid 24643] [client 20.203.163.149:51808] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeole4Jn-WvK1ZBTvjh5AAAANE"]
[Thu Apr 09 21:24:40.347176 2026] [:error] [pid 24927:tid 24945] [client 20.203.163.149:47453] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeomDXObuzEuw8mNJsnewAAAQ8"]
[Thu Apr 09 21:24:43.331502 2026] [:error] [pid 24515:tid 24539] [client 20.203.163.149:46424] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeom61OMnvM2fMnB1PBeAAAABQ"]
[Thu Apr 09 21:24:44.166736 2026] [:error] [pid 18477:tid 18499] [client 20.203.163.149:53709] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adeonMDe826HlFeoLPKgfgAAAVQ"]
[Thu Apr 09 21:24:47.377570 2026] [:error] [pid 24624:tid 24628] [client 20.203.163.149:49820] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adeon-4Jn-WvK1ZBTvjh6gAAAMI"]
[Thu Apr 09 21:24:50.018390 2026] [:error] [pid 24624:tid 24636] [client 20.203.163.149:5801] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adeoou4Jn-WvK1ZBTvjh7wAAAMo"]
[Thu Apr 09 21:24:55.105152 2026] [:error] [pid 24515:tid 24538] [client 20.203.163.149:60257] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adeop61OMnvM2fMnB1PBfQAAABM"]
[Thu Apr 09 21:25:03.619911 2026] [:error] [pid 24516:tid 24551] [client 20.203.163.149:48206] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adeor9hW7vSS-UkeWCU09QAAAEQ"]
[Thu Apr 09 21:25:11.063784 2026] [:error] [pid 18477:tid 18496] [client 20.203.163.149:53690] [client 20.203.163.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adeot8De826HlFeoLPKgmQAAAVE"]
[Thu Apr 09 21:25:21.880593 2026] [proxy_fcgi:error] [pid 24517:tid 24574] [client 20.203.163.149:53776] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:25:22.119631 2026] [proxy_fcgi:error] [pid 24517:tid 24585] [client 20.203.163.149:53776] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:25:22.359080 2026] [proxy_fcgi:error] [pid 24517:tid 24595] [client 20.203.163.149:53776] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:25:22.597392 2026] [proxy_fcgi:error] [pid 24517:tid 24581] [client 20.203.163.149:53776] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:25:22.837057 2026] [proxy_fcgi:error] [pid 24517:tid 24594] [client 20.203.163.149:53776] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:37.816621 2026] [proxy_fcgi:error] [pid 20837:tid 20846] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:38.090473 2026] [proxy_fcgi:error] [pid 20837:tid 20863] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:38.364199 2026] [proxy_fcgi:error] [pid 20837:tid 20839] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:38.656389 2026] [proxy_fcgi:error] [pid 20837:tid 20845] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:38.945350 2026] [proxy_fcgi:error] [pid 20837:tid 20842] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:39.221985 2026] [proxy_fcgi:error] [pid 20837:tid 20859] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:39.565465 2026] [proxy_fcgi:error] [pid 20837:tid 20848] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:39.832648 2026] [proxy_fcgi:error] [pid 20837:tid 20844] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:40.122176 2026] [proxy_fcgi:error] [pid 20837:tid 20850] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:40.405760 2026] [proxy_fcgi:error] [pid 20837:tid 20862] [client 4.225.204.246:33848] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:33:40.670105 2026] [:error] [pid 20837:tid 20858] [client 4.225.204.246:33848] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adeqtPSL71FHZkjrGzP6EgAAAZM"]
[Thu Apr 09 21:33:41.392967 2026] [:error] [pid 20837:tid 20846] [client 4.225.204.246:33757] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adeqtfSL71FHZkjrGzP6FAAAAYc"]
[Thu Apr 09 21:33:42.355130 2026] [:error] [pid 63331:tid 63341] [client 4.225.204.246:33823] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adeqtibKfIYuVjWbE4V4pAAAAcg"]
[Thu Apr 09 21:33:43.017248 2026] [:error] [pid 24624:tid 24645] [client 4.225.204.246:33731] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adeqt-4Jn-WvK1ZBTvjjUgAAANM"]
[Thu Apr 09 21:33:43.700133 2026] [:error] [pid 24927:tid 24932] [client 4.225.204.246:33845] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adeqtzXObuzEuw8mNJspYwAAAQI"]
[Thu Apr 09 21:33:44.584332 2026] [:error] [pid 18477:tid 18499] [client 4.225.204.246:33826] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adequMDe826HlFeoLPKhhAAAAVQ"]
[Thu Apr 09 21:33:45.261327 2026] [:error] [pid 24624:tid 24628] [client 4.225.204.246:33814] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adeque4Jn-WvK1ZBTvjjWQAAAMI"]
[Thu Apr 09 21:33:45.834738 2026] [:error] [pid 63331:tid 63343] [client 4.225.204.246:33828] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adequSbKfIYuVjWbE4V4qgAAAco"]
[Thu Apr 09 21:33:46.414952 2026] [:error] [pid 24927:tid 24954] [client 4.225.204.246:33794] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adequjXObuzEuw8mNJspZwAAARg"]
[Thu Apr 09 21:33:48.007347 2026] [:error] [pid 63331:tid 63349] [client 4.225.204.246:33729] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adeqvCbKfIYuVjWbE4V4rQAAAdA"]
[Thu Apr 09 21:33:48.609638 2026] [:error] [pid 24516:tid 24566] [client 4.225.204.246:33745] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adeqvNhW7vSS-UkeWCU16AAAAFM"]
[Thu Apr 09 21:33:49.256875 2026] [:error] [pid 18477:tid 18497] [client 4.225.204.246:33784] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adeqvcDe826HlFeoLPKhiAAAAVI"]
[Thu Apr 09 21:33:49.822264 2026] [:error] [pid 24624:tid 24646] [client 4.225.204.246:33739] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adeqve4Jn-WvK1ZBTvjjXAAAANQ"]
[Thu Apr 09 21:33:50.571848 2026] [:error] [pid 24516:tid 24563] [client 4.225.204.246:33807] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adeqvthW7vSS-UkeWCU16QAAAFA"]
[Thu Apr 09 21:33:51.276550 2026] [:error] [pid 18477:tid 18494] [client 4.225.204.246:33831] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adeqv8De826HlFeoLPKhjgAAAU8"]
[Thu Apr 09 21:33:51.816070 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:33811] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adeqv8De826HlFeoLPKhjwAAAVg"]
[Thu Apr 09 21:33:52.402709 2026] [:error] [pid 18477:tid 18483] [client 4.225.204.246:33795] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adeqwMDe826HlFeoLPKhkAAAAUQ"]
[Thu Apr 09 21:33:52.950675 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:33810] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adeqwO4Jn-WvK1ZBTvjjYAAAAMk"]
[Thu Apr 09 21:33:53.597647 2026] [:error] [pid 24624:tid 24647] [client 4.225.204.246:33816] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adeqwe4Jn-WvK1ZBTvjjYwAAANU"]
[Thu Apr 09 21:33:54.387021 2026] [:error] [pid 24624:tid 24639] [client 4.225.204.246:33852] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adeqwu4Jn-WvK1ZBTvjjZQAAAM0"]
[Thu Apr 09 21:33:55.117158 2026] [:error] [pid 24516:tid 24565] [client 4.225.204.246:33834] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adeqw9hW7vSS-UkeWCU18AAAAFI"]
[Thu Apr 09 21:33:55.704789 2026] [:error] [pid 24515:tid 24535] [client 4.225.204.246:6088] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adeqw61OMnvM2fMnB1PF3gAAABA"]
[Thu Apr 09 21:33:56.463313 2026] [:error] [pid 24624:tid 24644] [client 4.225.204.246:33732] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adeqxO4Jn-WvK1ZBTvjjbAAAANI"]
[Thu Apr 09 21:33:57.113583 2026] [:error] [pid 24515:tid 24528] [client 4.225.204.246:6099] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adeqxa1OMnvM2fMnB1PF4QAAAAk"]
[Thu Apr 09 21:33:57.697281 2026] [:error] [pid 20837:tid 20848] [client 4.225.204.246:33765] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "adeqxfSL71FHZkjrGzP6HgAAAYk"]
[Thu Apr 09 21:33:58.440991 2026] [:error] [pid 18477:tid 18484] [client 4.225.204.246:33769] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "adeqxsDe826HlFeoLPKhmAAAAUU"]
[Thu Apr 09 21:33:59.328547 2026] [:error] [pid 24516:tid 24547] [client 4.225.204.246:33754] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "adeqx9hW7vSS-UkeWCU19AAAAEA"]
[Thu Apr 09 21:33:59.965091 2026] [:error] [pid 24516:tid 24570] [client 4.225.204.246:33808] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "adeqx9hW7vSS-UkeWCU19gAAAFc"]
[Thu Apr 09 21:34:00.648956 2026] [:error] [pid 24517:tid 24579] [client 4.225.204.246:33812] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adeqyHboYEn2ZFM_PS-DdQAAAIU"]
[Thu Apr 09 21:34:01.304699 2026] [:error] [pid 24927:tid 24940] [client 4.225.204.246:33800] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adeqyTXObuzEuw8mNJspcwAAAQo"]
[Thu Apr 09 21:34:01.854480 2026] [:error] [pid 24927:tid 24932] [client 4.225.204.246:33787] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adeqyTXObuzEuw8mNJspdQAAAQI"]
[Thu Apr 09 21:34:02.542798 2026] [:error] [pid 20837:tid 20860] [client 4.225.204.246:33744] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adeqyvSL71FHZkjrGzP6JQAAAZU"]
[Thu Apr 09 21:34:03.247483 2026] [:error] [pid 20837:tid 20846] [client 4.225.204.246:33847] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adeqy_SL71FHZkjrGzP6KQAAAYc"]
[Thu Apr 09 21:34:03.845417 2026] [:error] [pid 24515:tid 24522] [client 4.225.204.246:33837] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adeqy61OMnvM2fMnB1PF4gAAAAM"]
[Thu Apr 09 21:34:04.535646 2026] [:error] [pid 20837:tid 20861] [client 4.225.204.246:33855] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adeqzPSL71FHZkjrGzP6LgAAAZY"]
[Thu Apr 09 21:34:05.219790 2026] [:error] [pid 24515:tid 24543] [client 4.225.204.246:33786] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "adeqza1OMnvM2fMnB1PF5QAAABg"]
[Thu Apr 09 21:34:05.838946 2026] [:error] [pid 24515:tid 24541] [client 4.225.204.246:6083] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "adeqza1OMnvM2fMnB1PF5wAAABY"]
[Thu Apr 09 21:34:06.518852 2026] [:error] [pid 24517:tid 24585] [client 4.225.204.246:6137] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "adeqznboYEn2ZFM_PS-DegAAAIs"]
[Thu Apr 09 21:34:07.135571 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:33748] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "adeqz8De826HlFeoLPKhoAAAAVg"]
[Thu Apr 09 21:34:07.729932 2026] [:error] [pid 24515:tid 24521] [client 4.225.204.246:33766] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "adeqz61OMnvM2fMnB1PF7wAAAAI"]
[Thu Apr 09 21:34:08.317502 2026] [:error] [pid 63331:tid 63337] [client 4.225.204.246:33849] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adeq0CbKfIYuVjWbE4V4tAAAAcQ"]
[Thu Apr 09 21:34:08.865713 2026] [:error] [pid 20837:tid 20852] [client 4.225.204.246:33799] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adeq0PSL71FHZkjrGzP6MAAAAY0"]
[Thu Apr 09 21:34:09.404829 2026] [:error] [pid 20837:tid 20849] [client 4.225.204.246:33733] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adeq0fSL71FHZkjrGzP6MgAAAYo"]
[Thu Apr 09 21:34:10.107206 2026] [:error] [pid 24515:tid 24530] [client 4.225.204.246:33758] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adeq0q1OMnvM2fMnB1PF8wAAAAs"]
[Thu Apr 09 21:34:10.679688 2026] [:error] [pid 24515:tid 24519] [client 4.225.204.246:6120] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adeq0q1OMnvM2fMnB1PF-AAAAAA"]
[Thu Apr 09 21:34:11.281447 2026] [:error] [pid 24515:tid 24541] [client 4.225.204.246:33853] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adeq061OMnvM2fMnB1PF-gAAABY"]
[Thu Apr 09 21:34:11.899687 2026] [:error] [pid 18477:tid 18485] [client 4.225.204.246:33840] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adeq08De826HlFeoLPKhogAAAUY"]
[Thu Apr 09 21:34:12.706193 2026] [:error] [pid 18477:tid 18492] [client 4.225.204.246:33747] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adeq1MDe826HlFeoLPKhpAAAAU0"]
[Thu Apr 09 21:34:13.286297 2026] [:error] [pid 18477:tid 18491] [client 4.225.204.246:33844] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adeq1cDe826HlFeoLPKhpgAAAUw"]
[Thu Apr 09 21:34:13.942061 2026] [:error] [pid 18477:tid 18479] [client 4.225.204.246:33782] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adeq1cDe826HlFeoLPKhqQAAAUA"]
[Thu Apr 09 21:34:14.737264 2026] [:error] [pid 18477:tid 18496] [client 4.225.204.246:33841] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adeq1sDe826HlFeoLPKhqgAAAVE"]
[Thu Apr 09 21:34:15.468937 2026] [:error] [pid 24624:tid 24644] [client 4.225.204.246:33735] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adeq1-4Jn-WvK1ZBTvjjewAAANI"]
[Thu Apr 09 21:34:16.074518 2026] [:error] [pid 18477:tid 18500] [client 4.225.204.246:33737] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adeq2MDe826HlFeoLPKhqwAAAVU"]
[Thu Apr 09 21:34:16.726122 2026] [:error] [pid 24515:tid 24535] [client 4.225.204.246:33854] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adeq2K1OMnvM2fMnB1PGCAAAABA"]
[Thu Apr 09 21:34:17.331642 2026] [:error] [pid 24515:tid 24520] [client 4.225.204.246:33764] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adeq2a1OMnvM2fMnB1PGCwAAAAE"]
[Thu Apr 09 21:34:17.900222 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:33818] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adeq2a1OMnvM2fMnB1PGDAAAABc"]
[Thu Apr 09 21:34:18.461562 2026] [:error] [pid 24624:tid 24636] [client 4.225.204.246:33817] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adeq2u4Jn-WvK1ZBTvjjfwAAAMo"]
[Thu Apr 09 21:34:19.025432 2026] [:error] [pid 24517:tid 24588] [client 4.225.204.246:6125] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adeq23boYEn2ZFM_PS-DfAAAAI4"]
[Thu Apr 09 21:34:19.645106 2026] [:error] [pid 24624:tid 24641] [client 4.225.204.246:33851] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adeq2-4Jn-WvK1ZBTvjjggAAAM8"]
[Thu Apr 09 21:34:20.331182 2026] [:error] [pid 20837:tid 20863] [client 4.225.204.246:33832] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adeq3PSL71FHZkjrGzP6OQAAAZg"]
[Thu Apr 09 21:34:21.021214 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:33820] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adeq3e4Jn-WvK1ZBTvjjhQAAAMk"]
[Thu Apr 09 21:34:21.576122 2026] [:error] [pid 24624:tid 24627] [client 4.225.204.246:33829] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adeq3e4Jn-WvK1ZBTvjjiQAAAME"]
[Thu Apr 09 21:34:22.296419 2026] [:error] [pid 24927:tid 24943] [client 4.225.204.246:33836] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adeq3jXObuzEuw8mNJspfQAAAQ0"]
[Thu Apr 09 21:34:22.845057 2026] [:error] [pid 63331:tid 63346] [client 4.225.204.246:33830] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adeq3ibKfIYuVjWbE4V4vwAAAc0"]
[Thu Apr 09 21:34:23.445621 2026] [:error] [pid 63331:tid 63335] [client 4.225.204.246:33772] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adeq3ybKfIYuVjWbE4V4wgAAAcI"]
[Thu Apr 09 21:34:24.259486 2026] [:error] [pid 63331:tid 63345] [client 4.225.204.246:33819] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adeq4CbKfIYuVjWbE4V4xgAAAcw"]
[Thu Apr 09 21:34:24.801914 2026] [:error] [pid 63331:tid 63342] [client 4.225.204.246:6018] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adeq4CbKfIYuVjWbE4V4ygAAAck"]
[Thu Apr 09 21:34:25.464603 2026] [:error] [pid 24516:tid 24557] [client 4.225.204.246:6017] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adeq4dhW7vSS-UkeWCU1_gAAAEo"]
[Thu Apr 09 21:34:26.151924 2026] [:error] [pid 63331:tid 63347] [client 4.225.204.246:33792] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adeq4ibKfIYuVjWbE4V4zgAAAc4"]
[Thu Apr 09 21:34:26.780673 2026] [:error] [pid 63331:tid 63346] [client 4.225.204.246:33850] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adeq4ibKfIYuVjWbE4V40gAAAc0"]
[Thu Apr 09 21:34:27.507014 2026] [:error] [pid 63331:tid 63335] [client 4.225.204.246:33791] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adeq4ybKfIYuVjWbE4V41AAAAcI"]
[Thu Apr 09 21:34:28.048703 2026] [:error] [pid 20837:tid 20850] [client 4.225.204.246:6142] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adeq5PSL71FHZkjrGzP6PwAAAYs"]
[Thu Apr 09 21:34:28.760772 2026] [:error] [pid 63331:tid 63352] [client 4.225.204.246:33734] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeq5CbKfIYuVjWbE4V41QAAAdM"]
[Thu Apr 09 21:34:29.443343 2026] [:error] [pid 24927:tid 24932] [client 4.225.204.246:6123] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeq5TXObuzEuw8mNJspgQAAAQI"]
[Thu Apr 09 21:34:30.180098 2026] [:error] [pid 24624:tid 24642] [client 4.225.204.246:6126] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeq5u4Jn-WvK1ZBTvjjnwAAANA"]
[Thu Apr 09 21:34:30.808253 2026] [:error] [pid 20837:tid 20847] [client 4.225.204.246:33746] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeq5vSL71FHZkjrGzP6QgAAAYg"]
[Thu Apr 09 21:34:31.407638 2026] [:error] [pid 24624:tid 24633] [client 4.225.204.246:33824] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "adeq5-4Jn-WvK1ZBTvjjogAAAMc"]
[Thu Apr 09 21:34:31.989223 2026] [:error] [pid 63331:tid 63333] [client 4.225.204.246:6098] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "adeq5ybKfIYuVjWbE4V41wAAAcA"]
[Thu Apr 09 21:34:32.575482 2026] [:error] [pid 24927:tid 24945] [client 4.225.204.246:6134] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "adeq6DXObuzEuw8mNJspgwAAAQ8"]
[Thu Apr 09 21:34:33.383051 2026] [:error] [pid 63331:tid 63349] [client 4.225.204.246:33738] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "adeq6SbKfIYuVjWbE4V43wAAAdA"]
[Thu Apr 09 21:34:34.376784 2026] [:error] [pid 24515:tid 24522] [client 4.225.204.246:6093] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adeq6q1OMnvM2fMnB1PGHwAAAAM"]
[Thu Apr 09 21:34:35.491721 2026] [:error] [pid 20837:tid 20859] [client 4.225.204.246:33835] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adeq6_SL71FHZkjrGzP6RAAAAZQ"]
[Thu Apr 09 21:34:36.525561 2026] [:error] [pid 18477:tid 18490] [client 4.225.204.246:6102] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adeq7MDe826HlFeoLPKhsAAAAUs"]
[Thu Apr 09 21:34:37.798050 2026] [:error] [pid 18477:tid 18495] [client 4.225.204.246:33825] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adeq7cDe826HlFeoLPKhsQAAAVA"]
[Thu Apr 09 21:34:40.619440 2026] [proxy_fcgi:error] [pid 18477:tid 18501] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:40.884917 2026] [proxy_fcgi:error] [pid 18477:tid 18485] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:41.468885 2026] [proxy_fcgi:error] [pid 18477:tid 18488] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:41.734988 2026] [proxy_fcgi:error] [pid 18477:tid 18491] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:42.015672 2026] [proxy_fcgi:error] [pid 18477:tid 18480] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:42.291753 2026] [proxy_fcgi:error] [pid 18477:tid 18499] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:42.768667 2026] [proxy_fcgi:error] [pid 18477:tid 18479] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:43.034083 2026] [proxy_fcgi:error] [pid 18477:tid 18481] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:43.300741 2026] [proxy_fcgi:error] [pid 18477:tid 18496] [client 4.225.204.246:6113] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:34:43.828985 2026] [:error] [pid 18477:tid 18484] [client 4.225.204.246:6113] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeq88De826HlFeoLPKhwgAAAUU"]
[Thu Apr 09 21:34:44.568983 2026] [:error] [pid 20837:tid 20848] [client 4.225.204.246:6047] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeq9PSL71FHZkjrGzP6UQAAAYk"]
[Thu Apr 09 21:34:45.393279 2026] [:error] [pid 63331:tid 63356] [client 4.225.204.246:6100] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeq9SbKfIYuVjWbE4V48AAAAdc"]
[Thu Apr 09 21:34:46.024573 2026] [:error] [pid 24624:tid 24632] [client 4.225.204.246:33761] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeq9u4Jn-WvK1ZBTvjjrAAAAMY"]
[Thu Apr 09 21:34:46.621899 2026] [:error] [pid 24517:tid 24587] [client 4.225.204.246:33749] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adeq9nboYEn2ZFM_PS-DggAAAI0"]
[Thu Apr 09 21:34:47.302832 2026] [:error] [pid 63331:tid 63353] [client 4.225.204.246:33785] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adeq9ybKfIYuVjWbE4V49QAAAdQ"]
[Thu Apr 09 21:34:47.893543 2026] [:error] [pid 20837:tid 20845] [client 4.225.204.246:33827] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adeq9_SL71FHZkjrGzP6WQAAAYY"]
[Thu Apr 09 21:34:48.591455 2026] [:error] [pid 20837:tid 20850] [client 4.225.204.246:6086] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adeq-PSL71FHZkjrGzP6XgAAAYs"]
[Thu Apr 09 21:34:49.282358 2026] [:error] [pid 24624:tid 24646] [client 4.225.204.246:6033] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adeq-e4Jn-WvK1ZBTvjjsAAAANQ"]
[Thu Apr 09 21:34:49.914210 2026] [:error] [pid 24624:tid 24633] [client 4.225.204.246:6111] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adeq-e4Jn-WvK1ZBTvjjsgAAAMc"]
[Thu Apr 09 21:34:50.501073 2026] [:error] [pid 24624:tid 24640] [client 4.225.204.246:6116] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adeq-u4Jn-WvK1ZBTvjjtQAAAM4"]
[Thu Apr 09 21:34:51.217054 2026] [:error] [pid 24624:tid 24638] [client 4.225.204.246:6109] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adeq--4Jn-WvK1ZBTvjjugAAAMw"]
[Thu Apr 09 21:34:51.854798 2026] [:error] [pid 24624:tid 24627] [client 4.225.204.246:33728] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeq--4Jn-WvK1ZBTvjjvAAAAME"]
[Thu Apr 09 21:34:52.429460 2026] [:error] [pid 24624:tid 24642] [client 4.225.204.246:6103] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeq_O4Jn-WvK1ZBTvjjvgAAANA"]
[Thu Apr 09 21:34:53.007300 2026] [:error] [pid 18477:tid 18494] [client 4.225.204.246:6117] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeq_cDe826HlFeoLPKhyQAAAU8"]
[Thu Apr 09 21:34:53.607453 2026] [:error] [pid 24517:tid 24580] [client 4.225.204.246:33750] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adeq_XboYEn2ZFM_PS-DhgAAAIY"]
[Thu Apr 09 21:34:54.316823 2026] [:error] [pid 18477:tid 18491] [client 4.225.204.246:33842] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeq_sDe826HlFeoLPKhzQAAAUw"]
[Thu Apr 09 21:34:54.902829 2026] [:error] [pid 24624:tid 24647] [client 4.225.204.246:6106] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeq_u4Jn-WvK1ZBTvjjvwAAANU"]
[Thu Apr 09 21:34:55.711670 2026] [:error] [pid 24517:tid 24584] [client 4.225.204.246:33740] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adeq_3boYEn2ZFM_PS-DhwAAAIo"]
[Thu Apr 09 21:34:56.521763 2026] [:error] [pid 63331:tid 63338] [client 4.225.204.246:6114] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "aderACbKfIYuVjWbE4V49wAAAcU"]
[Thu Apr 09 21:34:57.222993 2026] [:error] [pid 20837:tid 20853] [client 4.225.204.246:33730] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "aderAfSL71FHZkjrGzP6YwAAAY4"]
[Thu Apr 09 21:34:57.812153 2026] [:error] [pid 24624:tid 24646] [client 4.225.204.246:6082] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "aderAe4Jn-WvK1ZBTvjjwAAAANQ"]
[Thu Apr 09 21:34:58.435693 2026] [:error] [pid 63331:tid 63339] [client 4.225.204.246:6024] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "aderAibKfIYuVjWbE4V4-QAAAcY"]
[Thu Apr 09 21:34:59.583175 2026] [:error] [pid 20837:tid 20857] [client 4.225.204.246:33752] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "aderA_SL71FHZkjrGzP6ZQAAAZI"]
[Thu Apr 09 21:35:00.183186 2026] [:error] [pid 20837:tid 20858] [client 4.225.204.246:33838] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "aderBPSL71FHZkjrGzP6ZwAAAZM"]
[Thu Apr 09 21:35:00.850552 2026] [:error] [pid 20837:tid 20850] [client 4.225.204.246:33743] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "aderBPSL71FHZkjrGzP6aQAAAYs"]
[Thu Apr 09 21:35:01.459775 2026] [:error] [pid 24624:tid 24650] [client 4.225.204.246:33736] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "aderBe4Jn-WvK1ZBTvjjxAAAANg"]
[Thu Apr 09 21:35:02.032968 2026] [:error] [pid 24624:tid 24648] [client 4.225.204.246:33780] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "aderBu4Jn-WvK1ZBTvjjxQAAANY"]
[Thu Apr 09 21:35:02.723854 2026] [:error] [pid 24515:tid 24540] [client 4.225.204.246:6129] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aderBq1OMnvM2fMnB1PGLwAAABU"]
[Thu Apr 09 21:35:03.388014 2026] [:error] [pid 24515:tid 24535] [client 4.225.204.246:33846] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aderB61OMnvM2fMnB1PGNAAAABA"]
[Thu Apr 09 21:35:03.948697 2026] [:error] [pid 24927:tid 24951] [client 4.225.204.246:6115] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aderBzXObuzEuw8mNJsphwAAARU"]
[Thu Apr 09 21:35:04.538094 2026] [:error] [pid 24624:tid 24631] [client 4.225.204.246:33770] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aderCO4Jn-WvK1ZBTvjjxwAAAMU"]
[Thu Apr 09 21:35:05.181773 2026] [:error] [pid 24624:tid 24649] [client 4.225.204.246:33741] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aderCe4Jn-WvK1ZBTvjjyQAAANc"]
[Thu Apr 09 21:35:05.758260 2026] [:error] [pid 24624:tid 24641] [client 4.225.204.246:33831] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aderCe4Jn-WvK1ZBTvjjzQAAAM8"]
[Thu Apr 09 21:35:06.382965 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:6044] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aderCu4Jn-WvK1ZBTvjjzwAAAMk"]
[Thu Apr 09 21:35:06.992995 2026] [:error] [pid 24624:tid 24647] [client 4.225.204.246:6027] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "aderCu4Jn-WvK1ZBTvjj0AAAANU"]
[Thu Apr 09 21:35:07.624983 2026] [:error] [pid 24624:tid 24644] [client 4.225.204.246:33756] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "aderC-4Jn-WvK1ZBTvjj0wAAANI"]
[Thu Apr 09 21:35:08.292636 2026] [:error] [pid 24516:tid 24563] [client 4.225.204.246:6128] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "aderDNhW7vSS-UkeWCU2HQAAAFA"]
[Thu Apr 09 21:35:08.844346 2026] [:error] [pid 24624:tid 24628] [client 4.225.204.246:33777] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "aderDO4Jn-WvK1ZBTvjj1wAAAMI"]
[Thu Apr 09 21:35:09.620312 2026] [:error] [pid 63331:tid 63333] [client 4.225.204.246:6139] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "aderDSbKfIYuVjWbE4V5AAAAAcA"]
[Thu Apr 09 21:35:10.200477 2026] [:error] [pid 63331:tid 63337] [client 4.225.204.246:33763] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aderDibKfIYuVjWbE4V5AQAAAcQ"]
[Thu Apr 09 21:35:10.746347 2026] [:error] [pid 24624:tid 24649] [client 4.225.204.246:6063] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aderDu4Jn-WvK1ZBTvjj2gAAANc"]
[Thu Apr 09 21:35:11.377569 2026] [:error] [pid 24624:tid 24641] [client 4.225.204.246:33839] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aderD-4Jn-WvK1ZBTvjj3AAAAM8"]
[Thu Apr 09 21:35:11.941834 2026] [:error] [pid 63331:tid 63353] [client 4.225.204.246:33806] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aderDybKfIYuVjWbE4V5AgAAAdQ"]
[Thu Apr 09 21:35:12.706990 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:33771] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "aderEO4Jn-WvK1ZBTvjj4AAAAMk"]
[Thu Apr 09 21:35:13.282373 2026] [:error] [pid 63331:tid 63338] [client 4.225.204.246:6043] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "aderESbKfIYuVjWbE4V5BAAAAcU"]
[Thu Apr 09 21:35:13.833002 2026] [:error] [pid 18477:tid 18487] [client 4.225.204.246:6141] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "aderEcDe826HlFeoLPKh1gAAAUg"]
[Thu Apr 09 21:35:14.456336 2026] [:error] [pid 24515:tid 24537] [client 4.225.204.246:5768] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "aderEq1OMnvM2fMnB1PGOQAAABI"]
[Thu Apr 09 21:35:15.100802 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:33789] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aderE61OMnvM2fMnB1PGOgAAABc"]
[Thu Apr 09 21:35:15.719264 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:6119] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aderE61OMnvM2fMnB1PGPAAAAAg"]
[Thu Apr 09 21:35:16.321970 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:33774] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aderFK1OMnvM2fMnB1PGPwAAAA8"]
[Thu Apr 09 21:35:16.873813 2026] [:error] [pid 24515:tid 24535] [client 4.225.204.246:6062] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aderFK1OMnvM2fMnB1PGQQAAABA"]
[Thu Apr 09 21:35:17.451570 2026] [:error] [pid 24927:tid 24934] [client 4.225.204.246:33798] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aderFTXObuzEuw8mNJspigAAAQQ"]
[Thu Apr 09 21:35:18.056691 2026] [:error] [pid 24927:tid 24942] [client 4.225.204.246:5784] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aderFjXObuzEuw8mNJspiwAAAQw"]
[Thu Apr 09 21:35:18.617937 2026] [:error] [pid 24927:tid 24952] [client 4.225.204.246:33813] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aderFjXObuzEuw8mNJspjAAAARY"]
[Thu Apr 09 21:35:20.151817 2026] [:error] [pid 24927:tid 24944] [client 4.225.204.246:6077] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aderGDXObuzEuw8mNJspjQAAAQ4"]
[Thu Apr 09 21:35:20.720017 2026] [:error] [pid 24624:tid 24628] [client 4.225.204.246:33760] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aderGO4Jn-WvK1ZBTvjj4wAAAMI"]
[Thu Apr 09 21:35:21.336968 2026] [:error] [pid 24624:tid 24646] [client 4.225.204.246:6087] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aderGe4Jn-WvK1ZBTvjj5QAAANQ"]
[Thu Apr 09 21:35:22.252517 2026] [:error] [pid 24624:tid 24640] [client 4.225.204.246:6095] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aderGu4Jn-WvK1ZBTvjj5gAAAM4"]
[Thu Apr 09 21:35:22.854730 2026] [:error] [pid 63331:tid 63355] [client 4.225.204.246:33805] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aderGibKfIYuVjWbE4V5DgAAAdY"]
[Thu Apr 09 21:35:23.515651 2026] [:error] [pid 63331:tid 63352] [client 4.225.204.246:33751] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "aderGybKfIYuVjWbE4V5DwAAAdM"]
[Thu Apr 09 21:35:24.118426 2026] [:error] [pid 63331:tid 63333] [client 4.225.204.246:33755] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "aderHCbKfIYuVjWbE4V5EAAAAcA"]
[Thu Apr 09 21:35:24.681505 2026] [:error] [pid 63331:tid 63337] [client 4.225.204.246:33790] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "aderHCbKfIYuVjWbE4V5EQAAAcQ"]
[Thu Apr 09 21:35:25.438345 2026] [:error] [pid 63331:tid 63346] [client 4.225.204.246:33753] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "aderHSbKfIYuVjWbE4V5EwAAAc0"]
[Thu Apr 09 21:35:26.044562 2026] [:error] [pid 63331:tid 63343] [client 4.225.204.246:33781] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "aderHibKfIYuVjWbE4V5FgAAAco"]
[Thu Apr 09 21:35:26.711522 2026] [:error] [pid 63331:tid 63336] [client 4.225.204.246:6031] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "aderHibKfIYuVjWbE4V5GAAAAcM"]
[Thu Apr 09 21:35:27.295627 2026] [:error] [pid 24517:tid 24594] [client 4.225.204.246:5766] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "aderH3boYEn2ZFM_PS-DjwAAAJQ"]
[Thu Apr 09 21:35:27.879633 2026] [:error] [pid 24624:tid 24649] [client 4.225.204.246:6058] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "aderH-4Jn-WvK1ZBTvjj5wAAANc"]
[Thu Apr 09 21:35:28.528105 2026] [:error] [pid 63331:tid 63350] [client 4.225.204.246:6127] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aderICbKfIYuVjWbE4V5HAAAAdE"]
[Thu Apr 09 21:35:29.227740 2026] [:error] [pid 63331:tid 63352] [client 4.225.204.246:6020] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aderISbKfIYuVjWbE4V5HQAAAdM"]
[Thu Apr 09 21:35:29.844353 2026] [:error] [pid 24624:tid 24634] [client 4.225.204.246:6054] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aderIe4Jn-WvK1ZBTvjj6QAAAMg"]
[Thu Apr 09 21:35:30.452267 2026] [:error] [pid 63331:tid 63337] [client 4.225.204.246:6064] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aderIibKfIYuVjWbE4V5HgAAAcQ"]
[Thu Apr 09 21:35:30.991356 2026] [:error] [pid 63331:tid 63345] [client 4.225.204.246:6118] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "aderIibKfIYuVjWbE4V5HwAAAcw"]
[Thu Apr 09 21:35:31.614836 2026] [:error] [pid 63331:tid 63346] [client 4.225.204.246:6016] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "aderIybKfIYuVjWbE4V5IQAAAc0"]
[Thu Apr 09 21:35:32.199151 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:6135] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "aderJK1OMnvM2fMnB1PGRwAAABc"]
[Thu Apr 09 21:35:32.732629 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:6080] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "aderJK1OMnvM2fMnB1PGSAAAAAg"]
[Thu Apr 09 21:35:33.292028 2026] [:error] [pid 63331:tid 63339] [client 4.225.204.246:6022] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aderJSbKfIYuVjWbE4V5IwAAAcY"]
[Thu Apr 09 21:35:33.875645 2026] [:error] [pid 24927:tid 24940] [client 4.225.204.246:33801] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aderJTXObuzEuw8mNJspkQAAAQo"]
[Thu Apr 09 21:35:34.472004 2026] [:error] [pid 24515:tid 24526] [client 4.225.204.246:6069] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aderJq1OMnvM2fMnB1PGSQAAAAc"]
[Thu Apr 09 21:35:35.155829 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:6085] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aderJ61OMnvM2fMnB1PGTAAAAA8"]
[Thu Apr 09 21:35:35.995613 2026] [:error] [pid 24624:tid 24635] [client 4.225.204.246:6046] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "aderJ-4Jn-WvK1ZBTvjj7AAAAMk"]
[Thu Apr 09 21:35:36.887990 2026] [:error] [pid 63331:tid 63340] [client 4.225.204.246:6056] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "aderKCbKfIYuVjWbE4V5JAAAAcc"]
[Thu Apr 09 21:35:37.435052 2026] [:error] [pid 63331:tid 63336] [client 4.225.204.246:6130] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "aderKSbKfIYuVjWbE4V5JQAAAcM"]
[Thu Apr 09 21:35:38.010954 2026] [:error] [pid 24624:tid 24629] [client 4.225.204.246:33797] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "aderKu4Jn-WvK1ZBTvjj7wAAAMM"]
[Thu Apr 09 21:35:38.674852 2026] [:error] [pid 24624:tid 24633] [client 4.225.204.246:6084] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "aderKu4Jn-WvK1ZBTvjj8gAAAMc"]
[Thu Apr 09 21:35:39.427328 2026] [:error] [pid 24515:tid 24540] [client 4.225.204.246:6048] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "aderK61OMnvM2fMnB1PGTwAAABU"]
[Thu Apr 09 21:35:40.130282 2026] [:error] [pid 20837:tid 20855] [client 4.225.204.246:6124] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "aderLPSL71FHZkjrGzP6bwAAAZA"]
[Thu Apr 09 21:35:40.861323 2026] [:error] [pid 24516:tid 24566] [client 4.225.204.246:33779] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "aderLNhW7vSS-UkeWCU2KQAAAFM"]
[Thu Apr 09 21:35:41.528161 2026] [:error] [pid 18477:tid 18485] [client 4.225.204.246:6091] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aderLcDe826HlFeoLPKh3gAAAUY"]
[Thu Apr 09 21:35:42.134001 2026] [:error] [pid 18477:tid 18503] [client 4.225.204.246:6107] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aderLsDe826HlFeoLPKh3wAAAVg"]
[Thu Apr 09 21:35:42.733495 2026] [:error] [pid 18477:tid 18482] [client 4.225.204.246:33804] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aderLsDe826HlFeoLPKh4AAAAUM"]
[Thu Apr 09 21:35:43.403455 2026] [proxy_fcgi:error] [pid 18477:tid 18500] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:43.669799 2026] [proxy_fcgi:error] [pid 18477:tid 18486] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:43.936671 2026] [proxy_fcgi:error] [pid 18477:tid 18493] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:44.211011 2026] [proxy_fcgi:error] [pid 18477:tid 18502] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:44.489115 2026] [proxy_fcgi:error] [pid 18477:tid 18487] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:44.756085 2026] [proxy_fcgi:error] [pid 18477:tid 18498] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:45.024440 2026] [proxy_fcgi:error] [pid 18477:tid 18489] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:45.291863 2026] [proxy_fcgi:error] [pid 18477:tid 18490] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:45.587861 2026] [proxy_fcgi:error] [pid 18477:tid 18495] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:45.860718 2026] [proxy_fcgi:error] [pid 18477:tid 18494] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:46.128914 2026] [proxy_fcgi:error] [pid 18477:tid 18501] [client 4.225.204.246:6107] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:35:46.391875 2026] [:error] [pid 18477:tid 18492] [client 4.225.204.246:6107] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aderMsDe826HlFeoLPKh7wAAAU0"]
[Thu Apr 09 21:35:47.982727 2026] [:error] [pid 24515:tid 24532] [client 4.225.204.246:5781] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aderM61OMnvM2fMnB1PGUQAAAA0"]
[Thu Apr 09 21:35:48.532978 2026] [:error] [pid 20837:tid 20839] [client 4.225.204.246:6042] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aderNPSL71FHZkjrGzP6cAAAAYA"]
[Thu Apr 09 21:35:49.132105 2026] [:error] [pid 24515:tid 24536] [client 4.225.204.246:6104] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aderNa1OMnvM2fMnB1PGVAAAABE"]
[Thu Apr 09 21:35:49.774592 2026] [:error] [pid 24515:tid 24527] [client 4.225.204.246:6089] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aderNa1OMnvM2fMnB1PGVQAAAAg"]
[Thu Apr 09 21:35:50.443184 2026] [:error] [pid 24515:tid 24526] [client 4.225.204.246:33742] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aderNq1OMnvM2fMnB1PGVgAAAAc"]
[Thu Apr 09 21:35:51.056036 2026] [:error] [pid 24515:tid 24534] [client 4.225.204.246:33815] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aderN61OMnvM2fMnB1PGVwAAAA8"]
[Thu Apr 09 21:35:51.614485 2026] [:error] [pid 24515:tid 24525] [client 4.225.204.246:6132] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aderN61OMnvM2fMnB1PGWAAAAAY"]
[Thu Apr 09 21:35:52.163177 2026] [:error] [pid 20837:tid 20859] [client 4.225.204.246:6097] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aderOPSL71FHZkjrGzP6dQAAAZQ"]
[Thu Apr 09 21:35:52.987199 2026] [:error] [pid 24515:tid 24521] [client 4.225.204.246:6026] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aderOK1OMnvM2fMnB1PGWwAAAAI"]
[Thu Apr 09 21:35:53.564784 2026] [:error] [pid 63331:tid 63340] [client 4.225.204.246:6131] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aderOSbKfIYuVjWbE4V5UQAAAcc"]
[Thu Apr 09 21:35:54.118692 2026] [:error] [pid 63331:tid 63338] [client 4.225.204.246:33822] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aderOibKfIYuVjWbE4V5UwAAAcU"]
[Thu Apr 09 21:35:54.670196 2026] [:error] [pid 63331:tid 63335] [client 4.225.204.246:6034] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aderOibKfIYuVjWbE4V5VgAAAcI"]
[Thu Apr 09 21:35:55.253942 2026] [:error] [pid 63331:tid 63343] [client 4.225.204.246:6090] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aderOybKfIYuVjWbE4V5WAAAAco"]
[Thu Apr 09 21:35:55.801286 2026] [:error] [pid 63331:tid 63349] [client 4.225.204.246:5765] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aderOybKfIYuVjWbE4V5XQAAAdA"]
[Thu Apr 09 21:35:56.523021 2026] [:error] [pid 20837:tid 20854] [client 4.225.204.246:6133] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aderPPSL71FHZkjrGzP6ewAAAY8"]
[Thu Apr 09 21:35:57.280884 2026] [:error] [pid 24515:tid 24531] [client 4.225.204.246:33776] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aderPa1OMnvM2fMnB1PGXAAAAAw"]
[Thu Apr 09 21:35:57.918142 2026] [:error] [pid 24624:tid 24626] [client 4.225.204.246:6055] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aderPe4Jn-WvK1ZBTvjj9wAAAMA"]
[Thu Apr 09 21:35:58.559910 2026] [:error] [pid 18477:tid 18482] [client 4.225.204.246:33762] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aderPsDe826HlFeoLPKh9AAAAUM"]
[Thu Apr 09 21:35:59.221739 2026] [:error] [pid 24515:tid 24520] [client 4.225.204.246:33843] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aderP61OMnvM2fMnB1PGXwAAAAE"]
[Thu Apr 09 21:35:59.769897 2026] [:error] [pid 24515:tid 24542] [client 4.225.204.246:5796] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aderP61OMnvM2fMnB1PGYgAAABc"]
[Thu Apr 09 21:36:00.517661 2026] [:error] [pid 20837:tid 20858] [client 4.225.204.246:5762] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aderQPSL71FHZkjrGzP6jQAAAZM"]
[Thu Apr 09 21:36:01.061931 2026] [:error] [pid 18477:tid 18481] [client 4.225.204.246:6094] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aderQcDe826HlFeoLPKh9QAAAUI"]
[Thu Apr 09 21:36:01.671606 2026] [:error] [pid 24515:tid 24529] [client 4.225.204.246:6049] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aderQa1OMnvM2fMnB1PGZgAAAAo"]
[Thu Apr 09 21:36:02.206528 2026] [:error] [pid 20837:tid 20841] [client 4.225.204.246:5809] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aderQvSL71FHZkjrGzP6lAAAAYI"]
[Thu Apr 09 21:36:02.936004 2026] [:error] [pid 63331:tid 63346] [client 4.225.204.246:33803] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aderQibKfIYuVjWbE4V5ewAAAc0"]
[Thu Apr 09 21:36:03.504453 2026] [:error] [pid 63331:tid 63336] [client 4.225.204.246:33773] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aderQybKfIYuVjWbE4V5gAAAAcM"]
[Thu Apr 09 21:36:04.069860 2026] [:error] [pid 24515:tid 24533] [client 4.225.204.246:6032] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aderRK1OMnvM2fMnB1PGZwAAAA4"]
[Thu Apr 09 21:36:04.600826 2026] [:error] [pid 18477:tid 18486] [client 4.225.204.246:6051] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "aderRMDe826HlFeoLPKh-AAAAUc"]
[Thu Apr 09 21:36:05.259617 2026] [:error] [pid 24516:tid 24550] [client 4.225.204.246:6036] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "aderRdhW7vSS-UkeWCU2NgAAAEM"]
[Thu Apr 09 21:36:05.918002 2026] [:error] [pid 24515:tid 24536] [client 4.225.204.246:6081] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "aderRa1OMnvM2fMnB1PGbAAAABE"]
[Thu Apr 09 21:36:06.563488 2026] [:error] [pid 20837:tid 20852] [client 4.225.204.246:5792] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "aderRvSL71FHZkjrGzP6nAAAAY0"]
[Thu Apr 09 21:36:07.161952 2026] [:error] [pid 20837:tid 20855] [client 4.225.204.246:6138] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "aderR_SL71FHZkjrGzP6nQAAAZA"]
[Thu Apr 09 21:36:07.802000 2026] [:error] [pid 63331:tid 63352] [client 4.225.204.246:6122] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "aderRybKfIYuVjWbE4V5jwAAAdM"]
[Thu Apr 09 21:36:08.385130 2026] [:error] [pid 24927:tid 24930] [client 4.225.204.246:6045] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "aderSDXObuzEuw8mNJsp_gAAAQA"]
[Thu Apr 09 21:36:09.028282 2026] [:error] [pid 24516:tid 24563] [client 4.225.204.246:6078] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "aderSdhW7vSS-UkeWCU2OQAAAFA"]
[Thu Apr 09 21:36:09.698601 2026] [:error] [pid 63331:tid 63335] [client 4.225.204.246:6059] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aderSSbKfIYuVjWbE4V5mgAAAcI"]
[Thu Apr 09 21:36:10.331076 2026] [:error] [pid 24927:tid 24949] [client 4.225.204.246:6041] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aderSjXObuzEuw8mNJsqBQAAARM"]
[Thu Apr 09 21:36:10.908071 2026] [:error] [pid 24927:tid 24933] [client 4.225.204.246:5954] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aderSjXObuzEuw8mNJsqBgAAAQM"]
[Thu Apr 09 21:36:11.568789 2026] [:error] [pid 20837:tid 20852] [client 4.225.204.246:6110] [client 4.225.204.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aderS_SL71FHZkjrGzP6rQAAAY0"]
[Thu Apr 09 21:44:46.769023 2026] [proxy_fcgi:error] [pid 24516:tid 24556] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:47.038126 2026] [proxy_fcgi:error] [pid 24516:tid 24553] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:47.301491 2026] [proxy_fcgi:error] [pid 24516:tid 24560] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:47.565336 2026] [proxy_fcgi:error] [pid 24516:tid 24561] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:47.828136 2026] [proxy_fcgi:error] [pid 24516:tid 24567] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:48.091489 2026] [proxy_fcgi:error] [pid 24516:tid 24565] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:48.356794 2026] [proxy_fcgi:error] [pid 24516:tid 24549] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:48.644433 2026] [proxy_fcgi:error] [pid 24516:tid 24571] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:48.922496 2026] [proxy_fcgi:error] [pid 24516:tid 24547] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:49.196304 2026] [proxy_fcgi:error] [pid 24516:tid 24559] [client 20.100.175.19:55696] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:44:49.456377 2026] [:error] [pid 24516:tid 24555] [client 20.100.175.19:55696] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetUdhW7vSS-UkeWCU3lQAAAEg"]
[Thu Apr 09 21:44:51.386655 2026] [:error] [pid 24927:tid 24932] [client 20.100.175.19:3363] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetUzXObuzEuw8mNJsrIwAAAQI"]
[Thu Apr 09 21:44:52.365177 2026] [:error] [pid 24515:tid 24539] [client 20.100.175.19:53007] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetVK1OMnvM2fMnB1PLEwAAABQ"]
[Thu Apr 09 21:44:53.131127 2026] [:error] [pid 63331:tid 63333] [client 20.100.175.19:55148] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetVSbKfIYuVjWbE4V9MgAAAcA"]
[Thu Apr 09 21:44:54.754735 2026] [:error] [pid 63331:tid 63347] [client 20.100.175.19:3267] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetVibKfIYuVjWbE4V9NwAAAc4"]
[Thu Apr 09 21:44:56.600676 2026] [:error] [pid 63331:tid 63334] [client 20.100.175.19:43835] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetWCbKfIYuVjWbE4V9OQAAAcE"]
[Thu Apr 09 21:44:58.062163 2026] [:error] [pid 24515:tid 24543] [client 20.100.175.19:42392] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetWq1OMnvM2fMnB1PLKQAAABg"]
[Thu Apr 09 21:44:59.038337 2026] [:error] [pid 63331:tid 63343] [client 20.100.175.19:52550] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetWybKfIYuVjWbE4V9RwAAAco"]
[Thu Apr 09 21:45:01.431606 2026] [:error] [pid 24515:tid 24536] [client 20.100.175.19:41666] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adetXa1OMnvM2fMnB1PLNAAAABE"]
[Thu Apr 09 21:45:04.788195 2026] [:error] [pid 24515:tid 24533] [client 20.100.175.19:3868] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adetYK1OMnvM2fMnB1PLSAAAAA4"]
[Thu Apr 09 21:45:06.881375 2026] [:error] [pid 24624:tid 24627] [client 20.100.175.19:55182] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adetYu4Jn-WvK1ZBTvjldQAAAME"]
[Thu Apr 09 21:45:10.552452 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:3406] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adetZq1OMnvM2fMnB1PLXwAAAAE"]
[Thu Apr 09 21:45:16.155034 2026] [:error] [pid 20837:tid 20849] [client 20.100.175.19:58273] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adetbPSL71FHZkjrGzP9mgAAAYo"]
[Thu Apr 09 21:45:27.777867 2026] [:error] [pid 18477:tid 18494] [client 20.100.175.19:53515] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adetd8De826HlFeoLPKjIgAAAU8"]
[Thu Apr 09 21:45:33.397903 2026] [:error] [pid 20837:tid 20850] [client 20.100.175.19:64366] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adetffSL71FHZkjrGzP9tQAAAYs"]
[Thu Apr 09 21:45:39.744148 2026] [:error] [pid 63331:tid 63337] [client 20.100.175.19:58797] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adetgybKfIYuVjWbE4V9gwAAAcQ"]
[Thu Apr 09 21:45:45.343722 2026] [:error] [pid 20837:tid 20847] [client 20.100.175.19:4008] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adetifSL71FHZkjrGzP9xgAAAYg"]
[Thu Apr 09 21:45:48.583224 2026] [:error] [pid 24515:tid 24524] [client 20.100.175.19:3984] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adetjK1OMnvM2fMnB1PMEQAAAAU"]
[Thu Apr 09 21:45:53.310640 2026] [proxy_fcgi:error] [pid 24927:tid 24951] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:53.574926 2026] [proxy_fcgi:error] [pid 24927:tid 24953] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:53.842549 2026] [proxy_fcgi:error] [pid 24927:tid 24930] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:54.117779 2026] [proxy_fcgi:error] [pid 24927:tid 24936] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:54.391835 2026] [proxy_fcgi:error] [pid 24927:tid 24931] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:54.658150 2026] [proxy_fcgi:error] [pid 24927:tid 24937] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:54.929419 2026] [proxy_fcgi:error] [pid 24927:tid 24943] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:55.224787 2026] [proxy_fcgi:error] [pid 24927:tid 24932] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:55.505176 2026] [proxy_fcgi:error] [pid 24927:tid 24940] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:55.773774 2026] [proxy_fcgi:error] [pid 24927:tid 24941] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:56.045073 2026] [proxy_fcgi:error] [pid 24927:tid 24954] [client 20.100.175.19:44764] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:45:56.342763 2026] [:error] [pid 24927:tid 24948] [client 20.100.175.19:44764] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adetlDXObuzEuw8mNJsrRQAAARI"]
[Thu Apr 09 21:46:06.257391 2026] [proxy_fcgi:error] [pid 63331:tid 63357] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:06.475607 2026] [:error] [pid 24515:tid 24531] [client 20.100.175.19:57657] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "adetnq1OMnvM2fMnB1PMdAAAAAw"]
[Thu Apr 09 21:46:06.493962 2026] [proxy_fcgi:error] [pid 63331:tid 63345] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:06.732119 2026] [proxy_fcgi:error] [pid 63331:tid 63351] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:06.974643 2026] [proxy_fcgi:error] [pid 63331:tid 63338] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:07.211330 2026] [proxy_fcgi:error] [pid 63331:tid 63350] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:07.448289 2026] [proxy_fcgi:error] [pid 63331:tid 63346] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:07.686380 2026] [proxy_fcgi:error] [pid 63331:tid 63334] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:07.939280 2026] [proxy_fcgi:error] [pid 63331:tid 63340] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:08.175576 2026] [proxy_fcgi:error] [pid 63331:tid 63339] [client 4.232.92.99:60087] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:08.408536 2026] [:error] [pid 63331:tid 63349] [client 4.232.92.99:60087] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adetoCbKfIYuVjWbE4V9zwAAAdA"]
[Thu Apr 09 21:46:10.068504 2026] [:error] [pid 63331:tid 63341] [client 4.232.92.99:38926] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adetoibKfIYuVjWbE4V93AAAAcg"]
[Thu Apr 09 21:46:11.022516 2026] [:error] [pid 63331:tid 63336] [client 4.232.92.99:60063] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adetoybKfIYuVjWbE4V94wAAAcM"]
[Thu Apr 09 21:46:12.832762 2026] [:error] [pid 24624:tid 24632] [client 4.232.92.99:48053] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adetpO4Jn-WvK1ZBTvjl-QAAAMY"]
[Thu Apr 09 21:46:14.055156 2026] [:error] [pid 20837:tid 20858] [client 4.232.92.99:60059] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetpvSL71FHZkjrGzP97QAAAZM"]
[Thu Apr 09 21:46:14.795554 2026] [:error] [pid 24515:tid 24523] [client 4.232.92.99:36004] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetpq1OMnvM2fMnB1PMfwAAAAQ"]
[Thu Apr 09 21:46:15.508060 2026] [:error] [pid 24515:tid 24532] [client 4.232.92.99:50851] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetp61OMnvM2fMnB1PMgQAAAA0"]
[Thu Apr 09 21:46:18.290580 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:55548] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adetqibKfIYuVjWbE4V97wAAAc8"]
[Thu Apr 09 21:46:18.950986 2026] [:error] [pid 24516:tid 24561] [client 4.232.92.99:46174] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetqthW7vSS-UkeWCU3ywAAAE4"]
[Thu Apr 09 21:46:20.629421 2026] [:error] [pid 24515:tid 24522] [client 4.232.92.99:43353] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetrK1OMnvM2fMnB1PMkgAAAAM"]
[Thu Apr 09 21:46:21.815188 2026] [:error] [pid 24515:tid 24530] [client 4.232.92.99:57210] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetra1OMnvM2fMnB1PMlgAAAAs"]
[Thu Apr 09 21:46:23.609335 2026] [:error] [pid 24927:tid 24940] [client 4.232.92.99:49789] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adetrzXObuzEuw8mNJsrXAAAAQo"]
[Thu Apr 09 21:46:27.592588 2026] [:error] [pid 63331:tid 63348] [client 4.232.92.99:46228] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adetsybKfIYuVjWbE4V9_QAAAc8"]
[Thu Apr 09 21:46:40.087404 2026] [:error] [pid 24927:tid 24936] [client 4.232.92.99:49786] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adetwDXObuzEuw8mNJsrawAAAQY"]
[Thu Apr 09 21:46:46.969989 2026] [:error] [pid 20837:tid 20844] [client 20.100.175.19:45060] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adetxvSL71FHZkjrGzP-FQAAAYU"]
[Thu Apr 09 21:46:50.200717 2026] [:error] [pid 24517:tid 24586] [client 4.232.92.99:41369] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adetynboYEn2ZFM_PS-E7QAAAIw"]
[Thu Apr 09 21:46:51.085793 2026] [:error] [pid 24515:tid 24535] [client 20.100.175.19:60293] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adety61OMnvM2fMnB1PNLgAAABA"]
[Thu Apr 09 21:46:54.258699 2026] [:error] [pid 63331:tid 63339] [client 20.100.175.19:40693] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adetzibKfIYuVjWbE4V-bAAAAcY"]
[Thu Apr 09 21:46:55.751601 2026] [:error] [pid 63331:tid 63353] [client 4.232.92.99:46220] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "adetzybKfIYuVjWbE4V-dAAAAdQ"]
[Thu Apr 09 21:46:56.503480 2026] [proxy_fcgi:error] [pid 63331:tid 63340] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:56.766979 2026] [proxy_fcgi:error] [pid 63331:tid 63341] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:57.031907 2026] [proxy_fcgi:error] [pid 63331:tid 63350] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:57.369123 2026] [proxy_fcgi:error] [pid 63331:tid 63343] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:57.632913 2026] [proxy_fcgi:error] [pid 63331:tid 63353] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:58.166314 2026] [proxy_fcgi:error] [pid 63331:tid 63340] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:58.434797 2026] [proxy_fcgi:error] [pid 63331:tid 63337] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:58.726857 2026] [proxy_fcgi:error] [pid 63331:tid 63344] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:59.005902 2026] [proxy_fcgi:error] [pid 63331:tid 63333] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:59.270548 2026] [proxy_fcgi:error] [pid 63331:tid 63348] [client 20.100.175.19:40677] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:46:59.550799 2026] [:error] [pid 63331:tid 63352] [client 20.100.175.19:40677] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adet0ybKfIYuVjWbE4V-mwAAAdM"]
[Thu Apr 09 21:47:03.025655 2026] [:error] [pid 24517:tid 24588] [client 20.100.175.19:61310] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adet13boYEn2ZFM_PS-E7gAAAI4"]
[Thu Apr 09 21:47:05.806634 2026] [:error] [pid 24624:tid 24638] [client 4.232.92.99:4681] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adet2e4Jn-WvK1ZBTvjmFgAAAMw"]
[Thu Apr 09 21:47:06.765150 2026] [:error] [pid 20837:tid 20851] [client 20.100.175.19:60317] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adet2vSL71FHZkjrGzP-QQAAAYw"]
[Thu Apr 09 21:47:08.997286 2026] [:error] [pid 24624:tid 24639] [client 20.100.175.19:54623] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adet3O4Jn-WvK1ZBTvjmGgAAAM0"]
[Thu Apr 09 21:47:11.587375 2026] [:error] [pid 20837:tid 20848] [client 20.100.175.19:60310] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adet3_SL71FHZkjrGzP-VAAAAYk"]
[Thu Apr 09 21:47:12.653835 2026] [proxy_fcgi:error] [pid 63331:tid 63335] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:12.890055 2026] [proxy_fcgi:error] [pid 63331:tid 63338] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:13.138742 2026] [proxy_fcgi:error] [pid 63331:tid 63357] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:13.398251 2026] [proxy_fcgi:error] [pid 63331:tid 63355] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:13.651910 2026] [proxy_fcgi:error] [pid 63331:tid 63337] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:13.688023 2026] [:error] [pid 20837:tid 20853] [client 20.100.175.19:56496] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adet4fSL71FHZkjrGzP-WgAAAY4"]
[Thu Apr 09 21:47:13.934741 2026] [proxy_fcgi:error] [pid 63331:tid 63350] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:14.175604 2026] [proxy_fcgi:error] [pid 63331:tid 63345] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:14.432340 2026] [proxy_fcgi:error] [pid 63331:tid 63356] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:14.673005 2026] [proxy_fcgi:error] [pid 63331:tid 63342] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:14.931481 2026] [proxy_fcgi:error] [pid 63331:tid 63343] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:15.168607 2026] [proxy_fcgi:error] [pid 63331:tid 63333] [client 4.232.92.99:41379] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:47:15.431006 2026] [:error] [pid 63331:tid 63336] [client 4.232.92.99:41379] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adet4ybKfIYuVjWbE4V-yAAAAcM"]
[Thu Apr 09 21:47:23.586648 2026] [:error] [pid 24927:tid 24941] [client 20.100.175.19:62760] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wlld5fjtdpjmjhsds3qzmipfCdefault.php"] [unique_id "adet6zXObuzEuw8mNJsrqQAAAQs"]
[Thu Apr 09 21:47:26.939971 2026] [:error] [pid 24927:tid 24939] [client 4.232.92.99:46205] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adet7jXObuzEuw8mNJsrqwAAAQk"]
[Thu Apr 09 21:47:28.953368 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:4063] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adet8K1OMnvM2fMnB1PNtgAAAAE"]
[Thu Apr 09 21:47:32.209383 2026] [:error] [pid 24515:tid 24533] [client 20.100.175.19:51181] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adet9K1OMnvM2fMnB1PNyAAAAA4"]
[Thu Apr 09 21:47:34.701759 2026] [:error] [pid 24515:tid 24538] [client 20.100.175.19:51177] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adet9q1OMnvM2fMnB1PN2gAAABM"]
[Thu Apr 09 21:47:38.820052 2026] [:error] [pid 24515:tid 24542] [client 20.100.175.19:42108] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adet-q1OMnvM2fMnB1PN9AAAABc"]
[Thu Apr 09 21:47:44.431503 2026] [:error] [pid 24516:tid 24565] [client 20.100.175.19:48440] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeuANhW7vSS-UkeWCU4IQAAAFI"]
[Thu Apr 09 21:47:48.860178 2026] [:error] [pid 24624:tid 24635] [client 20.100.175.19:48447] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeuBO4Jn-WvK1ZBTvjmZAAAAMk"]
[Thu Apr 09 21:47:56.441538 2026] [:error] [pid 24927:tid 24931] [client 20.100.175.19:52596] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adeuDDXObuzEuw8mNJsr1gAAAQE"]
[Thu Apr 09 21:47:57.715317 2026] [:error] [pid 20837:tid 20848] [client 4.232.92.99:55514] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adeuDfSL71FHZkjrGzP-zAAAAYk"]
[Thu Apr 09 21:48:00.850769 2026] [proxy_fcgi:error] [pid 20837:tid 20841] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:01.113540 2026] [proxy_fcgi:error] [pid 20837:tid 20853] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:01.385837 2026] [proxy_fcgi:error] [pid 20837:tid 20855] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:01.654189 2026] [proxy_fcgi:error] [pid 20837:tid 20861] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:01.917612 2026] [proxy_fcgi:error] [pid 20837:tid 20851] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:02.180471 2026] [proxy_fcgi:error] [pid 20837:tid 20862] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:02.479493 2026] [proxy_fcgi:error] [pid 20837:tid 20863] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:02.747630 2026] [proxy_fcgi:error] [pid 20837:tid 20857] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:03.011108 2026] [proxy_fcgi:error] [pid 20837:tid 20854] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:03.274624 2026] [proxy_fcgi:error] [pid 20837:tid 20842] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:03.545444 2026] [proxy_fcgi:error] [pid 20837:tid 20844] [client 20.100.175.19:47135] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:03.805478 2026] [:error] [pid 20837:tid 20855] [client 20.100.175.19:47135] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adeuE_SL71FHZkjrGzP-8gAAAZA"]
[Thu Apr 09 21:48:06.975908 2026] [:error] [pid 63331:tid 63336] [client 4.232.92.99:51667] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeuFibKfIYuVjWbE4V-_wAAAcM"]
[Thu Apr 09 21:48:07.752318 2026] [:error] [pid 63331:tid 63352] [client 20.100.175.19:41156] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adeuFybKfIYuVjWbE4V_AgAAAdM"]
[Thu Apr 09 21:48:09.291244 2026] [:error] [pid 20837:tid 20860] [client 4.232.92.99:60696] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adeuGfSL71FHZkjrGzP-_QAAAZU"]
[Thu Apr 09 21:48:11.230383 2026] [:error] [pid 63331:tid 63341] [client 20.100.175.19:48400] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adeuGybKfIYuVjWbE4V_BwAAAcg"]
[Thu Apr 09 21:48:12.035362 2026] [proxy_fcgi:error] [pid 24927:tid 24938] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:12.577813 2026] [proxy_fcgi:error] [pid 24927:tid 24936] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:12.885033 2026] [proxy_fcgi:error] [pid 24927:tid 24943] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:13.929426 2026] [:error] [pid 63331:tid 63350] [client 20.100.175.19:55159] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "adeuHSbKfIYuVjWbE4V_CQAAAdE"]
[Thu Apr 09 21:48:14.490452 2026] [proxy_fcgi:error] [pid 24927:tid 24942] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:14.751463 2026] [proxy_fcgi:error] [pid 24927:tid 24930] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:15.264800 2026] [proxy_fcgi:error] [pid 24927:tid 24941] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:15.803584 2026] [:error] [pid 24515:tid 24519] [client 20.100.175.19:63852] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adeuH61OMnvM2fMnB1POwgAAAAA"]
[Thu Apr 09 21:48:15.898075 2026] [proxy_fcgi:error] [pid 24927:tid 24931] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:16.137291 2026] [proxy_fcgi:error] [pid 24927:tid 24937] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:16.380415 2026] [proxy_fcgi:error] [pid 24927:tid 24949] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:16.630152 2026] [proxy_fcgi:error] [pid 24927:tid 24944] [client 4.232.92.99:56480] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:48:16.868602 2026] [:error] [pid 24927:tid 24948] [client 4.232.92.99:56480] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adeuIDXObuzEuw8mNJssCQAAARI"]
[Thu Apr 09 21:48:18.192526 2026] [:error] [pid 24624:tid 24648] [client 20.100.175.19:55130] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adeuIu4Jn-WvK1ZBTvjmowAAANY"]
[Thu Apr 09 21:48:19.145061 2026] [:error] [pid 63331:tid 63345] [client 20.100.175.19:45664] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adeuIybKfIYuVjWbE4V_FwAAAcw"]
[Thu Apr 09 21:48:20.970101 2026] [:error] [pid 18477:tid 18491] [client 4.232.92.99:41283] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adeuJMDe826HlFeoLPKjjAAAAUw"]
[Thu Apr 09 21:48:21.066842 2026] [:error] [pid 24515:tid 24543] [client 20.100.175.19:44497] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adeuJa1OMnvM2fMnB1PO0wAAABg"]
[Thu Apr 09 21:48:21.722860 2026] [:error] [pid 63331:tid 63347] [client 4.232.92.99:41325] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Ov-Simple1.php"] [unique_id "adeuJSbKfIYuVjWbE4V_IQAAAc4"]
[Thu Apr 09 21:48:22.307723 2026] [:error] [pid 24515:tid 24527] [client 20.100.175.19:52752] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adeuJq1OMnvM2fMnB1PO1gAAAAg"]
[Thu Apr 09 21:48:24.467101 2026] [:error] [pid 63331:tid 63344] [client 20.100.175.19:45610] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adeuKCbKfIYuVjWbE4V_JgAAAcs"]
[Thu Apr 09 21:48:26.405570 2026] [:error] [pid 63331:tid 63337] [client 20.100.175.19:52749] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adeuKibKfIYuVjWbE4V_KQAAAcQ"]
[Thu Apr 09 21:48:30.277220 2026] [:error] [pid 24515:tid 24524] [client 20.100.175.19:47130] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adeuLq1OMnvM2fMnB1PO-gAAAAU"]
[Thu Apr 09 21:48:31.570875 2026] [:error] [pid 24515:tid 24528] [client 20.100.175.19:47129] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adeuL61OMnvM2fMnB1PPCAAAAAk"]
[Thu Apr 09 21:48:34.092147 2026] [:error] [pid 24927:tid 24943] [client 20.100.175.19:41104] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adeuMjXObuzEuw8mNJssJAAAAQ0"]
[Thu Apr 09 21:48:35.953117 2026] [:error] [pid 24515:tid 24540] [client 20.100.175.19:49793] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adeuM61OMnvM2fMnB1PPIgAAABU"]
[Thu Apr 09 21:48:38.414426 2026] [:error] [pid 63331:tid 63353] [client 20.100.175.19:43514] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adeuNibKfIYuVjWbE4V_MAAAAdQ"]
[Thu Apr 09 21:48:42.455666 2026] [:error] [pid 63331:tid 63349] [client 20.100.175.19:61804] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adeuOibKfIYuVjWbE4V_RAAAAdA"]
[Thu Apr 09 21:48:45.024584 2026] [:error] [pid 63331:tid 63357] [client 20.100.175.19:58341] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adeuPSbKfIYuVjWbE4V_SwAAAdg"]
[Thu Apr 09 21:48:46.077525 2026] [:error] [pid 18477:tid 18487] [client 20.100.175.19:40604] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adeuPsDe826HlFeoLPKjmAAAAUg"]
[Thu Apr 09 21:48:48.013927 2026] [:error] [pid 24624:tid 24646] [client 20.100.175.19:40585] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "adeuQO4Jn-WvK1ZBTvjmwAAAANQ"]
[Thu Apr 09 21:48:51.625579 2026] [:error] [pid 63331:tid 63346] [client 20.100.175.19:40264] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adeuQybKfIYuVjWbE4V_ZQAAAc0"]
[Thu Apr 09 21:48:54.082679 2026] [:error] [pid 63331:tid 63352] [client 4.232.92.99:5051] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeuRibKfIYuVjWbE4V_cQAAAdM"]
[Thu Apr 09 21:48:54.125078 2026] [:error] [pid 24624:tid 24635] [client 20.100.175.19:40299] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adeuRu4Jn-WvK1ZBTvjm0QAAAMk"]
[Thu Apr 09 21:48:57.785745 2026] [:error] [pid 24624:tid 24639] [client 20.100.175.19:40319] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adeuSe4Jn-WvK1ZBTvjm2QAAAM0"]
[Thu Apr 09 21:48:58.511006 2026] [:error] [pid 24515:tid 24537] [client 4.232.92.99:46911] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeuSq1OMnvM2fMnB1PPaAAAABI"]
[Thu Apr 09 21:48:59.473464 2026] [:error] [pid 24624:tid 24634] [client 20.100.175.19:3367] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adeuS-4Jn-WvK1ZBTvjm2wAAAMg"]
[Thu Apr 09 21:49:01.039790 2026] [:error] [pid 24927:tid 24949] [client 20.100.175.19:40967] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adeuTTXObuzEuw8mNJssWgAAARM"]
[Thu Apr 09 21:49:01.649753 2026] [:error] [pid 24624:tid 24640] [client 4.232.92.99:44158] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeuTe4Jn-WvK1ZBTvjm3gAAAM4"]
[Thu Apr 09 21:49:02.559841 2026] [:error] [pid 20837:tid 20847] [client 20.100.175.19:3367] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adeuTvSL71FHZkjrGzP_SwAAAYg"]
[Thu Apr 09 21:49:03.406046 2026] [proxy_fcgi:error] [pid 24515:tid 24539] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:03.668873 2026] [proxy_fcgi:error] [pid 24515:tid 24531] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:03.933766 2026] [proxy_fcgi:error] [pid 24515:tid 24537] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:04.196611 2026] [proxy_fcgi:error] [pid 24515:tid 24536] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:04.459561 2026] [proxy_fcgi:error] [pid 24515:tid 24520] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:04.722332 2026] [proxy_fcgi:error] [pid 24515:tid 24540] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:04.984492 2026] [proxy_fcgi:error] [pid 24515:tid 24543] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:05.251298 2026] [proxy_fcgi:error] [pid 24515:tid 24538] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:05.430649 2026] [:error] [pid 24517:tid 24579] [client 4.232.92.99:47416] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeuUXboYEn2ZFM_PS-FJAAAAIU"]
[Thu Apr 09 21:49:05.514944 2026] [proxy_fcgi:error] [pid 24515:tid 24523] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:05.779457 2026] [proxy_fcgi:error] [pid 24515:tid 24529] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:06.069752 2026] [proxy_fcgi:error] [pid 24515:tid 24524] [client 20.100.175.19:51486] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:06.349843 2026] [:error] [pid 24515:tid 24533] [client 20.100.175.19:51486] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adeuUq1OMnvM2fMnB1PPgQAAAA4"]
[Thu Apr 09 21:49:07.316692 2026] [:error] [pid 24516:tid 24566] [client 20.100.175.19:59438] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adeuU9hW7vSS-UkeWCU4VwAAAFM"]
[Thu Apr 09 21:49:08.272628 2026] [:error] [pid 24515:tid 24532] [client 20.100.175.19:52996] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adeuVK1OMnvM2fMnB1PPjAAAAA0"]
[Thu Apr 09 21:49:10.578174 2026] [:error] [pid 24515:tid 24523] [client 4.232.92.99:44131] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adeuVq1OMnvM2fMnB1PPngAAAAQ"]
[Thu Apr 09 21:49:10.855663 2026] [:error] [pid 24515:tid 24530] [client 20.100.175.19:59429] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adeuVq1OMnvM2fMnB1PPoQAAAAs"]
[Thu Apr 09 21:49:13.064852 2026] [:error] [pid 24515:tid 24529] [client 20.100.175.19:55714] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adeuWa1OMnvM2fMnB1PPqQAAAAo"]
[Thu Apr 09 21:49:18.223697 2026] [:error] [pid 20837:tid 20854] [client 20.100.175.19:53054] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adeuXvSL71FHZkjrGzP_VQAAAY8"]
[Thu Apr 09 21:49:19.639775 2026] [:error] [pid 20837:tid 20839] [client 20.100.175.19:40974] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adeuX_SL71FHZkjrGzP_XAAAAYA"]
[Thu Apr 09 21:49:21.670091 2026] [:error] [pid 63331:tid 63337] [client 20.100.175.19:3329] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gpt-sh.php"] [unique_id "adeuYSbKfIYuVjWbE4V_ggAAAcQ"]
[Thu Apr 09 21:49:24.679502 2026] [:error] [pid 63331:tid 63344] [client 20.100.175.19:40261] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adeuZCbKfIYuVjWbE4V_hgAAAcs"]
[Thu Apr 09 21:49:26.244218 2026] [:error] [pid 18477:tid 18497] [client 20.100.175.19:40286] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adeuZsDe826HlFeoLPKjqwAAAVI"]
[Thu Apr 09 21:49:27.160341 2026] [:error] [pid 24515:tid 24530] [client 20.100.175.19:55237] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adeuZ61OMnvM2fMnB1PPtQAAAAs"]
[Thu Apr 09 21:49:29.169472 2026] [:error] [pid 18477:tid 18489] [client 20.100.175.19:64284] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adeuacDe826HlFeoLPKjrwAAAUo"]
[Thu Apr 09 21:49:31.173912 2026] [:error] [pid 24624:tid 24636] [client 20.100.175.19:64277] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adeua-4Jn-WvK1ZBTvjm_gAAAMo"]
[Thu Apr 09 21:49:36.270075 2026] [:error] [pid 24515:tid 24542] [client 20.100.175.19:49508] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adeucK1OMnvM2fMnB1PPtgAAABc"]
[Thu Apr 09 21:49:38.058896 2026] [:error] [pid 24515:tid 24527] [client 20.100.175.19:61220] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adeucq1OMnvM2fMnB1PPwQAAAAg"]
[Thu Apr 09 21:49:41.656967 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:61186] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adeuda1OMnvM2fMnB1PP1AAAAAE"]
[Thu Apr 09 21:49:44.915016 2026] [:error] [pid 63331:tid 63347] [client 20.100.175.19:47117] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adeueCbKfIYuVjWbE4V_qQAAAc4"]
[Thu Apr 09 21:49:46.972694 2026] [:error] [pid 24624:tid 24645] [client 20.100.175.19:62785] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adeueu4Jn-WvK1ZBTvjnDwAAANM"]
[Thu Apr 09 21:49:49.587286 2026] [:error] [pid 20837:tid 20856] [client 20.100.175.19:48907] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adeuffSL71FHZkjrGzP_lwAAAZE"]
[Thu Apr 09 21:49:50.751392 2026] [:error] [pid 20837:tid 20849] [client 20.100.175.19:57707] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adeufvSL71FHZkjrGzP_nAAAAYo"]
[Thu Apr 09 21:49:53.890204 2026] [proxy_fcgi:error] [pid 63331:tid 63345] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:54.127254 2026] [proxy_fcgi:error] [pid 63331:tid 63351] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:54.172989 2026] [:error] [pid 63331:tid 63342] [client 20.100.175.19:57654] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeugibKfIYuVjWbE4V_uwAAAck"]
[Thu Apr 09 21:49:54.374503 2026] [proxy_fcgi:error] [pid 63331:tid 63357] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:54.626812 2026] [proxy_fcgi:error] [pid 63331:tid 63353] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:54.864171 2026] [proxy_fcgi:error] [pid 63331:tid 63343] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:55.131017 2026] [proxy_fcgi:error] [pid 63331:tid 63356] [client 4.232.92.99:46850] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:49:55.318398 2026] [:error] [pid 63331:tid 63338] [client 20.100.175.19:54406] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeugybKfIYuVjWbE4V_xAAAAcU"]
[Thu Apr 09 21:49:55.819600 2026] [:error] [pid 63331:tid 63352] [client 4.232.92.99:46850] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeugybKfIYuVjWbE4V_xQAAAdM"]
[Thu Apr 09 21:49:57.271467 2026] [:error] [pid 24927:tid 24952] [client 20.100.175.19:35258] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeuhTXObuzEuw8mNJsshAAAARY"]
[Thu Apr 09 21:49:59.311666 2026] [:error] [pid 24515:tid 24538] [client 4.232.92.99:60733] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeuh61OMnvM2fMnB1PP_QAAABM"]
[Thu Apr 09 21:49:59.483502 2026] [:error] [pid 24515:tid 24535] [client 20.100.175.19:3096] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "adeuh61OMnvM2fMnB1PP_gAAABA"]
[Thu Apr 09 21:50:01.433676 2026] [:error] [pid 20837:tid 20856] [client 20.100.175.19:61254] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeuifSL71FHZkjrGzP_qAAAAZE"]
[Thu Apr 09 21:50:01.499768 2026] [:error] [pid 20837:tid 20842] [client 4.232.92.99:42963] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeuifSL71FHZkjrGzP_qQAAAYM"]
[Thu Apr 09 21:50:02.926846 2026] [:error] [pid 24515:tid 24524] [client 4.232.92.99:54311] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adeuiq1OMnvM2fMnB1PQBAAAAAU"]
[Thu Apr 09 21:50:03.528971 2026] [:error] [pid 24515:tid 24526] [client 20.100.175.19:3605] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeui61OMnvM2fMnB1PQBwAAAAc"]
[Thu Apr 09 21:50:03.880722 2026] [:error] [pid 20837:tid 20860] [client 4.232.92.99:54723] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeui_SL71FHZkjrGzP_qwAAAZU"]
[Thu Apr 09 21:50:04.723305 2026] [:error] [pid 24515:tid 24529] [client 4.232.92.99:48940] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeujK1OMnvM2fMnB1PQCgAAAAo"]
[Thu Apr 09 21:50:05.529658 2026] [:error] [pid 20837:tid 20855] [client 4.232.92.99:41886] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeujfSL71FHZkjrGzP_rgAAAZA"]
[Thu Apr 09 21:50:05.621598 2026] [:error] [pid 24515:tid 24531] [client 20.100.175.19:64354] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adeuja1OMnvM2fMnB1PQDAAAAAw"]
[Thu Apr 09 21:50:07.205759 2026] [:error] [pid 24515:tid 24523] [client 4.232.92.99:5089] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adeuj61OMnvM2fMnB1PQJwAAAAQ"]
[Thu Apr 09 21:50:08.046647 2026] [proxy_fcgi:error] [pid 24515:tid 24527] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:08.309164 2026] [proxy_fcgi:error] [pid 24515:tid 24542] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:08.584466 2026] [proxy_fcgi:error] [pid 24515:tid 24528] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:08.849143 2026] [proxy_fcgi:error] [pid 24515:tid 24542] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:09.111950 2026] [proxy_fcgi:error] [pid 24515:tid 24539] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:09.392165 2026] [proxy_fcgi:error] [pid 24515:tid 24530] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:09.655620 2026] [proxy_fcgi:error] [pid 24515:tid 24522] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:09.919081 2026] [proxy_fcgi:error] [pid 24515:tid 24525] [client 20.100.175.19:3634] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:33.942118 2026] [:error] [pid 24516:tid 24569] [client 4.232.92.99:4931] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adeuqdhW7vSS-UkeWCU4ZgAAAFY"]
[Thu Apr 09 21:50:36.511784 2026] [:error] [pid 18477:tid 18503] [client 4.232.92.99:51107] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adeurMDe826HlFeoLPKjvgAAAVg"]
[Thu Apr 09 21:50:40.773727 2026] [:error] [pid 63331:tid 63341] [client 4.232.92.99:4942] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adeusCbKfIYuVjWbE4WAEgAAAcg"]
[Thu Apr 09 21:50:48.138671 2026] [:error] [pid 18477:tid 18482] [client 4.232.92.99:38546] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adeuuMDe826HlFeoLPKjwgAAAUM"]
[Thu Apr 09 21:50:54.439323 2026] [:error] [pid 24515:tid 24540] [client 4.232.92.99:38586] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws87.php"] [unique_id "adeuvq1OMnvM2fMnB1PQ8QAAABU"]
[Thu Apr 09 21:50:55.831172 2026] [proxy_fcgi:error] [pid 24515:tid 24538] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:56.079838 2026] [proxy_fcgi:error] [pid 24515:tid 24532] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:56.366992 2026] [proxy_fcgi:error] [pid 24515:tid 24533] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:56.603125 2026] [proxy_fcgi:error] [pid 24515:tid 24530] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:56.839269 2026] [proxy_fcgi:error] [pid 24515:tid 24522] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:57.076374 2026] [proxy_fcgi:error] [pid 24515:tid 24519] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:57.313498 2026] [proxy_fcgi:error] [pid 24515:tid 24528] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:57.567016 2026] [proxy_fcgi:error] [pid 24515:tid 24529] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:57.843163 2026] [proxy_fcgi:error] [pid 24515:tid 24521] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:58.097747 2026] [proxy_fcgi:error] [pid 24515:tid 24525] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:58.335537 2026] [proxy_fcgi:error] [pid 24515:tid 24541] [client 4.232.92.99:49092] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:50:58.587070 2026] [:error] [pid 24515:tid 24520] [client 4.232.92.99:49092] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adeuwq1OMnvM2fMnB1PRAgAAAAE"]
[Thu Apr 09 21:51:05.681715 2026] [:error] [pid 24515:tid 24522] [client 4.232.92.99:59788] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adeuya1OMnvM2fMnB1PRCQAAAAM"]
[Thu Apr 09 21:51:13.950453 2026] [:error] [pid 20837:tid 20858] [client 4.232.92.99:55791] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adeu0fSL71FHZkjrGzMAAgAAAZM"]
[Thu Apr 09 21:51:58.764905 2026] [proxy_fcgi:error] [pid 20837:tid 20849] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:51:59.978618 2026] [proxy_fcgi:error] [pid 20837:tid 20856] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:00.215959 2026] [proxy_fcgi:error] [pid 20837:tid 20853] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:00.465854 2026] [proxy_fcgi:error] [pid 20837:tid 20842] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:00.704244 2026] [proxy_fcgi:error] [pid 20837:tid 20843] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:00.941294 2026] [proxy_fcgi:error] [pid 20837:tid 20846] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:01.178198 2026] [proxy_fcgi:error] [pid 20837:tid 20852] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:01.421730 2026] [proxy_fcgi:error] [pid 20837:tid 20839] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:01.659249 2026] [proxy_fcgi:error] [pid 20837:tid 20863] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:01.896312 2026] [proxy_fcgi:error] [pid 20837:tid 20854] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:02.137970 2026] [proxy_fcgi:error] [pid 20837:tid 20855] [client 4.232.92.99:43789] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:52:02.418800 2026] [:error] [pid 20837:tid 20841] [client 4.232.92.99:43789] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adevAvSL71FHZkjrGzMAgAAAAYI"]
[Thu Apr 09 21:52:14.588019 2026] [:error] [pid 24515:tid 24537] [client 4.232.92.99:38920] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "adevDq1OMnvM2fMnB1PRVQAAABI"]
[Thu Apr 09 21:52:20.288818 2026] [:error] [pid 24624:tid 24649] [client 4.232.92.99:41840] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adevFO4Jn-WvK1ZBTvjndgAAANc"]
[Thu Apr 09 21:52:22.933992 2026] [:error] [pid 24624:tid 24627] [client 4.232.92.99:60045] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adevFu4Jn-WvK1ZBTvjnegAAAME"]
[Thu Apr 09 21:52:25.303030 2026] [:error] [pid 63331:tid 63339] [client 4.232.92.99:50659] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adevGSbKfIYuVjWbE4WAxwAAAcY"]
[Thu Apr 09 21:52:26.629774 2026] [:error] [pid 63331:tid 63350] [client 4.232.92.99:50652] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adevGibKfIYuVjWbE4WAzQAAAdE"]
[Thu Apr 09 21:52:29.332774 2026] [:error] [pid 24515:tid 24531] [client 4.232.92.99:55448] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adevHa1OMnvM2fMnB1PRcwAAAAw"]
[Thu Apr 09 21:52:42.055790 2026] [:error] [pid 63331:tid 63334] [client 4.232.92.99:55454] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adevKibKfIYuVjWbE4WA2QAAAcE"]
[Thu Apr 09 21:52:46.468848 2026] [:error] [pid 18477:tid 18496] [client 4.232.92.99:47678] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adevLsDe826HlFeoLPKkZgAAAVE"]
[Thu Apr 09 21:52:47.856480 2026] [:error] [pid 24515:tid 24543] [client 4.232.92.99:4555] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adevL61OMnvM2fMnB1PSDgAAABg"]
[Thu Apr 09 21:52:50.075637 2026] [:error] [pid 24624:tid 24633] [client 4.232.92.99:53176] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adevMu4Jn-WvK1ZBTvjnkgAAAMc"]
[Thu Apr 09 21:52:55.160948 2026] [:error] [pid 24515:tid 24530] [client 4.232.92.99:41304] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adevN61OMnvM2fMnB1PSUAAAAAs"]
[Thu Apr 09 21:53:00.600311 2026] [:error] [pid 24515:tid 24525] [client 4.232.92.99:55142] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adevPK1OMnvM2fMnB1PSogAAAAY"]
[Thu Apr 09 21:53:01.584761 2026] [:error] [pid 63331:tid 63340] [client 4.232.92.99:55110] [client 4.232.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adevPSbKfIYuVjWbE4WA8wAAAcc"]
[Thu Apr 09 21:53:07.924940 2026] [proxy_fcgi:error] [pid 63331:tid 63346] [client 4.232.92.99:51630] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:53:08.173710 2026] [proxy_fcgi:error] [pid 63331:tid 63338] [client 4.232.92.99:51630] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:53:08.410134 2026] [proxy_fcgi:error] [pid 63331:tid 63340] [client 4.232.92.99:51630] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 21:53:08.648391 2026] [proxy_fcgi:error] [pid 63331:tid 63355] [client 4.232.92.99:51630] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:00:49.099521 2026] [:error] [pid 63331:tid 63337] [client 180.153.236.174:60945] [client 180.153.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adexESbKfIYuVjWbE4WEwAAAAcQ"], referer: http://www.switchcreative.net/
[Thu Apr 09 22:47:31.291601 2026] [proxy_fcgi:error] [pid 24515:tid 24536] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:31.557068 2026] [proxy_fcgi:error] [pid 24515:tid 24529] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:31.821409 2026] [proxy_fcgi:error] [pid 24515:tid 24524] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:32.089329 2026] [proxy_fcgi:error] [pid 24515:tid 24541] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:32.356357 2026] [proxy_fcgi:error] [pid 24515:tid 24534] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:32.642579 2026] [proxy_fcgi:error] [pid 24515:tid 24540] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:32.976525 2026] [proxy_fcgi:error] [pid 24515:tid 24522] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:33.405668 2026] [proxy_fcgi:error] [pid 24515:tid 24526] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:33.722635 2026] [proxy_fcgi:error] [pid 24515:tid 24543] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:34.101981 2026] [proxy_fcgi:error] [pid 24515:tid 24525] [client 51.120.75.68:39024] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:47:34.362341 2026] [:error] [pid 24515:tid 24538] [client 51.120.75.68:39024] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ade8Bq1OMnvM2fMnB1PtFAAAABM"]
[Thu Apr 09 22:47:35.692832 2026] [:error] [pid 24517:tid 24586] [client 51.120.75.68:26455] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ade8B3boYEn2ZFM_PS-JlQAAAIw"]
[Thu Apr 09 22:47:36.985522 2026] [:error] [pid 63331:tid 63346] [client 51.120.75.68:30758] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ade8CCbKfIYuVjWbE4WX5QAAAc0"]
[Thu Apr 09 22:47:38.215879 2026] [:error] [pid 24927:tid 24951] [client 51.120.75.68:30785] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "ade8CjXObuzEuw8mNJs1xQAAARU"]
[Thu Apr 09 22:47:39.120707 2026] [:error] [pid 63331:tid 63352] [client 51.120.75.68:30802] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ade8CybKfIYuVjWbE4WX8AAAAdM"]
[Thu Apr 09 22:47:40.027906 2026] [:error] [pid 18477:tid 18492] [client 51.120.75.68:21991] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ade8DMDe826HlFeoLPKsDAAAAU0"]
[Thu Apr 09 22:47:40.982274 2026] [:error] [pid 63331:tid 63352] [client 51.120.75.68:13023] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ade8DCbKfIYuVjWbE4WYAgAAAdM"]
[Thu Apr 09 22:47:41.668358 2026] [:error] [pid 63331:tid 63340] [client 51.120.75.68:11489] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "ade8DSbKfIYuVjWbE4WYEgAAAcc"]
[Thu Apr 09 22:47:42.522114 2026] [:error] [pid 24516:tid 24551] [client 51.120.75.68:58107] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ade8DthW7vSS-UkeWCU-TwAAAEQ"]
[Thu Apr 09 22:47:43.359952 2026] [:error] [pid 24516:tid 24560] [client 51.120.75.68:34335] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ade8D9hW7vSS-UkeWCU-UgAAAE0"]
[Thu Apr 09 22:47:44.724438 2026] [:error] [pid 24927:tid 24933] [client 51.120.75.68:48913] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ade8EDXObuzEuw8mNJs10AAAAQM"]
[Thu Apr 09 22:47:45.909449 2026] [:error] [pid 24927:tid 24932] [client 51.120.75.68:63618] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "ade8ETXObuzEuw8mNJs11gAAAQI"]
[Thu Apr 09 22:47:46.900560 2026] [:error] [pid 24516:tid 24547] [client 51.120.75.68:22719] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ade8EthW7vSS-UkeWCU-XAAAAEA"]
[Thu Apr 09 22:47:49.054177 2026] [:error] [pid 20837:tid 20849] [client 51.120.75.68:29765] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ade8FfSL71FHZkjrGzMOjwAAAYo"]
[Thu Apr 09 22:47:50.297068 2026] [:error] [pid 63331:tid 63343] [client 51.120.75.68:34307] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ade8FibKfIYuVjWbE4WYSgAAAco"]
[Thu Apr 09 22:47:51.383218 2026] [:error] [pid 20837:tid 20858] [client 51.120.75.68:2889] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "ade8F_SL71FHZkjrGzMOlAAAAZM"]
[Thu Apr 09 22:47:52.177126 2026] [:error] [pid 24515:tid 24520] [client 51.120.75.68:13780] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ade8GK1OMnvM2fMnB1PtNQAAAAE"]
[Thu Apr 09 22:47:54.745317 2026] [:error] [pid 18477:tid 18497] [client 51.120.75.68:20002] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ade8GsDe826HlFeoLPKsHwAAAVI"]
[Thu Apr 09 22:47:55.648689 2026] [:error] [pid 24515:tid 24524] [client 51.120.75.68:23139] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ade8G61OMnvM2fMnB1PtPwAAAAU"]
[Thu Apr 09 22:47:56.529792 2026] [:error] [pid 24515:tid 24534] [client 51.120.75.68:30337] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "ade8HK1OMnvM2fMnB1PtRgAAAA8"]
[Thu Apr 09 22:47:57.327712 2026] [:error] [pid 18477:tid 18479] [client 51.120.75.68:42041] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ade8HcDe826HlFeoLPKsKwAAAUA"]
[Thu Apr 09 22:47:58.503173 2026] [:error] [pid 20837:tid 20858] [client 51.120.75.68:26654] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ade8HvSL71FHZkjrGzMOpAAAAZM"]
[Thu Apr 09 22:48:00.138081 2026] [:error] [pid 20837:tid 20853] [client 51.120.75.68:42034] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ade8IPSL71FHZkjrGzMOqQAAAY4"]
[Thu Apr 09 22:48:01.000628 2026] [:error] [pid 24624:tid 24641] [client 51.120.75.68:20011] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "ade8IO4Jn-WvK1ZBTvj0AgAAAM8"]
[Thu Apr 09 22:48:01.871989 2026] [:error] [pid 63331:tid 63343] [client 51.120.75.68:43215] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ade8ISbKfIYuVjWbE4WYiQAAAco"]
[Thu Apr 09 22:48:06.172587 2026] [:error] [pid 20837:tid 20856] [client 51.120.75.68:34336] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ade8JvSL71FHZkjrGzMOtwAAAZE"]
[Thu Apr 09 22:48:11.470373 2026] [:error] [pid 18477:tid 18481] [client 51.120.75.68:20768] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ade8K8De826HlFeoLPKsSAAAAUI"]
[Thu Apr 09 22:48:13.027385 2026] [:error] [pid 18477:tid 18499] [client 51.120.75.68:28259] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "ade8LcDe826HlFeoLPKsTAAAAVQ"]
[Thu Apr 09 22:48:14.125408 2026] [:error] [pid 24516:tid 24557] [client 51.120.75.68:29795] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ade8LthW7vSS-UkeWCU-cAAAAEo"]
[Thu Apr 09 22:48:15.790110 2026] [:error] [pid 18477:tid 18489] [client 51.120.75.68:29792] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ade8L8De826HlFeoLPKsUQAAAUo"]
[Thu Apr 09 22:48:17.059129 2026] [:error] [pid 20837:tid 20856] [client 51.120.75.68:18295] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ade8MfSL71FHZkjrGzMO6AAAAZE"]
[Thu Apr 09 22:48:18.450861 2026] [:error] [pid 24624:tid 24639] [client 51.120.75.68:18250] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "ade8Mu4Jn-WvK1ZBTvj0JQAAAM0"]
[Thu Apr 09 22:48:19.504510 2026] [:error] [pid 24515:tid 24519] [client 51.120.75.68:28162] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ade8M61OMnvM2fMnB1PtswAAAAA"]
[Thu Apr 09 22:48:21.763731 2026] [:error] [pid 24516:tid 24549] [client 51.120.75.68:29789] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ade8NdhW7vSS-UkeWCU-fwAAAEI"]
[Thu Apr 09 22:48:23.854476 2026] [:error] [pid 20837:tid 20863] [client 51.120.75.68:13027] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ade8N_SL71FHZkjrGzMO-QAAAZg"]
[Thu Apr 09 22:48:24.683495 2026] [:error] [pid 63331:tid 63340] [client 51.120.75.68:11458] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "ade8OCbKfIYuVjWbE4WYuQAAAcc"]
[Thu Apr 09 22:48:26.119556 2026] [:error] [pid 24517:tid 24575] [client 51.120.75.68:13000] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "ade8OnboYEn2ZFM_PS-J6QAAAIE"]
[Thu Apr 09 22:48:27.194686 2026] [:error] [pid 63331:tid 63352] [client 51.120.75.68:13001] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "ade8OybKfIYuVjWbE4WYvgAAAdM"]
[Thu Apr 09 22:48:28.246528 2026] [:error] [pid 24927:tid 24930] [client 51.120.75.68:42682] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "ade8PDXObuzEuw8mNJs19gAAAQA"]
[Thu Apr 09 22:48:29.503863 2026] [:error] [pid 63331:tid 63338] [client 51.120.75.68:21970] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "ade8PSbKfIYuVjWbE4WYygAAAcU"]
[Thu Apr 09 22:48:31.395072 2026] [:error] [pid 20837:tid 20846] [client 51.120.75.68:11799] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "ade8P_SL71FHZkjrGzMPGwAAAYc"]
[Thu Apr 09 22:48:32.478794 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:16695] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "ade8QCbKfIYuVjWbE4WY6wAAAc8"]
[Thu Apr 09 22:48:33.617850 2026] [:error] [pid 63331:tid 63334] [client 51.120.75.68:16643] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "ade8QSbKfIYuVjWbE4WY-AAAAcE"]
[Thu Apr 09 22:48:34.500198 2026] [proxy_fcgi:error] [pid 24624:tid 24649] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:34.968271 2026] [proxy_fcgi:error] [pid 24624:tid 24635] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:35.285934 2026] [proxy_fcgi:error] [pid 24624:tid 24630] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:35.548367 2026] [proxy_fcgi:error] [pid 24624:tid 24646] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:35.811020 2026] [proxy_fcgi:error] [pid 24624:tid 24641] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:36.231606 2026] [proxy_fcgi:error] [pid 24624:tid 24633] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:36.495218 2026] [proxy_fcgi:error] [pid 24624:tid 24643] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:36.794753 2026] [proxy_fcgi:error] [pid 24624:tid 24648] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:37.056532 2026] [proxy_fcgi:error] [pid 24624:tid 24628] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:37.389995 2026] [proxy_fcgi:error] [pid 24624:tid 24631] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:37.733194 2026] [proxy_fcgi:error] [pid 24624:tid 24642] [client 51.120.75.68:60989] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:48:38.079455 2026] [:error] [pid 24624:tid 24647] [client 51.120.75.68:60989] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ade8Ru4Jn-WvK1ZBTvj0UQAAANU"]
[Thu Apr 09 22:48:39.019449 2026] [:error] [pid 20837:tid 20861] [client 51.120.75.68:18649] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ade8R_SL71FHZkjrGzMPKgAAAZY"]
[Thu Apr 09 22:48:40.984780 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:33701] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ade8SCbKfIYuVjWbE4WZKQAAAdc"]
[Thu Apr 09 22:48:42.318994 2026] [:error] [pid 24517:tid 24593] [client 51.120.75.68:36471] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ade8SnboYEn2ZFM_PS-KAQAAAJM"]
[Thu Apr 09 22:48:43.929309 2026] [:error] [pid 24517:tid 24577] [client 51.120.75.68:28637] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ade8S3boYEn2ZFM_PS-KBQAAAIM"]
[Thu Apr 09 22:48:44.942604 2026] [:error] [pid 24517:tid 24591] [client 51.120.75.68:60602] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ade8THboYEn2ZFM_PS-KDgAAAJE"]
[Thu Apr 09 22:48:45.648928 2026] [:error] [pid 24515:tid 24529] [client 51.120.75.68:28651] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ade8Ta1OMnvM2fMnB1PtzwAAAAo"]
[Thu Apr 09 22:48:46.829170 2026] [:error] [pid 24515:tid 24530] [client 51.120.75.68:2243] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "ade8Tq1OMnvM2fMnB1Pt1QAAAAs"]
[Thu Apr 09 22:48:47.883300 2026] [:error] [pid 63331:tid 63335] [client 51.120.75.68:62702] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ade8TybKfIYuVjWbE4WZNAAAAcI"]
[Thu Apr 09 22:48:49.083898 2026] [:error] [pid 18477:tid 18503] [client 51.120.75.68:17802] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ade8UcDe826HlFeoLPKshwAAAVg"]
[Thu Apr 09 22:48:50.322992 2026] [:error] [pid 18477:tid 18492] [client 51.120.75.68:17885] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ade8UsDe826HlFeoLPKsiwAAAU0"]
[Thu Apr 09 22:48:51.267445 2026] [:error] [pid 24517:tid 24591] [client 51.120.75.68:16349] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "ade8U3boYEn2ZFM_PS-KHgAAAJE"]
[Thu Apr 09 22:48:54.102969 2026] [:error] [pid 24624:tid 24637] [client 51.120.75.68:2271] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ade8Vu4Jn-WvK1ZBTvj0dwAAAMs"]
[Thu Apr 09 22:48:54.838425 2026] [:error] [pid 24624:tid 24633] [client 51.120.75.68:27517] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ade8Vu4Jn-WvK1ZBTvj0fwAAAMc"]
[Thu Apr 09 22:48:56.084691 2026] [:error] [pid 18477:tid 18499] [client 51.120.75.68:14848] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ade8WMDe826HlFeoLPKslwAAAVQ"]
[Thu Apr 09 22:48:58.063725 2026] [:error] [pid 24927:tid 24932] [client 51.120.75.68:14891] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "ade8WjXObuzEuw8mNJs2PwAAAQI"]
[Thu Apr 09 22:48:59.011527 2026] [:error] [pid 24624:tid 24632] [client 51.120.75.68:33277] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ade8W-4Jn-WvK1ZBTvj0ggAAAMY"]
[Thu Apr 09 22:49:03.034647 2026] [:error] [pid 63331:tid 63345] [client 51.120.75.68:38922] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ade8XybKfIYuVjWbE4WZTQAAAcw"]
[Thu Apr 09 22:49:05.017630 2026] [:error] [pid 18477:tid 18495] [client 51.120.75.68:2774] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ade8YcDe826HlFeoLPKspgAAAVA"]
[Thu Apr 09 22:49:07.235349 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:13698] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ade8YybKfIYuVjWbE4WZUgAAAc8"]
[Thu Apr 09 22:49:08.709560 2026] [:error] [pid 63331:tid 63339] [client 51.120.75.68:58117] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ade8ZCbKfIYuVjWbE4WZXAAAAcY"]
[Thu Apr 09 22:49:14.147177 2026] [:error] [pid 24515:tid 24540] [client 51.120.75.68:19731] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ade8aq1OMnvM2fMnB1PuLgAAABU"]
[Thu Apr 09 22:49:15.646130 2026] [:error] [pid 63331:tid 63349] [client 51.120.75.68:15346] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ade8aybKfIYuVjWbE4WZaQAAAdA"]
[Thu Apr 09 22:49:17.037873 2026] [:error] [pid 20837:tid 20849] [client 51.120.75.68:22327] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ade8bfSL71FHZkjrGzMPTwAAAYo"]
[Thu Apr 09 22:49:18.499372 2026] [:error] [pid 24624:tid 24637] [client 51.120.75.68:9879] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ade8bu4Jn-WvK1ZBTvj0lQAAAMs"]
[Thu Apr 09 22:49:19.410727 2026] [:error] [pid 24515:tid 24521] [client 51.120.75.68:25403] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ade8b61OMnvM2fMnB1PuQQAAAAI"]
[Thu Apr 09 22:49:20.662964 2026] [:error] [pid 63331:tid 63334] [client 51.120.75.68:13719] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ade8cCbKfIYuVjWbE4WZcQAAAcE"]
[Thu Apr 09 22:49:21.405682 2026] [:error] [pid 63331:tid 63344] [client 51.120.75.68:10161] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gfd.php"] [unique_id "ade8cSbKfIYuVjWbE4WZdAAAAcs"]
[Thu Apr 09 22:49:22.307034 2026] [:error] [pid 24624:tid 24631] [client 51.120.75.68:13728] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ade8cu4Jn-WvK1ZBTvj0oAAAAMU"]
[Thu Apr 09 22:49:23.185463 2026] [:error] [pid 20837:tid 20851] [client 51.120.75.68:17410] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ade8c_SL71FHZkjrGzMPXgAAAYw"]
[Thu Apr 09 22:49:24.088749 2026] [:error] [pid 24624:tid 24639] [client 51.120.75.68:22330] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ade8dO4Jn-WvK1ZBTvj0pwAAAM0"]
[Thu Apr 09 22:49:25.158109 2026] [:error] [pid 24515:tid 24540] [client 51.120.75.68:13738] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/callback.php"] [unique_id "ade8da1OMnvM2fMnB1PuUgAAABU"]
[Thu Apr 09 22:49:26.411075 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:59367] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "ade8dibKfIYuVjWbE4WZhAAAAc8"]
[Thu Apr 09 22:49:27.290931 2026] [:error] [pid 20837:tid 20861] [client 51.120.75.68:42041] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "ade8d_SL71FHZkjrGzMPZAAAAZY"]
[Thu Apr 09 22:49:28.757125 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:22346] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "ade8eCbKfIYuVjWbE4WZoAAAAdc"]
[Thu Apr 09 22:49:30.652750 2026] [:error] [pid 24624:tid 24628] [client 51.120.75.68:19797] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "ade8eu4Jn-WvK1ZBTvj0xAAAAMI"]
[Thu Apr 09 22:49:41.002109 2026] [proxy_fcgi:error] [pid 24517:tid 24574] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:41.316092 2026] [proxy_fcgi:error] [pid 24517:tid 24594] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:41.579585 2026] [proxy_fcgi:error] [pid 24517:tid 24596] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:41.896211 2026] [proxy_fcgi:error] [pid 24517:tid 24582] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:42.204042 2026] [proxy_fcgi:error] [pid 24517:tid 24592] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:42.777175 2026] [proxy_fcgi:error] [pid 24517:tid 24595] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:43.070263 2026] [proxy_fcgi:error] [pid 24517:tid 24598] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:43.338581 2026] [proxy_fcgi:error] [pid 24517:tid 24585] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:43.668756 2026] [proxy_fcgi:error] [pid 24517:tid 24597] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:44.115001 2026] [proxy_fcgi:error] [pid 24517:tid 24591] [client 51.120.75.68:28182] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:49:44.425123 2026] [:error] [pid 24517:tid 24589] [client 51.120.75.68:28182] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ade8iHboYEn2ZFM_PS-KWQAAAI8"]
[Thu Apr 09 22:49:45.881745 2026] [:error] [pid 63331:tid 63344] [client 51.120.75.68:32600] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ade8iSbKfIYuVjWbE4WaEwAAAcs"]
[Thu Apr 09 22:49:46.880455 2026] [:error] [pid 24515:tid 24539] [client 51.120.75.68:48063] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ade8iq1OMnvM2fMnB1PunAAAABQ"]
[Thu Apr 09 22:49:47.709175 2026] [:error] [pid 24927:tid 24946] [client 51.120.75.68:49366] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ade8izXObuzEuw8mNJs2cwAAARA"]
[Thu Apr 09 22:49:48.785421 2026] [:error] [pid 24624:tid 24649] [client 51.120.75.68:17494] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "ade8jO4Jn-WvK1ZBTvj1EQAAANc"]
[Thu Apr 09 22:49:49.746271 2026] [:error] [pid 24516:tid 24549] [client 51.120.75.68:12553] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "ade8jdhW7vSS-UkeWCU-7QAAAEI"]
[Thu Apr 09 22:49:50.390503 2026] [:error] [pid 24515:tid 24520] [client 51.120.75.68:10189] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "ade8jq1OMnvM2fMnB1PurQAAAAE"]
[Thu Apr 09 22:49:51.180454 2026] [:error] [pid 24515:tid 24528] [client 51.120.75.68:17531] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "ade8j61OMnvM2fMnB1PusAAAAAk"]
[Thu Apr 09 22:49:53.551844 2026] [:error] [pid 24927:tid 24942] [client 51.120.75.68:14545] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "ade8kTXObuzEuw8mNJs2gQAAAQw"]
[Thu Apr 09 22:49:56.269058 2026] [:error] [pid 24927:tid 24943] [client 51.120.75.68:49362] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "ade8lDXObuzEuw8mNJs2hwAAAQ0"]
[Thu Apr 09 22:49:57.128876 2026] [:error] [pid 24517:tid 24578] [client 51.120.75.68:28185] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "ade8lXboYEn2ZFM_PS-KZwAAAIQ"]
[Thu Apr 09 22:49:58.605031 2026] [:error] [pid 24927:tid 24951] [client 51.120.75.68:28181] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "ade8ljXObuzEuw8mNJs2jQAAARU"]
[Thu Apr 09 22:49:59.664976 2026] [:error] [pid 24624:tid 24635] [client 51.120.75.68:63554] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "ade8l-4Jn-WvK1ZBTvj1LwAAAMk"]
[Thu Apr 09 22:50:00.786703 2026] [:error] [pid 24515:tid 24535] [client 51.120.75.68:11198] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "ade8mK1OMnvM2fMnB1PuvAAAABA"]
[Thu Apr 09 22:50:01.795359 2026] [:error] [pid 24515:tid 24528] [client 51.120.75.68:25055] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "ade8ma1OMnvM2fMnB1PuwgAAAAk"]
[Thu Apr 09 22:50:03.172519 2026] [:error] [pid 20837:tid 20842] [client 51.120.75.68:16699] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "ade8m_SL71FHZkjrGzMPtQAAAYM"]
[Thu Apr 09 22:50:03.997563 2026] [:error] [pid 63331:tid 63343] [client 51.120.75.68:63579] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "ade8mybKfIYuVjWbE4WaJgAAAco"]
[Thu Apr 09 22:50:05.009698 2026] [:error] [pid 63331:tid 63350] [client 51.120.75.68:48000] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "ade8nSbKfIYuVjWbE4WaLgAAAdE"]
[Thu Apr 09 22:50:06.372379 2026] [:error] [pid 63331:tid 63335] [client 51.120.75.68:21195] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "ade8nibKfIYuVjWbE4WaMwAAAcI"]
[Thu Apr 09 22:50:07.319613 2026] [:error] [pid 20837:tid 20849] [client 51.120.75.68:25028] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "ade8n_SL71FHZkjrGzMPxQAAAYo"]
[Thu Apr 09 22:50:09.338175 2026] [:error] [pid 24515:tid 24535] [client 51.120.75.68:48015] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "ade8oa1OMnvM2fMnB1Pu4QAAABA"]
[Thu Apr 09 22:50:11.700817 2026] [:error] [pid 24515:tid 24522] [client 51.120.75.68:39722] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "ade8o61OMnvM2fMnB1Pu8QAAAAM"]
[Thu Apr 09 22:50:13.020430 2026] [:error] [pid 24517:tid 24580] [client 51.120.75.68:17520] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "ade8pXboYEn2ZFM_PS-KgwAAAIY"]
[Thu Apr 09 22:50:17.451167 2026] [:error] [pid 24624:tid 24640] [client 51.120.75.68:58809] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "ade8qe4Jn-WvK1ZBTvj1WgAAAM4"]
[Thu Apr 09 22:50:18.457297 2026] [:error] [pid 63331:tid 63335] [client 51.120.75.68:25065] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "ade8qibKfIYuVjWbE4WaZQAAAcI"]
[Thu Apr 09 22:50:19.413249 2026] [:error] [pid 24516:tid 24558] [client 51.120.75.68:39737] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "ade8q9hW7vSS-UkeWCU_CgAAAEs"]
[Thu Apr 09 22:50:20.613669 2026] [:error] [pid 20837:tid 20844] [client 51.120.75.68:17509] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "ade8rPSL71FHZkjrGzMP3wAAAYU"]
[Thu Apr 09 22:50:22.255068 2026] [:error] [pid 24516:tid 24555] [client 51.120.75.68:12959] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "ade8rthW7vSS-UkeWCU_CwAAAEg"]
[Thu Apr 09 22:50:23.397567 2026] [:error] [pid 63331:tid 63333] [client 51.120.75.68:2569] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "ade8rybKfIYuVjWbE4WadgAAAcA"]
[Thu Apr 09 22:50:24.456155 2026] [:error] [pid 63331:tid 63354] [client 51.120.75.68:25792] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "ade8sCbKfIYuVjWbE4WafAAAAdU"]
[Thu Apr 09 22:50:25.355308 2026] [:error] [pid 63331:tid 63352] [client 51.120.75.68:21211] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "ade8sSbKfIYuVjWbE4WagwAAAdM"]
[Thu Apr 09 22:50:26.512864 2026] [:error] [pid 24515:tid 24536] [client 51.120.75.68:21188] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "ade8sq1OMnvM2fMnB1PvOwAAABE"]
[Thu Apr 09 22:50:27.455822 2026] [:error] [pid 24927:tid 24954] [client 51.120.75.68:2609] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "ade8szXObuzEuw8mNJs2sQAAARg"]
[Thu Apr 09 22:50:28.553568 2026] [:error] [pid 24515:tid 24534] [client 51.120.75.68:12194] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "ade8tK1OMnvM2fMnB1PvRQAAAA8"]
[Thu Apr 09 22:50:29.858175 2026] [:error] [pid 18477:tid 18485] [client 51.120.75.68:15737] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "ade8tcDe826HlFeoLPKtDAAAAUY"]
[Thu Apr 09 22:50:30.972798 2026] [:error] [pid 18477:tid 18491] [client 51.120.75.68:23855] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "ade8tsDe826HlFeoLPKtDwAAAUw"]
[Thu Apr 09 22:50:33.022434 2026] [:error] [pid 24516:tid 24554] [client 51.120.75.68:48344] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ade8udhW7vSS-UkeWCU_EQAAAEc"]
[Thu Apr 09 22:50:34.024546 2026] [:error] [pid 24516:tid 24551] [client 51.120.75.68:59884] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ade8uthW7vSS-UkeWCU_EwAAAEQ"]
[Thu Apr 09 22:50:34.979123 2026] [:error] [pid 24517:tid 24576] [client 51.120.75.68:19305] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ade8unboYEn2ZFM_PS-KigAAAII"]
[Thu Apr 09 22:50:36.034509 2026] [:error] [pid 20837:tid 20858] [client 51.120.75.68:23868] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ade8vPSL71FHZkjrGzMP8gAAAZM"]
[Thu Apr 09 22:50:36.803755 2026] [:error] [pid 63331:tid 63341] [client 51.120.75.68:18952] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "ade8vCbKfIYuVjWbE4WapAAAAcg"]
[Thu Apr 09 22:50:37.640960 2026] [:error] [pid 24515:tid 24526] [client 51.120.75.68:10386] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "ade8va1OMnvM2fMnB1PvfwAAAAc"]
[Thu Apr 09 22:50:38.582543 2026] [:error] [pid 63331:tid 63354] [client 51.120.75.68:23846] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "ade8vibKfIYuVjWbE4WasgAAAdU"]
[Thu Apr 09 22:50:40.321965 2026] [:error] [pid 24927:tid 24952] [client 51.120.75.68:2498] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "ade8wDXObuzEuw8mNJs2ugAAARY"]
[Thu Apr 09 22:50:42.014688 2026] [:error] [pid 24515:tid 24530] [client 51.120.75.68:34386] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ade8wq1OMnvM2fMnB1PvhQAAAAs"]
[Thu Apr 09 22:50:43.610435 2026] [:error] [pid 63331:tid 63334] [client 51.120.75.68:20478] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ade8wybKfIYuVjWbE4WazQAAAcE"]
[Thu Apr 09 22:50:45.953631 2026] [proxy_fcgi:error] [pid 18477:tid 18502] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:46.475685 2026] [proxy_fcgi:error] [pid 18477:tid 18493] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:46.785489 2026] [proxy_fcgi:error] [pid 18477:tid 18487] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:47.055765 2026] [proxy_fcgi:error] [pid 18477:tid 18494] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:47.371915 2026] [proxy_fcgi:error] [pid 18477:tid 18492] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:47.869500 2026] [proxy_fcgi:error] [pid 18477:tid 18480] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:48.208775 2026] [proxy_fcgi:error] [pid 18477:tid 18488] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:48.518500 2026] [proxy_fcgi:error] [pid 18477:tid 18495] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:48.782071 2026] [proxy_fcgi:error] [pid 18477:tid 18498] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:49.139140 2026] [proxy_fcgi:error] [pid 18477:tid 18486] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:49.497638 2026] [proxy_fcgi:error] [pid 18477:tid 18483] [client 51.120.75.68:60888] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:50:49.757908 2026] [:error] [pid 18477:tid 18499] [client 51.120.75.68:60888] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "ade8ycDe826HlFeoLPKtHAAAAVQ"]
[Thu Apr 09 22:50:50.814944 2026] [:error] [pid 24515:tid 24525] [client 51.120.75.68:23817] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "ade8yq1OMnvM2fMnB1PvyQAAAAY"]
[Thu Apr 09 22:50:52.498389 2026] [:error] [pid 24515:tid 24522] [client 51.120.75.68:19273] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "ade8zK1OMnvM2fMnB1PvzgAAAAM"]
[Thu Apr 09 22:50:53.491881 2026] [:error] [pid 24515:tid 24530] [client 51.120.75.68:20447] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "ade8za1OMnvM2fMnB1Pv1wAAAAs"]
[Thu Apr 09 22:50:54.551760 2026] [:error] [pid 24624:tid 24631] [client 51.120.75.68:13327] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schallfuns.php"] [unique_id "ade8zu4Jn-WvK1ZBTvj1gAAAAMU"]
[Thu Apr 09 22:50:55.537759 2026] [:error] [pid 24515:tid 24528] [client 51.120.75.68:39773] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schallfuns.php"] [unique_id "ade8z61OMnvM2fMnB1Pv2gAAAAk"]
[Thu Apr 09 22:50:56.982856 2026] [:error] [pid 63331:tid 63337] [client 51.120.75.68:48445] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schallfuns.php"] [unique_id "ade80CbKfIYuVjWbE4Wa-QAAAcQ"]
[Thu Apr 09 22:50:57.956723 2026] [:error] [pid 24515:tid 24521] [client 51.120.75.68:19326] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/schallfuns.php"] [unique_id "ade80a1OMnvM2fMnB1Pv4wAAAAI"]
[Thu Apr 09 22:50:58.754630 2026] [:error] [pid 24515:tid 24543] [client 51.120.75.68:61841] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "ade80q1OMnvM2fMnB1Pv6AAAABg"]
[Thu Apr 09 22:50:59.604681 2026] [:error] [pid 24927:tid 24946] [client 51.120.75.68:24963] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "ade80zXObuzEuw8mNJs2vwAAARA"]
[Thu Apr 09 22:51:00.541354 2026] [:error] [pid 24927:tid 24937] [client 51.120.75.68:48426] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "ade81DXObuzEuw8mNJs2wAAAAQc"]
[Thu Apr 09 22:51:01.261665 2026] [:error] [pid 24624:tid 24648] [client 51.120.75.68:60923] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX1.php"] [unique_id "ade81e4Jn-WvK1ZBTvj1iQAAANY"]
[Thu Apr 09 22:51:01.982005 2026] [:error] [pid 24516:tid 24563] [client 51.120.75.68:38376] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clasa99.php"] [unique_id "ade81dhW7vSS-UkeWCU_IAAAAFA"]
[Thu Apr 09 22:51:02.697723 2026] [:error] [pid 24927:tid 24930] [client 51.120.75.68:38359] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clasa99.php"] [unique_id "ade81jXObuzEuw8mNJs2wgAAAQA"]
[Thu Apr 09 22:51:04.791892 2026] [:error] [pid 20837:tid 20858] [client 51.120.75.68:60898] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clasa99.php"] [unique_id "ade82PSL71FHZkjrGzMQKAAAAZM"]
[Thu Apr 09 22:51:06.989831 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:28286] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clasa99.php"] [unique_id "ade82ibKfIYuVjWbE4WbAAAAAdc"]
[Thu Apr 09 22:51:10.823929 2026] [:error] [pid 24515:tid 24531] [client 51.120.75.68:20002] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfilexxx.php"] [unique_id "ade83q1OMnvM2fMnB1Pv9QAAAAw"]
[Thu Apr 09 22:51:12.615673 2026] [:error] [pid 24515:tid 24528] [client 51.120.75.68:38350] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfilexxx.php"] [unique_id "ade84K1OMnvM2fMnB1Pv-QAAAAk"]
[Thu Apr 09 22:51:13.885879 2026] [:error] [pid 24927:tid 24937] [client 51.120.75.68:19308] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfilexxx.php"] [unique_id "ade84TXObuzEuw8mNJs20wAAAQc"]
[Thu Apr 09 22:51:15.066971 2026] [:error] [pid 63331:tid 63355] [client 51.120.75.68:33775] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfilexxx.php"] [unique_id "ade84ybKfIYuVjWbE4WbCwAAAdY"]
[Thu Apr 09 22:51:15.839250 2026] [:error] [pid 20837:tid 20843] [client 51.120.75.68:33768] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_144a.php"] [unique_id "ade84_SL71FHZkjrGzMQSQAAAYQ"]
[Thu Apr 09 22:51:17.291670 2026] [:error] [pid 24515:tid 24521] [client 51.120.75.68:14972] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_144a.php"] [unique_id "ade85a1OMnvM2fMnB1PwEQAAAAI"]
[Thu Apr 09 22:51:18.559845 2026] [:error] [pid 18477:tid 18487] [client 51.120.75.68:38389] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_144a.php"] [unique_id "ade85sDe826HlFeoLPKtJwAAAUg"]
[Thu Apr 09 22:51:21.673254 2026] [:error] [pid 20837:tid 20850] [client 51.120.75.68:33777] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/karma_144a.php"] [unique_id "ade86fSL71FHZkjrGzMQVQAAAYs"]
[Thu Apr 09 22:51:24.086111 2026] [:error] [pid 24515:tid 24531] [client 51.120.75.68:38355] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3586%20b64.php"] [unique_id "ade87K1OMnvM2fMnB1PwcQAAAAw"]
[Thu Apr 09 22:51:33.055649 2026] [:error] [pid 24624:tid 24639] [client 51.120.75.68:38341] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3586%20b64.php"] [unique_id "ade89e4Jn-WvK1ZBTvj1yQAAAM0"]
[Thu Apr 09 22:51:35.002487 2026] [:error] [pid 20837:tid 20854] [client 51.120.75.68:44325] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3586%20b64.php"] [unique_id "ade89_SL71FHZkjrGzMQeAAAAY8"]
[Thu Apr 09 22:51:36.653044 2026] [:error] [pid 24515:tid 24539] [client 51.120.75.68:43832] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3586%20b64.php"] [unique_id "ade8-K1OMnvM2fMnB1PwiwAAABQ"]
[Thu Apr 09 22:51:37.446277 2026] [:error] [pid 63331:tid 63354] [client 51.120.75.68:14966] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ade8-SbKfIYuVjWbE4WbNgAAAdU"]
[Thu Apr 09 22:51:42.050283 2026] [:error] [pid 18477:tid 18492] [client 51.120.75.68:44328] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ade8_sDe826HlFeoLPKtSAAAAU0"]
[Thu Apr 09 22:51:44.947873 2026] [:error] [pid 20837:tid 20839] [client 51.120.75.68:24977] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ade9APSL71FHZkjrGzMQggAAAYA"]
[Thu Apr 09 22:51:46.072672 2026] [:error] [pid 63331:tid 63342] [client 51.120.75.68:62240] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ade9AibKfIYuVjWbE4WbUAAAAck"]
[Thu Apr 09 22:51:50.000214 2026] [proxy_fcgi:error] [pid 24515:tid 24529] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:50.303694 2026] [proxy_fcgi:error] [pid 24515:tid 24535] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:50.570503 2026] [proxy_fcgi:error] [pid 24515:tid 24523] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:51.280865 2026] [proxy_fcgi:error] [pid 24515:tid 24530] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:52.051083 2026] [proxy_fcgi:error] [pid 24515:tid 24520] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:52.443116 2026] [proxy_fcgi:error] [pid 24515:tid 24521] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:52.768538 2026] [proxy_fcgi:error] [pid 24515:tid 24535] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:53.032271 2026] [proxy_fcgi:error] [pid 24515:tid 24528] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:53.594964 2026] [proxy_fcgi:error] [pid 24515:tid 24519] [client 51.120.75.68:9244] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:51:53.911550 2026] [:error] [pid 24515:tid 24531] [client 51.120.75.68:9244] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "ade9Ca1OMnvM2fMnB1Pw3QAAAAw"]
[Thu Apr 09 22:51:54.728301 2026] [:error] [pid 24515:tid 24538] [client 51.120.75.68:14917] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "ade9Cq1OMnvM2fMnB1Pw6AAAABM"]
[Thu Apr 09 22:51:56.016283 2026] [:error] [pid 24624:tid 24628] [client 51.120.75.68:28236] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "ade9DO4Jn-WvK1ZBTvj18AAAAMI"]
[Thu Apr 09 22:51:57.488156 2026] [:error] [pid 24516:tid 24559] [client 51.120.75.68:48423] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "ade9DdhW7vSS-UkeWCU_RwAAAEw"]
[Thu Apr 09 22:51:58.833953 2026] [:error] [pid 24515:tid 24531] [client 51.120.75.68:33745] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "ade9Dq1OMnvM2fMnB1PxJwAAAAw"]
[Thu Apr 09 22:51:59.846729 2026] [:error] [pid 63331:tid 63333] [client 51.120.75.68:43781] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "ade9DybKfIYuVjWbE4WbiwAAAcA"]
[Thu Apr 09 22:52:01.117316 2026] [:error] [pid 18477:tid 18500] [client 51.120.75.68:24655] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "ade9EcDe826HlFeoLPKtVAAAAVU"]
[Thu Apr 09 22:52:02.506826 2026] [:error] [pid 20837:tid 20863] [client 51.120.75.68:24672] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "ade9EvSL71FHZkjrGzMQqQAAAZg"]
[Thu Apr 09 22:52:04.199739 2026] [:error] [pid 24516:tid 24555] [client 51.120.75.68:44327] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "ade9FNhW7vSS-UkeWCU_SQAAAEg"]
[Thu Apr 09 22:52:05.431060 2026] [:error] [pid 24515:tid 24533] [client 51.120.75.68:24658] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "ade9Fa1OMnvM2fMnB1PxNwAAAA4"]
[Thu Apr 09 22:52:06.425824 2026] [:error] [pid 24515:tid 24534] [client 51.120.75.68:59452] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "ade9Fq1OMnvM2fMnB1PxPwAAAA8"]
[Thu Apr 09 22:52:07.520863 2026] [:error] [pid 18477:tid 18494] [client 51.120.75.68:59405] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "ade9F8De826HlFeoLPKtXAAAAU8"]
[Thu Apr 09 22:52:08.262622 2026] [:error] [pid 24515:tid 24522] [client 51.120.75.68:48928] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "ade9GK1OMnvM2fMnB1PxSwAAAAM"]
[Thu Apr 09 22:52:08.988733 2026] [:error] [pid 24516:tid 24567] [client 51.120.75.68:39768] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "ade9GNhW7vSS-UkeWCU_SwAAAFQ"]
[Thu Apr 09 22:52:10.396110 2026] [:error] [pid 18477:tid 18479] [client 51.120.75.68:48945] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "ade9GsDe826HlFeoLPKtXgAAAUA"]
[Thu Apr 09 22:52:11.257209 2026] [:error] [pid 63331:tid 63342] [client 51.120.75.68:48909] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "ade9GybKfIYuVjWbE4WblwAAAck"]
[Thu Apr 09 22:52:12.695943 2026] [:error] [pid 20837:tid 20847] [client 51.120.75.68:2074] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "ade9HPSL71FHZkjrGzMQugAAAYg"]
[Thu Apr 09 22:52:13.540643 2026] [:error] [pid 24515:tid 24535] [client 51.120.75.68:13374] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "ade9Ha1OMnvM2fMnB1PxcQAAABA"]
[Thu Apr 09 22:52:14.793117 2026] [:error] [pid 63331:tid 63335] [client 51.120.75.68:33786] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "ade9HibKfIYuVjWbE4WbsgAAAcI"]
[Thu Apr 09 22:52:15.578557 2026] [:error] [pid 24517:tid 24575] [client 51.120.75.68:14465] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "ade9H3boYEn2ZFM_PS-K3AAAAIE"]
[Thu Apr 09 22:52:16.681770 2026] [:error] [pid 24516:tid 24554] [client 51.120.75.68:23462] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ade9INhW7vSS-UkeWCU_UAAAAEc"]
[Thu Apr 09 22:52:18.678598 2026] [:error] [pid 20837:tid 20863] [client 51.120.75.68:23467] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ade9IvSL71FHZkjrGzMQyQAAAZg"]
[Thu Apr 09 22:52:21.982706 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:33744] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ade9JSbKfIYuVjWbE4WbvgAAAdc"]
[Thu Apr 09 22:52:24.603698 2026] [:error] [pid 18477:tid 18492] [client 51.120.75.68:59426] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "ade9KMDe826HlFeoLPKtaAAAAU0"]
[Thu Apr 09 22:52:27.299673 2026] [:error] [pid 24624:tid 24649] [client 51.120.75.68:22700] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ade9K-4Jn-WvK1ZBTvj2FgAAANc"]
[Thu Apr 09 22:52:28.334251 2026] [:error] [pid 24927:tid 24944] [client 51.120.75.68:63642] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ade9LDXObuzEuw8mNJs3UgAAAQ4"]
[Thu Apr 09 22:52:30.094033 2026] [:error] [pid 24624:tid 24642] [client 51.120.75.68:2910] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ade9Lu4Jn-WvK1ZBTvj2HgAAANA"]
[Thu Apr 09 22:52:32.930764 2026] [:error] [pid 63331:tid 63341] [client 51.120.75.68:2910] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ade9MCbKfIYuVjWbE4Wb6wAAAcg"]
[Thu Apr 09 22:52:35.002580 2026] [:error] [pid 63331:tid 63341] [client 51.120.75.68:30338] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ade9MybKfIYuVjWbE4Wb_gAAAcg"]
[Thu Apr 09 22:52:35.873314 2026] [:error] [pid 24927:tid 24950] [client 51.120.75.68:26649] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ade9MzXObuzEuw8mNJs3WAAAARQ"]
[Thu Apr 09 22:52:36.629498 2026] [:error] [pid 20837:tid 20857] [client 51.120.75.68:32081] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ade9NPSL71FHZkjrGzMQ1gAAAZI"]
[Thu Apr 09 22:52:38.303065 2026] [:error] [pid 24515:tid 24524] [client 51.120.75.68:41996] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ade9Nq1OMnvM2fMnB1PxowAAAAU"]
[Thu Apr 09 22:52:39.396055 2026] [:error] [pid 63331:tid 63344] [client 51.120.75.68:20791] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ade9NybKfIYuVjWbE4WcBwAAAcs"]
[Thu Apr 09 22:52:40.319301 2026] [:error] [pid 20837:tid 20846] [client 51.120.75.68:29790] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ade9OPSL71FHZkjrGzMQ4AAAAYc"]
[Thu Apr 09 22:52:41.191104 2026] [:error] [pid 63331:tid 63339] [client 51.120.75.68:2346] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ade9OSbKfIYuVjWbE4WcEgAAAcY"]
[Thu Apr 09 22:52:43.802139 2026] [:error] [pid 24515:tid 24525] [client 51.120.75.68:54178] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "ade9O61OMnvM2fMnB1PxrwAAAAY"]
[Thu Apr 09 22:52:45.217718 2026] [:error] [pid 24515:tid 24519] [client 51.120.75.68:28991] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ade9Pa1OMnvM2fMnB1PxtwAAAAA"]
[Thu Apr 09 22:52:47.009604 2026] [:error] [pid 24927:tid 24945] [client 51.120.75.68:21987] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ade9PzXObuzEuw8mNJs3XgAAAQ8"]
[Thu Apr 09 22:52:48.103350 2026] [:error] [pid 24927:tid 24946] [client 51.120.75.68:54174] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ade9QDXObuzEuw8mNJs3YQAAARA"]
[Thu Apr 09 22:52:49.534250 2026] [:error] [pid 24515:tid 24541] [client 51.120.75.68:30780] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "ade9Qa1OMnvM2fMnB1PxywAAABY"]
[Thu Apr 09 22:52:50.766969 2026] [:error] [pid 20837:tid 20859] [client 51.120.75.68:2869] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ade9QvSL71FHZkjrGzMQ6wAAAZQ"]
[Thu Apr 09 22:52:51.627081 2026] [:error] [pid 20837:tid 20839] [client 51.120.75.68:18582] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ade9Q_SL71FHZkjrGzMQ8wAAAYA"]
[Thu Apr 09 22:52:52.678977 2026] [:error] [pid 20837:tid 20853] [client 51.120.75.68:24204] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "ade9RPSL71FHZkjrGzMQ-wAAAY4"]
[Thu Apr 09 22:52:53.997531 2026] [proxy_fcgi:error] [pid 24624:tid 24630] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:54.325400 2026] [proxy_fcgi:error] [pid 24624:tid 24645] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:54.591276 2026] [proxy_fcgi:error] [pid 24624:tid 24629] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:54.891657 2026] [proxy_fcgi:error] [pid 24624:tid 24635] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:55.218575 2026] [proxy_fcgi:error] [pid 24624:tid 24639] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:55.542176 2026] [proxy_fcgi:error] [pid 24624:tid 24649] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:55.888902 2026] [proxy_fcgi:error] [pid 24624:tid 24633] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:56.152202 2026] [proxy_fcgi:error] [pid 24624:tid 24634] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:56.884990 2026] [proxy_fcgi:error] [pid 24624:tid 24631] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:57.181921 2026] [proxy_fcgi:error] [pid 24624:tid 24642] [client 51.120.75.68:23928] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:52:57.506457 2026] [:error] [pid 24624:tid 24646] [client 51.120.75.68:23928] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "ade9Se4Jn-WvK1ZBTvj2ewAAANQ"]
[Thu Apr 09 22:52:58.371049 2026] [:error] [pid 63331:tid 63339] [client 51.120.75.68:61272] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "ade9SibKfIYuVjWbE4WcGQAAAcY"]
[Thu Apr 09 22:52:59.426464 2026] [:error] [pid 24515:tid 24533] [client 51.120.75.68:10720] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "ade9S61OMnvM2fMnB1PxzwAAAA4"]
[Thu Apr 09 22:53:00.272557 2026] [:error] [pid 24517:tid 24593] [client 51.120.75.68:62658] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "ade9THboYEn2ZFM_PS-K7QAAAJM"]
[Thu Apr 09 22:53:01.162959 2026] [:error] [pid 18477:tid 18483] [client 51.120.75.68:10671] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ade9TcDe826HlFeoLPKtfQAAAUQ"]
[Thu Apr 09 22:53:02.043977 2026] [:error] [pid 24515:tid 24539] [client 51.120.75.68:27518] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ade9Tq1OMnvM2fMnB1Px0wAAABQ"]
[Thu Apr 09 22:53:02.820481 2026] [:error] [pid 24517:tid 24579] [client 51.120.75.68:62705] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ade9TnboYEn2ZFM_PS-K8AAAAIU"]
[Thu Apr 09 22:53:03.566515 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:36454] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "ade9TybKfIYuVjWbE4WcGwAAAc8"]
[Thu Apr 09 22:53:04.531879 2026] [:error] [pid 24515:tid 24530] [client 51.120.75.68:53051] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "ade9UK1OMnvM2fMnB1Px1gAAAAs"]
[Thu Apr 09 22:53:07.841268 2026] [:error] [pid 63331:tid 63339] [client 51.120.75.68:10678] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "ade9UybKfIYuVjWbE4WcJgAAAcY"]
[Thu Apr 09 22:53:09.520113 2026] [:error] [pid 18477:tid 18481] [client 51.120.75.68:17865] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "ade9VcDe826HlFeoLPKtjwAAAUI"]
[Thu Apr 09 22:53:10.490180 2026] [:error] [pid 20837:tid 20856] [client 51.120.75.68:17896] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/ws49.php"] [unique_id "ade9VvSL71FHZkjrGzMRAwAAAZE"]
[Thu Apr 09 22:53:11.217523 2026] [:error] [pid 20837:tid 20854] [client 51.120.75.68:20078] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "ade9V_SL71FHZkjrGzMRCQAAAY8"]
[Thu Apr 09 22:53:12.040633 2026] [:error] [pid 24517:tid 24588] [client 51.120.75.68:17859] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "ade9WHboYEn2ZFM_PS-K9wAAAI4"]
[Thu Apr 09 22:53:12.628094 2026] [:error] [pid 24516:tid 24568] [client 51.120.75.68:15660] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "ade9WNhW7vSS-UkeWCU_hgAAAFU"]
[Thu Apr 09 22:53:13.475703 2026] [:error] [pid 20837:tid 20861] [client 51.120.75.68:37733] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "ade9WfSL71FHZkjrGzMREwAAAZY"]
[Thu Apr 09 22:53:14.562393 2026] [:error] [pid 24515:tid 24519] [client 51.120.75.68:31443] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ade9Wq1OMnvM2fMnB1Px6AAAAAA"]
[Thu Apr 09 22:53:15.371847 2026] [:error] [pid 18477:tid 18480] [client 51.120.75.68:18182] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ade9W8De826HlFeoLPKtmAAAAUE"]
[Thu Apr 09 22:53:16.186189 2026] [:error] [pid 24624:tid 24644] [client 51.120.75.68:27097] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ade9XO4Jn-WvK1ZBTvj2lAAAANI"]
[Thu Apr 09 22:53:17.393057 2026] [:error] [pid 24624:tid 24633] [client 51.120.75.68:37712] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ade9Xe4Jn-WvK1ZBTvj2mAAAAMc"]
[Thu Apr 09 22:53:19.520706 2026] [:error] [pid 63331:tid 63354] [client 51.120.75.68:27481] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "ade9XybKfIYuVjWbE4WcPAAAAdU"]
[Thu Apr 09 22:53:21.078142 2026] [:error] [pid 63331:tid 63337] [client 51.120.75.68:58061] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "ade9YSbKfIYuVjWbE4WcPgAAAcQ"]
[Thu Apr 09 22:53:24.466969 2026] [:error] [pid 63331:tid 63354] [client 51.120.75.68:37727] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "ade9ZCbKfIYuVjWbE4WcSQAAAdU"]
[Thu Apr 09 22:53:27.741228 2026] [:error] [pid 63331:tid 63357] [client 51.120.75.68:19797] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "ade9ZybKfIYuVjWbE4WchwAAAdg"]
[Thu Apr 09 22:53:32.273511 2026] [:error] [pid 63331:tid 63340] [client 51.120.75.68:31471] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ade9bCbKfIYuVjWbE4WcpgAAAcc"]
[Thu Apr 09 22:53:33.867397 2026] [:error] [pid 24515:tid 24531] [client 51.120.75.68:27014] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ade9ba1OMnvM2fMnB1PyOAAAAAw"]
[Thu Apr 09 22:53:34.914434 2026] [:error] [pid 24927:tid 24941] [client 51.120.75.68:53091] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ade9bjXObuzEuw8mNJs3qwAAAQs"]
[Thu Apr 09 22:53:37.820730 2026] [:error] [pid 24516:tid 24554] [client 51.120.75.68:58152] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ade9cdhW7vSS-UkeWCU_pwAAAEc"]
[Thu Apr 09 22:53:38.871995 2026] [:error] [pid 20837:tid 20847] [client 51.120.75.68:14851] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ade9cvSL71FHZkjrGzMRNQAAAYg"]
[Thu Apr 09 22:53:41.233940 2026] [:error] [pid 24624:tid 24630] [client 51.120.75.68:25447] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ade9de4Jn-WvK1ZBTvj2tgAAAMQ"]
[Thu Apr 09 22:54:18.947321 2026] [proxy_fcgi:error] [pid 24624:tid 24637] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:19.240186 2026] [proxy_fcgi:error] [pid 24624:tid 24629] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:19.591482 2026] [proxy_fcgi:error] [pid 24624:tid 24644] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:19.903203 2026] [proxy_fcgi:error] [pid 24624:tid 24642] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:20.192327 2026] [proxy_fcgi:error] [pid 24624:tid 24650] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:20.598446 2026] [proxy_fcgi:error] [pid 24624:tid 24626] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:20.900255 2026] [proxy_fcgi:error] [pid 24624:tid 24630] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:21.171429 2026] [proxy_fcgi:error] [pid 24624:tid 24632] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:21.435976 2026] [proxy_fcgi:error] [pid 24624:tid 24645] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:21.734088 2026] [proxy_fcgi:error] [pid 24624:tid 24640] [client 51.120.75.68:2457] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:54:22.405955 2026] [:error] [pid 24624:tid 24644] [client 51.120.75.68:2457] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ade9nu4Jn-WvK1ZBTvj3CwAAANI"]
[Thu Apr 09 22:54:24.710495 2026] [:error] [pid 20837:tid 20863] [client 51.120.75.68:22308] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ade9oPSL71FHZkjrGzMRcQAAAZg"]
[Thu Apr 09 22:54:25.892586 2026] [:error] [pid 24927:tid 24943] [client 51.120.75.68:22741] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ade9oTXObuzEuw8mNJs38AAAAQ0"]
[Thu Apr 09 22:54:27.827483 2026] [:error] [pid 63331:tid 63351] [client 51.120.75.68:2469] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ade9oybKfIYuVjWbE4WdNwAAAdI"]
[Thu Apr 09 22:54:29.102380 2026] [:error] [pid 18477:tid 18498] [client 51.120.75.68:33165] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ade9pcDe826HlFeoLPKtsAAAAVM"]
[Thu Apr 09 22:54:30.774424 2026] [:error] [pid 63331:tid 63355] [client 51.120.75.68:10113] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ade9pibKfIYuVjWbE4WdOAAAAdY"]
[Thu Apr 09 22:54:31.737594 2026] [:error] [pid 24515:tid 24527] [client 51.120.75.68:38924] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ade9p61OMnvM2fMnB1PyhQAAAAg"]
[Thu Apr 09 22:54:35.614684 2026] [:error] [pid 24624:tid 24642] [client 51.120.75.68:2455] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ade9q-4Jn-WvK1ZBTvj3FwAAANA"]
[Thu Apr 09 22:54:37.735913 2026] [:error] [pid 24624:tid 24647] [client 51.120.75.68:19712] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ade9re4Jn-WvK1ZBTvj3IwAAANU"]
[Thu Apr 09 22:54:39.298102 2026] [:error] [pid 18477:tid 18502] [client 51.120.75.68:22316] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ade9r8De826HlFeoLPKttgAAAVc"]
[Thu Apr 09 22:54:40.119055 2026] [:error] [pid 24624:tid 24642] [client 51.120.75.68:25740] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ade9sO4Jn-WvK1ZBTvj3KwAAANA"]
[Thu Apr 09 22:54:41.460018 2026] [:error] [pid 24515:tid 24542] [client 51.120.75.68:25784] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ade9sa1OMnvM2fMnB1PyjAAAABc"]
[Thu Apr 09 22:54:42.352623 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:15353] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "ade9sibKfIYuVjWbE4WdPAAAAdc"]
[Thu Apr 09 22:54:43.630674 2026] [:error] [pid 24515:tid 24520] [client 51.120.75.68:22288] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "ade9s61OMnvM2fMnB1PylAAAAAE"]
[Thu Apr 09 22:54:44.381190 2026] [:error] [pid 24515:tid 24529] [client 51.120.75.68:48834] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "ade9tK1OMnvM2fMnB1PynAAAAAo"]
[Thu Apr 09 22:54:45.907736 2026] [:error] [pid 24515:tid 24538] [client 51.120.75.68:15331] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "ade9ta1OMnvM2fMnB1PypQAAABM"]
[Thu Apr 09 22:54:47.007003 2026] [:error] [pid 63331:tid 63347] [client 51.120.75.68:19750] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ade9tybKfIYuVjWbE4WdQgAAAc4"]
[Thu Apr 09 22:54:47.708589 2026] [:error] [pid 20837:tid 20854] [client 51.120.75.68:10166] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ade9t_SL71FHZkjrGzMRfQAAAY8"]
[Thu Apr 09 22:54:49.774969 2026] [:error] [pid 63331:tid 63357] [client 51.120.75.68:29347] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ade9uSbKfIYuVjWbE4WdRAAAAdg"]
[Thu Apr 09 22:54:51.904349 2026] [:error] [pid 24515:tid 24536] [client 51.120.75.68:23144] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ade9u61OMnvM2fMnB1PyvgAAABE"]
[Thu Apr 09 22:54:53.041726 2026] [:error] [pid 24515:tid 24532] [client 51.120.75.68:62173] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "ade9va1OMnvM2fMnB1PywgAAAA0"]
[Thu Apr 09 22:54:55.445572 2026] [:error] [pid 18477:tid 18500] [client 51.120.75.68:10139] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "ade9v8De826HlFeoLPKtuAAAAVU"]
[Thu Apr 09 22:55:12.825897 2026] [:error] [pid 63331:tid 63356] [client 51.120.75.68:28164] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "ade90CbKfIYuVjWbE4WdbAAAAdc"]
[Thu Apr 09 22:55:13.774126 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:2969] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "ade90SbKfIYuVjWbE4WdbQAAAc8"]
[Thu Apr 09 22:55:14.489848 2026] [:error] [pid 24515:tid 24523] [client 51.120.75.68:2991] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "ade90q1OMnvM2fMnB1PzBAAAAAQ"]
[Thu Apr 09 22:55:15.441767 2026] [:error] [pid 24515:tid 24525] [client 51.120.75.68:14553] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "ade9061OMnvM2fMnB1PzCQAAAAY"]
[Thu Apr 09 22:55:16.042289 2026] [:error] [pid 24516:tid 24548] [client 51.120.75.68:62159] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ade91NhW7vSS-UkeWCVAAQAAAEE"]
[Thu Apr 09 22:55:17.081108 2026] [:error] [pid 20837:tid 20839] [client 51.120.75.68:22285] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ade91fSL71FHZkjrGzMR5wAAAYA"]
[Thu Apr 09 22:55:18.614706 2026] [:error] [pid 63331:tid 63345] [client 51.120.75.68:23135] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ade91ibKfIYuVjWbE4WdbwAAAcw"]
[Thu Apr 09 22:55:19.349996 2026] [:error] [pid 63331:tid 63337] [client 51.120.75.68:22273] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "ade91ybKfIYuVjWbE4WdcAAAAcQ"]
[Thu Apr 09 22:55:20.175731 2026] [:error] [pid 63331:tid 63352] [client 51.120.75.68:62154] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "ade92CbKfIYuVjWbE4WdcgAAAdM"]
[Thu Apr 09 22:55:20.931157 2026] [:error] [pid 63331:tid 63344] [client 51.120.75.68:10166] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "ade92CbKfIYuVjWbE4WddgAAAcs"]
[Thu Apr 09 22:55:22.675954 2026] [proxy_fcgi:error] [pid 63331:tid 63348] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:23.512954 2026] [proxy_fcgi:error] [pid 63331:tid 63352] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:23.800189 2026] [proxy_fcgi:error] [pid 63331:tid 63339] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:24.187056 2026] [proxy_fcgi:error] [pid 63331:tid 63354] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:24.575453 2026] [proxy_fcgi:error] [pid 63331:tid 63348] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:24.840529 2026] [proxy_fcgi:error] [pid 63331:tid 63349] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:25.120757 2026] [proxy_fcgi:error] [pid 63331:tid 63352] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:25.578979 2026] [proxy_fcgi:error] [pid 63331:tid 63350] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:25.881043 2026] [proxy_fcgi:error] [pid 63331:tid 63346] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:26.277435 2026] [proxy_fcgi:error] [pid 63331:tid 63338] [client 51.120.75.68:22305] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:55:26.538707 2026] [:error] [pid 63331:tid 63337] [client 51.120.75.68:22305] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "ade93ibKfIYuVjWbE4WdngAAAcQ"]
[Thu Apr 09 22:55:27.981717 2026] [:error] [pid 18477:tid 18503] [client 51.120.75.68:32560] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "ade938De826HlFeoLPKtugAAAVg"]
[Thu Apr 09 22:55:30.102646 2026] [:error] [pid 24624:tid 24639] [client 51.120.75.68:62153] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "ade94u4Jn-WvK1ZBTvj3jAAAAM0"]
[Thu Apr 09 22:55:32.866201 2026] [:error] [pid 18477:tid 18495] [client 51.120.75.68:11868] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/radio.php"] [unique_id "ade95MDe826HlFeoLPKtuwAAAVA"]
[Thu Apr 09 22:55:35.845552 2026] [:error] [pid 24624:tid 24637] [client 51.120.75.68:14579] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "ade95-4Jn-WvK1ZBTvj3lAAAAMs"]
[Thu Apr 09 22:55:37.374218 2026] [:error] [pid 18477:tid 18498] [client 51.120.75.68:14591] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "ade96cDe826HlFeoLPKtvgAAAVM"]
[Thu Apr 09 22:55:38.827373 2026] [:error] [pid 24927:tid 24947] [client 51.120.75.68:32546] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "ade96jXObuzEuw8mNJs4BwAAARE"]
[Thu Apr 09 22:55:41.208844 2026] [:error] [pid 20837:tid 20849] [client 51.120.75.68:17497] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/155.php"] [unique_id "ade97fSL71FHZkjrGzMSIAAAAYo"]
[Thu Apr 09 22:55:43.813281 2026] [:error] [pid 24624:tid 24628] [client 51.120.75.68:39731] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ade97-4Jn-WvK1ZBTvj3nAAAAMI"]
[Thu Apr 09 22:55:49.441650 2026] [:error] [pid 20837:tid 20847] [client 51.120.75.68:38319] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ade99fSL71FHZkjrGzMSPAAAAYg"]
[Thu Apr 09 22:55:50.963199 2026] [:error] [pid 63331:tid 63334] [client 51.120.75.68:49383] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ade99ibKfIYuVjWbE4Wd0gAAAcE"]
[Thu Apr 09 22:55:53.648177 2026] [:error] [pid 24927:tid 24952] [client 51.120.75.68:12982] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ade9-TXObuzEuw8mNJs4CgAAARY"]
[Thu Apr 09 22:55:54.712394 2026] [:error] [pid 24516:tid 24571] [client 51.120.75.68:10207] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "ade9-thW7vSS-UkeWCVADwAAAFg"]
[Thu Apr 09 22:55:55.923031 2026] [:error] [pid 24516:tid 24562] [client 51.120.75.68:11856] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "ade9-9hW7vSS-UkeWCVAEAAAAE8"]
[Thu Apr 09 22:55:56.703596 2026] [:error] [pid 20837:tid 20845] [client 51.120.75.68:63555] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "ade9_PSL71FHZkjrGzMSUwAAAYY"]
[Thu Apr 09 22:55:57.843379 2026] [:error] [pid 24515:tid 24535] [client 51.120.75.68:32554] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "ade9_a1OMnvM2fMnB1PzfwAAABA"]
[Thu Apr 09 22:55:58.969609 2026] [:error] [pid 24515:tid 24528] [client 51.120.75.68:59950] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ade9_q1OMnvM2fMnB1PzgAAAAAk"]
[Thu Apr 09 22:55:59.839865 2026] [:error] [pid 24516:tid 24570] [client 51.120.75.68:11842] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ade9_9hW7vSS-UkeWCVAEgAAAFc"]
[Thu Apr 09 22:56:00.646573 2026] [:error] [pid 24927:tid 24930] [client 51.120.75.68:19008] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ade-ADXObuzEuw8mNJs4DAAAAQA"]
[Thu Apr 09 22:56:02.058326 2026] [:error] [pid 24624:tid 24635] [client 51.120.75.68:61781] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ade-Au4Jn-WvK1ZBTvj3oAAAAMk"]
[Thu Apr 09 22:56:03.292308 2026] [:error] [pid 18477:tid 18479] [client 51.120.75.68:59922] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "ade-A8De826HlFeoLPKtwAAAAUA"]
[Thu Apr 09 22:56:04.538602 2026] [:error] [pid 18477:tid 18490] [client 51.120.75.68:61809] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "ade-BMDe826HlFeoLPKtwgAAAUs"]
[Thu Apr 09 22:56:06.330258 2026] [:error] [pid 24515:tid 24538] [client 51.120.75.68:12590] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "ade-Bq1OMnvM2fMnB1PzggAAABM"]
[Thu Apr 09 22:56:07.350218 2026] [:error] [pid 63331:tid 63348] [client 51.120.75.68:58807] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "ade-BybKfIYuVjWbE4Wd-gAAAc8"]
[Thu Apr 09 22:56:09.716528 2026] [:error] [pid 24515:tid 24526] [client 51.120.75.68:15680] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "ade-Ca1OMnvM2fMnB1PzigAAAAc"]
[Thu Apr 09 22:56:10.672077 2026] [:error] [pid 24515:tid 24529] [client 51.120.75.68:49386] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "ade-Cq1OMnvM2fMnB1PziwAAAAo"]
[Thu Apr 09 22:56:11.876048 2026] [:error] [pid 18477:tid 18496] [client 51.120.75.68:12567] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "ade-C8De826HlFeoLPKtxQAAAVE"]
[Thu Apr 09 22:56:12.748330 2026] [:error] [pid 24927:tid 24932] [client 51.120.75.68:61767] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "ade-DDXObuzEuw8mNJs4EgAAAQI"]
[Thu Apr 09 22:56:13.668336 2026] [:error] [pid 20837:tid 20842] [client 51.120.75.68:61822] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ade-DfSL71FHZkjrGzMSlAAAAYM"]
[Thu Apr 09 22:56:15.274204 2026] [:error] [pid 18477:tid 18488] [client 51.120.75.68:18945] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ade-D8De826HlFeoLPKtywAAAUk"]
[Thu Apr 09 22:56:16.253445 2026] [:error] [pid 63331:tid 63335] [client 51.120.75.68:58759] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ade-ECbKfIYuVjWbE4WeEgAAAcI"]
[Thu Apr 09 22:56:21.389516 2026] [:error] [pid 24927:tid 24952] [client 51.120.75.68:12562] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "ade-FTXObuzEuw8mNJs4FgAAARY"]
[Thu Apr 09 22:56:22.299839 2026] [:error] [pid 24927:tid 24935] [client 51.120.75.68:25842] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "ade-FjXObuzEuw8mNJs4GgAAAQU"]
[Thu Apr 09 22:56:23.252482 2026] [:error] [pid 24515:tid 24532] [client 51.120.75.68:10407] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "ade-F61OMnvM2fMnB1PzmwAAAA0"]
[Thu Apr 09 22:56:24.460368 2026] [:error] [pid 24515:tid 24540] [client 51.120.75.68:2106] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "ade-GK1OMnvM2fMnB1PzngAAABU"]
[Thu Apr 09 22:56:25.311253 2026] [:error] [pid 24927:tid 24951] [client 51.120.75.68:34426] [client 51.120.75.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "ade-GTXObuzEuw8mNJs4HgAAARU"]
[Thu Apr 09 22:56:27.564656 2026] [proxy_fcgi:error] [pid 24515:tid 24541] [client 51.120.75.68:10404] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:56:27.828489 2026] [proxy_fcgi:error] [pid 24515:tid 24527] [client 51.120.75.68:10404] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:56:28.406716 2026] [proxy_fcgi:error] [pid 24515:tid 24524] [client 51.120.75.68:10404] AH01071: Got error 'Primary script unknown'
[Thu Apr 09 22:56:28.670871 2026] [proxy_fcgi:error] [pid 24515:tid 24523] [client 51.120.75.68:10404] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 02:29:59.939297 2026] [:error] [pid 36399:tid 36457] [client 43.153.192.98:37314] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adfwJ68Hkxpyh6_TlVRAVgAAAII"]
[Fri Apr 10 03:48:40.693689 2026] [:error] [pid 29569:tid 29575] [client 49.51.132.100:34454] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adgCmLt9mkieWu8HPk5oXAAAAUI"]
[Fri Apr 10 05:26:38.876768 2026] [:error] [pid 12685:tid 12696] [client 173.239.214.46:48689] [client 173.239.214.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "adgZjs8f5ssYShsynapomwAAAMk"]
[Fri Apr 10 07:34:31.423770 2026] [:error] [pid 59218:tid 59224] [client 49.233.45.47:47202] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adg3h4jSO_Wp4VS3Qe_8hwAAAYQ"]
[Fri Apr 10 08:42:54.807763 2026] [:error] [pid 12576:tid 12673] [client 49.149.75.204:39195] [client 49.149.75.204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "adhHjgZp1JUS4li1QnvDFQAAAJg"]
[Fri Apr 10 08:51:05.330357 2026] [:error] [pid 54554:tid 54558] [client 68.183.178.15:64405] [client 68.183.178.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "adhJeRLV7UhSV2TjBIs8AgAAAUI"]
[Fri Apr 10 10:01:55.442471 2026] [:error] [pid 13189:tid 13201] [client 162.62.132.25:57030] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adhaE5AxiJKPums3eBDqrQAAAEk"]
[Fri Apr 10 11:06:07.481932 2026] [:error] [pid 13102:tid 13179] [client 43.163.206.70:46606] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adhpH_9xLvjW2guI55ZfLgAAABM"]
[Fri Apr 10 14:34:00.833918 2026] [proxy_fcgi:error] [pid 13101:tid 13147] [client 5.77.200.50:31472] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:01.468820 2026] [proxy_fcgi:error] [pid 13189:tid 13206] [client 5.77.200.50:36955] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:02.097938 2026] [proxy_fcgi:error] [pid 13102:tid 13166] [client 5.77.200.50:47507] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:03.351159 2026] [proxy_fcgi:error] [pid 3934:tid 3943] [client 5.77.200.50:1110] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:03.977281 2026] [proxy_fcgi:error] [pid 3934:tid 3962] [client 5.77.200.50:10686] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:04.617796 2026] [proxy_fcgi:error] [pid 3934:tid 3940] [client 5.77.200.50:31418] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:05.882999 2026] [proxy_fcgi:error] [pid 3934:tid 3951] [client 5.77.200.50:48429] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 14:34:07.777468 2026] [:error] [pid 13189:tid 13200] [client 5.77.200.50:48503] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Guestbook.php"] [unique_id "adiZ35AxiJKPums3eBDJlwAAAEg"]
[Fri Apr 10 14:34:08.403433 2026] [:error] [pid 13101:tid 13152] [client 5.77.200.50:1159] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Guestbook.php"] [unique_id "adiZ4N8Ldw85818pj2o3FgAAAJM"]
[Fri Apr 10 14:34:09.023508 2026] [:error] [pid 13102:tid 13161] [client 5.77.200.50:5493] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo-joy.cgi"] [unique_id "adiZ4f9xLvjW2guI55ba_wAAAAE"]
[Fri Apr 10 14:34:09.647266 2026] [:error] [pid 3934:tid 3954] [client 5.77.200.50:27917] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo-joy.cgi"] [unique_id "adiZ4Ya41m-BS8mg82eh6AAAAM8"]
[Fri Apr 10 14:34:10.267102 2026] [:error] [pid 3934:tid 3957] [client 5.77.200.50:5418] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yybbs.cgi"] [unique_id "adiZ4oa41m-BS8mg82eh6QAAANI"]
[Fri Apr 10 14:34:10.891768 2026] [:error] [pid 3934:tid 3957] [client 5.77.200.50:48487] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yybbs.cgi"] [unique_id "adiZ4oa41m-BS8mg82eh8gAAANI"]
[Fri Apr 10 14:34:11.525333 2026] [:error] [pid 13101:tid 13157] [client 5.77.200.50:1141] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook"] [unique_id "adiZ498Ldw85818pj2o3FwAAAJg"]
[Fri Apr 10 14:34:12.149780 2026] [:error] [pid 13101:tid 13144] [client 5.77.200.50:31445] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook"] [unique_id "adiZ5N8Ldw85818pj2o3GgAAAIs"]
[Fri Apr 10 14:34:12.777043 2026] [:error] [pid 3934:tid 3944] [client 5.77.200.50:11007] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aska.cgi"] [unique_id "adiZ5Ia41m-BS8mg82eh9wAAAMU"]
[Fri Apr 10 14:34:13.402504 2026] [:error] [pid 13102:tid 13169] [client 5.77.200.50:5395] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aska.cgi"] [unique_id "adiZ5f9xLvjW2guI55bbBAAAAAk"]
[Fri Apr 10 14:34:14.026917 2026] [:error] [pid 3934:tid 3944] [client 5.77.200.50:48888] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jax_guestbook.php"] [unique_id "adiZ5oa41m-BS8mg82eh_wAAAMU"]
[Fri Apr 10 14:34:14.653685 2026] [:error] [pid 13101:tid 13156] [client 5.77.200.50:27744] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jax_guestbook.php"] [unique_id "adiZ5t8Ldw85818pj2o3HAAAAJc"]
[Fri Apr 10 14:34:15.275776 2026] [:error] [pid 3934:tid 3940] [client 5.77.200.50:47825] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.asp"] [unique_id "adiZ54a41m-BS8mg82eiAgAAAME"]
[Fri Apr 10 14:34:15.902481 2026] [:error] [pid 13189:tid 13204] [client 5.77.200.50:10751] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/default.asp"] [unique_id "adiZ55AxiJKPums3eBDJvQAAAEw"]
[Fri Apr 10 14:34:16.537281 2026] [:error] [pid 13100:tid 13125] [client 5.77.200.50:31590] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/album.cgi"] [unique_id "adiZ6Fzg-ZkZ0InWIP0u4AAAARQ"]
[Fri Apr 10 14:34:17.161788 2026] [:error] [pid 3934:tid 3950] [client 5.77.200.50:37172] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/album.cgi"] [unique_id "adiZ6Ya41m-BS8mg82eiDAAAAMs"]
[Fri Apr 10 14:34:17.787311 2026] [:error] [pid 3934:tid 3962] [client 5.77.200.50:27824] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook.php"] [unique_id "adiZ6Ya41m-BS8mg82eiEwAAANc"]
[Fri Apr 10 14:34:18.419345 2026] [:error] [pid 13189:tid 13212] [client 5.77.200.50:47878] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook.php"] [unique_id "adiZ6pAxiJKPums3eBDJzAAAAFQ"]
[Fri Apr 10 14:34:19.042893 2026] [:error] [pid 3934:tid 3957] [client 5.77.200.50:11052] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scarbook.php"] [unique_id "adiZ64a41m-BS8mg82eiGAAAANI"]
[Fri Apr 10 14:34:19.662477 2026] [:error] [pid 3934:tid 3945] [client 5.77.200.50:1235] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/scarbook.php"] [unique_id "adiZ64a41m-BS8mg82eiGgAAAMY"]
[Fri Apr 10 14:34:20.282812 2026] [:error] [pid 3934:tid 3944] [client 5.77.200.50:36907] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook.html"] [unique_id "adiZ7Ia41m-BS8mg82eiIAAAAMU"]
[Fri Apr 10 14:34:20.910633 2026] [:error] [pid 13189:tid 13199] [client 5.77.200.50:10696] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guestbook.html"] [unique_id "adiZ7JAxiJKPums3eBDJ1wAAAEc"]
[Fri Apr 10 14:34:21.542466 2026] [:error] [pid 13101:tid 13147] [client 5.77.200.50:56260] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gaestebuch.php"] [unique_id "adiZ7d8Ldw85818pj2o3IQAAAI4"]
[Fri Apr 10 14:34:22.167101 2026] [:error] [pid 13100:tid 13124] [client 5.77.200.50:1189] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gaestebuch.php"] [unique_id "adiZ7lzg-ZkZ0InWIP0u4QAAARM"]
[Fri Apr 10 14:34:22.796132 2026] [:error] [pid 3934:tid 3951] [client 5.77.200.50:31672] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apps/guestbook"] [unique_id "adiZ7oa41m-BS8mg82eiLAAAAMw"]
[Fri Apr 10 14:34:23.426689 2026] [:error] [pid 13101:tid 13156] [client 5.77.200.50:55963] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apps/guestbook"] [unique_id "adiZ798Ldw85818pj2o3JwAAAJc"]
[Fri Apr 10 14:34:24.056540 2026] [:error] [pid 13189:tid 13207] [client 5.77.200.50:10768] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g_book.cgi"] [unique_id "adiZ8JAxiJKPums3eBDJ3AAAAE8"]
[Fri Apr 10 14:34:24.680114 2026] [:error] [pid 13189:tid 13202] [client 5.77.200.50:1303] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g_book.cgi"] [unique_id "adiZ8JAxiJKPums3eBDJ4AAAAEo"]
[Fri Apr 10 14:34:25.305853 2026] [:error] [pid 13189:tid 13192] [client 5.77.200.50:11034] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gb.php"] [unique_id "adiZ8ZAxiJKPums3eBDJ5AAAAEA"]
[Fri Apr 10 14:34:25.937801 2026] [:error] [pid 3934:tid 3953] [client 5.77.200.50:27885] [client 5.77.200.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gb.php"] [unique_id "adiZ8Ya41m-BS8mg82eiNAAAAM4"]
[Fri Apr 10 15:05:58.625979 2026] [:error] [pid 13189:tid 13204] [client 104.28.214.122:20965] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adihVpAxiJKPums3eBDdzQAAAEw"]
[Fri Apr 10 18:17:37.346900 2026] [:error] [pid 13102:tid 13161] [client 98.159.37.83:64847] [client 98.159.37.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "adjOQf9xLvjW2guI55ZXHwAAAAE"]
[Fri Apr 10 20:19:09.602122 2026] [proxy_fcgi:error] [pid 13102:tid 13184] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:09.840193 2026] [proxy_fcgi:error] [pid 13102:tid 13174] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:10.078709 2026] [proxy_fcgi:error] [pid 13102:tid 13168] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:10.317275 2026] [proxy_fcgi:error] [pid 13102:tid 13181] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:10.554759 2026] [proxy_fcgi:error] [pid 13102:tid 13163] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:10.792337 2026] [proxy_fcgi:error] [pid 13102:tid 13165] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:11.033395 2026] [proxy_fcgi:error] [pid 13102:tid 13161] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:11.271412 2026] [proxy_fcgi:error] [pid 13102:tid 13169] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:11.509208 2026] [proxy_fcgi:error] [pid 13102:tid 13162] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:11.747336 2026] [proxy_fcgi:error] [pid 13102:tid 13180] [client 158.158.45.58:64921] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:19:11.996221 2026] [:error] [pid 13102:tid 13167] [client 158.158.45.58:64921] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/option.php"] [unique_id "adjqv_9xLvjW2guI55akdQAAAAc"]
[Fri Apr 10 20:19:12.474496 2026] [:error] [pid 13102:tid 13179] [client 158.158.45.58:64988] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/option.php"] [unique_id "adjqwP9xLvjW2guI55akdgAAABM"]
[Fri Apr 10 20:19:12.947930 2026] [:error] [pid 13100:tid 13119] [client 158.158.45.58:64896] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/option.php"] [unique_id "adjqwFzg-ZkZ0InWIP2t_gAAAQ4"]
[Fri Apr 10 20:19:13.425625 2026] [:error] [pid 25984:tid 25994] [client 158.158.45.58:64980] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/option.php"] [unique_id "adjqwbsdbY_MC14OH17unwAAAUU"]
[Fri Apr 10 20:19:13.897779 2026] [:error] [pid 3934:tid 3960] [client 158.158.45.58:65016] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OK.php"] [unique_id "adjqwYa41m-BS8mg82fM5QAAANU"]
[Fri Apr 10 20:19:14.380032 2026] [:error] [pid 13101:tid 13149] [client 158.158.45.58:64978] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OK.php"] [unique_id "adjqwt8Ldw85818pj2rD2wAAAJA"]
[Fri Apr 10 20:19:14.858492 2026] [:error] [pid 13189:tid 13195] [client 158.158.45.58:64908] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OK.php"] [unique_id "adjqwpAxiJKPums3eBCe_wAAAEM"]
[Fri Apr 10 20:19:15.335312 2026] [:error] [pid 25984:tid 26006] [client 158.158.45.58:64902] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/OK.php"] [unique_id "adjqw7sdbY_MC14OH17utAAAAVE"]
[Fri Apr 10 20:19:15.810497 2026] [:error] [pid 3934:tid 3962] [client 158.158.45.58:64950] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adjqw4a41m-BS8mg82fM6gAAANc"]
[Fri Apr 10 20:19:16.291721 2026] [:error] [pid 13101:tid 13135] [client 158.158.45.58:65012] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adjqxN8Ldw85818pj2rD5QAAAII"]
[Fri Apr 10 20:19:16.765969 2026] [:error] [pid 3934:tid 3949] [client 158.158.45.58:64962] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adjqxIa41m-BS8mg82fM8QAAAMo"]
[Fri Apr 10 20:19:17.235578 2026] [:error] [pid 3934:tid 3952] [client 158.158.45.58:64965] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adjqxYa41m-BS8mg82fM8gAAAM0"]
[Fri Apr 10 20:19:17.716222 2026] [:error] [pid 25984:tid 26002] [client 158.158.45.58:64977] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/F1jgmosvPbq.php"] [unique_id "adjqxbsdbY_MC14OH17uxQAAAU0"]
[Fri Apr 10 20:19:18.192148 2026] [:error] [pid 25984:tid 25992] [client 158.158.45.58:65009] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/F1jgmosvPbq.php"] [unique_id "adjqxrsdbY_MC14OH17uyQAAAUM"]
[Fri Apr 10 20:19:18.677668 2026] [:error] [pid 25984:tid 26000] [client 158.158.45.58:64910] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/F1jgmosvPbq.php"] [unique_id "adjqxrsdbY_MC14OH17uzAAAAUs"]
[Fri Apr 10 20:19:19.153470 2026] [:error] [pid 13189:tid 13212] [client 158.158.45.58:64899] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/F1jgmosvPbq.php"] [unique_id "adjqx5AxiJKPums3eBCfAgAAAFQ"]
[Fri Apr 10 20:19:19.634310 2026] [:error] [pid 25984:tid 25997] [client 158.158.45.58:64963] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adjqx7sdbY_MC14OH17u0AAAAUg"]
[Fri Apr 10 20:19:20.108222 2026] [:error] [pid 25984:tid 25993] [client 158.158.45.58:64898] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adjqyLsdbY_MC14OH17u1QAAAUQ"]
[Fri Apr 10 20:19:20.581766 2026] [:error] [pid 25984:tid 26000] [client 158.158.45.58:64942] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adjqyLsdbY_MC14OH17u2gAAAUs"]
[Fri Apr 10 20:19:21.057282 2026] [:error] [pid 13100:tid 13120] [client 158.158.45.58:65013] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adjqyVzg-ZkZ0InWIP2uEQAAAQ8"]
[Fri Apr 10 20:19:21.531761 2026] [:error] [pid 13189:tid 13203] [client 158.158.45.58:64986] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NexusLeads.php"] [unique_id "adjqyZAxiJKPums3eBCfBwAAAEs"]
[Fri Apr 10 20:19:22.006036 2026] [:error] [pid 13102:tid 13171] [client 158.158.45.58:64914] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NexusLeads.php"] [unique_id "adjqyv9xLvjW2guI55akmwAAAAs"]
[Fri Apr 10 20:19:22.483376 2026] [:error] [pid 3934:tid 3947] [client 158.158.45.58:64996] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NexusLeads.php"] [unique_id "adjqyoa41m-BS8mg82fM_QAAAMg"]
[Fri Apr 10 20:19:22.965163 2026] [:error] [pid 25984:tid 25993] [client 158.158.45.58:64971] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NexusLeads.php"] [unique_id "adjqyrsdbY_MC14OH17u8wAAAUQ"]
[Fri Apr 10 20:19:23.436448 2026] [:error] [pid 13102:tid 13167] [client 158.158.45.58:64997] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rfzhh.php"] [unique_id "adjqy_9xLvjW2guI55akoAAAAAc"]
[Fri Apr 10 20:19:23.929779 2026] [:error] [pid 13101:tid 13134] [client 158.158.45.58:64985] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rfzhh.php"] [unique_id "adjqy98Ldw85818pj2rEBwAAAIE"]
[Fri Apr 10 20:19:24.404637 2026] [:error] [pid 13102:tid 13176] [client 158.158.45.58:65011] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rfzhh.php"] [unique_id "adjqzP9xLvjW2guI55akqAAAABA"]
[Fri Apr 10 20:19:24.876882 2026] [:error] [pid 25984:tid 25998] [client 158.158.45.58:65006] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rfzhh.php"] [unique_id "adjqzLsdbY_MC14OH17u_gAAAUk"]
[Fri Apr 10 20:19:25.355858 2026] [:error] [pid 25984:tid 25989] [client 158.158.45.58:64979] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-wp.php"] [unique_id "adjqzbsdbY_MC14OH17vAQAAAUA"]
[Fri Apr 10 20:19:25.830680 2026] [:error] [pid 3934:tid 3959] [client 158.158.45.58:64919] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-wp.php"] [unique_id "adjqzYa41m-BS8mg82fNAAAAANQ"]
[Fri Apr 10 20:19:26.306033 2026] [:error] [pid 13189:tid 13205] [client 158.158.45.58:64998] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-wp.php"] [unique_id "adjqzpAxiJKPums3eBCfHwAAAE0"]
[Fri Apr 10 20:19:26.778585 2026] [:error] [pid 13102:tid 13173] [client 158.158.45.58:64920] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-wp.php"] [unique_id "adjqzv9xLvjW2guI55akswAAAA0"]
[Fri Apr 10 20:19:27.260079 2026] [:error] [pid 25984:tid 25990] [client 158.158.45.58:65022] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uplozyu.php"] [unique_id "adjqz7sdbY_MC14OH17vBwAAAUE"]
[Fri Apr 10 20:19:27.734513 2026] [:error] [pid 13189:tid 13209] [client 158.158.45.58:64927] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uplozyu.php"] [unique_id "adjqz5AxiJKPums3eBCfLwAAAFE"]
[Fri Apr 10 20:19:28.206297 2026] [:error] [pid 13102:tid 13166] [client 158.158.45.58:64990] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uplozyu.php"] [unique_id "adjq0P9xLvjW2guI55akvQAAAAY"]
[Fri Apr 10 20:19:28.681308 2026] [:error] [pid 25984:tid 25995] [client 158.158.45.58:65005] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uplozyu.php"] [unique_id "adjq0LsdbY_MC14OH17vEgAAAUY"]
[Fri Apr 10 20:19:29.155665 2026] [:error] [pid 13189:tid 13199] [client 158.158.45.58:64938] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4oivIQALaOZ.php"] [unique_id "adjq0ZAxiJKPums3eBCfNQAAAEc"]
[Fri Apr 10 20:19:29.629935 2026] [:error] [pid 13189:tid 13210] [client 158.158.45.58:64989] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4oivIQALaOZ.php"] [unique_id "adjq0ZAxiJKPums3eBCfNwAAAFI"]
[Fri Apr 10 20:19:30.105200 2026] [:error] [pid 13101:tid 13140] [client 158.158.45.58:64940] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4oivIQALaOZ.php"] [unique_id "adjq0t8Ldw85818pj2rEGwAAAIc"]
[Fri Apr 10 20:19:30.577935 2026] [:error] [pid 13100:tid 13126] [client 158.158.45.58:65017] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4oivIQALaOZ.php"] [unique_id "adjq0lzg-ZkZ0InWIP2uFAAAARU"]
[Fri Apr 10 20:19:31.049181 2026] [:error] [pid 13189:tid 13212] [client 158.158.45.58:64929] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lpktuneq.php"] [unique_id "adjq05AxiJKPums3eBCfQgAAAFQ"]
[Fri Apr 10 20:19:31.523675 2026] [:error] [pid 3934:tid 3948] [client 158.158.45.58:64935] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lpktuneq.php"] [unique_id "adjq04a41m-BS8mg82fNDgAAAMk"]
[Fri Apr 10 20:19:32.002881 2026] [:error] [pid 25984:tid 26006] [client 158.158.45.58:64916] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lpktuneq.php"] [unique_id "adjq1LsdbY_MC14OH17vKwAAAVE"]
[Fri Apr 10 20:19:32.492795 2026] [:error] [pid 13102:tid 13173] [client 158.158.45.58:64995] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lpktuneq.php"] [unique_id "adjq1P9xLvjW2guI55akyQAAAA0"]
[Fri Apr 10 20:19:32.962123 2026] [:error] [pid 13189:tid 13192] [client 158.158.45.58:64913] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5cnobsvIfGg.php"] [unique_id "adjq1JAxiJKPums3eBCfUgAAAEA"]
[Fri Apr 10 20:19:33.440497 2026] [:error] [pid 13102:tid 13165] [client 158.158.45.58:65014] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5cnobsvIfGg.php"] [unique_id "adjq1f9xLvjW2guI55akzwAAAAU"]
[Fri Apr 10 20:19:33.917924 2026] [:error] [pid 25984:tid 26005] [client 158.158.45.58:64961] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5cnobsvIfGg.php"] [unique_id "adjq1bsdbY_MC14OH17vNwAAAVA"]
[Fri Apr 10 20:19:34.408246 2026] [:error] [pid 25984:tid 26004] [client 158.158.45.58:64966] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5cnobsvIfGg.php"] [unique_id "adjq1rsdbY_MC14OH17vOwAAAU8"]
[Fri Apr 10 20:19:34.884450 2026] [:error] [pid 13189:tid 13202] [client 158.158.45.58:65010] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "adjq1pAxiJKPums3eBCfWQAAAEo"]
[Fri Apr 10 20:19:35.360515 2026] [:error] [pid 25984:tid 26007] [client 158.158.45.58:64958] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "adjq17sdbY_MC14OH17vPwAAAVI"]
[Fri Apr 10 20:19:35.832273 2026] [:error] [pid 3934:tid 3940] [client 158.158.45.58:64992] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "adjq14a41m-BS8mg82fNKgAAAME"]
[Fri Apr 10 20:19:36.306004 2026] [:error] [pid 25984:tid 26006] [client 158.158.45.58:64909] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "adjq2LsdbY_MC14OH17vSQAAAVE"]
[Fri Apr 10 20:19:36.831147 2026] [:error] [pid 3934:tid 3951] [client 158.158.45.58:64945] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tsconfig.php"] [unique_id "adjq2Ia41m-BS8mg82fNLAAAAMw"]
[Fri Apr 10 20:19:37.306895 2026] [:error] [pid 25984:tid 26001] [client 158.158.45.58:64928] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tsconfig.php"] [unique_id "adjq2bsdbY_MC14OH17vTwAAAUw"]
[Fri Apr 10 20:19:37.829991 2026] [:error] [pid 13101:tid 13156] [client 158.158.45.58:64981] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tsconfig.php"] [unique_id "adjq2d8Ldw85818pj2rESwAAAJc"]
[Fri Apr 10 20:19:38.303965 2026] [:error] [pid 3934:tid 3962] [client 158.158.45.58:64943] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tsconfig.php"] [unique_id "adjq2oa41m-BS8mg82fNMgAAANc"]
[Fri Apr 10 20:19:38.813388 2026] [:error] [pid 3934:tid 3946] [client 158.158.45.58:64999] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ptFWN5XHUb1.php"] [unique_id "adjq2oa41m-BS8mg82fNNQAAAMc"]
[Fri Apr 10 20:19:39.287752 2026] [:error] [pid 13189:tid 13207] [client 158.158.45.58:64946] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ptFWN5XHUb1.php"] [unique_id "adjq25AxiJKPums3eBCfYwAAAE8"]
[Fri Apr 10 20:19:39.763757 2026] [:error] [pid 3934:tid 3959] [client 158.158.45.58:12229] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ptFWN5XHUb1.php"] [unique_id "adjq24a41m-BS8mg82fNQAAAANQ"]
[Fri Apr 10 20:19:40.242966 2026] [:error] [pid 25984:tid 26013] [client 158.158.45.58:64926] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ptFWN5XHUb1.php"] [unique_id "adjq3LsdbY_MC14OH17vYAAAAVg"]
[Fri Apr 10 20:19:40.731079 2026] [:error] [pid 13189:tid 13193] [client 158.158.45.58:12270] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/YpWD4kv2sPG.php"] [unique_id "adjq3JAxiJKPums3eBCfbAAAAEE"]
[Fri Apr 10 20:19:41.249163 2026] [:error] [pid 13102:tid 13160] [client 158.158.45.58:65000] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/YpWD4kv2sPG.php"] [unique_id "adjq3f9xLvjW2guI55ak6QAAAAA"]
[Fri Apr 10 20:19:41.725689 2026] [:error] [pid 13189:tid 13203] [client 158.158.45.58:64983] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/YpWD4kv2sPG.php"] [unique_id "adjq3ZAxiJKPums3eBCfcgAAAEs"]
[Fri Apr 10 20:19:42.202579 2026] [:error] [pid 25984:tid 26005] [client 158.158.45.58:12227] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/YpWD4kv2sPG.php"] [unique_id "adjq3rsdbY_MC14OH17vcwAAAVA"]
[Fri Apr 10 20:19:42.676685 2026] [:error] [pid 25984:tid 25995] [client 158.158.45.58:12239] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turbo.php"] [unique_id "adjq3rsdbY_MC14OH17vdwAAAUY"]
[Fri Apr 10 20:19:43.173217 2026] [:error] [pid 13100:tid 13120] [client 158.158.45.58:65019] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turbo.php"] [unique_id "adjq31zg-ZkZ0InWIP2uGwAAAQ8"]
[Fri Apr 10 20:19:43.644618 2026] [:error] [pid 13100:tid 13122] [client 158.158.45.58:65002] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turbo.php"] [unique_id "adjq31zg-ZkZ0InWIP2uHQAAARE"]
[Fri Apr 10 20:19:44.118007 2026] [:error] [pid 3934:tid 3947] [client 158.158.45.58:64911] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turbo.php"] [unique_id "adjq4Ia41m-BS8mg82fNVQAAAMg"]
[Fri Apr 10 20:19:44.592728 2026] [:error] [pid 13189:tid 13206] [client 158.158.45.58:65021] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/small.php"] [unique_id "adjq4JAxiJKPums3eBCfdwAAAE4"]
[Fri Apr 10 20:19:45.077831 2026] [:error] [pid 25984:tid 26001] [client 158.158.45.58:64918] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/small.php"] [unique_id "adjq4bsdbY_MC14OH17vhwAAAUw"]
[Fri Apr 10 20:19:45.559418 2026] [:error] [pid 13100:tid 13109] [client 158.158.45.58:64915] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/small.php"] [unique_id "adjq4Vzg-ZkZ0InWIP2uIwAAAQQ"]
[Fri Apr 10 20:19:46.030394 2026] [:error] [pid 3934:tid 3956] [client 158.158.45.58:64952] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/small.php"] [unique_id "adjq4oa41m-BS8mg82fNXQAAANE"]
[Fri Apr 10 20:19:46.498684 2026] [:error] [pid 3934:tid 3953] [client 158.158.45.58:64993] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/SE6yfkFKuQA.php"] [unique_id "adjq4oa41m-BS8mg82fNXwAAAM4"]
[Fri Apr 10 20:19:46.970455 2026] [:error] [pid 13102:tid 13174] [client 158.158.45.58:64972] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/SE6yfkFKuQA.php"] [unique_id "adjq4v9xLvjW2guI55alAAAAAA4"]
[Fri Apr 10 20:19:47.443802 2026] [:error] [pid 25984:tid 26001] [client 158.158.45.58:65004] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/SE6yfkFKuQA.php"] [unique_id "adjq47sdbY_MC14OH17vlQAAAUw"]
[Fri Apr 10 20:19:47.916778 2026] [:error] [pid 13100:tid 13108] [client 158.158.45.58:64900] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/SE6yfkFKuQA.php"] [unique_id "adjq41zg-ZkZ0InWIP2uJAAAAQM"]
[Fri Apr 10 20:19:48.391574 2026] [:error] [pid 13100:tid 13126] [client 158.158.45.58:65007] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6Vtfo6i9f2.php"] [unique_id "adjq5Fzg-ZkZ0InWIP2uJgAAARU"]
[Fri Apr 10 20:19:48.865390 2026] [:error] [pid 13100:tid 13127] [client 158.158.45.58:64917] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6Vtfo6i9f2.php"] [unique_id "adjq5Fzg-ZkZ0InWIP2uKQAAARY"]
[Fri Apr 10 20:19:49.352332 2026] [:error] [pid 13102:tid 13176] [client 158.158.45.58:65018] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6Vtfo6i9f2.php"] [unique_id "adjq5f9xLvjW2guI55alBAAAABA"]
[Fri Apr 10 20:19:49.826202 2026] [:error] [pid 25984:tid 26012] [client 158.158.45.58:65001] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6Vtfo6i9f2.php"] [unique_id "adjq5bsdbY_MC14OH17vqwAAAVc"]
[Fri Apr 10 20:19:50.299773 2026] [:error] [pid 13189:tid 13199] [client 158.158.45.58:64934] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/veoblmpa.php"] [unique_id "adjq5pAxiJKPums3eBCfhgAAAEc"]
[Fri Apr 10 20:19:50.781750 2026] [:error] [pid 3934:tid 3948] [client 158.158.45.58:64959] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/veoblmpa.php"] [unique_id "adjq5oa41m-BS8mg82fNaQAAAMk"]
[Fri Apr 10 20:19:51.260394 2026] [:error] [pid 3934:tid 3952] [client 158.158.45.58:12262] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/veoblmpa.php"] [unique_id "adjq54a41m-BS8mg82fNbgAAAM0"]
[Fri Apr 10 20:19:51.749739 2026] [:error] [pid 13102:tid 13172] [client 158.158.45.58:64987] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/veoblmpa.php"] [unique_id "adjq5_9xLvjW2guI55alFAAAAAw"]
[Fri Apr 10 20:19:52.223550 2026] [:error] [pid 13102:tid 13179] [client 158.158.45.58:64953] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adjq6P9xLvjW2guI55alHAAAABM"]
[Fri Apr 10 20:19:52.695551 2026] [:error] [pid 13102:tid 13165] [client 158.158.45.58:64937] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adjq6P9xLvjW2guI55alIwAAAAU"]
[Fri Apr 10 20:19:53.170135 2026] [:error] [pid 13189:tid 13194] [client 158.158.45.58:12225] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adjq6ZAxiJKPums3eBCfjAAAAEI"]
[Fri Apr 10 20:19:53.642700 2026] [:error] [pid 13100:tid 13116] [client 158.158.45.58:64912] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adjq6Vzg-ZkZ0InWIP2uLQAAAQs"]
[Fri Apr 10 20:19:54.117317 2026] [:error] [pid 3934:tid 3953] [client 158.158.45.58:64907] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/levyzxsb.php"] [unique_id "adjq6oa41m-BS8mg82fNcgAAAM4"]
[Fri Apr 10 20:19:54.587350 2026] [:error] [pid 3934:tid 3952] [client 158.158.45.58:64933] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/levyzxsb.php"] [unique_id "adjq6oa41m-BS8mg82fNdgAAAM0"]
[Fri Apr 10 20:19:55.061319 2026] [:error] [pid 3934:tid 3945] [client 158.158.45.58:64970] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/levyzxsb.php"] [unique_id "adjq64a41m-BS8mg82fNfQAAAMY"]
[Fri Apr 10 20:19:55.537547 2026] [:error] [pid 13102:tid 13171] [client 158.158.45.58:12266] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/levyzxsb.php"] [unique_id "adjq6_9xLvjW2guI55alLQAAAAs"]
[Fri Apr 10 20:19:56.027800 2026] [:error] [pid 13101:tid 13141] [client 158.158.45.58:12248] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HtQmJOArI4R.php"] [unique_id "adjq7N8Ldw85818pj2rEZAAAAIg"]
[Fri Apr 10 20:19:56.509475 2026] [:error] [pid 13101:tid 13156] [client 158.158.45.58:64975] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HtQmJOArI4R.php"] [unique_id "adjq7N8Ldw85818pj2rEZwAAAJc"]
[Fri Apr 10 20:19:56.988131 2026] [:error] [pid 13101:tid 13140] [client 158.158.45.58:12234] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HtQmJOArI4R.php"] [unique_id "adjq7N8Ldw85818pj2rEagAAAIc"]
[Fri Apr 10 20:19:57.461988 2026] [:error] [pid 13189:tid 13216] [client 158.158.45.58:64957] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HtQmJOArI4R.php"] [unique_id "adjq7ZAxiJKPums3eBCfnAAAAFg"]
[Fri Apr 10 20:19:57.930834 2026] [:error] [pid 25984:tid 26002] [client 158.158.45.58:65008] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2whl5XBpvzE.php"] [unique_id "adjq7bsdbY_MC14OH17v1gAAAU0"]
[Fri Apr 10 20:19:58.398912 2026] [:error] [pid 13189:tid 13201] [client 158.158.45.58:64912] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2whl5XBpvzE.php"] [unique_id "adjq7pAxiJKPums3eBCfnQAAAEk"]
[Fri Apr 10 20:19:58.897087 2026] [:error] [pid 13189:tid 13208] [client 158.158.45.58:64925] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2whl5XBpvzE.php"] [unique_id "adjq7pAxiJKPums3eBCfoAAAAFA"]
[Fri Apr 10 20:19:59.369117 2026] [:error] [pid 25984:tid 26013] [client 158.158.45.58:64994] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2whl5XBpvzE.php"] [unique_id "adjq77sdbY_MC14OH17v5wAAAVg"]
[Fri Apr 10 20:19:59.844123 2026] [:error] [pid 13101:tid 13149] [client 158.158.45.58:12169] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtMi25FrDCR.php"] [unique_id "adjq798Ldw85818pj2rEbQAAAJA"]
[Fri Apr 10 20:20:00.321485 2026] [:error] [pid 13189:tid 13192] [client 158.158.45.58:12259] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtMi25FrDCR.php"] [unique_id "adjq8JAxiJKPums3eBCfpgAAAEA"]
[Fri Apr 10 20:20:00.797096 2026] [:error] [pid 13101:tid 13152] [client 158.158.45.58:64903] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtMi25FrDCR.php"] [unique_id "adjq8N8Ldw85818pj2rEcgAAAJM"]
[Fri Apr 10 20:20:01.295752 2026] [:error] [pid 25984:tid 25998] [client 158.158.45.58:64924] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtMi25FrDCR.php"] [unique_id "adjq8bsdbY_MC14OH17v7gAAAUk"]
[Fri Apr 10 20:20:01.766850 2026] [:error] [pid 13102:tid 13164] [client 158.158.45.58:64932] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/avTptOckufV.php"] [unique_id "adjq8f9xLvjW2guI55alQwAAAAQ"]
[Fri Apr 10 20:20:02.241493 2026] [:error] [pid 13102:tid 13183] [client 158.158.45.58:12251] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/avTptOckufV.php"] [unique_id "adjq8v9xLvjW2guI55alRwAAABc"]
[Fri Apr 10 20:20:02.715727 2026] [:error] [pid 13102:tid 13163] [client 158.158.45.58:12224] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/avTptOckufV.php"] [unique_id "adjq8v9xLvjW2guI55alTAAAAAM"]
[Fri Apr 10 20:20:03.197679 2026] [:error] [pid 25984:tid 25993] [client 158.158.45.58:12246] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/avTptOckufV.php"] [unique_id "adjq87sdbY_MC14OH17v-wAAAUQ"]
[Fri Apr 10 20:20:03.675408 2026] [:error] [pid 25984:tid 26008] [client 158.158.45.58:64960] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/FZH64c5eNOX.php"] [unique_id "adjq87sdbY_MC14OH17wBAAAAVM"]
[Fri Apr 10 20:20:04.146337 2026] [:error] [pid 25984:tid 26003] [client 158.158.45.58:64923] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/FZH64c5eNOX.php"] [unique_id "adjq9LsdbY_MC14OH17wEAAAAU4"]
[Fri Apr 10 20:20:04.622490 2026] [:error] [pid 3934:tid 3962] [client 158.158.45.58:12254] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/FZH64c5eNOX.php"] [unique_id "adjq9Ia41m-BS8mg82fNlQAAANc"]
[Fri Apr 10 20:20:05.090437 2026] [:error] [pid 3934:tid 3940] [client 158.158.45.58:64944] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/FZH64c5eNOX.php"] [unique_id "adjq9Ya41m-BS8mg82fNlgAAAME"]
[Fri Apr 10 20:20:05.572918 2026] [:error] [pid 13189:tid 13214] [client 158.158.45.58:12275] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/K9s7LSHhmVd.php"] [unique_id "adjq9ZAxiJKPums3eBCf3gAAAFY"]
[Fri Apr 10 20:20:06.043603 2026] [:error] [pid 13102:tid 13175] [client 158.158.45.58:12265] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/K9s7LSHhmVd.php"] [unique_id "adjq9v9xLvjW2guI55alVQAAAA8"]
[Fri Apr 10 20:20:06.517318 2026] [:error] [pid 13189:tid 13196] [client 158.158.45.58:12236] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/K9s7LSHhmVd.php"] [unique_id "adjq9pAxiJKPums3eBCf6gAAAEQ"]
[Fri Apr 10 20:20:06.988305 2026] [:error] [pid 25984:tid 25995] [client 158.158.45.58:12284] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/K9s7LSHhmVd.php"] [unique_id "adjq9rsdbY_MC14OH17wOAAAAUY"]
[Fri Apr 10 20:20:07.464337 2026] [:error] [pid 3934:tid 3939] [client 158.158.45.58:12260] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-casper.php"] [unique_id "adjq94a41m-BS8mg82fNoQAAAMA"]
[Fri Apr 10 20:20:07.938785 2026] [:error] [pid 3934:tid 3956] [client 158.158.45.58:12189] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-casper.php"] [unique_id "adjq94a41m-BS8mg82fNpAAAANE"]
[Fri Apr 10 20:20:08.415299 2026] [:error] [pid 13102:tid 13177] [client 158.158.45.58:64931] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-casper.php"] [unique_id "adjq-P9xLvjW2guI55alXAAAABE"]
[Fri Apr 10 20:20:08.885056 2026] [:error] [pid 25984:tid 25996] [client 158.158.45.58:12276] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-casper.php"] [unique_id "adjq-LsdbY_MC14OH17wSQAAAUc"]
[Fri Apr 10 20:20:09.359925 2026] [:error] [pid 13101:tid 13150] [client 158.158.45.58:12277] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Curve25519-items.php"] [unique_id "adjq-d8Ldw85818pj2rEkgAAAJE"]
[Fri Apr 10 20:20:09.835357 2026] [:error] [pid 13189:tid 13208] [client 158.158.45.58:12252] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Curve25519-items.php"] [unique_id "adjq-ZAxiJKPums3eBCgBQAAAFA"]
[Fri Apr 10 20:20:10.316226 2026] [:error] [pid 25984:tid 25999] [client 158.158.45.58:64930] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Curve25519-items.php"] [unique_id "adjq-rsdbY_MC14OH17wVgAAAUo"]
[Fri Apr 10 20:20:10.801990 2026] [:error] [pid 25984:tid 26003] [client 158.158.45.58:12245] [client 158.158.45.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Curve25519-items.php"] [unique_id "adjq-rsdbY_MC14OH17wWQAAAU4"]
[Fri Apr 10 20:20:11.288824 2026] [proxy_fcgi:error] [pid 25984:tid 26004] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:11.530464 2026] [proxy_fcgi:error] [pid 25984:tid 25998] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:11.771158 2026] [proxy_fcgi:error] [pid 25984:tid 25999] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:12.013393 2026] [proxy_fcgi:error] [pid 25984:tid 26003] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:12.256163 2026] [proxy_fcgi:error] [pid 25984:tid 25997] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:12.499922 2026] [proxy_fcgi:error] [pid 25984:tid 26011] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:14.163475 2026] [proxy_fcgi:error] [pid 25984:tid 25991] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:14.404083 2026] [proxy_fcgi:error] [pid 25984:tid 25992] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:20:14.648532 2026] [proxy_fcgi:error] [pid 25984:tid 25994] [client 158.158.45.58:12241] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 20:35:43.704283 2026] [:error] [pid 3934:tid 3958] [client 135.181.180.59:24056] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adjun4a41m-BS8mg82fWIAAAANM"]
[Fri Apr 10 20:35:46.202025 2026] [:error] [pid 13100:tid 13109] [client 135.181.180.59:13768] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adjuolzg-ZkZ0InWIP2ysgAAAQQ"]
[Fri Apr 10 20:35:48.293435 2026] [:error] [pid 13100:tid 13111] [client 135.181.180.59:31646] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adjupFzg-ZkZ0InWIP2ytQAAAQY"]
[Fri Apr 10 20:35:50.225694 2026] [:error] [pid 13100:tid 13119] [client 135.181.180.59:31654] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adjuplzg-ZkZ0InWIP2ytwAAAQ4"]
[Fri Apr 10 20:35:52.342556 2026] [:error] [pid 25984:tid 26002] [client 135.181.180.59:31668] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adjuqLsdbY_MC14OH17_IAAAAU0"]
[Fri Apr 10 20:35:54.473175 2026] [:error] [pid 25984:tid 26004] [client 135.181.180.59:31676] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adjuqrsdbY_MC14OH17_IgAAAU8"]
[Fri Apr 10 20:35:56.481045 2026] [:error] [pid 13100:tid 13127] [client 135.181.180.59:28578] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adjurFzg-ZkZ0InWIP2yvwAAARY"]
[Fri Apr 10 20:35:58.455312 2026] [:error] [pid 25984:tid 26005] [client 135.181.180.59:28582] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adjurrsdbY_MC14OH17_KwAAAVA"]
[Fri Apr 10 20:36:00.496911 2026] [:error] [pid 25984:tid 25998] [client 135.181.180.59:28594] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adjusLsdbY_MC14OH17_MgAAAUk"]
[Fri Apr 10 20:36:02.531227 2026] [:error] [pid 25984:tid 26012] [client 135.181.180.59:28602] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adjusrsdbY_MC14OH17_NgAAAVc"]
[Fri Apr 10 20:36:04.640808 2026] [:error] [pid 13100:tid 13108] [client 135.181.180.59:52562] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adjutFzg-ZkZ0InWIP2ywgAAAQM"]
[Fri Apr 10 20:36:06.601443 2026] [:error] [pid 13102:tid 13183] [client 135.181.180.59:52574] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adjutv9xLvjW2guI55avkwAAABc"]
[Fri Apr 10 20:36:08.649309 2026] [:error] [pid 13100:tid 13122] [client 135.181.180.59:52578] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adjuuFzg-ZkZ0InWIP2yxQAAARE"]
[Fri Apr 10 20:36:10.718687 2026] [:error] [pid 25984:tid 26010] [client 135.181.180.59:52588] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adjuursdbY_MC14OH17_YgAAAVU"]
[Fri Apr 10 20:36:12.578184 2026] [:error] [pid 3934:tid 3962] [client 135.181.180.59:52598] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adjuvIa41m-BS8mg82fWSwAAANc"]
[Fri Apr 10 20:36:24.237738 2026] [:error] [pid 13189:tid 13203] [client 135.181.180.59:34796] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adjuyJAxiJKPums3eBCnGQAAAEs"]
[Fri Apr 10 20:36:26.244840 2026] [:error] [pid 25984:tid 26012] [client 135.181.180.59:32038] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adjuyrsdbY_MC14OH17_iAAAAVc"]
[Fri Apr 10 20:36:28.273492 2026] [:error] [pid 25984:tid 25989] [client 135.181.180.59:32040] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adjuzLsdbY_MC14OH17_iwAAAUA"]
[Fri Apr 10 20:36:30.157849 2026] [:error] [pid 25984:tid 25997] [client 135.181.180.59:32042] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adjuzrsdbY_MC14OH17_jgAAAUg"]
[Fri Apr 10 20:36:32.309465 2026] [:error] [pid 3934:tid 3950] [client 135.181.180.59:32052] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adju0Ia41m-BS8mg82fWdwAAAMs"]
[Fri Apr 10 20:36:34.290591 2026] [:error] [pid 13101:tid 13141] [client 135.181.180.59:32064] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adju0t8Ldw85818pj2rK1AAAAIg"]
[Fri Apr 10 20:36:36.240477 2026] [:error] [pid 13101:tid 13149] [client 135.181.180.59:28026] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adju1N8Ldw85818pj2rK2AAAAJA"]
[Fri Apr 10 20:37:13.677316 2026] [:error] [pid 13189:tid 13216] [client 135.181.180.59:64762] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adju-ZAxiJKPums3eBCnTAAAAFg"]
[Fri Apr 10 20:37:15.599546 2026] [:error] [pid 13100:tid 13121] [client 135.181.180.59:52262] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adju-1zg-ZkZ0InWIP2zBQAAARA"]
[Fri Apr 10 20:37:17.731349 2026] [:error] [pid 13101:tid 13134] [client 135.181.180.59:52274] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adju_d8Ldw85818pj2rLHQAAAIE"]
[Fri Apr 10 20:37:19.738622 2026] [:error] [pid 13189:tid 13207] [client 135.181.180.59:52280] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adju_5AxiJKPums3eBCnUAAAAE8"]
[Fri Apr 10 20:37:22.250063 2026] [:error] [pid 13102:tid 13172] [client 135.181.180.59:35380] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adjvAv9xLvjW2guI55awEwAAAAw"]
[Fri Apr 10 20:37:24.205993 2026] [:error] [pid 13189:tid 13193] [client 135.181.180.59:52282] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adjvBJAxiJKPums3eBCnVwAAAEE"]
[Fri Apr 10 20:37:26.229789 2026] [:error] [pid 13100:tid 13109] [client 135.181.180.59:47430] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adjvBlzg-ZkZ0InWIP2zEwAAAQQ"]
[Fri Apr 10 20:37:28.100093 2026] [:error] [pid 13189:tid 13192] [client 135.181.180.59:47432] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adjvCJAxiJKPums3eBCnWwAAAEA"]
[Fri Apr 10 20:37:30.204013 2026] [:error] [pid 3934:tid 3944] [client 135.181.180.59:47448] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adjvCoa41m-BS8mg82fW7AAAAMU"]
[Fri Apr 10 20:37:32.667293 2026] [:error] [pid 3934:tid 3951] [client 135.181.180.59:1252] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adjvDIa41m-BS8mg82fW8QAAAMw"]
[Fri Apr 10 20:37:34.519156 2026] [:error] [pid 3934:tid 3944] [client 135.181.180.59:47452] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adjvDoa41m-BS8mg82fW-QAAAMU"]
[Fri Apr 10 20:37:36.452930 2026] [:error] [pid 13189:tid 13199] [client 135.181.180.59:52124] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adjvEJAxiJKPums3eBCnZgAAAEc"]
[Fri Apr 10 20:37:38.392265 2026] [:error] [pid 13102:tid 13179] [client 135.181.180.59:52138] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adjvEv9xLvjW2guI55awMwAAABM"]
[Fri Apr 10 20:37:41.013972 2026] [:error] [pid 13189:tid 13211] [client 135.181.180.59:26238] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adjvFZAxiJKPums3eBCncAAAAFM"]
[Fri Apr 10 20:37:42.952014 2026] [:error] [pid 13100:tid 13125] [client 135.181.180.59:52140] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adjvFlzg-ZkZ0InWIP2zLAAAARQ"]
[Fri Apr 10 20:37:44.926599 2026] [:error] [pid 13102:tid 13176] [client 135.181.180.59:36356] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adjvGP9xLvjW2guI55awRgAAABA"]
[Fri Apr 10 20:37:46.871611 2026] [:error] [pid 13102:tid 13173] [client 135.181.180.59:36370] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adjvGv9xLvjW2guI55awTwAAAA0"]
[Fri Apr 10 20:37:48.972638 2026] [:error] [pid 25984:tid 26009] [client 135.181.180.59:36380] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adjvHLsdbY_MC14OH14AwwAAAVQ"]
[Fri Apr 10 20:37:50.887490 2026] [:error] [pid 3934:tid 3957] [client 135.181.180.59:36386] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adjvHoa41m-BS8mg82fXFwAAANI"]
[Fri Apr 10 20:37:53.608078 2026] [:error] [pid 3934:tid 3943] [client 135.181.180.59:33306] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adjvIYa41m-BS8mg82fXIQAAAMQ"]
[Fri Apr 10 20:37:55.525062 2026] [:error] [pid 25984:tid 26009] [client 135.181.180.59:47858] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adjvI7sdbY_MC14OH14A6QAAAVQ"]
[Fri Apr 10 20:37:57.459935 2026] [:error] [pid 13101:tid 13138] [client 135.181.180.59:47866] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adjvJd8Ldw85818pj2rLaQAAAIU"]
[Fri Apr 10 20:38:00.115177 2026] [:error] [pid 13189:tid 13205] [client 135.181.180.59:11676] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adjvKJAxiJKPums3eBCniQAAAE0"]
[Fri Apr 10 20:38:02.177127 2026] [:error] [pid 25984:tid 25992] [client 135.181.180.59:47880] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adjvKrsdbY_MC14OH14A9AAAAUM"]
[Fri Apr 10 20:38:04.115420 2026] [:error] [pid 25984:tid 26000] [client 135.181.180.59:47896] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adjvLLsdbY_MC14OH14A_QAAAUs"]
[Fri Apr 10 20:38:06.273006 2026] [:error] [pid 3934:tid 3943] [client 135.181.180.59:39534] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adjvLoa41m-BS8mg82fXagAAAMQ"]
[Fri Apr 10 20:38:08.251269 2026] [:error] [pid 3934:tid 3944] [client 135.181.180.59:39540] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adjvMIa41m-BS8mg82fXcQAAAMU"]
[Fri Apr 10 20:38:10.793550 2026] [:error] [pid 13102:tid 13167] [client 135.181.180.59:61506] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adjvMv9xLvjW2guI55awkAAAAAc"]
[Fri Apr 10 20:38:36.552107 2026] [:error] [pid 13102:tid 13167] [client 135.181.180.59:43330] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adjvTP9xLvjW2guI55awygAAAAc"]
[Fri Apr 10 20:38:39.132097 2026] [:error] [pid 13100:tid 13116] [client 135.181.180.59:24876] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adjvT1zg-ZkZ0InWIP2zhgAAAQs"]
[Fri Apr 10 20:38:40.969742 2026] [:error] [pid 25984:tid 25994] [client 135.181.180.59:43340] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adjvULsdbY_MC14OH14BvQAAAUU"]
[Fri Apr 10 20:38:42.908888 2026] [:error] [pid 13102:tid 13166] [client 135.181.180.59:43342] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adjvUv9xLvjW2guI55aw3AAAAAY"]
[Fri Apr 10 20:38:44.811164 2026] [:error] [pid 25984:tid 26011] [client 135.181.180.59:51508] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adjvVLsdbY_MC14OH14BzQAAAVY"]
[Fri Apr 10 20:38:46.762076 2026] [:error] [pid 13102:tid 13183] [client 135.181.180.59:51522] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adjvVv9xLvjW2guI55aw9QAAABc"]
[Fri Apr 10 20:38:48.689780 2026] [:error] [pid 13101:tid 13151] [client 135.181.180.59:51532] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adjvWN8Ldw85818pj2rLswAAAJI"]
[Fri Apr 10 20:38:50.797299 2026] [:error] [pid 13101:tid 13152] [client 135.181.180.59:51542] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adjvWt8Ldw85818pj2rLuQAAAJM"]
[Fri Apr 10 20:38:53.324374 2026] [:error] [pid 3934:tid 3956] [client 135.181.180.59:42218] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adjvXYa41m-BS8mg82fX1gAAANE"]
[Fri Apr 10 20:38:55.362811 2026] [:error] [pid 3934:tid 3944] [client 135.181.180.59:47526] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adjvX4a41m-BS8mg82fX5AAAAMU"]
[Fri Apr 10 20:38:57.983984 2026] [:error] [pid 13189:tid 13211] [client 135.181.180.59:57166] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adjvYZAxiJKPums3eBCn-wAAAFM"]
[Fri Apr 10 20:38:59.985169 2026] [:error] [pid 13189:tid 13212] [client 135.181.180.59:47532] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adjvY5AxiJKPums3eBCn_gAAAFQ"]
[Fri Apr 10 20:39:02.090430 2026] [:error] [pid 13101:tid 13149] [client 135.181.180.59:47534] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adjvZt8Ldw85818pj2rL3QAAAJA"]
[Fri Apr 10 20:39:04.662410 2026] [:error] [pid 25984:tid 26002] [client 135.181.180.59:57218] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adjvaLsdbY_MC14OH14B7wAAAU0"]
[Fri Apr 10 20:39:06.646751 2026] [:error] [pid 13101:tid 13151] [client 135.181.180.59:7860] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adjvat8Ldw85818pj2rL6gAAAJI"]
[Fri Apr 10 20:39:08.570478 2026] [:error] [pid 3934:tid 3953] [client 135.181.180.59:7872] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adjvbIa41m-BS8mg82fX8QAAAM4"]
[Fri Apr 10 20:39:10.539692 2026] [:error] [pid 3934:tid 3943] [client 135.181.180.59:7888] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adjvboa41m-BS8mg82fX-AAAAMQ"]
[Fri Apr 10 20:39:14.858851 2026] [:error] [pid 25984:tid 26004] [client 135.181.180.59:47770] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adjvcrsdbY_MC14OH14CFAAAAU8"]
[Fri Apr 10 20:39:18.657164 2026] [:error] [pid 3934:tid 3947] [client 135.181.180.59:47778] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adjvdoa41m-BS8mg82fYDAAAAMg"]
[Fri Apr 10 20:47:48.906552 2026] [:error] [pid 13102:tid 13167] [client 36.41.75.167:37563] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adjxdP9xLvjW2guI55a2IAAAAAc"]
[Fri Apr 10 21:47:02.347663 2026] [:error] [pid 13189:tid 13202] [client 42.200.231.39:3335] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adj_VpAxiJKPums3eBDHMAAAAEo"]
[Fri Apr 10 21:47:57.868924 2026] [:error] [pid 13189:tid 13213] [client 42.200.231.39:26102] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adj_jZAxiJKPums3eBDHtAAAAFU"]
[Fri Apr 10 21:48:22.620860 2026] [:error] [pid 62710:tid 62720] [client 42.200.231.39:40129] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adj_puME7qrf5xEWWJsc2QAAAgc"]
[Fri Apr 10 21:48:24.678931 2026] [:error] [pid 13101:tid 13147] [client 42.200.231.39:34588] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adj_qN8Ldw85818pj2rmYAAAAI4"]
[Fri Apr 10 21:48:26.601873 2026] [:error] [pid 62769:tid 62777] [client 42.200.231.39:32090] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adj_qsWsSnfLoB8ifjBkjgAAAkY"]
[Fri Apr 10 21:48:28.539728 2026] [:error] [pid 62769:tid 62775] [client 42.200.231.39:17063] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adj_rMWsSnfLoB8ifjBkkwAAAkQ"]
[Fri Apr 10 21:48:30.482454 2026] [:error] [pid 13189:tid 13211] [client 42.200.231.39:47425] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adj_rpAxiJKPums3eBDH7wAAAFM"]
[Fri Apr 10 21:48:32.560964 2026] [:error] [pid 13101:tid 13136] [client 42.200.231.39:31406] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adj_sN8Ldw85818pj2rmaQAAAIM"]
[Fri Apr 10 21:48:34.515960 2026] [:error] [pid 62710:tid 62724] [client 42.200.231.39:58105] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adj_suME7qrf5xEWWJsc4AAAAgs"]
[Fri Apr 10 21:48:36.572723 2026] [:error] [pid 62819:tid 62823] [client 42.200.231.39:34592] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adj_tPU20EyPf7NlsldsNwAAAoE"]
[Fri Apr 10 21:48:38.523131 2026] [:error] [pid 62769:tid 62787] [client 42.200.231.39:6568] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adj_tsWsSnfLoB8ifjBkngAAAlA"]
[Fri Apr 10 21:48:40.645705 2026] [:error] [pid 63062:tid 63088] [client 42.200.231.39:1850] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adj_uJ2HtsmV85NqkMfzjQAAA5g"]
[Fri Apr 10 21:48:46.821685 2026] [:error] [pid 13100:tid 13125] [client 42.200.231.39:51928] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adj_vlzg-ZkZ0InWIP3BzgAAARQ"]
[Fri Apr 10 21:48:50.413840 2026] [:error] [pid 62769:tid 62781] [client 42.200.231.39:37930] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adj_wsWsSnfLoB8ifjBkwAAAAko"]
[Fri Apr 10 23:08:34.169272 2026] [:error] [pid 62769:tid 62772] [client 51.68.235.38:35370] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adkScsWsSnfLoB8ifjCnJgAAAkE"]
[Fri Apr 10 23:08:36.485513 2026] [:error] [pid 13189:tid 13201] [client 51.68.235.38:48278] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adkSdJAxiJKPums3eBD4UgAAAEk"]
[Fri Apr 10 23:08:38.973698 2026] [:error] [pid 62819:tid 62826] [client 51.68.235.38:48284] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adkSdvU20EyPf7Nlsld9zgAAAoQ"]
[Fri Apr 10 23:08:41.476803 2026] [:error] [pid 63062:tid 63068] [client 51.68.235.38:48286] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adkSeZ2HtsmV85NqkMcJeAAAA4Q"]
[Fri Apr 10 23:08:43.983666 2026] [:error] [pid 62819:tid 62823] [client 51.68.235.38:55474] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adkSe_U20EyPf7Nlsld91QAAAoE"]
[Fri Apr 10 23:08:46.490627 2026] [:error] [pid 62884:tid 62901] [client 51.68.235.38:55486] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adkSfuUCK1xrhnnmpo2VowAAAso"]
[Fri Apr 10 23:08:48.987669 2026] [:error] [pid 62769:tid 62782] [client 51.68.235.38:55490] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adkSgMWsSnfLoB8ifjCnTQAAAks"]
[Fri Apr 10 23:08:51.525856 2026] [:error] [pid 62769:tid 62785] [client 51.68.235.38:55492] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adkSg8WsSnfLoB8ifjCnVAAAAk4"]
[Fri Apr 10 23:08:54.009815 2026] [:error] [pid 62651:tid 62658] [client 51.68.235.38:52008] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adkShjbAH0le57SIaqw0vQAAAcU"]
[Fri Apr 10 23:08:56.511870 2026] [:error] [pid 62651:tid 62669] [client 51.68.235.38:52024] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adkSiDbAH0le57SIaqw0zAAAAdA"]
[Fri Apr 10 23:08:58.720751 2026] [:error] [pid 62769:tid 62795] [client 51.68.235.38:52036] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adkSisWsSnfLoB8ifjCncQAAAlg"]
[Fri Apr 10 23:09:01.244183 2026] [:error] [pid 62769:tid 62773] [client 51.68.235.38:52050] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adkSjcWsSnfLoB8ifjCngQAAAkI"]
[Fri Apr 10 23:09:03.734383 2026] [:error] [pid 13101:tid 13136] [client 51.68.235.38:38542] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adkSj98Ldw85818pj2oRlgAAAIM"]
[Fri Apr 10 23:09:06.236258 2026] [:error] [pid 62884:tid 62906] [client 51.68.235.38:38554] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adkSkuUCK1xrhnnmpo2VuAAAAs8"]
[Fri Apr 10 23:09:08.715651 2026] [:error] [pid 62710:tid 62737] [client 51.68.235.38:38558] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adkSlOME7qrf5xEWWJs8BgAAAhg"]
[Fri Apr 10 23:09:11.041479 2026] [:error] [pid 13100:tid 13129] [client 51.68.235.38:38562] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adkSl1zg-ZkZ0InWIP3OvAAAARg"]
[Fri Apr 10 23:09:13.547606 2026] [:error] [pid 62769:tid 62774] [client 51.68.235.38:38570] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adkSmcWsSnfLoB8ifjCnswAAAkM"]
[Fri Apr 10 23:09:16.061981 2026] [:error] [pid 62710:tid 62713] [client 51.68.235.38:37408] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adkSnOME7qrf5xEWWJs8FwAAAgA"]
[Fri Apr 10 23:09:18.555107 2026] [:error] [pid 62769:tid 62777] [client 51.68.235.38:37422] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adkSnsWsSnfLoB8ifjCn-QAAAkY"]
[Fri Apr 10 23:09:21.069000 2026] [:error] [pid 13100:tid 13108] [client 51.68.235.38:37434] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adkSoVzg-ZkZ0InWIP3OvgAAAQM"]
[Fri Apr 10 23:09:23.556905 2026] [:error] [pid 63062:tid 63084] [client 51.68.235.38:37442] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "adkSo52HtsmV85NqkMcJpgAAA5Q"]
[Fri Apr 10 23:09:26.054961 2026] [:error] [pid 62710:tid 62733] [client 51.68.235.38:50032] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "adkSpuME7qrf5xEWWJs8QQAAAhQ"]
[Fri Apr 10 23:09:28.576948 2026] [:error] [pid 62710:tid 62734] [client 51.68.235.38:50040] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adkSqOME7qrf5xEWWJs8UQAAAhU"]
[Fri Apr 10 23:09:31.045284 2026] [:error] [pid 13101:tid 13153] [client 51.68.235.38:50048] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adkSq98Ldw85818pj2oRyAAAAJQ"]
[Fri Apr 10 23:09:52.013571 2026] [:error] [pid 63134:tid 63152] [client 51.68.235.38:50058] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adkSwNFALqPDwWi6eJLA8AAAA88"]
[Fri Apr 10 23:09:54.463676 2026] [:error] [pid 13189:tid 13201] [client 51.68.235.38:39210] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adkSwpAxiJKPums3eBD5SAAAAEk"]
[Fri Apr 10 23:09:56.944133 2026] [:error] [pid 62769:tid 62793] [client 51.68.235.38:39216] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adkSxMWsSnfLoB8ifjCooAAAAlY"]
[Fri Apr 10 23:09:59.446389 2026] [:error] [pid 13101:tid 13143] [client 51.68.235.38:39222] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adkSx98Ldw85818pj2oSVgAAAIo"]
[Fri Apr 10 23:28:58.401755 2026] [:error] [pid 62710:tid 62714] [client 39.194.5.47:31049] [client 39.194.5.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.194.5.47, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adkXOuME7qrf5xEWWJtHZwAAAgE"]
[Fri Apr 10 23:28:58.414190 2026] [proxy_fcgi:error] [pid 62710:tid 62714] [client 39.194.5.47:31049] AH01071: Got error 'Primary script unknown'
[Fri Apr 10 23:52:42.411570 2026] [:error] [pid 13101:tid 13145] [client 43.165.135.242:57534] [client 43.165.135.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adkcyt8Ldw85818pj2osdAAAAIw"]
[Sat Apr 11 00:14:22.314366 2026] [proxy_fcgi:error] [pid 62710:tid 62728] [client 51.103.21.74:34066] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:22.551534 2026] [proxy_fcgi:error] [pid 62710:tid 62736] [client 51.103.21.74:34066] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:22.796546 2026] [proxy_fcgi:error] [pid 62710:tid 62735] [client 51.103.21.74:34066] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:23.034099 2026] [proxy_fcgi:error] [pid 62710:tid 62731] [client 51.103.21.74:34066] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:23.271105 2026] [proxy_fcgi:error] [pid 62710:tid 62717] [client 51.103.21.74:34066] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:23.504270 2026] [:error] [pid 62710:tid 62718] [client 51.103.21.74:34066] [client 51.103.21.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Ipv6.php"] [unique_id "adkh3-ME7qrf5xEWWJtXqwAAAgU"]
[Sat Apr 11 00:14:23.972584 2026] [proxy_fcgi:error] [pid 13189:tid 13194] [client 51.103.21.74:34079] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:24.208179 2026] [proxy_fcgi:error] [pid 13189:tid 13215] [client 51.103.21.74:34079] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:24.445475 2026] [proxy_fcgi:error] [pid 13189:tid 13205] [client 51.103.21.74:34079] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:24.681666 2026] [proxy_fcgi:error] [pid 13189:tid 13213] [client 51.103.21.74:34079] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:26.041743 2026] [proxy_fcgi:error] [pid 13189:tid 13215] [client 51.103.21.74:34079] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:14:26.740737 2026] [:error] [pid 13189:tid 13215] [client 51.103.21.74:34079] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-gertdxz.php"] [unique_id "adkh4pAxiJKPums3eBAr6QAAAFc"]
[Sat Apr 11 00:14:27.211544 2026] [:error] [pid 13189:tid 13209] [client 51.103.21.74:34055] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-gertdxz.php"] [unique_id "adkh45AxiJKPums3eBAr6gAAAFE"]
[Sat Apr 11 00:14:27.677805 2026] [:error] [pid 13189:tid 13216] [client 51.103.21.74:34049] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-gertdxz.php"] [unique_id "adkh45AxiJKPums3eBAr7QAAAFg"]
[Sat Apr 11 00:14:28.145646 2026] [:error] [pid 63062:tid 63084] [client 51.103.21.74:34063] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-gertdxz.php"] [unique_id "adkh5J2HtsmV85NqkMcc5gAAA5Q"]
[Sat Apr 11 00:14:28.618492 2026] [:error] [pid 13100:tid 13126] [client 51.103.21.74:34080] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adkh5Fzg-ZkZ0InWIP3ZEAAAARU"]
[Sat Apr 11 00:14:29.092436 2026] [:error] [pid 62710:tid 62719] [client 51.103.21.74:34111] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adkh5eME7qrf5xEWWJtXswAAAgY"]
[Sat Apr 11 00:14:29.557912 2026] [:error] [pid 63134:tid 63155] [client 51.103.21.74:34064] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adkh5dFALqPDwWi6eJLYuwAAA9I"]
[Sat Apr 11 00:14:30.025443 2026] [:error] [pid 62710:tid 62737] [client 51.103.21.74:34091] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adkh5uME7qrf5xEWWJtXtQAAAhg"]
[Sat Apr 11 00:14:30.494805 2026] [:error] [pid 13189:tid 13207] [client 51.103.21.74:6614] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adkh5pAxiJKPums3eBAr-AAAAE8"]
[Sat Apr 11 00:14:30.959439 2026] [:error] [pid 62651:tid 62673] [client 51.103.21.74:6629] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adkh5jbAH0le57SIaqxA0gAAAdQ"]
[Sat Apr 11 00:14:31.424302 2026] [:error] [pid 62710:tid 62725] [client 51.103.21.74:34082] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adkh5-ME7qrf5xEWWJtXuwAAAgw"]
[Sat Apr 11 00:14:31.893577 2026] [:error] [pid 62769:tid 62790] [client 51.103.21.74:6603] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "adkh58WsSnfLoB8ifjDssQAAAlM"]
[Sat Apr 11 00:14:32.360928 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:34093] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adkh6MWsSnfLoB8ifjDstAAAAk8"]
[Sat Apr 11 00:14:32.827136 2026] [:error] [pid 13189:tid 13195] [client 51.103.21.74:34101] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adkh6JAxiJKPums3eBAsAAAAAEM"]
[Sat Apr 11 00:14:33.287739 2026] [:error] [pid 62819:tid 62832] [client 51.103.21.74:34067] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adkh6fU20EyPf7NlsleOvgAAAoo"]
[Sat Apr 11 00:14:33.755160 2026] [:error] [pid 13189:tid 13211] [client 51.103.21.74:34058] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "adkh6ZAxiJKPums3eBAsBgAAAFM"]
[Sat Apr 11 00:14:34.222036 2026] [:error] [pid 13189:tid 13216] [client 51.103.21.74:34070] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "adkh6pAxiJKPums3eBAsCQAAAFg"]
[Sat Apr 11 00:14:34.700080 2026] [:error] [pid 13189:tid 13194] [client 51.103.21.74:34060] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "adkh6pAxiJKPums3eBAsDwAAAEI"]
[Sat Apr 11 00:14:35.167948 2026] [:error] [pid 13189:tid 13211] [client 51.103.21.74:34096] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "adkh65AxiJKPums3eBAsFwAAAFM"]
[Sat Apr 11 00:14:35.643607 2026] [:error] [pid 63134:tid 63151] [client 51.103.21.74:34051] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "adkh69FALqPDwWi6eJLYwAAAA84"]
[Sat Apr 11 00:14:36.111558 2026] [:error] [pid 62651:tid 62670] [client 51.103.21.74:34077] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adkh7DbAH0le57SIaqxA1AAAAdE"]
[Sat Apr 11 00:14:36.575867 2026] [:error] [pid 62884:tid 62899] [client 51.103.21.74:34088] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adkh7OUCK1xrhnnmpo2jFwAAAsg"]
[Sat Apr 11 00:14:37.044757 2026] [:error] [pid 62710:tid 62720] [client 51.103.21.74:34053] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adkh7eME7qrf5xEWWJtXwwAAAgc"]
[Sat Apr 11 00:14:37.514844 2026] [:error] [pid 62769:tid 62774] [client 51.103.21.74:6611] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adkh7cWsSnfLoB8ifjDswAAAAkM"]
[Sat Apr 11 00:14:37.985295 2026] [:error] [pid 62651:tid 62663] [client 51.103.21.74:34106] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "adkh7TbAH0le57SIaqxA1gAAAco"]
[Sat Apr 11 00:14:38.451674 2026] [:error] [pid 63134:tid 63149] [client 51.103.21.74:6595] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "adkh7tFALqPDwWi6eJLYxQAAA8w"]
[Sat Apr 11 00:14:38.916177 2026] [:error] [pid 13101:tid 13143] [client 51.103.21.74:6616] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "adkh7t8Ldw85818pj2o3SQAAAIo"]
[Sat Apr 11 00:14:39.384156 2026] [:error] [pid 13101:tid 13153] [client 51.103.21.74:34095] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "adkh798Ldw85818pj2o3TQAAAJQ"]
[Sat Apr 11 00:14:39.869467 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:34085] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adkh78WsSnfLoB8ifjDsxwAAAk8"]
[Sat Apr 11 00:14:40.339876 2026] [:error] [pid 62769:tid 62789] [client 51.103.21.74:34105] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adkh8MWsSnfLoB8ifjDszgAAAlI"]
[Sat Apr 11 00:14:40.813547 2026] [:error] [pid 63134:tid 63146] [client 51.103.21.74:6609] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adkh8NFALqPDwWi6eJLYyAAAA8k"]
[Sat Apr 11 00:14:41.286070 2026] [:error] [pid 62769:tid 62783] [client 51.103.21.74:34086] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "adkh8cWsSnfLoB8ifjDs0wAAAkw"]
[Sat Apr 11 00:14:41.754306 2026] [:error] [pid 63134:tid 63147] [client 51.103.21.74:6632] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wswer1.php"] [unique_id "adkh8dFALqPDwWi6eJLYywAAA8o"]
[Sat Apr 11 00:14:42.221077 2026] [:error] [pid 63134:tid 63159] [client 51.103.21.74:34076] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wswer1.php"] [unique_id "adkh8tFALqPDwWi6eJLYzAAAA9Y"]
[Sat Apr 11 00:14:42.685979 2026] [:error] [pid 62710:tid 62735] [client 51.103.21.74:34103] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wswer1.php"] [unique_id "adkh8uME7qrf5xEWWJtXzAAAAhY"]
[Sat Apr 11 00:14:43.154452 2026] [:error] [pid 62651:tid 62658] [client 51.103.21.74:34108] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wswer1.php"] [unique_id "adkh8zbAH0le57SIaqxA2gAAAcU"]
[Sat Apr 11 00:14:43.621505 2026] [:error] [pid 63134:tid 63154] [client 51.103.21.74:6594] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adkh89FALqPDwWi6eJLYzgAAA9E"]
[Sat Apr 11 00:14:44.098582 2026] [:error] [pid 13101:tid 13157] [client 51.103.21.74:6615] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adkh9N8Ldw85818pj2o3VQAAAJg"]
[Sat Apr 11 00:14:44.562516 2026] [:error] [pid 62769:tid 62795] [client 51.103.21.74:6607] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adkh9MWsSnfLoB8ifjDs2AAAAlg"]
[Sat Apr 11 00:14:45.033341 2026] [:error] [pid 63134:tid 63158] [client 51.103.21.74:7122] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "adkh9dFALqPDwWi6eJLY2QAAA9U"]
[Sat Apr 11 00:14:45.501960 2026] [:error] [pid 62710:tid 62723] [client 51.103.21.74:6655] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "adkh9eME7qrf5xEWWJtXzQAAAgo"]
[Sat Apr 11 00:14:45.971347 2026] [:error] [pid 13101:tid 13148] [client 51.103.21.74:34100] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "adkh9d8Ldw85818pj2o3WgAAAI8"]
[Sat Apr 11 00:14:46.439033 2026] [:error] [pid 62769:tid 62789] [client 51.103.21.74:34107] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "adkh9sWsSnfLoB8ifjDs4AAAAlI"]
[Sat Apr 11 00:14:46.911272 2026] [:error] [pid 13101:tid 13146] [client 51.103.21.74:6639] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "adkh9t8Ldw85818pj2o3ZQAAAI0"]
[Sat Apr 11 00:14:47.376784 2026] [:error] [pid 62710:tid 62733] [client 51.103.21.74:6653] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "adkh9-ME7qrf5xEWWJtX0AAAAhQ"]
[Sat Apr 11 00:14:47.848964 2026] [:error] [pid 13101:tid 13135] [client 51.103.21.74:34104] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "adkh998Ldw85818pj2o3aQAAAII"]
[Sat Apr 11 00:14:48.318198 2026] [:error] [pid 13100:tid 13114] [client 51.103.21.74:6613] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "adkh-Fzg-ZkZ0InWIP3ZFQAAAQk"]
[Sat Apr 11 00:14:48.793655 2026] [:error] [pid 13101:tid 13139] [client 51.103.21.74:7107] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "adkh-N8Ldw85818pj2o3bgAAAIY"]
[Sat Apr 11 00:14:49.263722 2026] [:error] [pid 62884:tid 62903] [client 51.103.21.74:6625] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adkh-eUCK1xrhnnmpo2jHAAAAsw"]
[Sat Apr 11 00:14:49.730397 2026] [:error] [pid 62884:tid 62901] [client 51.103.21.74:6592] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adkh-eUCK1xrhnnmpo2jHQAAAso"]
[Sat Apr 11 00:14:50.196300 2026] [:error] [pid 13101:tid 13133] [client 51.103.21.74:34087] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adkh-t8Ldw85818pj2o3cgAAAIA"]
[Sat Apr 11 00:14:50.662065 2026] [:error] [pid 62710:tid 62732] [client 51.103.21.74:34084] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "adkh-uME7qrf5xEWWJtX0wAAAhM"]
[Sat Apr 11 00:14:51.129467 2026] [:error] [pid 62710:tid 62722] [client 51.103.21.74:6641] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adkh--ME7qrf5xEWWJtX1wAAAgk"]
[Sat Apr 11 00:14:51.593765 2026] [:error] [pid 13189:tid 13210] [client 51.103.21.74:6602] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adkh-5AxiJKPums3eBAsNgAAAFI"]
[Sat Apr 11 00:14:52.057279 2026] [:error] [pid 62769:tid 62794] [client 51.103.21.74:6606] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adkh_MWsSnfLoB8ifjDs5QAAAlc"]
[Sat Apr 11 00:14:52.525160 2026] [:error] [pid 62769:tid 62787] [client 51.103.21.74:7108] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-turn.php"] [unique_id "adkh_MWsSnfLoB8ifjDs6QAAAlA"]
[Sat Apr 11 00:14:52.992039 2026] [:error] [pid 62769:tid 62788] [client 51.103.21.74:34083] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "adkh_MWsSnfLoB8ifjDs7wAAAlE"]
[Sat Apr 11 00:14:53.467263 2026] [:error] [pid 62769:tid 62778] [client 51.103.21.74:7121] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "adkh_cWsSnfLoB8ifjDs9QAAAkc"]
[Sat Apr 11 00:14:53.932614 2026] [:error] [pid 62769:tid 62782] [client 51.103.21.74:34059] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "adkh_cWsSnfLoB8ifjDs-gAAAks"]
[Sat Apr 11 00:14:54.408609 2026] [:error] [pid 62769:tid 62790] [client 51.103.21.74:6630] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "adkh_sWsSnfLoB8ifjDs_QAAAlM"]
[Sat Apr 11 00:14:54.877747 2026] [:error] [pid 62819:tid 62845] [client 51.103.21.74:34068] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adkh_vU20EyPf7NlsleO0QAAApc"]
[Sat Apr 11 00:14:55.366599 2026] [:error] [pid 62769:tid 62782] [client 51.103.21.74:34081] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adkh_8WsSnfLoB8ifjDtBwAAAks"]
[Sat Apr 11 00:14:55.832193 2026] [:error] [pid 62769:tid 62789] [client 51.103.21.74:34048] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adkh_8WsSnfLoB8ifjDtDAAAAlI"]
[Sat Apr 11 00:14:56.299114 2026] [:error] [pid 62769:tid 62793] [client 51.103.21.74:6599] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/red.php"] [unique_id "adkiAMWsSnfLoB8ifjDtFQAAAlY"]
[Sat Apr 11 00:14:56.765812 2026] [:error] [pid 62769:tid 62773] [client 51.103.21.74:34099] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adkiAMWsSnfLoB8ifjDtGwAAAkI"]
[Sat Apr 11 00:14:57.233894 2026] [:error] [pid 62769:tid 62779] [client 51.103.21.74:34094] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adkiAcWsSnfLoB8ifjDtIQAAAkg"]
[Sat Apr 11 00:14:57.701557 2026] [:error] [pid 63134:tid 63154] [client 51.103.21.74:34074] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adkiAdFALqPDwWi6eJLY5AAAA9E"]
[Sat Apr 11 00:14:58.170279 2026] [:error] [pid 63134:tid 63145] [client 51.103.21.74:6601] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "adkiAtFALqPDwWi6eJLY6AAAA8g"]
[Sat Apr 11 00:14:58.637351 2026] [:error] [pid 63134:tid 63146] [client 51.103.21.74:34110] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adkiAtFALqPDwWi6eJLY7AAAA8k"]
[Sat Apr 11 00:14:59.105274 2026] [:error] [pid 62769:tid 62795] [client 51.103.21.74:6622] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adkiA8WsSnfLoB8ifjDtJgAAAlg"]
[Sat Apr 11 00:14:59.573122 2026] [:error] [pid 13101:tid 13140] [client 51.103.21.74:6623] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adkiA98Ldw85818pj2o3hAAAAIc"]
[Sat Apr 11 00:15:00.045455 2026] [:error] [pid 62769:tid 62790] [client 51.103.21.74:34072] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adkiBMWsSnfLoB8ifjDtLAAAAlM"]
[Sat Apr 11 00:15:00.519093 2026] [:error] [pid 62651:tid 62673] [client 51.103.21.74:7129] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adkiBDbAH0le57SIaqxA4AAAAdQ"]
[Sat Apr 11 00:15:00.986287 2026] [:error] [pid 62710:tid 62726] [client 51.103.21.74:7120] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adkiBOME7qrf5xEWWJtX2wAAAg0"]
[Sat Apr 11 00:15:01.451293 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:34071] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adkiBcWsSnfLoB8ifjDtLgAAAk8"]
[Sat Apr 11 00:15:01.915209 2026] [:error] [pid 13189:tid 13201] [client 51.103.21.74:7116] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "adkiBZAxiJKPums3eBAsPwAAAEk"]
[Sat Apr 11 00:15:02.375574 2026] [:error] [pid 62769:tid 62778] [client 51.103.21.74:6620] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adkiBsWsSnfLoB8ifjDtMgAAAkc"]
[Sat Apr 11 00:15:02.848323 2026] [:error] [pid 62769:tid 62791] [client 51.103.21.74:7113] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adkiBsWsSnfLoB8ifjDtMwAAAlQ"]
[Sat Apr 11 00:15:03.310697 2026] [:error] [pid 13100:tid 13121] [client 51.103.21.74:6610] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adkiB1zg-ZkZ0InWIP3ZGwAAARA"]
[Sat Apr 11 00:15:03.777719 2026] [:error] [pid 13189:tid 13195] [client 51.103.21.74:7125] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "adkiB5AxiJKPums3eBAsRwAAAEM"]
[Sat Apr 11 00:15:04.248033 2026] [:error] [pid 62769:tid 62781] [client 51.103.21.74:7138] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "adkiCMWsSnfLoB8ifjDtNAAAAko"]
[Sat Apr 11 00:15:04.713359 2026] [:error] [pid 13189:tid 13206] [client 51.103.21.74:34078] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "adkiCJAxiJKPums3eBAsSwAAAE4"]
[Sat Apr 11 00:15:05.181592 2026] [:error] [pid 13189:tid 13201] [client 51.103.21.74:7106] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "adkiCZAxiJKPums3eBAsUAAAAEk"]
[Sat Apr 11 00:15:05.649154 2026] [:error] [pid 13189:tid 13208] [client 51.103.21.74:7164] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "adkiCZAxiJKPums3eBAsVQAAAFA"]
[Sat Apr 11 00:15:06.116538 2026] [:error] [pid 13189:tid 13193] [client 51.103.21.74:7137] [client 51.103.21.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adkiCpAxiJKPums3eBAsXAAAAEE"]
[Sat Apr 11 00:15:06.582502 2026] [:error] [pid 62884:tid 62903] [client 51.103.21.74:6635] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "adkiCuUCK1xrhnnmpo2jKAAAAsw"]
[Sat Apr 11 00:15:07.063576 2026] [:error] [pid 63134:tid 63160] [client 51.103.21.74:6649] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "adkiC9FALqPDwWi6eJLY_gAAA9c"]
[Sat Apr 11 00:15:07.531335 2026] [:error] [pid 13189:tid 13206] [client 51.103.21.74:34102] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "adkiC5AxiJKPums3eBAsYwAAAE4"]
[Sat Apr 11 00:15:08.000092 2026] [:error] [pid 13101:tid 13153] [client 51.103.21.74:6604] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myy.php"] [unique_id "adkiC98Ldw85818pj2o3lgAAAJQ"]
[Sat Apr 11 00:15:08.481822 2026] [:error] [pid 62769:tid 62783] [client 51.103.21.74:6626] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myy.php"] [unique_id "adkiDMWsSnfLoB8ifjDtNgAAAkw"]
[Sat Apr 11 00:15:08.948133 2026] [:error] [pid 62710:tid 62721] [client 51.103.21.74:34089] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myy.php"] [unique_id "adkiDOME7qrf5xEWWJtX8QAAAgg"]
[Sat Apr 11 00:15:09.415953 2026] [:error] [pid 62884:tid 62898] [client 51.103.21.74:34073] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myy.php"] [unique_id "adkiDeUCK1xrhnnmpo2jLAAAAsc"]
[Sat Apr 11 00:15:09.893494 2026] [:error] [pid 63134:tid 63137] [client 51.103.21.74:7123] [client 51.103.21.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "adkiDdFALqPDwWi6eJLZBQAAA8A"]
[Sat Apr 11 00:15:10.365190 2026] [:error] [pid 62710:tid 62716] [client 51.103.21.74:7119] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "adkiDuME7qrf5xEWWJtX-wAAAgM"]
[Sat Apr 11 00:15:10.832053 2026] [:error] [pid 13101:tid 13153] [client 51.103.21.74:6648] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "adkiDt8Ldw85818pj2o3ogAAAJQ"]
[Sat Apr 11 00:15:11.297489 2026] [:error] [pid 62710:tid 62724] [client 51.103.21.74:34062] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdone1.php"] [unique_id "adkiD-ME7qrf5xEWWJtYAAAAAgs"]
[Sat Apr 11 00:15:11.776150 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:7048] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adkiD8WsSnfLoB8ifjDtPwAAAk8"]
[Sat Apr 11 00:15:12.240834 2026] [:error] [pid 13101:tid 13142] [client 51.103.21.74:7144] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adkiEN8Ldw85818pj2o3qgAAAIk"]
[Sat Apr 11 00:15:12.709934 2026] [:error] [pid 13189:tid 13197] [client 51.103.21.74:34097] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adkiEJAxiJKPums3eBAsbAAAAEU"]
[Sat Apr 11 00:15:13.174816 2026] [:error] [pid 62884:tid 62905] [client 51.103.21.74:7149] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adkiEeUCK1xrhnnmpo2jMwAAAs4"]
[Sat Apr 11 00:15:13.642187 2026] [:error] [pid 62710:tid 62722] [client 51.103.21.74:6634] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adkiEeME7qrf5xEWWJtYBgAAAgk"]
[Sat Apr 11 00:15:14.112194 2026] [:error] [pid 62819:tid 62845] [client 51.103.21.74:34075] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adkiEvU20EyPf7NlsleO5wAAApc"]
[Sat Apr 11 00:15:14.577416 2026] [:error] [pid 62769:tid 62789] [client 51.103.21.74:7163] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adkiEsWsSnfLoB8ifjDtQgAAAlI"]
[Sat Apr 11 00:15:15.056832 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:34065] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wsheet1.php"] [unique_id "adkiE8WsSnfLoB8ifjDtSAAAAk8"]
[Sat Apr 11 00:15:15.528731 2026] [:error] [pid 63134:tid 63161] [client 51.103.21.74:6596] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "adkiE9FALqPDwWi6eJLZGAAAA9g"]
[Sat Apr 11 00:15:15.998847 2026] [:error] [pid 63134:tid 63147] [client 51.103.21.74:6612] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "adkiE9FALqPDwWi6eJLZGwAAA8o"]
[Sat Apr 11 00:15:16.477472 2026] [:error] [pid 62884:tid 62895] [client 51.103.21.74:34056] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "adkiFOUCK1xrhnnmpo2jNwAAAsQ"]
[Sat Apr 11 00:15:16.941266 2026] [:error] [pid 62710:tid 62726] [client 51.103.21.74:6650] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccs.php"] [unique_id "adkiFOME7qrf5xEWWJtYDAAAAg0"]
[Sat Apr 11 00:15:17.404106 2026] [:error] [pid 62769:tid 62784] [client 51.103.21.74:7086] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "adkiFcWsSnfLoB8ifjDtWgAAAk0"]
[Sat Apr 11 00:15:17.873995 2026] [:error] [pid 13101:tid 13148] [client 51.103.21.74:7118] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "adkiFd8Ldw85818pj2o3uAAAAI8"]
[Sat Apr 11 00:15:18.343763 2026] [:error] [pid 13100:tid 13122] [client 51.103.21.74:7105] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "adkiFlzg-ZkZ0InWIP3ZIQAAARE"]
[Sat Apr 11 00:15:18.821291 2026] [:error] [pid 62884:tid 62900] [client 51.103.21.74:6654] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "adkiFuUCK1xrhnnmpo2jPAAAAsk"]
[Sat Apr 11 00:15:19.286505 2026] [:error] [pid 62769:tid 62777] [client 51.103.21.74:7064] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adkiF8WsSnfLoB8ifjDtYAAAAkY"]
[Sat Apr 11 00:15:19.757177 2026] [:error] [pid 62651:tid 62654] [client 51.103.21.74:7147] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adkiFzbAH0le57SIaqxA6AAAAcE"]
[Sat Apr 11 00:15:20.223575 2026] [:error] [pid 13101:tid 13156] [client 51.103.21.74:6645] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adkiGN8Ldw85818pj2o3vAAAAJc"]
[Sat Apr 11 00:15:20.689202 2026] [:error] [pid 62651:tid 62669] [client 51.103.21.74:6647] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "adkiGDbAH0le57SIaqxA7AAAAdA"]
[Sat Apr 11 00:15:21.153730 2026] [:error] [pid 62769:tid 62784] [client 51.103.21.74:7045] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adkiGcWsSnfLoB8ifjDtZAAAAk0"]
[Sat Apr 11 00:15:21.624559 2026] [:error] [pid 62710:tid 62735] [client 51.103.21.74:6600] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adkiGeME7qrf5xEWWJtYEgAAAhY"]
[Sat Apr 11 00:15:22.100943 2026] [:error] [pid 62769:tid 62780] [client 51.103.21.74:34098] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adkiGsWsSnfLoB8ifjDtaQAAAkk"]
[Sat Apr 11 00:15:22.565431 2026] [:error] [pid 62884:tid 62896] [client 51.103.21.74:6631] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adkiGuUCK1xrhnnmpo2jPgAAAsU"]
[Sat Apr 11 00:15:23.052986 2026] [:error] [pid 62819:tid 62846] [client 51.103.21.74:34061] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adkiG_U20EyPf7NlsleO-QAAApg"]
[Sat Apr 11 00:15:23.521740 2026] [:error] [pid 63062:tid 63069] [client 51.103.21.74:7127] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adkiG52HtsmV85NqkMcdJgAAA4U"]
[Sat Apr 11 00:15:23.993246 2026] [:error] [pid 13101:tid 13141] [client 51.103.21.74:34054] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adkiG98Ldw85818pj2o3zwAAAIg"]
[Sat Apr 11 00:15:24.469753 2026] [:error] [pid 63062:tid 63086] [client 51.103.21.74:6597] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "adkiHJ2HtsmV85NqkMcdJwAAA5Y"]
[Sat Apr 11 00:15:24.938313 2026] [:error] [pid 62884:tid 62904] [client 51.103.21.74:6627] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adkiHOUCK1xrhnnmpo2jPwAAAs0"]
[Sat Apr 11 00:15:25.404423 2026] [:error] [pid 62769:tid 62778] [client 51.103.21.74:6621] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adkiHcWsSnfLoB8ifjDtfAAAAkc"]
[Sat Apr 11 00:15:25.868451 2026] [:error] [pid 62769:tid 62775] [client 51.103.21.74:7117] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ava.php"] [unique_id "adkiHcWsSnfLoB8ifjDtgAAAAkQ"]
[Sat Apr 11 00:15:26.345135 2026] [proxy_fcgi:error] [pid 13101:tid 13148] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:26.588251 2026] [proxy_fcgi:error] [pid 13101:tid 13139] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:26.827413 2026] [proxy_fcgi:error] [pid 13101:tid 13143] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:27.064599 2026] [proxy_fcgi:error] [pid 13101:tid 13136] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:27.304862 2026] [proxy_fcgi:error] [pid 13101:tid 13142] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:27.543002 2026] [proxy_fcgi:error] [pid 13101:tid 13134] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:27.782008 2026] [proxy_fcgi:error] [pid 13101:tid 13151] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:28.019517 2026] [proxy_fcgi:error] [pid 13101:tid 13137] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:28.258846 2026] [proxy_fcgi:error] [pid 13101:tid 13146] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:28.496077 2026] [proxy_fcgi:error] [pid 13101:tid 13140] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:28.733980 2026] [proxy_fcgi:error] [pid 13101:tid 13147] [client 51.103.21.74:6605] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:15:28.974205 2026] [:error] [pid 13101:tid 13149] [client 51.103.21.74:6605] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "adkiIN8Ldw85818pj2o37gAAAJA"]
[Sat Apr 11 00:15:29.440518 2026] [:error] [pid 62769:tid 62773] [client 51.103.21.74:6619] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "adkiIcWsSnfLoB8ifjDtkQAAAkI"]
[Sat Apr 11 00:15:29.909395 2026] [:error] [pid 13101:tid 13146] [client 51.103.21.74:34057] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "adkiId8Ldw85818pj2o39QAAAI0"]
[Sat Apr 11 00:15:30.380677 2026] [:error] [pid 13101:tid 13150] [client 51.103.21.74:6640] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "adkiIt8Ldw85818pj2o3-wAAAJE"]
[Sat Apr 11 00:15:30.848344 2026] [:error] [pid 13189:tid 13201] [client 51.103.21.74:7126] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adkiIpAxiJKPums3eBAsjQAAAEk"]
[Sat Apr 11 00:15:31.316132 2026] [:error] [pid 63062:tid 63073] [client 51.103.21.74:6642] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adkiI52HtsmV85NqkMcdOgAAA4k"]
[Sat Apr 11 00:15:31.788515 2026] [:error] [pid 13189:tid 13215] [client 51.103.21.74:7124] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adkiI5AxiJKPums3eBAsjwAAAFc"]
[Sat Apr 11 00:15:32.258296 2026] [:error] [pid 13100:tid 13126] [client 51.103.21.74:7114] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolf.php"] [unique_id "adkiJFzg-ZkZ0InWIP3ZKAAAARU"]
[Sat Apr 11 00:15:32.726872 2026] [:error] [pid 13100:tid 13108] [client 51.103.21.74:7067] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adkiJFzg-ZkZ0InWIP3ZKgAAAQM"]
[Sat Apr 11 00:15:33.193982 2026] [:error] [pid 63134:tid 63146] [client 51.103.21.74:7082] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adkiJdFALqPDwWi6eJLZJwAAA8k"]
[Sat Apr 11 00:15:33.661874 2026] [:error] [pid 63134:tid 63159] [client 51.103.21.74:6608] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adkiJdFALqPDwWi6eJLZLAAAA9Y"]
[Sat Apr 11 00:15:34.127584 2026] [:error] [pid 13101:tid 13144] [client 51.103.21.74:34069] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "adkiJt8Ldw85818pj2o4CAAAAIs"]
[Sat Apr 11 00:15:34.595714 2026] [:error] [pid 13189:tid 13208] [client 51.103.21.74:7130] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adkiJpAxiJKPums3eBAslQAAAFA"]
[Sat Apr 11 00:15:35.063765 2026] [:error] [pid 62884:tid 62911] [client 51.103.21.74:7052] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adkiJ-UCK1xrhnnmpo2jRwAAAtQ"]
[Sat Apr 11 00:15:35.526419 2026] [:error] [pid 13101:tid 13140] [client 51.103.21.74:7166] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adkiJ98Ldw85818pj2o4DgAAAIc"]
[Sat Apr 11 00:15:36.003279 2026] [:error] [pid 62884:tid 62914] [client 51.103.21.74:6593] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "adkiKOUCK1xrhnnmpo2jSAAAAtc"]
[Sat Apr 11 00:15:36.469736 2026] [:error] [pid 13189:tid 13209] [client 51.103.21.74:34109] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkiKJAxiJKPums3eBAsngAAAFE"]
[Sat Apr 11 00:15:36.940302 2026] [:error] [pid 13189:tid 13216] [client 51.103.21.74:7139] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkiKJAxiJKPums3eBAsogAAAFg"]
[Sat Apr 11 00:15:37.407164 2026] [:error] [pid 62884:tid 62899] [client 51.103.21.74:7146] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkiKeUCK1xrhnnmpo2jSwAAAsg"]
[Sat Apr 11 00:15:37.891988 2026] [:error] [pid 62710:tid 62728] [client 51.103.21.74:7145] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkiKeME7qrf5xEWWJtYPQAAAg8"]
[Sat Apr 11 00:15:38.358727 2026] [:error] [pid 13189:tid 13207] [client 51.103.21.74:34050] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkiKpAxiJKPums3eBAsqwAAAE8"]
[Sat Apr 11 00:15:38.829467 2026] [:error] [pid 63134:tid 63156] [client 51.103.21.74:7157] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkiKtFALqPDwWi6eJLZPAAAA9M"]
[Sat Apr 11 00:15:39.294809 2026] [:error] [pid 13189:tid 13211] [client 51.103.21.74:7068] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkiK5AxiJKPums3eBAssAAAAFM"]
[Sat Apr 11 00:15:39.759611 2026] [:error] [pid 13101:tid 13145] [client 51.103.21.74:7050] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkiK98Ldw85818pj2o4EwAAAIw"]
[Sat Apr 11 00:15:40.225928 2026] [:error] [pid 13189:tid 13213] [client 51.103.21.74:7142] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkiLJAxiJKPums3eBAsvAAAAFU"]
[Sat Apr 11 00:15:40.690706 2026] [:error] [pid 62769:tid 62793] [client 51.103.21.74:7143] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkiLMWsSnfLoB8ifjDtqwAAAlY"]
[Sat Apr 11 00:15:41.170024 2026] [:error] [pid 63134:tid 63151] [client 51.103.21.74:7057] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkiLdFALqPDwWi6eJLZQwAAA84"]
[Sat Apr 11 00:15:41.640327 2026] [:error] [pid 63134:tid 63139] [client 51.103.21.74:7104] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkiLdFALqPDwWi6eJLZRQAAA8I"]
[Sat Apr 11 00:15:42.105821 2026] [:error] [pid 62884:tid 62915] [client 51.103.21.74:7136] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/image.php"] [unique_id "adkiLuUCK1xrhnnmpo2jUAAAAtg"]
[Sat Apr 11 00:15:42.576492 2026] [:error] [pid 62819:tid 62831] [client 51.103.21.74:7140] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/image.php"] [unique_id "adkiLvU20EyPf7NlslePCgAAAok"]
[Sat Apr 11 00:15:43.044955 2026] [:error] [pid 62819:tid 62825] [client 51.103.21.74:6644] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/image.php"] [unique_id "adkiL_U20EyPf7NlslePDQAAAoM"]
[Sat Apr 11 00:15:43.509205 2026] [:error] [pid 13101:tid 13136] [client 51.103.21.74:6636] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/image.php"] [unique_id "adkiL98Ldw85818pj2o4HAAAAIM"]
[Sat Apr 11 00:15:43.978571 2026] [:error] [pid 62769:tid 62788] [client 51.103.21.74:7009] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkiL8WsSnfLoB8ifjDttQAAAlE"]
[Sat Apr 11 00:15:44.463498 2026] [:error] [pid 62769:tid 62779] [client 51.103.21.74:7156] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkiMMWsSnfLoB8ifjDtuQAAAkg"]
[Sat Apr 11 00:15:44.936719 2026] [:error] [pid 13101:tid 13134] [client 51.103.21.74:7141] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkiMN8Ldw85818pj2o4HgAAAIE"]
[Sat Apr 11 00:15:45.402813 2026] [:error] [pid 63062:tid 63077] [client 51.103.21.74:6646] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkiMZ2HtsmV85NqkMcdSwAAA40"]
[Sat Apr 11 00:15:45.873916 2026] [:error] [pid 62769:tid 62784] [client 51.103.21.74:7079] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkiMcWsSnfLoB8ifjDtvwAAAk0"]
[Sat Apr 11 00:15:46.362618 2026] [:error] [pid 13101:tid 13139] [client 51.103.21.74:7003] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkiMt8Ldw85818pj2o4IAAAAIY"]
[Sat Apr 11 00:15:46.830382 2026] [:error] [pid 62769:tid 62773] [client 51.103.21.74:7133] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkiMsWsSnfLoB8ifjDtxwAAAkI"]
[Sat Apr 11 00:15:47.296615 2026] [:error] [pid 62769:tid 62772] [client 51.103.21.74:7063] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkiM8WsSnfLoB8ifjDtzAAAAkE"]
[Sat Apr 11 00:15:47.765159 2026] [:error] [pid 62769:tid 62788] [client 51.103.21.74:7165] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkiM8WsSnfLoB8ifjDt1AAAAlE"]
[Sat Apr 11 00:15:48.231744 2026] [:error] [pid 62769:tid 62775] [client 51.103.21.74:7073] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkiNMWsSnfLoB8ifjDt1wAAAkQ"]
[Sat Apr 11 00:15:48.698544 2026] [:error] [pid 62769:tid 62780] [client 51.103.21.74:6986] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkiNMWsSnfLoB8ifjDt2AAAAkk"]
[Sat Apr 11 00:15:49.165728 2026] [:error] [pid 62769:tid 62783] [client 51.103.21.74:7044] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkiNcWsSnfLoB8ifjDt3gAAAkw"]
[Sat Apr 11 00:15:49.634093 2026] [:error] [pid 62819:tid 62829] [client 51.103.21.74:7161] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adkiNfU20EyPf7NlslePEQAAAoc"]
[Sat Apr 11 00:15:50.100757 2026] [:error] [pid 13100:tid 13106] [client 51.103.21.74:7042] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adkiNlzg-ZkZ0InWIP3ZOwAAAQE"]
[Sat Apr 11 00:15:50.572349 2026] [:error] [pid 63134:tid 63148] [client 51.103.21.74:7075] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adkiNtFALqPDwWi6eJLZWAAAA8s"]
[Sat Apr 11 00:15:51.039280 2026] [:error] [pid 13101:tid 13152] [client 51.103.21.74:7093] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/admin.php"] [unique_id "adkiN98Ldw85818pj2o4KQAAAJM"]
[Sat Apr 11 00:15:51.507010 2026] [:error] [pid 62710:tid 62728] [client 51.103.21.74:7072] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "adkiN-ME7qrf5xEWWJtYVwAAAg8"]
[Sat Apr 11 00:15:51.972367 2026] [:error] [pid 13100:tid 13114] [client 51.103.21.74:7066] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "adkiN1zg-ZkZ0InWIP3ZPAAAAQk"]
[Sat Apr 11 00:15:52.434643 2026] [:error] [pid 62769:tid 62788] [client 51.103.21.74:6643] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "adkiOMWsSnfLoB8ifjDt7AAAAlE"]
[Sat Apr 11 00:15:52.900880 2026] [:error] [pid 62884:tid 62914] [client 51.103.21.74:7160] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "adkiOOUCK1xrhnnmpo2jVgAAAtc"]
[Sat Apr 11 00:15:53.365343 2026] [:error] [pid 13101:tid 13139] [client 51.103.21.74:34105] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkiOd8Ldw85818pj2o4LgAAAIY"]
[Sat Apr 11 00:15:53.833876 2026] [:error] [pid 13189:tid 13195] [client 51.103.21.74:7092] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkiOZAxiJKPums3eBAs0wAAAEM"]
[Sat Apr 11 00:15:54.304607 2026] [:error] [pid 13189:tid 13194] [client 51.103.21.74:6652] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkiOpAxiJKPums3eBAs2gAAAEI"]
[Sat Apr 11 00:15:54.772580 2026] [:error] [pid 62710:tid 62732] [client 51.103.21.74:6598] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkiOuME7qrf5xEWWJtYYgAAAhM"]
[Sat Apr 11 00:15:55.246265 2026] [:error] [pid 13101:tid 13133] [client 51.103.21.74:7040] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkiO98Ldw85818pj2o4LwAAAIA"]
[Sat Apr 11 00:15:55.723430 2026] [:error] [pid 62710:tid 62728] [client 51.103.21.74:34090] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkiO-ME7qrf5xEWWJtYZwAAAg8"]
[Sat Apr 11 00:15:56.194835 2026] [:error] [pid 13101:tid 13153] [client 51.103.21.74:7109] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkiPN8Ldw85818pj2o4NgAAAJQ"]
[Sat Apr 11 00:15:56.661337 2026] [:error] [pid 13101:tid 13152] [client 51.103.21.74:7154] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkiPN8Ldw85818pj2o4OQAAAJM"]
[Sat Apr 11 00:15:57.131016 2026] [:error] [pid 62884:tid 62905] [client 51.103.21.74:7131] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1aa.php"] [unique_id "adkiPeUCK1xrhnnmpo2jXQAAAs4"]
[Sat Apr 11 00:15:57.602172 2026] [:error] [pid 62710:tid 62725] [client 51.103.21.74:6651] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1aa.php"] [unique_id "adkiPeME7qrf5xEWWJtYbAAAAgw"]
[Sat Apr 11 00:15:58.074549 2026] [:error] [pid 63062:tid 63065] [client 51.103.21.74:6980] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1aa.php"] [unique_id "adkiPp2HtsmV85NqkMcdWAAAA4E"]
[Sat Apr 11 00:15:58.542803 2026] [:error] [pid 13101:tid 13150] [client 51.103.21.74:6981] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1aa.php"] [unique_id "adkiPt8Ldw85818pj2o4QwAAAJE"]
[Sat Apr 11 00:15:59.009852 2026] [:error] [pid 63134:tid 63144] [client 51.103.21.74:6996] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkiP9FALqPDwWi6eJLZYAAAA8c"]
[Sat Apr 11 00:15:59.477866 2026] [:error] [pid 13101:tid 13153] [client 51.103.21.74:7167] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkiP98Ldw85818pj2o4SAAAAJQ"]
[Sat Apr 11 00:15:59.948356 2026] [:error] [pid 13101:tid 13138] [client 51.103.21.74:6978] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkiP98Ldw85818pj2o4TAAAAIU"]
[Sat Apr 11 00:16:00.414550 2026] [:error] [pid 63062:tid 63086] [client 51.103.21.74:7070] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkiQJ2HtsmV85NqkMcdXgAAA5Y"]
[Sat Apr 11 00:16:00.880442 2026] [:error] [pid 13189:tid 13214] [client 51.103.21.74:7153] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adkiQJAxiJKPums3eBAs4gAAAFY"]
[Sat Apr 11 00:16:01.346879 2026] [:error] [pid 62710:tid 62735] [client 51.103.21.74:6997] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adkiQeME7qrf5xEWWJtYbwAAAhY"]
[Sat Apr 11 00:16:01.822930 2026] [:error] [pid 13101:tid 13136] [client 51.103.21.74:6618] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adkiQd8Ldw85818pj2o4WAAAAIM"]
[Sat Apr 11 00:16:02.288282 2026] [:error] [pid 13101:tid 13144] [client 51.103.21.74:7085] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "adkiQt8Ldw85818pj2o4WwAAAIs"]
[Sat Apr 11 00:16:02.756132 2026] [:error] [pid 13189:tid 13200] [client 51.103.21.74:34098] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkiQpAxiJKPums3eBAs5gAAAEg"]
[Sat Apr 11 00:16:03.227986 2026] [:error] [pid 62769:tid 62786] [client 51.103.21.74:7135] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkiQ8WsSnfLoB8ifjDuEgAAAk8"]
[Sat Apr 11 00:16:03.705669 2026] [:error] [pid 62769:tid 62795] [client 51.103.21.74:6624] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkiQ8WsSnfLoB8ifjDuGgAAAlg"]
[Sat Apr 11 00:16:04.170374 2026] [:error] [pid 13101:tid 13155] [client 51.103.21.74:7132] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkiRN8Ldw85818pj2o4ZgAAAJY"]
[Sat Apr 11 00:16:04.654976 2026] [:error] [pid 13101:tid 13148] [client 51.103.21.74:6983] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkiRN8Ldw85818pj2o4agAAAI8"]
[Sat Apr 11 00:16:05.136839 2026] [:error] [pid 63134:tid 63157] [client 51.103.21.74:34052] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkiRdFALqPDwWi6eJLZagAAA9Q"]
[Sat Apr 11 00:16:05.605974 2026] [:error] [pid 63134:tid 63141] [client 51.103.21.74:6617] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkiRdFALqPDwWi6eJLZbAAAA8Q"]
[Sat Apr 11 00:16:06.072799 2026] [:error] [pid 62651:tid 62659] [client 51.103.21.74:7029] [client 51.103.21.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkiRjbAH0le57SIaqxBAwAAAcY"]
[Sat Apr 11 00:56:50.215768 2026] [proxy_fcgi:error] [pid 21706:tid 21714] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:50.468186 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:50.704796 2026] [proxy_fcgi:error] [pid 21706:tid 21717] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:50.942151 2026] [proxy_fcgi:error] [pid 21706:tid 21720] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:51.208458 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:51.459041 2026] [proxy_fcgi:error] [pid 21706:tid 21728] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:51.700926 2026] [proxy_fcgi:error] [pid 21706:tid 21718] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:51.947779 2026] [proxy_fcgi:error] [pid 21706:tid 21712] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:52.186785 2026] [proxy_fcgi:error] [pid 21706:tid 21724] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:52.428439 2026] [proxy_fcgi:error] [pid 21706:tid 21726] [client 20.216.168.122:61617] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:56:52.675599 2026] [:error] [pid 21706:tid 21714] [client 20.216.168.122:61617] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "adkr1CGQ1M5d8fQSsLFtOgAAAAY"]
[Sat Apr 11 00:56:53.316190 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:39050] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "adkr1TKs5t9xRSNL6cmiYQAAAEA"]
[Sat Apr 11 00:56:53.950749 2026] [:error] [pid 21568:tid 21596] [client 20.216.168.122:39100] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "adkr1Yiz5v_ljZxkpR-gyAAAARg"]
[Sat Apr 11 00:56:54.481484 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:39071] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-104.php"] [unique_id "adkr1jKs5t9xRSNL6cmiZgAAAEU"]
[Sat Apr 11 00:56:55.033925 2026] [:error] [pid 21706:tid 21730] [client 20.216.168.122:44879] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "adkr1yGQ1M5d8fQSsLFtSAAAABY"]
[Sat Apr 11 00:56:55.753501 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:44917] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "adkr1yGQ1M5d8fQSsLFtUQAAAAM"]
[Sat Apr 11 00:56:56.278952 2026] [:error] [pid 21570:tid 21670] [client 20.216.168.122:42474] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "adkr2DKs5t9xRSNL6cmiaAAAAEQ"]
[Sat Apr 11 00:56:56.854883 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:20186] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rzki.php"] [unique_id "adkr2CGQ1M5d8fQSsLFtVQAAAAI"]
[Sat Apr 11 00:56:57.333753 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:39073] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adkr2TKs5t9xRSNL6cmibAAAAEM"]
[Sat Apr 11 00:56:57.854659 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:44899] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adkr2SGQ1M5d8fQSsLFtXgAAAAk"]
[Sat Apr 11 00:56:58.358496 2026] [:error] [pid 21706:tid 21732] [client 20.216.168.122:39058] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adkr2iGQ1M5d8fQSsLFtYgAAABg"]
[Sat Apr 11 00:56:58.844346 2026] [:error] [pid 21569:tid 21647] [client 20.216.168.122:17637] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adkr2nAvQTgvXJ6vHop9kgAAAII"]
[Sat Apr 11 00:56:59.571143 2026] [:error] [pid 21569:tid 21678] [client 20.216.168.122:61570] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "adkr23AvQTgvXJ6vHop9lQAAAJY"]
[Sat Apr 11 00:57:00.100657 2026] [:error] [pid 21570:tid 21695] [client 20.216.168.122:42464] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "adkr3DKs5t9xRSNL6cmicwAAAFU"]
[Sat Apr 11 00:57:00.656604 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:65506] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "adkr3CGQ1M5d8fQSsLFteQAAABQ"]
[Sat Apr 11 00:57:01.258907 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:20188] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d12.php"] [unique_id "adkr3SGQ1M5d8fQSsLFtfQAAAAU"]
[Sat Apr 11 00:57:01.776176 2026] [:error] [pid 21706:tid 21719] [client 20.216.168.122:20183] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "adkr3SGQ1M5d8fQSsLFtgwAAAAs"]
[Sat Apr 11 00:57:02.269956 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:61583] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "adkr3iGQ1M5d8fQSsLFthwAAABc"]
[Sat Apr 11 00:57:02.756476 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:25126] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "adkr3iGQ1M5d8fQSsLFtiwAAAAw"]
[Sat Apr 11 00:57:03.269335 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:38993] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/okxh.php"] [unique_id "adkr3yGQ1M5d8fQSsLFtjwAAAAU"]
[Sat Apr 11 00:57:03.885628 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:20214] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "adkr3yGQ1M5d8fQSsLFtlwAAABQ"]
[Sat Apr 11 00:57:04.398998 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:20189] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "adkr4Iiz5v_ljZxkpR-g7QAAAQE"]
[Sat Apr 11 00:57:04.912714 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:42443] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "adkr4HAvQTgvXJ6vHop9pgAAAI4"]
[Sat Apr 11 00:57:05.462888 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:39101] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/55b76.php"] [unique_id "adkr4SGQ1M5d8fQSsLFtpAAAAAo"]
[Sat Apr 11 00:57:05.938166 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:42455] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "adkr4SGQ1M5d8fQSsLFtrgAAABc"]
[Sat Apr 11 00:57:06.429685 2026] [:error] [pid 21568:tid 21591] [client 20.216.168.122:44882] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "adkr4oiz5v_ljZxkpR-g8AAAARM"]
[Sat Apr 11 00:57:06.924792 2026] [:error] [pid 21569:tid 21657] [client 20.216.168.122:44907] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "adkr4nAvQTgvXJ6vHop9qQAAAIw"]
[Sat Apr 11 00:57:07.500688 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:20161] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "adkr4yGQ1M5d8fQSsLFttAAAAA8"]
[Sat Apr 11 00:57:08.123303 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:42487] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "adkr5Iiz5v_ljZxkpR-g9gAAARE"]
[Sat Apr 11 00:57:08.734716 2026] [:error] [pid 21568:tid 21576] [client 20.216.168.122:42452] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "adkr5Iiz5v_ljZxkpR-g-QAAAQQ"]
[Sat Apr 11 00:57:09.250515 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:61568] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "adkr5TKs5t9xRSNL6cmigwAAAEM"]
[Sat Apr 11 00:57:09.883287 2026] [:error] [pid 21568:tid 21585] [client 20.216.168.122:44887] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maul.php"] [unique_id "adkr5Yiz5v_ljZxkpR-g_wAAAQ0"]
[Sat Apr 11 00:57:10.540135 2026] [:error] [pid 21570:tid 21665] [client 20.216.168.122:20207] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "adkr5jKs5t9xRSNL6cmiigAAAEI"]
[Sat Apr 11 00:57:11.212159 2026] [:error] [pid 21570:tid 21663] [client 20.216.168.122:39019] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "adkr5zKs5t9xRSNL6cmijAAAAEE"]
[Sat Apr 11 00:57:11.854009 2026] [:error] [pid 21568:tid 21575] [client 20.216.168.122:39103] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "adkr54iz5v_ljZxkpR-hDwAAAQM"]
[Sat Apr 11 00:57:12.434280 2026] [:error] [pid 21570:tid 21677] [client 20.216.168.122:17622] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5b9ac.php"] [unique_id "adkr6DKs5t9xRSNL6cmijwAAAEg"]
[Sat Apr 11 00:57:13.099805 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:61597] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "adkr6SGQ1M5d8fQSsLFtxwAAABQ"]
[Sat Apr 11 00:57:13.661442 2026] [:error] [pid 21570:tid 21690] [client 20.216.168.122:17638] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "adkr6TKs5t9xRSNL6cmilAAAAFA"]
[Sat Apr 11 00:57:14.286643 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:44912] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "adkr6nAvQTgvXJ6vHop9uQAAAIU"]
[Sat Apr 11 00:57:14.915885 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:61575] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hehe.php"] [unique_id "adkr6oiz5v_ljZxkpR-hGwAAAQE"]
[Sat Apr 11 00:57:15.476781 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:44866] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkr6yGQ1M5d8fQSsLFtzAAAAA0"]
[Sat Apr 11 00:57:16.043086 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:42457] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkr7Iiz5v_ljZxkpR-hIQAAAQc"]
[Sat Apr 11 00:57:16.645182 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:17629] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkr7CGQ1M5d8fQSsLFt1QAAAA8"]
[Sat Apr 11 00:57:17.208990 2026] [:error] [pid 21568:tid 21590] [client 20.216.168.122:39074] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6kDPjgFTmvS.php"] [unique_id "adkr7Yiz5v_ljZxkpR-hKAAAARI"]
[Sat Apr 11 00:57:17.844838 2026] [:error] [pid 21570:tid 21685] [client 20.216.168.122:20202] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "adkr7TKs5t9xRSNL6cmimwAAAEw"]
[Sat Apr 11 00:57:18.339434 2026] [:error] [pid 21569:tid 21664] [client 20.216.168.122:17617] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "adkr7nAvQTgvXJ6vHop9wQAAAJA"]
[Sat Apr 11 00:57:18.945792 2026] [:error] [pid 21569:tid 21683] [client 20.216.168.122:39044] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "adkr7nAvQTgvXJ6vHop9xQAAAJg"]
[Sat Apr 11 00:57:19.463974 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:39097] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/varb.php"] [unique_id "adkr7zKs5t9xRSNL6cmioAAAAEA"]
[Sat Apr 11 00:57:20.052767 2026] [:error] [pid 21570:tid 21688] [client 20.216.168.122:17601] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "adkr8DKs5t9xRSNL6cmipAAAAE4"]
[Sat Apr 11 00:57:20.544441 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:20171] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "adkr8HAvQTgvXJ6vHop9ygAAAIs"]
[Sat Apr 11 00:57:21.148327 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:39082] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "adkr8SGQ1M5d8fQSsLFt3gAAAAQ"]
[Sat Apr 11 00:57:21.631739 2026] [:error] [pid 21570:tid 21670] [client 20.216.168.122:17644] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lm15.php"] [unique_id "adkr8TKs5t9xRSNL6cmipQAAAEQ"]
[Sat Apr 11 00:57:22.203036 2026] [:error] [pid 21568:tid 21577] [client 20.216.168.122:38989] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clss.php"] [unique_id "adkr8oiz5v_ljZxkpR-hMgAAAQU"]
[Sat Apr 11 00:57:22.699865 2026] [:error] [pid 21569:tid 21678] [client 20.216.168.122:20222] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clss.php"] [unique_id "adkr8nAvQTgvXJ6vHop91QAAAJY"]
[Sat Apr 11 00:57:23.180057 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:20166] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clss.php"] [unique_id "adkr84iz5v_ljZxkpR-hNwAAAQc"]
[Sat Apr 11 00:57:23.769416 2026] [:error] [pid 21569:tid 21648] [client 20.216.168.122:17615] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clss.php"] [unique_id "adkr83AvQTgvXJ6vHop93QAAAIM"]
[Sat Apr 11 00:57:24.489463 2026] [:error] [pid 21570:tid 21692] [client 20.216.168.122:42439] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/44.php"] [unique_id "adkr9DKs5t9xRSNL6cmirgAAAFI"]
[Sat Apr 11 00:57:24.997433 2026] [:error] [pid 21568:tid 21574] [client 20.216.168.122:39078] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/44.php"] [unique_id "adkr9Iiz5v_ljZxkpR-hPAAAAQI"]
[Sat Apr 11 00:57:25.529542 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:17633] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/44.php"] [unique_id "adkr9SGQ1M5d8fQSsLFt6gAAAAQ"]
[Sat Apr 11 00:57:26.008489 2026] [:error] [pid 21569:tid 21664] [client 20.216.168.122:61606] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/44.php"] [unique_id "adkr9nAvQTgvXJ6vHop95AAAAJA"]
[Sat Apr 11 00:57:27.652857 2026] [:error] [pid 21569:tid 21657] [client 20.216.168.122:20170] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5e0a.php"] [unique_id "adkr93AvQTgvXJ6vHop95QAAAIw"]
[Sat Apr 11 00:57:28.150860 2026] [:error] [pid 21569:tid 21674] [client 20.216.168.122:20181] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5e0a.php"] [unique_id "adkr-HAvQTgvXJ6vHop96AAAAJQ"]
[Sat Apr 11 00:57:28.624619 2026] [:error] [pid 21569:tid 21659] [client 20.216.168.122:61619] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5e0a.php"] [unique_id "adkr-HAvQTgvXJ6vHop96gAAAI0"]
[Sat Apr 11 00:57:29.211915 2026] [:error] [pid 21706:tid 21719] [client 20.216.168.122:39020] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5e0a.php"] [unique_id "adkr-SGQ1M5d8fQSsLFt9AAAAAs"]
[Sat Apr 11 00:57:29.692017 2026] [:error] [pid 21568:tid 21592] [client 20.216.168.122:61615] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "adkr-Yiz5v_ljZxkpR-hUgAAARQ"]
[Sat Apr 11 00:57:30.184312 2026] [:error] [pid 21570:tid 21694] [client 20.216.168.122:17655] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "adkr-jKs5t9xRSNL6cmiugAAAFQ"]
[Sat Apr 11 00:57:30.686300 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:61581] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "adkr-iGQ1M5d8fQSsLFt-QAAAAA"]
[Sat Apr 11 00:57:31.172525 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:44883] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bo.php"] [unique_id "adkr-yGQ1M5d8fQSsLFt_wAAAAE"]
[Sat Apr 11 00:57:31.672923 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:61572] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "adkr-zKs5t9xRSNL6cmiwgAAAFY"]
[Sat Apr 11 00:57:32.265851 2026] [:error] [pid 21570:tid 21675] [client 20.216.168.122:44902] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "adkr_DKs5t9xRSNL6cmiwwAAAEc"]
[Sat Apr 11 00:57:32.825140 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:61599] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "adkr_CGQ1M5d8fQSsLFuCAAAAAo"]
[Sat Apr 11 00:57:33.331959 2026] [:error] [pid 21568:tid 21581] [client 20.216.168.122:27663] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/56c53.php"] [unique_id "adkr_Yiz5v_ljZxkpR-hWgAAAQk"]
[Sat Apr 11 00:57:33.857951 2026] [:error] [pid 21568:tid 21595] [client 20.216.168.122:20169] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adkr_Yiz5v_ljZxkpR-hXQAAARc"]
[Sat Apr 11 00:57:34.382992 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:42440] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adkr_oiz5v_ljZxkpR-hXwAAARE"]
[Sat Apr 11 00:57:35.022441 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:20216] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adkr_yGQ1M5d8fQSsLFuGQAAAA0"]
[Sat Apr 11 00:57:35.716308 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:44878] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx78.php"] [unique_id "adkr_yGQ1M5d8fQSsLFuHgAAAA8"]
[Sat Apr 11 00:57:36.268033 2026] [:error] [pid 21570:tid 21689] [client 20.216.168.122:39043] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "adksADKs5t9xRSNL6cmizAAAAE8"]
[Sat Apr 11 00:57:36.735263 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:38986] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "adksACGQ1M5d8fQSsLFuJwAAABE"]
[Sat Apr 11 00:57:37.635846 2026] [:error] [pid 21569:tid 21664] [client 20.216.168.122:44875] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "adksAXAvQTgvXJ6vHop98QAAAJA"]
[Sat Apr 11 00:57:38.111049 2026] [:error] [pid 21569:tid 21653] [client 20.216.168.122:17648] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "adksAnAvQTgvXJ6vHop99QAAAIg"]
[Sat Apr 11 00:57:38.642316 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:39075] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adksAiGQ1M5d8fQSsLFuLwAAABc"]
[Sat Apr 11 00:57:39.126128 2026] [:error] [pid 21569:tid 21662] [client 20.216.168.122:27658] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adksA3AvQTgvXJ6vHop9-gAAAI8"]
[Sat Apr 11 00:57:39.668060 2026] [:error] [pid 21569:tid 21676] [client 20.216.168.122:44906] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adksA3AvQTgvXJ6vHop9_gAAAJU"]
[Sat Apr 11 00:57:40.141114 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:61610] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "adksBIiz5v_ljZxkpR-hawAAAQs"]
[Sat Apr 11 00:57:40.650782 2026] [:error] [pid 21568:tid 21595] [client 20.216.168.122:42476] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "adksBIiz5v_ljZxkpR-hbAAAARc"]
[Sat Apr 11 00:57:41.129948 2026] [:error] [pid 21569:tid 21671] [client 20.216.168.122:20163] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "adksBXAvQTgvXJ6vHop-AwAAAJM"]
[Sat Apr 11 00:57:41.600694 2026] [:error] [pid 21568:tid 21592] [client 20.216.168.122:39055] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "adksBYiz5v_ljZxkpR-hcAAAARQ"]
[Sat Apr 11 00:57:42.092085 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:17621] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "adksBiGQ1M5d8fQSsLFuOQAAAAo"]
[Sat Apr 11 00:57:42.569610 2026] [:error] [pid 21569:tid 21649] [client 20.216.168.122:61586] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adksBnAvQTgvXJ6vHop-CAAAAIQ"]
[Sat Apr 11 00:57:43.040647 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:17660] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adksByGQ1M5d8fQSsLFuPgAAAAw"]
[Sat Apr 11 00:57:43.526170 2026] [:error] [pid 21570:tid 21694] [client 20.216.168.122:39057] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adksBzKs5t9xRSNL6cmi3gAAAFQ"]
[Sat Apr 11 00:57:44.110174 2026] [:error] [pid 21568:tid 21590] [client 20.216.168.122:38994] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "adksCIiz5v_ljZxkpR-hfQAAARI"]
[Sat Apr 11 00:57:44.584333 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:25114] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "adksCIiz5v_ljZxkpR-hgAAAAQE"]
[Sat Apr 11 00:57:45.066636 2026] [:error] [pid 21569:tid 21646] [client 20.216.168.122:61598] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "adksCXAvQTgvXJ6vHop-CwAAAIE"]
[Sat Apr 11 00:57:45.592825 2026] [:error] [pid 21570:tid 21693] [client 20.216.168.122:44873] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "adksCTKs5t9xRSNL6cmi5QAAAFM"]
[Sat Apr 11 00:57:47.952487 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:42484] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b.php"] [unique_id "adksC4iz5v_ljZxkpR-hkgAAARE"]
[Sat Apr 11 00:57:48.424450 2026] [:error] [pid 21570:tid 21673] [client 20.216.168.122:25136] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "adksDDKs5t9xRSNL6cmi7wAAAEY"]
[Sat Apr 11 00:57:48.911092 2026] [:error] [pid 21569:tid 21680] [client 20.216.168.122:61578] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "adksDHAvQTgvXJ6vHop-EgAAAJc"]
[Sat Apr 11 00:57:49.383154 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:20197] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "adksDSGQ1M5d8fQSsLFuTAAAAA0"]
[Sat Apr 11 00:57:49.894135 2026] [:error] [pid 21568:tid 21574] [client 20.216.168.122:17636] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws49.php"] [unique_id "adksDYiz5v_ljZxkpR-hlwAAAQI"]
[Sat Apr 11 00:57:50.399209 2026] [:error] [pid 21706:tid 21727] [client 20.216.168.122:42495] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "adksDiGQ1M5d8fQSsLFuTwAAABM"]
[Sat Apr 11 00:57:52.310947 2026] [proxy_fcgi:error] [pid 21570:tid 21698] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:52.551610 2026] [proxy_fcgi:error] [pid 21570:tid 21690] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:52.788629 2026] [proxy_fcgi:error] [pid 21570:tid 21696] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:53.025505 2026] [proxy_fcgi:error] [pid 21570:tid 21695] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:53.262890 2026] [proxy_fcgi:error] [pid 21570:tid 21661] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:53.646555 2026] [proxy_fcgi:error] [pid 21570:tid 21688] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:53.945297 2026] [proxy_fcgi:error] [pid 21570:tid 21691] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:54.185536 2026] [proxy_fcgi:error] [pid 21570:tid 21672] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:54.426745 2026] [proxy_fcgi:error] [pid 21570:tid 21697] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:54.762307 2026] [proxy_fcgi:error] [pid 21570:tid 21698] [client 20.216.168.122:65041] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:57:55.300255 2026] [:error] [pid 21570:tid 21673] [client 20.216.168.122:65041] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "adksEzKs5t9xRSNL6cmjCAAAAEY"]
[Sat Apr 11 00:57:55.825130 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:39048] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "adksE3AvQTgvXJ6vHop-MgAAAI4"]
[Sat Apr 11 00:57:56.322399 2026] [:error] [pid 21570:tid 21663] [client 20.216.168.122:17619] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "adksFDKs5t9xRSNL6cmjCQAAAEE"]
[Sat Apr 11 00:57:56.817436 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:42459] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "adksFCGQ1M5d8fQSsLFuYQAAABQ"]
[Sat Apr 11 00:57:57.522143 2026] [:error] [pid 21568:tid 21590] [client 20.216.168.122:39015] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewe.php"] [unique_id "adksFYiz5v_ljZxkpR-hpgAAARI"]
[Sat Apr 11 00:57:58.114531 2026] [:error] [pid 21706:tid 21726] [client 20.216.168.122:20201] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewe.php"] [unique_id "adksFiGQ1M5d8fQSsLFuaQAAABI"]
[Sat Apr 11 00:58:00.070753 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:42477] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewe.php"] [unique_id "adksGDKs5t9xRSNL6cmjFAAAAEM"]
[Sat Apr 11 00:58:00.667098 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:39063] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewe.php"] [unique_id "adksGCGQ1M5d8fQSsLFudAAAAA8"]
[Sat Apr 11 00:58:01.150906 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:38988] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adksGXAvQTgvXJ6vHop-PAAAAI4"]
[Sat Apr 11 00:58:01.648334 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:39060] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adksGSGQ1M5d8fQSsLFuewAAAAI"]
[Sat Apr 11 00:58:02.124165 2026] [:error] [pid 21568:tid 21593] [client 20.216.168.122:40067] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adksGoiz5v_ljZxkpR-hrwAAARU"]
[Sat Apr 11 00:58:02.619614 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:61569] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "adksGoiz5v_ljZxkpR-hsQAAAQo"]
[Sat Apr 11 00:58:03.102962 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:61626] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x9.php"] [unique_id "adksGyGQ1M5d8fQSsLFuhgAAAAw"]
[Sat Apr 11 00:58:03.642650 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:44923] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x9.php"] [unique_id "adksG4iz5v_ljZxkpR-htQAAAQc"]
[Sat Apr 11 00:58:04.128025 2026] [:error] [pid 21706:tid 21732] [client 20.216.168.122:17611] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x9.php"] [unique_id "adksHCGQ1M5d8fQSsLFuiwAAABg"]
[Sat Apr 11 00:58:04.706501 2026] [:error] [pid 21568:tid 21586] [client 20.216.168.122:61594] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x9.php"] [unique_id "adksHIiz5v_ljZxkpR-hugAAAQ4"]
[Sat Apr 11 00:58:05.189599 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:17650] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "adksHSGQ1M5d8fQSsLFukwAAAAQ"]
[Sat Apr 11 00:58:05.672267 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:39014] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "adksHSGQ1M5d8fQSsLFulwAAAAM"]
[Sat Apr 11 00:58:06.146371 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:39021] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "adksHiGQ1M5d8fQSsLFumQAAAA8"]
[Sat Apr 11 00:58:06.750732 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:39069] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "adksHiGQ1M5d8fQSsLFunAAAAAo"]
[Sat Apr 11 00:58:07.233233 2026] [:error] [pid 21706:tid 21715] [client 20.216.168.122:65497] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "adksHyGQ1M5d8fQSsLFunwAAAAc"]
[Sat Apr 11 00:58:07.820250 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:61601] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "adksH3AvQTgvXJ6vHop-QwAAAIU"]
[Sat Apr 11 00:58:08.376874 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:42479] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "adksICGQ1M5d8fQSsLFupwAAABQ"]
[Sat Apr 11 00:58:08.957533 2026] [:error] [pid 21568:tid 21592] [client 20.216.168.122:65497] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "adksIIiz5v_ljZxkpR-hzgAAARQ"]
[Sat Apr 11 00:58:09.697984 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:38997] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "adksIYiz5v_ljZxkpR-h1AAAARY"]
[Sat Apr 11 00:58:10.185932 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:61625] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "adksIjKs5t9xRSNL6cmjJgAAAE0"]
[Sat Apr 11 00:58:10.687891 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:17641] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "adksIoiz5v_ljZxkpR-h3AAAAQs"]
[Sat Apr 11 00:58:11.267718 2026] [:error] [pid 21570:tid 21697] [client 20.216.168.122:20191] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdn.php"] [unique_id "adksIzKs5t9xRSNL6cmjLQAAAFc"]
[Sat Apr 11 00:58:11.803113 2026] [:error] [pid 21569:tid 21646] [client 20.216.168.122:17627] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "adksI3AvQTgvXJ6vHop-RwAAAIE"]
[Sat Apr 11 00:58:12.298858 2026] [:error] [pid 21570:tid 21673] [client 20.216.168.122:20176] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "adksJDKs5t9xRSNL6cmjMgAAAEY"]
[Sat Apr 11 00:58:12.809203 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:17652] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "adksJDKs5t9xRSNL6cmjNwAAAFY"]
[Sat Apr 11 00:58:13.285953 2026] [:error] [pid 21570:tid 21682] [client 20.216.168.122:39056] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/first.php"] [unique_id "adksJTKs5t9xRSNL6cmjPQAAAEs"]
[Sat Apr 11 00:58:13.947994 2026] [:error] [pid 21568:tid 21585] [client 20.216.168.122:17632] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "adksJYiz5v_ljZxkpR-h4gAAAQ0"]
[Sat Apr 11 00:58:14.429874 2026] [:error] [pid 21568:tid 21576] [client 20.216.168.122:27679] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "adksJoiz5v_ljZxkpR-h5AAAAQQ"]
[Sat Apr 11 00:58:15.110487 2026] [:error] [pid 21570:tid 21690] [client 20.216.168.122:27686] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "adksJzKs5t9xRSNL6cmjUwAAAFA"]
[Sat Apr 11 00:58:15.619447 2026] [:error] [pid 21568:tid 21572] [client 20.216.168.122:44895] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "adksJ4iz5v_ljZxkpR-h5wAAAQA"]
[Sat Apr 11 00:58:16.264258 2026] [:error] [pid 21569:tid 21664] [client 20.216.168.122:65496] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "adksKHAvQTgvXJ6vHop-TgAAAJA"]
[Sat Apr 11 00:58:16.738361 2026] [:error] [pid 21568:tid 21590] [client 20.216.168.122:17612] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "adksKIiz5v_ljZxkpR-h7QAAARI"]
[Sat Apr 11 00:58:17.233714 2026] [:error] [pid 21569:tid 21653] [client 20.216.168.122:17643] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "adksKXAvQTgvXJ6vHop-UQAAAIg"]
[Sat Apr 11 00:58:17.782448 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:42481] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpp2.php"] [unique_id "adksKYiz5v_ljZxkpR-h9QAAAQc"]
[Sat Apr 11 00:58:18.345662 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:38996] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "adksKjKs5t9xRSNL6cmjYQAAAFY"]
[Sat Apr 11 00:58:19.007831 2026] [:error] [pid 21706:tid 21724] [client 20.216.168.122:39040] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "adksKyGQ1M5d8fQSsLFuxQAAABA"]
[Sat Apr 11 00:58:19.515984 2026] [:error] [pid 21570:tid 21697] [client 20.216.168.122:20190] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "adksKzKs5t9xRSNL6cmjaAAAAFc"]
[Sat Apr 11 00:58:20.110442 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:39067] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admlo.php"] [unique_id "adksLHAvQTgvXJ6vHop-XQAAAJE"]
[Sat Apr 11 00:58:20.658021 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:39022] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "adksLIiz5v_ljZxkpR-h-AAAARE"]
[Sat Apr 11 00:58:21.160515 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:20215] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "adksLYiz5v_ljZxkpR-h-QAAARY"]
[Sat Apr 11 00:58:21.960523 2026] [:error] [pid 21706:tid 21716] [client 20.216.168.122:61627] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "adksLSGQ1M5d8fQSsLFu1QAAAAg"]
[Sat Apr 11 00:58:22.622967 2026] [:error] [pid 21569:tid 21680] [client 20.216.168.122:39008] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-ajax.php"] [unique_id "adksLnAvQTgvXJ6vHop-YQAAAJc"]
[Sat Apr 11 00:58:23.222388 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:20209] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "adksL3AvQTgvXJ6vHop-YgAAAIs"]
[Sat Apr 11 00:58:23.864267 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:44920] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "adksLzKs5t9xRSNL6cmjcQAAAEM"]
[Sat Apr 11 00:58:24.380803 2026] [:error] [pid 21570:tid 21693] [client 20.216.168.122:44881] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "adksMDKs5t9xRSNL6cmjdgAAAFM"]
[Sat Apr 11 00:58:24.860939 2026] [:error] [pid 21568:tid 21591] [client 20.216.168.122:38981] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amthd.php"] [unique_id "adksMIiz5v_ljZxkpR-iBQAAARM"]
[Sat Apr 11 00:58:25.389748 2026] [:error] [pid 21568:tid 21587] [client 20.216.168.122:42434] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adksMYiz5v_ljZxkpR-iCAAAAQ8"]
[Sat Apr 11 00:58:25.987739 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:42466] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adksMSGQ1M5d8fQSsLFu4AAAAA8"]
[Sat Apr 11 00:58:26.480798 2026] [:error] [pid 21569:tid 21645] [client 20.216.168.122:42437] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adksMnAvQTgvXJ6vHop-bQAAAIA"]
[Sat Apr 11 00:58:26.978164 2026] [:error] [pid 21569:tid 21649] [client 20.216.168.122:44871] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "adksMnAvQTgvXJ6vHop-cgAAAIQ"]
[Sat Apr 11 00:58:27.539441 2026] [:error] [pid 21569:tid 21669] [client 20.216.168.122:39004] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adksM3AvQTgvXJ6vHop-dQAAAJI"]
[Sat Apr 11 00:58:28.078404 2026] [:error] [pid 21568:tid 21588] [client 20.216.168.122:25149] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adksNIiz5v_ljZxkpR-iEgAAARA"]
[Sat Apr 11 00:58:28.604508 2026] [:error] [pid 21568:tid 21593] [client 20.216.168.122:25109] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adksNIiz5v_ljZxkpR-iEwAAARU"]
[Sat Apr 11 00:58:29.177268 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:65083] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adksNSGQ1M5d8fQSsLFu5wAAAAQ"]
[Sat Apr 11 00:58:29.913710 2026] [:error] [pid 21568:tid 21572] [client 20.216.168.122:65025] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "adksNYiz5v_ljZxkpR-iFQAAAQA"]
[Sat Apr 11 00:58:30.435161 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:20168] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "adksNoiz5v_ljZxkpR-iFgAAAQc"]
[Sat Apr 11 00:58:32.938697 2026] [:error] [pid 21568:tid 21590] [client 20.216.168.122:39042] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "adksOIiz5v_ljZxkpR-iGQAAARI"]
[Sat Apr 11 00:58:33.440580 2026] [:error] [pid 21570:tid 21682] [client 20.216.168.122:42447] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws68.php"] [unique_id "adksOTKs5t9xRSNL6cmjlAAAAEs"]
[Sat Apr 11 00:58:34.215180 2026] [:error] [pid 21570:tid 21675] [client 20.216.168.122:44919] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "adksOjKs5t9xRSNL6cmjmwAAAEc"]
[Sat Apr 11 00:58:34.871326 2026] [:error] [pid 21569:tid 21652] [client 20.216.168.122:17657] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "adksOnAvQTgvXJ6vHop-kwAAAIc"]
[Sat Apr 11 00:58:35.444578 2026] [:error] [pid 21569:tid 21678] [client 20.216.168.122:39009] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "adksO3AvQTgvXJ6vHop-mQAAAJY"]
[Sat Apr 11 00:58:36.165786 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:39000] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "adksPHAvQTgvXJ6vHop-mwAAAI4"]
[Sat Apr 11 00:58:36.750998 2026] [:error] [pid 21569:tid 21655] [client 20.216.168.122:17634] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/njxjtooj.php"] [unique_id "adksPHAvQTgvXJ6vHop-oAAAAIo"]
[Sat Apr 11 00:58:37.255136 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:44889] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/njxjtooj.php"] [unique_id "adksPYiz5v_ljZxkpR-iIQAAAQE"]
[Sat Apr 11 00:58:37.869375 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:39045] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/njxjtooj.php"] [unique_id "adksPTKs5t9xRSNL6cmjrQAAAEM"]
[Sat Apr 11 00:58:38.430019 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:20220] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/njxjtooj.php"] [unique_id "adksPoiz5v_ljZxkpR-iJQAAARY"]
[Sat Apr 11 00:58:38.954455 2026] [:error] [pid 21569:tid 21649] [client 20.216.168.122:39038] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adksPnAvQTgvXJ6vHop-pwAAAIQ"]
[Sat Apr 11 00:58:39.484618 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:40103] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adksP4iz5v_ljZxkpR-iJwAAARE"]
[Sat Apr 11 00:58:40.064664 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:42446] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adksQHAvQTgvXJ6vHop-qgAAAI4"]
[Sat Apr 11 00:58:40.765867 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:39005] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "adksQDKs5t9xRSNL6cmjtwAAAEM"]
[Sat Apr 11 00:58:42.781742 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:39049] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "adksQnAvQTgvXJ6vHop-rwAAAIs"]
[Sat Apr 11 00:58:44.128573 2026] [:error] [pid 21568:tid 21581] [client 20.216.168.122:17635] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "adksRIiz5v_ljZxkpR-iNwAAAQk"]
[Sat Apr 11 00:58:45.017337 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:42471] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "adksRSGQ1M5d8fQSsLFvKAAAAAM"]
[Sat Apr 11 00:58:45.667690 2026] [:error] [pid 21706:tid 21724] [client 20.216.168.122:44916] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "adksRSGQ1M5d8fQSsLFvKgAAABA"]
[Sat Apr 11 00:58:46.566592 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:17653] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iyy.php"] [unique_id "adksRiGQ1M5d8fQSsLFvNAAAAAU"]
[Sat Apr 11 00:58:47.126176 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:17658] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iyy.php"] [unique_id "adksR4iz5v_ljZxkpR-iQAAAAQs"]
[Sat Apr 11 00:58:47.663283 2026] [:error] [pid 21568:tid 21586] [client 20.216.168.122:39085] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iyy.php"] [unique_id "adksR4iz5v_ljZxkpR-iQgAAAQ4"]
[Sat Apr 11 00:58:48.157003 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:42434] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iyy.php"] [unique_id "adksSHAvQTgvXJ6vHop-ugAAAIU"]
[Sat Apr 11 00:58:48.732498 2026] [:error] [pid 21568:tid 21587] [client 20.216.168.122:39088] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/900.php"] [unique_id "adksSIiz5v_ljZxkpR-iRgAAAQ8"]
[Sat Apr 11 00:58:49.480828 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:39092] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/900.php"] [unique_id "adksSTKs5t9xRSNL6cmjyAAAAEU"]
[Sat Apr 11 00:58:49.991814 2026] [:error] [pid 21570:tid 21698] [client 20.216.168.122:42494] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/900.php"] [unique_id "adksSTKs5t9xRSNL6cmjzAAAAFg"]
[Sat Apr 11 00:58:50.576873 2026] [:error] [pid 21706:tid 21714] [client 20.216.168.122:17624] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/900.php"] [unique_id "adksSiGQ1M5d8fQSsLFvOwAAAAY"]
[Sat Apr 11 00:58:51.220880 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:42458] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blsvgeyaza.php"] [unique_id "adksSyGQ1M5d8fQSsLFvRAAAABQ"]
[Sat Apr 11 00:58:51.733528 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:44915] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blsvgeyaza.php"] [unique_id "adksS4iz5v_ljZxkpR-iSgAAAQE"]
[Sat Apr 11 00:58:52.260746 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:61613] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blsvgeyaza.php"] [unique_id "adksTCGQ1M5d8fQSsLFvSgAAAA0"]
[Sat Apr 11 00:58:52.834740 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:62935] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blsvgeyaza.php"] [unique_id "adksTCGQ1M5d8fQSsLFvUQAAAAo"]
[Sat Apr 11 00:58:53.338545 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:44867] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gqhyti.php"] [unique_id "adksTSGQ1M5d8fQSsLFvVgAAABQ"]
[Sat Apr 11 00:58:54.072586 2026] [proxy_fcgi:error] [pid 21569:tid 21655] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:54.313891 2026] [proxy_fcgi:error] [pid 21569:tid 21667] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:54.551336 2026] [proxy_fcgi:error] [pid 21569:tid 21647] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:54.788339 2026] [proxy_fcgi:error] [pid 21569:tid 21680] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:55.026558 2026] [proxy_fcgi:error] [pid 21569:tid 21659] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:55.331675 2026] [proxy_fcgi:error] [pid 21569:tid 21683] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:55.567527 2026] [proxy_fcgi:error] [pid 21569:tid 21647] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:55.810646 2026] [proxy_fcgi:error] [pid 21569:tid 21676] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:56.063046 2026] [proxy_fcgi:error] [pid 21569:tid 21669] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:56.327038 2026] [proxy_fcgi:error] [pid 21569:tid 21664] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:56.575922 2026] [proxy_fcgi:error] [pid 21569:tid 21655] [client 20.216.168.122:62914] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:58:56.828020 2026] [:error] [pid 21569:tid 21648] [client 20.216.168.122:62914] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adksUHAvQTgvXJ6vHop-8AAAAIM"]
[Sat Apr 11 00:58:57.299847 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:17605] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adksUSGQ1M5d8fQSsLFvYQAAAA8"]
[Sat Apr 11 00:58:57.846669 2026] [:error] [pid 21706:tid 21729] [client 20.216.168.122:39009] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adksUSGQ1M5d8fQSsLFvaAAAABU"]
[Sat Apr 11 00:58:58.334601 2026] [:error] [pid 21568:tid 21592] [client 20.216.168.122:20205] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "adksUoiz5v_ljZxkpR-iXwAAARQ"]
[Sat Apr 11 00:58:58.833196 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:44898] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bmi.php"] [unique_id "adksUiGQ1M5d8fQSsLFvbwAAAAQ"]
[Sat Apr 11 00:58:59.344549 2026] [:error] [pid 21568:tid 21593] [client 20.216.168.122:38991] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bmi.php"] [unique_id "adksU4iz5v_ljZxkpR-iYAAAARU"]
[Sat Apr 11 00:58:59.869538 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:20182] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bmi.php"] [unique_id "adksUzKs5t9xRSNL6cmj5QAAAE0"]
[Sat Apr 11 00:59:00.354536 2026] [:error] [pid 21570:tid 21691] [client 20.216.168.122:40114] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bmi.php"] [unique_id "adksVDKs5t9xRSNL6cmj6QAAAFE"]
[Sat Apr 11 00:59:00.850810 2026] [:error] [pid 21570:tid 21698] [client 20.216.168.122:65481] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypltspd.php"] [unique_id "adksVDKs5t9xRSNL6cmj7QAAAFg"]
[Sat Apr 11 00:59:01.319442 2026] [:error] [pid 21706:tid 21732] [client 20.216.168.122:27671] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypltspd.php"] [unique_id "adksVSGQ1M5d8fQSsLFvgAAAABg"]
[Sat Apr 11 00:59:01.800590 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:39076] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypltspd.php"] [unique_id "adksVYiz5v_ljZxkpR-iagAAAQs"]
[Sat Apr 11 00:59:02.280396 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:65037] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bypltspd.php"] [unique_id "adksViGQ1M5d8fQSsLFviAAAAAQ"]
[Sat Apr 11 00:59:02.765548 2026] [:error] [pid 21706:tid 21727] [client 20.216.168.122:25135] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "adksViGQ1M5d8fQSsLFvjwAAABM"]
[Sat Apr 11 00:59:03.260870 2026] [:error] [pid 21570:tid 21695] [client 20.216.168.122:17608] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "adksVzKs5t9xRSNL6cmj-gAAAFU"]
[Sat Apr 11 00:59:03.741124 2026] [:error] [pid 21570:tid 21690] [client 20.216.168.122:38978] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "adksVzKs5t9xRSNL6cmj_wAAAFA"]
[Sat Apr 11 00:59:04.214773 2026] [:error] [pid 21570:tid 21675] [client 20.216.168.122:39027] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "adksWDKs5t9xRSNL6cmkAgAAAEc"]
[Sat Apr 11 00:59:04.863624 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:42450] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "adksWCGQ1M5d8fQSsLFvlwAAAAQ"]
[Sat Apr 11 00:59:05.344540 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:61603] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "adksWSGQ1M5d8fQSsLFvmwAAAAk"]
[Sat Apr 11 00:59:05.812537 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:44877] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "adksWYiz5v_ljZxkpR-icwAAAQo"]
[Sat Apr 11 00:59:06.294484 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:39051] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "adksWiGQ1M5d8fQSsLFvogAAAA8"]
[Sat Apr 11 00:59:06.779921 2026] [:error] [pid 21568:tid 21588] [client 20.216.168.122:17642] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/edit.php"] [unique_id "adksWoiz5v_ljZxkpR-ieAAAARA"]
[Sat Apr 11 00:59:07.262429 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:65487] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/edit.php"] [unique_id "adksWyGQ1M5d8fQSsLFvpgAAAAM"]
[Sat Apr 11 00:59:07.741221 2026] [:error] [pid 21568:tid 21574] [client 20.216.168.122:40125] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/edit.php"] [unique_id "adksW4iz5v_ljZxkpR-igAAAAQI"]
[Sat Apr 11 00:59:08.279546 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:65520] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/edit.php"] [unique_id "adksXCGQ1M5d8fQSsLFvrgAAAAE"]
[Sat Apr 11 00:59:08.771212 2026] [:error] [pid 21706:tid 21726] [client 20.216.168.122:44886] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "adksXCGQ1M5d8fQSsLFvsAAAABI"]
[Sat Apr 11 00:59:09.374088 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:39047] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "adksXSGQ1M5d8fQSsLFvtAAAAAk"]
[Sat Apr 11 00:59:09.861589 2026] [:error] [pid 21570:tid 21691] [client 20.216.168.122:27705] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "adksXTKs5t9xRSNL6cmkFAAAAFE"]
[Sat Apr 11 00:59:10.448404 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:44896] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "adksXnAvQTgvXJ6vHop_AgAAAJE"]
[Sat Apr 11 00:59:10.916057 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:42438] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "adksXiGQ1M5d8fQSsLFvugAAABE"]
[Sat Apr 11 00:59:11.389629 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:27669] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "adksXyGQ1M5d8fQSsLFvvwAAAAA"]
[Sat Apr 11 00:59:11.875646 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:25128] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "adksXyGQ1M5d8fQSsLFvwgAAAAE"]
[Sat Apr 11 00:59:12.434037 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:25132] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "adksYIiz5v_ljZxkpR-iiwAAAQo"]
[Sat Apr 11 00:59:13.028749 2026] [:error] [pid 21568:tid 21576] [client 20.216.168.122:57771] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "adksYYiz5v_ljZxkpR-ijQAAAQQ"]
[Sat Apr 11 00:59:13.653178 2026] [:error] [pid 21568:tid 21596] [client 20.216.168.122:42489] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "adksYYiz5v_ljZxkpR-ikQAAARg"]
[Sat Apr 11 00:59:14.217504 2026] [:error] [pid 21706:tid 21716] [client 20.216.168.122:42472] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "adksYiGQ1M5d8fQSsLFv0QAAAAg"]
[Sat Apr 11 00:59:14.685111 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:20213] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "adksYoiz5v_ljZxkpR-imAAAAQo"]
[Sat Apr 11 00:59:15.174738 2026] [:error] [pid 21706:tid 21724] [client 20.216.168.122:27687] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-mancvgertdxz.php"] [unique_id "adksYyGQ1M5d8fQSsLFv2QAAABA"]
[Sat Apr 11 00:59:15.678311 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:20204] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-mancvgertdxz.php"] [unique_id "adksY4iz5v_ljZxkpR-ingAAAQs"]
[Sat Apr 11 00:59:16.168455 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:39066] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-mancvgertdxz.php"] [unique_id "adksZIiz5v_ljZxkpR-ipAAAAQo"]
[Sat Apr 11 00:59:16.656820 2026] [:error] [pid 21706:tid 21729] [client 20.216.168.122:42453] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-mancvgertdxz.php"] [unique_id "adksZCGQ1M5d8fQSsLFv3gAAABU"]
[Sat Apr 11 00:59:17.590669 2026] [:error] [pid 21569:tid 21657] [client 20.216.168.122:27675] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "adksZXAvQTgvXJ6vHop_CQAAAIw"]
[Sat Apr 11 00:59:18.103435 2026] [:error] [pid 21706:tid 21719] [client 20.216.168.122:27660] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "adksZiGQ1M5d8fQSsLFv5AAAAAs"]
[Sat Apr 11 00:59:18.574751 2026] [:error] [pid 21706:tid 21716] [client 20.216.168.122:44885] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "adksZiGQ1M5d8fQSsLFv6wAAAAg"]
[Sat Apr 11 00:59:19.047440 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:65521] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/plugins.php"] [unique_id "adksZyGQ1M5d8fQSsLFv8wAAABc"]
[Sat Apr 11 00:59:19.747786 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:39016] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws57.php"] [unique_id "adksZyGQ1M5d8fQSsLFv-gAAAAE"]
[Sat Apr 11 00:59:20.237748 2026] [:error] [pid 21568:tid 21595] [client 20.216.168.122:44901] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws57.php"] [unique_id "adksaIiz5v_ljZxkpR-iqwAAARc"]
[Sat Apr 11 00:59:20.803111 2026] [:error] [pid 21570:tid 21663] [client 20.216.168.122:27706] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws57.php"] [unique_id "adksaDKs5t9xRSNL6cmkOwAAAEE"]
[Sat Apr 11 00:59:21.289390 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:17607] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws57.php"] [unique_id "adksaSGQ1M5d8fQSsLFwCgAAAAU"]
[Sat Apr 11 00:59:21.776788 2026] [:error] [pid 21570:tid 21691] [client 20.216.168.122:65071] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "adksaTKs5t9xRSNL6cmkPwAAAFE"]
[Sat Apr 11 00:59:22.254086 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:39059] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "adksaiGQ1M5d8fQSsLFwFgAAAAE"]
[Sat Apr 11 00:59:22.883367 2026] [:error] [pid 21706:tid 21715] [client 20.216.168.122:65483] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "adksaiGQ1M5d8fQSsLFwGQAAAAc"]
[Sat Apr 11 00:59:23.387946 2026] [:error] [pid 21706:tid 21727] [client 20.216.168.122:42442] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.qiodetme.php"] [unique_id "adksayGQ1M5d8fQSsLFwHgAAABM"]
[Sat Apr 11 00:59:23.948693 2026] [:error] [pid 21570:tid 21663] [client 20.216.168.122:44904] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "adksazKs5t9xRSNL6cmkSwAAAEE"]
[Sat Apr 11 00:59:24.549016 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:39052] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "adksbIiz5v_ljZxkpR-iswAAAQo"]
[Sat Apr 11 00:59:25.047122 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:61608] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "adksbSGQ1M5d8fQSsLFwJgAAAAU"]
[Sat Apr 11 00:59:25.526830 2026] [:error] [pid 21706:tid 21718] [client 20.216.168.122:61571] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sodas.php"] [unique_id "adksbSGQ1M5d8fQSsLFwKgAAAAo"]
[Sat Apr 11 00:59:26.125981 2026] [:error] [pid 21570:tid 21689] [client 20.216.168.122:61588] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "adksbjKs5t9xRSNL6cmkUwAAAE8"]
[Sat Apr 11 00:59:26.601848 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:44869] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "adksboiz5v_ljZxkpR-iuAAAAQc"]
[Sat Apr 11 00:59:27.114131 2026] [:error] [pid 21569:tid 21659] [client 20.216.168.122:39026] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "adksb3AvQTgvXJ6vHop_GQAAAI0"]
[Sat Apr 11 00:59:27.610404 2026] [:error] [pid 21569:tid 21648] [client 20.216.168.122:42460] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yw5bi63u.php"] [unique_id "adksb3AvQTgvXJ6vHop_GwAAAIM"]
[Sat Apr 11 00:59:28.091545 2026] [:error] [pid 21569:tid 21647] [client 20.216.168.122:55042] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "adkscHAvQTgvXJ6vHop_IQAAAII"]
[Sat Apr 11 00:59:28.606936 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:25107] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "adkscCGQ1M5d8fQSsLFwOAAAAAE"]
[Sat Apr 11 00:59:29.075751 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:39013] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "adkscSGQ1M5d8fQSsLFwPgAAAAk"]
[Sat Apr 11 00:59:29.583761 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:20194] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "adkscSGQ1M5d8fQSsLFwRAAAABc"]
[Sat Apr 11 00:59:30.261342 2026] [:error] [pid 21570:tid 21692] [client 20.216.168.122:25095] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "adkscjKs5t9xRSNL6cmkYAAAAFI"]
[Sat Apr 11 00:59:30.740126 2026] [:error] [pid 21569:tid 21680] [client 20.216.168.122:38982] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "adkscnAvQTgvXJ6vHop_KAAAAJc"]
[Sat Apr 11 00:59:31.273985 2026] [:error] [pid 21569:tid 21678] [client 20.216.168.122:44927] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "adksc3AvQTgvXJ6vHop_LQAAAJY"]
[Sat Apr 11 00:59:31.751736 2026] [:error] [pid 21569:tid 21647] [client 20.216.168.122:17609] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "adksc3AvQTgvXJ6vHop_MgAAAII"]
[Sat Apr 11 00:59:32.353144 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:65518] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adksdIiz5v_ljZxkpR-iwwAAAQc"]
[Sat Apr 11 00:59:32.835652 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:20193] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adksdHAvQTgvXJ6vHop_NgAAAIs"]
[Sat Apr 11 00:59:33.304145 2026] [:error] [pid 21570:tid 21690] [client 20.216.168.122:65067] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adksdTKs5t9xRSNL6cmkZQAAAFA"]
[Sat Apr 11 00:59:33.796664 2026] [:error] [pid 21569:tid 21651] [client 20.216.168.122:65061] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adksdXAvQTgvXJ6vHop_NwAAAIY"]
[Sat Apr 11 00:59:34.277642 2026] [:error] [pid 21569:tid 21676] [client 20.216.168.122:39041] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adksdnAvQTgvXJ6vHop_OAAAAJU"]
[Sat Apr 11 00:59:34.749691 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:17606] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adksdjKs5t9xRSNL6cmkbAAAAFY"]
[Sat Apr 11 00:59:35.220279 2026] [:error] [pid 21568:tid 21591] [client 20.216.168.122:20200] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adksd4iz5v_ljZxkpR-izwAAARM"]
[Sat Apr 11 00:59:35.696325 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:39071] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "adksdyGQ1M5d8fQSsLFwUwAAAAA"]
[Sat Apr 11 00:59:36.473687 2026] [:error] [pid 21570:tid 21685] [client 20.216.168.122:17651] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "adkseDKs5t9xRSNL6cmkbwAAAEw"]
[Sat Apr 11 00:59:36.946064 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:65052] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "adkseHAvQTgvXJ6vHop_PwAAAIs"]
[Sat Apr 11 00:59:37.470171 2026] [:error] [pid 21568:tid 21587] [client 20.216.168.122:39053] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "adkseYiz5v_ljZxkpR-i0AAAAQ8"]
[Sat Apr 11 00:59:37.944655 2026] [:error] [pid 21568:tid 21593] [client 20.216.168.122:42462] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "adkseYiz5v_ljZxkpR-i0wAAARU"]
[Sat Apr 11 00:59:38.414546 2026] [:error] [pid 21569:tid 21662] [client 20.216.168.122:20167] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adksenAvQTgvXJ6vHop_RAAAAI8"]
[Sat Apr 11 00:59:38.893120 2026] [:error] [pid 21706:tid 21732] [client 20.216.168.122:25111] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adkseiGQ1M5d8fQSsLFwYgAAABg"]
[Sat Apr 11 00:59:39.401118 2026] [:error] [pid 21570:tid 21693] [client 20.216.168.122:39087] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adksezKs5t9xRSNL6cmkeQAAAFM"]
[Sat Apr 11 00:59:39.879731 2026] [:error] [pid 21570:tid 21682] [client 20.216.168.122:61629] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dass.php"] [unique_id "adksezKs5t9xRSNL6cmkfAAAAEs"]
[Sat Apr 11 00:59:40.356644 2026] [:error] [pid 21570:tid 21685] [client 20.216.168.122:27649] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "adksfDKs5t9xRSNL6cmkfgAAAEw"]
[Sat Apr 11 00:59:40.829689 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:39080] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "adksfCGQ1M5d8fQSsLFwaAAAAA0"]
[Sat Apr 11 00:59:41.372184 2026] [:error] [pid 21570:tid 21681] [client 20.216.168.122:38976] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "adksfTKs5t9xRSNL6cmkhQAAAEo"]
[Sat Apr 11 00:59:41.898163 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:27676] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s.php"] [unique_id "adksfTKs5t9xRSNL6cmkiQAAAFY"]
[Sat Apr 11 00:59:42.369767 2026] [:error] [pid 21568:tid 21574] [client 20.216.168.122:57748] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adksfoiz5v_ljZxkpR-i2gAAAQI"]
[Sat Apr 11 00:59:42.847284 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:42468] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adksfjKs5t9xRSNL6cmkkAAAAEA"]
[Sat Apr 11 00:59:43.336742 2026] [:error] [pid 21570:tid 21688] [client 20.216.168.122:44888] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adksfzKs5t9xRSNL6cmkkQAAAE4"]
[Sat Apr 11 00:59:43.837502 2026] [:error] [pid 21570:tid 21668] [client 20.216.168.122:20217] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adksfzKs5t9xRSNL6cmklAAAAEM"]
[Sat Apr 11 00:59:44.329045 2026] [:error] [pid 21706:tid 21715] [client 20.216.168.122:65475] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "adksgCGQ1M5d8fQSsLFwbgAAAAc"]
[Sat Apr 11 00:59:44.838827 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:20211] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "adksgDKs5t9xRSNL6cmklwAAAFY"]
[Sat Apr 11 00:59:45.332884 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:27684] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "adksgSGQ1M5d8fQSsLFwdQAAABE"]
[Sat Apr 11 00:59:45.815309 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:39086] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "adksgSGQ1M5d8fQSsLFwdgAAAAA"]
[Sat Apr 11 00:59:46.308717 2026] [:error] [pid 21569:tid 21645] [client 20.216.168.122:25127] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "adksgnAvQTgvXJ6vHop_UAAAAIA"]
[Sat Apr 11 00:59:46.784809 2026] [:error] [pid 21570:tid 21690] [client 20.216.168.122:17613] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "adksgjKs5t9xRSNL6cmknQAAAFA"]
[Sat Apr 11 00:59:47.253152 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:39096] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "adksgzKs5t9xRSNL6cmkoQAAAE0"]
[Sat Apr 11 00:59:47.805429 2026] [:error] [pid 21568:tid 21585] [client 20.216.168.122:27680] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws75.php"] [unique_id "adksg4iz5v_ljZxkpR-i6gAAAQ0"]
[Sat Apr 11 00:59:48.280332 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:61614] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adkshIiz5v_ljZxkpR-i6wAAAQo"]
[Sat Apr 11 00:59:48.969883 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:39008] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adkshCGQ1M5d8fQSsLFwegAAAAQ"]
[Sat Apr 11 00:59:49.460821 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:27665] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adkshSGQ1M5d8fQSsLFwfQAAAAw"]
[Sat Apr 11 00:59:49.952979 2026] [:error] [pid 21706:tid 21732] [client 20.216.168.122:65477] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adkshSGQ1M5d8fQSsLFwgwAAABg"]
[Sat Apr 11 00:59:50.587040 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:61622] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "adkshnAvQTgvXJ6vHop_WwAAAJE"]
[Sat Apr 11 00:59:51.063814 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:65056] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "adkshzKs5t9xRSNL6cmkswAAAEU"]
[Sat Apr 11 00:59:51.556360 2026] [:error] [pid 21570:tid 21677] [client 20.216.168.122:65031] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "adkshzKs5t9xRSNL6cmkugAAAEg"]
[Sat Apr 11 00:59:52.043880 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:42461] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "adksiCGQ1M5d8fQSsLFwhwAAABQ"]
[Sat Apr 11 00:59:52.642952 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:39083] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adksiCGQ1M5d8fQSsLFwigAAABE"]
[Sat Apr 11 00:59:53.197114 2026] [:error] [pid 21570:tid 21677] [client 20.216.168.122:40086] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adksiTKs5t9xRSNL6cmkxQAAAEg"]
[Sat Apr 11 00:59:53.689318 2026] [:error] [pid 21570:tid 21695] [client 20.216.168.122:40111] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adksiTKs5t9xRSNL6cmkxwAAAFU"]
[Sat Apr 11 00:59:54.391571 2026] [:error] [pid 21569:tid 21669] [client 20.216.168.122:61596] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adksinAvQTgvXJ6vHop_ZAAAAJI"]
[Sat Apr 11 00:59:54.873577 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:25138] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adksinAvQTgvXJ6vHop_ZwAAAIU"]
[Sat Apr 11 00:59:55.448540 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:65039] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adksiyGQ1M5d8fQSsLFwlwAAAAA"]
[Sat Apr 11 00:59:55.944074 2026] [:error] [pid 21570:tid 21670] [client 20.216.168.122:65479] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "adksizKs5t9xRSNL6cmkzQAAAEQ"]
[Sat Apr 11 00:59:56.437365 2026] [proxy_fcgi:error] [pid 21568:tid 21575] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:56.688415 2026] [proxy_fcgi:error] [pid 21568:tid 21590] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:57.263696 2026] [proxy_fcgi:error] [pid 21568:tid 21581] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:57.502625 2026] [proxy_fcgi:error] [pid 21568:tid 21574] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:57.738693 2026] [proxy_fcgi:error] [pid 21568:tid 21580] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:58.064742 2026] [proxy_fcgi:error] [pid 21568:tid 21591] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:58.561321 2026] [proxy_fcgi:error] [pid 21568:tid 21595] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:59.058271 2026] [proxy_fcgi:error] [pid 21568:tid 21587] [client 20.216.168.122:39010] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 00:59:59.299746 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:39010] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adksj4iz5v_ljZxkpR-jAgAAARE"]
[Sat Apr 11 00:59:59.819309 2026] [:error] [pid 21570:tid 21697] [client 20.216.168.122:61592] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adksjzKs5t9xRSNL6cmk3gAAAFc"]
[Sat Apr 11 01:00:00.392576 2026] [:error] [pid 21706:tid 21727] [client 20.216.168.122:39001] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adkskCGQ1M5d8fQSsLFwpAAAABM"]
[Sat Apr 11 01:00:00.926476 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:39084] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "adkskCGQ1M5d8fQSsLFwpwAAAAk"]
[Sat Apr 11 01:00:01.397642 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:61602] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adkskSGQ1M5d8fQSsLFwrAAAABE"]
[Sat Apr 11 01:00:01.907458 2026] [:error] [pid 21570:tid 21691] [client 20.216.168.122:42467] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adkskTKs5t9xRSNL6cmk5wAAAFE"]
[Sat Apr 11 01:00:02.440579 2026] [:error] [pid 21570:tid 21693] [client 20.216.168.122:65027] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adkskjKs5t9xRSNL6cmk6gAAAFM"]
[Sat Apr 11 01:00:02.916517 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:65079] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adkskiGQ1M5d8fQSsLFwtwAAABQ"]
[Sat Apr 11 01:00:03.430856 2026] [:error] [pid 21570:tid 21665] [client 20.216.168.122:42470] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "adkskzKs5t9xRSNL6cmk8AAAAEI"]
[Sat Apr 11 01:00:03.968165 2026] [:error] [pid 21570:tid 21697] [client 20.216.168.122:62923] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "adkskzKs5t9xRSNL6cmk8gAAAFc"]
[Sat Apr 11 01:00:04.642871 2026] [:error] [pid 21570:tid 21675] [client 20.216.168.122:62913] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "adkslDKs5t9xRSNL6cmk-gAAAEc"]
[Sat Apr 11 01:00:05.126823 2026] [:error] [pid 21570:tid 21681] [client 20.216.168.122:44893] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amp.php"] [unique_id "adkslTKs5t9xRSNL6cmlAAAAAEo"]
[Sat Apr 11 01:00:05.608559 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:25121] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "adkslSGQ1M5d8fQSsLFwwgAAAAA"]
[Sat Apr 11 01:00:06.113520 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:20206] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "adksliGQ1M5d8fQSsLFwwwAAABQ"]
[Sat Apr 11 01:00:06.589060 2026] [:error] [pid 21570:tid 21663] [client 20.216.168.122:44913] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "adksljKs5t9xRSNL6cmlBAAAAEE"]
[Sat Apr 11 01:00:07.077955 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:65493] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "adkslyGQ1M5d8fQSsLFwzQAAAAA"]
[Sat Apr 11 01:00:07.563061 2026] [:error] [pid 21706:tid 21722] [client 20.216.168.122:42436] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "adkslyGQ1M5d8fQSsLFw0QAAAA4"]
[Sat Apr 11 01:00:08.045102 2026] [:error] [pid 21706:tid 21729] [client 20.216.168.122:57743] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "adksmCGQ1M5d8fQSsLFw0gAAABU"]
[Sat Apr 11 01:00:08.551907 2026] [:error] [pid 21568:tid 21572] [client 20.216.168.122:61591] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "adksmIiz5v_ljZxkpR-jGAAAAQA"]
[Sat Apr 11 01:00:09.271796 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:65067] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/init.php"] [unique_id "adksmTKs5t9xRSNL6cmlDAAAAEU"]
[Sat Apr 11 01:00:09.742173 2026] [:error] [pid 21570:tid 21698] [client 20.216.168.122:65523] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adksmTKs5t9xRSNL6cmlDQAAAFg"]
[Sat Apr 11 01:00:10.221262 2026] [:error] [pid 21570:tid 21665] [client 20.216.168.122:17631] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adksmjKs5t9xRSNL6cmlDwAAAEI"]
[Sat Apr 11 01:00:10.790043 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:42480] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adksmjKs5t9xRSNL6cmlEgAAAEA"]
[Sat Apr 11 01:00:11.344307 2026] [:error] [pid 21569:tid 21653] [client 20.216.168.122:57519] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adksm3AvQTgvXJ6vHop_fgAAAIg"]
[Sat Apr 11 01:00:11.831080 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:25144] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "adksmzKs5t9xRSNL6cmlGQAAAEU"]
[Sat Apr 11 01:00:12.465596 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:17610] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "adksnCGQ1M5d8fQSsLFw7AAAABE"]
[Sat Apr 11 01:00:13.044504 2026] [:error] [pid 21706:tid 21726] [client 20.216.168.122:38983] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "adksnSGQ1M5d8fQSsLFw7wAAABI"]
[Sat Apr 11 01:00:13.520943 2026] [:error] [pid 21568:tid 21576] [client 20.216.168.122:44897] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "adksnYiz5v_ljZxkpR-jKQAAAQQ"]
[Sat Apr 11 01:00:13.990953 2026] [:error] [pid 21568:tid 21596] [client 20.216.168.122:17620] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adksnYiz5v_ljZxkpR-jLgAAARg"]
[Sat Apr 11 01:00:14.572563 2026] [:error] [pid 21569:tid 21657] [client 20.216.168.122:25123] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adksnnAvQTgvXJ6vHop_gwAAAIw"]
[Sat Apr 11 01:00:15.061312 2026] [:error] [pid 21569:tid 21651] [client 20.216.168.122:42465] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adksn3AvQTgvXJ6vHop_hgAAAIY"]
[Sat Apr 11 01:00:15.540508 2026] [:error] [pid 21706:tid 21712] [client 20.216.168.122:61589] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adksnyGQ1M5d8fQSsLFw-QAAAAQ"]
[Sat Apr 11 01:00:16.101754 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:17645] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adksoIiz5v_ljZxkpR-jOgAAARY"]
[Sat Apr 11 01:00:16.663073 2026] [:error] [pid 21706:tid 21715] [client 20.216.168.122:62922] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adksoCGQ1M5d8fQSsLFw_AAAAAc"]
[Sat Apr 11 01:00:17.157878 2026] [:error] [pid 21569:tid 21654] [client 20.216.168.122:38985] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adksoXAvQTgvXJ6vHop_jAAAAIk"]
[Sat Apr 11 01:00:17.674317 2026] [:error] [pid 21569:tid 21680] [client 20.216.168.122:62965] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "adksoXAvQTgvXJ6vHop_jQAAAJc"]
[Sat Apr 11 01:00:18.485688 2026] [:error] [pid 21568:tid 21575] [client 20.216.168.122:39079] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "adksooiz5v_ljZxkpR-jQQAAAQM"]
[Sat Apr 11 01:00:18.972773 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:42444] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "adksooiz5v_ljZxkpR-jRgAAARY"]
[Sat Apr 11 01:00:19.704145 2026] [:error] [pid 21569:tid 21647] [client 20.216.168.122:39011] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "adkso3AvQTgvXJ6vHop_lgAAAII"]
[Sat Apr 11 01:00:20.386989 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:44892] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxw.php"] [unique_id "adkspCGQ1M5d8fQSsLFxDgAAABE"]
[Sat Apr 11 01:00:21.018354 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:57742] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adkspSGQ1M5d8fQSsLFxEQAAAAw"]
[Sat Apr 11 01:00:21.570089 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:62926] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adkspSGQ1M5d8fQSsLFxGwAAAAM"]
[Sat Apr 11 01:00:22.256257 2026] [:error] [pid 21570:tid 21691] [client 20.216.168.122:61590] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adkspjKs5t9xRSNL6cmlLAAAAFE"]
[Sat Apr 11 01:00:22.939712 2026] [:error] [pid 21570:tid 21673] [client 20.216.168.122:40091] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "adkspjKs5t9xRSNL6cmlMQAAAEY"]
[Sat Apr 11 01:00:23.599606 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:65503] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adksp3AvQTgvXJ6vHop_mwAAAJE"]
[Sat Apr 11 01:00:24.192954 2026] [:error] [pid 21568:tid 21596] [client 20.216.168.122:39028] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adksqIiz5v_ljZxkpR-jUQAAARg"]
[Sat Apr 11 01:00:24.799444 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:17656] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adksqCGQ1M5d8fQSsLFxLQAAAAI"]
[Sat Apr 11 01:00:25.488368 2026] [:error] [pid 21569:tid 21659] [client 20.216.168.122:61611] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adksqXAvQTgvXJ6vHop_ogAAAI0"]
[Sat Apr 11 01:00:26.012844 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:44872] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adksqoiz5v_ljZxkpR-jWgAAAQs"]
[Sat Apr 11 01:00:26.751869 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:61621] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adksqiGQ1M5d8fQSsLFxOQAAABc"]
[Sat Apr 11 01:00:27.276639 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:39099] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adksq4iz5v_ljZxkpR-jXgAAARY"]
[Sat Apr 11 01:00:27.835482 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:20178] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adksqyGQ1M5d8fQSsLFxRgAAAAI"]
[Sat Apr 11 01:00:28.687777 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:17661] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adksrCGQ1M5d8fQSsLFxTQAAAAE"]
[Sat Apr 11 01:00:29.271687 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:38999] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adksrXAvQTgvXJ6vHop_qQAAAJE"]
[Sat Apr 11 01:00:29.845552 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:39046] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adksrSGQ1M5d8fQSsLFxWQAAAAM"]
[Sat Apr 11 01:00:30.388358 2026] [:error] [pid 21706:tid 21723] [client 20.216.168.122:44908] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "adksriGQ1M5d8fQSsLFxXQAAAA8"]
[Sat Apr 11 01:00:30.926789 2026] [:error] [pid 21569:tid 21656] [client 20.216.168.122:38998] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adksrnAvQTgvXJ6vHop_qgAAAIs"]
[Sat Apr 11 01:00:31.939193 2026] [:error] [pid 21568:tid 21586] [client 20.216.168.122:27673] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adksr4iz5v_ljZxkpR-jZgAAAQ4"]
[Sat Apr 11 01:00:35.045939 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:25113] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adkssyGQ1M5d8fQSsLFxeQAAAA0"]
[Sat Apr 11 01:00:35.884432 2026] [:error] [pid 21568:tid 21580] [client 20.216.168.122:62929] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adkss4iz5v_ljZxkpR-jdgAAAQg"]
[Sat Apr 11 01:00:36.499675 2026] [:error] [pid 21569:tid 21654] [client 20.216.168.122:20198] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adkstHAvQTgvXJ6vHop_rgAAAIk"]
[Sat Apr 11 01:00:36.999730 2026] [:error] [pid 21568:tid 21575] [client 20.216.168.122:42478] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adkstIiz5v_ljZxkpR-jfgAAAQM"]
[Sat Apr 11 01:00:37.520781 2026] [:error] [pid 21570:tid 21696] [client 20.216.168.122:42456] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adkstTKs5t9xRSNL6cmlTAAAAFY"]
[Sat Apr 11 01:00:37.995589 2026] [:error] [pid 21569:tid 21667] [client 20.216.168.122:38992] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adkstXAvQTgvXJ6vHop_swAAAJE"]
[Sat Apr 11 01:00:38.572555 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:44891] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adkstiGQ1M5d8fQSsLFxkgAAAAA"]
[Sat Apr 11 01:00:39.057068 2026] [:error] [pid 21569:tid 21662] [client 20.216.168.122:27648] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adkst3AvQTgvXJ6vHop_tgAAAI8"]
[Sat Apr 11 01:00:39.561825 2026] [:error] [pid 21568:tid 21586] [client 20.216.168.122:40069] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adkst4iz5v_ljZxkpR-jiAAAAQ4"]
[Sat Apr 11 01:00:40.181091 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:57752] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adksuHAvQTgvXJ6vHop_vAAAAIU"]
[Sat Apr 11 01:00:40.841040 2026] [:error] [pid 21570:tid 21677] [client 20.216.168.122:44894] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "adksuDKs5t9xRSNL6cmlWQAAAEg"]
[Sat Apr 11 01:00:41.509247 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:62958] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "adksuTKs5t9xRSNL6cmlXQAAAEU"]
[Sat Apr 11 01:00:42.525335 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:39065] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "adksuoiz5v_ljZxkpR-jjgAAARY"]
[Sat Apr 11 01:00:43.118813 2026] [:error] [pid 21570:tid 21693] [client 20.216.168.122:17614] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ajax.php"] [unique_id "adksuzKs5t9xRSNL6cmlYgAAAFM"]
[Sat Apr 11 01:00:43.760219 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:39037] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adksu4iz5v_ljZxkpR-jmAAAARE"]
[Sat Apr 11 01:00:44.256662 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:57496] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adksvCGQ1M5d8fQSsLFxrQAAABQ"]
[Sat Apr 11 01:00:44.777190 2026] [:error] [pid 21706:tid 21730] [client 20.216.168.122:65476] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adksvCGQ1M5d8fQSsLFxswAAABY"]
[Sat Apr 11 01:00:45.310799 2026] [:error] [pid 21706:tid 21717] [client 20.216.168.122:42441] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "adksvSGQ1M5d8fQSsLFxuQAAAAk"]
[Sat Apr 11 01:00:45.962655 2026] [:error] [pid 21706:tid 21726] [client 20.216.168.122:65508] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "adksvSGQ1M5d8fQSsLFxwQAAABI"]
[Sat Apr 11 01:00:46.486127 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:62918] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "adksviGQ1M5d8fQSsLFxxQAAAAM"]
[Sat Apr 11 01:00:47.220426 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:42451] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "adksvyGQ1M5d8fQSsLFxzgAAABQ"]
[Sat Apr 11 01:00:47.934710 2026] [:error] [pid 21570:tid 21698] [client 20.216.168.122:65488] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/wp-blog.php"] [unique_id "adksvzKs5t9xRSNL6cmlbQAAAFg"]
[Sat Apr 11 01:00:48.563793 2026] [:error] [pid 21706:tid 21729] [client 20.216.168.122:39091] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adkswCGQ1M5d8fQSsLFx2AAAABU"]
[Sat Apr 11 01:00:49.177222 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:25093] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adkswSGQ1M5d8fQSsLFx2gAAABE"]
[Sat Apr 11 01:00:49.879466 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:65510] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adkswSGQ1M5d8fQSsLFx4AAAAAI"]
[Sat Apr 11 01:00:50.421462 2026] [:error] [pid 21569:tid 21645] [client 20.216.168.122:17630] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "adkswnAvQTgvXJ6vHop_6AAAAIA"]
[Sat Apr 11 01:00:50.984324 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:25094] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "adkswiGQ1M5d8fQSsLFx6AAAAAw"]
[Sat Apr 11 01:00:51.515092 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:17603] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "adkswyGQ1M5d8fQSsLFx7QAAABQ"]
[Sat Apr 11 01:00:52.227914 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:25105] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "adksxCGQ1M5d8fQSsLFx8wAAAAM"]
[Sat Apr 11 01:00:52.755801 2026] [:error] [pid 21570:tid 21681] [client 20.216.168.122:62921] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tool.php"] [unique_id "adksxDKs5t9xRSNL6cmlhwAAAEo"]
[Sat Apr 11 01:00:53.270184 2026] [:error] [pid 21568:tid 21579] [client 20.216.168.122:39006] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "adksxYiz5v_ljZxkpR-jtwAAAQc"]
[Sat Apr 11 01:00:53.746815 2026] [:error] [pid 21570:tid 21695] [client 20.216.168.122:65477] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "adksxTKs5t9xRSNL6cmlmAAAAFU"]
[Sat Apr 11 01:00:54.234449 2026] [:error] [pid 21706:tid 21725] [client 20.216.168.122:27694] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "adksxiGQ1M5d8fQSsLFyAwAAABE"]
[Sat Apr 11 01:00:54.703958 2026] [:error] [pid 21569:tid 21651] [client 20.216.168.122:44922] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "adksxnAvQTgvXJ6vHoqAAwAAAIY"]
[Sat Apr 11 01:00:55.182610 2026] [:error] [pid 21706:tid 21721] [client 20.216.168.122:20212] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/index.php"] [unique_id "adksxyGQ1M5d8fQSsLFyDAAAAA0"]
[Sat Apr 11 01:00:55.739883 2026] [:error] [pid 21570:tid 21670] [client 20.216.168.122:44910] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/index.php"] [unique_id "adksxzKs5t9xRSNL6cmltwAAAEQ"]
[Sat Apr 11 01:00:56.265928 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:25141] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/index.php"] [unique_id "adksyCGQ1M5d8fQSsLFyEwAAAAM"]
[Sat Apr 11 01:00:56.739601 2026] [:error] [pid 21568:tid 21583] [client 20.216.168.122:44880] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/index.php"] [unique_id "adksyIiz5v_ljZxkpR-jygAAAQs"]
[Sat Apr 11 01:00:57.217137 2026] [:error] [pid 21568:tid 21595] [client 20.216.168.122:40081] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adksyYiz5v_ljZxkpR-jzwAAARc"]
[Sat Apr 11 01:00:57.694359 2026] [:error] [pid 21570:tid 21695] [client 20.216.168.122:25148] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "adksyTKs5t9xRSNL6cmlygAAAFU"]
[Sat Apr 11 01:01:00.177458 2026] [proxy_fcgi:error] [pid 21569:tid 21652] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:00.415515 2026] [proxy_fcgi:error] [pid 21569:tid 21660] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:00.651492 2026] [proxy_fcgi:error] [pid 21569:tid 21649] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:00.894847 2026] [proxy_fcgi:error] [pid 21569:tid 21669] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:01.131412 2026] [proxy_fcgi:error] [pid 21569:tid 21683] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:01.373076 2026] [proxy_fcgi:error] [pid 21569:tid 21646] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:01.611299 2026] [proxy_fcgi:error] [pid 21569:tid 21655] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:01.948528 2026] [proxy_fcgi:error] [pid 21569:tid 21653] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:02.182784 2026] [proxy_fcgi:error] [pid 21569:tid 21680] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:02.657679 2026] [proxy_fcgi:error] [pid 21569:tid 21656] [client 20.216.168.122:44908] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 01:01:02.890447 2026] [:error] [pid 21569:tid 21660] [client 20.216.168.122:44908] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adksznAvQTgvXJ6vHoqALAAAAI4"]
[Sat Apr 11 01:01:03.792296 2026] [:error] [pid 21570:tid 21682] [client 20.216.168.122:57734] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adkszzKs5t9xRSNL6cml_gAAAEs"]
[Sat Apr 11 01:01:04.414121 2026] [:error] [pid 21706:tid 21731] [client 20.216.168.122:27702] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adks0CGQ1M5d8fQSsLFyWwAAABc"]
[Sat Apr 11 01:01:04.986193 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:44905] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "adks0DKs5t9xRSNL6cmmBAAAAE0"]
[Sat Apr 11 01:01:05.464555 2026] [:error] [pid 21569:tid 21678] [client 20.216.168.122:39018] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adks0XAvQTgvXJ6vHoqANAAAAJY"]
[Sat Apr 11 01:01:05.958518 2026] [:error] [pid 21569:tid 21655] [client 20.216.168.122:42454] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adks0XAvQTgvXJ6vHoqANwAAAIo"]
[Sat Apr 11 01:01:06.450515 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:27668] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adks0jKs5t9xRSNL6cmmCgAAAEA"]
[Sat Apr 11 01:01:06.947958 2026] [:error] [pid 21570:tid 21688] [client 20.216.168.122:65500] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adks0jKs5t9xRSNL6cmmDgAAAE4"]
[Sat Apr 11 01:01:12.943729 2026] [:error] [pid 21568:tid 21581] [client 20.216.168.122:57761] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "adks2Iiz5v_ljZxkpR-kVAAAAQk"]
[Sat Apr 11 01:01:13.516447 2026] [:error] [pid 21568:tid 21593] [client 20.216.168.122:44914] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "adks2Yiz5v_ljZxkpR-kWQAAARU"]
[Sat Apr 11 01:01:13.983939 2026] [:error] [pid 21706:tid 21709] [client 20.216.168.122:25100] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "adks2SGQ1M5d8fQSsLFysAAAAAE"]
[Sat Apr 11 01:01:14.480385 2026] [:error] [pid 21569:tid 21650] [client 20.216.168.122:42492] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "adks2nAvQTgvXJ6vHoqAXgAAAIU"]
[Sat Apr 11 01:01:14.970577 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:27659] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "adks2jKs5t9xRSNL6cmmJwAAAE0"]
[Sat Apr 11 01:01:15.770775 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:42490] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "adks2yGQ1M5d8fQSsLFyvwAAAAw"]
[Sat Apr 11 01:01:16.259253 2026] [:error] [pid 21706:tid 21722] [client 20.216.168.122:44907] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "adks3CGQ1M5d8fQSsLFyxAAAAA4"]
[Sat Apr 11 01:01:16.760315 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:39054] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hots.php"] [unique_id "adks3CGQ1M5d8fQSsLFyyQAAAAM"]
[Sat Apr 11 01:01:17.299539 2026] [:error] [pid 21568:tid 21580] [client 20.216.168.122:38984] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "adks3Yiz5v_ljZxkpR-kYwAAAQg"]
[Sat Apr 11 01:01:17.928286 2026] [:error] [pid 21706:tid 21713] [client 20.216.168.122:27699] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "adks3SGQ1M5d8fQSsLFy1wAAAAU"]
[Sat Apr 11 01:01:18.400218 2026] [:error] [pid 21568:tid 21584] [client 20.216.168.122:65055] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "adks3oiz5v_ljZxkpR-kaAAAAQw"]
[Sat Apr 11 01:01:18.891018 2026] [:error] [pid 21568:tid 21581] [client 20.216.168.122:42491] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin-footer.php"] [unique_id "adks3oiz5v_ljZxkpR-kawAAAQk"]
[Sat Apr 11 01:01:19.368964 2026] [:error] [pid 21706:tid 21708] [client 20.216.168.122:40112] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "adks3yGQ1M5d8fQSsLFy3gAAAAA"]
[Sat Apr 11 01:01:19.848527 2026] [:error] [pid 21706:tid 21710] [client 20.216.168.122:61576] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "adks3yGQ1M5d8fQSsLFy5QAAAAI"]
[Sat Apr 11 01:01:20.370584 2026] [:error] [pid 21706:tid 21730] [client 20.216.168.122:62967] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "adks4CGQ1M5d8fQSsLFy7AAAABY"]
[Sat Apr 11 01:01:20.904212 2026] [:error] [pid 21570:tid 21665] [client 20.216.168.122:42457] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "adks4DKs5t9xRSNL6cmmLAAAAEI"]
[Sat Apr 11 01:01:21.458100 2026] [:error] [pid 21569:tid 21671] [client 20.216.168.122:42432] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adks4XAvQTgvXJ6vHoqAdAAAAJM"]
[Sat Apr 11 01:01:21.934423 2026] [:error] [pid 21706:tid 21711] [client 20.216.168.122:62941] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adks4SGQ1M5d8fQSsLFy-QAAAAM"]
[Sat Apr 11 01:01:22.453898 2026] [:error] [pid 21570:tid 21685] [client 20.216.168.122:39019] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adks4jKs5t9xRSNL6cmmNgAAAEw"]
[Sat Apr 11 01:01:22.953170 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:25104] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bnm.php"] [unique_id "adks4jKs5t9xRSNL6cmmOgAAAEU"]
[Sat Apr 11 01:01:23.448442 2026] [:error] [pid 21568:tid 21584] [client 20.216.168.122:65029] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adks44iz5v_ljZxkpR-kgQAAAQw"]
[Sat Apr 11 01:01:23.943608 2026] [:error] [pid 21568:tid 21572] [client 20.216.168.122:17600] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adks44iz5v_ljZxkpR-khwAAAQA"]
[Sat Apr 11 01:01:24.425363 2026] [:error] [pid 21706:tid 21727] [client 20.216.168.122:39017] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adks5CGQ1M5d8fQSsLFzBgAAABM"]
[Sat Apr 11 01:01:24.892042 2026] [:error] [pid 21570:tid 21661] [client 20.216.168.122:42449] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "adks5DKs5t9xRSNL6cmmQQAAAEA"]
[Sat Apr 11 01:01:26.735087 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:39024] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adks5jKs5t9xRSNL6cmmTAAAAEU"]
[Sat Apr 11 01:01:27.244377 2026] [:error] [pid 21570:tid 21687] [client 20.216.168.122:20221] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adks5zKs5t9xRSNL6cmmVwAAAE0"]
[Sat Apr 11 01:01:28.034278 2026] [:error] [pid 21706:tid 21720] [client 20.216.168.122:65045] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adks6CGQ1M5d8fQSsLFzEgAAAAw"]
[Sat Apr 11 01:01:28.705233 2026] [:error] [pid 21570:tid 21675] [client 20.216.168.122:39034] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adks6DKs5t9xRSNL6cmmYAAAAEc"]
[Sat Apr 11 01:01:29.220394 2026] [:error] [pid 21570:tid 21673] [client 20.216.168.122:20184] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "adks6TKs5t9xRSNL6cmmZAAAAEY"]
[Sat Apr 11 01:01:29.703884 2026] [:error] [pid 21568:tid 21594] [client 20.216.168.122:65050] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "adks6Yiz5v_ljZxkpR-knAAAARY"]
[Sat Apr 11 01:01:30.480169 2026] [:error] [pid 21568:tid 21582] [client 20.216.168.122:44924] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "adks6oiz5v_ljZxkpR-kowAAAQo"]
[Sat Apr 11 01:01:30.984296 2026] [:error] [pid 21568:tid 21587] [client 20.216.168.122:20187] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/file.php"] [unique_id "adks6oiz5v_ljZxkpR-kqAAAAQ8"]
[Sat Apr 11 01:01:31.495062 2026] [:error] [pid 21570:tid 21672] [client 20.216.168.122:61604] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "adks6zKs5t9xRSNL6cmmaQAAAEU"]
[Sat Apr 11 01:01:32.125960 2026] [:error] [pid 21568:tid 21589] [client 20.216.168.122:65489] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "adks7Iiz5v_ljZxkpR-ktQAAARE"]
[Sat Apr 11 01:01:32.889607 2026] [:error] [pid 21569:tid 21669] [client 20.216.168.122:20160] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "adks7HAvQTgvXJ6vHoqAowAAAJI"]
[Sat Apr 11 01:01:33.486135 2026] [:error] [pid 21568:tid 21573] [client 20.216.168.122:17629] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "adks7Yiz5v_ljZxkpR-kvgAAAQE"]
[Sat Apr 11 01:01:34.300130 2026] [:error] [pid 21569:tid 21662] [client 20.216.168.122:42493] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "adks7nAvQTgvXJ6vHoqArwAAAI8"]
[Sat Apr 11 01:01:34.777089 2026] [:error] [pid 21569:tid 21652] [client 20.216.168.122:38980] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "adks7nAvQTgvXJ6vHoqAswAAAIc"]
[Sat Apr 11 01:01:35.693583 2026] [:error] [pid 21706:tid 21728] [client 20.216.168.122:44865] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "adks7yGQ1M5d8fQSsLFzTQAAABQ"]
[Sat Apr 11 01:01:36.210605 2026] [:error] [pid 21568:tid 21591] [client 20.216.168.122:20181] [client 20.216.168.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "adks8Iiz5v_ljZxkpR-kywAAARM"]
[Sat Apr 11 03:24:26.222447 2026] [proxy_fcgi:error] [pid 21706:tid 21723] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:26.537500 2026] [proxy_fcgi:error] [pid 21706:tid 21709] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:26.825104 2026] [proxy_fcgi:error] [pid 21706:tid 21717] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:27.420988 2026] [proxy_fcgi:error] [pid 21706:tid 21727] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:27.811662 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:28.070251 2026] [proxy_fcgi:error] [pid 21706:tid 21710] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:28.380169 2026] [proxy_fcgi:error] [pid 21706:tid 21711] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:28.763986 2026] [proxy_fcgi:error] [pid 21706:tid 21713] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:30.246750 2026] [proxy_fcgi:error] [pid 21706:tid 21713] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:30.644774 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:14797] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:24:30.963411 2026] [:error] [pid 21706:tid 21710] [client 4.219.9.127:14797] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "adlObiGQ1M5d8fQSsLEFHwAAAAI"]
[Sat Apr 11 03:24:34.534694 2026] [:error] [pid 55451:tid 55455] [client 4.219.9.127:16424] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "adlOcnApxuyB7yCS5RlRGAAAAMI"]
[Sat Apr 11 03:24:35.798735 2026] [:error] [pid 21570:tid 21693] [client 4.219.9.127:14378] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "adlOczKs5t9xRSNL6cn1LwAAAFM"]
[Sat Apr 11 03:24:37.506765 2026] [:error] [pid 21568:tid 21588] [client 4.219.9.127:15069] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "adlOdYiz5v_ljZxkpR__ZAAAARA"]
[Sat Apr 11 03:24:41.927668 2026] [:error] [pid 21570:tid 21693] [client 4.219.9.127:38150] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "adlOeTKs5t9xRSNL6cn1OQAAAFM"]
[Sat Apr 11 03:24:43.498774 2026] [:error] [pid 21706:tid 21732] [client 4.219.9.127:21207] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "adlOeyGQ1M5d8fQSsLEFZAAAABg"]
[Sat Apr 11 03:24:46.714534 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:20041] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "adlOfiGQ1M5d8fQSsLEFcQAAAAw"]
[Sat Apr 11 03:25:05.856398 2026] [:error] [pid 21570:tid 21673] [client 4.219.9.127:58391] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlOkTKs5t9xRSNL6cn1YgAAAEY"]
[Sat Apr 11 03:25:07.116834 2026] [:error] [pid 55451:tid 55464] [client 4.219.9.127:26406] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlOk3ApxuyB7yCS5RlRXQAAAMs"]
[Sat Apr 11 03:25:15.823959 2026] [:error] [pid 21706:tid 21731] [client 4.219.9.127:18401] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "adlOmyGQ1M5d8fQSsLEGBQAAABc"]
[Sat Apr 11 03:25:17.261876 2026] [:error] [pid 21706:tid 21709] [client 4.219.9.127:15093] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "adlOnSGQ1M5d8fQSsLEGDgAAAAE"]
[Sat Apr 11 03:25:22.291616 2026] [:error] [pid 21706:tid 21727] [client 4.219.9.127:3739] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "adlOoiGQ1M5d8fQSsLEGLgAAABM"]
[Sat Apr 11 03:25:23.786413 2026] [:error] [pid 55451:tid 55475] [client 4.219.9.127:16473] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "adlOo3ApxuyB7yCS5RlRjwAAANY"]
[Sat Apr 11 03:25:28.683450 2026] [:error] [pid 21570:tid 21688] [client 4.219.9.127:17711] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adlOqDKs5t9xRSNL6cn1rQAAAE4"]
[Sat Apr 11 03:25:29.536832 2026] [:error] [pid 21706:tid 21719] [client 4.219.9.127:52627] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "adlOqSGQ1M5d8fQSsLEGXQAAAAs"]
[Sat Apr 11 03:25:33.130462 2026] [proxy_fcgi:error] [pid 21706:tid 21724] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:33.470948 2026] [proxy_fcgi:error] [pid 21706:tid 21712] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:33.786593 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:34.530835 2026] [proxy_fcgi:error] [pid 21706:tid 21710] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:34.792818 2026] [proxy_fcgi:error] [pid 21706:tid 21720] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:35.058094 2026] [proxy_fcgi:error] [pid 21706:tid 21719] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:35.348817 2026] [proxy_fcgi:error] [pid 21706:tid 21726] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:35.612373 2026] [proxy_fcgi:error] [pid 21706:tid 21712] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:35.873164 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:36.157706 2026] [proxy_fcgi:error] [pid 21706:tid 21709] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:36.420123 2026] [proxy_fcgi:error] [pid 21706:tid 21718] [client 4.219.9.127:16582] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:25:36.678250 2026] [:error] [pid 21706:tid 21712] [client 4.219.9.127:16582] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "adlOsCGQ1M5d8fQSsLEGhwAAAAQ"]
[Sat Apr 11 03:25:38.344578 2026] [:error] [pid 21568:tid 21591] [client 4.219.9.127:22722] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "adlOsoiz5v_ljZxkpR__6QAAARM"]
[Sat Apr 11 03:25:40.129355 2026] [:error] [pid 55451:tid 55460] [client 4.219.9.127:22777] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "adlOtHApxuyB7yCS5RlRwQAAAMc"]
[Sat Apr 11 03:25:44.389110 2026] [:error] [pid 21706:tid 21732] [client 4.219.9.127:54500] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "adlOuCGQ1M5d8fQSsLEGpAAAABg"]
[Sat Apr 11 03:25:46.694262 2026] [:error] [pid 21706:tid 21714] [client 4.219.9.127:21652] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "adlOuiGQ1M5d8fQSsLEGtAAAAAY"]
[Sat Apr 11 03:25:51.772117 2026] [:error] [pid 21706:tid 21725] [client 4.219.9.127:3471] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "adlOvyGQ1M5d8fQSsLEGxAAAABE"]
[Sat Apr 11 03:25:55.013937 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:28023] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "adlOwyGQ1M5d8fQSsLEG2AAAABA"]
[Sat Apr 11 03:25:56.801839 2026] [:error] [pid 21706:tid 21713] [client 4.219.9.127:53273] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "adlOxCGQ1M5d8fQSsLEG7gAAAAU"]
[Sat Apr 11 03:25:58.521829 2026] [:error] [pid 21568:tid 21588] [client 4.219.9.127:50741] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlOxoiz5v_ljZxkpR8ACQAAARA"]
[Sat Apr 11 03:26:00.446056 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:18442] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlOyCGQ1M5d8fQSsLEHFQAAAAM"]
[Sat Apr 11 03:26:03.325361 2026] [:error] [pid 21570:tid 21691] [client 4.219.9.127:53271] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlOyzKs5t9xRSNL6cn1-wAAAFE"]
[Sat Apr 11 03:26:05.714985 2026] [:error] [pid 21706:tid 21728] [client 4.219.9.127:18409] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adlOzSGQ1M5d8fQSsLEHTAAAABQ"]
[Sat Apr 11 03:26:08.858579 2026] [:error] [pid 21706:tid 21719] [client 4.219.9.127:3942] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Spow_SRw.php"] [unique_id "adlO0CGQ1M5d8fQSsLEHbQAAAAs"]
[Sat Apr 11 03:26:11.421784 2026] [:error] [pid 21568:tid 21581] [client 4.219.9.127:24938] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Spow_SRw.php"] [unique_id "adlO04iz5v_ljZxkpR8ANwAAAQk"]
[Sat Apr 11 03:26:13.389455 2026] [:error] [pid 21570:tid 21673] [client 4.219.9.127:19301] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Spow_SRw.php"] [unique_id "adlO1TKs5t9xRSNL6cn2BQAAAEY"]
[Sat Apr 11 03:26:15.301193 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:22751] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Spow_SRw.php"] [unique_id "adlO1yGQ1M5d8fQSsLEHpQAAAAw"]
[Sat Apr 11 03:26:17.659446 2026] [:error] [pid 55451:tid 55457] [client 4.219.9.127:21409] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adlO2XApxuyB7yCS5RlSJQAAAMQ"]
[Sat Apr 11 03:26:20.637306 2026] [:error] [pid 21569:tid 21669] [client 4.219.9.127:46490] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adlO3HAvQTgvXJ6vHorC3AAAAJI"]
[Sat Apr 11 03:26:25.329769 2026] [:error] [pid 21570:tid 21688] [client 4.219.9.127:38790] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adlO4TKs5t9xRSNL6cn2IAAAAE4"]
[Sat Apr 11 03:26:27.154258 2026] [:error] [pid 21706:tid 21723] [client 4.219.9.127:38823] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "adlO4yGQ1M5d8fQSsLEH_AAAAA8"]
[Sat Apr 11 03:26:30.653169 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:21419] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxivicLhot.php"] [unique_id "adlO5iGQ1M5d8fQSsLEIEQAAABA"]
[Sat Apr 11 03:26:31.720034 2026] [:error] [pid 21569:tid 21655] [client 4.219.9.127:23098] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxivicLhot.php"] [unique_id "adlO53AvQTgvXJ6vHorC7QAAAIo"]
[Sat Apr 11 03:26:33.553538 2026] [:error] [pid 21568:tid 21572] [client 4.219.9.127:45782] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxivicLhot.php"] [unique_id "adlO6Yiz5v_ljZxkpR8AegAAAQA"]
[Sat Apr 11 03:26:37.280617 2026] [proxy_fcgi:error] [pid 21706:tid 21720] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:37.564716 2026] [proxy_fcgi:error] [pid 21706:tid 21722] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:37.833154 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:38.162515 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:38.491875 2026] [proxy_fcgi:error] [pid 21706:tid 21713] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:38.943004 2026] [proxy_fcgi:error] [pid 21706:tid 21708] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:39.203072 2026] [proxy_fcgi:error] [pid 21706:tid 21729] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:39.658726 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:40.022992 2026] [proxy_fcgi:error] [pid 21706:tid 21719] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:40.384838 2026] [proxy_fcgi:error] [pid 21706:tid 21714] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:40.644815 2026] [proxy_fcgi:error] [pid 21706:tid 21718] [client 4.219.9.127:58990] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:26:41.016700 2026] [:error] [pid 21706:tid 21715] [client 4.219.9.127:58990] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "adlO8SGQ1M5d8fQSsLEIWgAAAAc"]
[Sat Apr 11 03:26:44.268480 2026] [:error] [pid 21706:tid 21708] [client 4.219.9.127:29891] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "adlO9CGQ1M5d8fQSsLEIcwAAAAA"]
[Sat Apr 11 03:26:46.396855 2026] [:error] [pid 21706:tid 21727] [client 4.219.9.127:20357] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "adlO9iGQ1M5d8fQSsLEIeAAAABM"]
[Sat Apr 11 03:26:48.546837 2026] [:error] [pid 21706:tid 21713] [client 4.219.9.127:37538] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "adlO-CGQ1M5d8fQSsLEIfwAAAAU"]
[Sat Apr 11 03:26:54.088459 2026] [:error] [pid 21568:tid 21596] [client 4.219.9.127:3550] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "adlO_oiz5v_ljZxkpR8ApgAAARg"]
[Sat Apr 11 03:26:55.907267 2026] [:error] [pid 21706:tid 21717] [client 4.219.9.127:45243] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "adlO_yGQ1M5d8fQSsLEIlQAAAAk"]
[Sat Apr 11 03:26:56.912396 2026] [:error] [pid 21706:tid 21708] [client 4.219.9.127:36891] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "adlPACGQ1M5d8fQSsLEInAAAAAA"]
[Sat Apr 11 03:26:59.124211 2026] [:error] [pid 21706:tid 21730] [client 4.219.9.127:57692] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "adlPAyGQ1M5d8fQSsLEInwAAABY"]
[Sat Apr 11 03:27:00.341757 2026] [:error] [pid 21706:tid 21727] [client 4.219.9.127:14612] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlPBCGQ1M5d8fQSsLEIpwAAABM"]
[Sat Apr 11 03:27:01.187414 2026] [:error] [pid 21570:tid 21695] [client 4.219.9.127:20356] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlPBTKs5t9xRSNL6cn2dgAAAFU"]
[Sat Apr 11 03:27:02.416926 2026] [:error] [pid 21568:tid 21587] [client 4.219.9.127:45239] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlPBoiz5v_ljZxkpR8AsAAAAQ8"]
[Sat Apr 11 03:27:11.117323 2026] [:error] [pid 55451:tid 55466] [client 4.219.9.127:19612] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adlPD3ApxuyB7yCS5RlSvwAAAM0"]
[Sat Apr 11 03:27:13.285895 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:45217] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "adlPESGQ1M5d8fQSsLEIygAAAAM"]
[Sat Apr 11 03:27:15.977103 2026] [:error] [pid 21570:tid 21679] [client 4.219.9.127:15866] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "adlPEzKs5t9xRSNL6cn2gwAAAEk"]
[Sat Apr 11 03:27:17.608307 2026] [:error] [pid 21568:tid 21578] [client 4.219.9.127:15846] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "adlPFYiz5v_ljZxkpR8A6AAAAQY"]
[Sat Apr 11 03:27:18.858423 2026] [:error] [pid 21570:tid 21679] [client 4.219.9.127:24157] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "adlPFjKs5t9xRSNL6cn2kAAAAEk"]
[Sat Apr 11 03:27:23.474380 2026] [:error] [pid 21569:tid 21646] [client 4.219.9.127:23166] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "adlPG3AvQTgvXJ6vHorDMAAAAIE"]
[Sat Apr 11 03:27:25.434948 2026] [:error] [pid 21569:tid 21649] [client 4.219.9.127:56478] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "adlPHXAvQTgvXJ6vHorDNgAAAIQ"]
[Sat Apr 11 03:27:27.459925 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:18889] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "adlPHyGQ1M5d8fQSsLEI8AAAAAw"]
[Sat Apr 11 03:27:28.286648 2026] [:error] [pid 21568:tid 21581] [client 4.219.9.127:15828] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "adlPIIiz5v_ljZxkpR8BFwAAAQk"]
[Sat Apr 11 03:27:30.433949 2026] [:error] [pid 55451:tid 55458] [client 4.219.9.127:37566] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adlPInApxuyB7yCS5RlTBgAAAMU"]
[Sat Apr 11 03:27:31.410984 2026] [:error] [pid 55451:tid 55474] [client 4.219.9.127:24866] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adlPI3ApxuyB7yCS5RlTCgAAANU"]
[Sat Apr 11 03:27:34.322718 2026] [:error] [pid 21706:tid 21727] [client 4.219.9.127:52911] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adlPJiGQ1M5d8fQSsLEJCQAAABM"]
[Sat Apr 11 03:27:39.284629 2026] [:error] [pid 55451:tid 55464] [client 4.219.9.127:18852] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adlPK3ApxuyB7yCS5RlTJgAAAMs"]
[Sat Apr 11 03:27:42.488551 2026] [proxy_fcgi:error] [pid 21706:tid 21722] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:42.780249 2026] [proxy_fcgi:error] [pid 21706:tid 21714] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:43.053941 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:43.314633 2026] [proxy_fcgi:error] [pid 21706:tid 21726] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:43.574066 2026] [proxy_fcgi:error] [pid 21706:tid 21723] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:43.836714 2026] [proxy_fcgi:error] [pid 21706:tid 21716] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:44.120851 2026] [proxy_fcgi:error] [pid 21706:tid 21722] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:44.419831 2026] [proxy_fcgi:error] [pid 21706:tid 21718] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:44.762391 2026] [proxy_fcgi:error] [pid 21706:tid 21711] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:45.038546 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:45.320198 2026] [proxy_fcgi:error] [pid 21706:tid 21726] [client 4.219.9.127:19212] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:27:45.707532 2026] [:error] [pid 21706:tid 21713] [client 4.219.9.127:19212] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlPMSGQ1M5d8fQSsLEJWAAAAAU"]
[Sat Apr 11 03:27:47.809394 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:57124] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlPMyGQ1M5d8fQSsLEJYQAAABA"]
[Sat Apr 11 03:27:50.691978 2026] [:error] [pid 55451:tid 55470] [client 4.219.9.127:25878] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlPNnApxuyB7yCS5RlTZwAAANE"]
[Sat Apr 11 03:27:54.959759 2026] [:error] [pid 21569:tid 21678] [client 4.219.9.127:40485] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adlPOnAvQTgvXJ6vHorDbQAAAJY"]
[Sat Apr 11 03:27:58.798742 2026] [:error] [pid 55451:tid 55456] [client 4.219.9.127:34301] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upll22.php"] [unique_id "adlPPnApxuyB7yCS5RlTfQAAAMM"]
[Sat Apr 11 03:28:00.750613 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:20368] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upll22.php"] [unique_id "adlPQCGQ1M5d8fQSsLEJrQAAAAM"]
[Sat Apr 11 03:28:02.286477 2026] [:error] [pid 55451:tid 55457] [client 4.219.9.127:33005] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upll22.php"] [unique_id "adlPQnApxuyB7yCS5RlTjAAAAMQ"]
[Sat Apr 11 03:28:05.992514 2026] [:error] [pid 21568:tid 21593] [client 4.219.9.127:3532] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upll22.php"] [unique_id "adlPRYiz5v_ljZxkpR8BZAAAARU"]
[Sat Apr 11 03:28:11.031494 2026] [:error] [pid 21706:tid 21731] [client 4.219.9.127:25897] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adlPSyGQ1M5d8fQSsLEJ5QAAABc"]
[Sat Apr 11 03:28:13.043257 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:55185] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adlPTSGQ1M5d8fQSsLEJ9AAAABA"]
[Sat Apr 11 03:28:13.917122 2026] [:error] [pid 21706:tid 21732] [client 4.219.9.127:23059] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adlPTSGQ1M5d8fQSsLEJ-gAAABg"]
[Sat Apr 11 03:28:16.151833 2026] [:error] [pid 21568:tid 21579] [client 4.219.9.127:24927] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adlPUIiz5v_ljZxkpR8BgQAAAQc"]
[Sat Apr 11 03:28:18.931458 2026] [:error] [pid 21570:tid 21681] [client 4.219.9.127:21414] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adlPUjKs5t9xRSNL6cn3CQAAAEo"]
[Sat Apr 11 03:28:20.503647 2026] [:error] [pid 55451:tid 55476] [client 4.219.9.127:51370] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adlPVHApxuyB7yCS5RlTrgAAANc"]
[Sat Apr 11 03:28:22.520506 2026] [:error] [pid 21568:tid 21578] [client 4.219.9.127:46503] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adlPVoiz5v_ljZxkpR8BjgAAAQY"]
[Sat Apr 11 03:28:24.739668 2026] [:error] [pid 21570:tid 21697] [client 4.219.9.127:21634] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "adlPWDKs5t9xRSNL6cn3DwAAAFc"]
[Sat Apr 11 03:28:27.800797 2026] [:error] [pid 21706:tid 21717] [client 4.219.9.127:41284] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "adlPWyGQ1M5d8fQSsLEKSQAAAAk"]
[Sat Apr 11 03:28:28.681336 2026] [:error] [pid 21570:tid 21677] [client 4.219.9.127:34918] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "adlPXDKs5t9xRSNL6cn3FQAAAEg"]
[Sat Apr 11 03:28:32.515893 2026] [:error] [pid 21568:tid 21594] [client 4.219.9.127:51271] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "adlPYIiz5v_ljZxkpR8BqgAAARY"]
[Sat Apr 11 03:28:33.895632 2026] [:error] [pid 21570:tid 21693] [client 4.219.9.127:41282] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "adlPYTKs5t9xRSNL6cn3LAAAAFM"]
[Sat Apr 11 03:28:35.526921 2026] [:error] [pid 21570:tid 21687] [client 4.219.9.127:18449] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adlPYzKs5t9xRSNL6cn3LwAAAE0"]
[Sat Apr 11 03:28:45.970205 2026] [proxy_fcgi:error] [pid 21706:tid 21730] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:46.236840 2026] [proxy_fcgi:error] [pid 21706:tid 21708] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:46.644334 2026] [proxy_fcgi:error] [pid 21706:tid 21714] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:46.903752 2026] [proxy_fcgi:error] [pid 21706:tid 21720] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:47.162292 2026] [proxy_fcgi:error] [pid 21706:tid 21723] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:47.442725 2026] [proxy_fcgi:error] [pid 21706:tid 21729] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:47.753174 2026] [proxy_fcgi:error] [pid 21706:tid 21717] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:48.061983 2026] [proxy_fcgi:error] [pid 21706:tid 21711] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:48.351554 2026] [proxy_fcgi:error] [pid 21706:tid 21730] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:48.770648 2026] [proxy_fcgi:error] [pid 21706:tid 21731] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:49.044090 2026] [proxy_fcgi:error] [pid 21706:tid 21717] [client 4.219.9.127:51372] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:28:49.299215 2026] [:error] [pid 21706:tid 21716] [client 4.219.9.127:51372] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adlPcSGQ1M5d8fQSsLEKogAAAAg"]
[Sat Apr 11 03:28:55.088724 2026] [:error] [pid 21570:tid 21698] [client 4.219.9.127:53262] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adlPdzKs5t9xRSNL6cn3QQAAAFg"]
[Sat Apr 11 03:28:56.270434 2026] [:error] [pid 55451:tid 55456] [client 4.219.9.127:18464] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adlPeHApxuyB7yCS5RlT9wAAAMM"]
[Sat Apr 11 03:28:57.714926 2026] [:error] [pid 21706:tid 21714] [client 4.219.9.127:51372] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "adlPeSGQ1M5d8fQSsLEKygAAAAY"]
[Sat Apr 11 03:29:00.567996 2026] [:error] [pid 21568:tid 21586] [client 4.219.9.127:29865] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adlPfIiz5v_ljZxkpR8B3wAAAQ4"]
[Sat Apr 11 03:29:02.192940 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:59627] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adlPfnApxuyB7yCS5RlUAAAAAM4"]
[Sat Apr 11 03:29:04.057674 2026] [:error] [pid 21706:tid 21729] [client 4.219.9.127:50746] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adlPgCGQ1M5d8fQSsLEK2wAAABU"]
[Sat Apr 11 03:29:06.858172 2026] [:error] [pid 21706:tid 21729] [client 4.219.9.127:16973] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "adlPgiGQ1M5d8fQSsLEK5QAAABU"]
[Sat Apr 11 03:29:08.769509 2026] [:error] [pid 21569:tid 21676] [client 4.219.9.127:50727] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlPhHAvQTgvXJ6vHorD5gAAAJU"]
[Sat Apr 11 03:29:10.046490 2026] [:error] [pid 21568:tid 21572] [client 4.219.9.127:16999] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlPhoiz5v_ljZxkpR8B8gAAAQA"]
[Sat Apr 11 03:29:11.394027 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:18092] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlPhyGQ1M5d8fQSsLELFwAAABA"]
[Sat Apr 11 03:29:14.302893 2026] [:error] [pid 21706:tid 21717] [client 4.219.9.127:52003] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlPiiGQ1M5d8fQSsLELIQAAAAk"]
[Sat Apr 11 03:29:42.083832 2026] [:error] [pid 21706:tid 21713] [client 4.219.9.127:57035] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlPpiGQ1M5d8fQSsLELkwAAAAU"]
[Sat Apr 11 03:29:43.394634 2026] [:error] [pid 21706:tid 21727] [client 4.219.9.127:43606] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlPpyGQ1M5d8fQSsLELmwAAABM"]
[Sat Apr 11 03:29:45.163130 2026] [:error] [pid 21568:tid 21573] [client 4.219.9.127:3072] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlPqYiz5v_ljZxkpR8CTAAAAQE"]
[Sat Apr 11 03:29:46.208910 2026] [:error] [pid 55451:tid 55477] [client 4.219.9.127:25240] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlPqnApxuyB7yCS5RlUeQAAANg"]
[Sat Apr 11 03:29:47.579730 2026] [:error] [pid 21569:tid 21676] [client 4.219.9.127:16429] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adlPq3AvQTgvXJ6vHorENAAAAJU"]
[Sat Apr 11 03:29:49.026118 2026] [proxy_fcgi:error] [pid 21706:tid 21732] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:49.357723 2026] [proxy_fcgi:error] [pid 21706:tid 21730] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:49.678009 2026] [proxy_fcgi:error] [pid 21706:tid 21712] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:49.940705 2026] [proxy_fcgi:error] [pid 21706:tid 21716] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:50.338028 2026] [proxy_fcgi:error] [pid 21706:tid 21708] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:50.600509 2026] [proxy_fcgi:error] [pid 21706:tid 21726] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:50.945462 2026] [proxy_fcgi:error] [pid 21706:tid 21725] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:51.317960 2026] [proxy_fcgi:error] [pid 21706:tid 21710] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:51.775966 2026] [proxy_fcgi:error] [pid 21706:tid 21719] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:52.194599 2026] [proxy_fcgi:error] [pid 21706:tid 21730] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:52.454693 2026] [proxy_fcgi:error] [pid 21706:tid 21711] [client 4.219.9.127:3133] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:29:52.937631 2026] [:error] [pid 21706:tid 21714] [client 4.219.9.127:3133] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adlPsCGQ1M5d8fQSsLELwAAAAAY"]
[Sat Apr 11 03:29:54.179125 2026] [:error] [pid 21570:tid 21694] [client 4.219.9.127:14991] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adlPsjKs5t9xRSNL6cn3uQAAAFQ"]
[Sat Apr 11 03:29:54.901916 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:52558] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adlPsnApxuyB7yCS5RlUjwAAAM4"]
[Sat Apr 11 03:29:55.699980 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:38203] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "adlPsyGQ1M5d8fQSsLELyQAAABA"]
[Sat Apr 11 03:29:56.338200 2026] [:error] [pid 21568:tid 21596] [client 4.219.9.127:38172] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adlPtIiz5v_ljZxkpR8CYgAAARg"]
[Sat Apr 11 03:29:57.300475 2026] [:error] [pid 21570:tid 21673] [client 4.219.9.127:56390] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adlPtTKs5t9xRSNL6cn3vQAAAEY"]
[Sat Apr 11 03:29:58.241687 2026] [:error] [pid 55451:tid 55477] [client 4.219.9.127:56398] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adlPtnApxuyB7yCS5RlUlAAAANg"]
[Sat Apr 11 03:29:59.379845 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:57052] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "adlPt3ApxuyB7yCS5RlUmQAAAM4"]
[Sat Apr 11 03:30:00.483692 2026] [:error] [pid 21570:tid 21697] [client 4.219.9.127:16447] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "adlPuDKs5t9xRSNL6cn3ygAAAFc"]
[Sat Apr 11 03:30:01.983447 2026] [:error] [pid 55451:tid 55465] [client 4.219.9.127:14984] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "adlPuXApxuyB7yCS5RlUpQAAAMw"]
[Sat Apr 11 03:30:03.040903 2026] [:error] [pid 21706:tid 21728] [client 4.219.9.127:52588] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "adlPuyGQ1M5d8fQSsLEL5AAAABQ"]
[Sat Apr 11 03:30:03.803301 2026] [:error] [pid 55451:tid 55472] [client 4.219.9.127:53898] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "adlPu3ApxuyB7yCS5RlUrQAAANM"]
[Sat Apr 11 03:30:04.752989 2026] [:error] [pid 21570:tid 21677] [client 4.219.9.127:28859] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adlPvDKs5t9xRSNL6cn31AAAAEg"]
[Sat Apr 11 03:30:05.724011 2026] [:error] [pid 21569:tid 21674] [client 4.219.9.127:46880] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adlPvXAvQTgvXJ6vHorEXAAAAJQ"]
[Sat Apr 11 03:30:06.538182 2026] [:error] [pid 21568:tid 21575] [client 4.219.9.127:54589] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adlPvoiz5v_ljZxkpR8CaQAAAQM"]
[Sat Apr 11 03:30:07.995644 2026] [:error] [pid 21570:tid 21694] [client 4.219.9.127:36862] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "adlPvzKs5t9xRSNL6cn35AAAAFQ"]
[Sat Apr 11 03:30:09.648997 2026] [:error] [pid 21568:tid 21579] [client 4.219.9.127:63638] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adlPwYiz5v_ljZxkpR8CbAAAAQc"]
[Sat Apr 11 03:30:10.424750 2026] [:error] [pid 21570:tid 21685] [client 4.219.9.127:46886] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adlPwjKs5t9xRSNL6cn36gAAAEw"]
[Sat Apr 11 03:30:11.212680 2026] [:error] [pid 21569:tid 21671] [client 4.219.9.127:46866] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adlPw3AvQTgvXJ6vHorEawAAAJM"]
[Sat Apr 11 03:30:11.999802 2026] [:error] [pid 21569:tid 21669] [client 4.219.9.127:52565] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "adlPw3AvQTgvXJ6vHorEcAAAAJI"]
[Sat Apr 11 03:30:12.844439 2026] [:error] [pid 55451:tid 55458] [client 4.219.9.127:63634] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adlPxHApxuyB7yCS5RlUuQAAAMU"]
[Sat Apr 11 03:30:13.632124 2026] [:error] [pid 21706:tid 21719] [client 4.219.9.127:53929] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adlPxSGQ1M5d8fQSsLEMAAAAAAs"]
[Sat Apr 11 03:30:15.159328 2026] [:error] [pid 21706:tid 21721] [client 4.219.9.127:54581] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adlPxyGQ1M5d8fQSsLEMCAAAAA0"]
[Sat Apr 11 03:30:16.158316 2026] [:error] [pid 55451:tid 55476] [client 4.219.9.127:36837] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adlPyHApxuyB7yCS5RlUvwAAANc"]
[Sat Apr 11 03:30:16.955045 2026] [:error] [pid 21568:tid 21580] [client 4.219.9.127:59068] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "adlPyIiz5v_ljZxkpR8CeQAAAQg"]
[Sat Apr 11 03:30:17.643389 2026] [:error] [pid 21706:tid 21717] [client 4.219.9.127:52563] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "adlPySGQ1M5d8fQSsLEMDgAAAAk"]
[Sat Apr 11 03:30:19.837369 2026] [:error] [pid 55451:tid 55460] [client 4.219.9.127:46884] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "adlPy3ApxuyB7yCS5RlUzwAAAMc"]
[Sat Apr 11 03:30:20.791068 2026] [:error] [pid 21706:tid 21710] [client 4.219.9.127:63656] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "adlPzCGQ1M5d8fQSsLEMGAAAAAI"]
[Sat Apr 11 03:30:21.937573 2026] [:error] [pid 21570:tid 21663] [client 4.219.9.127:17023] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adlPzTKs5t9xRSNL6cn39wAAAEE"]
[Sat Apr 11 03:30:22.993087 2026] [:error] [pid 21570:tid 21698] [client 4.219.9.127:19649] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adlPzjKs5t9xRSNL6cn3-gAAAFg"]
[Sat Apr 11 03:30:24.280761 2026] [:error] [pid 21568:tid 21580] [client 4.219.9.127:16394] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adlP0Iiz5v_ljZxkpR8CgQAAAQg"]
[Sat Apr 11 03:30:25.996412 2026] [:error] [pid 21570:tid 21670] [client 4.219.9.127:36834] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adlP0TKs5t9xRSNL6cn4AwAAAEQ"]
[Sat Apr 11 03:30:27.456285 2026] [:error] [pid 21568:tid 21577] [client 4.219.9.127:42596] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adlP04iz5v_ljZxkpR8ChgAAAQU"]
[Sat Apr 11 03:30:28.136421 2026] [:error] [pid 55451:tid 55462] [client 4.219.9.127:46899] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adlP1HApxuyB7yCS5RlU7wAAAMk"]
[Sat Apr 11 03:30:29.024461 2026] [:error] [pid 55451:tid 55458] [client 4.219.9.127:36823] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adlP1XApxuyB7yCS5RlU8gAAAMU"]
[Sat Apr 11 03:30:29.715333 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:48160] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "adlP1SGQ1M5d8fQSsLEMMwAAAAM"]
[Sat Apr 11 03:30:30.686592 2026] [:error] [pid 21570:tid 21681] [client 4.219.9.127:3413] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlP1jKs5t9xRSNL6cn4DQAAAEo"]
[Sat Apr 11 03:30:31.509099 2026] [:error] [pid 21706:tid 21728] [client 4.219.9.127:16431] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlP1yGQ1M5d8fQSsLEMOwAAABQ"]
[Sat Apr 11 03:30:34.498968 2026] [:error] [pid 21570:tid 21694] [client 4.219.9.127:16433] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlP2jKs5t9xRSNL6cn4EwAAAFQ"]
[Sat Apr 11 03:30:37.128448 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:48173] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adlP3XApxuyB7yCS5RlVBgAAAM4"]
[Sat Apr 11 03:30:38.151846 2026] [:error] [pid 21568:tid 21594] [client 4.219.9.127:51989] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adlP3oiz5v_ljZxkpR8CnwAAARY"]
[Sat Apr 11 03:30:39.258277 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:17006] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adlP3yGQ1M5d8fQSsLEMVQAAAAM"]
[Sat Apr 11 03:30:40.234448 2026] [:error] [pid 21569:tid 21657] [client 4.219.9.127:3093] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adlP4HAvQTgvXJ6vHorEnQAAAIw"]
[Sat Apr 11 03:30:41.264523 2026] [:error] [pid 21706:tid 21718] [client 4.219.9.127:19655] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "adlP4SGQ1M5d8fQSsLEMZgAAAAo"]
[Sat Apr 11 03:30:43.224671 2026] [:error] [pid 21706:tid 21710] [client 4.219.9.127:63578] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlP4yGQ1M5d8fQSsLEMfQAAAAI"]
[Sat Apr 11 03:30:44.557660 2026] [:error] [pid 21706:tid 21724] [client 4.219.9.127:50730] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlP5CGQ1M5d8fQSsLEMigAAABA"]
[Sat Apr 11 03:30:45.327669 2026] [:error] [pid 21706:tid 21723] [client 4.219.9.127:14339] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlP5SGQ1M5d8fQSsLEMkQAAAA8"]
[Sat Apr 11 03:30:46.407859 2026] [:error] [pid 21706:tid 21723] [client 4.219.9.127:48181] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adlP5iGQ1M5d8fQSsLEMmQAAAA8"]
[Sat Apr 11 03:30:47.346926 2026] [:error] [pid 21570:tid 21675] [client 4.219.9.127:59593] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adlP5zKs5t9xRSNL6cn4HwAAAEc"]
[Sat Apr 11 03:30:48.161114 2026] [:error] [pid 55451:tid 55476] [client 4.219.9.127:3423] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adlP6HApxuyB7yCS5RlVIAAAANc"]
[Sat Apr 11 03:30:49.846540 2026] [:error] [pid 55451:tid 55458] [client 4.219.9.127:29867] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adlP6XApxuyB7yCS5RlVJgAAAMU"]
[Sat Apr 11 03:30:50.903408 2026] [:error] [pid 21706:tid 21725] [client 4.219.9.127:29824] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "adlP6iGQ1M5d8fQSsLEMqAAAABE"]
[Sat Apr 11 03:30:52.287478 2026] [proxy_fcgi:error] [pid 21568:tid 21585] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:52.593376 2026] [proxy_fcgi:error] [pid 21568:tid 21573] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:52.857098 2026] [proxy_fcgi:error] [pid 21568:tid 21591] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:53.120290 2026] [proxy_fcgi:error] [pid 21568:tid 21594] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:53.385409 2026] [proxy_fcgi:error] [pid 21568:tid 21572] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:53.912092 2026] [proxy_fcgi:error] [pid 21568:tid 21586] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:54.276432 2026] [proxy_fcgi:error] [pid 21568:tid 21596] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:54.658101 2026] [proxy_fcgi:error] [pid 21568:tid 21588] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:54.954415 2026] [proxy_fcgi:error] [pid 21568:tid 21581] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:55.362421 2026] [proxy_fcgi:error] [pid 21568:tid 21593] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:55.899645 2026] [proxy_fcgi:error] [pid 21568:tid 21582] [client 4.219.9.127:34900] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 03:30:56.157128 2026] [:error] [pid 21568:tid 21583] [client 4.219.9.127:34900] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adlP8Iiz5v_ljZxkpR8CvwAAAQs"]
[Sat Apr 11 03:30:57.283266 2026] [:error] [pid 21570:tid 21692] [client 4.219.9.127:26957] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adlP8TKs5t9xRSNL6cn4NAAAAFI"]
[Sat Apr 11 03:30:58.915626 2026] [:error] [pid 21706:tid 21710] [client 4.219.9.127:21642] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adlP8iGQ1M5d8fQSsLEMxAAAAAI"]
[Sat Apr 11 03:31:00.179399 2026] [:error] [pid 21569:tid 21657] [client 4.219.9.127:34894] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "adlP9HAvQTgvXJ6vHorEswAAAIw"]
[Sat Apr 11 03:31:01.058267 2026] [:error] [pid 21569:tid 21674] [client 4.219.9.127:22720] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adlP9XAvQTgvXJ6vHorEtwAAAJQ"]
[Sat Apr 11 03:31:01.641887 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:50723] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adlP9SGQ1M5d8fQSsLEMygAAAAw"]
[Sat Apr 11 03:31:02.497852 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:22782] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adlP9nApxuyB7yCS5RlVPwAAAM4"]
[Sat Apr 11 03:31:03.347028 2026] [:error] [pid 55451:tid 55471] [client 4.219.9.127:22783] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "adlP93ApxuyB7yCS5RlVQwAAANI"]
[Sat Apr 11 03:31:04.194137 2026] [:error] [pid 21569:tid 21656] [client 4.219.9.127:49357] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adlP-HAvQTgvXJ6vHorEugAAAIs"]
[Sat Apr 11 03:31:05.146172 2026] [:error] [pid 55451:tid 55475] [client 4.219.9.127:59646] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adlP-XApxuyB7yCS5RlVSwAAANY"]
[Sat Apr 11 03:31:05.875871 2026] [:error] [pid 21706:tid 21721] [client 4.219.9.127:27980] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adlP-SGQ1M5d8fQSsLEM2AAAAA0"]
[Sat Apr 11 03:31:07.041960 2026] [:error] [pid 21568:tid 21578] [client 4.219.9.127:27428] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "adlP-4iz5v_ljZxkpR8CzAAAAQY"]
[Sat Apr 11 03:31:07.743584 2026] [:error] [pid 21706:tid 21708] [client 4.219.9.127:50696] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adlP-yGQ1M5d8fQSsLEM3AAAAAA"]
[Sat Apr 11 03:31:08.411600 2026] [:error] [pid 21706:tid 21719] [client 4.219.9.127:18488] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adlP_CGQ1M5d8fQSsLEM4AAAAAs"]
[Sat Apr 11 03:31:09.032835 2026] [:error] [pid 21568:tid 21594] [client 4.219.9.127:41977] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adlP_Yiz5v_ljZxkpR8C0AAAARY"]
[Sat Apr 11 03:31:09.877289 2026] [:error] [pid 55451:tid 55463] [client 4.219.9.127:22760] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "adlP_XApxuyB7yCS5RlVXQAAAMo"]
[Sat Apr 11 03:31:10.558588 2026] [:error] [pid 21569:tid 21664] [client 4.219.9.127:16611] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/jp.php"] [unique_id "adlP_nAvQTgvXJ6vHorExQAAAJA"]
[Sat Apr 11 03:31:11.212308 2026] [:error] [pid 21569:tid 21654] [client 4.219.9.127:42584] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/jp.php"] [unique_id "adlP_3AvQTgvXJ6vHorEzAAAAIk"]
[Sat Apr 11 03:31:11.921126 2026] [:error] [pid 21706:tid 21710] [client 4.219.9.127:3714] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/jp.php"] [unique_id "adlP_yGQ1M5d8fQSsLEM5QAAAAI"]
[Sat Apr 11 03:31:12.952915 2026] [:error] [pid 21706:tid 21721] [client 4.219.9.127:18379] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/jp.php"] [unique_id "adlQACGQ1M5d8fQSsLEM6gAAAA0"]
[Sat Apr 11 03:31:13.593120 2026] [:error] [pid 21570:tid 21685] [client 4.219.9.127:27997] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adlQATKs5t9xRSNL6cn4UQAAAEw"]
[Sat Apr 11 03:31:14.772537 2026] [:error] [pid 21569:tid 21655] [client 4.219.9.127:3966] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adlQAnAvQTgvXJ6vHorE0wAAAIo"]
[Sat Apr 11 03:31:15.899490 2026] [:error] [pid 21568:tid 21591] [client 4.219.9.127:27981] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adlQA4iz5v_ljZxkpR8C2QAAARM"]
[Sat Apr 11 03:31:16.971358 2026] [:error] [pid 21570:tid 21690] [client 4.219.9.127:59628] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "adlQBDKs5t9xRSNL6cn4VQAAAFA"]
[Sat Apr 11 03:31:17.663850 2026] [:error] [pid 21568:tid 21588] [client 4.219.9.127:59623] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adlQBYiz5v_ljZxkpR8C3QAAARA"]
[Sat Apr 11 03:31:18.327329 2026] [:error] [pid 21568:tid 21582] [client 4.219.9.127:41949] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adlQBoiz5v_ljZxkpR8C4AAAAQo"]
[Sat Apr 11 03:31:19.045268 2026] [:error] [pid 21570:tid 21677] [client 4.219.9.127:40112] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adlQBzKs5t9xRSNL6cn4VwAAAEg"]
[Sat Apr 11 03:31:19.664718 2026] [:error] [pid 21568:tid 21587] [client 4.219.9.127:18462] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp5.php"] [unique_id "adlQB4iz5v_ljZxkpR8C5AAAAQ8"]
[Sat Apr 11 03:31:20.308367 2026] [:error] [pid 21706:tid 21714] [client 4.219.9.127:40087] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adlQCCGQ1M5d8fQSsLENBAAAAAY"]
[Sat Apr 11 03:31:22.033948 2026] [:error] [pid 55451:tid 55465] [client 4.219.9.127:21662] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adlQCnApxuyB7yCS5RlVggAAAMw"]
[Sat Apr 11 03:31:22.938194 2026] [:error] [pid 21706:tid 21715] [client 4.219.9.127:43681] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adlQCiGQ1M5d8fQSsLENDwAAAAc"]
[Sat Apr 11 03:31:23.828649 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:18368] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "adlQCyGQ1M5d8fQSsLENFQAAAAw"]
[Sat Apr 11 03:31:24.979699 2026] [:error] [pid 55451:tid 55467] [client 4.219.9.127:21693] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adlQDHApxuyB7yCS5RlVjwAAAM4"]
[Sat Apr 11 03:31:26.138064 2026] [:error] [pid 21706:tid 21729] [client 4.219.9.127:21685] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adlQDiGQ1M5d8fQSsLENIQAAABU"]
[Sat Apr 11 03:31:26.825584 2026] [:error] [pid 21706:tid 21711] [client 4.219.9.127:34939] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adlQDiGQ1M5d8fQSsLENKgAAAAM"]
[Sat Apr 11 03:31:27.915884 2026] [:error] [pid 55451:tid 55463] [client 4.219.9.127:53198] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws88.php"] [unique_id "adlQD3ApxuyB7yCS5RlVlAAAAMo"]
[Sat Apr 11 03:31:29.597476 2026] [:error] [pid 21568:tid 21591] [client 4.219.9.127:21665] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlQEYiz5v_ljZxkpR8C7wAAARM"]
[Sat Apr 11 03:31:31.242441 2026] [:error] [pid 55451:tid 55456] [client 4.219.9.127:53280] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlQE3ApxuyB7yCS5RlVnwAAAMM"]
[Sat Apr 11 03:31:32.301879 2026] [:error] [pid 21570:tid 21682] [client 4.219.9.127:18403] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlQFDKs5t9xRSNL6cn4dwAAAEs"]
[Sat Apr 11 03:31:33.464004 2026] [:error] [pid 21570:tid 21698] [client 4.219.9.127:16587] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "adlQFTKs5t9xRSNL6cn4fAAAAFg"]
[Sat Apr 11 03:31:34.837781 2026] [:error] [pid 21706:tid 21720] [client 4.219.9.127:18404] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adlQFiGQ1M5d8fQSsLENTwAAAAw"]
[Sat Apr 11 03:31:35.696220 2026] [:error] [pid 21706:tid 21723] [client 4.219.9.127:41952] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adlQFyGQ1M5d8fQSsLENVwAAAA8"]
[Sat Apr 11 03:31:36.590019 2026] [:error] [pid 21706:tid 21731] [client 4.219.9.127:24170] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adlQGCGQ1M5d8fQSsLENXgAAABc"]
[Sat Apr 11 03:31:37.635400 2026] [:error] [pid 21569:tid 21648] [client 4.219.9.127:53224] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adlQGXAvQTgvXJ6vHorE9QAAAIM"]
[Sat Apr 11 06:56:39.002807 2026] [:error] [pid 15244:tid 15252] [client 197.36.11.93:53562] [client 197.36.11.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.36.11.93, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "admAJ4kdEsz5NeAq8w1Y_gAAAQY"]
[Sat Apr 11 06:56:39.014192 2026] [proxy_fcgi:error] [pid 15244:tid 15252] [client 197.36.11.93:53562] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:42.979054 2026] [proxy_fcgi:error] [pid 33172:tid 33225] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:43.232261 2026] [proxy_fcgi:error] [pid 33172:tid 33238] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:43.549069 2026] [proxy_fcgi:error] [pid 33172:tid 33218] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:43.786857 2026] [proxy_fcgi:error] [pid 33172:tid 33220] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:44.037844 2026] [proxy_fcgi:error] [pid 33172:tid 33235] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:44.299644 2026] [proxy_fcgi:error] [pid 33172:tid 33222] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:44.539316 2026] [proxy_fcgi:error] [pid 33172:tid 33237] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:44.788198 2026] [proxy_fcgi:error] [pid 33172:tid 33226] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:45.026994 2026] [proxy_fcgi:error] [pid 33172:tid 33230] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:45.264889 2026] [proxy_fcgi:error] [pid 33172:tid 33225] [client 52.143.152.19:42886] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:02:45.498642 2026] [:error] [pid 33172:tid 33221] [client 52.143.152.19:42886] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "admBlTn2G0IJw5EZY9ldTAAAAEM"]
[Sat Apr 11 07:02:47.100595 2026] [:error] [pid 33288:tid 33311] [client 52.143.152.19:54309] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "admBl2JmwJFFPEgRHfFzdAAAANU"]
[Sat Apr 11 07:02:47.800762 2026] [:error] [pid 33288:tid 33302] [client 52.143.152.19:2362] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "admBl2JmwJFFPEgRHfFzdQAAAMw"]
[Sat Apr 11 07:02:48.321281 2026] [:error] [pid 33288:tid 33298] [client 52.143.152.19:37289] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BhqKs28Cw94.php"] [unique_id "admBmGJmwJFFPEgRHfFzewAAAMg"]
[Sat Apr 11 07:02:48.860169 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:46278] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "admBmGJmwJFFPEgRHfFzgAAAAMk"]
[Sat Apr 11 07:02:49.428948 2026] [:error] [pid 33288:tid 33301] [client 52.143.152.19:54318] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "admBmWJmwJFFPEgRHfFzhAAAAMs"]
[Sat Apr 11 07:02:50.014208 2026] [:error] [pid 33173:tid 33256] [client 52.143.152.19:37270] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "admBmq8109xRDP2izWgCTAAAAIs"]
[Sat Apr 11 07:02:50.548635 2026] [:error] [pid 33288:tid 33294] [client 52.143.152.19:2948] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "admBmmJmwJFFPEgRHfFzigAAAMQ"]
[Sat Apr 11 07:02:51.279276 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:61350] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "admBm4kdEsz5NeAq8w1gNgAAAQs"]
[Sat Apr 11 07:02:52.297793 2026] [:error] [pid 33173:tid 33248] [client 52.143.152.19:61331] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "admBnK8109xRDP2izWgCVAAAAIM"]
[Sat Apr 11 07:02:52.884000 2026] [:error] [pid 33288:tid 33307] [client 52.143.152.19:42909] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "admBnGJmwJFFPEgRHfFzjgAAANE"]
[Sat Apr 11 07:02:53.575936 2026] [:error] [pid 33288:tid 33291] [client 52.143.152.19:20049] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3Cr1w6dfjTK.php"] [unique_id "admBnWJmwJFFPEgRHfFzjwAAAME"]
[Sat Apr 11 07:02:54.326017 2026] [:error] [pid 33173:tid 33267] [client 52.143.152.19:20043] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "admBnq8109xRDP2izWgCWQAAAJY"]
[Sat Apr 11 07:02:54.962200 2026] [:error] [pid 33288:tid 33296] [client 52.143.152.19:37264] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "admBnmJmwJFFPEgRHfFzmgAAAMY"]
[Sat Apr 11 07:02:55.822865 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:22429] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "admBn4kdEsz5NeAq8w1gTAAAAQ4"]
[Sat Apr 11 07:02:56.399042 2026] [:error] [pid 33173:tid 33246] [client 52.143.152.19:61323] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beerd.php"] [unique_id "admBoK8109xRDP2izWgCXwAAAIE"]
[Sat Apr 11 07:02:57.085285 2026] [:error] [pid 33288:tid 33294] [client 52.143.152.19:20042] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "admBoWJmwJFFPEgRHfFzoQAAAMQ"]
[Sat Apr 11 07:02:57.875277 2026] [:error] [pid 33173:tid 33263] [client 52.143.152.19:20073] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "admBoa8109xRDP2izWgCZQAAAJI"]
[Sat Apr 11 07:02:59.273506 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:36006] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "admBo2JmwJFFPEgRHfFzrAAAAMk"]
[Sat Apr 11 07:03:00.298005 2026] [:error] [pid 33173:tid 33250] [client 52.143.152.19:2315] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "admBpK8109xRDP2izWgCcgAAAIU"]
[Sat Apr 11 07:03:00.893088 2026] [:error] [pid 33288:tid 33304] [client 52.143.152.19:21900] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "admBpGJmwJFFPEgRHfFzrQAAAM4"]
[Sat Apr 11 07:03:01.587821 2026] [:error] [pid 33288:tid 33290] [client 52.143.152.19:54312] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "admBpWJmwJFFPEgRHfFzsQAAAMA"]
[Sat Apr 11 07:03:02.908480 2026] [:error] [pid 33172:tid 33226] [client 52.143.152.19:2308] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "admBpjn2G0IJw5EZY9ldYAAAAEg"]
[Sat Apr 11 07:03:03.941682 2026] [:error] [pid 33173:tid 33246] [client 52.143.152.19:2745] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "admBp68109xRDP2izWgCiAAAAIE"]
[Sat Apr 11 07:03:05.350062 2026] [:error] [pid 33173:tid 33247] [client 52.143.152.19:21892] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "admBqa8109xRDP2izWgCjwAAAII"]
[Sat Apr 11 07:03:06.507409 2026] [:error] [pid 33288:tid 33307] [client 52.143.152.19:37263] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "admBqmJmwJFFPEgRHfFzvwAAANE"]
[Sat Apr 11 07:03:07.223138 2026] [:error] [pid 33173:tid 33253] [client 52.143.152.19:48831] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "admBq68109xRDP2izWgCkgAAAIg"]
[Sat Apr 11 07:03:08.034783 2026] [:error] [pid 33173:tid 33263] [client 52.143.152.19:3001] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "admBrK8109xRDP2izWgCmwAAAJI"]
[Sat Apr 11 07:03:08.566820 2026] [:error] [pid 33172:tid 33232] [client 52.143.152.19:22411] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "admBrDn2G0IJw5EZY9ldagAAAE4"]
[Sat Apr 11 07:03:09.330627 2026] [:error] [pid 33173:tid 33255] [client 52.143.152.19:61334] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "admBra8109xRDP2izWgCoAAAAIo"]
[Sat Apr 11 07:03:10.189381 2026] [:error] [pid 33171:tid 33204] [client 52.143.152.19:42888] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "admBrroqTMlo30hcVw97ZAAAABI"]
[Sat Apr 11 07:03:10.828585 2026] [:error] [pid 15244:tid 15246] [client 52.143.152.19:46292] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "admBrokdEsz5NeAq8w1ggAAAAQA"]
[Sat Apr 11 07:03:11.551751 2026] [:error] [pid 33172:tid 33220] [client 52.143.152.19:21896] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/RIP.php"] [unique_id "admBrzn2G0IJw5EZY9lddgAAAEI"]
[Sat Apr 11 07:03:12.298850 2026] [:error] [pid 33172:tid 33222] [client 52.143.152.19:54288] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/RIP.php"] [unique_id "admBsDn2G0IJw5EZY9ldfAAAAEQ"]
[Sat Apr 11 07:03:13.147447 2026] [:error] [pid 33171:tid 33196] [client 52.143.152.19:17982] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/RIP.php"] [unique_id "admBsboqTMlo30hcVw97aQAAAAo"]
[Sat Apr 11 07:03:14.027912 2026] [:error] [pid 33288:tid 33303] [client 52.143.152.19:37304] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/RIP.php"] [unique_id "admBsmJmwJFFPEgRHfFz0QAAAM0"]
[Sat Apr 11 07:03:14.747690 2026] [:error] [pid 33173:tid 33267] [client 52.143.152.19:21899] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "admBsq8109xRDP2izWgCrgAAAJY"]
[Sat Apr 11 07:03:15.430814 2026] [:error] [pid 15244:tid 15255] [client 52.143.152.19:42890] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "admBs4kdEsz5NeAq8w1gjAAAAQk"]
[Sat Apr 11 07:03:16.333383 2026] [:error] [pid 33172:tid 33218] [client 52.143.152.19:37279] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "admBtDn2G0IJw5EZY9ldhQAAAEA"]
[Sat Apr 11 07:03:17.220900 2026] [:error] [pid 33173:tid 33253] [client 52.143.152.19:42894] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "admBta8109xRDP2izWgCuAAAAIg"]
[Sat Apr 11 07:03:18.098023 2026] [:error] [pid 33172:tid 33225] [client 52.143.152.19:54281] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blqjs.php"] [unique_id "admBtjn2G0IJw5EZY9ldlAAAAEc"]
[Sat Apr 11 07:03:20.257038 2026] [:error] [pid 15244:tid 15267] [client 52.143.152.19:46280] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blqjs.php"] [unique_id "admBuIkdEsz5NeAq8w1gngAAARU"]
[Sat Apr 11 07:03:20.960988 2026] [:error] [pid 33171:tid 33195] [client 52.143.152.19:2729] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blqjs.php"] [unique_id "admBuLoqTMlo30hcVw97eAAAAAk"]
[Sat Apr 11 07:03:21.702937 2026] [:error] [pid 33288:tid 33304] [client 52.143.152.19:37285] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blqjs.php"] [unique_id "admBuWJmwJFFPEgRHfFz6QAAAM4"]
[Sat Apr 11 07:03:22.484954 2026] [:error] [pid 33171:tid 33208] [client 52.143.152.19:61335] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sk25_1.php"] [unique_id "admBuroqTMlo30hcVw97ewAAABY"]
[Sat Apr 11 07:03:23.419972 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:36002] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sk25_1.php"] [unique_id "admBu4kdEsz5NeAq8w1gqgAAAQo"]
[Sat Apr 11 07:03:24.463618 2026] [:error] [pid 33173:tid 33257] [client 52.143.152.19:35972] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sk25_1.php"] [unique_id "admBvK8109xRDP2izWgCxQAAAIw"]
[Sat Apr 11 07:03:25.658824 2026] [:error] [pid 15244:tid 15252] [client 52.143.152.19:37254] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sk25_1.php"] [unique_id "admBvYkdEsz5NeAq8w1guQAAAQY"]
[Sat Apr 11 07:03:26.217622 2026] [:error] [pid 33288:tid 33308] [client 52.143.152.19:2731] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "admBvmJmwJFFPEgRHfFz-wAAANI"]
[Sat Apr 11 07:03:27.132506 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:35973] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "admBv4kdEsz5NeAq8w1gvQAAAQ4"]
[Sat Apr 11 07:03:27.799170 2026] [:error] [pid 33171:tid 33197] [client 52.143.152.19:61347] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "admBv7oqTMlo30hcVw97gQAAAAs"]
[Sat Apr 11 07:03:28.365252 2026] [:error] [pid 33171:tid 33193] [client 52.143.152.19:21923] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fetch.php"] [unique_id "admBwLoqTMlo30hcVw97hAAAAAc"]
[Sat Apr 11 07:03:29.004724 2026] [:error] [pid 33171:tid 33190] [client 52.143.152.19:54320] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "admBwboqTMlo30hcVw97hQAAAAQ"]
[Sat Apr 11 07:03:29.644764 2026] [:error] [pid 33173:tid 33256] [client 52.143.152.19:48781] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "admBwa8109xRDP2izWgC7wAAAIs"]
[Sat Apr 11 07:03:30.655809 2026] [:error] [pid 33288:tid 33293] [client 52.143.152.19:54335] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "admBwmJmwJFFPEgRHfF0AgAAAMM"]
[Sat Apr 11 07:03:31.490156 2026] [:error] [pid 33288:tid 33292] [client 52.143.152.19:61363] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "admBw2JmwJFFPEgRHfF0BwAAAMI"]
[Sat Apr 11 07:03:32.275438 2026] [:error] [pid 33173:tid 33260] [client 52.143.152.19:48816] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "admBxK8109xRDP2izWgC_AAAAI8"]
[Sat Apr 11 07:03:32.974541 2026] [:error] [pid 33172:tid 33222] [client 52.143.152.19:2713] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "admBxDn2G0IJw5EZY9ldtwAAAEQ"]
[Sat Apr 11 07:03:33.797226 2026] [:error] [pid 33288:tid 33298] [client 52.143.152.19:2959] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "admBxWJmwJFFPEgRHfF0DQAAAMg"]
[Sat Apr 11 07:03:34.602622 2026] [:error] [pid 33173:tid 33266] [client 52.143.152.19:2952] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "admBxq8109xRDP2izWgDFwAAAJU"]
[Sat Apr 11 07:03:35.850485 2026] [:error] [pid 15244:tid 15247] [client 52.143.152.19:61348] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "admBx4kdEsz5NeAq8w1g0gAAAQE"]
[Sat Apr 11 07:03:37.110731 2026] [:error] [pid 15244:tid 15248] [client 52.143.152.19:2996] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "admByYkdEsz5NeAq8w1g2gAAAQI"]
[Sat Apr 11 07:03:38.040178 2026] [:error] [pid 33173:tid 33266] [client 52.143.152.19:2690] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "admByq8109xRDP2izWgDIgAAAJU"]
[Sat Apr 11 07:03:38.753060 2026] [:error] [pid 15244:tid 15261] [client 52.143.152.19:21904] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oircv.php"] [unique_id "admByokdEsz5NeAq8w1g4wAAAQ8"]
[Sat Apr 11 07:03:39.733828 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:42881] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "admBy4kdEsz5NeAq8w1g8AAAARQ"]
[Sat Apr 11 07:03:40.259198 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:36018] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "admBzIkdEsz5NeAq8w1g9wAAAQo"]
[Sat Apr 11 07:03:40.901913 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:20047] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "admBzIkdEsz5NeAq8w1g_AAAARQ"]
[Sat Apr 11 07:03:41.893676 2026] [:error] [pid 33172:tid 33223] [client 52.143.152.19:21942] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blnux.php"] [unique_id "admBzTn2G0IJw5EZY9ldzgAAAEU"]
[Sat Apr 11 07:03:42.525553 2026] [:error] [pid 33172:tid 33220] [client 52.143.152.19:61343] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "admBzjn2G0IJw5EZY9ld0wAAAEI"]
[Sat Apr 11 07:03:43.248502 2026] [:error] [pid 33171:tid 33191] [client 52.143.152.19:2971] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "admBz7oqTMlo30hcVw97ngAAAAU"]
[Sat Apr 11 07:03:43.843570 2026] [:error] [pid 33172:tid 33224] [client 52.143.152.19:22430] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "admBzzn2G0IJw5EZY9ld3QAAAEY"]
[Sat Apr 11 07:03:44.498915 2026] [:error] [pid 33173:tid 33250] [client 52.143.152.19:22433] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "admB0K8109xRDP2izWgDLAAAAIU"]
[Sat Apr 11 07:03:45.189705 2026] [proxy_fcgi:error] [pid 15244:tid 15262] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:45.442671 2026] [proxy_fcgi:error] [pid 15244:tid 15259] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:45.678456 2026] [proxy_fcgi:error] [pid 15244:tid 15247] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:45.913848 2026] [proxy_fcgi:error] [pid 15244:tid 15251] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:46.149760 2026] [proxy_fcgi:error] [pid 15244:tid 15252] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:46.385299 2026] [proxy_fcgi:error] [pid 15244:tid 15270] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:46.630435 2026] [proxy_fcgi:error] [pid 15244:tid 15263] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:46.867902 2026] [proxy_fcgi:error] [pid 15244:tid 15269] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:47.103790 2026] [proxy_fcgi:error] [pid 15244:tid 15267] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:47.351706 2026] [proxy_fcgi:error] [pid 15244:tid 15260] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:47.586758 2026] [proxy_fcgi:error] [pid 15244:tid 15249] [client 52.143.152.19:36008] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:03:47.820428 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:36008] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpb.php"] [unique_id "admB04kdEsz5NeAq8w1hHAAAAQ0"]
[Sat Apr 11 07:03:48.454561 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:46324] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpb.php"] [unique_id "admB1IkdEsz5NeAq8w1hHQAAARQ"]
[Sat Apr 11 07:03:49.032008 2026] [:error] [pid 33172:tid 33242] [client 52.143.152.19:61345] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpb.php"] [unique_id "admB1Tn2G0IJw5EZY9ld7gAAAFg"]
[Sat Apr 11 07:03:50.181934 2026] [:error] [pid 15244:tid 15255] [client 52.143.152.19:54322] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpb.php"] [unique_id "admB1okdEsz5NeAq8w1hHwAAAQk"]
[Sat Apr 11 07:03:50.729455 2026] [:error] [pid 15244:tid 15267] [client 52.143.152.19:54278] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "admB1okdEsz5NeAq8w1hJQAAARU"]
[Sat Apr 11 07:03:51.347441 2026] [:error] [pid 15244:tid 15247] [client 52.143.152.19:22451] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "admB14kdEsz5NeAq8w1hKQAAAQE"]
[Sat Apr 11 07:03:52.309252 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:2979] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "admB2GJmwJFFPEgRHfF0HgAAAMk"]
[Sat Apr 11 07:03:53.147863 2026] [:error] [pid 33173:tid 33258] [client 52.143.152.19:37300] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "admB2a8109xRDP2izWgDQgAAAI0"]
[Sat Apr 11 07:03:54.044958 2026] [:error] [pid 33173:tid 33263] [client 52.143.152.19:39214] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "admB2q8109xRDP2izWgDQwAAAJI"]
[Sat Apr 11 07:03:54.559796 2026] [:error] [pid 33288:tid 33291] [client 52.143.152.19:61356] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "admB2mJmwJFFPEgRHfF0JgAAAME"]
[Sat Apr 11 07:03:55.295967 2026] [:error] [pid 15244:tid 15267] [client 52.143.152.19:46277] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "admB24kdEsz5NeAq8w1hRQAAARU"]
[Sat Apr 11 07:03:56.130775 2026] [:error] [pid 33288:tid 33304] [client 52.143.152.19:2955] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "admB3GJmwJFFPEgRHfF0KQAAAM4"]
[Sat Apr 11 07:03:56.892283 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:36025] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "admB3IkdEsz5NeAq8w1hTgAAAQw"]
[Sat Apr 11 07:03:57.551398 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:12957] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "admB3YkdEsz5NeAq8w1hVAAAARI"]
[Sat Apr 11 07:03:58.411721 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:61338] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "admB3okdEsz5NeAq8w1hXAAAAQo"]
[Sat Apr 11 07:03:59.099299 2026] [:error] [pid 33288:tid 33313] [client 52.143.152.19:38637] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxl.php"] [unique_id "admB32JmwJFFPEgRHfF0MgAAANc"]
[Sat Apr 11 07:03:59.862508 2026] [:error] [pid 15244:tid 15250] [client 52.143.152.19:37280] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "admB34kdEsz5NeAq8w1hZgAAAQQ"]
[Sat Apr 11 07:04:00.627194 2026] [:error] [pid 33288:tid 33309] [client 52.143.152.19:48815] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "admB4GJmwJFFPEgRHfF0RQAAANM"]
[Sat Apr 11 07:04:01.252325 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:20039] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "admB4YkdEsz5NeAq8w1hagAAAQw"]
[Sat Apr 11 07:04:01.878934 2026] [:error] [pid 33171:tid 33206] [client 52.143.152.19:22412] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "admB4boqTMlo30hcVw97wwAAABQ"]
[Sat Apr 11 07:04:02.607075 2026] [:error] [pid 33171:tid 33205] [client 52.143.152.19:37265] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "admB4roqTMlo30hcVw97xwAAABM"]
[Sat Apr 11 07:04:03.545951 2026] [:error] [pid 33173:tid 33252] [client 52.143.152.19:35986] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "admB468109xRDP2izWgDWAAAAIc"]
[Sat Apr 11 07:04:04.049138 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:2343] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "admB5IkdEsz5NeAq8w1hdQAAAQs"]
[Sat Apr 11 07:04:04.807018 2026] [:error] [pid 33171:tid 33200] [client 52.143.152.19:2957] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "admB5LoqTMlo30hcVw970AAAAA4"]
[Sat Apr 11 07:04:05.702520 2026] [:error] [pid 15244:tid 15262] [client 52.143.152.19:2707] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "admB5YkdEsz5NeAq8w1hfAAAARA"]
[Sat Apr 11 07:04:07.219583 2026] [:error] [pid 33172:tid 33230] [client 52.143.152.19:54331] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "admB5zn2G0IJw5EZY9leDAAAAEw"]
[Sat Apr 11 07:04:08.379186 2026] [:error] [pid 15244:tid 15250] [client 52.143.152.19:21906] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "admB6IkdEsz5NeAq8w1hkwAAAQQ"]
[Sat Apr 11 07:04:09.704974 2026] [:error] [pid 33173:tid 33264] [client 52.143.152.19:37257] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "admB6a8109xRDP2izWgDYgAAAJM"]
[Sat Apr 11 07:04:10.853543 2026] [:error] [pid 33172:tid 33235] [client 52.143.152.19:36001] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "admB6jn2G0IJw5EZY9leDgAAAFE"]
[Sat Apr 11 07:04:11.422345 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:48824] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "admB62JmwJFFPEgRHfF0bAAAAMk"]
[Sat Apr 11 07:04:12.594318 2026] [:error] [pid 33173:tid 33260] [client 52.143.152.19:37299] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "admB7K8109xRDP2izWgDawAAAI8"]
[Sat Apr 11 07:04:13.593143 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:2318] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "admB7YkdEsz5NeAq8w1hsQAAAQ0"]
[Sat Apr 11 07:04:14.314722 2026] [:error] [pid 15244:tid 15269] [client 52.143.152.19:37275] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "admB7okdEsz5NeAq8w1hswAAARc"]
[Sat Apr 11 07:04:15.151690 2026] [:error] [pid 33288:tid 33305] [client 52.143.152.19:46313] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "admB72JmwJFFPEgRHfF0jAAAAM8"]
[Sat Apr 11 07:04:15.703827 2026] [:error] [pid 33172:tid 33234] [client 52.143.152.19:35982] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "admB7zn2G0IJw5EZY9leFgAAAFA"]
[Sat Apr 11 07:04:16.424330 2026] [:error] [pid 33172:tid 33225] [client 52.143.152.19:2721] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "admB8Dn2G0IJw5EZY9leHgAAAEc"]
[Sat Apr 11 07:04:17.203104 2026] [:error] [pid 33288:tid 33295] [client 52.143.152.19:42935] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "admB8WJmwJFFPEgRHfF0kwAAAMU"]
[Sat Apr 11 07:04:17.857558 2026] [:error] [pid 33172:tid 33242] [client 52.143.152.19:22408] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "admB8Tn2G0IJw5EZY9leKQAAAFg"]
[Sat Apr 11 07:04:18.479314 2026] [:error] [pid 33172:tid 33232] [client 52.143.152.19:61361] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "admB8jn2G0IJw5EZY9leLQAAAE4"]
[Sat Apr 11 07:04:19.023759 2026] [:error] [pid 33172:tid 33239] [client 52.143.152.19:48805] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "admB8zn2G0IJw5EZY9leMQAAAFU"]
[Sat Apr 11 07:04:19.546741 2026] [:error] [pid 33172:tid 33240] [client 52.143.152.19:20084] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "admB8zn2G0IJw5EZY9leNAAAAFY"]
[Sat Apr 11 07:04:20.285286 2026] [:error] [pid 15244:tid 15248] [client 52.143.152.19:42898] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "admB9IkdEsz5NeAq8w1huwAAAQI"]
[Sat Apr 11 07:04:21.020357 2026] [:error] [pid 33171:tid 33200] [client 52.143.152.19:42899] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "admB9boqTMlo30hcVw974wAAAA4"]
[Sat Apr 11 07:04:21.588737 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:48769] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iindv.php"] [unique_id "admB9YkdEsz5NeAq8w1hwwAAAQw"]
[Sat Apr 11 07:04:22.114707 2026] [:error] [pid 33288:tid 33308] [client 52.143.152.19:35974] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maintura.php"] [unique_id "admB9mJmwJFFPEgRHfF0owAAANI"]
[Sat Apr 11 07:04:22.948018 2026] [:error] [pid 15244:tid 15250] [client 52.143.152.19:35989] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maintura.php"] [unique_id "admB9okdEsz5NeAq8w1hzAAAAQQ"]
[Sat Apr 11 07:04:23.876559 2026] [:error] [pid 15244:tid 15254] [client 52.143.152.19:37298] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maintura.php"] [unique_id "admB94kdEsz5NeAq8w1h0wAAAQg"]
[Sat Apr 11 07:04:24.719835 2026] [:error] [pid 15244:tid 15255] [client 52.143.152.19:36013] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maintura.php"] [unique_id "admB-IkdEsz5NeAq8w1h3AAAAQk"]
[Sat Apr 11 07:04:25.627051 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:48808] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "admB-YkdEsz5NeAq8w1h5wAAAQs"]
[Sat Apr 11 07:04:26.284934 2026] [:error] [pid 33288:tid 33301] [client 52.143.152.19:36024] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "admB-mJmwJFFPEgRHfF0pwAAAMs"]
[Sat Apr 11 07:04:27.037573 2026] [:error] [pid 15244:tid 15268] [client 52.143.152.19:46276] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "admB-4kdEsz5NeAq8w1h8wAAARY"]
[Sat Apr 11 07:04:27.877671 2026] [:error] [pid 33171:tid 33208] [client 52.143.152.19:2994] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "admB-7oqTMlo30hcVw976AAAABY"]
[Sat Apr 11 07:04:29.079563 2026] [:error] [pid 33171:tid 33197] [client 52.143.152.19:61371] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "admB_boqTMlo30hcVw976gAAAAs"]
[Sat Apr 11 07:04:30.425074 2026] [:error] [pid 33288:tid 33293] [client 52.143.152.19:54293] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "admB_mJmwJFFPEgRHfF0swAAAMM"]
[Sat Apr 11 07:04:31.089080 2026] [:error] [pid 33172:tid 33225] [client 52.143.152.19:2723] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "admB_zn2G0IJw5EZY9leQgAAAEc"]
[Sat Apr 11 07:04:31.949693 2026] [:error] [pid 33171:tid 33193] [client 52.143.152.19:46306] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "admB_7oqTMlo30hcVw977QAAAAc"]
[Sat Apr 11 07:04:32.929381 2026] [:error] [pid 15244:tid 15261] [client 52.143.152.19:42941] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "admCAIkdEsz5NeAq8w1iDAAAAQ8"]
[Sat Apr 11 07:04:33.731040 2026] [:error] [pid 33288:tid 33291] [client 52.143.152.19:46325] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "admCAWJmwJFFPEgRHfF0wgAAAME"]
[Sat Apr 11 07:04:34.647386 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:34837] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "admCAokdEsz5NeAq8w1iEAAAAQw"]
[Sat Apr 11 07:04:35.745756 2026] [:error] [pid 15244:tid 15253] [client 52.143.152.19:34829] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "admCA4kdEsz5NeAq8w1iGQAAAQc"]
[Sat Apr 11 07:04:36.528599 2026] [:error] [pid 15244:tid 15246] [client 52.143.152.19:20064] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "admCBIkdEsz5NeAq8w1iIgAAAQA"]
[Sat Apr 11 07:04:37.151149 2026] [:error] [pid 15244:tid 15261] [client 52.143.152.19:2724] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "admCBYkdEsz5NeAq8w1iKAAAAQ8"]
[Sat Apr 11 07:04:38.206804 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:2750] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "admCBokdEsz5NeAq8w1iLQAAAQ0"]
[Sat Apr 11 07:04:39.641706 2026] [:error] [pid 33171:tid 33196] [client 52.143.152.19:54274] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "admCB7oqTMlo30hcVw98AAAAAAo"]
[Sat Apr 11 07:04:40.414787 2026] [:error] [pid 15244:tid 15269] [client 52.143.152.19:35993] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "admCCIkdEsz5NeAq8w1iOAAAARc"]
[Sat Apr 11 07:04:41.329321 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:21897] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "admCCYkdEsz5NeAq8w1iQAAAAQ4"]
[Sat Apr 11 07:04:42.718687 2026] [:error] [pid 33172:tid 33223] [client 52.143.152.19:22437] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "admCCjn2G0IJw5EZY9leUQAAAEU"]
[Sat Apr 11 07:04:43.509022 2026] [:error] [pid 33172:tid 33229] [client 52.143.152.19:46290] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "admCCzn2G0IJw5EZY9leUgAAAEs"]
[Sat Apr 11 07:04:44.151797 2026] [:error] [pid 33172:tid 33236] [client 52.143.152.19:2304] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxiviLDIot.php"] [unique_id "admCDDn2G0IJw5EZY9leVQAAAFI"]
[Sat Apr 11 07:04:45.029882 2026] [:error] [pid 33172:tid 33237] [client 52.143.152.19:42903] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxiviLDIot.php"] [unique_id "admCDTn2G0IJw5EZY9leXQAAAFM"]
[Sat Apr 11 07:04:45.922484 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:51863] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxiviLDIot.php"] [unique_id "admCDYkdEsz5NeAq8w1iTwAAAQo"]
[Sat Apr 11 07:04:46.716864 2026] [:error] [pid 33288:tid 33306] [client 52.143.152.19:54289] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxiviLDIot.php"] [unique_id "admCDmJmwJFFPEgRHfF00AAAANA"]
[Sat Apr 11 07:04:47.434161 2026] [proxy_fcgi:error] [pid 33171:tid 33198] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:47.840061 2026] [proxy_fcgi:error] [pid 33171:tid 33188] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:48.124965 2026] [proxy_fcgi:error] [pid 33171:tid 33209] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:48.369038 2026] [proxy_fcgi:error] [pid 33171:tid 33194] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:48.727307 2026] [proxy_fcgi:error] [pid 33171:tid 33187] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:49.043877 2026] [proxy_fcgi:error] [pid 33171:tid 33206] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:49.280012 2026] [proxy_fcgi:error] [pid 33171:tid 33197] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:49.625375 2026] [proxy_fcgi:error] [pid 33171:tid 33191] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:49.887331 2026] [proxy_fcgi:error] [pid 33171:tid 33193] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:50.242874 2026] [proxy_fcgi:error] [pid 33171:tid 33200] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:50.556773 2026] [proxy_fcgi:error] [pid 33171:tid 33186] [client 52.143.152.19:46333] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:04:50.836301 2026] [:error] [pid 33171:tid 33192] [client 52.143.152.19:46333] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "admCEroqTMlo30hcVw98IAAAAAY"]
[Sat Apr 11 07:04:51.750569 2026] [:error] [pid 33171:tid 33198] [client 52.143.152.19:42893] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "admCE7oqTMlo30hcVw98IwAAAAw"]
[Sat Apr 11 07:04:53.077532 2026] [:error] [pid 33171:tid 33194] [client 52.143.152.19:54291] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "admCFboqTMlo30hcVw98KAAAAAg"]
[Sat Apr 11 07:04:54.080870 2026] [:error] [pid 33173:tid 33268] [client 52.143.152.19:2726] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "admCFq8109xRDP2izWgDtAAAAJc"]
[Sat Apr 11 07:04:54.723432 2026] [:error] [pid 33172:tid 33241] [client 52.143.152.19:48768] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCFjn2G0IJw5EZY9ledgAAAFc"]
[Sat Apr 11 07:04:55.286571 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:2716] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCF4kdEsz5NeAq8w1ibQAAAQ0"]
[Sat Apr 11 07:04:56.037374 2026] [:error] [pid 15244:tid 15254] [client 52.143.152.19:37284] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCGIkdEsz5NeAq8w1idgAAAQg"]
[Sat Apr 11 07:04:57.711301 2026] [:error] [pid 15244:tid 15269] [client 52.143.152.19:3004] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCGYkdEsz5NeAq8w1ifQAAARc"]
[Sat Apr 11 07:04:58.793404 2026] [:error] [pid 15244:tid 15250] [client 52.143.152.19:2715] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "admCGokdEsz5NeAq8w1iggAAAQQ"]
[Sat Apr 11 07:05:00.188133 2026] [:error] [pid 33288:tid 33309] [client 52.143.152.19:46287] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "admCHGJmwJFFPEgRHfF08gAAANM"]
[Sat Apr 11 07:05:01.560692 2026] [:error] [pid 33172:tid 33229] [client 52.143.152.19:42943] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "admCHTn2G0IJw5EZY9legAAAAEs"]
[Sat Apr 11 07:05:03.738229 2026] [:error] [pid 33171:tid 33203] [client 52.143.152.19:48807] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "admCH7oqTMlo30hcVw98NAAAABE"]
[Sat Apr 11 07:05:04.869049 2026] [:error] [pid 33172:tid 33234] [client 52.143.152.19:61367] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "admCIDn2G0IJw5EZY9lehQAAAFA"]
[Sat Apr 11 07:05:06.996398 2026] [:error] [pid 33288:tid 33311] [client 52.143.152.19:35971] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "admCImJmwJFFPEgRHfF1BgAAANU"]
[Sat Apr 11 07:05:07.953759 2026] [:error] [pid 33288:tid 33303] [client 52.143.152.19:36025] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "admCI2JmwJFFPEgRHfF1DQAAAM0"]
[Sat Apr 11 07:05:09.066219 2026] [:error] [pid 33173:tid 33266] [client 52.143.152.19:2718] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "admCJa8109xRDP2izWgDzAAAAJU"]
[Sat Apr 11 07:05:10.490937 2026] [:error] [pid 15244:tid 15247] [client 52.143.152.19:51902] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "admCJokdEsz5NeAq8w1ilQAAAQE"]
[Sat Apr 11 07:05:11.259121 2026] [:error] [pid 33171:tid 33210] [client 52.143.152.19:37273] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "admCJ7oqTMlo30hcVw98OQAAABg"]
[Sat Apr 11 07:05:11.999324 2026] [:error] [pid 15244:tid 15263] [client 52.143.152.19:54314] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "admCJ4kdEsz5NeAq8w1imAAAARE"]
[Sat Apr 11 07:05:12.870100 2026] [:error] [pid 33288:tid 33307] [client 52.143.152.19:48778] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "admCKGJmwJFFPEgRHfF1EwAAANE"]
[Sat Apr 11 07:05:13.713206 2026] [:error] [pid 15244:tid 15254] [client 52.143.152.19:22428] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "admCKYkdEsz5NeAq8w1inwAAAQg"]
[Sat Apr 11 07:05:14.508905 2026] [:error] [pid 15244:tid 15268] [client 52.143.152.19:46307] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "admCKokdEsz5NeAq8w1iowAAARY"]
[Sat Apr 11 07:05:15.657080 2026] [:error] [pid 33172:tid 33226] [client 52.143.152.19:61344] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "admCKzn2G0IJw5EZY9lekgAAAEg"]
[Sat Apr 11 07:05:16.587133 2026] [:error] [pid 33172:tid 33236] [client 52.143.152.19:37253] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "admCLDn2G0IJw5EZY9lekwAAAFI"]
[Sat Apr 11 07:05:17.238596 2026] [:error] [pid 33173:tid 33253] [client 52.143.152.19:2349] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "admCLa8109xRDP2izWgD2gAAAIg"]
[Sat Apr 11 07:05:17.861063 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:37301] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "admCLYkdEsz5NeAq8w1ipwAAAQw"]
[Sat Apr 11 07:05:18.419608 2026] [:error] [pid 15244:tid 15262] [client 52.143.152.19:20032] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "admCLokdEsz5NeAq8w1iqgAAARA"]
[Sat Apr 11 07:05:18.943348 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:61370] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "admCLokdEsz5NeAq8w1irAAAAQs"]
[Sat Apr 11 07:05:19.480144 2026] [:error] [pid 33173:tid 33259] [client 52.143.152.19:2703] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "admCL68109xRDP2izWgD3QAAAI4"]
[Sat Apr 11 07:05:20.114736 2026] [:error] [pid 33171:tid 33209] [client 52.143.152.19:37990] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "admCMLoqTMlo30hcVw98QgAAABc"]
[Sat Apr 11 07:05:20.600159 2026] [:error] [pid 15244:tid 15252] [client 52.143.152.19:21922] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "admCMIkdEsz5NeAq8w1isAAAAQY"]
[Sat Apr 11 07:05:21.271840 2026] [:error] [pid 33173:tid 33262] [client 52.143.152.19:2366] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "admCMa8109xRDP2izWgD4QAAAJE"]
[Sat Apr 11 07:05:21.867065 2026] [:error] [pid 15244:tid 15253] [client 52.143.152.19:38632] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "admCMYkdEsz5NeAq8w1iswAAAQc"]
[Sat Apr 11 07:05:22.631059 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:35981] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "admCMokdEsz5NeAq8w1itgAAAQw"]
[Sat Apr 11 07:05:23.329061 2026] [:error] [pid 33173:tid 33245] [client 52.143.152.19:20058] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "admCM68109xRDP2izWgD5AAAAIA"]
[Sat Apr 11 07:05:23.929598 2026] [:error] [pid 15244:tid 15247] [client 52.143.152.19:38645] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "admCM4kdEsz5NeAq8w1iuwAAAQE"]
[Sat Apr 11 07:05:24.791945 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:14544] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "admCNIkdEsz5NeAq8w1ivwAAAQo"]
[Sat Apr 11 07:05:25.491341 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:2762] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "admCNYkdEsz5NeAq8w1iwgAAAQw"]
[Sat Apr 11 07:05:26.459024 2026] [:error] [pid 33171:tid 33188] [client 52.143.152.19:48770] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "admCNroqTMlo30hcVw98SQAAAAI"]
[Sat Apr 11 07:05:27.394753 2026] [:error] [pid 33172:tid 33223] [client 52.143.152.19:20068] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "admCNzn2G0IJw5EZY9lenQAAAEU"]
[Sat Apr 11 07:05:28.702845 2026] [:error] [pid 33173:tid 33252] [client 52.143.152.19:61352] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCOK8109xRDP2izWgD5wAAAIc"]
[Sat Apr 11 07:05:31.473873 2026] [:error] [pid 33172:tid 33220] [client 52.143.152.19:2342] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCOzn2G0IJw5EZY9leowAAAEI"]
[Sat Apr 11 07:05:34.904755 2026] [:error] [pid 33288:tid 33291] [client 52.143.152.19:61333] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCPmJmwJFFPEgRHfF1LAAAAME"]
[Sat Apr 11 07:05:36.060656 2026] [:error] [pid 33172:tid 33222] [client 52.143.152.19:20048] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCQDn2G0IJw5EZY9lerAAAAEQ"]
[Sat Apr 11 07:05:37.130384 2026] [:error] [pid 15244:tid 15267] [client 52.143.152.19:20092] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "admCQYkdEsz5NeAq8w1i0AAAARU"]
[Sat Apr 11 07:05:38.145810 2026] [:error] [pid 33288:tid 33304] [client 52.143.152.19:2313] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "admCQmJmwJFFPEgRHfF1LgAAAM4"]
[Sat Apr 11 07:05:39.717495 2026] [:error] [pid 15244:tid 15265] [client 52.143.152.19:42895] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "admCQ4kdEsz5NeAq8w1i1AAAARM"]
[Sat Apr 11 07:05:40.426995 2026] [:error] [pid 33288:tid 33305] [client 52.143.152.19:37294] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "admCRGJmwJFFPEgRHfF1MgAAAM8"]
[Sat Apr 11 07:05:41.114452 2026] [:error] [pid 33171:tid 33198] [client 52.143.152.19:46320] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "admCRboqTMlo30hcVw98ZAAAAAw"]
[Sat Apr 11 07:05:42.014142 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:21909] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "admCRokdEsz5NeAq8w1i2gAAAQo"]
[Sat Apr 11 07:05:42.698714 2026] [:error] [pid 15244:tid 15263] [client 52.143.152.19:62798] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "admCRokdEsz5NeAq8w1i3wAAARE"]
[Sat Apr 11 07:05:43.477599 2026] [:error] [pid 33172:tid 33232] [client 52.143.152.19:51877] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "admCRzn2G0IJw5EZY9lezgAAAE4"]
[Sat Apr 11 07:05:44.334166 2026] [:error] [pid 33172:tid 33218] [client 52.143.152.19:54273] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "admCSDn2G0IJw5EZY9le0gAAAEA"]
[Sat Apr 11 07:05:45.210057 2026] [:error] [pid 15244:tid 15262] [client 52.143.152.19:2950] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "admCSYkdEsz5NeAq8w1jBgAAARA"]
[Sat Apr 11 07:05:46.131596 2026] [:error] [pid 33172:tid 33228] [client 52.143.152.19:54276] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "admCSjn2G0IJw5EZY9le1QAAAEo"]
[Sat Apr 11 07:05:47.767010 2026] [:error] [pid 33173:tid 33245] [client 52.143.152.19:42925] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "admCS68109xRDP2izWgEBgAAAIA"]
[Sat Apr 11 07:05:49.190220 2026] [:error] [pid 33173:tid 33259] [client 52.143.152.19:3006] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "admCTa8109xRDP2izWgEDQAAAI4"]
[Sat Apr 11 07:05:50.180418 2026] [proxy_fcgi:error] [pid 33172:tid 33225] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:50.417880 2026] [proxy_fcgi:error] [pid 33172:tid 33227] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:50.655767 2026] [proxy_fcgi:error] [pid 33172:tid 33239] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:50.893084 2026] [proxy_fcgi:error] [pid 33172:tid 33231] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:51.130166 2026] [proxy_fcgi:error] [pid 33172:tid 33234] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:51.428318 2026] [proxy_fcgi:error] [pid 33172:tid 33240] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:51.686220 2026] [proxy_fcgi:error] [pid 33172:tid 33220] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:51.924152 2026] [proxy_fcgi:error] [pid 33172:tid 33235] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:52.162506 2026] [proxy_fcgi:error] [pid 33172:tid 33218] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:52.399810 2026] [proxy_fcgi:error] [pid 33172:tid 33230] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:52.636185 2026] [proxy_fcgi:error] [pid 33172:tid 33242] [client 52.143.152.19:21911] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:05:52.870312 2026] [:error] [pid 33172:tid 33236] [client 52.143.152.19:21911] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "admCUDn2G0IJw5EZY9le5wAAAFI"]
[Sat Apr 11 07:05:53.375496 2026] [:error] [pid 33173:tid 33263] [client 52.143.152.19:2954] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "admCUa8109xRDP2izWgEFAAAAJI"]
[Sat Apr 11 07:05:53.954536 2026] [:error] [pid 33171:tid 33204] [client 52.143.152.19:3002] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "admCUboqTMlo30hcVw98lgAAABI"]
[Sat Apr 11 07:05:54.523004 2026] [:error] [pid 33171:tid 33207] [client 52.143.152.19:35992] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "admCUroqTMlo30hcVw98lwAAABU"]
[Sat Apr 11 07:05:55.159610 2026] [:error] [pid 33288:tid 33306] [client 52.143.152.19:21906] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "admCU2JmwJFFPEgRHfF1TQAAANA"]
[Sat Apr 11 07:05:55.690700 2026] [:error] [pid 33288:tid 33310] [client 52.143.152.19:2989] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "admCU2JmwJFFPEgRHfF1TwAAANQ"]
[Sat Apr 11 07:05:56.284654 2026] [:error] [pid 33288:tid 33309] [client 52.143.152.19:46281] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "admCVGJmwJFFPEgRHfF1VQAAANM"]
[Sat Apr 11 07:05:56.805276 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:20071] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "admCVIkdEsz5NeAq8w1jYwAAAQo"]
[Sat Apr 11 07:05:57.331387 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:46299] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "admCVYkdEsz5NeAq8w1jZwAAAQ4"]
[Sat Apr 11 07:05:57.951853 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:21908] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "admCVWJmwJFFPEgRHfF1WgAAAMk"]
[Sat Apr 11 07:05:58.468713 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:37293] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "admCVokdEsz5NeAq8w1jcQAAARQ"]
[Sat Apr 11 07:05:59.001846 2026] [:error] [pid 15244:tid 15255] [client 52.143.152.19:46296] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "admCV4kdEsz5NeAq8w1jfAAAAQk"]
[Sat Apr 11 07:05:59.558855 2026] [:error] [pid 33172:tid 33222] [client 52.143.152.19:54283] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCVzn2G0IJw5EZY9le9AAAAEQ"]
[Sat Apr 11 07:06:00.227860 2026] [:error] [pid 33288:tid 33309] [client 52.143.152.19:36003] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCWGJmwJFFPEgRHfF1YgAAANM"]
[Sat Apr 11 07:06:01.038839 2026] [:error] [pid 33288:tid 33310] [client 52.143.152.19:37251] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCWWJmwJFFPEgRHfF1ZwAAANQ"]
[Sat Apr 11 07:06:01.609613 2026] [:error] [pid 33171:tid 33201] [client 52.143.152.19:42924] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file61.php"] [unique_id "admCWboqTMlo30hcVw98pQAAAA8"]
[Sat Apr 11 07:06:02.109309 2026] [:error] [pid 33173:tid 33259] [client 52.143.152.19:54308] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "admCWq8109xRDP2izWgEIgAAAI4"]
[Sat Apr 11 07:06:02.645785 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:21889] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "admCWokdEsz5NeAq8w1jigAAARQ"]
[Sat Apr 11 07:06:03.201053 2026] [:error] [pid 33173:tid 33263] [client 52.143.152.19:38642] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "admCW68109xRDP2izWgEJwAAAJI"]
[Sat Apr 11 07:06:03.875043 2026] [:error] [pid 33172:tid 33242] [client 52.143.152.19:54332] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "admCWzn2G0IJw5EZY9le-gAAAFg"]
[Sat Apr 11 07:06:04.462900 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:2794] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "admCXIkdEsz5NeAq8w1jiwAAARI"]
[Sat Apr 11 07:06:05.053649 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:42884] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "admCXYkdEsz5NeAq8w1jkgAAAQs"]
[Sat Apr 11 07:06:05.814940 2026] [:error] [pid 33173:tid 33251] [client 52.143.152.19:2336] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "admCXa8109xRDP2izWgELgAAAIY"]
[Sat Apr 11 07:06:06.522652 2026] [:error] [pid 33171:tid 33199] [client 52.143.152.19:38014] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "admCXroqTMlo30hcVw98qwAAAA0"]
[Sat Apr 11 07:06:07.047725 2026] [:error] [pid 33288:tid 33307] [client 52.143.152.19:54295] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCX2JmwJFFPEgRHfF1iAAAANE"]
[Sat Apr 11 07:06:07.616636 2026] [:error] [pid 33288:tid 33306] [client 52.143.152.19:2722] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCX2JmwJFFPEgRHfF1iwAAANA"]
[Sat Apr 11 07:06:08.121322 2026] [:error] [pid 33173:tid 33264] [client 52.143.152.19:21893] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCYK8109xRDP2izWgENQAAAJM"]
[Sat Apr 11 07:06:08.677331 2026] [:error] [pid 33172:tid 33242] [client 52.143.152.19:48794] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "admCYDn2G0IJw5EZY9lfDAAAAFg"]
[Sat Apr 11 07:06:09.276954 2026] [:error] [pid 15244:tid 15261] [client 52.143.152.19:12686] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "admCYYkdEsz5NeAq8w1jnQAAAQ8"]
[Sat Apr 11 07:06:10.039518 2026] [:error] [pid 15244:tid 15253] [client 52.143.152.19:35987] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "admCYokdEsz5NeAq8w1jpAAAAQc"]
[Sat Apr 11 07:06:10.541694 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:36022] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "admCYokdEsz5NeAq8w1jqQAAARI"]
[Sat Apr 11 07:06:11.149413 2026] [:error] [pid 15244:tid 15269] [client 52.143.152.19:21932] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "admCY4kdEsz5NeAq8w1jrAAAARc"]
[Sat Apr 11 07:06:11.745902 2026] [:error] [pid 33172:tid 33234] [client 52.143.152.19:21912] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "admCYzn2G0IJw5EZY9lfEgAAAFA"]
[Sat Apr 11 07:06:12.303489 2026] [:error] [pid 33173:tid 33259] [client 52.143.152.19:48792] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "admCZK8109xRDP2izWgEOwAAAI4"]
[Sat Apr 11 07:06:12.825298 2026] [:error] [pid 33173:tid 33267] [client 52.143.152.19:2984] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "admCZK8109xRDP2izWgEPQAAAJY"]
[Sat Apr 11 07:06:13.328474 2026] [:error] [pid 33171:tid 33194] [client 52.143.152.19:2976] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "admCZboqTMlo30hcVw98swAAAAg"]
[Sat Apr 11 07:06:13.828450 2026] [:error] [pid 33172:tid 33220] [client 52.143.152.19:48790] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "admCZTn2G0IJw5EZY9lfFAAAAEI"]
[Sat Apr 11 07:06:14.316875 2026] [:error] [pid 33171:tid 33206] [client 52.143.152.19:2976] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "admCZroqTMlo30hcVw98tgAAABQ"]
[Sat Apr 11 07:06:14.793396 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:37272] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "admCZokdEsz5NeAq8w1jvgAAAQw"]
[Sat Apr 11 07:06:15.317100 2026] [:error] [pid 15244:tid 15251] [client 52.143.152.19:35985] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "admCZ4kdEsz5NeAq8w1jwgAAAQU"]
[Sat Apr 11 07:06:15.860836 2026] [:error] [pid 15244:tid 15246] [client 52.143.152.19:38653] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "admCZ4kdEsz5NeAq8w1jxgAAAQA"]
[Sat Apr 11 07:06:16.373895 2026] [:error] [pid 15244:tid 15257] [client 52.143.152.19:22457] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "admCaIkdEsz5NeAq8w1jzQAAAQs"]
[Sat Apr 11 07:06:16.902871 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:20061] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "admCaIkdEsz5NeAq8w1j0wAAAQw"]
[Sat Apr 11 07:06:17.455338 2026] [:error] [pid 15244:tid 15251] [client 52.143.152.19:21914] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "admCaYkdEsz5NeAq8w1j2AAAAQU"]
[Sat Apr 11 07:06:17.926060 2026] [:error] [pid 15244:tid 15256] [client 52.143.152.19:38607] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "admCaYkdEsz5NeAq8w1j2wAAAQo"]
[Sat Apr 11 07:06:18.425852 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:2746] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "admCaokdEsz5NeAq8w1j4gAAAQ0"]
[Sat Apr 11 07:06:18.938518 2026] [:error] [pid 33172:tid 33238] [client 52.143.152.19:48797] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "admCajn2G0IJw5EZY9lfGQAAAFQ"]
[Sat Apr 11 07:06:19.414308 2026] [:error] [pid 15244:tid 15253] [client 52.143.152.19:12990] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "admCa4kdEsz5NeAq8w1j6wAAAQc"]
[Sat Apr 11 07:06:20.148731 2026] [:error] [pid 15244:tid 15258] [client 52.143.152.19:48821] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "admCbIkdEsz5NeAq8w1j9wAAAQw"]
[Sat Apr 11 07:06:20.690281 2026] [:error] [pid 33173:tid 33260] [client 52.143.152.19:48803] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "admCbK8109xRDP2izWgESAAAAI8"]
[Sat Apr 11 07:06:21.170882 2026] [:error] [pid 15244:tid 15263] [client 52.143.152.19:42942] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "admCbYkdEsz5NeAq8w1j-wAAARE"]
[Sat Apr 11 07:06:21.689428 2026] [:error] [pid 33173:tid 33249] [client 52.143.152.19:20094] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "admCba8109xRDP2izWgESgAAAIQ"]
[Sat Apr 11 07:06:22.223559 2026] [:error] [pid 33172:tid 33225] [client 52.143.152.19:20089] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "admCbjn2G0IJw5EZY9lfIwAAAEc"]
[Sat Apr 11 07:06:22.697746 2026] [:error] [pid 33172:tid 33231] [client 52.143.152.19:2367] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "admCbjn2G0IJw5EZY9lfKAAAAE0"]
[Sat Apr 11 07:06:23.181366 2026] [:error] [pid 33288:tid 33314] [client 52.143.152.19:46303] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "admCb2JmwJFFPEgRHfF1tQAAANg"]
[Sat Apr 11 07:06:23.715576 2026] [:error] [pid 15244:tid 15266] [client 52.143.152.19:13202] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "admCb4kdEsz5NeAq8w1kBAAAARQ"]
[Sat Apr 11 07:06:24.269863 2026] [:error] [pid 15244:tid 15265] [client 52.143.152.19:2358] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "admCcIkdEsz5NeAq8w1kCwAAARM"]
[Sat Apr 11 07:06:24.884228 2026] [:error] [pid 33173:tid 33257] [client 52.143.152.19:42901] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "admCcK8109xRDP2izWgEUAAAAIw"]
[Sat Apr 11 07:06:25.524476 2026] [:error] [pid 33171:tid 33205] [client 52.143.152.19:13224] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "admCcboqTMlo30hcVw98wgAAABM"]
[Sat Apr 11 07:06:26.037857 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:2733] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "admCcokdEsz5NeAq8w1kFgAAARI"]
[Sat Apr 11 07:06:26.578524 2026] [:error] [pid 33173:tid 33254] [client 52.143.152.19:20052] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "admCcq8109xRDP2izWgEUwAAAIk"]
[Sat Apr 11 07:06:27.123695 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:14587] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "admCc4kdEsz5NeAq8w1kHwAAAQ4"]
[Sat Apr 11 07:06:27.597813 2026] [:error] [pid 33173:tid 33253] [client 52.143.152.19:37278] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "admCc68109xRDP2izWgEVAAAAIg"]
[Sat Apr 11 07:06:28.080386 2026] [:error] [pid 33172:tid 33232] [client 52.143.152.19:3005] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "admCdDn2G0IJw5EZY9lfNAAAAE4"]
[Sat Apr 11 07:06:28.576502 2026] [:error] [pid 15244:tid 15249] [client 52.143.152.19:54286] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "admCdIkdEsz5NeAq8w1kJgAAAQM"]
[Sat Apr 11 07:06:29.082011 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:2806] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "admCdYkdEsz5NeAq8w1kLQAAARI"]
[Sat Apr 11 07:06:29.589843 2026] [:error] [pid 33173:tid 33249] [client 52.143.152.19:61353] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "admCda8109xRDP2izWgEVwAAAIQ"]
[Sat Apr 11 07:06:30.097574 2026] [:error] [pid 33172:tid 33235] [client 52.143.152.19:35980] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "admCdjn2G0IJw5EZY9lfNwAAAFE"]
[Sat Apr 11 07:06:30.746753 2026] [:error] [pid 33172:tid 33241] [client 52.143.152.19:48798] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "admCdjn2G0IJw5EZY9lfOwAAAFc"]
[Sat Apr 11 07:06:31.311565 2026] [:error] [pid 33173:tid 33268] [client 52.143.152.19:14539] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "admCd68109xRDP2izWgEWgAAAJc"]
[Sat Apr 11 07:06:31.934153 2026] [:error] [pid 33288:tid 33312] [client 52.143.152.19:2330] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "admCd2JmwJFFPEgRHfF1yAAAANY"]
[Sat Apr 11 07:06:32.566896 2026] [:error] [pid 33172:tid 33228] [client 52.143.152.19:13217] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "admCeDn2G0IJw5EZY9lfPgAAAEo"]
[Sat Apr 11 07:06:33.108376 2026] [:error] [pid 33171:tid 33187] [client 52.143.152.19:61332] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "admCeboqTMlo30hcVw980QAAAAE"]
[Sat Apr 11 07:06:33.700365 2026] [:error] [pid 33172:tid 33221] [client 52.143.152.19:3001] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "admCeTn2G0IJw5EZY9lfQgAAAEM"]
[Sat Apr 11 07:06:34.423147 2026] [:error] [pid 33172:tid 33233] [client 52.143.152.19:2980] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "admCejn2G0IJw5EZY9lfSwAAAE8"]
[Sat Apr 11 07:06:35.086356 2026] [:error] [pid 33288:tid 33301] [client 52.143.152.19:35994] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "admCe2JmwJFFPEgRHfF12wAAAMs"]
[Sat Apr 11 07:06:36.239320 2026] [:error] [pid 33288:tid 33299] [client 52.143.152.19:2709] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "admCfGJmwJFFPEgRHfF14QAAAMk"]
[Sat Apr 11 07:06:36.906641 2026] [:error] [pid 33288:tid 33295] [client 52.143.152.19:2991] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "admCfGJmwJFFPEgRHfF15QAAAMU"]
[Sat Apr 11 07:06:37.809331 2026] [:error] [pid 33288:tid 33292] [client 52.143.152.19:13240] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "admCfWJmwJFFPEgRHfF17gAAAMI"]
[Sat Apr 11 07:06:39.437654 2026] [:error] [pid 33172:tid 33224] [client 52.143.152.19:13190] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nw.php"] [unique_id "admCfzn2G0IJw5EZY9lfWQAAAEY"]
[Sat Apr 11 07:06:40.469118 2026] [:error] [pid 15244:tid 15268] [client 52.143.152.19:21903] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "admCgIkdEsz5NeAq8w1kZgAAARY"]
[Sat Apr 11 07:06:41.150992 2026] [:error] [pid 33288:tid 33294] [client 52.143.152.19:21891] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "admCgWJmwJFFPEgRHfF1_QAAAMQ"]
[Sat Apr 11 07:06:42.041433 2026] [:error] [pid 33288:tid 33305] [client 52.143.152.19:22409] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "admCgmJmwJFFPEgRHfF2AgAAAM8"]
[Sat Apr 11 07:06:42.622675 2026] [:error] [pid 33172:tid 33229] [client 52.143.152.19:20055] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "admCgjn2G0IJw5EZY9lfYgAAAEs"]
[Sat Apr 11 07:06:43.126131 2026] [:error] [pid 33171:tid 33202] [client 52.143.152.19:12702] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "admCg7oqTMlo30hcVw984wAAABA"]
[Sat Apr 11 07:06:43.707583 2026] [:error] [pid 33171:tid 33201] [client 52.143.152.19:2771] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "admCg7oqTMlo30hcVw985gAAAA8"]
[Sat Apr 11 07:06:44.262722 2026] [:error] [pid 15244:tid 15270] [client 52.143.152.19:42919] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "admChIkdEsz5NeAq8w1kdgAAARg"]
[Sat Apr 11 07:06:44.736924 2026] [:error] [pid 15244:tid 15264] [client 52.143.152.19:42892] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "admChIkdEsz5NeAq8w1kdwAAARI"]
[Sat Apr 11 07:06:45.289443 2026] [:error] [pid 33288:tid 33310] [client 52.143.152.19:17935] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "admChWJmwJFFPEgRHfF2EQAAANQ"]
[Sat Apr 11 07:06:45.768224 2026] [:error] [pid 33172:tid 33230] [client 52.143.152.19:42922] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "admChTn2G0IJw5EZY9lfawAAAEw"]
[Sat Apr 11 07:06:46.332458 2026] [:error] [pid 33173:tid 33255] [client 52.143.152.19:21890] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "admChq8109xRDP2izWgEdwAAAIo"]
[Sat Apr 11 07:06:46.806544 2026] [:error] [pid 33171:tid 33192] [client 52.143.152.19:13230] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "admChroqTMlo30hcVw989AAAAAY"]
[Sat Apr 11 07:06:47.285086 2026] [:error] [pid 15244:tid 15250] [client 52.143.152.19:61324] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "admCh4kdEsz5NeAq8w1kiQAAAQQ"]
[Sat Apr 11 07:06:47.764426 2026] [:error] [pid 33171:tid 33206] [client 52.143.152.19:42897] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "admCh7oqTMlo30hcVw98-AAAABQ"]
[Sat Apr 11 07:06:48.297331 2026] [:error] [pid 15244:tid 15259] [client 52.143.152.19:2706] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "admCiIkdEsz5NeAq8w1kkgAAAQ0"]
[Sat Apr 11 07:06:49.065458 2026] [:error] [pid 33173:tid 33260] [client 52.143.152.19:36007] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "admCia8109xRDP2izWgEfAAAAI8"]
[Sat Apr 11 07:06:49.543321 2026] [:error] [pid 15244:tid 15260] [client 52.143.152.19:13185] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "admCiYkdEsz5NeAq8w1koQAAAQ4"]
[Sat Apr 11 07:06:50.087006 2026] [:error] [pid 15244:tid 15261] [client 52.143.152.19:13220] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "admCiokdEsz5NeAq8w1kqgAAAQ8"]
[Sat Apr 11 07:06:50.569688 2026] [:error] [pid 15244:tid 15268] [client 52.143.152.19:2993] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "admCiokdEsz5NeAq8w1ksAAAARY"]
[Sat Apr 11 07:06:51.168910 2026] [:error] [pid 15244:tid 15246] [client 52.143.152.19:13184] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsas.php"] [unique_id "admCi4kdEsz5NeAq8w1ktgAAAQA"]
[Sat Apr 11 07:06:51.691338 2026] [:error] [pid 33171:tid 33192] [client 52.143.152.19:2742] [client 52.143.152.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/jp.php"] [unique_id "admCi7oqTMlo30hcVw99CAAAAAY"]
[Sat Apr 11 07:06:52.451381 2026] [proxy_fcgi:error] [pid 33171:tid 33196] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:06:52.685497 2026] [proxy_fcgi:error] [pid 33171:tid 33204] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:06:52.920299 2026] [proxy_fcgi:error] [pid 33171:tid 33188] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:06:53.154384 2026] [proxy_fcgi:error] [pid 33171:tid 33191] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:06:53.389299 2026] [proxy_fcgi:error] [pid 33171:tid 33209] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:06:53.624166 2026] [proxy_fcgi:error] [pid 33171:tid 33195] [client 52.143.152.19:14552] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:46.137729 2026] [proxy_fcgi:error] [pid 15244:tid 15270] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:46.373794 2026] [proxy_fcgi:error] [pid 15244:tid 15260] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:46.609533 2026] [proxy_fcgi:error] [pid 15244:tid 15249] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:46.847433 2026] [proxy_fcgi:error] [pid 15244:tid 15252] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:47.084037 2026] [proxy_fcgi:error] [pid 15244:tid 15255] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:47.319676 2026] [proxy_fcgi:error] [pid 15244:tid 15253] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 07:10:47.554605 2026] [proxy_fcgi:error] [pid 15244:tid 15260] [client 20.250.31.31:13093] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:11.374458 2026] [proxy_fcgi:error] [pid 5794:tid 5860] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:11.631707 2026] [proxy_fcgi:error] [pid 5794:tid 5864] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:11.888959 2026] [proxy_fcgi:error] [pid 5794:tid 5872] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:12.146100 2026] [proxy_fcgi:error] [pid 5794:tid 5855] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:12.403019 2026] [proxy_fcgi:error] [pid 5794:tid 5866] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:12.660456 2026] [proxy_fcgi:error] [pid 5794:tid 5876] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 08:43:12.917712 2026] [proxy_fcgi:error] [pid 5794:tid 5874] [client 74.248.128.78:19284] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 09:42:42.736948 2026] [:error] [pid 34911:tid 34936] [client 157.15.40.61:60046] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "admnEg4Dca235WG8VGLHvgAAABc"]
[Sat Apr 11 10:26:22.427989 2026] [:error] [pid 58196:tid 58277] [client 43.135.186.135:51758] [client 43.135.186.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "admxThmf0L5kNLP6dTlD2wAAABc"]
[Sat Apr 11 12:05:02.790664 2026] [:error] [pid 2297:tid 2323] [client 49.51.233.46:54504] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adnIbrXJS-Jji11jZk2fKQAAARY"]
[Sat Apr 11 12:05:43.309714 2026] [:error] [pid 11067:tid 11087] [client 103.235.94.96:53407] [client 103.235.94.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.94.96, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adnIl8W3w7N67R04YCI6kAAAAFI"]
[Sat Apr 11 12:05:43.328211 2026] [proxy_fcgi:error] [pid 11067:tid 11087] [client 103.235.94.96:53407] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 14:11:36.782840 2026] [:error] [pid 2186:tid 2201] [client 157.15.40.61:56037] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adnmGMibnOEEvcO8wPL9FwAAAIs"]
[Sat Apr 11 14:11:37.053480 2026] [:error] [pid 2187:tid 2252] [client 157.15.40.61:56111] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/style.php"] [unique_id "adnmGQ4J29_qQi0FkjiH_gAAABg"]
[Sat Apr 11 14:11:37.315298 2026] [:error] [pid 2187:tid 2251] [client 157.15.40.61:56172] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/themes/style.php"] [unique_id "adnmGQ4J29_qQi0FkjiIBgAAABc"]
[Sat Apr 11 14:11:37.581685 2026] [:error] [pid 2186:tid 2208] [client 157.15.40.61:56273] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/style.php"] [unique_id "adnmGcibnOEEvcO8wPL9NwAAAJI"]
[Sat Apr 11 14:11:37.905148 2026] [:error] [pid 2297:tid 2304] [client 157.15.40.61:56394] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style.php"] [unique_id "adnmGbXJS-Jji11jZk3ZGQAAAQM"]
[Sat Apr 11 14:11:38.194756 2026] [:error] [pid 11067:tid 11071] [client 157.15.40.61:56511] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "adnmGsW3w7N67R04YCKQxgAAAEI"]
[Sat Apr 11 14:11:38.467667 2026] [:error] [pid 2186:tid 2196] [client 157.15.40.61:56566] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "adnmGsibnOEEvcO8wPL9agAAAIY"]
[Sat Apr 11 14:11:40.642622 2026] [:error] [pid 2187:tid 2238] [client 157.15.40.61:56745] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/flower.php"] [unique_id "adnmHA4J29_qQi0FkjiIWwAAAAo"]
[Sat Apr 11 14:11:41.932918 2026] [:error] [pid 11067:tid 11072] [client 157.15.40.61:57008] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "adnmHcW3w7N67R04YCKRUgAAAEM"]
[Sat Apr 11 14:11:42.204901 2026] [:error] [pid 11067:tid 11091] [client 157.15.40.61:57222] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "adnmHsW3w7N67R04YCKRdQAAAFY"]
[Sat Apr 11 14:11:45.489674 2026] [:error] [pid 2297:tid 2325] [client 157.15.40.61:57267] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "adnmIbXJS-Jji11jZk3aUAAAARg"]
[Sat Apr 11 14:11:46.250521 2026] [:error] [pid 2297:tid 2315] [client 157.15.40.61:57939] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/blurbs.php"] [unique_id "adnmIrXJS-Jji11jZk3adwAAAQ4"]
[Sat Apr 11 14:11:49.455439 2026] [:error] [pid 11067:tid 11088] [client 157.15.40.61:58278] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/akcc.php"] [unique_id "adnmJcW3w7N67R04YCKSswAAAFM"]
[Sat Apr 11 14:11:49.705478 2026] [:error] [pid 11067:tid 11072] [client 157.15.40.61:58520] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adnmJcW3w7N67R04YCKS1wAAAEM"]
[Sat Apr 11 14:11:50.710805 2026] [:error] [pid 2297:tid 2316] [client 157.15.40.61:58785] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "adnmJrXJS-Jji11jZk3bRAAAAQ8"]
[Sat Apr 11 14:11:52.980116 2026] [:error] [pid 2188:tid 2262] [client 157.15.40.61:59061] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/cord.php"] [unique_id "adnmKIDhDA-Xtn2nRScLPwAAAMY"]
[Sat Apr 11 14:11:54.775847 2026] [:error] [pid 11067:tid 11077] [client 157.15.40.61:59405] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/dex.php"] [unique_id "adnmKsW3w7N67R04YCKUDwAAAEg"]
[Sat Apr 11 14:11:55.542311 2026] [:error] [pid 2188:tid 2267] [client 157.15.40.61:59736] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmK4DhDA-Xtn2nRScLXwAAAMs"]
[Sat Apr 11 14:11:55.798059 2026] [:error] [pid 11067:tid 11072] [client 157.15.40.61:59805] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "adnmK8W3w7N67R04YCKUbwAAAEM"]
[Sat Apr 11 14:11:56.050630 2026] [:error] [pid 11067:tid 11077] [client 157.15.40.61:59870] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "adnmLMW3w7N67R04YCKUpgAAAEg"]
[Sat Apr 11 14:11:57.322066 2026] [:error] [pid 2188:tid 2269] [client 157.15.40.61:59953] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/zwso.php"] [unique_id "adnmLYDhDA-Xtn2nRScLiwAAAM0"]
[Sat Apr 11 14:11:57.581862 2026] [:error] [pid 11067:tid 11083] [client 157.15.40.61:60209] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmLcW3w7N67R04YCKVSwAAAE4"]
[Sat Apr 11 14:11:58.888483 2026] [:error] [pid 2297:tid 2317] [client 157.15.40.61:60597] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adnmLrXJS-Jji11jZk3cFwAAARA"]
[Sat Apr 11 14:12:02.344342 2026] [:error] [pid 2297:tid 2325] [client 157.15.40.61:60877] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/shlo.php"] [unique_id "adnmMrXJS-Jji11jZk3cXgAAARg"]
[Sat Apr 11 14:12:04.155429 2026] [:error] [pid 2297:tid 2307] [client 157.15.40.61:61486] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "adnmNLXJS-Jji11jZk3cewAAAQY"]
[Sat Apr 11 14:12:06.953665 2026] [:error] [pid 2187:tid 2226] [client 157.15.40.61:62469] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "adnmNg4J29_qQi0FkjiKGwAAAAA"]
[Sat Apr 11 14:12:11.233897 2026] [:error] [pid 11067:tid 11074] [client 157.15.40.61:50263] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/php8.php"] [unique_id "adnmO8W3w7N67R04YCKXdQAAAEU"]
[Sat Apr 11 14:12:11.500399 2026] [:error] [pid 2187:tid 2252] [client 157.15.40.61:50507] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/lufix1.php"] [unique_id "adnmOw4J29_qQi0FkjiKPgAAABg"]
[Sat Apr 11 14:12:14.813129 2026] [:error] [pid 2297:tid 2315] [client 157.15.40.61:50559] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/witmm.php"] [unique_id "adnmPrXJS-Jji11jZk3dJQAAAQ4"]
[Sat Apr 11 14:12:16.643387 2026] [:error] [pid 2186:tid 2191] [client 157.15.40.61:51162] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-admin/css/index.php"] [unique_id "adnmQMibnOEEvcO8wPL_qAAAAIE"]
[Sat Apr 11 14:12:20.080701 2026] [:error] [pid 11067:tid 11073] [client 157.15.40.61:51753] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/index.php"] [unique_id "adnmRMW3w7N67R04YCKX1gAAAEQ"]
[Sat Apr 11 14:12:21.761339 2026] [:error] [pid 2297:tid 2317] [client 157.15.40.61:51935] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "adnmRbXJS-Jji11jZk3diQAAARA"]
[Sat Apr 11 14:12:22.865752 2026] [:error] [pid 2187:tid 2232] [client 157.15.40.61:52050] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adnmRg4J29_qQi0FkjiKbwAAAAQ"]
[Sat Apr 11 14:12:24.989048 2026] [:error] [pid 11067:tid 11072] [client 157.15.40.61:52174] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "adnmSMW3w7N67R04YCKYHAAAAEM"]
[Sat Apr 11 14:12:28.260655 2026] [:error] [pid 2186:tid 2203] [client 157.15.40.61:52660] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/files.php"] [unique_id "adnmTMibnOEEvcO8wPIACAAAAI0"]
[Sat Apr 11 14:12:29.901927 2026] [:error] [pid 11067:tid 11093] [client 157.15.40.61:52793] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-editor.php"] [unique_id "adnmTcW3w7N67R04YCKYYAAAAFg"]
[Sat Apr 11 16:17:44.510194 2026] [:error] [pid 11067:tid 11073] [client 35.224.118.24:50263] [client 35.224.118.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.224.118.24, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adoDqMW3w7N67R04YCLn_gAAAEQ"]
[Sat Apr 11 16:17:44.525598 2026] [proxy_fcgi:error] [pid 11067:tid 11073] [client 35.224.118.24:50263] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 16:17:46.894810 2026] [:error] [pid 11067:tid 11087] [client 35.224.118.24:50263] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adoDqsW3w7N67R04YCLoFQAAAFI"]
[Sat Apr 11 16:17:47.317979 2026] [:error] [pid 2297:tid 2320] [client 35.224.118.24:61591] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adoDq7XJS-Jji11jZk0WrQAAARM"]
[Sat Apr 11 16:17:47.792706 2026] [:error] [pid 11067:tid 11075] [client 35.224.118.24:62430] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "adoDq8W3w7N67R04YCLoGQAAAEY"]
[Sat Apr 11 16:17:48.189693 2026] [:error] [pid 11067:tid 11081] [client 35.224.118.24:61965] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "adoDrMW3w7N67R04YCLoHQAAAEw"]
[Sat Apr 11 16:17:48.594687 2026] [:error] [pid 2297:tid 2301] [client 35.224.118.24:65388] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adoDrLXJS-Jji11jZk0WswAAAQA"]
[Sat Apr 11 16:17:49.037705 2026] [:error] [pid 11067:tid 11085] [client 35.224.118.24:58396] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adoDrcW3w7N67R04YCLoIAAAAFA"]
[Sat Apr 11 16:17:49.437376 2026] [:error] [pid 11067:tid 11074] [client 35.224.118.24:52876] [client 35.224.118.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "adoDrcW3w7N67R04YCLoIwAAAEU"]
[Sat Apr 11 16:34:32.745266 2026] [:error] [pid 2187:tid 2236] [client 115.242.246.46:11879] [client 115.242.246.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.242.246.46, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adoHmA4J29_qQi0FkjixAQAAAAg"]
[Sat Apr 11 16:34:32.757360 2026] [proxy_fcgi:error] [pid 2187:tid 2236] [client 115.242.246.46:11879] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 19:15:12.172573 2026] [:error] [pid 54520:tid 54598] [client 122.168.89.93:5902] [client 122.168.89.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.89.93, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adotQMOfMlnGwwoJrMCaKAAAAFY"]
[Sat Apr 11 19:15:12.185015 2026] [proxy_fcgi:error] [pid 54520:tid 54598] [client 122.168.89.93:5902] AH01071: Got error 'Primary script unknown'
[Sat Apr 11 20:07:16.986621 2026] [:error] [pid 54519:tid 54566] [client 162.62.231.139:53896] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ado5dB3fdONpCON3MUistAAAANE"]
[Sat Apr 11 23:11:57.457584 2026] [:error] [pid 52608:tid 52627] [client 54.37.252.212:36326] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adpkvSY5wH-BLt5QEKhsOwAAARA"]
[Sat Apr 11 23:11:59.283086 2026] [:error] [pid 42313:tid 42321] [client 54.37.252.212:60496] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adpkv12P8TxdbaN018JZ9wAAAAU"]
[Sat Apr 11 23:12:01.148146 2026] [:error] [pid 52608:tid 52628] [client 54.37.252.212:36338] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adpkwSY5wH-BLt5QEKhsWQAAARE"]
[Sat Apr 11 23:12:03.169855 2026] [:error] [pid 42313:tid 42330] [client 54.37.252.212:36350] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adpkw12P8TxdbaN018JaBgAAAA4"]
[Sat Apr 11 23:12:05.270592 2026] [:error] [pid 52608:tid 52629] [client 54.37.252.212:36352] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adpkxSY5wH-BLt5QEKhscAAAARI"]
[Sat Apr 11 23:12:07.091680 2026] [:error] [pid 52608:tid 52635] [client 54.37.252.212:51576] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adpkxyY5wH-BLt5QEKhsfQAAARg"]
[Sat Apr 11 23:12:09.192779 2026] [:error] [pid 52608:tid 52630] [client 54.37.252.212:51584] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adpkySY5wH-BLt5QEKhshQAAARM"]
[Sat Apr 11 23:12:11.337545 2026] [:error] [pid 52608:tid 52611] [client 54.37.252.212:51594] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adpkyyY5wH-BLt5QEKhskgAAAQA"]
[Sat Apr 11 23:12:13.593594 2026] [:error] [pid 42313:tid 42325] [client 54.37.252.212:51602] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adpkzV2P8TxdbaN018JaHQAAAAk"]
[Sat Apr 11 23:12:15.725071 2026] [:error] [pid 42313:tid 42324] [client 54.37.252.212:51618] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adpkz12P8TxdbaN018JaIgAAAAg"]
[Sat Apr 11 23:12:17.873479 2026] [:error] [pid 52608:tid 52615] [client 54.37.252.212:55392] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adpk0SY5wH-BLt5QEKhsqgAAAQQ"]
[Sat Apr 11 23:12:20.161688 2026] [:error] [pid 42313:tid 42340] [client 54.37.252.212:55408] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adpk1F2P8TxdbaN018JaLgAAABg"]
[Sat Apr 11 23:12:21.982623 2026] [:error] [pid 52608:tid 52627] [client 54.37.252.212:55414] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adpk1SY5wH-BLt5QEKhstQAAARA"]
[Sat Apr 11 23:12:24.318163 2026] [:error] [pid 52608:tid 52630] [client 54.37.252.212:55424] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adpk2CY5wH-BLt5QEKhsywAAARM"]
[Sat Apr 11 23:12:26.553935 2026] [:error] [pid 42221:tid 42296] [client 54.37.252.212:43754] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adpk2k2gt0pb_0-cc6mibQAAAFI"]
[Sat Apr 11 23:12:28.587941 2026] [:error] [pid 42313:tid 42317] [client 54.37.252.212:43770] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adpk3F2P8TxdbaN018JaQwAAAAE"]
[Sat Apr 11 23:12:30.793505 2026] [:error] [pid 42219:tid 42236] [client 54.37.252.212:43780] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adpk3g-4IkVbTQx_J-2haAAAAI0"]
[Sat Apr 11 23:12:33.161081 2026] [:error] [pid 52608:tid 52624] [client 54.37.252.212:43784] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adpk4SY5wH-BLt5QEKhs_QAAAQ0"]
[Sat Apr 11 23:12:35.344227 2026] [:error] [pid 52608:tid 52632] [client 54.37.252.212:43786] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adpk4yY5wH-BLt5QEKhtCAAAARU"]
[Sat Apr 11 23:12:37.385553 2026] [:error] [pid 52608:tid 52616] [client 54.37.252.212:47916] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adpk5SY5wH-BLt5QEKhtHAAAAQU"]
[Sat Apr 11 23:12:39.841534 2026] [:error] [pid 42313:tid 42324] [client 54.37.252.212:47928] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adpk512P8TxdbaN018JaawAAAAg"]
[Sat Apr 11 23:12:41.666987 2026] [:error] [pid 52608:tid 52628] [client 54.37.252.212:47930] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adpk6SY5wH-BLt5QEKhtOwAAARE"]
[Sat Apr 11 23:12:43.834946 2026] [:error] [pid 42221:tid 42289] [client 54.37.252.212:47940] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adpk602gt0pb_0-cc6milQAAAEs"]
[Sat Apr 11 23:12:46.751338 2026] [:error] [pid 52608:tid 52621] [client 54.37.252.212:54720] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adpk7iY5wH-BLt5QEKhtaQAAAQo"]
[Sat Apr 11 23:12:49.104428 2026] [:error] [pid 42219:tid 42246] [client 54.37.252.212:48996] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adpk8Q-4IkVbTQx_J-2hhwAAAJc"]
[Sat Apr 11 23:12:51.254602 2026] [:error] [pid 42313:tid 42335] [client 54.37.252.212:49008] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adpk812P8TxdbaN018JagAAAABM"]
[Sat Apr 11 23:12:53.513998 2026] [:error] [pid 52608:tid 52618] [client 54.37.252.212:49010] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adpk9SY5wH-BLt5QEKhtmAAAAQc"]
[Sat Apr 11 23:13:23.610732 2026] [:error] [pid 52608:tid 52631] [client 54.37.252.212:54536] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adplEyY5wH-BLt5QEKht_AAAARQ"]
[Sat Apr 11 23:13:25.662252 2026] [:error] [pid 42220:tid 42272] [client 54.37.252.212:54550] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adplFUz5c3Cs6a8B5QuadAAAANU"]
[Sat Apr 11 23:13:27.596006 2026] [:error] [pid 42220:tid 42257] [client 54.37.252.212:55952] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adplF0z5c3Cs6a8B5QuagAAAAMY"]
[Sat Apr 11 23:13:30.302643 2026] [:error] [pid 42313:tid 42323] [client 54.37.252.212:55476] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adplGl2P8TxdbaN018Ja1QAAAAc"]
[Sat Apr 11 23:13:32.658430 2026] [:error] [pid 42313:tid 42330] [client 54.37.252.212:55962] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adplHF2P8TxdbaN018Ja2wAAAA4"]
[Sat Apr 11 23:13:35.779061 2026] [:error] [pid 52608:tid 52630] [client 54.37.252.212:55974] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adplHyY5wH-BLt5QEKhuMgAAARM"]
[Sat Apr 11 23:13:37.920365 2026] [:error] [pid 42313:tid 42321] [client 54.37.252.212:52476] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adplIV2P8TxdbaN018Ja8gAAAAU"]
[Sat Apr 11 23:13:41.241198 2026] [:error] [pid 42313:tid 42335] [client 54.37.252.212:52824] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adplJV2P8TxdbaN018Ja-AAAABM"]
[Sat Apr 11 23:13:43.266564 2026] [:error] [pid 42313:tid 42317] [client 54.37.252.212:52478] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adplJ12P8TxdbaN018Ja_wAAAAE"]
[Sat Apr 11 23:13:45.340111 2026] [:error] [pid 42313:tid 42321] [client 54.37.252.212:52494] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adplKV2P8TxdbaN018JbCgAAAAU"]
[Sat Apr 11 23:13:47.802383 2026] [:error] [pid 42221:tid 42287] [client 54.37.252.212:32828] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adplK02gt0pb_0-cc6mjBgAAAEk"]
[Sat Apr 11 23:13:49.807182 2026] [:error] [pid 52608:tid 52613] [client 54.37.252.212:32840] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adplLSY5wH-BLt5QEKhuZAAAAQI"]
[Sat Apr 11 23:13:51.778630 2026] [:error] [pid 52608:tid 52626] [client 54.37.252.212:32854] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adplLyY5wH-BLt5QEKhubQAAAQ8"]
[Sat Apr 11 23:13:54.255050 2026] [:error] [pid 42313:tid 42318] [client 54.37.252.212:53632] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adplMl2P8TxdbaN018JbLAAAAAI"]
[Sat Apr 11 23:13:56.726061 2026] [:error] [pid 52608:tid 52629] [client 54.37.252.212:56168] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adplNCY5wH-BLt5QEKhuewAAARI"]
[Sat Apr 11 23:13:59.256432 2026] [:error] [pid 42221:tid 42302] [client 54.37.252.212:56178] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adplN02gt0pb_0-cc6mjHAAAAFg"]
[Sat Apr 11 23:14:01.948909 2026] [:error] [pid 42313:tid 42316] [client 54.37.252.212:52114] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adplOV2P8TxdbaN018JbPAAAAAA"]
[Sat Apr 11 23:14:04.101122 2026] [:error] [pid 52608:tid 52632] [client 54.37.252.212:56188] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adplPCY5wH-BLt5QEKhulQAAARU"]
[Sat Apr 11 23:14:06.559624 2026] [:error] [pid 52608:tid 52625] [client 54.37.252.212:46052] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adplPiY5wH-BLt5QEKhunAAAAQ4"]
[Sat Apr 11 23:14:08.826390 2026] [:error] [pid 42221:tid 42293] [client 54.37.252.212:46068] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adplQE2gt0pb_0-cc6mjJQAAAE8"]
[Sat Apr 11 23:14:10.915248 2026] [:error] [pid 52608:tid 52622] [client 54.37.252.212:46072] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adplQiY5wH-BLt5QEKhutgAAAQs"]
[Sat Apr 11 23:14:13.408252 2026] [:error] [pid 52608:tid 52630] [client 54.37.252.212:38854] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adplRSY5wH-BLt5QEKhuywAAARM"]
[Sat Apr 11 23:14:15.489563 2026] [:error] [pid 52608:tid 52632] [client 54.37.252.212:46088] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adplRyY5wH-BLt5QEKhu3wAAARU"]
[Sat Apr 11 23:14:17.773795 2026] [:error] [pid 42219:tid 42242] [client 54.37.252.212:51656] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adplSQ-4IkVbTQx_J-2iCQAAAJM"]
[Sat Apr 11 23:14:45.594923 2026] [:error] [pid 42313:tid 42323] [client 54.37.252.212:56068] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adplZV2P8TxdbaN018JbvQAAAAc"]
[Sat Apr 11 23:14:47.787049 2026] [:error] [pid 52608:tid 52634] [client 54.37.252.212:51204] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adplZyY5wH-BLt5QEKhvRwAAARc"]
[Sat Apr 11 23:14:49.807537 2026] [:error] [pid 42313:tid 42316] [client 54.37.252.212:51206] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adplaV2P8TxdbaN018JbxQAAAAA"]
[Sat Apr 11 23:14:51.801606 2026] [:error] [pid 42221:tid 42284] [client 54.37.252.212:51216] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adpla02gt0pb_0-cc6mjdAAAAEY"]
[Sat Apr 11 23:14:53.814681 2026] [:error] [pid 52608:tid 52619] [client 54.37.252.212:51222] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adplbSY5wH-BLt5QEKhvbAAAAQg"]
[Sat Apr 11 23:14:56.320534 2026] [:error] [pid 42219:tid 42224] [client 54.37.252.212:54288] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adplcA-4IkVbTQx_J-2iXQAAAIE"]
[Sat Apr 11 23:14:58.171076 2026] [:error] [pid 42219:tid 42245] [client 54.37.252.212:34202] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adplcg-4IkVbTQx_J-2iYQAAAJY"]
[Sat Apr 11 23:15:00.533435 2026] [:error] [pid 52608:tid 52634] [client 54.37.252.212:54154] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adpldCY5wH-BLt5QEKhvkwAAARc"]
[Sat Apr 11 23:15:02.556285 2026] [:error] [pid 42313:tid 42323] [client 54.37.252.212:34212] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adpldl2P8TxdbaN018Jb8AAAAAc"]
[Sat Apr 11 23:15:04.473665 2026] [:error] [pid 42219:tid 42232] [client 54.37.252.212:34222] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adpleA-4IkVbTQx_J-2iagAAAIk"]
[Sat Apr 11 23:15:06.967161 2026] [:error] [pid 42313:tid 42323] [client 54.37.252.212:44950] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adplel2P8TxdbaN018JcAgAAAAc"]
[Sat Apr 11 23:15:09.224983 2026] [:error] [pid 52608:tid 52632] [client 54.37.252.212:60908] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adplfSY5wH-BLt5QEKhvrQAAARU"]
[Sat Apr 11 23:15:11.208844 2026] [:error] [pid 42220:tid 42267] [client 54.37.252.212:60912] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adplf0z5c3Cs6a8B5Qua3wAAANA"]
[Sat Apr 11 23:15:13.248090 2026] [:error] [pid 52608:tid 52630] [client 54.37.252.212:60918] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adplgSY5wH-BLt5QEKhvwwAAARM"]
[Sat Apr 11 23:15:15.087656 2026] [:error] [pid 42219:tid 42243] [client 54.37.252.212:60920] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adplgw-4IkVbTQx_J-2ifgAAAJQ"]
[Sat Apr 11 23:15:18.923554 2026] [:error] [pid 42221:tid 42284] [client 54.37.252.212:47028] [client 54.37.252.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adplhk2gt0pb_0-cc6mjnAAAAEY"]
[Sun Apr 12 01:16:58.408562 2026] [:error] [pid 45064:tid 45114] [client 135.181.213.219:20916] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adqCCpcHBvLyJ6EUhUr3dQAAAVU"]
[Sun Apr 12 01:17:00.974302 2026] [:error] [pid 45064:tid 45115] [client 135.181.213.219:32734] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adqCDJcHBvLyJ6EUhUr3egAAAVY"]
[Sun Apr 12 01:17:02.918141 2026] [:error] [pid 34152:tid 34174] [client 135.181.213.219:16696] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adqCDoFtE4RhFslT1DqzuQAAABQ"]
[Sun Apr 12 01:17:05.496970 2026] [:error] [pid 45064:tid 45093] [client 135.181.213.219:32736] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adqCEZcHBvLyJ6EUhUr3gwAAAUE"]
[Sun Apr 12 01:17:07.517572 2026] [:error] [pid 34152:tid 34160] [client 135.181.213.219:16706] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adqCE4FtE4RhFslT1DqzywAAAAY"]
[Sun Apr 12 01:17:10.043450 2026] [:error] [pid 34152:tid 34176] [client 135.181.213.219:32746] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adqCFoFtE4RhFslT1Dqz4QAAABY"]
[Sun Apr 12 01:17:12.458575 2026] [:error] [pid 45064:tid 45107] [client 135.181.213.219:50186] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adqCGJcHBvLyJ6EUhUr3jgAAAU4"]
[Sun Apr 12 01:17:14.555032 2026] [:error] [pid 44701:tid 44798] [client 135.181.213.219:18254] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adqCGhGZAP4MrlxEPFcw_AAAAFY"]
[Sun Apr 12 01:17:17.168772 2026] [:error] [pid 44700:tid 44767] [client 135.181.213.219:50194] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adqCHWryPgh_uW4QPClfDwAAANc"]
[Sun Apr 12 01:17:19.091112 2026] [:error] [pid 34152:tid 34156] [client 135.181.213.219:18280] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adqCH4FtE4RhFslT1Dqz9gAAAAI"]
[Sun Apr 12 01:17:21.637535 2026] [:error] [pid 44700:tid 44759] [client 135.181.213.219:49156] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adqCIWryPgh_uW4QPClfGgAAAM8"]
[Sun Apr 12 01:17:24.169666 2026] [:error] [pid 45064:tid 45107] [client 135.181.213.219:49162] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adqCJJcHBvLyJ6EUhUr3mAAAAU4"]
[Sun Apr 12 01:17:26.143690 2026] [:error] [pid 34152:tid 34166] [client 135.181.213.219:52628] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adqCJoFtE4RhFslT1Dq0PAAAAAw"]
[Sun Apr 12 01:17:28.600066 2026] [:error] [pid 44701:tid 44794] [client 135.181.213.219:49176] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adqCKBGZAP4MrlxEPFcxGgAAAFM"]
[Sun Apr 12 01:17:30.534031 2026] [:error] [pid 45064:tid 45092] [client 135.181.213.219:15952] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adqCKpcHBvLyJ6EUhUr3pAAAAUA"]
[Sun Apr 12 01:17:33.110650 2026] [:error] [pid 44701:tid 44796] [client 135.181.213.219:19008] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adqCLRGZAP4MrlxEPFcxHgAAAFU"]
[Sun Apr 12 01:17:34.943507 2026] [:error] [pid 44701:tid 44792] [client 135.181.213.219:15956] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adqCLhGZAP4MrlxEPFcxIwAAAFE"]
[Sun Apr 12 01:17:37.516708 2026] [:error] [pid 45064:tid 45097] [client 135.181.213.219:19020] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adqCMZcHBvLyJ6EUhUr3sAAAAUU"]
[Sun Apr 12 01:17:39.442953 2026] [:error] [pid 44701:tid 44798] [client 135.181.213.219:15960] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adqCMxGZAP4MrlxEPFcxLgAAAFY"]
[Sun Apr 12 01:17:42.107325 2026] [:error] [pid 34152:tid 34154] [client 135.181.213.219:46094] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adqCNoFtE4RhFslT1Dq0dQAAAAA"]
[Sun Apr 12 01:17:44.640141 2026] [:error] [pid 45064:tid 45115] [client 135.181.213.219:46104] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adqCOJcHBvLyJ6EUhUr3wAAAAVY"]
[Sun Apr 12 01:17:46.638575 2026] [:error] [pid 44701:tid 44787] [client 135.181.213.219:5426] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adqCOhGZAP4MrlxEPFcxMwAAAE0"]
[Sun Apr 12 01:17:49.089814 2026] [:error] [pid 34152:tid 34155] [client 135.181.213.219:46106] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adqCPYFtE4RhFslT1Dq0kAAAAAE"]
[Sun Apr 12 01:17:51.085729 2026] [:error] [pid 44700:tid 44768] [client 135.181.213.219:4042] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adqCP2ryPgh_uW4QPClfQQAAANg"]
[Sun Apr 12 01:17:53.688776 2026] [:error] [pid 34152:tid 34160] [client 135.181.213.219:25438] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adqCQYFtE4RhFslT1Dq0ngAAAAY"]
[Sun Apr 12 01:18:35.791653 2026] [:error] [pid 44698:tid 44707] [client 135.181.213.219:24606] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "adqCaxgoH9UWd-U3D55b_wAAAIQ"]
[Sun Apr 12 01:18:38.250240 2026] [:error] [pid 34152:tid 34178] [client 135.181.213.219:24608] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adqCboFtE4RhFslT1Dq1EgAAABg"]
[Sun Apr 12 01:18:40.815880 2026] [:error] [pid 44698:tid 44723] [client 135.181.213.219:7910] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adqCcBgoH9UWd-U3D55cAQAAAJQ"]
[Sun Apr 12 01:18:43.438358 2026] [:error] [pid 44698:tid 44709] [client 135.181.213.219:7924] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adqCcxgoH9UWd-U3D55cBgAAAIY"]
[Sun Apr 12 01:18:45.952435 2026] [:error] [pid 45064:tid 45107] [client 135.181.213.219:7930] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adqCdZcHBvLyJ6EUhUr4VgAAAU4"]
[Sun Apr 12 01:18:47.957896 2026] [:error] [pid 34152:tid 34158] [client 135.181.213.219:41710] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adqCd4FtE4RhFslT1Dq1KQAAAAQ"]
[Sun Apr 12 01:18:50.549325 2026] [:error] [pid 45064:tid 45104] [client 135.181.213.219:25142] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adqCepcHBvLyJ6EUhUr4ZgAAAUs"]
[Sun Apr 12 01:18:52.388314 2026] [:error] [pid 34152:tid 34158] [client 135.181.213.219:22698] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adqCfIFtE4RhFslT1Dq1OQAAAAQ"]
[Sun Apr 12 01:18:55.003859 2026] [:error] [pid 44698:tid 44708] [client 135.181.213.219:25152] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adqCfxgoH9UWd-U3D55cFQAAAIU"]
[Sun Apr 12 01:18:57.539301 2026] [:error] [pid 34152:tid 34162] [client 135.181.213.219:25166] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adqCgYFtE4RhFslT1Dq1UwAAAAg"]
[Sun Apr 12 01:19:00.021204 2026] [:error] [pid 45064:tid 45097] [client 135.181.213.219:25178] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adqChJcHBvLyJ6EUhUr4fQAAAUU"]
[Sun Apr 12 01:19:01.997199 2026] [:error] [pid 34152:tid 34158] [client 135.181.213.219:43428] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adqChYFtE4RhFslT1Dq1ZwAAAAQ"]
[Sun Apr 12 01:19:04.471586 2026] [:error] [pid 44700:tid 44757] [client 135.181.213.219:5912] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adqCiGryPgh_uW4QPClfrwAAAM0"]
[Sun Apr 12 01:19:06.499069 2026] [:error] [pid 45064:tid 45095] [client 135.181.213.219:43438] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adqCipcHBvLyJ6EUhUr4jwAAAUM"]
[Sun Apr 12 01:19:08.917399 2026] [:error] [pid 44700:tid 44752] [client 135.181.213.219:5914] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adqCjGryPgh_uW4QPClftQAAAMg"]
[Sun Apr 12 01:19:10.780905 2026] [:error] [pid 44701:tid 44774] [client 135.181.213.219:44086] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adqCjhGZAP4MrlxEPFcx7gAAAEI"]
[Sun Apr 12 01:19:13.366060 2026] [:error] [pid 45064:tid 45105] [client 135.181.213.219:45188] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adqCkZcHBvLyJ6EUhUr4nQAAAUw"]
[Sun Apr 12 01:19:15.889174 2026] [:error] [pid 44698:tid 44711] [client 135.181.213.219:45194] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adqCkxgoH9UWd-U3D55cKwAAAIg"]
[Sun Apr 12 01:19:41.413324 2026] [:error] [pid 44698:tid 44727] [client 135.181.213.219:19310] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adqCrRgoH9UWd-U3D55cQAAAAJg"]
[Sun Apr 12 01:19:43.446114 2026] [:error] [pid 45064:tid 45114] [client 135.181.213.219:19320] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adqCr5cHBvLyJ6EUhUr4-QAAAVU"]
[Sun Apr 12 01:19:45.490527 2026] [:error] [pid 44698:tid 44704] [client 135.181.213.219:19336] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adqCsRgoH9UWd-U3D55cSAAAAIE"]
[Sun Apr 12 01:19:47.380143 2026] [:error] [pid 34152:tid 34170] [client 135.181.213.219:19352] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adqCs4FtE4RhFslT1Dq12QAAABA"]
[Sun Apr 12 01:19:49.818493 2026] [:error] [pid 45064:tid 45113] [client 135.181.213.219:25154] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adqCtZcHBvLyJ6EUhUr5FAAAAVQ"]
[Sun Apr 12 01:19:52.308919 2026] [:error] [pid 45064:tid 45099] [client 135.181.213.219:35236] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adqCuJcHBvLyJ6EUhUr5KAAAAUc"]
[Sun Apr 12 01:19:54.235618 2026] [:error] [pid 44701:tid 44782] [client 135.181.213.219:29504] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adqCuhGZAP4MrlxEPFcyMgAAAEk"]
[Sun Apr 12 01:19:56.283296 2026] [:error] [pid 44700:tid 44765] [client 135.181.213.219:29506] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adqCvGryPgh_uW4QPClgBwAAANU"]
[Sun Apr 12 01:19:58.320246 2026] [:error] [pid 44700:tid 44745] [client 135.181.213.219:29522] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adqCvmryPgh_uW4QPClgCQAAAME"]
[Sun Apr 12 01:20:00.195070 2026] [:error] [pid 34152:tid 34171] [client 135.181.213.219:11392] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adqCwIFtE4RhFslT1Dq1_AAAABE"]
[Sun Apr 12 01:20:02.209409 2026] [:error] [pid 34152:tid 34165] [client 135.181.213.219:11400] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adqCwoFtE4RhFslT1Dq2EAAAAAs"]
[Sun Apr 12 01:20:04.715502 2026] [:error] [pid 45064:tid 45117] [client 135.181.213.219:19530] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adqCxJcHBvLyJ6EUhUr5XAAAAVg"]
[Sun Apr 12 01:20:07.220797 2026] [:error] [pid 44701:tid 44796] [client 135.181.213.219:19538] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adqCxxGZAP4MrlxEPFcyPwAAAFU"]
[Sun Apr 12 01:20:09.756848 2026] [:error] [pid 45064:tid 45092] [client 135.181.213.219:19542] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adqCyZcHBvLyJ6EUhUr5ZAAAAUA"]
[Sun Apr 12 01:20:12.375133 2026] [:error] [pid 44701:tid 44793] [client 135.181.213.219:3148] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adqCzBGZAP4MrlxEPFcySQAAAFI"]
[Sun Apr 12 01:20:14.982804 2026] [:error] [pid 44698:tid 44722] [client 135.181.213.219:3160] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adqCzhgoH9UWd-U3D55cZQAAAJM"]
[Sun Apr 12 01:20:24.626439 2026] [:error] [pid 44698:tid 44719] [client 135.181.213.219:32830] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adqC2BgoH9UWd-U3D55cegAAAJA"]
[Sun Apr 12 01:20:27.080123 2026] [:error] [pid 44701:tid 44786] [client 135.181.213.219:32836] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adqC2xGZAP4MrlxEPFcyUAAAAEw"]
[Sun Apr 12 01:20:29.559611 2026] [:error] [pid 44700:tid 44759] [client 135.181.213.219:32844] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adqC3WryPgh_uW4QPClgOgAAAM8"]
[Sun Apr 12 01:20:32.046671 2026] [:error] [pid 34152:tid 34158] [client 135.181.213.219:53100] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adqC4IFtE4RhFslT1Dq2lQAAAAQ"]
[Sun Apr 12 01:20:34.553299 2026] [:error] [pid 45064:tid 45115] [client 135.181.213.219:53102] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adqC4pcHBvLyJ6EUhUr5fgAAAVY"]
[Sun Apr 12 01:20:37.171379 2026] [:error] [pid 34152:tid 34155] [client 135.181.213.219:53108] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adqC5YFtE4RhFslT1Dq2rwAAAAE"]
[Sun Apr 12 01:21:09.677666 2026] [:error] [pid 34152:tid 34171] [client 135.181.213.219:31848] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "adqDBYFtE4RhFslT1Dq3PwAAABE"]
[Sun Apr 12 01:21:11.648860 2026] [:error] [pid 45064:tid 45113] [client 135.181.213.219:61836] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "adqDB5cHBvLyJ6EUhUr55AAAAVQ"]
[Sun Apr 12 01:21:13.648079 2026] [:error] [pid 34152:tid 34166] [client 135.181.213.219:61846] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adqDCYFtE4RhFslT1Dq3YAAAAAw"]
[Sun Apr 12 01:21:15.643667 2026] [:error] [pid 45064:tid 45113] [client 135.181.213.219:61858] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adqDC5cHBvLyJ6EUhUr56wAAAVQ"]
[Sun Apr 12 01:21:17.659910 2026] [:error] [pid 34152:tid 34167] [client 135.181.213.219:61866] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adqDDYFtE4RhFslT1Dq3fwAAAA0"]
[Sun Apr 12 01:21:19.668399 2026] [:error] [pid 44700:tid 44753] [client 135.181.213.219:61882] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adqDD2ryPgh_uW4QPClhSgAAAMk"]
[Sun Apr 12 01:21:21.654425 2026] [:error] [pid 44701:tid 44777] [client 135.181.213.219:13328] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adqDERGZAP4MrlxEPFcynQAAAEU"]
[Sun Apr 12 01:21:23.645301 2026] [:error] [pid 45064:tid 45111] [client 135.181.213.219:13338] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adqDE5cHBvLyJ6EUhUr6AQAAAVI"]
[Sun Apr 12 01:21:25.611749 2026] [:error] [pid 44701:tid 44799] [client 135.181.213.219:13346] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adqDFRGZAP4MrlxEPFcyoQAAAFc"]
[Sun Apr 12 01:21:27.580339 2026] [:error] [pid 44700:tid 44766] [client 135.181.213.219:13354] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "adqDF2ryPgh_uW4QPClhXwAAANY"]
[Sun Apr 12 01:21:29.564436 2026] [:error] [pid 44701:tid 44793] [client 135.181.213.219:13360] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adqDGRGZAP4MrlxEPFcypgAAAFI"]
[Sun Apr 12 01:21:31.547085 2026] [:error] [pid 44701:tid 44774] [client 135.181.213.219:29928] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adqDGxGZAP4MrlxEPFcyqgAAAEI"]
[Sun Apr 12 01:21:33.559996 2026] [:error] [pid 45064:tid 45096] [client 135.181.213.219:29942] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adqDHZcHBvLyJ6EUhUr6DgAAAUQ"]
[Sun Apr 12 01:21:35.534294 2026] [:error] [pid 44698:tid 44712] [client 135.181.213.219:29946] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adqDHxgoH9UWd-U3D55c0gAAAIk"]
[Sun Apr 12 01:21:37.529005 2026] [:error] [pid 34152:tid 34158] [client 135.181.213.219:29956] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adqDIYFtE4RhFslT1Dq3sQAAAAQ"]
[Sun Apr 12 01:21:39.370100 2026] [:error] [pid 44698:tid 44724] [client 135.181.213.219:29970] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adqDIxgoH9UWd-U3D55c1gAAAJU"]
[Sun Apr 12 01:21:41.353572 2026] [:error] [pid 45064:tid 45107] [client 135.181.213.219:10992] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adqDJZcHBvLyJ6EUhUr6FgAAAU4"]
[Sun Apr 12 01:21:43.189423 2026] [:error] [pid 44701:tid 44773] [client 135.181.213.219:11000] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adqDJxGZAP4MrlxEPFcyxQAAAEE"]
[Sun Apr 12 01:21:45.177313 2026] [:error] [pid 34152:tid 34169] [client 135.181.213.219:11014] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adqDKYFtE4RhFslT1Dq3wwAAAA8"]
[Sun Apr 12 01:21:47.140807 2026] [:error] [pid 44698:tid 44707] [client 135.181.213.219:11024] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adqDKxgoH9UWd-U3D55c4QAAAIQ"]
[Sun Apr 12 01:21:49.130852 2026] [:error] [pid 45064:tid 45113] [client 135.181.213.219:11040] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adqDLZcHBvLyJ6EUhUr6IgAAAVQ"]
[Sun Apr 12 01:21:51.132112 2026] [:error] [pid 44700:tid 44748] [client 135.181.213.219:63434] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adqDL2ryPgh_uW4QPClhfQAAAMQ"]
[Sun Apr 12 01:21:53.139551 2026] [:error] [pid 45064:tid 45103] [client 135.181.213.219:63450] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "adqDMZcHBvLyJ6EUhUr6MAAAAUo"]
[Sun Apr 12 01:21:55.129017 2026] [:error] [pid 44700:tid 44765] [client 135.181.213.219:63456] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adqDM2ryPgh_uW4QPClhhwAAANU"]
[Sun Apr 12 01:21:57.145576 2026] [:error] [pid 44700:tid 44756] [client 135.181.213.219:63458] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adqDNWryPgh_uW4QPClhkAAAAMw"]
[Sun Apr 12 01:21:59.178175 2026] [:error] [pid 34152:tid 34163] [client 135.181.213.219:63474] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adqDN4FtE4RhFslT1Dq4AwAAAAk"]
[Sun Apr 12 01:22:01.074481 2026] [:error] [pid 45064:tid 45104] [client 135.181.213.219:6178] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adqDOZcHBvLyJ6EUhUr6OAAAAUs"]
[Sun Apr 12 01:22:03.077411 2026] [:error] [pid 34152:tid 34177] [client 135.181.213.219:6180] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adqDO4FtE4RhFslT1Dq4BAAAABc"]
[Sun Apr 12 01:22:05.118711 2026] [:error] [pid 44700:tid 44752] [client 135.181.213.219:6194] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adqDPWryPgh_uW4QPClhqAAAAMg"]
[Sun Apr 12 01:22:28.992450 2026] [:error] [pid 34152:tid 34159] [client 135.181.213.219:3620] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adqDVIFtE4RhFslT1Dq4XQAAAAU"]
[Sun Apr 12 01:22:32.763067 2026] [:error] [pid 34152:tid 34168] [client 135.181.213.219:7844] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adqDWIFtE4RhFslT1Dq4bAAAAA4"]
[Sun Apr 12 01:22:34.814921 2026] [:error] [pid 34152:tid 34169] [client 135.181.213.219:7860] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adqDWoFtE4RhFslT1Dq4bwAAAA8"]
[Sun Apr 12 01:22:36.819646 2026] [:error] [pid 45064:tid 45110] [client 135.181.213.219:7864] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adqDXJcHBvLyJ6EUhUr6bwAAAVE"]
[Sun Apr 12 01:22:38.822016 2026] [:error] [pid 34152:tid 34162] [client 135.181.213.219:7878] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adqDXoFtE4RhFslT1Dq4fQAAAAg"]
[Sun Apr 12 01:22:40.849439 2026] [:error] [pid 34152:tid 34171] [client 135.181.213.219:45800] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adqDYIFtE4RhFslT1Dq4hAAAABE"]
[Sun Apr 12 01:22:42.844505 2026] [:error] [pid 44701:tid 44789] [client 135.181.213.219:45810] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adqDYhGZAP4MrlxEPFcy_AAAAE4"]
[Sun Apr 12 01:22:44.887246 2026] [:error] [pid 44700:tid 44754] [client 135.181.213.219:45816] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adqDZGryPgh_uW4QPClh1QAAAMo"]
[Sun Apr 12 01:22:46.903309 2026] [:error] [pid 44701:tid 44792] [client 135.181.213.219:45818] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adqDZhGZAP4MrlxEPFczAwAAAFE"]
[Sun Apr 12 01:22:48.904658 2026] [:error] [pid 44700:tid 44758] [client 135.181.213.219:45828] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adqDaGryPgh_uW4QPClh2gAAAM4"]
[Sun Apr 12 01:22:50.939421 2026] [:error] [pid 44700:tid 44759] [client 135.181.213.219:23566] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adqDamryPgh_uW4QPClh5AAAAM8"]
[Sun Apr 12 01:22:52.952439 2026] [:error] [pid 34152:tid 34154] [client 135.181.213.219:23570] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adqDbIFtE4RhFslT1Dq4lAAAAAA"]
[Sun Apr 12 01:22:54.961425 2026] [:error] [pid 45064:tid 45101] [client 135.181.213.219:23580] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adqDbpcHBvLyJ6EUhUr6jAAAAUg"]
[Sun Apr 12 01:50:35.995116 2026] [:error] [pid 44698:tid 44708] [client 163.53.244.172:16690] [client 163.53.244.172] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/ogg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adqJ6xgoH9UWd-U3D55ligAAAIU"]
[Sun Apr 12 03:31:54.062591 2026] [:error] [pid 36938:tid 36954] [client 217.182.139.33:52444] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adqhqoSWpa_VL1JPU6wNEwAAAY4"]
[Sun Apr 12 03:31:56.589597 2026] [:error] [pid 36909:tid 36926] [client 217.182.139.33:55284] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adqhrEGk5GhxTCzHUOpSVgAAAQ8"]
[Sun Apr 12 03:31:59.014532 2026] [:error] [pid 45064:tid 45098] [client 217.182.139.33:55286] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adqhr5cHBvLyJ6EUhUomgAAAAUY"]
[Sun Apr 12 03:32:01.450879 2026] [:error] [pid 36909:tid 36921] [client 217.182.139.33:55296] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adqhsUGk5GhxTCzHUOpSigAAAQo"]
[Sun Apr 12 03:32:04.066819 2026] [:error] [pid 44701:tid 44779] [client 217.182.139.33:50814] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adqhtBGZAP4MrlxEPFdmtAAAAEc"]
[Sun Apr 12 03:32:06.480675 2026] [:error] [pid 36909:tid 36913] [client 217.182.139.33:50824] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adqhtkGk5GhxTCzHUOpSswAAAQI"]
[Sun Apr 12 03:32:08.840306 2026] [:error] [pid 36909:tid 36929] [client 217.182.139.33:50826] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adqhuEGk5GhxTCzHUOpS4QAAARI"]
[Sun Apr 12 03:32:11.260127 2026] [:error] [pid 44700:tid 44753] [client 217.182.139.33:50834] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adqhu2ryPgh_uW4QPCmQqgAAAMk"]
[Sun Apr 12 03:32:13.634144 2026] [:error] [pid 45064:tid 45116] [client 217.182.139.33:50850] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adqhvZcHBvLyJ6EUhUomnwAAAVc"]
[Sun Apr 12 03:32:16.040170 2026] [:error] [pid 44701:tid 44790] [client 217.182.139.33:49588] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adqhwBGZAP4MrlxEPFdm0QAAAE8"]
[Sun Apr 12 03:32:18.555133 2026] [:error] [pid 45064:tid 45111] [client 217.182.139.33:49600] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adqhwpcHBvLyJ6EUhUompAAAAVI"]
[Sun Apr 12 03:32:20.943640 2026] [:error] [pid 44701:tid 44789] [client 217.182.139.33:49606] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adqhxBGZAP4MrlxEPFdm3QAAAE4"]
[Sun Apr 12 03:32:23.487600 2026] [:error] [pid 36909:tid 36918] [client 217.182.139.33:49612] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adqhx0Gk5GhxTCzHUOpTSQAAAQc"]
[Sun Apr 12 03:32:26.011953 2026] [:error] [pid 36909:tid 36911] [client 217.182.139.33:48928] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adqhykGk5GhxTCzHUOpTVAAAAQA"]
[Sun Apr 12 03:32:28.380606 2026] [:error] [pid 44700:tid 44749] [client 217.182.139.33:48938] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adqhzGryPgh_uW4QPCmQwAAAAMU"]
[Sun Apr 12 03:32:30.881934 2026] [:error] [pid 36909:tid 36914] [client 217.182.139.33:48946] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adqhzkGk5GhxTCzHUOpTbQAAAQM"]
[Sun Apr 12 03:32:33.390477 2026] [:error] [pid 36909:tid 36913] [client 217.182.139.33:48956] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adqh0UGk5GhxTCzHUOpTeAAAAQI"]
[Sun Apr 12 03:32:35.922672 2026] [:error] [pid 44698:tid 44709] [client 217.182.139.33:36862] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adqh0xgoH9UWd-U3D56igAAAAIY"]
[Sun Apr 12 03:32:38.314220 2026] [:error] [pid 36909:tid 36925] [client 217.182.139.33:36866] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adqh1kGk5GhxTCzHUOpThQAAAQ4"]
[Sun Apr 12 03:32:40.815363 2026] [:error] [pid 44698:tid 44705] [client 217.182.139.33:36870] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adqh2BgoH9UWd-U3D56ihQAAAII"]
[Sun Apr 12 03:32:43.327036 2026] [:error] [pid 36909:tid 36931] [client 217.182.139.33:36874] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adqh20Gk5GhxTCzHUOpTngAAARQ"]
[Sun Apr 12 03:32:45.841401 2026] [:error] [pid 45064:tid 45101] [client 217.182.139.33:45324] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adqh3ZcHBvLyJ6EUhUomugAAAUg"]
[Sun Apr 12 03:32:48.350710 2026] [:error] [pid 44701:tid 44793] [client 217.182.139.33:45330] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adqh4BGZAP4MrlxEPFdnFAAAAFI"]
[Sun Apr 12 03:32:50.867513 2026] [:error] [pid 44698:tid 44709] [client 217.182.139.33:45340] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adqh4hgoH9UWd-U3D56ijgAAAIY"]
[Sun Apr 12 04:21:58.945392 2026] [:error] [pid 25327:tid 25341] [client 170.106.82.209:42470] [client 170.106.82.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adqtZi6h2tZEVJo9JFIzIgAAAAU"]
[Sun Apr 12 05:29:53.698406 2026] [:error] [pid 25437:tid 25451] [client 182.44.67.97:40275] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adq9UXf97wYZje1ep_NPuAAAAMw"]
[Sun Apr 12 05:55:39.425827 2026] [proxy_fcgi:error] [pid 25327:tid 25357] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:39.689902 2026] [proxy_fcgi:error] [pid 25327:tid 25341] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:39.954124 2026] [proxy_fcgi:error] [pid 25327:tid 25352] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:40.482502 2026] [proxy_fcgi:error] [pid 25327:tid 25353] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:40.745673 2026] [proxy_fcgi:error] [pid 25327:tid 25337] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:41.010867 2026] [proxy_fcgi:error] [pid 25327:tid 25355] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:41.275115 2026] [proxy_fcgi:error] [pid 25327:tid 25343] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:41.539130 2026] [proxy_fcgi:error] [pid 25327:tid 25336] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:41.802878 2026] [proxy_fcgi:error] [pid 25327:tid 25346] [client 20.91.190.16:54223] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 05:55:42.064011 2026] [:error] [pid 25327:tid 25347] [client 20.91.190.16:54223] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a.php"] [unique_id "adrDXi6h2tZEVJo9JFJExwAAAAs"]
[Sun Apr 12 05:55:42.582602 2026] [:error] [pid 26600:tid 26629] [client 20.91.190.16:8812] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a.php"] [unique_id "adrDXu1YwAZiXhQKLYp9rAAAAYA"]
[Sun Apr 12 05:55:43.108228 2026] [:error] [pid 25328:tid 25367] [client 20.91.190.16:57193] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a.php"] [unique_id "adrDX8xUaQZxT-e0YsDpSgAAAEM"]
[Sun Apr 12 05:55:43.625575 2026] [:error] [pid 25328:tid 25366] [client 20.91.190.16:38316] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a.php"] [unique_id "adrDX8xUaQZxT-e0YsDpSwAAAEI"]
[Sun Apr 12 05:55:44.144051 2026] [:error] [pid 25328:tid 25396] [client 20.91.190.16:29755] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adrDYMxUaQZxT-e0YsDpTgAAAFM"]
[Sun Apr 12 05:55:44.663735 2026] [:error] [pid 26567:tid 26581] [client 20.91.190.16:58338] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adrDYHhRpg6ptWFyFx0C1gAAAQw"]
[Sun Apr 12 05:55:45.186693 2026] [:error] [pid 25329:tid 25382] [client 20.91.190.16:21367] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adrDYWdcIYsS8Iyaj101uQAAAIQ"]
[Sun Apr 12 05:55:45.709069 2026] [:error] [pid 60280:tid 60293] [client 20.91.190.16:22385] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "adrDYXBlLnDOYuIykkjtwQAAAcs"]
[Sun Apr 12 05:55:46.249404 2026] [:error] [pid 25328:tid 25369] [client 20.91.190.16:27614] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "adrDYsxUaQZxT-e0YsDpUQAAAEU"]
[Sun Apr 12 05:55:46.768623 2026] [:error] [pid 25328:tid 25370] [client 20.91.190.16:49392] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "adrDYsxUaQZxT-e0YsDpUgAAAEY"]
[Sun Apr 12 05:55:47.307328 2026] [:error] [pid 25328:tid 25401] [client 20.91.190.16:27611] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "adrDY8xUaQZxT-e0YsDpUwAAAFU"]
[Sun Apr 12 05:55:47.827369 2026] [:error] [pid 26567:tid 26590] [client 20.91.190.16:49857] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "adrDY3hRpg6ptWFyFx0C2gAAARU"]
[Sun Apr 12 05:55:48.350895 2026] [:error] [pid 25328:tid 25387] [client 20.91.190.16:29696] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jquery.php"] [unique_id "adrDZMxUaQZxT-e0YsDpVQAAAE8"]
[Sun Apr 12 05:55:48.869977 2026] [:error] [pid 60280:tid 60295] [client 20.91.190.16:38314] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jquery.php"] [unique_id "adrDZHBlLnDOYuIykkjtyAAAAc0"]
[Sun Apr 12 05:55:49.389584 2026] [:error] [pid 60280:tid 60297] [client 20.91.190.16:23031] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jquery.php"] [unique_id "adrDZXBlLnDOYuIykkjtyQAAAc8"]
[Sun Apr 12 05:55:49.911930 2026] [:error] [pid 26567:tid 26586] [client 20.91.190.16:49867] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jquery.php"] [unique_id "adrDZXhRpg6ptWFyFx0C3AAAARE"]
[Sun Apr 12 05:55:50.432072 2026] [:error] [pid 26600:tid 26641] [client 20.91.190.16:17246] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adrDZu1YwAZiXhQKLYp9sQAAAYw"]
[Sun Apr 12 05:55:50.956897 2026] [:error] [pid 26600:tid 26634] [client 20.91.190.16:29756] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adrDZu1YwAZiXhQKLYp9swAAAYU"]
[Sun Apr 12 05:55:51.475002 2026] [:error] [pid 25328:tid 25389] [client 20.91.190.16:8774] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adrDZ8xUaQZxT-e0YsDpXAAAAFA"]
[Sun Apr 12 05:55:51.996908 2026] [:error] [pid 60280:tid 60293] [client 20.91.190.16:49367] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "adrDZ3BlLnDOYuIykkjt0AAAAcs"]
[Sun Apr 12 05:55:52.513622 2026] [:error] [pid 26599:tid 26611] [client 20.91.190.16:60361] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adrDaHG89LXoQbk_rwBECwAAAUk"]
[Sun Apr 12 05:55:53.030140 2026] [:error] [pid 60280:tid 60301] [client 20.91.190.16:49384] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adrDaXBlLnDOYuIykkjt1gAAAdM"]
[Sun Apr 12 05:55:53.554792 2026] [:error] [pid 25328:tid 25375] [client 20.91.190.16:8636] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adrDacxUaQZxT-e0YsDpYgAAAEk"]
[Sun Apr 12 05:55:54.073379 2026] [:error] [pid 26567:tid 26574] [client 20.91.190.16:22976] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "adrDanhRpg6ptWFyFx0C4QAAAQU"]
[Sun Apr 12 05:55:54.603937 2026] [:error] [pid 25327:tid 25349] [client 20.91.190.16:34509] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "adrDai6h2tZEVJo9JFJEyQAAAA0"]
[Sun Apr 12 05:55:55.129725 2026] [:error] [pid 60280:tid 60297] [client 20.91.190.16:53845] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "adrDa3BlLnDOYuIykkjt3AAAAc8"]
[Sun Apr 12 05:55:55.672894 2026] [:error] [pid 60280:tid 60306] [client 20.91.190.16:43161] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "adrDa3BlLnDOYuIykkjt3wAAAdg"]
[Sun Apr 12 05:55:56.193999 2026] [:error] [pid 26599:tid 26617] [client 20.91.190.16:57764] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "adrDbHG89LXoQbk_rwBEEQAAAU8"]
[Sun Apr 12 05:55:56.713957 2026] [:error] [pid 25328:tid 25389] [client 20.91.190.16:8613] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adrDbMxUaQZxT-e0YsDpaAAAAFA"]
[Sun Apr 12 05:55:57.231497 2026] [:error] [pid 25328:tid 25372] [client 20.91.190.16:63989] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adrDbcxUaQZxT-e0YsDpagAAAEc"]
[Sun Apr 12 05:55:57.763544 2026] [:error] [pid 60280:tid 60291] [client 20.91.190.16:63944] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adrDbXBlLnDOYuIykkjt4gAAAck"]
[Sun Apr 12 05:55:58.284385 2026] [:error] [pid 25328:tid 25379] [client 20.91.190.16:30380] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adrDbsxUaQZxT-e0YsDpbQAAAEs"]
[Sun Apr 12 05:55:58.804042 2026] [:error] [pid 26567:tid 26586] [client 20.91.190.16:63956] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-info.php"] [unique_id "adrDbnhRpg6ptWFyFx0C7AAAARE"]
[Sun Apr 12 05:55:59.351829 2026] [:error] [pid 25327:tid 25352] [client 20.91.190.16:53859] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-info.php"] [unique_id "adrDby6h2tZEVJo9JFJEzAAAABA"]
[Sun Apr 12 05:55:59.889842 2026] [:error] [pid 25327:tid 25342] [client 20.91.190.16:43164] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-info.php"] [unique_id "adrDby6h2tZEVJo9JFJEzwAAAAY"]
[Sun Apr 12 05:56:00.451600 2026] [:error] [pid 25329:tid 25402] [client 20.91.190.16:53841] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-info.php"] [unique_id "adrDcGdcIYsS8Iyaj101xAAAAI8"]
[Sun Apr 12 05:56:00.972988 2026] [:error] [pid 25329:tid 25390] [client 20.91.190.16:58325] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adrDcGdcIYsS8Iyaj101xgAAAIg"]
[Sun Apr 12 05:56:01.499834 2026] [:error] [pid 25328:tid 25394] [client 20.91.190.16:30367] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adrDccxUaQZxT-e0YsDpdQAAAFI"]
[Sun Apr 12 05:56:02.058456 2026] [:error] [pid 25328:tid 25366] [client 20.91.190.16:30356] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adrDcsxUaQZxT-e0YsDpeAAAAEI"]
[Sun Apr 12 05:56:02.597856 2026] [:error] [pid 26599:tid 26609] [client 20.91.190.16:53865] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "adrDcnG89LXoQbk_rwBEHwAAAUc"]
[Sun Apr 12 05:56:03.127780 2026] [:error] [pid 25329:tid 25412] [client 20.91.190.16:38296] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrDc2dcIYsS8Iyaj101zAAAAJU"]
[Sun Apr 12 05:56:03.655350 2026] [:error] [pid 25328:tid 25405] [client 20.91.190.16:17221] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrDc8xUaQZxT-e0YsDpfQAAAFc"]
[Sun Apr 12 05:56:04.173384 2026] [:error] [pid 25328:tid 25370] [client 20.91.190.16:30367] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrDdMxUaQZxT-e0YsDpfwAAAEY"]
[Sun Apr 12 05:56:04.691293 2026] [:error] [pid 25328:tid 25408] [client 20.91.190.16:53877] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/admin.php"] [unique_id "adrDdMxUaQZxT-e0YsDpggAAAFg"]
[Sun Apr 12 05:56:05.210315 2026] [:error] [pid 26600:tid 26629] [client 20.91.190.16:38302] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adrDde1YwAZiXhQKLYp9vQAAAYA"]
[Sun Apr 12 05:56:05.726536 2026] [:error] [pid 26600:tid 26631] [client 20.91.190.16:30361] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adrDde1YwAZiXhQKLYp9vgAAAYI"]
[Sun Apr 12 05:56:06.244524 2026] [:error] [pid 26567:tid 26585] [client 20.91.190.16:25038] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adrDdnhRpg6ptWFyFx0C9wAAARA"]
[Sun Apr 12 05:56:06.760666 2026] [:error] [pid 60280:tid 60284] [client 20.91.190.16:7838] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adrDdnBlLnDOYuIykkjt7AAAAcI"]
[Sun Apr 12 05:56:07.279364 2026] [:error] [pid 60280:tid 60304] [client 20.91.190.16:17242] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "adrDd3BlLnDOYuIykkjt7gAAAdY"]
[Sun Apr 12 05:56:07.803810 2026] [:error] [pid 26600:tid 26647] [client 20.91.190.16:52452] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "adrDd-1YwAZiXhQKLYp9wAAAAZI"]
[Sun Apr 12 05:56:08.325884 2026] [:error] [pid 26599:tid 26620] [client 20.91.190.16:38307] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "adrDeHG89LXoQbk_rwBEIgAAAVI"]
[Sun Apr 12 05:56:08.845616 2026] [:error] [pid 60280:tid 60303] [client 20.91.190.16:55757] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "adrDeHBlLnDOYuIykkjt9AAAAdU"]
[Sun Apr 12 05:56:09.363610 2026] [:error] [pid 26600:tid 26630] [client 20.91.190.16:25053] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adrDee1YwAZiXhQKLYp9xQAAAYE"]
[Sun Apr 12 05:56:09.884719 2026] [:error] [pid 26600:tid 26646] [client 20.91.190.16:31642] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adrDee1YwAZiXhQKLYp9xgAAAZE"]
[Sun Apr 12 05:56:10.407668 2026] [:error] [pid 26567:tid 26592] [client 20.91.190.16:31653] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adrDenhRpg6ptWFyFx0C-wAAARc"]
[Sun Apr 12 05:56:10.926669 2026] [:error] [pid 26567:tid 26586] [client 20.91.190.16:25039] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adrDenhRpg6ptWFyFx0C_AAAARE"]
[Sun Apr 12 05:56:11.453016 2026] [:error] [pid 26600:tid 26650] [client 20.91.190.16:17238] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adrDe-1YwAZiXhQKLYp9yAAAAZU"]
[Sun Apr 12 05:56:11.976126 2026] [:error] [pid 26599:tid 26617] [client 20.91.190.16:38295] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adrDe3G89LXoQbk_rwBEJQAAAU8"]
[Sun Apr 12 05:56:12.497320 2026] [:error] [pid 26567:tid 26576] [client 20.91.190.16:17224] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adrDfHhRpg6ptWFyFx0DAgAAAQc"]
[Sun Apr 12 05:56:13.014943 2026] [:error] [pid 26600:tid 26648] [client 20.91.190.16:38308] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "adrDfe1YwAZiXhQKLYp9ywAAAZM"]
[Sun Apr 12 05:56:13.543130 2026] [:error] [pid 26599:tid 26621] [client 20.91.190.16:65314] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "adrDfXG89LXoQbk_rwBEJgAAAVM"]
[Sun Apr 12 05:56:14.093567 2026] [:error] [pid 25327:tid 25347] [client 20.91.190.16:38274] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "adrDfi6h2tZEVJo9JFJE1wAAAAs"]
[Sun Apr 12 05:56:14.637313 2026] [:error] [pid 26567:tid 26585] [client 20.91.190.16:45740] [client 20.91.190.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "adrDfnhRpg6ptWFyFx0DCAAAARA"]
[Sun Apr 12 09:47:23.934783 2026] [proxy_fcgi:error] [pid 25328:tid 25405] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:24.186363 2026] [proxy_fcgi:error] [pid 25328:tid 25401] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:24.467481 2026] [proxy_fcgi:error] [pid 25328:tid 25380] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:24.718325 2026] [proxy_fcgi:error] [pid 25328:tid 25391] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:24.975630 2026] [proxy_fcgi:error] [pid 25328:tid 25373] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:25.215492 2026] [proxy_fcgi:error] [pid 25328:tid 25383] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:25.455419 2026] [proxy_fcgi:error] [pid 25328:tid 25372] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:25.695131 2026] [proxy_fcgi:error] [pid 25328:tid 25389] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:26.031415 2026] [proxy_fcgi:error] [pid 25328:tid 25396] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:26.384340 2026] [proxy_fcgi:error] [pid 25328:tid 25368] [client 158.158.55.67:32114] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:47:26.705926 2026] [:error] [pid 25328:tid 25370] [client 158.158.55.67:32114] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "adr5rsxUaQZxT-e0YsBBzAAAAEY"]
[Sun Apr 12 09:47:27.889459 2026] [:error] [pid 60280:tid 60290] [client 158.158.55.67:13113] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "adr5r3BlLnDOYuIykkhROwAAAcg"]
[Sun Apr 12 09:47:28.823280 2026] [:error] [pid 60280:tid 60292] [client 158.158.55.67:12944] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "adr5sHBlLnDOYuIykkhRRAAAAco"]
[Sun Apr 12 09:47:31.800100 2026] [:error] [pid 60280:tid 60300] [client 158.158.55.67:6468] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "adr5s3BlLnDOYuIykkhRWgAAAdI"]
[Sun Apr 12 09:47:32.936733 2026] [:error] [pid 60280:tid 60287] [client 158.158.55.67:42450] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adr5tHBlLnDOYuIykkhRYQAAAcU"]
[Sun Apr 12 09:47:33.683513 2026] [:error] [pid 60280:tid 60301] [client 158.158.55.67:38019] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adr5tXBlLnDOYuIykkhRZwAAAdM"]
[Sun Apr 12 09:47:34.548858 2026] [:error] [pid 25328:tid 25372] [client 158.158.55.67:6644] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adr5tsxUaQZxT-e0YsBB5gAAAEc"]
[Sun Apr 12 09:47:35.347466 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:6985] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "adr5t8xUaQZxT-e0YsBB6wAAAEs"]
[Sun Apr 12 09:47:36.859785 2026] [:error] [pid 60280:tid 60302] [client 158.158.55.67:32066] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adr5uHBlLnDOYuIykkhRdwAAAdQ"]
[Sun Apr 12 09:47:38.181286 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:38077] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adr5unBlLnDOYuIykkhRgQAAAck"]
[Sun Apr 12 09:47:39.464934 2026] [:error] [pid 25328:tid 25385] [client 158.158.55.67:13642] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adr5u8xUaQZxT-e0YsBB8AAAAE4"]
[Sun Apr 12 09:47:40.651881 2026] [:error] [pid 25328:tid 25375] [client 158.158.55.67:36034] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "adr5vMxUaQZxT-e0YsBB9QAAAEk"]
[Sun Apr 12 09:47:42.839288 2026] [:error] [pid 26567:tid 26572] [client 158.158.55.67:32096] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "adr5vnhRpg6ptWFyFx09xwAAAQM"]
[Sun Apr 12 09:47:43.755941 2026] [:error] [pid 25328:tid 25394] [client 158.158.55.67:42443] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "adr5v8xUaQZxT-e0YsBB_AAAAFI"]
[Sun Apr 12 09:47:44.401778 2026] [:error] [pid 26600:tid 26645] [client 158.158.55.67:30820] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "adr5wO1YwAZiXhQKLYqyLQAAAZA"]
[Sun Apr 12 09:47:45.070620 2026] [:error] [pid 26600:tid 26632] [client 158.158.55.67:17579] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "adr5we1YwAZiXhQKLYqyMAAAAYM"]
[Sun Apr 12 09:47:46.319940 2026] [:error] [pid 25327:tid 25357] [client 158.158.55.67:30808] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "adr5wi6h2tZEVJo9JFJ4hwAAABU"]
[Sun Apr 12 09:47:47.297768 2026] [:error] [pid 25328:tid 25377] [client 158.158.55.67:13685] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "adr5w8xUaQZxT-e0YsBCAgAAAEo"]
[Sun Apr 12 09:47:48.226745 2026] [:error] [pid 26600:tid 26641] [client 158.158.55.67:6481] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "adr5xO1YwAZiXhQKLYqyNQAAAYw"]
[Sun Apr 12 09:47:48.877114 2026] [:error] [pid 26600:tid 26640] [client 158.158.55.67:30111] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "adr5xO1YwAZiXhQKLYqyOAAAAYs"]
[Sun Apr 12 09:47:50.931543 2026] [:error] [pid 25328:tid 25380] [client 158.158.55.67:36838] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adr5xsxUaQZxT-e0YsBCBwAAAEw"]
[Sun Apr 12 09:47:52.061019 2026] [:error] [pid 26600:tid 26632] [client 158.158.55.67:6486] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adr5yO1YwAZiXhQKLYqyPAAAAYM"]
[Sun Apr 12 09:47:53.566232 2026] [:error] [pid 25328:tid 25365] [client 158.158.55.67:34510] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adr5ycxUaQZxT-e0YsBCDAAAAEE"]
[Sun Apr 12 09:47:54.344521 2026] [:error] [pid 60280:tid 60289] [client 158.158.55.67:30784] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "adr5ynBlLnDOYuIykkhRsQAAAcc"]
[Sun Apr 12 09:47:55.232541 2026] [:error] [pid 25328:tid 25364] [client 158.158.55.67:34524] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "adr5y8xUaQZxT-e0YsBCEgAAAEA"]
[Sun Apr 12 09:47:56.317570 2026] [:error] [pid 25328:tid 25401] [client 158.158.55.67:36090] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "adr5zMxUaQZxT-e0YsBCFgAAAFU"]
[Sun Apr 12 09:47:57.982737 2026] [:error] [pid 26600:tid 26632] [client 158.158.55.67:6494] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "adr5ze1YwAZiXhQKLYqySQAAAYM"]
[Sun Apr 12 09:47:59.190688 2026] [:error] [pid 60280:tid 60285] [client 158.158.55.67:17561] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "adr5z3BlLnDOYuIykkhRvwAAAcM"]
[Sun Apr 12 09:48:00.153874 2026] [:error] [pid 25437:tid 25459] [client 158.158.55.67:6627] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "adr50Hf97wYZje1ep_OXvwAAANQ"]
[Sun Apr 12 09:48:01.808171 2026] [:error] [pid 25328:tid 25408] [client 158.158.55.67:13086] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "adr50cxUaQZxT-e0YsBCIwAAAFg"]
[Sun Apr 12 09:48:02.786912 2026] [:error] [pid 25329:tid 25412] [client 158.158.55.67:6605] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "adr50mdcIYsS8Iyaj11ovAAAAJU"]
[Sun Apr 12 09:48:03.773562 2026] [:error] [pid 26600:tid 26647] [client 158.158.55.67:13258] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "adr50-1YwAZiXhQKLYqyTwAAAZI"]
[Sun Apr 12 09:48:04.706102 2026] [:error] [pid 26600:tid 26643] [client 158.158.55.67:13882] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adr51O1YwAZiXhQKLYqyVQAAAY4"]
[Sun Apr 12 09:48:05.510756 2026] [:error] [pid 25328:tid 25380] [client 158.158.55.67:34552] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adr51cxUaQZxT-e0YsBCLAAAAEw"]
[Sun Apr 12 09:48:06.367420 2026] [:error] [pid 25327:tid 25350] [client 158.158.55.67:13832] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adr51i6h2tZEVJo9JFJ4kgAAAA4"]
[Sun Apr 12 09:48:07.186421 2026] [:error] [pid 26567:tid 26582] [client 158.158.55.67:16623] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "adr513hRpg6ptWFyFx092QAAAQ0"]
[Sun Apr 12 09:48:07.920014 2026] [:error] [pid 26567:tid 26587] [client 158.158.55.67:17551] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adr513hRpg6ptWFyFx092gAAARI"]
[Sun Apr 12 09:48:08.885996 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:30136] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adr52MxUaQZxT-e0YsBCMAAAAEs"]
[Sun Apr 12 09:48:09.847053 2026] [:error] [pid 25328:tid 25370] [client 158.158.55.67:16531] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adr52cxUaQZxT-e0YsBCMwAAAEY"]
[Sun Apr 12 09:48:11.155683 2026] [:error] [pid 25328:tid 25398] [client 158.158.55.67:15031] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "adr528xUaQZxT-e0YsBCNAAAAFQ"]
[Sun Apr 12 09:48:12.050256 2026] [:error] [pid 26567:tid 26581] [client 158.158.55.67:14248] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "adr53HhRpg6ptWFyFx094wAAAQw"]
[Sun Apr 12 09:48:13.075623 2026] [:error] [pid 25328:tid 25368] [client 158.158.55.67:36810] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "adr53cxUaQZxT-e0YsBCOAAAAEQ"]
[Sun Apr 12 09:48:14.011083 2026] [:error] [pid 25327:tid 25344] [client 158.158.55.67:13875] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "adr53i6h2tZEVJo9JFJ4lgAAAAg"]
[Sun Apr 12 09:48:14.909612 2026] [:error] [pid 25437:tid 25443] [client 158.158.55.67:13104] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "adr53nf97wYZje1ep_OXyQAAAMQ"]
[Sun Apr 12 09:48:15.781987 2026] [:error] [pid 25437:tid 25458] [client 158.158.55.67:15004] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adr533f97wYZje1ep_OXywAAANM"]
[Sun Apr 12 09:48:17.392587 2026] [:error] [pid 25328:tid 25369] [client 158.158.55.67:16617] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adr54cxUaQZxT-e0YsBCPgAAAEU"]
[Sun Apr 12 09:48:18.290637 2026] [:error] [pid 26599:tid 26607] [client 158.158.55.67:16379] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adr54nG89LXoQbk_rwB_EgAAAUU"]
[Sun Apr 12 09:48:19.006881 2026] [:error] [pid 25329:tid 25413] [client 158.158.55.67:16348] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "adr542dcIYsS8Iyaj11ovwAAAJY"]
[Sun Apr 12 09:48:20.122565 2026] [:error] [pid 25437:tid 25451] [client 158.158.55.67:36863] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adr55Hf97wYZje1ep_OX0QAAAMw"]
[Sun Apr 12 09:48:21.125732 2026] [:error] [pid 60280:tid 60284] [client 158.158.55.67:13869] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adr55XBlLnDOYuIykkhR1AAAAcI"]
[Sun Apr 12 09:48:21.806705 2026] [:error] [pid 25437:tid 25458] [client 158.158.55.67:16523] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adr55Xf97wYZje1ep_OX2QAAANM"]
[Sun Apr 12 09:48:22.924902 2026] [:error] [pid 60280:tid 60305] [client 158.158.55.67:16332] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "adr55nBlLnDOYuIykkhR1gAAAdc"]
[Sun Apr 12 09:48:23.651718 2026] [:error] [pid 60280:tid 60297] [client 158.158.55.67:17401] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "adr553BlLnDOYuIykkhR2AAAAc8"]
[Sun Apr 12 09:48:24.734421 2026] [:error] [pid 25327:tid 25346] [client 158.158.55.67:40579] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "adr56C6h2tZEVJo9JFJ4nAAAAAo"]
[Sun Apr 12 09:48:25.591487 2026] [:error] [pid 60280:tid 60285] [client 158.158.55.67:17582] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "adr56XBlLnDOYuIykkhR4AAAAcM"]
[Sun Apr 12 09:48:26.219607 2026] [proxy_fcgi:error] [pid 60280:tid 60288] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:26.464463 2026] [proxy_fcgi:error] [pid 60280:tid 60296] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:26.705444 2026] [proxy_fcgi:error] [pid 60280:tid 60286] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:26.949848 2026] [proxy_fcgi:error] [pid 60280:tid 60289] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:28.321750 2026] [proxy_fcgi:error] [pid 60280:tid 60300] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:28.562382 2026] [proxy_fcgi:error] [pid 60280:tid 60306] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:28.918465 2026] [proxy_fcgi:error] [pid 60280:tid 60294] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:29.171808 2026] [proxy_fcgi:error] [pid 60280:tid 60285] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:29.531276 2026] [proxy_fcgi:error] [pid 60280:tid 60290] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:29.772845 2026] [proxy_fcgi:error] [pid 60280:tid 60302] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:30.019956 2026] [proxy_fcgi:error] [pid 60280:tid 60284] [client 158.158.55.67:38014] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:48:30.302585 2026] [:error] [pid 60280:tid 60293] [client 158.158.55.67:38014] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "adr57nBlLnDOYuIykkhR8QAAAcs"]
[Sun Apr 12 09:48:31.063162 2026] [:error] [pid 25329:tid 25390] [client 158.158.55.67:38010] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "adr572dcIYsS8Iyaj11owwAAAIg"]
[Sun Apr 12 09:48:32.210087 2026] [:error] [pid 26567:tid 26579] [client 158.158.55.67:6375] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "adr58HhRpg6ptWFyFx097QAAAQo"]
[Sun Apr 12 09:48:33.199967 2026] [:error] [pid 25437:tid 25446] [client 158.158.55.67:13471] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "adr58Xf97wYZje1ep_OX7gAAAMc"]
[Sun Apr 12 09:48:34.129250 2026] [:error] [pid 60280:tid 60301] [client 158.158.55.67:14218] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "adr58nBlLnDOYuIykkhR8gAAAdM"]
[Sun Apr 12 09:48:35.144847 2026] [:error] [pid 26599:tid 26614] [client 158.158.55.67:16585] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "adr583G89LXoQbk_rwB_GgAAAUw"]
[Sun Apr 12 09:48:36.934558 2026] [:error] [pid 25328:tid 25365] [client 158.158.55.67:35035] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "adr59MxUaQZxT-e0YsBCUgAAAEE"]
[Sun Apr 12 09:48:38.542946 2026] [:error] [pid 25328:tid 25372] [client 158.158.55.67:36104] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "adr59sxUaQZxT-e0YsBCUwAAAEc"]
[Sun Apr 12 09:48:40.197694 2026] [:error] [pid 60280:tid 60289] [client 158.158.55.67:15833] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adr5-HBlLnDOYuIykkhR-wAAAcc"]
[Sun Apr 12 09:48:44.669958 2026] [:error] [pid 25329:tid 25381] [client 158.158.55.67:15860] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adr5_GdcIYsS8Iyaj11ozQAAAIM"]
[Sun Apr 12 09:48:45.854718 2026] [:error] [pid 60280:tid 60294] [client 158.158.55.67:6347] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adr5_XBlLnDOYuIykkhSCwAAAcw"]
[Sun Apr 12 09:48:46.581181 2026] [:error] [pid 25329:tid 25376] [client 158.158.55.67:6391] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "adr5_mdcIYsS8Iyaj11ozwAAAIE"]
[Sun Apr 12 09:48:47.382898 2026] [:error] [pid 26567:tid 26569] [client 158.158.55.67:35025] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "adr5_3hRpg6ptWFyFx09_QAAAQA"]
[Sun Apr 12 09:48:48.545850 2026] [:error] [pid 60280:tid 60288] [client 158.158.55.67:32989] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "adr6AHBlLnDOYuIykkhSEwAAAcY"]
[Sun Apr 12 09:48:49.627927 2026] [:error] [pid 25437:tid 25461] [client 158.158.55.67:18191] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "adr6AXf97wYZje1ep_OYCQAAANY"]
[Sun Apr 12 09:48:50.471925 2026] [:error] [pid 60280:tid 60299] [client 158.158.55.67:30407] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "adr6AnBlLnDOYuIykkhSHgAAAdE"]
[Sun Apr 12 09:48:51.209548 2026] [:error] [pid 60280:tid 60304] [client 158.158.55.67:35069] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "adr6A3BlLnDOYuIykkhSIQAAAdY"]
[Sun Apr 12 09:48:52.237550 2026] [:error] [pid 25437:tid 25463] [client 158.158.55.67:16884] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "adr6BHf97wYZje1ep_OYEgAAANg"]
[Sun Apr 12 09:48:53.114651 2026] [:error] [pid 26567:tid 26573] [client 158.158.55.67:35015] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "adr6BXhRpg6ptWFyFx0-AgAAAQQ"]
[Sun Apr 12 09:48:53.982302 2026] [:error] [pid 25328:tid 25364] [client 158.158.55.67:32967] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.mopj.php"] [unique_id "adr6BcxUaQZxT-e0YsBCXAAAAEA"]
[Sun Apr 12 09:48:56.451930 2026] [:error] [pid 26600:tid 26638] [client 158.158.55.67:18213] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adr6CO1YwAZiXhQKLYqy9QAAAYk"]
[Sun Apr 12 09:48:57.517775 2026] [:error] [pid 26600:tid 26637] [client 158.158.55.67:13955] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adr6Ce1YwAZiXhQKLYqy-QAAAYg"]
[Sun Apr 12 09:48:58.533099 2026] [:error] [pid 60280:tid 60290] [client 158.158.55.67:13491] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adr6CnBlLnDOYuIykkhSLwAAAcg"]
[Sun Apr 12 09:48:59.809077 2026] [:error] [pid 60280:tid 60295] [client 158.158.55.67:14063] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "adr6C3BlLnDOYuIykkhSMgAAAc0"]
[Sun Apr 12 09:49:00.934983 2026] [:error] [pid 25328:tid 25366] [client 158.158.55.67:17075] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "adr6DMxUaQZxT-e0YsBCeAAAAEI"]
[Sun Apr 12 09:49:02.001671 2026] [:error] [pid 25328:tid 25401] [client 158.158.55.67:15078] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "adr6DsxUaQZxT-e0YsBCfwAAAFU"]
[Sun Apr 12 09:49:02.635568 2026] [:error] [pid 26599:tid 26603] [client 158.158.55.67:52366] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "adr6DnG89LXoQbk_rwB_LAAAAUE"]
[Sun Apr 12 09:49:03.290115 2026] [:error] [pid 60280:tid 60301] [client 158.158.55.67:58711] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nano.php"] [unique_id "adr6D3BlLnDOYuIykkhSOgAAAdM"]
[Sun Apr 12 09:49:06.610422 2026] [:error] [pid 25437:tid 25455] [client 158.158.55.67:20275] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "adr6Enf97wYZje1ep_OYQAAAANA"]
[Sun Apr 12 09:49:07.605607 2026] [:error] [pid 25327:tid 25346] [client 158.158.55.67:14072] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "adr6Ey6h2tZEVJo9JFJ4uAAAAAo"]
[Sun Apr 12 09:49:09.044972 2026] [:error] [pid 25437:tid 25454] [client 158.158.55.67:58739] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "adr6FXf97wYZje1ep_OYSgAAAM8"]
[Sun Apr 12 09:49:11.481070 2026] [:error] [pid 26599:tid 26618] [client 158.158.55.67:52392] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "adr6F3G89LXoQbk_rwB_OgAAAVA"]
[Sun Apr 12 09:49:12.746323 2026] [:error] [pid 60280:tid 60304] [client 158.158.55.67:20273] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adr6GHBlLnDOYuIykkhSPQAAAdY"]
[Sun Apr 12 09:49:14.700612 2026] [:error] [pid 60280:tid 60298] [client 158.158.55.67:57526] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adr6GnBlLnDOYuIykkhSQwAAAdA"]
[Sun Apr 12 09:49:15.959637 2026] [:error] [pid 25327:tid 25345] [client 158.158.55.67:13382] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adr6Gy6h2tZEVJo9JFJ4vQAAAAk"]
[Sun Apr 12 09:49:17.378862 2026] [:error] [pid 25437:tid 25441] [client 158.158.55.67:57492] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "adr6HXf97wYZje1ep_OYXAAAAMI"]
[Sun Apr 12 09:49:18.511808 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:35555] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adr6HsxUaQZxT-e0YsBCnQAAAEs"]
[Sun Apr 12 09:49:19.521466 2026] [:error] [pid 26600:tid 26629] [client 158.158.55.67:20225] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adr6H-1YwAZiXhQKLYqzBwAAAYA"]
[Sun Apr 12 09:49:20.306700 2026] [:error] [pid 26600:tid 26635] [client 158.158.55.67:29506] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adr6IO1YwAZiXhQKLYqzDAAAAYY"]
[Sun Apr 12 09:49:22.948307 2026] [:error] [pid 60280:tid 60295] [client 158.158.55.67:54359] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "adr6InBlLnDOYuIykkhSYQAAAc0"]
[Sun Apr 12 09:49:23.968544 2026] [:error] [pid 25328:tid 25380] [client 158.158.55.67:54399] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adr6I8xUaQZxT-e0YsBCqQAAAEw"]
[Sun Apr 12 09:49:24.892055 2026] [:error] [pid 26567:tid 26583] [client 158.158.55.67:33068] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adr6JHhRpg6ptWFyFx0-FAAAAQ4"]
[Sun Apr 12 09:49:26.413332 2026] [:error] [pid 26600:tid 26631] [client 158.158.55.67:33046] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adr6Ju1YwAZiXhQKLYqzEgAAAYI"]
[Sun Apr 12 09:49:27.749721 2026] [:error] [pid 26599:tid 26607] [client 158.158.55.67:34005] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "adr6J3G89LXoQbk_rwB_TAAAAUU"]
[Sun Apr 12 09:49:29.989308 2026] [:error] [pid 26599:tid 26615] [client 158.158.55.67:35110] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "adr6KXG89LXoQbk_rwB_UAAAAU0"]
[Sun Apr 12 09:49:32.053877 2026] [proxy_fcgi:error] [pid 25328:tid 25383] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:32.394318 2026] [proxy_fcgi:error] [pid 25328:tid 25387] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:32.646084 2026] [proxy_fcgi:error] [pid 25328:tid 25364] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:32.884176 2026] [proxy_fcgi:error] [pid 25328:tid 25365] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:33.150389 2026] [proxy_fcgi:error] [pid 25328:tid 25380] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:33.390071 2026] [proxy_fcgi:error] [pid 25328:tid 25367] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:33.628637 2026] [proxy_fcgi:error] [pid 25328:tid 25368] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:33.866936 2026] [proxy_fcgi:error] [pid 25328:tid 25408] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:34.270760 2026] [proxy_fcgi:error] [pid 25328:tid 25394] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:34.513382 2026] [proxy_fcgi:error] [pid 25328:tid 25405] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:34.752499 2026] [proxy_fcgi:error] [pid 25328:tid 25372] [client 158.158.55.67:12469] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:49:34.996540 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:12469] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adr6LsxUaQZxT-e0YsBCwwAAAEs"]
[Sun Apr 12 09:49:36.130906 2026] [:error] [pid 60280:tid 60292] [client 158.158.55.67:14731] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adr6MHBlLnDOYuIykkhSdQAAAco"]
[Sun Apr 12 09:49:38.011082 2026] [:error] [pid 25328:tid 25387] [client 158.158.55.67:14740] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adr6MsxUaQZxT-e0YsBCygAAAE8"]
[Sun Apr 12 09:49:39.028720 2026] [:error] [pid 26567:tid 26591] [client 158.158.55.67:56805] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "adr6M3hRpg6ptWFyFx0-IwAAARY"]
[Sun Apr 12 09:49:40.122859 2026] [:error] [pid 60280:tid 60282] [client 158.158.55.67:14510] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6NHBlLnDOYuIykkhSfAAAAcA"]
[Sun Apr 12 09:49:41.080583 2026] [:error] [pid 60280:tid 60300] [client 158.158.55.67:40562] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6NXBlLnDOYuIykkhSfwAAAdI"]
[Sun Apr 12 09:49:42.159010 2026] [:error] [pid 60280:tid 60299] [client 158.158.55.67:55006] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6NnBlLnDOYuIykkhShAAAAdE"]
[Sun Apr 12 09:49:43.283293 2026] [:error] [pid 25329:tid 25412] [client 158.158.55.67:56164] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6N2dcIYsS8Iyaj11o5QAAAJU"]
[Sun Apr 12 09:49:44.075554 2026] [:error] [pid 25327:tid 25345] [client 158.158.55.67:18610] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adr6OC6h2tZEVJo9JFJ4zAAAAAk"]
[Sun Apr 12 09:49:45.482101 2026] [:error] [pid 26600:tid 26648] [client 158.158.55.67:18619] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adr6Oe1YwAZiXhQKLYqzHQAAAZM"]
[Sun Apr 12 09:49:46.718183 2026] [:error] [pid 25437:tid 25455] [client 158.158.55.67:46884] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adr6Onf97wYZje1ep_OYbQAAANA"]
[Sun Apr 12 09:49:47.873648 2026] [:error] [pid 25328:tid 25373] [client 158.158.55.67:14723] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "adr6O8xUaQZxT-e0YsBC3gAAAEg"]
[Sun Apr 12 09:49:49.175343 2026] [:error] [pid 25328:tid 25367] [client 158.158.55.67:14509] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "adr6PcxUaQZxT-e0YsBC4gAAAEM"]
[Sun Apr 12 09:49:50.825283 2026] [:error] [pid 26600:tid 26641] [client 158.158.55.67:18596] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "adr6Pu1YwAZiXhQKLYqzIQAAAYw"]
[Sun Apr 12 09:49:51.912357 2026] [:error] [pid 25329:tid 25414] [client 158.158.55.67:6772] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "adr6P2dcIYsS8Iyaj11o5wAAAJc"]
[Sun Apr 12 09:49:53.089714 2026] [:error] [pid 26600:tid 26646] [client 158.158.55.67:12800] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sf.php"] [unique_id "adr6Qe1YwAZiXhQKLYqzKgAAAZE"]
[Sun Apr 12 09:49:54.472094 2026] [:error] [pid 25437:tid 25456] [client 158.158.55.67:14782] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "adr6Qnf97wYZje1ep_OYdAAAANE"]
[Sun Apr 12 09:49:55.499184 2026] [:error] [pid 25437:tid 25454] [client 158.158.55.67:56794] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "adr6Q3f97wYZje1ep_OYdwAAAM8"]
[Sun Apr 12 09:49:56.693312 2026] [:error] [pid 26567:tid 26571] [client 158.158.55.67:54982] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "adr6RHhRpg6ptWFyFx0-PwAAAQI"]
[Sun Apr 12 09:49:57.887828 2026] [:error] [pid 26600:tid 26631] [client 158.158.55.67:12531] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "adr6Re1YwAZiXhQKLYqzLwAAAYI"]
[Sun Apr 12 09:49:59.067583 2026] [:error] [pid 25437:tid 25442] [client 158.158.55.67:14524] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "adr6R3f97wYZje1ep_OYgAAAAMM"]
[Sun Apr 12 09:50:00.927268 2026] [:error] [pid 25328:tid 25364] [client 158.158.55.67:17632] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "adr6SMxUaQZxT-e0YsBC6wAAAEA"]
[Sun Apr 12 09:50:02.053300 2026] [:error] [pid 26600:tid 26652] [client 158.158.55.67:39399] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "adr6Su1YwAZiXhQKLYqzNwAAAZc"]
[Sun Apr 12 09:50:04.883641 2026] [:error] [pid 25327:tid 25355] [client 158.158.55.67:56826] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "adr6TC6h2tZEVJo9JFJ47QAAABM"]
[Sun Apr 12 09:50:05.872135 2026] [:error] [pid 25329:tid 25411] [client 158.158.55.67:56796] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "adr6TWdcIYsS8Iyaj11o6wAAAJQ"]
[Sun Apr 12 09:50:06.838340 2026] [:error] [pid 25437:tid 25460] [client 158.158.55.67:35130] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "adr6Tnf97wYZje1ep_OYjAAAANU"]
[Sun Apr 12 09:50:08.092016 2026] [:error] [pid 25437:tid 25462] [client 158.158.55.67:60817] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "adr6UHf97wYZje1ep_OYkgAAANc"]
[Sun Apr 12 09:50:09.249836 2026] [:error] [pid 25437:tid 25442] [client 158.158.55.67:34101] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "adr6UXf97wYZje1ep_OYngAAAMM"]
[Sun Apr 12 09:50:09.988547 2026] [:error] [pid 25437:tid 25461] [client 158.158.55.67:31785] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adr6UXf97wYZje1ep_OYoAAAANY"]
[Sun Apr 12 09:50:11.183438 2026] [:error] [pid 25327:tid 25339] [client 158.158.55.67:21299] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adr6Uy6h2tZEVJo9JFJ48gAAAAM"]
[Sun Apr 12 09:50:12.023370 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:34099] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adr6VHBlLnDOYuIykkhSwQAAAck"]
[Sun Apr 12 09:50:13.175204 2026] [:error] [pid 25327:tid 25349] [client 158.158.55.67:33036] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "adr6VS6h2tZEVJo9JFJ48wAAAA0"]
[Sun Apr 12 09:50:14.061807 2026] [:error] [pid 25327:tid 25346] [client 158.158.55.67:44111] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adr6Vi6h2tZEVJo9JFJ4-AAAAAo"]
[Sun Apr 12 09:50:15.166089 2026] [:error] [pid 25328:tid 25369] [client 158.158.55.67:53029] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adr6V8xUaQZxT-e0YsBC-AAAAEU"]
[Sun Apr 12 09:50:16.412339 2026] [:error] [pid 26600:tid 26640] [client 158.158.55.67:58157] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adr6WO1YwAZiXhQKLYqzTwAAAYs"]
[Sun Apr 12 09:50:18.266172 2026] [:error] [pid 25328:tid 25396] [client 158.158.55.67:20349] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "adr6WsxUaQZxT-e0YsBDAwAAAFM"]
[Sun Apr 12 09:50:19.416159 2026] [:error] [pid 60280:tid 60299] [client 158.158.55.67:33524] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adr6W3BlLnDOYuIykkhS0gAAAdE"]
[Sun Apr 12 09:50:21.352890 2026] [:error] [pid 26599:tid 26613] [client 158.158.55.67:6554] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adr6XXG89LXoQbk_rwB_agAAAUs"]
[Sun Apr 12 09:50:24.087649 2026] [:error] [pid 26567:tid 26590] [client 158.158.55.67:6584] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adr6YHhRpg6ptWFyFx0-UQAAARU"]
[Sun Apr 12 09:50:25.292601 2026] [:error] [pid 26600:tid 26648] [client 158.158.55.67:6277] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "adr6Ye1YwAZiXhQKLYqzVwAAAZM"]
[Sun Apr 12 09:50:26.025308 2026] [:error] [pid 60280:tid 60299] [client 158.158.55.67:14076] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6YnBlLnDOYuIykkhS4AAAAdE"]
[Sun Apr 12 09:50:27.345713 2026] [:error] [pid 25437:tid 25442] [client 158.158.55.67:32960] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6Y3f97wYZje1ep_OYrgAAAMM"]
[Sun Apr 12 09:50:28.530006 2026] [:error] [pid 26567:tid 26569] [client 158.158.55.67:13463] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6ZHhRpg6ptWFyFx0-VgAAAQA"]
[Sun Apr 12 09:50:29.577016 2026] [:error] [pid 26567:tid 26587] [client 158.158.55.67:35061] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6ZXhRpg6ptWFyFx0-XAAAARI"]
[Sun Apr 12 09:50:30.410074 2026] [:error] [pid 25328:tid 25398] [client 158.158.55.67:38000] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adr6ZsxUaQZxT-e0YsBDIQAAAFQ"]
[Sun Apr 12 09:50:31.332483 2026] [:error] [pid 60280:tid 60297] [client 158.158.55.67:16568] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adr6Z3BlLnDOYuIykkhS7AAAAc8"]
[Sun Apr 12 09:50:32.055502 2026] [:error] [pid 26599:tid 26603] [client 158.158.55.67:16337] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adr6aHG89LXoQbk_rwB_bwAAAUE"]
[Sun Apr 12 09:50:33.608431 2026] [:error] [pid 26567:tid 26590] [client 158.158.55.67:6609] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "adr6aXhRpg6ptWFyFx0-YQAAARU"]
[Sun Apr 12 09:50:34.517752 2026] [proxy_fcgi:error] [pid 60280:tid 60287] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:34.757330 2026] [proxy_fcgi:error] [pid 60280:tid 60282] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:34.995787 2026] [proxy_fcgi:error] [pid 60280:tid 60305] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:35.234739 2026] [proxy_fcgi:error] [pid 60280:tid 60285] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:35.489009 2026] [proxy_fcgi:error] [pid 60280:tid 60283] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:35.751129 2026] [proxy_fcgi:error] [pid 60280:tid 60290] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:36.957356 2026] [proxy_fcgi:error] [pid 60280:tid 60299] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:37.447476 2026] [proxy_fcgi:error] [pid 60280:tid 60303] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:37.685551 2026] [proxy_fcgi:error] [pid 60280:tid 60293] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:37.923958 2026] [proxy_fcgi:error] [pid 60280:tid 60282] [client 158.158.55.67:12566] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:50:38.159128 2026] [:error] [pid 60280:tid 60304] [client 158.158.55.67:12566] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adr6bnBlLnDOYuIykkhTBQAAAdY"]
[Sun Apr 12 09:50:39.278014 2026] [:error] [pid 60280:tid 60298] [client 158.158.55.67:12946] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adr6b3BlLnDOYuIykkhTCwAAAdA"]
[Sun Apr 12 09:50:40.617406 2026] [:error] [pid 25329:tid 25400] [client 158.158.55.67:30017] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adr6cGdcIYsS8Iyaj11o-AAAAI4"]
[Sun Apr 12 09:50:41.566081 2026] [:error] [pid 25437:tid 25453] [client 158.158.55.67:36040] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "adr6cXf97wYZje1ep_OYxQAAAM4"]
[Sun Apr 12 09:50:42.289163 2026] [:error] [pid 25329:tid 25382] [client 158.158.55.67:12701] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adr6cmdcIYsS8Iyaj11o-wAAAIQ"]
[Sun Apr 12 09:50:43.369593 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:7045] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adr6c8xUaQZxT-e0YsBDVAAAAEs"]
[Sun Apr 12 09:50:44.646575 2026] [:error] [pid 26567:tid 26584] [client 158.158.55.67:36041] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adr6dHhRpg6ptWFyFx0-gQAAAQ8"]
[Sun Apr 12 09:50:45.777027 2026] [:error] [pid 60280:tid 60297] [client 158.158.55.67:15339] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "adr6dXBlLnDOYuIykkhTKAAAAc8"]
[Sun Apr 12 09:50:46.865060 2026] [:error] [pid 25437:tid 25457] [client 158.158.55.67:16122] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adr6dnf97wYZje1ep_OYzgAAANI"]
[Sun Apr 12 09:50:47.537593 2026] [:error] [pid 60280:tid 60284] [client 158.158.55.67:49140] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adr6d3BlLnDOYuIykkhTLgAAAcI"]
[Sun Apr 12 09:50:48.384809 2026] [:error] [pid 60280:tid 60300] [client 158.158.55.67:36045] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adr6eHBlLnDOYuIykkhTMQAAAdI"]
[Sun Apr 12 09:50:50.394520 2026] [:error] [pid 25327:tid 25342] [client 158.158.55.67:16088] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "adr6ei6h2tZEVJo9JFJ5EwAAAAY"]
[Sun Apr 12 09:50:51.342524 2026] [:error] [pid 25328:tid 25385] [client 158.158.55.67:49124] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "adr6e8xUaQZxT-e0YsBDXgAAAE4"]
[Sun Apr 12 09:50:52.222348 2026] [:error] [pid 25328:tid 25379] [client 158.158.55.67:6243] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "adr6fMxUaQZxT-e0YsBDYQAAAEs"]
[Sun Apr 12 09:50:52.989606 2026] [:error] [pid 25329:tid 25390] [client 158.158.55.67:12371] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "adr6fGdcIYsS8Iyaj11o_AAAAIg"]
[Sun Apr 12 09:50:53.669727 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:12372] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "adr6fXBlLnDOYuIykkhTRgAAAck"]
[Sun Apr 12 09:50:54.462835 2026] [:error] [pid 60280:tid 60290] [client 158.158.55.67:12399] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adr6fnBlLnDOYuIykkhTTQAAAcg"]
[Sun Apr 12 09:50:55.133615 2026] [:error] [pid 60280:tid 60299] [client 158.158.55.67:16079] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adr6f3BlLnDOYuIykkhTUgAAAdE"]
[Sun Apr 12 09:50:56.530805 2026] [:error] [pid 60280:tid 60296] [client 158.158.55.67:36918] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adr6gHBlLnDOYuIykkhTVgAAAc4"]
[Sun Apr 12 09:50:57.533899 2026] [:error] [pid 60280:tid 60295] [client 158.158.55.67:31716] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "adr6gXBlLnDOYuIykkhTdQAAAc0"]
[Sun Apr 12 09:50:59.674555 2026] [:error] [pid 26600:tid 26644] [client 158.158.55.67:36886] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "adr6g-1YwAZiXhQKLYqzawAAAY8"]
[Sun Apr 12 09:51:00.839678 2026] [:error] [pid 25327:tid 25356] [client 158.158.55.67:6606] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "adr6hC6h2tZEVJo9JFJ5GgAAABQ"]
[Sun Apr 12 09:51:01.879757 2026] [:error] [pid 26567:tid 26588] [client 158.158.55.67:46196] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "adr6hXhRpg6ptWFyFx0-igAAARM"]
[Sun Apr 12 09:51:02.732889 2026] [:error] [pid 25328:tid 25398] [client 158.158.55.67:13910] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "adr6hsxUaQZxT-e0YsBDcwAAAFQ"]
[Sun Apr 12 09:51:03.472756 2026] [:error] [pid 25328:tid 25391] [client 158.158.55.67:18275] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "adr6h8xUaQZxT-e0YsBDdQAAAFE"]
[Sun Apr 12 09:51:04.244197 2026] [:error] [pid 25327:tid 25354] [client 158.158.55.67:16820] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "adr6iC6h2tZEVJo9JFJ5HwAAABI"]
[Sun Apr 12 09:51:05.465668 2026] [:error] [pid 25437:tid 25452] [client 158.158.55.67:36865] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "adr6iXf97wYZje1ep_OY7wAAAM0"]
[Sun Apr 12 09:51:06.443407 2026] [:error] [pid 25437:tid 25447] [client 158.158.55.67:13185] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "adr6inf97wYZje1ep_OY8QAAAMg"]
[Sun Apr 12 09:51:07.165440 2026] [:error] [pid 26600:tid 26649] [client 158.158.55.67:37351] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adr6i-1YwAZiXhQKLYqzdAAAAZQ"]
[Sun Apr 12 09:51:09.101585 2026] [:error] [pid 26600:tid 26646] [client 158.158.55.67:46178] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adr6je1YwAZiXhQKLYqzewAAAZE"]
[Sun Apr 12 09:51:09.847979 2026] [:error] [pid 26599:tid 26623] [client 158.158.55.67:52296] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adr6jXG89LXoQbk_rwB_hgAAAVU"]
[Sun Apr 12 09:51:11.775634 2026] [:error] [pid 60280:tid 60295] [client 158.158.55.67:36886] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "adr6j3BlLnDOYuIykkhUDQAAAc0"]
[Sun Apr 12 09:51:12.926311 2026] [:error] [pid 60280:tid 60302] [client 158.158.55.67:37325] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "adr6kHBlLnDOYuIykkhUEQAAAdQ"]
[Sun Apr 12 09:51:14.960804 2026] [:error] [pid 60280:tid 60306] [client 158.158.55.67:47487] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "adr6knBlLnDOYuIykkhUFAAAAdg"]
[Sun Apr 12 09:51:16.646035 2026] [:error] [pid 25328:tid 25377] [client 158.158.55.67:52321] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "adr6lMxUaQZxT-e0YsBDpwAAAEo"]
[Sun Apr 12 09:51:17.935709 2026] [:error] [pid 26567:tid 26588] [client 158.158.55.67:13521] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "adr6lXhRpg6ptWFyFx0-mQAAARM"]
[Sun Apr 12 09:51:18.531089 2026] [:error] [pid 25437:tid 25453] [client 158.158.55.67:40174] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6lnf97wYZje1ep_OZAAAAAM4"]
[Sun Apr 12 09:51:19.283182 2026] [:error] [pid 25328:tid 25385] [client 158.158.55.67:13565] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6l8xUaQZxT-e0YsBDqQAAAE4"]
[Sun Apr 12 09:51:20.630828 2026] [:error] [pid 26599:tid 26607] [client 158.158.55.67:42559] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6mHG89LXoQbk_rwB_jwAAAUU"]
[Sun Apr 12 09:51:21.535211 2026] [:error] [pid 25328:tid 25403] [client 158.158.55.67:13598] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "adr6mcxUaQZxT-e0YsBDrQAAAFY"]
[Sun Apr 12 09:51:22.231673 2026] [:error] [pid 25437:tid 25447] [client 158.158.55.67:31226] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adr6mnf97wYZje1ep_OZAgAAAMg"]
[Sun Apr 12 09:51:23.584160 2026] [:error] [pid 25437:tid 25459] [client 158.158.55.67:46785] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adr6m3f97wYZje1ep_OZBQAAANQ"]
[Sun Apr 12 09:51:24.447928 2026] [:error] [pid 26600:tid 26646] [client 158.158.55.67:20275] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adr6nO1YwAZiXhQKLYqzigAAAZE"]
[Sun Apr 12 09:51:25.100398 2026] [:error] [pid 25437:tid 25440] [client 158.158.55.67:48505] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adr6nXf97wYZje1ep_OZCwAAAME"]
[Sun Apr 12 09:51:26.023189 2026] [:error] [pid 25328:tid 25387] [client 158.158.55.67:15234] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "adr6nsxUaQZxT-e0YsBDswAAAE8"]
[Sun Apr 12 09:51:28.902094 2026] [:error] [pid 25328:tid 25401] [client 158.158.55.67:35618] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "adr6oMxUaQZxT-e0YsBDuAAAAFU"]
[Sun Apr 12 09:51:30.453682 2026] [:error] [pid 60280:tid 60303] [client 158.158.55.67:13024] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "adr6onBlLnDOYuIykkhUNwAAAdU"]
[Sun Apr 12 09:51:31.586675 2026] [:error] [pid 25328:tid 25364] [client 158.158.55.67:13045] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "adr6o8xUaQZxT-e0YsBDugAAAEA"]
[Sun Apr 12 09:51:32.485161 2026] [:error] [pid 25328:tid 25366] [client 158.158.55.67:31186] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "adr6pMxUaQZxT-e0YsBDuwAAAEI"]
[Sun Apr 12 09:51:33.560654 2026] [:error] [pid 25328:tid 25401] [client 158.158.55.67:17919] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "adr6pcxUaQZxT-e0YsBDyAAAAFU"]
[Sun Apr 12 09:51:35.217979 2026] [:error] [pid 26599:tid 26605] [client 158.158.55.67:58763] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "adr6p3G89LXoQbk_rwB_nAAAAUM"]
[Sun Apr 12 09:51:35.860136 2026] [:error] [pid 60280:tid 60304] [client 158.158.55.67:47814] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "adr6p3BlLnDOYuIykkhUPAAAAdY"]
[Sun Apr 12 09:51:36.717487 2026] [:error] [pid 26567:tid 26587] [client 158.158.55.67:29581] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "adr6qHhRpg6ptWFyFx0-uAAAARI"]
[Sun Apr 12 09:51:37.702160 2026] [proxy_fcgi:error] [pid 26599:tid 26613] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:37.943379 2026] [proxy_fcgi:error] [pid 26599:tid 26608] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:38.187912 2026] [proxy_fcgi:error] [pid 26599:tid 26623] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:38.439785 2026] [proxy_fcgi:error] [pid 26599:tid 26625] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:38.951378 2026] [proxy_fcgi:error] [pid 26599:tid 26606] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:39.262632 2026] [proxy_fcgi:error] [pid 26599:tid 26611] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:39.502702 2026] [proxy_fcgi:error] [pid 26599:tid 26626] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:39.754946 2026] [proxy_fcgi:error] [pid 26599:tid 26622] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:39.995876 2026] [proxy_fcgi:error] [pid 26599:tid 26619] [client 158.158.55.67:32182] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:51:40.471547 2026] [:error] [pid 26599:tid 26612] [client 158.158.55.67:32182] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adr6rHG89LXoQbk_rwB_swAAAUo"]
[Sun Apr 12 09:51:41.428709 2026] [:error] [pid 25328:tid 25405] [client 158.158.55.67:29610] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adr6rcxUaQZxT-e0YsBD1AAAAFc"]
[Sun Apr 12 09:51:43.335109 2026] [:error] [pid 25328:tid 25368] [client 158.158.55.67:43558] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adr6r8xUaQZxT-e0YsBD2wAAAEQ"]
[Sun Apr 12 09:51:44.003671 2026] [:error] [pid 25329:tid 25381] [client 158.158.55.67:44753] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "adr6sGdcIYsS8Iyaj11pGQAAAIM"]
[Sun Apr 12 09:51:44.871783 2026] [:error] [pid 60280:tid 60283] [client 158.158.55.67:29576] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adr6sHBlLnDOYuIykkhUTgAAAcE"]
[Sun Apr 12 09:51:46.654040 2026] [:error] [pid 25437:tid 25454] [client 158.158.55.67:15589] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adr6snf97wYZje1ep_OZIwAAAM8"]
[Sun Apr 12 09:51:48.060161 2026] [:error] [pid 25437:tid 25449] [client 158.158.55.67:44740] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adr6tHf97wYZje1ep_OZKQAAAMo"]
[Sun Apr 12 09:51:48.936307 2026] [:error] [pid 25328:tid 25408] [client 158.158.55.67:16036] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "adr6tMxUaQZxT-e0YsBD3QAAAFg"]
[Sun Apr 12 09:51:49.773133 2026] [:error] [pid 26600:tid 26645] [client 158.158.55.67:44750] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adr6te1YwAZiXhQKLYqzoQAAAZA"]
[Sun Apr 12 09:51:51.353327 2026] [:error] [pid 25437:tid 25448] [client 158.158.55.67:60168] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adr6t3f97wYZje1ep_OZMgAAAMk"]
[Sun Apr 12 09:51:52.432958 2026] [:error] [pid 25437:tid 25439] [client 158.158.55.67:19410] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adr6uHf97wYZje1ep_OZNwAAAMA"]
[Sun Apr 12 09:51:53.418894 2026] [:error] [pid 25329:tid 25412] [client 158.158.55.67:31268] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "adr6uWdcIYsS8Iyaj11pIQAAAJU"]
[Sun Apr 12 09:51:55.225430 2026] [:error] [pid 25328:tid 25364] [client 158.158.55.67:56250] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adr6u8xUaQZxT-e0YsBD5wAAAEA"]
[Sun Apr 12 09:51:56.273727 2026] [:error] [pid 25327:tid 25355] [client 158.158.55.67:43538] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adr6vC6h2tZEVJo9JFJ5VQAAABM"]
[Sun Apr 12 09:51:57.481418 2026] [:error] [pid 25437:tid 25454] [client 158.158.55.67:43546] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adr6vXf97wYZje1ep_OZQAAAAM8"]
[Sun Apr 12 09:51:59.424640 2026] [:error] [pid 60280:tid 60300] [client 158.158.55.67:43565] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "adr6v3BlLnDOYuIykkhUWgAAAdI"]
[Sun Apr 12 09:52:00.955485 2026] [:error] [pid 25437:tid 25439] [client 158.158.55.67:55513] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adr6wHf97wYZje1ep_OZRAAAAMA"]
[Sun Apr 12 09:52:02.745188 2026] [:error] [pid 26599:tid 26626] [client 158.158.55.67:56211] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adr6wnG89LXoQbk_rwB_vwAAAVg"]
[Sun Apr 12 09:52:03.465114 2026] [:error] [pid 25328:tid 25408] [client 158.158.55.67:14273] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adr6w8xUaQZxT-e0YsBD7QAAAFg"]
[Sun Apr 12 09:52:04.447631 2026] [:error] [pid 25328:tid 25383] [client 158.158.55.67:7134] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "adr6xMxUaQZxT-e0YsBD7wAAAE0"]
[Sun Apr 12 09:52:05.427657 2026] [:error] [pid 25328:tid 25405] [client 158.158.55.67:33556] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6xcxUaQZxT-e0YsBD8wAAAFc"]
[Sun Apr 12 09:52:06.551034 2026] [:error] [pid 25327:tid 25353] [client 158.158.55.67:18998] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6xi6h2tZEVJo9JFJ5YAAAABE"]
[Sun Apr 12 09:52:11.588599 2026] [:error] [pid 60280:tid 60296] [client 158.158.55.67:19010] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6y3BlLnDOYuIykkhUZwAAAc4"]
[Sun Apr 12 09:52:12.989696 2026] [:error] [pid 25328:tid 25383] [client 158.158.55.67:7156] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "adr6zMxUaQZxT-e0YsBEAAAAAE0"]
[Sun Apr 12 09:52:14.357905 2026] [:error] [pid 60280:tid 60293] [client 158.158.55.67:6910] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adr6znBlLnDOYuIykkhUbwAAAcs"]
[Sun Apr 12 09:52:15.476007 2026] [:error] [pid 26600:tid 26632] [client 158.158.55.67:47873] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adr6z-1YwAZiXhQKLYqzsAAAAYM"]
[Sun Apr 12 09:52:16.515047 2026] [:error] [pid 26567:tid 26575] [client 158.158.55.67:58157] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adr60HhRpg6ptWFyFx0-4wAAAQY"]
[Sun Apr 12 09:52:17.440346 2026] [:error] [pid 26600:tid 26653] [client 158.158.55.67:55502] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adr60e1YwAZiXhQKLYqztgAAAZg"]
[Sun Apr 12 09:52:18.170038 2026] [:error] [pid 26600:tid 26633] [client 158.158.55.67:12745] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adr60u1YwAZiXhQKLYqzuQAAAYQ"]
[Sun Apr 12 09:52:20.339810 2026] [:error] [pid 25437:tid 25445] [client 158.158.55.67:34597] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adr61Hf97wYZje1ep_OZZgAAAMY"]
[Sun Apr 12 09:52:21.396403 2026] [:error] [pid 25328:tid 25366] [client 158.158.55.67:12786] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adr61cxUaQZxT-e0YsBEBgAAAEI"]
[Sun Apr 12 09:52:22.556402 2026] [:error] [pid 26600:tid 26640] [client 158.158.55.67:55540] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "adr61u1YwAZiXhQKLYqz0gAAAYs"]
[Sun Apr 12 09:52:23.453442 2026] [:error] [pid 25327:tid 25343] [client 158.158.55.67:47908] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adr61y6h2tZEVJo9JFJ5aAAAAAc"]
[Sun Apr 12 09:52:24.447026 2026] [:error] [pid 26567:tid 26590] [client 158.158.55.67:33563] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adr62HhRpg6ptWFyFx0-7AAAARU"]
[Sun Apr 12 09:52:25.181668 2026] [:error] [pid 26599:tid 26606] [client 158.158.55.67:59332] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adr62XG89LXoQbk_rwB_5AAAAUQ"]
[Sun Apr 12 09:52:25.925690 2026] [:error] [pid 26600:tid 26645] [client 158.158.55.67:13331] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "adr62e1YwAZiXhQKLYqz3wAAAZA"]
[Sun Apr 12 09:52:27.523827 2026] [:error] [pid 26599:tid 26607] [client 158.158.55.67:6895] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "adr623G89LXoQbk_rwB_6gAAAUU"]
[Sun Apr 12 09:52:28.469680 2026] [:error] [pid 25327:tid 25350] [client 158.158.55.67:41885] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "adr63C6h2tZEVJo9JFJ5cAAAAA4"]
[Sun Apr 12 09:52:30.386033 2026] [:error] [pid 25327:tid 25356] [client 158.158.55.67:47881] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "adr63i6h2tZEVJo9JFJ5dAAAABQ"]
[Sun Apr 12 09:52:31.100462 2026] [:error] [pid 26599:tid 26615] [client 158.158.55.67:33542] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "adr633G89LXoQbk_rwB_8AAAAU0"]
[Sun Apr 12 09:52:31.866955 2026] [:error] [pid 26599:tid 26620] [client 158.158.55.67:34621] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "adr633G89LXoQbk_rwB_9QAAAVI"]
[Sun Apr 12 09:52:32.935869 2026] [:error] [pid 25437:tid 25453] [client 158.158.55.67:14800] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "adr64Hf97wYZje1ep_OZiwAAAM4"]
[Sun Apr 12 09:52:33.641349 2026] [:error] [pid 25328:tid 25366] [client 158.158.55.67:12789] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "adr64cxUaQZxT-e0YsBEOAAAAEI"]
[Sun Apr 12 09:52:34.776173 2026] [:error] [pid 25328:tid 25369] [client 158.158.55.67:55519] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "adr64sxUaQZxT-e0YsBEPAAAAEU"]
[Sun Apr 12 09:52:36.224057 2026] [:error] [pid 25328:tid 25375] [client 158.158.55.67:34616] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "adr65MxUaQZxT-e0YsBESAAAAEk"]
[Sun Apr 12 09:52:37.248114 2026] [:error] [pid 26600:tid 26631] [client 158.158.55.67:55493] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "adr65e1YwAZiXhQKLYq0AAAAAYI"]
[Sun Apr 12 09:52:38.058013 2026] [:error] [pid 25437:tid 25442] [client 158.158.55.67:19004] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "adr65nf97wYZje1ep_OZlAAAAMM"]
[Sun Apr 12 09:52:39.442505 2026] [:error] [pid 25327:tid 25352] [client 158.158.55.67:19719] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "adr65y6h2tZEVJo9JFJ5fQAAABA"]
[Sun Apr 12 09:52:40.212062 2026] [:error] [pid 25328:tid 25405] [client 158.158.55.67:12786] [client 158.158.55.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adr66MxUaQZxT-e0YsBEVQAAAFc"]
[Sun Apr 12 09:52:40.917249 2026] [proxy_fcgi:error] [pid 25437:tid 25461] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:41.659702 2026] [proxy_fcgi:error] [pid 25437:tid 25462] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:41.899798 2026] [proxy_fcgi:error] [pid 25437:tid 25453] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:42.146492 2026] [proxy_fcgi:error] [pid 25437:tid 25449] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:42.406698 2026] [proxy_fcgi:error] [pid 25437:tid 25463] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:42.647071 2026] [proxy_fcgi:error] [pid 25437:tid 25443] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:42.892754 2026] [proxy_fcgi:error] [pid 25437:tid 25459] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:43.132915 2026] [proxy_fcgi:error] [pid 25437:tid 25458] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:43.373378 2026] [proxy_fcgi:error] [pid 25437:tid 25446] [client 158.158.55.67:14308] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:52:43.740370 2026] [:error] [pid 25437:tid 25457] [client 158.158.55.67:14308] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adr663f97wYZje1ep_OZtgAAANI"]
[Sun Apr 12 09:52:44.693445 2026] [:error] [pid 26600:tid 26638] [client 158.158.55.67:17099] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adr67O1YwAZiXhQKLYq0AwAAAYk"]
[Sun Apr 12 09:52:45.877772 2026] [:error] [pid 26599:tid 26626] [client 158.158.55.67:19745] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adr67XG89LXoQbk_rwCAAwAAAVg"]
[Sun Apr 12 09:52:46.941749 2026] [:error] [pid 26599:tid 26611] [client 158.158.55.67:19758] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bengi.php"] [unique_id "adr67nG89LXoQbk_rwCABwAAAUk"]
[Sun Apr 12 09:52:47.764347 2026] [:error] [pid 25329:tid 25407] [client 158.158.55.67:13910] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr672dcIYsS8Iyaj11pTQAAAJI"]
[Sun Apr 12 09:52:49.174753 2026] [:error] [pid 25328:tid 25373] [client 158.158.55.67:18977] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr68cxUaQZxT-e0YsBEZQAAAEg"]
[Sun Apr 12 09:52:49.964860 2026] [:error] [pid 60280:tid 60286] [client 158.158.55.67:7137] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr68XBlLnDOYuIykkhUmwAAAcQ"]
[Sun Apr 12 09:52:51.242090 2026] [:error] [pid 26599:tid 26610] [client 158.158.55.67:7147] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adr683G89LXoQbk_rwCAEgAAAUg"]
[Sun Apr 12 09:52:52.179026 2026] [:error] [pid 26599:tid 26619] [client 158.158.55.67:12798] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adr69HG89LXoQbk_rwCAFgAAAVE"]
[Sun Apr 12 09:52:52.950495 2026] [:error] [pid 25329:tid 25397] [client 158.158.55.67:19774] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adr69GdcIYsS8Iyaj11pTgAAAIw"]
[Sun Apr 12 09:52:54.251180 2026] [:error] [pid 26567:tid 26585] [client 158.158.55.67:30131] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adr69nhRpg6ptWFyFx0_CwAAARA"]
[Sun Apr 12 09:52:54.988598 2026] [:error] [pid 25328:tid 25377] [client 158.158.55.67:59366] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "adr69sxUaQZxT-e0YsBEaAAAAEo"]
[Sun Apr 12 09:52:56.001545 2026] [:error] [pid 25437:tid 25450] [client 158.158.55.67:12776] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adr6-Hf97wYZje1ep_OZ0QAAAMs"]
[Sun Apr 12 09:52:57.052952 2026] [:error] [pid 25437:tid 25459] [client 158.158.55.67:59384] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adr6-Xf97wYZje1ep_OZ1QAAANQ"]
[Sun Apr 12 09:52:58.139726 2026] [:error] [pid 25328:tid 25391] [client 158.158.55.67:14798] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adr6-sxUaQZxT-e0YsBEagAAAFE"]
[Sun Apr 12 09:52:59.078756 2026] [:error] [pid 60280:tid 60295] [client 158.158.55.67:16376] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "adr6-3BlLnDOYuIykkhUnQAAAc0"]
[Sun Apr 12 09:53:00.094496 2026] [:error] [pid 25328:tid 25405] [client 158.158.55.67:59376] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adr6_MxUaQZxT-e0YsBEcQAAAFc"]
[Sun Apr 12 09:53:01.367938 2026] [:error] [pid 25329:tid 25393] [client 158.158.55.67:6905] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adr6_WdcIYsS8Iyaj11pUQAAAIo"]
[Sun Apr 12 09:53:01.982536 2026] [:error] [pid 25328:tid 25366] [client 158.158.55.67:18990] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adr6_cxUaQZxT-e0YsBEdgAAAEI"]
[Sun Apr 12 09:53:03.121916 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:18997] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "adr6_3BlLnDOYuIykkhUrQAAAck"]
[Sun Apr 12 09:53:04.416000 2026] [:error] [pid 60280:tid 60296] [client 158.158.55.67:39464] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adr7AHBlLnDOYuIykkhUsQAAAc4"]
[Sun Apr 12 09:53:05.378577 2026] [:error] [pid 60280:tid 60304] [client 158.158.55.67:41918] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adr7AXBlLnDOYuIykkhUtQAAAdY"]
[Sun Apr 12 09:53:06.430045 2026] [:error] [pid 25329:tid 25381] [client 158.158.55.67:30085] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adr7AmdcIYsS8Iyaj11pXAAAAIM"]
[Sun Apr 12 09:53:07.184900 2026] [:error] [pid 60280:tid 60296] [client 158.158.55.67:14723] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "adr7A3BlLnDOYuIykkhUwAAAAc4"]
[Sun Apr 12 09:53:08.079787 2026] [:error] [pid 26600:tid 26642] [client 158.158.55.67:30451] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adr7BO1YwAZiXhQKLYq0FwAAAY0"]
[Sun Apr 12 09:53:09.491119 2026] [:error] [pid 26600:tid 26649] [client 158.158.55.67:40639] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adr7Be1YwAZiXhQKLYq0GQAAAZQ"]
[Sun Apr 12 09:53:10.255088 2026] [:error] [pid 25328:tid 25394] [client 158.158.55.67:40596] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adr7BsxUaQZxT-e0YsBEfAAAAFI"]
[Sun Apr 12 09:53:10.901293 2026] [:error] [pid 25437:tid 25453] [client 158.158.55.67:40588] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "adr7Bnf97wYZje1ep_OZ4QAAAM4"]
[Sun Apr 12 09:53:11.837576 2026] [:error] [pid 26600:tid 26633] [client 158.158.55.67:13060] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adr7B-1YwAZiXhQKLYq0HAAAAYQ"]
[Sun Apr 12 09:53:13.109175 2026] [:error] [pid 60280:tid 60287] [client 158.158.55.67:16371] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adr7CXBlLnDOYuIykkhU4QAAAcU"]
[Sun Apr 12 09:53:14.654410 2026] [:error] [pid 60280:tid 60298] [client 158.158.55.67:34613] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adr7CnBlLnDOYuIykkhU7QAAAdA"]
[Sun Apr 12 09:53:15.472329 2026] [:error] [pid 60280:tid 60286] [client 158.158.55.67:17113] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "adr7C3BlLnDOYuIykkhU8QAAAcQ"]
[Sun Apr 12 09:53:16.372595 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:32118] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adr7DHBlLnDOYuIykkhU9QAAAck"]
[Sun Apr 12 09:53:17.274488 2026] [:error] [pid 25328:tid 25396] [client 158.158.55.67:30083] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adr7DcxUaQZxT-e0YsBEgQAAAFM"]
[Sun Apr 12 09:53:18.937150 2026] [:error] [pid 25328:tid 25368] [client 158.158.55.67:13100] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adr7DsxUaQZxT-e0YsBEigAAAEQ"]
[Sun Apr 12 09:53:19.633726 2026] [:error] [pid 60280:tid 60291] [client 158.158.55.67:14543] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "adr7D3BlLnDOYuIykkhVAwAAAck"]
[Sun Apr 12 09:53:22.248355 2026] [:error] [pid 25328:tid 25375] [client 158.158.55.67:13081] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adr7EsxUaQZxT-e0YsBElAAAAEk"]
[Sun Apr 12 09:53:24.567993 2026] [:error] [pid 25437:tid 25441] [client 158.158.55.67:40600] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adr7FHf97wYZje1ep_OZ7QAAAMI"]
[Sun Apr 12 09:53:26.273519 2026] [:error] [pid 25329:tid 25412] [client 158.158.55.67:39482] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adr7FmdcIYsS8Iyaj11pYgAAAJU"]
[Sun Apr 12 09:53:29.032458 2026] [:error] [pid 60280:tid 60303] [client 158.158.55.67:6343] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "adr7GXBlLnDOYuIykkhVFAAAAdU"]
[Sun Apr 12 09:53:31.013556 2026] [:error] [pid 25327:tid 25355] [client 158.158.55.67:13840] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adr7Gy6h2tZEVJo9JFJ5kgAAABM"]
[Sun Apr 12 09:53:31.756463 2026] [:error] [pid 25437:tid 25463] [client 158.158.55.67:40204] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adr7G3f97wYZje1ep_OZ_AAAANg"]
[Sun Apr 12 09:53:32.640260 2026] [:error] [pid 60280:tid 60285] [client 158.158.55.67:15056] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adr7HHBlLnDOYuIykkhVHQAAAcM"]
[Sun Apr 12 09:53:33.207547 2026] [:error] [pid 25437:tid 25443] [client 158.158.55.67:58692] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "adr7HXf97wYZje1ep_OaAAAAAMQ"]
[Sun Apr 12 09:53:34.785541 2026] [:error] [pid 25437:tid 25442] [client 158.158.55.67:6362] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adr7Hnf97wYZje1ep_OaAQAAAMM"]
[Sun Apr 12 09:53:36.762113 2026] [:error] [pid 26599:tid 26626] [client 158.158.55.67:16292] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adr7IHG89LXoQbk_rwCAMwAAAVg"]
[Sun Apr 12 09:53:37.856187 2026] [:error] [pid 26599:tid 26621] [client 158.158.55.67:14529] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adr7IXG89LXoQbk_rwCANQAAAVM"]
[Sun Apr 12 09:53:38.493848 2026] [:error] [pid 26600:tid 26643] [client 158.158.55.67:6391] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "adr7Iu1YwAZiXhQKLYq0NAAAAY4"]
[Sun Apr 12 09:53:39.438044 2026] [:error] [pid 60280:tid 60306] [client 158.158.55.67:6372] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adr7I3BlLnDOYuIykkhVKwAAAdg"]
[Sun Apr 12 09:53:40.173724 2026] [:error] [pid 25327:tid 25339] [client 158.158.55.67:12646] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adr7JC6h2tZEVJo9JFJ5pQAAAAM"]
[Sun Apr 12 09:53:40.935727 2026] [:error] [pid 26600:tid 26645] [client 158.158.55.67:58713] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adr7JO1YwAZiXhQKLYq0OQAAAZA"]
[Sun Apr 12 09:53:41.885582 2026] [:error] [pid 26600:tid 26644] [client 158.158.55.67:30445] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "adr7Je1YwAZiXhQKLYq0PQAAAY8"]
[Sun Apr 12 09:53:42.746816 2026] [:error] [pid 60280:tid 60283] [client 158.158.55.67:15071] [client 158.158.55.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class20.php"] [unique_id "adr7JnBlLnDOYuIykkhVNAAAAcE"]
[Sun Apr 12 09:53:43.783095 2026] [proxy_fcgi:error] [pid 60280:tid 60284] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:44.338927 2026] [proxy_fcgi:error] [pid 60280:tid 60304] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:44.591945 2026] [proxy_fcgi:error] [pid 60280:tid 60298] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:44.914441 2026] [proxy_fcgi:error] [pid 60280:tid 60305] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:45.253630 2026] [proxy_fcgi:error] [pid 60280:tid 60289] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:45.496206 2026] [proxy_fcgi:error] [pid 60280:tid 60283] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:45.742899 2026] [proxy_fcgi:error] [pid 60280:tid 60300] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 09:53:45.984620 2026] [proxy_fcgi:error] [pid 60280:tid 60302] [client 158.158.55.67:12665] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 16:42:37.321493 2026] [:error] [pid 25437:tid 25444] [client 94.154.239.69:42722] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adta_Xf97wYZje1ep_MO0AAAAMU"]
[Sun Apr 12 16:42:38.907418 2026] [:error] [pid 25327:tid 25359] [client 94.154.239.69:56232] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adta_i6h2tZEVJo9JFK32wAAABc"]
[Sun Apr 12 16:42:40.902778 2026] [:error] [pid 26600:tid 26653] [client 94.154.239.69:44762] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adtbAO1YwAZiXhQKLYoPDAAAAZg"]
[Sun Apr 12 16:42:42.800722 2026] [:error] [pid 25329:tid 25413] [client 94.154.239.69:40560] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adtbAmdcIYsS8Iyaj12WvAAAAJY"]
[Sun Apr 12 16:42:44.842621 2026] [:error] [pid 26567:tid 26579] [client 94.154.239.69:40568] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adtbBHhRpg6ptWFyFx2IlwAAAQo"]
[Sun Apr 12 16:42:46.739080 2026] [:error] [pid 25329:tid 25392] [client 94.154.239.69:40582] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adtbBmdcIYsS8Iyaj12WvQAAAIk"]
[Sun Apr 12 16:42:48.741172 2026] [:error] [pid 25327:tid 25353] [client 94.154.239.69:40594] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adtbCC6h2tZEVJo9JFK3_QAAABE"]
[Sun Apr 12 16:42:50.772516 2026] [:error] [pid 26567:tid 26590] [client 94.154.239.69:40602] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adtbCnhRpg6ptWFyFx2IsQAAARU"]
[Sun Apr 12 16:42:52.763735 2026] [:error] [pid 60280:tid 60301] [client 94.154.239.69:59450] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adtbDHBlLnDOYuIykkgkwgAAAdM"]
[Sun Apr 12 16:42:54.776670 2026] [:error] [pid 25328:tid 25383] [client 94.154.239.69:59462] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adtbDsxUaQZxT-e0YsDgxwAAAE0"]
[Sun Apr 12 16:42:56.754589 2026] [:error] [pid 60280:tid 60282] [client 94.154.239.69:59466] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adtbEHBlLnDOYuIykkgk0QAAAcA"]
[Sun Apr 12 16:42:58.746204 2026] [:error] [pid 26600:tid 26629] [client 94.154.239.69:59472] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adtbEu1YwAZiXhQKLYoPKwAAAYA"]
[Sun Apr 12 16:43:00.742308 2026] [:error] [pid 25437:tid 25463] [client 94.154.239.69:59482] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adtbFHf97wYZje1ep_MO7QAAANg"]
[Sun Apr 12 16:43:02.746770 2026] [:error] [pid 25328:tid 25403] [client 94.154.239.69:59832] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adtbFsxUaQZxT-e0YsDg1QAAAFY"]
[Sun Apr 12 16:43:04.773347 2026] [:error] [pid 60280:tid 60287] [client 94.154.239.69:59842] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adtbGHBlLnDOYuIykkgk3wAAAcU"]
[Sun Apr 12 16:43:06.766697 2026] [:error] [pid 60280:tid 60295] [client 94.154.239.69:59856] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adtbGnBlLnDOYuIykkgk4wAAAc0"]
[Sun Apr 12 16:43:08.779739 2026] [:error] [pid 26567:tid 26572] [client 94.154.239.69:59858] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adtbHHhRpg6ptWFyFx2IwwAAAQM"]
[Sun Apr 12 16:43:10.790334 2026] [:error] [pid 25329:tid 25412] [client 94.154.239.69:59864] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adtbHmdcIYsS8Iyaj12WxQAAAJU"]
[Sun Apr 12 16:43:12.651344 2026] [:error] [pid 25328:tid 25391] [client 94.154.239.69:35998] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adtbIMxUaQZxT-e0YsDg4QAAAFE"]
[Sun Apr 12 16:43:14.660539 2026] [:error] [pid 25328:tid 25379] [client 94.154.239.69:36010] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adtbIsxUaQZxT-e0YsDg6QAAAEs"]
[Sun Apr 12 16:43:16.657449 2026] [:error] [pid 25329:tid 25388] [client 94.154.239.69:36016] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adtbJGdcIYsS8Iyaj12WxgAAAIc"]
[Sun Apr 12 16:43:18.670034 2026] [:error] [pid 60280:tid 60285] [client 94.154.239.69:36026] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "adtbJnBlLnDOYuIykkgk-wAAAcM"]
[Sun Apr 12 16:43:20.664743 2026] [:error] [pid 60280:tid 60303] [client 94.154.239.69:36042] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adtbKHBlLnDOYuIykkglBQAAAdU"]
[Sun Apr 12 16:43:23.205269 2026] [:error] [pid 26600:tid 26642] [client 94.154.239.69:38516] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "adtbK-1YwAZiXhQKLYoPPgAAAY0"]
[Sun Apr 12 16:43:25.283556 2026] [:error] [pid 26567:tid 26578] [client 94.154.239.69:35104] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adtbLXhRpg6ptWFyFx2IzgAAAQk"]
[Sun Apr 12 16:43:27.267550 2026] [:error] [pid 25437:tid 25445] [client 94.154.239.69:35120] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adtbL3f97wYZje1ep_MO-wAAAMY"]
[Sun Apr 12 16:43:29.282562 2026] [:error] [pid 60280:tid 60292] [client 94.154.239.69:35122] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adtbMXBlLnDOYuIykkglDwAAAco"]
[Sun Apr 12 16:43:31.293125 2026] [:error] [pid 60280:tid 60297] [client 94.154.239.69:35128] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adtbM3BlLnDOYuIykkglFQAAAc8"]
[Sun Apr 12 16:43:33.291888 2026] [:error] [pid 26599:tid 26606] [client 94.154.239.69:51218] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adtbNXG89LXoQbk_rwC0TwAAAUQ"]
[Sun Apr 12 16:43:55.840779 2026] [:error] [pid 60280:tid 60287] [client 94.154.239.69:51232] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adtbS3BlLnDOYuIykkglQwAAAcU"]
[Sun Apr 12 16:43:57.802927 2026] [:error] [pid 25437:tid 25449] [client 94.154.239.69:59624] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adtbTXf97wYZje1ep_MPFgAAAMo"]
[Sun Apr 12 16:44:00.348871 2026] [:error] [pid 25328:tid 25370] [client 94.154.239.69:48144] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adtbUMxUaQZxT-e0YsDhPgAAAEY"]
[Sun Apr 12 16:44:02.417779 2026] [:error] [pid 26600:tid 26629] [client 94.154.239.69:59492] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adtbUu1YwAZiXhQKLYoPggAAAYA"]
[Sun Apr 12 16:44:04.437071 2026] [:error] [pid 25437:tid 25443] [client 94.154.239.69:59498] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adtbVHf97wYZje1ep_MPHwAAAMQ"]
[Sun Apr 12 16:44:06.442557 2026] [:error] [pid 25329:tid 25393] [client 94.154.239.69:59510] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adtbVmdcIYsS8Iyaj12W4QAAAIo"]
[Sun Apr 12 16:44:09.002120 2026] [:error] [pid 25328:tid 25379] [client 94.154.239.69:53108] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "adtbWcxUaQZxT-e0YsDhTAAAAEs"]
[Sun Apr 12 16:44:10.943040 2026] [:error] [pid 26567:tid 26584] [client 94.154.239.69:59516] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adtbWnhRpg6ptWFyFx2I6gAAAQ8"]
[Sun Apr 12 16:44:12.959683 2026] [:error] [pid 60280:tid 60304] [client 94.154.239.69:48388] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "adtbXHBlLnDOYuIykkglfAAAAdY"]
[Sun Apr 12 16:44:14.972134 2026] [:error] [pid 25328:tid 25389] [client 94.154.239.69:48404] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "adtbXsxUaQZxT-e0YsDhTQAAAFA"]
[Sun Apr 12 16:44:16.973790 2026] [:error] [pid 60280:tid 60301] [client 94.154.239.69:48406] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "adtbYHBlLnDOYuIykkglkAAAAdM"]
[Sun Apr 12 16:44:18.845809 2026] [:error] [pid 26600:tid 26637] [client 94.154.239.69:48418] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adtbYu1YwAZiXhQKLYoPjgAAAYg"]
[Sun Apr 12 16:44:21.400619 2026] [:error] [pid 25329:tid 25382] [client 94.154.239.69:58830] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "adtbZWdcIYsS8Iyaj12W5QAAAIQ"]
[Sun Apr 12 16:44:23.349587 2026] [:error] [pid 26599:tid 26620] [client 94.154.239.69:34004] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adtbZ3G89LXoQbk_rwC0agAAAVI"]
[Sun Apr 12 16:44:25.359270 2026] [:error] [pid 26600:tid 26639] [client 94.154.239.69:34020] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adtbae1YwAZiXhQKLYoPkAAAAYo"]
[Sun Apr 12 16:44:27.932859 2026] [:error] [pid 60280:tid 60288] [client 94.154.239.69:53072] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adtba3BlLnDOYuIykkglrQAAAcY"]
[Sun Apr 12 16:44:29.748577 2026] [:error] [pid 26600:tid 26645] [client 94.154.239.69:34034] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adtbbe1YwAZiXhQKLYoPkwAAAZA"]
[Sun Apr 12 16:44:31.757279 2026] [:error] [pid 60280:tid 60288] [client 94.154.239.69:34040] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adtbb3BlLnDOYuIykkgluwAAAcY"]
[Sun Apr 12 16:44:33.772973 2026] [:error] [pid 60280:tid 60294] [client 94.154.239.69:42342] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adtbcXBlLnDOYuIykkglwwAAAcw"]
[Sun Apr 12 16:44:35.771672 2026] [:error] [pid 26567:tid 26589] [client 94.154.239.69:42346] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adtbc3hRpg6ptWFyFx2I-wAAARQ"]
[Sun Apr 12 16:44:38.331276 2026] [:error] [pid 25328:tid 25377] [client 94.154.239.69:58802] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adtbdsxUaQZxT-e0YsDhZgAAAEo"]
[Sun Apr 12 16:44:40.405813 2026] [:error] [pid 60280:tid 60295] [client 94.154.239.69:42360] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adtbeHBlLnDOYuIykkgl2gAAAc0"]
[Sun Apr 12 16:44:42.807125 2026] [:error] [pid 26599:tid 26625] [client 94.154.239.69:58816] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adtbenG89LXoQbk_rwC0cQAAAVc"]
[Sun Apr 12 16:44:44.740656 2026] [:error] [pid 25437:tid 25450] [client 94.154.239.69:58832] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adtbfHf97wYZje1ep_MPOQAAAMs"]
[Sun Apr 12 16:44:47.324210 2026] [:error] [pid 25327:tid 25340] [client 94.154.239.69:55786] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adtbfy6h2tZEVJo9JFK4NAAAAAQ"]
[Sun Apr 12 16:44:49.383367 2026] [:error] [pid 25328:tid 25365] [client 94.154.239.69:58848] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adtbgcxUaQZxT-e0YsDhegAAAEE"]
[Sun Apr 12 16:44:51.380191 2026] [:error] [pid 25437:tid 25460] [client 94.154.239.69:58852] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adtbg3f97wYZje1ep_MPPwAAANU"]
[Sun Apr 12 16:44:53.939403 2026] [:error] [pid 25437:tid 25450] [client 94.154.239.69:48286] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adtbhXf97wYZje1ep_MPQwAAAMs"]
[Sun Apr 12 16:45:15.242180 2026] [:error] [pid 60280:tid 60306] [client 94.154.239.69:36682] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adtbm3BlLnDOYuIykkgmOgAAAdg"]
[Sun Apr 12 16:45:17.778584 2026] [:error] [pid 26599:tid 26614] [client 94.154.239.69:53626] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "adtbnXG89LXoQbk_rwC0iwAAAUw"]
[Sun Apr 12 16:45:19.735006 2026] [:error] [pid 60280:tid 60306] [client 94.154.239.69:57044] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adtbn3BlLnDOYuIykkgmQwAAAdg"]
[Sun Apr 12 16:45:22.144848 2026] [:error] [pid 60280:tid 60283] [client 94.154.239.69:53642] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "adtbonBlLnDOYuIykkgmRgAAAcE"]
[Sun Apr 12 16:45:24.236491 2026] [:error] [pid 25437:tid 25445] [client 94.154.239.69:42278] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adtbpHf97wYZje1ep_MPWwAAAMY"]
[Sun Apr 12 16:45:26.216023 2026] [:error] [pid 25437:tid 25441] [client 94.154.239.69:42294] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adtbpnf97wYZje1ep_MPYgAAAMI"]
[Sun Apr 12 16:45:28.751855 2026] [:error] [pid 25437:tid 25461] [client 94.154.239.69:36384] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adtbqHf97wYZje1ep_MPZgAAANY"]
[Sun Apr 12 16:45:30.783894 2026] [:error] [pid 25327:tid 25360] [client 94.154.239.69:42306] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adtbqi6h2tZEVJo9JFK4SwAAABg"]
[Sun Apr 12 16:45:32.633363 2026] [:error] [pid 25327:tid 25342] [client 94.154.239.69:47284] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adtbrC6h2tZEVJo9JFK4UAAAAAY"]
[Sun Apr 12 16:45:34.509569 2026] [:error] [pid 25327:tid 25354] [client 94.154.239.69:47290] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adtbri6h2tZEVJo9JFK4VQAAABI"]
[Sun Apr 12 16:45:36.076004 2026] [:error] [pid 25328:tid 25369] [client 94.154.239.69:47300] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adtbsMxUaQZxT-e0YsDhrwAAAEU"]
[Sun Apr 12 16:45:39.959670 2026] [:error] [pid 25437:tid 25442] [client 94.154.239.69:47314] [client 94.154.239.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adtbs3f97wYZje1ep_MPcAAAAMM"]
[Sun Apr 12 16:52:48.375186 2026] [:error] [pid 60280:tid 60298] [client 180.153.236.227:5389] [client 180.153.236.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adtdYHBlLnDOYuIykkgphAAAAdA"], referer: http://www.switchcreative.net/
[Sun Apr 12 17:13:19.037390 2026] [autoindex:error] [pid 60280:tid 60290] [client 143.110.240.70:52014] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 18:43:45.419530 2026] [:error] [pid 25328:tid 25372] [client 91.240.139.235:9121] [client 91.240.139.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.240.139.235, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adt3YcxUaQZxT-e0YsAYMwAAAEc"]
[Sun Apr 12 18:43:45.430567 2026] [proxy_fcgi:error] [pid 25328:tid 25372] [client 91.240.139.235:9121] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 18:48:12.293317 2026] [:error] [pid 25328:tid 25373] [client 119.73.101.173:43141] [client 119.73.101.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.73.101.173, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adt4bMxUaQZxT-e0YsAbXAAAAEg"]
[Sun Apr 12 18:48:12.302487 2026] [proxy_fcgi:error] [pid 25328:tid 25373] [client 119.73.101.173:43141] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 19:16:19.259402 2026] [:error] [pid 25327:tid 25344] [client 54.37.252.192:43774] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adt_Ay6h2tZEVJo9JFLXJQAAAAg"]
[Sun Apr 12 19:16:21.626419 2026] [:error] [pid 60280:tid 60305] [client 54.37.252.192:36544] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adt_BXBlLnDOYuIykkiJ3wAAAdc"]
[Sun Apr 12 19:16:23.461171 2026] [:error] [pid 60280:tid 60296] [client 54.37.252.192:47448] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adt_B3BlLnDOYuIykkiKBwAAAc4"]
[Sun Apr 12 19:16:25.917460 2026] [:error] [pid 60280:tid 60299] [client 54.37.252.192:36996] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adt_CXBlLnDOYuIykkiKOQAAAdE"]
[Sun Apr 12 19:16:27.865262 2026] [:error] [pid 26600:tid 26629] [client 54.37.252.192:47450] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adt_C-1YwAZiXhQKLYo6TwAAAYA"]
[Sun Apr 12 19:16:30.284698 2026] [:error] [pid 25327:tid 25346] [client 54.37.252.192:37012] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adt_Di6h2tZEVJo9JFLXLgAAAAo"]
[Sun Apr 12 19:16:33.098038 2026] [:error] [pid 25327:tid 25357] [client 54.37.252.192:36220] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adt_ES6h2tZEVJo9JFLXNQAAABU"]
[Sun Apr 12 19:16:35.127715 2026] [:error] [pid 25327:tid 25356] [client 54.37.252.192:59212] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adt_Ey6h2tZEVJo9JFLXOAAAABQ"]
[Sun Apr 12 19:16:37.634304 2026] [:error] [pid 25327:tid 25341] [client 54.37.252.192:36230] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adt_FS6h2tZEVJo9JFLXQAAAAAU"]
[Sun Apr 12 19:16:39.582388 2026] [:error] [pid 25437:tid 25446] [client 54.37.252.192:59226] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adt_F3f97wYZje1ep_NFzAAAAMc"]
[Sun Apr 12 19:16:42.009059 2026] [:error] [pid 25328:tid 25365] [client 54.37.252.192:56156] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adt_GsxUaQZxT-e0YsAoyAAAAEE"]
[Sun Apr 12 19:16:44.480136 2026] [:error] [pid 25328:tid 25389] [client 54.37.252.192:56162] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adt_HMxUaQZxT-e0YsAoywAAAFA"]
[Sun Apr 12 19:16:46.563918 2026] [:error] [pid 25329:tid 25386] [client 54.37.252.192:58696] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adt_HmdcIYsS8Iyaj12vdAAAAIY"]
[Sun Apr 12 19:16:49.090446 2026] [:error] [pid 25328:tid 25396] [client 54.37.252.192:56166] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adt_IcxUaQZxT-e0YsAo2AAAAFM"]
[Sun Apr 12 19:16:51.053289 2026] [:error] [pid 25329:tid 25390] [client 54.37.252.192:58708] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adt_I2dcIYsS8Iyaj12vfwAAAIg"]
[Sun Apr 12 19:16:53.519719 2026] [:error] [pid 25327:tid 25359] [client 54.37.252.192:47318] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adt_JS6h2tZEVJo9JFLXVAAAABc"]
[Sun Apr 12 19:16:55.387102 2026] [:error] [pid 25327:tid 25352] [client 54.37.252.192:58364] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adt_Jy6h2tZEVJo9JFLXVwAAABA"]
[Sun Apr 12 19:16:57.761027 2026] [:error] [pid 60280:tid 60301] [client 54.37.252.192:47326] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adt_KXBlLnDOYuIykkiKhQAAAdM"]
[Sun Apr 12 19:16:59.619923 2026] [:error] [pid 60280:tid 60282] [client 54.37.252.192:58372] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adt_K3BlLnDOYuIykkiKiQAAAcA"]
[Sun Apr 12 19:17:01.930572 2026] [:error] [pid 60280:tid 60290] [client 54.37.252.192:59182] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adt_LXBlLnDOYuIykkiKkgAAAcg"]
[Sun Apr 12 19:17:04.294834 2026] [:error] [pid 60280:tid 60288] [client 54.37.252.192:59192] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adt_MHBlLnDOYuIykkiKlgAAAcY"]
[Sun Apr 12 19:17:06.408825 2026] [:error] [pid 26600:tid 26634] [client 54.37.252.192:40656] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adt_Mu1YwAZiXhQKLYo6gwAAAYU"]
[Sun Apr 12 19:17:08.672363 2026] [:error] [pid 25327:tid 25340] [client 54.37.252.192:59208] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adt_NC6h2tZEVJo9JFLXaAAAAAQ"]
[Sun Apr 12 19:17:10.431195 2026] [:error] [pid 60280:tid 60303] [client 54.37.252.192:40666] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adt_NnBlLnDOYuIykkiKqQAAAdU"]
[Sun Apr 12 19:17:12.728441 2026] [:error] [pid 26567:tid 26584] [client 54.37.252.192:41092] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adt_OHhRpg6ptWFyFx2txgAAAQ8"]
[Sun Apr 12 19:17:14.649663 2026] [:error] [pid 25328:tid 25387] [client 54.37.252.192:52438] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adt_OsxUaQZxT-e0YsAo_wAAAE8"]
[Sun Apr 12 19:17:16.964941 2026] [:error] [pid 60280:tid 60297] [client 54.37.252.192:41102] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adt_PHBlLnDOYuIykkiKuQAAAc8"]
[Sun Apr 12 19:17:39.108947 2026] [:error] [pid 25328:tid 25364] [client 54.37.252.192:41104] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adt_U8xUaQZxT-e0YsApRAAAAEA"]
[Sun Apr 12 19:17:41.447632 2026] [:error] [pid 26567:tid 26584] [client 54.37.252.192:43636] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adt_VXhRpg6ptWFyFx2t5wAAAQ8"]
[Sun Apr 12 19:17:43.521163 2026] [:error] [pid 25328:tid 25391] [client 54.37.252.192:42982] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adt_V8xUaQZxT-e0YsApVQAAAFE"]
[Sun Apr 12 19:17:45.792955 2026] [:error] [pid 26567:tid 26590] [client 54.37.252.192:59388] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adt_WXhRpg6ptWFyFx2t8QAAARU"]
[Sun Apr 12 19:17:47.542295 2026] [:error] [pid 26600:tid 26647] [client 54.37.252.192:42988] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adt_W-1YwAZiXhQKLYo6tgAAAZI"]
[Sun Apr 12 19:17:49.924751 2026] [:error] [pid 26600:tid 26632] [client 54.37.252.192:59392] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adt_Xe1YwAZiXhQKLYo6xAAAAYM"]
[Sun Apr 12 19:17:52.164996 2026] [:error] [pid 26600:tid 26651] [client 54.37.252.192:48190] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adt_YO1YwAZiXhQKLYo6zQAAAZY"]
[Sun Apr 12 19:17:54.718631 2026] [:error] [pid 60280:tid 60306] [client 54.37.252.192:48206] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adt_YnBlLnDOYuIykkiK4QAAAdg"]
[Sun Apr 12 19:17:56.787820 2026] [:error] [pid 60280:tid 60297] [client 54.37.252.192:55118] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adt_ZHBlLnDOYuIykkiK7QAAAc8"]
[Sun Apr 12 19:17:59.131208 2026] [:error] [pid 25328:tid 25391] [client 54.37.252.192:48214] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adt_Z8xUaQZxT-e0YsApaAAAAFE"]
[Sun Apr 12 19:18:01.148303 2026] [:error] [pid 60280:tid 60297] [client 54.37.252.192:55120] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adt_aXBlLnDOYuIykkiLDQAAAc8"]
[Sun Apr 12 19:18:03.677231 2026] [:error] [pid 25327:tid 25337] [client 54.37.252.192:54820] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adt_ay6h2tZEVJo9JFLXiQAAAAE"]
[Sun Apr 12 19:18:05.683744 2026] [:error] [pid 25437:tid 25455] [client 54.37.252.192:55186] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adt_bXf97wYZje1ep_NGWgAAANA"]
[Sun Apr 12 19:18:08.210033 2026] [:error] [pid 60280:tid 60293] [client 54.37.252.192:54836] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adt_cHBlLnDOYuIykkiLSgAAAcs"]
[Sun Apr 12 19:18:10.713519 2026] [:error] [pid 25328:tid 25385] [client 54.37.252.192:54844] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adt_csxUaQZxT-e0YsApdwAAAE4"]
[Sun Apr 12 19:18:13.229300 2026] [:error] [pid 25328:tid 25364] [client 54.37.252.192:48670] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adt_dcxUaQZxT-e0YsApegAAAEA"]
[Sun Apr 12 19:18:15.240845 2026] [:error] [pid 25437:tid 25449] [client 54.37.252.192:53710] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adt_d3f97wYZje1ep_NGaQAAAMo"]
[Sun Apr 12 19:18:17.271859 2026] [:error] [pid 60280:tid 60297] [client 54.37.252.192:53720] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adt_eXBlLnDOYuIykkiLgQAAAc8"]
[Sun Apr 12 19:18:19.295751 2026] [:error] [pid 26600:tid 26631] [client 54.37.252.192:53736] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adt_e-1YwAZiXhQKLYo6-wAAAYI"]
[Sun Apr 12 19:18:21.321124 2026] [:error] [pid 25328:tid 25398] [client 54.37.252.192:53126] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adt_fcxUaQZxT-e0YsApkAAAAFQ"]
[Sun Apr 12 19:18:23.196146 2026] [:error] [pid 25437:tid 25444] [client 54.37.252.192:53128] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adt_f3f97wYZje1ep_NGcgAAAMU"]
[Sun Apr 12 19:18:25.198220 2026] [:error] [pid 26600:tid 26629] [client 54.37.252.192:53134] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adt_ge1YwAZiXhQKLYo7BwAAAYA"]
[Sun Apr 12 19:18:27.692872 2026] [:error] [pid 25328:tid 25405] [client 54.37.252.192:42728] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adt_g8xUaQZxT-e0YsApoAAAAFc"]
[Sun Apr 12 19:18:29.540292 2026] [:error] [pid 60280:tid 60285] [client 54.37.252.192:53148] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adt_hXBlLnDOYuIykkiLjwAAAcM"]
[Sun Apr 12 19:18:31.558079 2026] [:error] [pid 26567:tid 26585] [client 54.37.252.192:34628] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adt_h3hRpg6ptWFyFx2u8wAAARA"]
[Sun Apr 12 19:18:34.064583 2026] [:error] [pid 25437:tid 25449] [client 54.37.252.192:48252] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "adt_inf97wYZje1ep_NGggAAAMo"]
[Sun Apr 12 19:18:36.041337 2026] [:error] [pid 25328:tid 25373] [client 54.37.252.192:34642] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adt_jMxUaQZxT-e0YsApuAAAAEg"]
[Sun Apr 12 19:18:58.201051 2026] [:error] [pid 25328:tid 25394] [client 54.37.252.192:57232] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adt_osxUaQZxT-e0YsAp9QAAAFI"]
[Sun Apr 12 19:19:00.645632 2026] [:error] [pid 25329:tid 25382] [client 54.37.252.192:57234] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adt_pGdcIYsS8Iyaj12v7QAAAIQ"]
[Sun Apr 12 19:19:02.961030 2026] [:error] [pid 60280:tid 60302] [client 54.37.252.192:59192] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adt_pnBlLnDOYuIykkiLugAAAdQ"]
[Sun Apr 12 19:19:05.415307 2026] [:error] [pid 25328:tid 25365] [client 54.37.252.192:59204] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adt_qcxUaQZxT-e0YsAqBwAAAEE"]
[Sun Apr 12 19:19:07.878510 2026] [:error] [pid 25328:tid 25375] [client 54.37.252.192:59210] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adt_q8xUaQZxT-e0YsAqEAAAAEk"]
[Sun Apr 12 19:19:10.357597 2026] [:error] [pid 26567:tid 26571] [client 54.37.252.192:59226] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adt_rnhRpg6ptWFyFx2vJwAAAQI"]
[Sun Apr 12 19:19:12.802283 2026] [:error] [pid 25328:tid 25369] [client 54.37.252.192:45314] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adt_sMxUaQZxT-e0YsAqGwAAAEU"]
[Sun Apr 12 19:19:15.253733 2026] [:error] [pid 26600:tid 26631] [client 54.37.252.192:45326] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adt_s-1YwAZiXhQKLYo7KwAAAYI"]
[Sun Apr 12 19:19:17.721365 2026] [:error] [pid 25328:tid 25366] [client 54.37.252.192:45340] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adt_tcxUaQZxT-e0YsAqMgAAAEI"]
[Sun Apr 12 19:19:20.178386 2026] [:error] [pid 26600:tid 26640] [client 54.37.252.192:45342] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adt_uO1YwAZiXhQKLYo7OAAAAYs"]
[Sun Apr 12 19:19:22.637783 2026] [:error] [pid 26567:tid 26593] [client 54.37.252.192:38014] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adt_unhRpg6ptWFyFx2vOgAAARg"]
[Sun Apr 12 19:19:25.102766 2026] [:error] [pid 25328:tid 25365] [client 54.37.252.192:38016] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adt_vcxUaQZxT-e0YsAqQwAAAEE"]
[Sun Apr 12 19:19:27.404147 2026] [:error] [pid 26600:tid 26652] [client 54.37.252.192:38018] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adt_v-1YwAZiXhQKLYo7QwAAAZc"]
[Sun Apr 12 19:19:29.729344 2026] [:error] [pid 25437:tid 25444] [client 54.37.252.192:38020] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adt_wXf97wYZje1ep_NGygAAAMU"]
[Sun Apr 12 19:19:32.042199 2026] [:error] [pid 60280:tid 60290] [client 54.37.252.192:55500] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adt_xHBlLnDOYuIykkiMaAAAAcg"]
[Sun Apr 12 19:19:34.359999 2026] [:error] [pid 26567:tid 26593] [client 54.37.252.192:55510] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adt_xnhRpg6ptWFyFx2vTAAAARg"]
[Sun Apr 12 19:19:36.679647 2026] [:error] [pid 60280:tid 60301] [client 54.37.252.192:55514] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adt_yHBlLnDOYuIykkiMfAAAAdM"]
[Sun Apr 12 19:19:38.981342 2026] [:error] [pid 26600:tid 26649] [client 54.37.252.192:55528] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adt_yu1YwAZiXhQKLYo7TgAAAZQ"]
[Sun Apr 12 19:19:41.423148 2026] [:error] [pid 26600:tid 26641] [client 54.37.252.192:55532] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adt_ze1YwAZiXhQKLYo7VAAAAYw"]
[Sun Apr 12 19:19:43.731031 2026] [:error] [pid 60280:tid 60292] [client 54.37.252.192:56936] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adt_z3BlLnDOYuIykkiMigAAAco"]
[Sun Apr 12 19:19:47.539629 2026] [:error] [pid 26567:tid 26569] [client 54.37.252.192:56942] [client 54.37.252.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adt_03hRpg6ptWFyFx2vcgAAAQA"]
[Sun Apr 12 19:40:15.503854 2026] [:error] [pid 26599:tid 26619] [client 180.153.236.149:63699] [client 180.153.236.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aduEn3G89LXoQbk_rwDSngAAAVE"], referer: http://switchcreative.net/
[Sun Apr 12 21:06:39.645116 2026] [:error] [pid 26600:tid 26642] [client 91.137.27.140:29731] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aduY3-1YwAZiXhQKLYpXXQAAAY0"]
[Sun Apr 12 21:06:42.131366 2026] [:error] [pid 60280:tid 60283] [client 91.137.27.140:16570] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aduY4nBlLnDOYuIykkjKsgAAAcE"]
[Sun Apr 12 21:06:44.510328 2026] [:error] [pid 26567:tid 26590] [client 91.137.27.140:49742] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aduY5HhRpg6ptWFyFx3GjAAAARU"]
[Sun Apr 12 21:06:47.022334 2026] [:error] [pid 26567:tid 26570] [client 91.137.27.140:55607] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aduY53hRpg6ptWFyFx3GkgAAAQE"]
[Sun Apr 12 21:06:49.531914 2026] [:error] [pid 25328:tid 25380] [client 91.137.27.140:13232] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aduY6cxUaQZxT-e0YsBY-wAAAEw"]
[Sun Apr 12 21:06:51.902260 2026] [:error] [pid 26567:tid 26585] [client 91.137.27.140:54016] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aduY63hRpg6ptWFyFx3GmAAAARA"]
[Sun Apr 12 21:06:54.429460 2026] [:error] [pid 26600:tid 26641] [client 91.137.27.140:15188] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aduY7u1YwAZiXhQKLYpXcQAAAYw"]
[Sun Apr 12 21:06:56.952662 2026] [:error] [pid 26600:tid 26632] [client 91.137.27.140:27373] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aduY8O1YwAZiXhQKLYpXdAAAAYM"]
[Sun Apr 12 21:06:59.335983 2026] [:error] [pid 25328:tid 25398] [client 91.137.27.140:44443] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aduY88xUaQZxT-e0YsBZDwAAAFQ"]
[Sun Apr 12 21:07:01.719657 2026] [:error] [pid 25329:tid 25397] [client 91.137.27.140:42275] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aduY9WdcIYsS8Iyaj13AAgAAAIw"]
[Sun Apr 12 21:07:04.252351 2026] [:error] [pid 25327:tid 25351] [client 91.137.27.140:7321] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aduY-C6h2tZEVJo9JFLsYQAAAA8"]
[Sun Apr 12 21:07:06.754550 2026] [:error] [pid 60280:tid 60286] [client 91.137.27.140:12681] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aduY-nBlLnDOYuIykkjKzgAAAcQ"]
[Sun Apr 12 21:07:09.236145 2026] [:error] [pid 25437:tid 25463] [client 91.137.27.140:55591] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aduY_Xf97wYZje1ep_NsAAAAANg"]
[Sun Apr 12 21:07:11.777374 2026] [:error] [pid 26600:tid 26635] [client 91.137.27.140:36496] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aduY_-1YwAZiXhQKLYpXhAAAAYY"]
[Sun Apr 12 21:07:14.128316 2026] [:error] [pid 26600:tid 26630] [client 91.137.27.140:4790] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aduZAu1YwAZiXhQKLYpXiAAAAYE"]
[Sun Apr 12 21:07:16.651809 2026] [:error] [pid 26599:tid 26618] [client 91.137.27.140:59730] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aduZBHG89LXoQbk_rwDfSwAAAVA"]
[Sun Apr 12 21:07:19.159046 2026] [:error] [pid 26600:tid 26634] [client 91.137.27.140:49453] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aduZB-1YwAZiXhQKLYpXigAAAYU"]
[Sun Apr 12 21:07:21.694777 2026] [:error] [pid 26599:tid 26613] [client 91.137.27.140:19976] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aduZCXG89LXoQbk_rwDfTgAAAUs"]
[Sun Apr 12 21:07:24.062443 2026] [:error] [pid 25437:tid 25463] [client 91.137.27.140:11619] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aduZDHf97wYZje1ep_NsDAAAANg"]
[Sun Apr 12 21:07:26.580798 2026] [:error] [pid 60280:tid 60291] [client 91.137.27.140:33451] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aduZDnBlLnDOYuIykkjK7gAAAck"]
[Sun Apr 12 21:07:29.097617 2026] [:error] [pid 60280:tid 60290] [client 91.137.27.140:56966] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aduZEXBlLnDOYuIykkjK9gAAAcg"]
[Sun Apr 12 21:07:31.468263 2026] [:error] [pid 25329:tid 25393] [client 91.137.27.140:7692] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aduZE2dcIYsS8Iyaj13AFgAAAIo"]
[Sun Apr 12 21:07:33.983636 2026] [:error] [pid 60280:tid 60305] [client 91.137.27.140:29889] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aduZFXBlLnDOYuIykkjLBgAAAdc"]
[Sun Apr 12 21:07:36.490781 2026] [:error] [pid 60280:tid 60301] [client 91.137.27.140:46771] [client 91.137.27.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aduZGHBlLnDOYuIykkjLEQAAAdM"]
[Mon Apr 13 03:13:33.108466 2026] [:error] [pid 54671:tid 54686] [client 43.153.87.54:40528] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "advu3WyJMmaONUqF0tCsewAAAQs"]
[Mon Apr 13 03:45:48.256915 2026] [proxy_fcgi:error] [pid 34048:tid 34068] [client 20.151.248.149:16273] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 05:05:07.710732 2026] [:error] [pid 33942:tid 33985] [client 20.203.149.161:12329] [client 20.203.149.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adwJAxNHe8geO_lMeFaKKwAAAEY"]
[Mon Apr 13 05:05:09.491691 2026] [:error] [pid 11325:tid 11350] [client 20.203.149.161:36329] [client 20.203.149.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adwJBeCGj3EEJtCwa0NxQwAAARc"]
[Mon Apr 13 05:05:11.095882 2026] [:error] [pid 34048:tid 34063] [client 20.203.149.161:16078] [client 20.203.149.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adwJB_SiQ_PJjlY5Ehzo-QAAAM0"]
[Mon Apr 13 05:05:12.167753 2026] [:error] [pid 33941:tid 33952] [client 20.203.149.161:12781] [client 20.203.149.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adwJCG_NKERAxgG-rYMuIQAAAAI"]
[Mon Apr 13 05:27:03.075722 2026] [proxy_fcgi:error] [pid 33941:tid 33955] [client 20.151.248.149:27535] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 05:27:03.076612 2026] [proxy_fcgi:error] [pid 34048:tid 34051] [client 20.151.248.149:27609] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 05:27:03.282485 2026] [:error] [pid 34048:tid 34074] [client 20.151.248.149:27609] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOJ_SiQ_PJjlY5EhzyHAAAANg"]
[Mon Apr 13 05:27:03.282810 2026] [:error] [pid 33941:tid 33964] [client 20.151.248.149:27535] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOJ2_NKERAxgG-rYM02wAAAA0"]
[Mon Apr 13 05:27:03.702537 2026] [:error] [pid 11325:tid 11333] [client 20.151.248.149:27590] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOJ-CGj3EEJtCwa0OHBQAAAQY"]
[Mon Apr 13 05:27:03.702557 2026] [:error] [pid 11325:tid 11331] [client 20.151.248.149:27588] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOJ-CGj3EEJtCwa0OHBAAAAQQ"]
[Mon Apr 13 05:27:04.120894 2026] [:error] [pid 33942:tid 33979] [client 20.151.248.149:27584] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOKBNHe8geO_lMeFaWLAAAAEA"]
[Mon Apr 13 05:27:04.120918 2026] [:error] [pid 11325:tid 11335] [client 20.151.248.149:27607] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOKOCGj3EEJtCwa0OHCAAAAQg"]
[Mon Apr 13 05:27:04.538173 2026] [:error] [pid 11325:tid 11334] [client 20.151.248.149:27533] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOKOCGj3EEJtCwa0OHDQAAAQc"]
[Mon Apr 13 05:27:04.538759 2026] [:error] [pid 11325:tid 11344] [client 20.151.248.149:27633] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwOKOCGj3EEJtCwa0OHDgAAARE"]
[Mon Apr 13 05:27:04.948177 2026] [:error] [pid 33942:tid 33997] [client 20.151.248.149:27585] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKBNHe8geO_lMeFaWLwAAAFI"]
[Mon Apr 13 05:27:04.949409 2026] [:error] [pid 33942:tid 33996] [client 20.151.248.149:27645] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKBNHe8geO_lMeFaWMAAAAFE"]
[Mon Apr 13 05:27:05.359398 2026] [:error] [pid 33943:tid 34015] [client 20.151.248.149:27521] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKayoXuZjocnxM5FjYQAAAIk"]
[Mon Apr 13 05:27:05.360495 2026] [:error] [pid 33943:tid 34015] [client 20.151.248.149:27559] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKayoXuZjocnxM5FjYgAAAIk"]
[Mon Apr 13 05:27:05.771407 2026] [:error] [pid 33941:tid 33974] [client 20.151.248.149:27642] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKW_NKERAxgG-rYM03wAAABc"]
[Mon Apr 13 05:27:05.783563 2026] [:error] [pid 33941:tid 33967] [client 20.151.248.149:27586] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKW_NKERAxgG-rYM04AAAABA"]
[Mon Apr 13 05:27:06.182164 2026] [:error] [pid 34048:tid 34057] [client 20.151.248.149:27621] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKvSiQ_PJjlY5EhzyIgAAAMc"]
[Mon Apr 13 05:27:06.193778 2026] [:error] [pid 34048:tid 34055] [client 20.151.248.149:27527] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwOKvSiQ_PJjlY5EhzyIwAAAMU"]
[Mon Apr 13 05:27:06.604734 2026] [:error] [pid 33942:tid 34001] [client 20.151.248.149:27520] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOKhNHe8geO_lMeFaWOgAAAFY"]
[Mon Apr 13 05:27:06.610065 2026] [:error] [pid 33942:tid 33988] [client 20.151.248.149:27638] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOKhNHe8geO_lMeFaWOwAAAEk"]
[Mon Apr 13 05:27:07.018391 2026] [:error] [pid 33943:tid 34006] [client 20.151.248.149:27598] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOK6yoXuZjocnxM5FjZgAAAIA"]
[Mon Apr 13 05:27:07.018591 2026] [:error] [pid 33943:tid 34025] [client 20.151.248.149:27634] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOK6yoXuZjocnxM5FjZwAAAJM"]
[Mon Apr 13 05:27:07.429709 2026] [:error] [pid 34048:tid 34063] [client 20.151.248.149:27608] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOK_SiQ_PJjlY5EhzyJgAAAM0"]
[Mon Apr 13 05:27:07.429743 2026] [:error] [pid 34048:tid 34071] [client 20.151.248.149:27639] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOK_SiQ_PJjlY5EhzyJwAAANU"]
[Mon Apr 13 05:27:07.840157 2026] [:error] [pid 33942:tid 33980] [client 20.151.248.149:27543] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOKxNHe8geO_lMeFaWRAAAAEE"]
[Mon Apr 13 05:27:07.841371 2026] [:error] [pid 33943:tid 34011] [client 20.151.248.149:27596] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ssh3ll.php"] [unique_id "adwOK6yoXuZjocnxM5FjagAAAIU"]
[Mon Apr 13 05:27:08.257768 2026] [:error] [pid 34048:tid 34053] [client 20.151.248.149:27610] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLPSiQ_PJjlY5EhzyKQAAAMM"]
[Mon Apr 13 05:27:08.264470 2026] [:error] [pid 33942:tid 33995] [client 20.151.248.149:27641] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLBNHe8geO_lMeFaWRwAAAFA"]
[Mon Apr 13 05:27:08.668517 2026] [:error] [pid 33942:tid 33987] [client 20.151.248.149:27571] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLBNHe8geO_lMeFaWSAAAAEg"]
[Mon Apr 13 05:27:08.674819 2026] [:error] [pid 33941:tid 33952] [client 20.151.248.149:27616] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLG_NKERAxgG-rYM06AAAAAI"]
[Mon Apr 13 05:27:09.087963 2026] [:error] [pid 33942:tid 33979] [client 20.151.248.149:27646] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLRNHe8geO_lMeFaWTQAAAEA"]
[Mon Apr 13 05:27:09.096296 2026] [:error] [pid 33942:tid 33999] [client 20.151.248.149:27536] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLRNHe8geO_lMeFaWTgAAAFQ"]
[Mon Apr 13 05:27:09.503754 2026] [:error] [pid 33942:tid 33997] [client 20.151.248.149:27636] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLRNHe8geO_lMeFaWVAAAAFI"]
[Mon Apr 13 05:27:09.511276 2026] [:error] [pid 33941:tid 33954] [client 20.151.248.149:27565] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwOLW_NKERAxgG-rYM06gAAAAQ"]
[Mon Apr 13 07:37:12.416553 2026] [:error] [pid 33943:tid 34021] [client 60.188.57.0:40081] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adwsqKyoXuZjocnxM5GflAAAAI8"]
[Mon Apr 13 08:01:53.766694 2026] [proxy_fcgi:error] [pid 63310:tid 63353] [client 20.151.248.149:3338] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 08:01:53.975245 2026] [proxy_fcgi:error] [pid 63310:tid 63352] [client 20.151.248.149:3338] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 08:01:54.183955 2026] [proxy_fcgi:error] [pid 63310:tid 63344] [client 20.151.248.149:3338] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 08:01:54.388537 2026] [:error] [pid 63310:tid 63345] [client 20.151.248.149:3338] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwycnoXpRU5ztmwPjKhpwAAAEE"]
[Mon Apr 13 08:01:54.822721 2026] [:error] [pid 63311:tid 63377] [client 20.151.248.149:3375] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwycqHjrGN1MqBCVFkeDQAAAIY"]
[Mon Apr 13 08:01:55.325425 2026] [:error] [pid 63311:tid 63378] [client 20.151.248.149:53728] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwyc6HjrGN1MqBCVFkeDgAAAIc"]
[Mon Apr 13 08:01:55.806394 2026] [:error] [pid 63310:tid 63355] [client 20.151.248.149:3387] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "adwyc3oXpRU5ztmwPjKhqQAAAEs"]
[Mon Apr 13 08:01:56.350776 2026] [:error] [pid 63311:tid 63391] [client 20.151.248.149:53699] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwydKHjrGN1MqBCVFkeEQAAAJQ"]
[Mon Apr 13 08:01:56.769701 2026] [:error] [pid 63309:tid 63326] [client 20.151.248.149:53738] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwydEpIKZ10weXpf0WOIAAAAA0"]
[Mon Apr 13 08:01:57.191118 2026] [:error] [pid 63310:tid 63365] [client 20.151.248.149:53712] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwydXoXpRU5ztmwPjKhrQAAAFU"]
[Mon Apr 13 08:01:57.606019 2026] [:error] [pid 63310:tid 63359] [client 20.151.248.149:52957] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i6z19N.php"] [unique_id "adwydXoXpRU5ztmwPjKhrgAAAE8"]
[Mon Apr 13 08:01:58.044331 2026] [:error] [pid 63311:tid 63386] [client 20.151.248.149:52942] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwydqHjrGN1MqBCVFkeFQAAAI8"]
[Mon Apr 13 08:01:58.508708 2026] [:error] [pid 63310:tid 63361] [client 20.151.248.149:53706] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwydnoXpRU5ztmwPjKhsgAAAFE"]
[Mon Apr 13 08:01:58.945130 2026] [:error] [pid 63310:tid 63356] [client 20.151.248.149:52935] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwydnoXpRU5ztmwPjKhtAAAAEw"]
[Mon Apr 13 08:01:59.434464 2026] [:error] [pid 63310:tid 63351] [client 20.151.248.149:61953] [client 20.151.248.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "adwyd3oXpRU5ztmwPjKhuAAAAEc"]
[Mon Apr 13 10:25:38.161534 2026] [:error] [pid 63309:tid 63314] [client 51.83.6.238:59152] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adxUIkpIKZ10weXpf0W5OwAAAAE"]
[Mon Apr 13 10:25:43.447082 2026] [:error] [pid 63309:tid 63318] [client 51.83.6.238:51004] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adxUJ0pIKZ10weXpf0W5TQAAAAU"]
[Mon Apr 13 10:25:45.829908 2026] [:error] [pid 63311:tid 63392] [client 51.83.6.238:44802] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adxUKaHjrGN1MqBCVFleJgAAAJU"]
[Mon Apr 13 10:25:48.421749 2026] [:error] [pid 63310:tid 63365] [client 51.83.6.238:44804] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adxULHoXpRU5ztmwPjLVngAAAFU"]
[Mon Apr 13 10:25:53.468222 2026] [:error] [pid 63311:tid 63376] [client 51.83.6.238:57050] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adxUMaHjrGN1MqBCVFleZAAAAIU"]
[Mon Apr 13 10:25:58.006523 2026] [:error] [pid 7228:tid 7243] [client 51.83.6.238:57054] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "adxUNgEnn1dQrOSHHNVZDwAAAQ0"]
[Mon Apr 13 10:26:02.249540 2026] [:error] [pid 63406:tid 63411] [client 51.83.6.238:52074] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adxUOrHZEIkQ0Zmgp5pQhQAAAMA"]
[Mon Apr 13 10:26:05.667479 2026] [:error] [pid 63310:tid 63368] [client 51.83.6.238:52076] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adxUPXoXpRU5ztmwPjLWGgAAAFg"]
[Mon Apr 13 10:26:11.444916 2026] [:error] [pid 63310:tid 63367] [client 51.83.6.238:49304] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adxUQ3oXpRU5ztmwPjLWKQAAAFc"]
[Mon Apr 13 10:26:14.700255 2026] [:error] [pid 63406:tid 63412] [client 51.83.6.238:49306] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adxURrHZEIkQ0Zmgp5pQqwAAAME"]
[Mon Apr 13 10:26:19.334459 2026] [:error] [pid 63406:tid 63429] [client 51.83.6.238:55028] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adxUS7HZEIkQ0Zmgp5pQtgAAANI"]
[Mon Apr 13 10:26:24.782165 2026] [:error] [pid 63309:tid 63326] [client 51.83.6.238:55032] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adxUUEpIKZ10weXpf0W5vQAAAA0"]
[Mon Apr 13 10:26:29.125143 2026] [:error] [pid 63310:tid 63366] [client 51.83.6.238:55040] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adxUVXoXpRU5ztmwPjLWVwAAAFY"]
[Mon Apr 13 10:26:33.381937 2026] [:error] [pid 63406:tid 63412] [client 51.83.6.238:60666] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adxUWbHZEIkQ0Zmgp5pQ2AAAAME"]
[Mon Apr 13 10:27:17.363538 2026] [:error] [pid 63406:tid 63422] [client 51.83.6.238:40274] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adxUhbHZEIkQ0Zmgp5pRWAAAAMs"]
[Mon Apr 13 10:27:21.397019 2026] [:error] [pid 63310:tid 63357] [client 51.83.6.238:52682] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adxUiXoXpRU5ztmwPjLWjQAAAE0"]
[Mon Apr 13 10:27:25.166062 2026] [:error] [pid 7228:tid 7231] [client 51.83.6.238:52684] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adxUjQEnn1dQrOSHHNVagAAAAQE"]
[Mon Apr 13 10:27:28.439023 2026] [:error] [pid 63406:tid 63435] [client 51.83.6.238:52700] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adxUkLHZEIkQ0Zmgp5pRZAAAANg"]
[Mon Apr 13 10:27:31.279946 2026] [:error] [pid 63406:tid 63419] [client 51.83.6.238:60586] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "adxUk7HZEIkQ0Zmgp5pRaAAAAMg"]
[Mon Apr 13 10:27:34.260671 2026] [:error] [pid 7228:tid 7252] [client 51.83.6.238:60602] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "adxUlgEnn1dQrOSHHNVarAAAARY"]
[Mon Apr 13 10:27:36.793197 2026] [:error] [pid 7228:tid 7248] [client 51.83.6.238:60604] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "adxUmAEnn1dQrOSHHNVaswAAARI"]
[Mon Apr 13 10:27:40.195480 2026] [:error] [pid 63406:tid 63435] [client 51.83.6.238:54040] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adxUnLHZEIkQ0Zmgp5pRgwAAANg"]
[Mon Apr 13 10:27:43.930714 2026] [:error] [pid 63406:tid 63435] [client 51.83.6.238:32952] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "adxUn7HZEIkQ0Zmgp5pRiwAAANg"]
[Mon Apr 13 10:27:46.661804 2026] [:error] [pid 7228:tid 7233] [client 51.83.6.238:54042] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "adxUogEnn1dQrOSHHNVa0wAAAQM"]
[Mon Apr 13 10:27:50.397504 2026] [:error] [pid 63406:tid 63432] [client 51.83.6.238:46834] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "adxUprHZEIkQ0Zmgp5pRlgAAANU"]
[Mon Apr 13 10:27:53.574379 2026] [:error] [pid 63406:tid 63430] [client 51.83.6.238:46840] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adxUqbHZEIkQ0Zmgp5pRnQAAANM"]
[Mon Apr 13 10:27:57.743106 2026] [:error] [pid 63406:tid 63427] [client 51.83.6.238:38620] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "adxUrbHZEIkQ0Zmgp5pRpAAAANA"]
[Mon Apr 13 10:28:00.893250 2026] [:error] [pid 63406:tid 63424] [client 51.83.6.238:46016] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "adxUsLHZEIkQ0Zmgp5pRqQAAAM0"]
[Mon Apr 13 10:28:03.917509 2026] [:error] [pid 63311:tid 63377] [client 51.83.6.238:46028] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adxUs6HjrGN1MqBCVFlfagAAAIY"]
[Mon Apr 13 10:28:06.163902 2026] [:error] [pid 7228:tid 7233] [client 51.83.6.238:46034] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "adxUtgEnn1dQrOSHHNVbAQAAAQM"]
[Mon Apr 13 10:28:08.809815 2026] [:error] [pid 63310:tid 63358] [client 51.83.6.238:46048] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adxUuHoXpRU5ztmwPjLWrQAAAE4"]
[Mon Apr 13 10:28:12.361756 2026] [:error] [pid 63311:tid 63388] [client 51.83.6.238:46076] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adxUvKHjrGN1MqBCVFlfjwAAAJE"]
[Mon Apr 13 10:28:47.931017 2026] [:error] [pid 7228:tid 7249] [client 51.83.6.238:40942] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "adxU3wEnn1dQrOSHHNVbYgAAARM"]
[Mon Apr 13 10:28:49.706534 2026] [:error] [pid 63310:tid 63357] [client 51.83.6.238:45922] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adxU4XoXpRU5ztmwPjLW5gAAAE0"]
[Mon Apr 13 10:28:51.921010 2026] [:error] [pid 63406:tid 63424] [client 51.83.6.238:36344] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adxU47HZEIkQ0Zmgp5pR7QAAAM0"]
[Mon Apr 13 10:28:54.272821 2026] [:error] [pid 63310:tid 63350] [client 51.83.6.238:36356] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adxU5noXpRU5ztmwPjLW8gAAAEY"]
[Mon Apr 13 10:28:56.415652 2026] [:error] [pid 63310:tid 63365] [client 51.83.6.238:36364] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adxU6HoXpRU5ztmwPjLW-AAAAFU"]
[Mon Apr 13 10:28:59.429836 2026] [:error] [pid 7228:tid 7254] [client 51.83.6.238:46516] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "adxU6wEnn1dQrOSHHNVb4gAAARg"]
[Mon Apr 13 10:29:01.746323 2026] [:error] [pid 63406:tid 63414] [client 51.83.6.238:36590] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adxU7bHZEIkQ0Zmgp5pR8gAAAMM"]
[Mon Apr 13 10:29:04.810191 2026] [:error] [pid 63406:tid 63418] [client 51.83.6.238:60558] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adxU8LHZEIkQ0Zmgp5pR_QAAAMc"]
[Mon Apr 13 10:29:06.827794 2026] [:error] [pid 7228:tid 7239] [client 51.83.6.238:36596] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adxU8gEnn1dQrOSHHNVb_QAAAQk"]
[Mon Apr 13 10:29:09.813289 2026] [:error] [pid 63311:tid 63388] [client 51.83.6.238:45346] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adxU9aHjrGN1MqBCVFlgIQAAAJE"]
[Mon Apr 13 10:29:12.188096 2026] [:error] [pid 63406:tid 63435] [client 51.83.6.238:45020] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adxU-LHZEIkQ0Zmgp5pSGAAAANg"]
[Mon Apr 13 10:29:14.463292 2026] [:error] [pid 63311:tid 63378] [client 51.83.6.238:45032] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adxU-qHjrGN1MqBCVFlgMQAAAIc"]
[Mon Apr 13 10:29:17.058993 2026] [:error] [pid 63406:tid 63420] [client 51.83.6.238:45356] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "adxU_bHZEIkQ0Zmgp5pSJQAAAMk"]
[Mon Apr 13 10:29:19.403047 2026] [:error] [pid 63406:tid 63424] [client 51.83.6.238:60868] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adxU_7HZEIkQ0Zmgp5pSMAAAAM0"]
[Mon Apr 13 10:29:21.784860 2026] [:error] [pid 7228:tid 7246] [client 51.83.6.238:60882] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adxVAQEnn1dQrOSHHNVcJgAAARA"]
[Mon Apr 13 10:29:23.898329 2026] [:error] [pid 63310:tid 63358] [client 51.83.6.238:60894] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adxVA3oXpRU5ztmwPjLXDgAAAE4"]
[Mon Apr 13 10:29:26.847468 2026] [:error] [pid 63309:tid 63323] [client 51.83.6.238:34552] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "adxVBkpIKZ10weXpf0W6iAAAAAo"]
[Mon Apr 13 10:29:28.985418 2026] [:error] [pid 63311:tid 63376] [client 51.83.6.238:60910] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adxVCKHjrGN1MqBCVFlgegAAAIU"]
[Mon Apr 13 10:29:31.560046 2026] [:error] [pid 63311:tid 63386] [client 51.83.6.238:32842] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "adxVC6HjrGN1MqBCVFlgiAAAAI8"]
[Mon Apr 13 10:29:33.693221 2026] [:error] [pid 7228:tid 7253] [client 51.83.6.238:45062] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adxVDQEnn1dQrOSHHNVcQwAAARc"]
[Mon Apr 13 10:29:35.951514 2026] [:error] [pid 7228:tid 7236] [client 51.83.6.238:45064] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adxVDwEnn1dQrOSHHNVcSgAAAQY"]
[Mon Apr 13 10:29:38.110410 2026] [:error] [pid 7228:tid 7240] [client 51.83.6.238:45074] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adxVEgEnn1dQrOSHHNVcTQAAAQo"]
[Mon Apr 13 10:29:40.026379 2026] [:error] [pid 63310:tid 63365] [client 51.83.6.238:50716] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adxVFHoXpRU5ztmwPjLXGQAAAFU"]
[Mon Apr 13 10:29:42.092464 2026] [:error] [pid 63311:tid 63385] [client 51.83.6.238:50736] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adxVFqHjrGN1MqBCVFlgnQAAAI4"]
[Mon Apr 13 10:30:06.994408 2026] [:error] [pid 63311:tid 63380] [client 51.83.6.238:50656] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/1234%20slot.aspx"] [unique_id "adxVLqHjrGN1MqBCVFlguQAAAIk"]
[Mon Apr 13 10:30:09.101475 2026] [:error] [pid 63406:tid 63428] [client 51.83.6.238:50660] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/1234%20superslot.aspx"] [unique_id "adxVMbHZEIkQ0Zmgp5pSbgAAANE"]
[Mon Apr 13 10:30:11.103805 2026] [:error] [pid 63406:tid 63431] [client 51.83.6.238:40300] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/168%20slot.aspx"] [unique_id "adxVM7HZEIkQ0Zmgp5pScQAAANQ"]
[Mon Apr 13 10:30:13.218468 2026] [:error] [pid 63406:tid 63430] [client 51.83.6.238:40306] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/24th%20slot.aspx"] [unique_id "adxVNbHZEIkQ0Zmgp5pSdAAAANM"]
[Mon Apr 13 10:30:15.380282 2026] [:error] [pid 7228:tid 7237] [client 51.83.6.238:40318] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "adxVNwEnn1dQrOSHHNVcmAAAAQc"]
[Mon Apr 13 10:30:17.499547 2026] [:error] [pid 7228:tid 7235] [client 51.83.6.238:40330] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "adxVOQEnn1dQrOSHHNVcogAAAQU"]
[Mon Apr 13 10:30:19.404307 2026] [:error] [pid 63406:tid 63431] [client 51.83.6.238:51662] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "adxVO7HZEIkQ0Zmgp5pSfAAAANQ"]
[Mon Apr 13 10:30:21.450713 2026] [:error] [pid 7228:tid 7237] [client 51.83.6.238:51676] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adxVPQEnn1dQrOSHHNVcqgAAAQc"]
[Mon Apr 13 10:30:23.482486 2026] [:error] [pid 63406:tid 63428] [client 51.83.6.238:51688] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adxVP7HZEIkQ0Zmgp5pShAAAANE"]
[Mon Apr 13 10:30:25.516956 2026] [:error] [pid 63406:tid 63431] [client 51.83.6.238:51704] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adxVQbHZEIkQ0Zmgp5pShQAAANQ"]
[Mon Apr 13 10:30:27.706425 2026] [:error] [pid 63311:tid 63374] [client 51.83.6.238:51714] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adxVQ6HjrGN1MqBCVFlgyQAAAIM"]
[Mon Apr 13 10:30:29.700510 2026] [:error] [pid 63311:tid 63379] [client 51.83.6.238:41430] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adxVRaHjrGN1MqBCVFlgywAAAIg"]
[Mon Apr 13 10:30:31.687076 2026] [:error] [pid 63310:tid 63348] [client 51.83.6.238:41438] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adxVR3oXpRU5ztmwPjLXSwAAAEQ"]
[Mon Apr 13 10:30:33.852948 2026] [:error] [pid 7228:tid 7248] [client 51.83.6.238:41454] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adxVSQEnn1dQrOSHHNVcwwAAARI"]
[Mon Apr 13 10:30:35.836569 2026] [:error] [pid 63311:tid 63372] [client 51.83.6.238:41458] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adxVS6HjrGN1MqBCVFlg0wAAAIE"]
[Mon Apr 13 10:30:37.816479 2026] [:error] [pid 63309:tid 63323] [client 51.83.6.238:41474] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adxVTUpIKZ10weXpf0W6rgAAAAo"]
[Mon Apr 13 10:30:39.803512 2026] [:error] [pid 7228:tid 7241] [client 51.83.6.238:36342] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adxVTwEnn1dQrOSHHNVcywAAAQs"]
[Mon Apr 13 10:30:41.880119 2026] [:error] [pid 63406:tid 63414] [client 51.83.6.238:36352] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "adxVUbHZEIkQ0Zmgp5pSqAAAAMM"]
[Mon Apr 13 10:30:43.750559 2026] [:error] [pid 7228:tid 7249] [client 51.83.6.238:36358] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "adxVUwEnn1dQrOSHHNVc1gAAARM"]
[Mon Apr 13 10:30:45.771443 2026] [:error] [pid 7228:tid 7250] [client 51.83.6.238:36360] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "adxVVQEnn1dQrOSHHNVc3AAAARQ"]
[Mon Apr 13 10:30:47.867900 2026] [:error] [pid 63406:tid 63421] [client 51.83.6.238:36372] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adxVV7HZEIkQ0Zmgp5pSsAAAAMo"]
[Mon Apr 13 10:30:49.921305 2026] [:error] [pid 63406:tid 63429] [client 51.83.6.238:55724] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adxVWbHZEIkQ0Zmgp5pStAAAANI"]
[Mon Apr 13 10:30:51.815886 2026] [:error] [pid 63406:tid 63415] [client 51.83.6.238:55734] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adxVW7HZEIkQ0Zmgp5pStQAAAMQ"]
[Mon Apr 13 10:30:53.765081 2026] [:error] [pid 7228:tid 7234] [client 51.83.6.238:55746] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adxVXQEnn1dQrOSHHNVc6QAAAQQ"]
[Mon Apr 13 10:30:55.775755 2026] [:error] [pid 7228:tid 7236] [client 51.83.6.238:55762] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adxVXwEnn1dQrOSHHNVc8AAAAQY"]
[Mon Apr 13 10:30:57.844302 2026] [:error] [pid 7228:tid 7235] [client 51.83.6.238:55774] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adxVYQEnn1dQrOSHHNVc-AAAAQU"]
[Mon Apr 13 10:30:59.744631 2026] [:error] [pid 7228:tid 7253] [client 51.83.6.238:41688] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "adxVYwEnn1dQrOSHHNVdAAAAARc"]
[Mon Apr 13 10:31:01.616509 2026] [:error] [pid 63406:tid 63423] [client 51.83.6.238:41698] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "adxVZbHZEIkQ0Zmgp5pSwQAAAMw"]
[Mon Apr 13 10:31:03.499915 2026] [:error] [pid 7228:tid 7254] [client 51.83.6.238:41712] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "adxVZwEnn1dQrOSHHNVdCQAAARg"]
[Mon Apr 13 10:31:23.612920 2026] [:error] [pid 63309:tid 63315] [client 51.83.6.238:41718] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adxVe0pIKZ10weXpf0W61QAAAAI"]
[Mon Apr 13 10:31:25.605019 2026] [:error] [pid 7228:tid 7240] [client 51.83.6.238:53486] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "adxVfQEnn1dQrOSHHNVdQQAAAQo"]
[Mon Apr 13 10:31:27.512167 2026] [:error] [pid 7228:tid 7252] [client 51.83.6.238:53502] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "adxVfwEnn1dQrOSHHNVdwAAAARY"]
[Mon Apr 13 10:31:29.321359 2026] [:error] [pid 63311:tid 63392] [client 51.83.6.238:54708] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "adxVgaHjrGN1MqBCVFlhMQAAAJU"]
[Mon Apr 13 10:31:31.273005 2026] [:error] [pid 63309:tid 63327] [client 51.83.6.238:54712] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adxVg0pIKZ10weXpf0W62gAAAA4"]
[Mon Apr 13 10:31:33.101773 2026] [:error] [pid 63311:tid 63372] [client 51.83.6.238:54722] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adxVhaHjrGN1MqBCVFlhNgAAAIE"]
[Mon Apr 13 10:31:35.089567 2026] [:error] [pid 63309:tid 63333] [client 51.83.6.238:54728] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adxVh0pIKZ10weXpf0W63QAAABQ"]
[Mon Apr 13 10:31:37.042053 2026] [:error] [pid 63311:tid 63377] [client 51.83.6.238:54744] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adxViaHjrGN1MqBCVFlhQQAAAIY"]
[Mon Apr 13 10:31:39.008692 2026] [:error] [pid 63309:tid 63320] [client 51.83.6.238:54748] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adxVi0pIKZ10weXpf0W64gAAAAc"]
[Mon Apr 13 10:31:40.913275 2026] [:error] [pid 7228:tid 7242] [client 51.83.6.238:41374] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adxVjAEnn1dQrOSHHNVeAgAAAQw"]
[Mon Apr 13 10:31:42.853343 2026] [:error] [pid 63406:tid 63418] [client 51.83.6.238:41390] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adxVjrHZEIkQ0Zmgp5pS7gAAAMc"]
[Mon Apr 13 10:31:44.780480 2026] [:error] [pid 63310:tid 63361] [client 51.83.6.238:41396] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adxVkHoXpRU5ztmwPjLXiAAAAFE"]
[Mon Apr 13 10:31:46.874671 2026] [:error] [pid 63309:tid 63336] [client 51.83.6.238:41398] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adxVkkpIKZ10weXpf0W66wAAABc"]
[Mon Apr 13 10:31:48.991396 2026] [:error] [pid 7228:tid 7239] [client 51.83.6.238:41406] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "adxVlAEnn1dQrOSHHNVeIAAAAQk"]
[Mon Apr 13 10:31:50.908884 2026] [:error] [pid 63310:tid 63350] [client 51.83.6.238:57906] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "adxVlnoXpRU5ztmwPjLXjAAAAEY"]
[Mon Apr 13 10:31:52.837483 2026] [:error] [pid 63311:tid 63382] [client 51.83.6.238:57916] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adxVmKHjrGN1MqBCVFlhWwAAAIs"]
[Mon Apr 13 10:31:54.922252 2026] [:error] [pid 63311:tid 63371] [client 51.83.6.238:57918] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "adxVmqHjrGN1MqBCVFlhZAAAAIA"]
[Mon Apr 13 10:31:56.818193 2026] [:error] [pid 7228:tid 7244] [client 51.83.6.238:57920] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "adxVnAEnn1dQrOSHHNVeJQAAAQ4"]
[Mon Apr 13 10:31:58.733931 2026] [:error] [pid 63310:tid 63348] [client 51.83.6.238:57930] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "adxVnnoXpRU5ztmwPjLXlwAAAEQ"]
[Mon Apr 13 10:32:00.901323 2026] [:error] [pid 63310:tid 63344] [client 51.83.6.238:41974] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adxVoHoXpRU5ztmwPjLXmgAAAEA"]
[Mon Apr 13 10:32:02.706223 2026] [:error] [pid 63309:tid 63315] [client 51.83.6.238:41990] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adxVokpIKZ10weXpf0W68gAAAAI"]
[Mon Apr 13 11:08:02.380574 2026] [:error] [pid 63310:tid 63353] [client 119.28.177.175:42042] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "adxeEnoXpRU5ztmwPjLg2QAAAEk"]
[Mon Apr 13 11:33:38.541059 2026] [:error] [pid 57183:tid 57208] [client 24.78.106.29:55716] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "adxkEjDO3t8R5NaxzYQXqwAAAVc"]
[Mon Apr 13 11:33:38.557639 2026] [proxy_fcgi:error] [pid 57183:tid 57208] [client 24.78.106.29:55716] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:06.218841 2026] [proxy_fcgi:error] [pid 57183:tid 57209] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:06.463226 2026] [proxy_fcgi:error] [pid 57183:tid 57191] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:06.705415 2026] [proxy_fcgi:error] [pid 57183:tid 57189] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:06.920901 2026] [proxy_fcgi:error] [pid 57183:tid 57200] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:07.131830 2026] [proxy_fcgi:error] [pid 57183:tid 57201] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:24:08.029316 2026] [proxy_fcgi:error] [pid 57183:tid 57202] [client 20.104.245.70:12517] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 12:56:07.122421 2026] [:error] [pid 7228:tid 7249] [client 145.239.195.38:39120] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "adx3ZwEnn1dQrOSHHNW8AQAAARM"]
[Mon Apr 13 12:56:09.613595 2026] [:error] [pid 7228:tid 7252] [client 145.239.195.38:55092] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "adx3aQEnn1dQrOSHHNW8AgAAARY"]
[Mon Apr 13 12:56:11.635836 2026] [:error] [pid 63309:tid 63322] [client 145.239.195.38:37706] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adx3a0pIKZ10weXpf0XWmAAAAAk"]
[Mon Apr 13 12:56:14.266638 2026] [:error] [pid 63311:tid 63390] [client 145.239.195.38:44582] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "adx3bqHjrGN1MqBCVFmI2AAAAJM"]
[Mon Apr 13 12:56:16.228108 2026] [:error] [pid 63406:tid 63414] [client 145.239.195.38:49096] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adx3cLHZEIkQ0Zmgp5qHXQAAAMM"]
[Mon Apr 13 12:56:18.622566 2026] [:error] [pid 7228:tid 7244] [client 145.239.195.38:44586] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "adx3cgEnn1dQrOSHHNW8DAAAAQ4"]
[Mon Apr 13 12:56:20.997836 2026] [:error] [pid 63406:tid 63422] [client 145.239.195.38:44588] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "adx3dLHZEIkQ0Zmgp5qHbQAAAMs"]
[Mon Apr 13 12:56:22.982103 2026] [:error] [pid 63310:tid 63346] [client 145.239.195.38:49110] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adx3dnoXpRU5ztmwPjL4HwAAAEI"]
[Mon Apr 13 12:56:25.543171 2026] [:error] [pid 7228:tid 7248] [client 145.239.195.38:44454] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "adx3eQEnn1dQrOSHHNW8IgAAARI"]
[Mon Apr 13 12:56:27.524088 2026] [:error] [pid 63311:tid 63387] [client 145.239.195.38:33042] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adx3e6HjrGN1MqBCVFmI3wAAAJA"]
[Mon Apr 13 12:56:30.003497 2026] [:error] [pid 63310:tid 63364] [client 145.239.195.38:44470] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "adx3fnoXpRU5ztmwPjL4JAAAAFQ"]
[Mon Apr 13 12:56:32.460192 2026] [:error] [pid 57183:tid 57191] [client 145.239.195.38:44486] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "adx3gDDO3t8R5NaxzYQ8NQAAAUY"]
[Mon Apr 13 12:56:34.466252 2026] [:error] [pid 57183:tid 57195] [client 145.239.195.38:59208] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adx3gjDO3t8R5NaxzYQ8QAAAAUo"]
[Mon Apr 13 12:56:36.997051 2026] [:error] [pid 7228:tid 7234] [client 145.239.195.38:43516] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "adx3hAEnn1dQrOSHHNW8TwAAAQQ"]
[Mon Apr 13 12:56:38.975481 2026] [:error] [pid 63406:tid 63433] [client 145.239.195.38:59214] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adx3hrHZEIkQ0Zmgp5qHlAAAANY"]
[Mon Apr 13 12:56:41.457589 2026] [:error] [pid 57183:tid 57208] [client 145.239.195.38:43526] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "adx3iTDO3t8R5NaxzYQ8TQAAAVc"]
[Mon Apr 13 12:56:43.428269 2026] [:error] [pid 63311:tid 63379] [client 145.239.195.38:60006] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adx3i6HjrGN1MqBCVFmI6QAAAIg"]
[Mon Apr 13 12:56:45.898447 2026] [:error] [pid 57183:tid 57191] [client 145.239.195.38:55104] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "adx3jTDO3t8R5NaxzYQ8VAAAAUY"]
[Mon Apr 13 12:56:48.001947 2026] [:error] [pid 7228:tid 7252] [client 145.239.195.38:60008] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adx3kAEnn1dQrOSHHNW8qAAAARY"]
[Mon Apr 13 12:56:50.706788 2026] [:error] [pid 63406:tid 63419] [client 145.239.195.38:55110] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "adx3krHZEIkQ0Zmgp5qHxQAAAMg"]
[Mon Apr 13 12:56:53.173869 2026] [:error] [pid 7228:tid 7254] [client 145.239.195.38:55120] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "adx3lQEnn1dQrOSHHNW8rAAAARg"]
[Mon Apr 13 12:56:55.228152 2026] [:error] [pid 7228:tid 7244] [client 145.239.195.38:34206] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "adx3lwEnn1dQrOSHHNW8tAAAAQ4"]
[Mon Apr 13 12:56:57.770742 2026] [:error] [pid 7228:tid 7247] [client 145.239.195.38:33160] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "adx3mQEnn1dQrOSHHNW8uwAAARE"]
[Mon Apr 13 12:56:59.680785 2026] [:error] [pid 7228:tid 7238] [client 145.239.195.38:34222] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adx3mwEnn1dQrOSHHNW8vgAAAQg"]
[Mon Apr 13 12:57:02.241897 2026] [:error] [pid 63311:tid 63391] [client 145.239.195.38:33168] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "adx3nqHjrGN1MqBCVFmJDwAAAJQ"]
[Mon Apr 13 12:57:04.619622 2026] [:error] [pid 57183:tid 57195] [client 145.239.195.38:59308] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "adx3oDDO3t8R5NaxzYQ8iwAAAUo"]
[Mon Apr 13 12:57:25.694449 2026] [:error] [pid 63310:tid 63354] [client 145.239.195.38:35156] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "adx3tXoXpRU5ztmwPjL4TgAAAEo"]
[Mon Apr 13 12:57:28.028502 2026] [:error] [pid 7228:tid 7234] [client 145.239.195.38:49200] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "adx3uAEnn1dQrOSHHNW89QAAAQQ"]
[Mon Apr 13 12:57:30.524797 2026] [:error] [pid 7228:tid 7241] [client 145.239.195.38:49208] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "adx3ugEnn1dQrOSHHNW9AwAAAQs"]
[Mon Apr 13 12:57:33.125764 2026] [:error] [pid 7228:tid 7234] [client 145.239.195.38:49224] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "adx3vQEnn1dQrOSHHNW9EQAAAQQ"]
[Mon Apr 13 12:57:34.999174 2026] [:error] [pid 7228:tid 7231] [client 145.239.195.38:37682] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adx3vgEnn1dQrOSHHNW9HwAAAQE"]
[Mon Apr 13 12:57:37.307613 2026] [:error] [pid 63406:tid 63419] [client 145.239.195.38:54562] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "adx3wbHZEIkQ0Zmgp5qH8QAAAMg"]
[Mon Apr 13 12:57:39.368388 2026] [:error] [pid 63309:tid 63333] [client 145.239.195.38:37698] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adx3w0pIKZ10weXpf0XWwAAAABQ"]
[Mon Apr 13 12:57:41.823529 2026] [:error] [pid 7228:tid 7240] [client 145.239.195.38:54576] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "adx3xQEnn1dQrOSHHNW9JwAAAQo"]
[Mon Apr 13 12:57:44.404364 2026] [:error] [pid 63406:tid 63414] [client 145.239.195.38:45214] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "adx3yLHZEIkQ0Zmgp5qH_wAAAMM"]
[Mon Apr 13 12:57:47.022301 2026] [:error] [pid 57183:tid 57193] [client 145.239.195.38:45228] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "adx3yzDO3t8R5NaxzYQ86gAAAUg"]
[Mon Apr 13 12:57:49.050759 2026] [:error] [pid 57183:tid 57205] [client 145.239.195.38:47446] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adx3zTDO3t8R5NaxzYQ89QAAAVQ"]
[Mon Apr 13 12:57:51.496319 2026] [:error] [pid 7228:tid 7240] [client 145.239.195.38:45244] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "adx3zwEnn1dQrOSHHNW9NwAAAQo"]
[Mon Apr 13 12:57:53.378247 2026] [:error] [pid 57183:tid 57198] [client 145.239.195.38:53318] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adx30TDO3t8R5NaxzYQ8-gAAAU0"]
[Mon Apr 13 12:57:55.906552 2026] [:error] [pid 7228:tid 7252] [client 145.239.195.38:41746] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "adx30wEnn1dQrOSHHNW9TgAAARY"]
[Mon Apr 13 12:57:57.847471 2026] [:error] [pid 57183:tid 57200] [client 145.239.195.38:53334] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adx31TDO3t8R5NaxzYQ9DQAAAU8"]
[Mon Apr 13 12:58:00.432872 2026] [:error] [pid 7228:tid 7233] [client 145.239.195.38:41750] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "adx32AEnn1dQrOSHHNW9UwAAAQM"]
[Mon Apr 13 12:58:02.944933 2026] [:error] [pid 7228:tid 7249] [client 145.239.195.38:41756] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "adx32gEnn1dQrOSHHNW9XgAAARM"]
[Mon Apr 13 12:58:05.444064 2026] [:error] [pid 57183:tid 57192] [client 145.239.195.38:57540] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "adx33TDO3t8R5NaxzYQ9JgAAAUc"]
[Mon Apr 13 12:58:07.467936 2026] [:error] [pid 63406:tid 63430] [client 145.239.195.38:37934] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "adx337HZEIkQ0Zmgp5qIMwAAANM"]
[Mon Apr 13 12:58:09.615925 2026] [:error] [pid 7228:tid 7251] [client 145.239.195.38:37948] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adx34QEnn1dQrOSHHNW9ZQAAARU"]
[Mon Apr 13 12:58:11.709943 2026] [:error] [pid 7228:tid 7240] [client 145.239.195.38:37962] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adx34wEnn1dQrOSHHNW9bgAAAQo"]
[Mon Apr 13 12:58:13.633499 2026] [:error] [pid 7228:tid 7241] [client 145.239.195.38:47100] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adx35QEnn1dQrOSHHNW9dgAAAQs"]
[Mon Apr 13 12:58:15.486926 2026] [:error] [pid 7228:tid 7235] [client 145.239.195.38:47102] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adx35wEnn1dQrOSHHNW9fAAAAQU"]
[Mon Apr 13 12:58:17.399405 2026] [:error] [pid 7228:tid 7231] [client 145.239.195.38:47118] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adx36QEnn1dQrOSHHNW9gwAAAQE"]
[Mon Apr 13 12:58:19.799478 2026] [:error] [pid 63311:tid 63379] [client 145.239.195.38:39406] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "adx366HjrGN1MqBCVFmJTgAAAIg"]
[Mon Apr 13 12:58:21.863424 2026] [:error] [pid 57183:tid 57202] [client 145.239.195.38:47122] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adx37TDO3t8R5NaxzYQ9QgAAAVE"]
[Mon Apr 13 12:58:23.922117 2026] [:error] [pid 7228:tid 7244] [client 145.239.195.38:53264] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adx37wEnn1dQrOSHHNW9kQAAAQ4"]
[Mon Apr 13 12:58:48.500756 2026] [:error] [pid 7228:tid 7246] [client 145.239.195.38:33316] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "adx4CAEnn1dQrOSHHNW95QAAARA"]
[Mon Apr 13 12:58:51.065374 2026] [:error] [pid 57183:tid 57189] [client 145.239.195.38:33320] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "adx4CzDO3t8R5NaxzYQ9jwAAAUQ"]
[Mon Apr 13 12:58:53.599163 2026] [:error] [pid 63309:tid 63313] [client 145.239.195.38:33330] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "adx4DUpIKZ10weXpf0XXEQAAAAA"]
[Mon Apr 13 12:58:55.915377 2026] [:error] [pid 7228:tid 7248] [client 145.239.195.38:37924] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "adx4DwEnn1dQrOSHHNW98wAAARI"]
[Mon Apr 13 12:58:58.504692 2026] [:error] [pid 63309:tid 63315] [client 145.239.195.38:37928] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "adx4EkpIKZ10weXpf0XXGQAAAAI"]
[Mon Apr 13 12:59:01.036595 2026] [:error] [pid 63406:tid 63432] [client 145.239.195.38:37930] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "adx4FbHZEIkQ0Zmgp5qI7gAAANU"]
[Mon Apr 13 12:59:03.583660 2026] [:error] [pid 63311:tid 63392] [client 145.239.195.38:37936] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "adx4F6HjrGN1MqBCVFmJewAAAJU"]
[Mon Apr 13 12:59:06.071984 2026] [:error] [pid 63310:tid 63367] [client 145.239.195.38:41798] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "adx4GnoXpRU5ztmwPjL4vAAAAFc"]
[Mon Apr 13 12:59:08.593568 2026] [:error] [pid 63310:tid 63358] [client 145.239.195.38:41804] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "adx4HHoXpRU5ztmwPjL4wAAAAE4"]
[Mon Apr 13 12:59:11.060313 2026] [:error] [pid 63311:tid 63391] [client 145.239.195.38:41816] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "adx4H6HjrGN1MqBCVFmJjQAAAJQ"]
[Mon Apr 13 12:59:13.562923 2026] [:error] [pid 63311:tid 63392] [client 145.239.195.38:41828] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "adx4IaHjrGN1MqBCVFmJlAAAAJU"]
[Mon Apr 13 12:59:16.075448 2026] [:error] [pid 63311:tid 63391] [client 145.239.195.38:49358] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "adx4JKHjrGN1MqBCVFmJmgAAAJQ"]
[Mon Apr 13 12:59:18.488856 2026] [:error] [pid 57183:tid 57188] [client 145.239.195.38:49370] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "adx4JjDO3t8R5NaxzYQ9sQAAAUM"]
[Mon Apr 13 12:59:20.955718 2026] [:error] [pid 57183:tid 57203] [client 145.239.195.38:49384] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "adx4KDDO3t8R5NaxzYQ9uwAAAVI"]
[Mon Apr 13 12:59:23.512406 2026] [:error] [pid 63310:tid 63350] [client 145.239.195.38:49394] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "adx4K3oXpRU5ztmwPjL41AAAAEY"]
[Mon Apr 13 12:59:25.870985 2026] [:error] [pid 63311:tid 63394] [client 145.239.195.38:48968] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "adx4LaHjrGN1MqBCVFmJtQAAAJc"]
[Mon Apr 13 12:59:28.334325 2026] [:error] [pid 63310:tid 63349] [client 145.239.195.38:48974] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "adx4MHoXpRU5ztmwPjL42wAAAEU"]
[Mon Apr 13 12:59:30.830991 2026] [:error] [pid 57183:tid 57204] [client 145.239.195.38:48984] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "adx4MjDO3t8R5NaxzYQ91gAAAVM"]
[Mon Apr 13 12:59:33.198894 2026] [:error] [pid 57183:tid 57189] [client 145.239.195.38:48998] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "adx4NTDO3t8R5NaxzYQ93gAAAUQ"]
[Mon Apr 13 12:59:35.715202 2026] [:error] [pid 7228:tid 7230] [client 145.239.195.38:53648] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "adx4NwEnn1dQrOSHHNW-bwAAAQA"]
[Mon Apr 13 12:59:37.939746 2026] [:error] [pid 63406:tid 63425] [client 145.239.195.38:49020] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adx4ObHZEIkQ0Zmgp5qJHQAAAM4"]
[Mon Apr 13 12:59:41.709705 2026] [:error] [pid 57183:tid 57194] [client 145.239.195.38:49030] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "adx4PTDO3t8R5NaxzYQ-JgAAAUk"]
[Mon Apr 13 14:11:18.458797 2026] [:error] [pid 63309:tid 63319] [client 54.36.60.45:53710] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "adyJBkpIKZ10weXpf0XkYQAAAAY"]
[Mon Apr 13 14:11:20.874778 2026] [:error] [pid 63406:tid 63426] [client 54.36.60.45:38986] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "adyJCLHZEIkQ0Zmgp5qm-QAAAM8"]
[Mon Apr 13 14:11:23.144465 2026] [:error] [pid 57183:tid 57188] [client 54.36.60.45:38992] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "adyJCzDO3t8R5NaxzYRkYwAAAUM"]
[Mon Apr 13 14:11:25.571813 2026] [:error] [pid 7228:tid 7248] [client 54.36.60.45:33082] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "adyJDQEnn1dQrOSHHNX2BQAAARI"]
[Mon Apr 13 14:11:27.951169 2026] [:error] [pid 7228:tid 7240] [client 54.36.60.45:33084] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "adyJDwEnn1dQrOSHHNX2EAAAAQo"]
[Mon Apr 13 14:11:30.548541 2026] [:error] [pid 57183:tid 57185] [client 54.36.60.45:33090] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "adyJEjDO3t8R5NaxzYRkcwAAAUA"]
[Mon Apr 13 14:11:32.967148 2026] [:error] [pid 7228:tid 7246] [client 54.36.60.45:33096] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "adyJFAEnn1dQrOSHHNX2JQAAARA"]
[Mon Apr 13 14:11:35.372820 2026] [:error] [pid 63309:tid 63320] [client 54.36.60.45:53680] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "adyJF0pIKZ10weXpf0XkcgAAAAc"]
[Mon Apr 13 14:11:37.801961 2026] [:error] [pid 63310:tid 63368] [client 54.36.60.45:53690] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "adyJGXoXpRU5ztmwPjIKmAAAAFg"]
[Mon Apr 13 14:11:40.179643 2026] [:error] [pid 63309:tid 63329] [client 54.36.60.45:53696] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "adyJHEpIKZ10weXpf0XkegAAABA"]
[Mon Apr 13 14:11:42.731002 2026] [:error] [pid 57183:tid 57209] [client 54.36.60.45:53702] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "adyJHjDO3t8R5NaxzYRkiQAAAVg"]
[Mon Apr 13 14:11:45.095634 2026] [:error] [pid 57183:tid 57185] [client 54.36.60.45:36470] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "adyJITDO3t8R5NaxzYRkkQAAAUA"]
[Mon Apr 13 14:11:47.608884 2026] [:error] [pid 63309:tid 63320] [client 54.36.60.45:36476] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "adyJI0pIKZ10weXpf0XkgQAAAAc"]
[Mon Apr 13 14:11:50.124493 2026] [:error] [pid 63310:tid 63349] [client 54.36.60.45:36490] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "adyJJnoXpRU5ztmwPjIKpAAAAEU"]
[Mon Apr 13 14:11:52.339428 2026] [:error] [pid 7228:tid 7251] [client 54.36.60.45:36492] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "adyJKAEnn1dQrOSHHNX2YQAAARU"]
[Mon Apr 13 14:11:54.866100 2026] [:error] [pid 63310:tid 63363] [client 54.36.60.45:42358] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "adyJKnoXpRU5ztmwPjIKpwAAAFM"]
[Mon Apr 13 14:11:57.403617 2026] [:error] [pid 7228:tid 7249] [client 54.36.60.45:42364] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "adyJLQEnn1dQrOSHHNX2eAAAARM"]
[Mon Apr 13 14:11:59.911811 2026] [:error] [pid 7228:tid 7232] [client 54.36.60.45:42378] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "adyJLwEnn1dQrOSHHNX2lAAAAQI"]
[Mon Apr 13 14:12:02.401692 2026] [:error] [pid 63311:tid 63371] [client 54.36.60.45:42392] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "adyJMqHjrGN1MqBCVFmfEQAAAIA"]
[Mon Apr 13 14:12:04.897377 2026] [:error] [pid 57183:tid 57206] [client 54.36.60.45:55444] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "adyJNDDO3t8R5NaxzYRkrQAAAVU"]
[Mon Apr 13 14:12:07.382925 2026] [:error] [pid 63309:tid 63329] [client 54.36.60.45:55452] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "adyJN0pIKZ10weXpf0XkkgAAABA"]
[Mon Apr 13 14:12:09.898560 2026] [:error] [pid 63311:tid 63379] [client 54.36.60.45:55454] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "adyJOaHjrGN1MqBCVFmfIAAAAIg"]
[Mon Apr 13 14:12:12.197119 2026] [:error] [pid 57183:tid 57195] [client 54.36.60.45:55466] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "adyJPDDO3t8R5NaxzYRkzAAAAUo"]
[Mon Apr 13 14:12:14.703144 2026] [:error] [pid 63309:tid 63325] [client 54.36.60.45:46920] [client 54.36.60.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "adyJPkpIKZ10weXpf0XkngAAAAw"]
[Mon Apr 13 16:28:45.159506 2026] [:error] [pid 63406:tid 63428] [client 140.245.33.63:51416] [client 140.245.33.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.63, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adypPbHZEIkQ0Zmgp5r5ZAAAANE"]
[Mon Apr 13 16:28:45.170852 2026] [proxy_fcgi:error] [pid 63406:tid 63428] [client 140.245.33.63:51416] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 16:28:45.348435 2026] [:error] [pid 9314:tid 9334] [client 140.245.33.63:49154] [client 140.245.33.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.63, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "adypPW_r4W8fX2GWyGS1bwAAAZI"], referer: https://www.google.com/
[Mon Apr 13 16:28:45.352401 2026] [proxy_fcgi:error] [pid 9314:tid 9334] [client 140.245.33.63:49154] AH01071: Got error 'Primary script unknown', referer: https://www.google.com/
[Mon Apr 13 20:41:05.933370 2026] [:error] [pid 9314:tid 9333] [client 103.77.107.178:64404] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "adzkYW_r4W8fX2GWyGQY2AAAAZE"]
[Mon Apr 13 20:41:06.135105 2026] [:error] [pid 63406:tid 63411] [client 103.77.107.178:64420] [client 103.77.107.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "adzkYrHZEIkQ0Zmgp5qrFwAAAMA"]
[Mon Apr 13 20:50:18.070521 2026] [:error] [pid 63311:tid 63374] [client 182.42.110.255:48959] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "adzmiqHjrGN1MqBCVFkEDgAAAIM"]
[Tue Apr 14 01:30:49.897930 2026] [:error] [pid 59913:tid 59928] [client 43.135.142.7:45120] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad0oSa5XvQ9C-gZtr2ynFAAAAAs"]
[Tue Apr 14 02:32:53.142223 2026] [:error] [pid 59913:tid 59927] [client 43.157.188.74:34478] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad021a5XvQ9C-gZtr2y63wAAAAo"]
[Tue Apr 14 02:48:14.831456 2026] [:error] [pid 59915:tid 59971] [client 212.47.78.120:61234] [client 212.47.78.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad06boeTNdEemByf99hc_wAAAIA"]
[Tue Apr 14 02:48:15.387765 2026] [:error] [pid 59915:tid 59976] [client 212.47.78.120:62346] [client 212.47.78.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "ad06b4eTNdEemByf99hdAgAAAIU"]
[Tue Apr 14 02:48:15.943371 2026] [:error] [pid 59915:tid 59985] [client 212.47.78.120:64233] [client 212.47.78.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "ad06b4eTNdEemByf99hdBQAAAI4"]
[Tue Apr 14 03:30:01.255392 2026] [:error] [pid 19687:tid 19704] [client 118.179.177.17:50632] [client 118.179.177.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.179.177.17, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ad1EOWBZImnR12CCWFocZQAAAAg"]
[Tue Apr 14 03:30:01.266007 2026] [proxy_fcgi:error] [pid 19687:tid 19704] [client 118.179.177.17:50632] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:53.282677 2026] [proxy_fcgi:error] [pid 19689:tid 19761] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:54.389987 2026] [proxy_fcgi:error] [pid 19689:tid 19755] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:54.517541 2026] [proxy_fcgi:error] [pid 19689:tid 19776] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:54.641147 2026] [proxy_fcgi:error] [pid 19689:tid 19771] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:54.764614 2026] [autoindex:error] [pid 19689:tid 19775] [client 20.24.192.90:23003] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 04:16:55.134668 2026] [proxy_fcgi:error] [pid 19689:tid 19777] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:55.260184 2026] [proxy_fcgi:error] [pid 19689:tid 19765] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:55.505568 2026] [proxy_fcgi:error] [pid 19689:tid 19762] [client 20.24.192.90:23003] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 04:16:55.760413 2026] [:error] [pid 19689:tid 19760] [client 20.24.192.90:23003] [client 20.24.192.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ad1PN5WU15arjG3aJyRB5AAAAIU"]
[Tue Apr 14 04:16:56.286527 2026] [:error] [pid 19688:tid 19730] [client 20.24.192.90:27553] [client 20.24.192.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ad1POIHoi57o76xPstKs5QAAAEI"]
[Tue Apr 14 04:16:56.813747 2026] [:error] [pid 19687:tid 19699] [client 20.24.192.90:23025] [client 20.24.192.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ad1POGBZImnR12CCWFonhQAAAAM"]
[Tue Apr 14 04:16:57.304601 2026] [:error] [pid 19687:tid 19706] [client 20.24.192.90:27533] [client 20.24.192.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws77.php"] [unique_id "ad1POWBZImnR12CCWFoniAAAAAo"]
[Tue Apr 14 04:17:26.157201 2026] [:error] [pid 19793:tid 19808] [client 147.135.214.95:58208] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad1PVgGEQsZw9TkmIA4AFgAAAM0"]
[Tue Apr 14 04:17:27.826605 2026] [:error] [pid 19793:tid 19807] [client 147.135.214.95:43782] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad1PVwGEQsZw9TkmIA4AGgAAAMw"]
[Tue Apr 14 04:17:29.671108 2026] [:error] [pid 19793:tid 19803] [client 147.135.214.95:40622] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad1PWQGEQsZw9TkmIA4AIwAAAMg"]
[Tue Apr 14 04:17:31.808167 2026] [:error] [pid 19688:tid 19731] [client 147.135.214.95:40636] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad1PW4Hoi57o76xPstKtGwAAAEM"]
[Tue Apr 14 04:17:33.954898 2026] [:error] [pid 19689:tid 19769] [client 147.135.214.95:40650] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ad1PXZWU15arjG3aJyRCMwAAAI4"]
[Tue Apr 14 04:17:35.991675 2026] [:error] [pid 19793:tid 19800] [client 147.135.214.95:40658] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ad1PXwGEQsZw9TkmIA4APAAAAMU"]
[Tue Apr 14 04:17:37.967155 2026] [:error] [pid 19689:tid 19756] [client 147.135.214.95:43594] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad1PYZWU15arjG3aJyRCQwAAAIE"]
[Tue Apr 14 04:17:39.803668 2026] [:error] [pid 19688:tid 19748] [client 147.135.214.95:43610] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad1PY4Hoi57o76xPstKtLgAAAFQ"]
[Tue Apr 14 04:17:41.662863 2026] [:error] [pid 19687:tid 19696] [client 147.135.214.95:43626] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad1PZWBZImnR12CCWFonywAAAAA"]
[Tue Apr 14 04:17:43.589699 2026] [:error] [pid 19688:tid 19746] [client 147.135.214.95:43632] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad1PZ4Hoi57o76xPstKtNQAAAFI"]
[Tue Apr 14 04:17:45.757397 2026] [:error] [pid 19688:tid 19750] [client 147.135.214.95:43642] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ad1PaYHoi57o76xPstKtOQAAAFY"]
[Tue Apr 14 04:17:47.684834 2026] [:error] [pid 19793:tid 19815] [client 147.135.214.95:53444] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ad1PawGEQsZw9TkmIA4AbQAAANQ"]
[Tue Apr 14 04:17:49.602332 2026] [:error] [pid 19793:tid 19800] [client 147.135.214.95:53454] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ad1PbQGEQsZw9TkmIA4AfwAAAMU"]
[Tue Apr 14 04:17:51.622015 2026] [:error] [pid 19793:tid 19809] [client 147.135.214.95:53468] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ad1PbwGEQsZw9TkmIA4AjgAAAM4"]
[Tue Apr 14 04:17:53.661678 2026] [:error] [pid 19793:tid 19802] [client 147.135.214.95:53480] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ad1PcQGEQsZw9TkmIA4AngAAAMc"]
[Tue Apr 14 04:17:55.718340 2026] [:error] [pid 19689:tid 19775] [client 147.135.214.95:53496] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ad1Pc5WU15arjG3aJyRCZwAAAJQ"]
[Tue Apr 14 04:17:57.728120 2026] [:error] [pid 19689:tid 19760] [client 147.135.214.95:60928] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad1PdZWU15arjG3aJyRCcQAAAIU"]
[Tue Apr 14 04:17:59.880447 2026] [:error] [pid 19689:tid 19772] [client 147.135.214.95:60940] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad1Pd5WU15arjG3aJyRCfQAAAJE"]
[Tue Apr 14 04:18:01.972028 2026] [:error] [pid 19793:tid 19807] [client 147.135.214.95:60950] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad1PeQGEQsZw9TkmIA4AqwAAAMw"]
[Tue Apr 14 04:18:04.096121 2026] [:error] [pid 19689:tid 19760] [client 147.135.214.95:60960] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ad1PfJWU15arjG3aJyRCiAAAAIU"]
[Tue Apr 14 04:18:06.072855 2026] [:error] [pid 19793:tid 19812] [client 147.135.214.95:60966] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ad1PfgGEQsZw9TkmIA4AuAAAANE"]
[Tue Apr 14 04:18:07.840643 2026] [:error] [pid 19688:tid 19746] [client 147.135.214.95:46144] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ad1Pf4Hoi57o76xPstKtXQAAAFI"]
[Tue Apr 14 04:18:09.921657 2026] [:error] [pid 19688:tid 19750] [client 147.135.214.95:46152] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad1PgYHoi57o76xPstKtYQAAAFY"]
[Tue Apr 14 04:18:12.333904 2026] [:error] [pid 19688:tid 19747] [client 147.135.214.95:39038] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad1PhIHoi57o76xPstKtZgAAAFM"]
[Tue Apr 14 04:18:14.247272 2026] [:error] [pid 19687:tid 19706] [client 147.135.214.95:46160] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ad1PhmBZImnR12CCWFon5QAAAAo"]
[Tue Apr 14 04:18:16.326749 2026] [:error] [pid 19688:tid 19742] [client 147.135.214.95:46172] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ad1PiIHoi57o76xPstKtcAAAAE4"]
[Tue Apr 14 04:18:18.416192 2026] [:error] [pid 19688:tid 19732] [client 147.135.214.95:55330] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ad1PioHoi57o76xPstKtcgAAAEQ"]
[Tue Apr 14 04:18:20.561389 2026] [:error] [pid 19688:tid 19751] [client 147.135.214.95:55332] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ad1PjIHoi57o76xPstKtdgAAAFc"]
[Tue Apr 14 04:18:22.556367 2026] [:error] [pid 19793:tid 19814] [client 147.135.214.95:55346] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ad1PjgGEQsZw9TkmIA4A6QAAANM"]
[Tue Apr 14 04:18:45.042888 2026] [:error] [pid 19689:tid 19759] [client 147.135.214.95:55360] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad1PpZWU15arjG3aJyRDEQAAAIQ"]
[Tue Apr 14 04:18:47.182505 2026] [:error] [pid 19793:tid 19819] [client 147.135.214.95:36056] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad1PpwGEQsZw9TkmIA4BOQAAANg"]
[Tue Apr 14 04:18:49.692295 2026] [:error] [pid 19689:tid 19776] [client 147.135.214.95:37346] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad1PqZWU15arjG3aJyRDHAAAAJU"]
[Tue Apr 14 04:18:51.766276 2026] [:error] [pid 19688:tid 19749] [client 147.135.214.95:36072] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad1Pq4Hoi57o76xPstKtkgAAAFU"]
[Tue Apr 14 04:18:53.802522 2026] [:error] [pid 19689:tid 19769] [client 147.135.214.95:36076] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad1PrZWU15arjG3aJyRDIQAAAI4"]
[Tue Apr 14 04:18:55.753644 2026] [:error] [pid 19688:tid 19732] [client 147.135.214.95:36092] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad1Pr4Hoi57o76xPstKtlQAAAEQ"]
[Tue Apr 14 04:18:58.303451 2026] [:error] [pid 19689:tid 19760] [client 147.135.214.95:46724] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad1PspWU15arjG3aJyRDLAAAAIU"]
[Tue Apr 14 04:19:00.356031 2026] [:error] [pid 19689:tid 19755] [client 147.135.214.95:47686] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad1PtJWU15arjG3aJyRDNQAAAIA"]
[Tue Apr 14 04:19:02.331756 2026] [:error] [pid 19793:tid 19816] [client 147.135.214.95:47700] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad1PtgGEQsZw9TkmIA4BYQAAANU"]
[Tue Apr 14 04:19:04.344830 2026] [:error] [pid 19793:tid 19795] [client 147.135.214.95:47716] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad1PuAGEQsZw9TkmIA4BZwAAAMA"]
[Tue Apr 14 04:19:06.228594 2026] [:error] [pid 19689:tid 19758] [client 147.135.214.95:47718] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad1PupWU15arjG3aJyRDPgAAAIM"]
[Tue Apr 14 04:19:08.136037 2026] [:error] [pid 19793:tid 19807] [client 147.135.214.95:44652] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad1PvAGEQsZw9TkmIA4BdgAAAMw"]
[Tue Apr 14 04:19:10.702561 2026] [:error] [pid 19793:tid 19796] [client 147.135.214.95:59784] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad1PvgGEQsZw9TkmIA4BfQAAAME"]
[Tue Apr 14 04:19:12.635748 2026] [:error] [pid 19793:tid 19814] [client 147.135.214.95:44660] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad1PwAGEQsZw9TkmIA4BggAAANM"]
[Tue Apr 14 04:19:14.484273 2026] [:error] [pid 19687:tid 19717] [client 147.135.214.95:44662] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad1PwmBZImnR12CCWFooHAAAABU"]
[Tue Apr 14 04:19:16.862862 2026] [:error] [pid 19689:tid 19771] [client 147.135.214.95:59796] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad1PxJWU15arjG3aJyRDTwAAAJA"]
[Tue Apr 14 04:19:19.009990 2026] [:error] [pid 19689:tid 19766] [client 147.135.214.95:37578] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad1Px5WU15arjG3aJyRDWgAAAIs"]
[Tue Apr 14 04:19:21.036733 2026] [:error] [pid 19689:tid 19778] [client 147.135.214.95:37590] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad1PyZWU15arjG3aJyRDXAAAAJc"]
[Tue Apr 14 04:19:23.021605 2026] [:error] [pid 19793:tid 19815] [client 147.135.214.95:37602] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad1PywGEQsZw9TkmIA4BkQAAANQ"]
[Tue Apr 14 04:19:24.974605 2026] [:error] [pid 19689:tid 19756] [client 147.135.214.95:37614] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad1PzJWU15arjG3aJyRDYQAAAIE"]
[Tue Apr 14 04:19:27.442492 2026] [:error] [pid 19688:tid 19737] [client 147.135.214.95:54764] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad1Pz4Hoi57o76xPstKtyAAAAEk"]
[Tue Apr 14 04:19:29.341397 2026] [:error] [pid 19687:tid 19700] [client 147.135.214.95:40460] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad1P0WBZImnR12CCWFooMAAAAAQ"]
[Tue Apr 14 04:19:31.816733 2026] [:error] [pid 19688:tid 19742] [client 147.135.214.95:57416] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad1P04Hoi57o76xPstKtzgAAAE4"]
[Tue Apr 14 04:19:33.910897 2026] [:error] [pid 19689:tid 19779] [client 147.135.214.95:40466] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ad1P1ZWU15arjG3aJyRDbQAAAJg"]
[Tue Apr 14 04:19:36.440686 2026] [:error] [pid 19687:tid 19700] [client 147.135.214.95:57434] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ad1P2GBZImnR12CCWFooPAAAAAQ"]
[Tue Apr 14 04:19:38.365651 2026] [:error] [pid 19687:tid 19702] [client 147.135.214.95:35112] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ad1P2mBZImnR12CCWFooPwAAAAY"]
[Tue Apr 14 04:19:40.369867 2026] [:error] [pid 19689:tid 19759] [client 147.135.214.95:35116] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ad1P3JWU15arjG3aJyRDdQAAAIQ"]
[Tue Apr 14 04:19:42.928079 2026] [:error] [pid 19688:tid 19734] [client 147.135.214.95:48538] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ad1P3oHoi57o76xPstKt2QAAAEY"]
[Tue Apr 14 04:20:04.955866 2026] [:error] [pid 19689:tid 19765] [client 147.135.214.95:35120] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad1P9JWU15arjG3aJyRDvgAAAIo"]
[Tue Apr 14 04:20:07.508888 2026] [:error] [pid 19689:tid 19778] [client 147.135.214.95:52998] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad1P95WU15arjG3aJyRDwwAAAJc"]
[Tue Apr 14 04:20:09.527330 2026] [:error] [pid 19793:tid 19807] [client 147.135.214.95:41374] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad1P-QGEQsZw9TkmIA4B_AAAAMw"]
[Tue Apr 14 04:20:12.065179 2026] [:error] [pid 19689:tid 19763] [client 147.135.214.95:53040] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad1P_JWU15arjG3aJyRDywAAAIg"]
[Tue Apr 14 04:20:14.165301 2026] [:error] [pid 19689:tid 19768] [client 147.135.214.95:41390] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad1P_pWU15arjG3aJyRD0wAAAI0"]
[Tue Apr 14 04:20:16.148998 2026] [:error] [pid 19793:tid 19799] [client 147.135.214.95:41396] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad1QAAGEQsZw9TkmIA4CCQAAAMQ"]
[Tue Apr 14 04:20:18.754442 2026] [:error] [pid 19793:tid 19818] [client 147.135.214.95:50912] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad1QAgGEQsZw9TkmIA4CEwAAANc"]
[Tue Apr 14 04:20:20.644700 2026] [:error] [pid 19793:tid 19803] [client 147.135.214.95:47100] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad1QBAGEQsZw9TkmIA4CGwAAAMg"]
[Tue Apr 14 04:20:22.735329 2026] [:error] [pid 19793:tid 19819] [client 147.135.214.95:47102] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad1QBgGEQsZw9TkmIA4CLQAAANg"]
[Tue Apr 14 04:20:24.737925 2026] [:error] [pid 19793:tid 19819] [client 147.135.214.95:47108] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad1QCAGEQsZw9TkmIA4CPAAAANg"]
[Tue Apr 14 04:20:27.014435 2026] [:error] [pid 19689:tid 19769] [client 147.135.214.95:47120] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad1QC5WU15arjG3aJyRD9QAAAI4"]
[Tue Apr 14 04:20:30.848711 2026] [:error] [pid 19688:tid 19744] [client 147.135.214.95:51638] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad1QDoHoi57o76xPstKuDgAAAFA"]
[Tue Apr 14 06:15:32.367879 2026] [:error] [pid 19689:tid 19770] [client 51.75.119.153:49098] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ad1rBJWU15arjG3aJyRmHAAAAI8"]
[Tue Apr 14 06:15:34.909979 2026] [:error] [pid 19689:tid 19773] [client 51.75.119.153:43126] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ad1rBpWU15arjG3aJyRmIQAAAJI"]
[Tue Apr 14 06:15:36.825482 2026] [:error] [pid 19689:tid 19769] [client 51.75.119.153:34310] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ad1rCJWU15arjG3aJyRmJQAAAI4"]
[Tue Apr 14 06:15:39.200608 2026] [:error] [pid 19689:tid 19765] [client 51.75.119.153:43130] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ad1rC5WU15arjG3aJyRmLAAAAIo"]
[Tue Apr 14 06:15:41.036682 2026] [:error] [pid 19689:tid 19757] [client 51.75.119.153:34326] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ad1rDZWU15arjG3aJyRmLgAAAII"]
[Tue Apr 14 06:15:43.395146 2026] [:error] [pid 19687:tid 19707] [client 51.75.119.153:48232] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ad1rD2BZImnR12CCWFo_dgAAAAs"]
[Tue Apr 14 06:15:45.864268 2026] [:error] [pid 19793:tid 19797] [client 51.75.119.153:48242] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ad1rEQGEQsZw9TkmIA4tyAAAAMI"]
[Tue Apr 14 06:15:47.756115 2026] [:error] [pid 19687:tid 19717] [client 51.75.119.153:45362] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ad1rE2BZImnR12CCWFo_eAAAABU"]
[Tue Apr 14 06:15:50.094345 2026] [:error] [pid 64393:tid 64412] [client 51.75.119.153:48244] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ad1rFuClKltJhW50hKPjSwAAARE"]
[Tue Apr 14 06:15:51.941618 2026] [:error] [pid 19689:tid 19755] [client 51.75.119.153:45370] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ad1rF5WU15arjG3aJyRmPQAAAIA"]
[Tue Apr 14 06:15:54.434321 2026] [:error] [pid 64393:tid 64396] [client 51.75.119.153:49816] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ad1rGuClKltJhW50hKPjTgAAAQE"]
[Tue Apr 14 06:15:56.856904 2026] [:error] [pid 19687:tid 19719] [client 51.75.119.153:49832] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ad1rHGBZImnR12CCWFo_egAAABc"]
[Tue Apr 14 06:15:58.898109 2026] [:error] [pid 19687:tid 19699] [client 51.75.119.153:39866] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ad1rHmBZImnR12CCWFo_fAAAAAM"]
[Tue Apr 14 06:16:01.313795 2026] [:error] [pid 19689:tid 19768] [client 51.75.119.153:49848] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ad1rIZWU15arjG3aJyRmSQAAAI0"]
[Tue Apr 14 06:16:03.193140 2026] [:error] [pid 19689:tid 19757] [client 51.75.119.153:58196] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ad1rI5WU15arjG3aJyRmTgAAAII"]
[Tue Apr 14 06:16:05.724111 2026] [:error] [pid 64393:tid 64411] [client 51.75.119.153:53738] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ad1rJeClKltJhW50hKPjWwAAARA"]
[Tue Apr 14 06:16:07.604315 2026] [:error] [pid 64393:tid 64401] [client 51.75.119.153:58208] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ad1rJ-ClKltJhW50hKPjXgAAAQY"]
[Tue Apr 14 06:16:10.121442 2026] [:error] [pid 19688:tid 19741] [client 51.75.119.153:53744] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ad1rKoHoi57o76xPstLJTwAAAE0"]
[Tue Apr 14 06:16:12.011525 2026] [:error] [pid 64393:tid 64417] [client 51.75.119.153:58222] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ad1rLOClKltJhW50hKPjbQAAARY"]
[Tue Apr 14 06:16:14.525396 2026] [:error] [pid 64393:tid 64396] [client 51.75.119.153:36430] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ad1rLuClKltJhW50hKPjdwAAAQE"]
[Tue Apr 14 06:16:17.033838 2026] [:error] [pid 19688:tid 19728] [client 51.75.119.153:36432] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad1rMYHoi57o76xPstLJUwAAAEA"]
[Tue Apr 14 06:16:19.051406 2026] [:error] [pid 19687:tid 19697] [client 51.75.119.153:38194] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ad1rM2BZImnR12CCWFo_iQAAAAE"]
[Tue Apr 14 06:16:21.430420 2026] [:error] [pid 64393:tid 64402] [client 51.75.119.153:36442] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad1rNeClKltJhW50hKPjjQAAAQc"]
[Tue Apr 14 06:16:23.293669 2026] [:error] [pid 19687:tid 19716] [client 51.75.119.153:40504] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ad1rN2BZImnR12CCWFo_jQAAABQ"]
[Tue Apr 14 06:16:25.644192 2026] [:error] [pid 19689:tid 19757] [client 51.75.119.153:47770] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ad1rOZWU15arjG3aJyRmVQAAAII"]
[Tue Apr 14 06:16:27.676439 2026] [:error] [pid 64393:tid 64416] [client 51.75.119.153:40516] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ad1rO-ClKltJhW50hKPjngAAARU"]
[Tue Apr 14 06:16:49.057960 2026] [:error] [pid 64393:tid 64418] [client 51.75.119.153:47776] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad1rUeClKltJhW50hKPjzAAAARc"]
[Tue Apr 14 06:16:51.349171 2026] [:error] [pid 64393:tid 64402] [client 51.75.119.153:36902] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad1rU-ClKltJhW50hKPjzwAAAQc"]
[Tue Apr 14 06:16:53.847450 2026] [:error] [pid 19793:tid 19800] [client 51.75.119.153:43488] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad1rVQGEQsZw9TkmIA4uEQAAAMU"]
[Tue Apr 14 06:16:56.187726 2026] [:error] [pid 19793:tid 19798] [client 51.75.119.153:43496] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad1rWAGEQsZw9TkmIA4uGQAAAMM"]
[Tue Apr 14 06:16:58.224282 2026] [:error] [pid 19793:tid 19812] [client 51.75.119.153:54210] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ad1rWgGEQsZw9TkmIA4uHQAAANE"]
[Tue Apr 14 06:17:00.751875 2026] [:error] [pid 19688:tid 19748] [client 51.75.119.153:43510] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ad1rXIHoi57o76xPstLJbAAAAFQ"]
[Tue Apr 14 06:17:02.750769 2026] [:error] [pid 64393:tid 64417] [client 51.75.119.153:34692] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ad1rXuClKltJhW50hKPj2AAAARY"]
[Tue Apr 14 06:17:05.247567 2026] [:error] [pid 19688:tid 19744] [client 51.75.119.153:57182] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ad1rYYHoi57o76xPstLJbwAAAFA"]
[Tue Apr 14 06:17:07.741590 2026] [:error] [pid 64393:tid 64402] [client 51.75.119.153:57190] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ad1rY-ClKltJhW50hKPj4wAAAQc"]
[Tue Apr 14 06:17:10.226210 2026] [:error] [pid 19687:tid 19715] [client 51.75.119.153:57196] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ad1rZmBZImnR12CCWFo_nwAAABM"]
[Tue Apr 14 06:17:12.074396 2026] [:error] [pid 19793:tid 19810] [client 51.75.119.153:34698] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ad1raAGEQsZw9TkmIA4uNgAAAM8"]
[Tue Apr 14 06:17:14.569489 2026] [:error] [pid 19689:tid 19763] [client 51.75.119.153:55398] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ad1rapWU15arjG3aJyRmjgAAAIg"]
[Tue Apr 14 06:17:16.574374 2026] [:error] [pid 19689:tid 19776] [client 51.75.119.153:55266] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ad1rbJWU15arjG3aJyRmlgAAAJU"]
[Tue Apr 14 06:17:19.070305 2026] [:error] [pid 19689:tid 19778] [client 51.75.119.153:55404] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ad1rb5WU15arjG3aJyRmngAAAJc"]
[Tue Apr 14 06:17:21.066555 2026] [:error] [pid 64393:tid 64407] [client 51.75.119.153:55280] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ad1rceClKltJhW50hKPj7wAAAQw"]
[Tue Apr 14 06:17:23.285663 2026] [:error] [pid 19793:tid 19795] [client 51.75.119.153:51094] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ad1rcwGEQsZw9TkmIA4uPQAAAMA"]
[Tue Apr 14 06:17:25.763962 2026] [:error] [pid 19689:tid 19762] [client 51.75.119.153:51098] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ad1rdZWU15arjG3aJyRmpgAAAIc"]
[Tue Apr 14 06:17:28.084594 2026] [:error] [pid 19688:tid 19738] [client 51.75.119.153:51108] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ad1reIHoi57o76xPstLJgAAAAEo"]
[Tue Apr 14 06:17:30.078896 2026] [:error] [pid 19689:tid 19761] [client 51.75.119.153:49872] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ad1repWU15arjG3aJyRmrQAAAIY"]
[Tue Apr 14 06:17:32.105547 2026] [:error] [pid 19793:tid 19798] [client 51.75.119.153:49880] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ad1rfAGEQsZw9TkmIA4uSgAAAMM"]
[Tue Apr 14 06:17:34.118176 2026] [:error] [pid 19688:tid 19736] [client 51.75.119.153:47758] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ad1rfoHoi57o76xPstLJjQAAAEg"]
[Tue Apr 14 06:17:36.135875 2026] [:error] [pid 19689:tid 19770] [client 51.75.119.153:47774] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ad1rgJWU15arjG3aJyRmtwAAAI8"]
[Tue Apr 14 06:17:38.144668 2026] [:error] [pid 19689:tid 19762] [client 51.75.119.153:47776] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ad1rgpWU15arjG3aJyRmvgAAAIc"]
[Tue Apr 14 06:17:40.156575 2026] [:error] [pid 19687:tid 19697] [client 51.75.119.153:47790] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ad1rhGBZImnR12CCWFo_ugAAAAE"]
[Tue Apr 14 06:17:42.512080 2026] [:error] [pid 19687:tid 19708] [client 51.75.119.153:43150] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ad1rhmBZImnR12CCWFo_vQAAAAw"]
[Tue Apr 14 06:17:44.513474 2026] [:error] [pid 19687:tid 19705] [client 51.75.119.153:53092] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ad1riGBZImnR12CCWFo_vwAAAAk"]
[Tue Apr 14 06:17:46.519739 2026] [:error] [pid 19793:tid 19815] [client 51.75.119.153:53108] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ad1rigGEQsZw9TkmIA4uUQAAANQ"]
[Tue Apr 14 06:18:09.054772 2026] [:error] [pid 19689:tid 19765] [client 51.75.119.153:55428] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ad1roZWU15arjG3aJyRm4wAAAIo"]
[Tue Apr 14 06:18:11.472328 2026] [:error] [pid 64393:tid 64409] [client 51.75.119.153:60658] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ad1ro-ClKltJhW50hKPkPAAAAQ4"]
[Tue Apr 14 06:18:13.940842 2026] [:error] [pid 64393:tid 64395] [client 51.75.119.153:52030] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad1rpeClKltJhW50hKPkSAAAAQA"]
[Tue Apr 14 06:18:16.444205 2026] [:error] [pid 19793:tid 19801] [client 51.75.119.153:52034] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad1rqAGEQsZw9TkmIA4unwAAAMY"]
[Tue Apr 14 06:18:18.905584 2026] [:error] [pid 19688:tid 19748] [client 51.75.119.153:52046] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad1rqoHoi57o76xPstLJqQAAAFQ"]
[Tue Apr 14 06:18:21.365656 2026] [:error] [pid 19688:tid 19739] [client 51.75.119.153:52056] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad1rrYHoi57o76xPstLJswAAAEs"]
[Tue Apr 14 06:18:23.669851 2026] [:error] [pid 64393:tid 64403] [client 51.75.119.153:43114] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad1rr-ClKltJhW50hKPkVQAAAQg"]
[Tue Apr 14 06:18:25.993278 2026] [:error] [pid 19688:tid 19735] [client 51.75.119.153:43122] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad1rsYHoi57o76xPstLJtwAAAEc"]
[Tue Apr 14 06:18:28.450041 2026] [:error] [pid 19689:tid 19766] [client 51.75.119.153:43130] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad1rtJWU15arjG3aJyRm_gAAAIs"]
[Tue Apr 14 06:18:30.906375 2026] [:error] [pid 64393:tid 64409] [client 51.75.119.153:43136] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ad1rtuClKltJhW50hKPkZQAAAQ4"]
[Tue Apr 14 06:18:33.361296 2026] [:error] [pid 19687:tid 19718] [client 51.75.119.153:39614] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ad1ruWBZImnR12CCWFo_5AAAABY"]
[Tue Apr 14 06:18:35.811654 2026] [:error] [pid 64393:tid 64409] [client 51.75.119.153:39620] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ad1ru-ClKltJhW50hKPkbwAAAQ4"]
[Tue Apr 14 06:18:38.258503 2026] [:error] [pid 64393:tid 64416] [client 51.75.119.153:39632] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ad1rvuClKltJhW50hKPkeAAAARU"]
[Tue Apr 14 06:18:40.695430 2026] [:error] [pid 64393:tid 64398] [client 51.75.119.153:39636] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad1rwOClKltJhW50hKPkfwAAAQM"]
[Tue Apr 14 06:18:42.994751 2026] [:error] [pid 19793:tid 19812] [client 51.75.119.153:37992] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ad1rwgGEQsZw9TkmIA4u2AAAANE"]
[Tue Apr 14 06:18:45.431763 2026] [:error] [pid 64393:tid 64404] [client 51.75.119.153:38004] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad1rxeClKltJhW50hKPkgwAAAQk"]
[Tue Apr 14 06:18:47.875720 2026] [:error] [pid 64393:tid 64405] [client 51.75.119.153:38006] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad1rx-ClKltJhW50hKPkiAAAAQo"]
[Tue Apr 14 06:18:50.323452 2026] [:error] [pid 64393:tid 64411] [client 51.75.119.153:38014] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad1ryuClKltJhW50hKPkjQAAARA"]
[Tue Apr 14 06:18:52.772796 2026] [:error] [pid 19689:tid 19764] [client 51.75.119.153:44594] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad1rzJWU15arjG3aJyRnEwAAAIk"]
[Tue Apr 14 06:18:55.213473 2026] [:error] [pid 64393:tid 64406] [client 51.75.119.153:44598] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad1rz-ClKltJhW50hKPkqwAAAQs"]
[Tue Apr 14 06:18:57.513064 2026] [:error] [pid 19793:tid 19815] [client 51.75.119.153:44610] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad1r0QGEQsZw9TkmIA4u4wAAANQ"]
[Tue Apr 14 06:18:59.790875 2026] [:error] [pid 64393:tid 64412] [client 51.75.119.153:41310] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad1r0-ClKltJhW50hKPkzgAAARE"]
[Tue Apr 14 06:19:03.610329 2026] [:error] [pid 19793:tid 19814] [client 51.75.119.153:34878] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad1r1wGEQsZw9TkmIA4u7QAAANM"]
[Tue Apr 14 06:19:23.111456 2026] [:error] [pid 19687:tid 19715] [client 216.73.216.136:48561] [client 216.73.216.136] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||switchcreative.net|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ad1r62BZImnR12CCWFpADQAAABM"]
[Tue Apr 14 06:24:09.257044 2026] [proxy_fcgi:error] [pid 64393:tid 64397] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:09.824341 2026] [proxy_fcgi:error] [pid 64393:tid 64415] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:10.081117 2026] [proxy_fcgi:error] [pid 64393:tid 64406] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:10.321610 2026] [proxy_fcgi:error] [pid 64393:tid 64407] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:10.561533 2026] [proxy_fcgi:error] [pid 64393:tid 64413] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:10.803213 2026] [proxy_fcgi:error] [pid 64393:tid 64401] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:11.336848 2026] [proxy_fcgi:error] [pid 64393:tid 64403] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:11.581595 2026] [proxy_fcgi:error] [pid 64393:tid 64417] [client 158.158.43.6:46694] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:12.139787 2026] [:error] [pid 64393:tid 64405] [client 158.158.43.6:46694] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad1tDOClKltJhW50hKPoiwAAAQo"]
[Tue Apr 14 06:24:13.103982 2026] [proxy_fcgi:error] [pid 19688:tid 19738] [client 158.158.43.6:46657] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:13.359123 2026] [proxy_fcgi:error] [pid 19688:tid 19744] [client 158.158.43.6:46657] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:24:13.730996 2026] [:error] [pid 19688:tid 19730] [client 158.158.43.6:46657] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ad1tDYHoi57o76xPstLLIwAAAEI"]
[Tue Apr 14 06:24:14.847954 2026] [:error] [pid 64393:tid 64408] [client 158.158.43.6:56323] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ad1tDuClKltJhW50hKPojwAAAQ0"]
[Tue Apr 14 06:24:16.139379 2026] [:error] [pid 19689:tid 19756] [client 158.158.43.6:63998] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ad1tEJWU15arjG3aJyRo0QAAAIE"]
[Tue Apr 14 06:24:17.132226 2026] [:error] [pid 19687:tid 19698] [client 158.158.43.6:63948] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ad1tEWBZImnR12CCWFpBFQAAAAI"]
[Tue Apr 14 06:24:17.857140 2026] [:error] [pid 19793:tid 19810] [client 158.158.43.6:54009] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "ad1tEQGEQsZw9TkmIA4xhAAAAM8"]
[Tue Apr 14 06:24:18.627245 2026] [:error] [pid 19689:tid 19758] [client 158.158.43.6:49893] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "ad1tEpWU15arjG3aJyRo1gAAAIM"]
[Tue Apr 14 06:24:19.943294 2026] [:error] [pid 19793:tid 19814] [client 158.158.43.6:56334] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "ad1tEwGEQsZw9TkmIA4xhwAAANM"]
[Tue Apr 14 06:24:20.923498 2026] [:error] [pid 19793:tid 19811] [client 158.158.43.6:50559] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "ad1tFAGEQsZw9TkmIA4xjAAAANA"]
[Tue Apr 14 06:24:21.554102 2026] [:error] [pid 64393:tid 64405] [client 158.158.43.6:46666] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/state.php"] [unique_id "ad1tFeClKltJhW50hKPomgAAAQo"]
[Tue Apr 14 06:24:23.237301 2026] [:error] [pid 19793:tid 19798] [client 158.158.43.6:53966] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/state.php"] [unique_id "ad1tFwGEQsZw9TkmIA4xkQAAAMM"]
[Tue Apr 14 06:24:24.226792 2026] [:error] [pid 19793:tid 19804] [client 158.158.43.6:63983] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/state.php"] [unique_id "ad1tGAGEQsZw9TkmIA4xkwAAAMk"]
[Tue Apr 14 06:24:25.840584 2026] [:error] [pid 19687:tid 19711] [client 158.158.43.6:53981] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/state.php"] [unique_id "ad1tGWBZImnR12CCWFpBHQAAAA8"]
[Tue Apr 14 06:24:27.457424 2026] [:error] [pid 19793:tid 19819] [client 158.158.43.6:46687] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "ad1tGwGEQsZw9TkmIA4xngAAANg"]
[Tue Apr 14 06:24:29.134977 2026] [:error] [pid 19793:tid 19801] [client 158.158.43.6:46670] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "ad1tHQGEQsZw9TkmIA4xpgAAAMY"]
[Tue Apr 14 06:24:32.426627 2026] [:error] [pid 64393:tid 64397] [client 158.158.43.6:53998] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "ad1tIOClKltJhW50hKPouAAAAQI"]
[Tue Apr 14 06:24:53.861273 2026] [:error] [pid 64393:tid 64418] [client 158.158.43.6:56378] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ad1tNeClKltJhW50hKPo3AAAARc"]
[Tue Apr 14 06:25:00.702668 2026] [:error] [pid 19689:tid 19771] [client 158.158.43.6:50497] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ad1tPJWU15arjG3aJyRo9QAAAJA"]
[Tue Apr 14 06:25:06.236842 2026] [:error] [pid 19687:tid 19698] [client 158.158.43.6:53997] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ad1tQmBZImnR12CCWFpBNQAAAAI"]
[Tue Apr 14 06:25:10.221141 2026] [:error] [pid 64393:tid 64396] [client 158.158.43.6:54005] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ad1tRuClKltJhW50hKPpBgAAAQE"]
[Tue Apr 14 06:25:13.559580 2026] [proxy_fcgi:error] [pid 64393:tid 64409] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:13.799811 2026] [proxy_fcgi:error] [pid 64393:tid 64414] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:14.054150 2026] [proxy_fcgi:error] [pid 64393:tid 64399] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:14.294443 2026] [proxy_fcgi:error] [pid 64393:tid 64410] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:14.538496 2026] [proxy_fcgi:error] [pid 64393:tid 64402] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:15.743646 2026] [proxy_fcgi:error] [pid 64393:tid 64404] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:15.982723 2026] [proxy_fcgi:error] [pid 64393:tid 64419] [client 158.158.43.6:56372] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:16.462563 2026] [:error] [pid 64393:tid 64409] [client 158.158.43.6:56372] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ad1tTOClKltJhW50hKPpGAAAAQ4"]
[Tue Apr 14 06:25:19.692854 2026] [proxy_fcgi:error] [pid 19687:tid 19715] [client 158.158.43.6:50502] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:19.936476 2026] [proxy_fcgi:error] [pid 19687:tid 19702] [client 158.158.43.6:50502] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:25:20.173160 2026] [:error] [pid 19687:tid 19713] [client 158.158.43.6:50502] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ad1tUGBZImnR12CCWFpBRQAAABE"]
[Tue Apr 14 06:25:22.305565 2026] [:error] [pid 19687:tid 19698] [client 158.158.43.6:56375] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ad1tUmBZImnR12CCWFpBTAAAAAI"]
[Tue Apr 14 06:25:25.239095 2026] [:error] [pid 19793:tid 19813] [client 158.158.43.6:46080] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ad1tVQGEQsZw9TkmIA4x_gAAANI"]
[Tue Apr 14 06:25:29.069950 2026] [:error] [pid 64393:tid 64399] [client 158.158.43.6:56381] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ad1tWeClKltJhW50hKPpIAAAAQQ"]
[Tue Apr 14 06:25:33.625685 2026] [:error] [pid 64393:tid 64404] [client 158.158.43.6:46678] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ad1tXeClKltJhW50hKPpNgAAAQk"]
[Tue Apr 14 06:25:40.680851 2026] [:error] [pid 19793:tid 19801] [client 158.158.43.6:49867] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "ad1tZAGEQsZw9TkmIA4yDQAAAMY"]
[Tue Apr 14 06:25:56.684776 2026] [:error] [pid 19688:tid 19750] [client 158.158.43.6:50551] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/footer.php"] [unique_id "ad1tdIHoi57o76xPstLLeQAAAFY"]
[Tue Apr 14 06:26:07.095027 2026] [:error] [pid 19793:tid 19807] [client 158.158.43.6:50527] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ad1tfwGEQsZw9TkmIA4yIQAAAMw"]
[Tue Apr 14 06:26:09.292020 2026] [:error] [pid 19688:tid 19747] [client 158.158.43.6:56336] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ad1tgYHoi57o76xPstLLggAAAFM"]
[Tue Apr 14 06:26:13.709602 2026] [:error] [pid 19688:tid 19749] [client 158.158.43.6:63955] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ad1thYHoi57o76xPstLLigAAAFU"]
[Tue Apr 14 06:26:16.450443 2026] [:error] [pid 64393:tid 64398] [client 158.158.43.6:49895] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ad1tiOClKltJhW50hKPpnwAAAQM"]
[Tue Apr 14 06:26:19.153915 2026] [proxy_fcgi:error] [pid 19689:tid 19777] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:19.393140 2026] [proxy_fcgi:error] [pid 19689:tid 19761] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:19.631950 2026] [proxy_fcgi:error] [pid 19689:tid 19770] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:19.870978 2026] [proxy_fcgi:error] [pid 19689:tid 19769] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:20.109932 2026] [proxy_fcgi:error] [pid 19689:tid 19773] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:20.348231 2026] [proxy_fcgi:error] [pid 19689:tid 19764] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:20.587080 2026] [proxy_fcgi:error] [pid 19689:tid 19778] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:20.825404 2026] [proxy_fcgi:error] [pid 19689:tid 19772] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:21.158706 2026] [proxy_fcgi:error] [pid 19689:tid 19758] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:21.399530 2026] [proxy_fcgi:error] [pid 19689:tid 19775] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:21.671665 2026] [proxy_fcgi:error] [pid 19689:tid 19774] [client 158.158.43.6:53978] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:26:21.907080 2026] [:error] [pid 19689:tid 19756] [client 158.158.43.6:53978] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ad1tjZWU15arjG3aJyRpOwAAAIE"]
[Tue Apr 14 06:26:23.833093 2026] [:error] [pid 19793:tid 19797] [client 158.158.43.6:49884] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ad1tjwGEQsZw9TkmIA4yLAAAAMI"]
[Tue Apr 14 06:26:25.475257 2026] [:error] [pid 64393:tid 64413] [client 158.158.43.6:46714] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ad1tkeClKltJhW50hKPpqwAAARI"]
[Tue Apr 14 06:26:29.469344 2026] [:error] [pid 64393:tid 64406] [client 158.158.43.6:53957] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws86.php"] [unique_id "ad1tleClKltJhW50hKPpswAAAQs"]
[Tue Apr 14 06:26:33.628770 2026] [:error] [pid 64393:tid 64417] [client 158.158.43.6:53955] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "ad1tmeClKltJhW50hKPpvQAAARY"]
[Tue Apr 14 06:26:37.141951 2026] [:error] [pid 19793:tid 19819] [client 158.158.43.6:56320] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "ad1tnQGEQsZw9TkmIA4yYQAAANg"]
[Tue Apr 14 06:26:39.173981 2026] [:error] [pid 64393:tid 64398] [client 158.158.43.6:49896] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "ad1tn-ClKltJhW50hKPp7QAAAQM"]
[Tue Apr 14 06:26:40.973633 2026] [:error] [pid 19688:tid 19736] [client 158.158.43.6:56333] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "ad1toIHoi57o76xPstLLowAAAEg"]
[Tue Apr 14 06:26:42.512507 2026] [:error] [pid 19687:tid 19708] [client 158.158.43.6:46141] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ad1tomBZImnR12CCWFpBpQAAAAw"]
[Tue Apr 14 06:26:43.423896 2026] [:error] [pid 64393:tid 64398] [client 158.158.43.6:63949] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ad1to-ClKltJhW50hKPp-AAAAQM"]
[Tue Apr 14 06:26:45.178400 2026] [:error] [pid 64393:tid 64397] [client 158.158.43.6:63978] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ad1tpeClKltJhW50hKPqAwAAAQI"]
[Tue Apr 14 06:26:46.497100 2026] [:error] [pid 19793:tid 19811] [client 158.158.43.6:63988] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ad1tpgGEQsZw9TkmIA4ydwAAANA"]
[Tue Apr 14 06:26:48.258699 2026] [:error] [pid 19689:tid 19771] [client 158.158.43.6:53970] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1s7y8wt9dz.php"] [unique_id "ad1tqJWU15arjG3aJyRpXAAAAJA"]
[Tue Apr 14 06:26:49.177119 2026] [:error] [pid 64393:tid 64403] [client 158.158.43.6:50498] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1s7y8wt9dz.php"] [unique_id "ad1tqeClKltJhW50hKPqDQAAAQg"]
[Tue Apr 14 06:26:51.618149 2026] [:error] [pid 64393:tid 64395] [client 158.158.43.6:50556] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1s7y8wt9dz.php"] [unique_id "ad1tq-ClKltJhW50hKPqFwAAAQA"]
[Tue Apr 14 06:26:57.144577 2026] [:error] [pid 19689:tid 19767] [client 158.158.43.6:50554] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1s7y8wt9dz.php"] [unique_id "ad1tsZWU15arjG3aJyRpZQAAAIw"]
[Tue Apr 14 06:27:01.125996 2026] [:error] [pid 64393:tid 64409] [client 158.158.43.6:50532] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bdktk.php"] [unique_id "ad1tteClKltJhW50hKPqIgAAAQ4"]
[Tue Apr 14 06:27:02.922606 2026] [:error] [pid 64393:tid 64406] [client 158.158.43.6:46665] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bdktk.php"] [unique_id "ad1ttuClKltJhW50hKPqKAAAAQs"]
[Tue Apr 14 06:27:05.190115 2026] [:error] [pid 64393:tid 64411] [client 158.158.43.6:54012] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bdktk.php"] [unique_id "ad1tueClKltJhW50hKPqKwAAARA"]
[Tue Apr 14 06:27:07.430392 2026] [:error] [pid 19688:tid 19748] [client 158.158.43.6:46139] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bdktk.php"] [unique_id "ad1tu4Hoi57o76xPstLLtQAAAFQ"]
[Tue Apr 14 06:27:13.449467 2026] [:error] [pid 32941:tid 32949] [client 158.158.43.6:56352] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v5.php"] [unique_id "ad1twaAX0ubdpP7Z66y4twAAAAM"]
[Tue Apr 14 06:27:17.993342 2026] [:error] [pid 32941:tid 32970] [client 158.158.43.6:56339] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v5.php"] [unique_id "ad1txaAX0ubdpP7Z66y5AwAAABg"]
[Tue Apr 14 06:27:21.362277 2026] [proxy_fcgi:error] [pid 33031:tid 33056] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:21.624052 2026] [proxy_fcgi:error] [pid 33031:tid 33037] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:21.866849 2026] [proxy_fcgi:error] [pid 33031:tid 33036] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:23.831779 2026] [proxy_fcgi:error] [pid 33031:tid 33045] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:24.075552 2026] [proxy_fcgi:error] [pid 33031:tid 33053] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:24.325973 2026] [proxy_fcgi:error] [pid 33031:tid 33054] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:26.043986 2026] [proxy_fcgi:error] [pid 33031:tid 33038] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:26.285529 2026] [proxy_fcgi:error] [pid 33031:tid 33058] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:26.559018 2026] [proxy_fcgi:error] [pid 33031:tid 33043] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:26.814048 2026] [proxy_fcgi:error] [pid 33031:tid 33036] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:28.575598 2026] [proxy_fcgi:error] [pid 33031:tid 33049] [client 158.158.43.6:56364] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:27:28.824790 2026] [:error] [pid 33031:tid 33035] [client 158.158.43.6:56364] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "ad1t0P4d7_j9IbSJ_rwAxwAAAQE"]
[Tue Apr 14 06:27:30.095991 2026] [:error] [pid 33031:tid 33044] [client 158.158.43.6:46680] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "ad1t0v4d7_j9IbSJ_rwAywAAAQo"]
[Tue Apr 14 06:27:33.218572 2026] [:error] [pid 32943:tid 33023] [client 158.158.43.6:56347] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "ad1t1QtqsULtpZz5NS15iAAAAJY"]
[Tue Apr 14 06:27:36.319384 2026] [:error] [pid 33031:tid 33048] [client 158.158.43.6:63953] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "ad1t2P4d7_j9IbSJ_rwA1AAAAQ4"]
[Tue Apr 14 06:27:40.459652 2026] [:error] [pid 32941:tid 32961] [client 158.158.43.6:7513] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ad1t3KAX0ubdpP7Z66y5JwAAAA8"]
[Tue Apr 14 06:27:44.904275 2026] [:error] [pid 32941:tid 32954] [client 158.158.43.6:53995] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ad1t4KAX0ubdpP7Z66y5LAAAAAg"]
[Tue Apr 14 06:27:50.218876 2026] [:error] [pid 32942:tid 32997] [client 158.158.43.6:56366] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "ad1t5kLPfTkkAwENPeqI1gAAAFc"]
[Tue Apr 14 06:27:52.382954 2026] [:error] [pid 33031:tid 33056] [client 158.158.43.6:49897] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "ad1t6P4d7_j9IbSJ_rwA9QAAARY"]
[Tue Apr 14 06:27:54.265388 2026] [:error] [pid 33031:tid 33049] [client 158.158.43.6:49863] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "ad1t6v4d7_j9IbSJ_rwA_gAAAQ8"]
[Tue Apr 14 06:28:05.408545 2026] [:error] [pid 32941:tid 32952] [client 158.158.43.6:49906] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "ad1t9aAX0ubdpP7Z66y5PwAAAAY"]
[Tue Apr 14 06:28:07.350810 2026] [:error] [pid 32942:tid 32988] [client 158.158.43.6:50520] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqa.php"] [unique_id "ad1t90LPfTkkAwENPeqI4QAAAE4"]
[Tue Apr 14 06:28:08.274944 2026] [:error] [pid 33031:tid 33044] [client 158.158.43.6:49861] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqa.php"] [unique_id "ad1t-P4d7_j9IbSJ_rwBGgAAAQo"]
[Tue Apr 14 06:28:08.921103 2026] [:error] [pid 32941:tid 32956] [client 158.158.43.6:63972] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqa.php"] [unique_id "ad1t-KAX0ubdpP7Z66y5QwAAAAo"]
[Tue Apr 14 06:28:10.148183 2026] [:error] [pid 32942:tid 32990] [client 158.158.43.6:56341] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qqa.php"] [unique_id "ad1t-kLPfTkkAwENPeqI4wAAAFA"]
[Tue Apr 14 06:28:14.879882 2026] [:error] [pid 32942:tid 32998] [client 158.158.43.6:50530] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ad1t_kLPfTkkAwENPeqI6wAAAFg"]
[Tue Apr 14 06:28:17.115791 2026] [:error] [pid 32942:tid 32982] [client 158.158.43.6:56367] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ad1uAULPfTkkAwENPeqI9gAAAEg"]
[Tue Apr 14 06:28:20.788429 2026] [:error] [pid 32943:tid 33003] [client 158.158.43.6:46715] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ad1uBAtqsULtpZz5NS152gAAAII"]
[Tue Apr 14 06:28:23.349947 2026] [:error] [pid 33031:tid 33055] [client 158.158.43.6:46684] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ad1uB_4d7_j9IbSJ_rwBSgAAARU"]
[Tue Apr 14 06:28:26.224202 2026] [:error] [pid 32941:tid 32962] [client 158.158.43.6:46707] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ga.php"] [unique_id "ad1uCqAX0ubdpP7Z66y5XwAAABA"]
[Tue Apr 14 06:28:36.103441 2026] [proxy_fcgi:error] [pid 32943:tid 33017] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:36.341150 2026] [proxy_fcgi:error] [pid 32943:tid 33025] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:36.581604 2026] [proxy_fcgi:error] [pid 32943:tid 33001] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:36.820377 2026] [proxy_fcgi:error] [pid 32943:tid 33021] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:37.072991 2026] [proxy_fcgi:error] [pid 32943:tid 33024] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:38.090450 2026] [proxy_fcgi:error] [pid 32943:tid 33013] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:39.662446 2026] [proxy_fcgi:error] [pid 32943:tid 33017] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:39.902365 2026] [proxy_fcgi:error] [pid 32943:tid 33025] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:40.142251 2026] [proxy_fcgi:error] [pid 32943:tid 33024] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:40.386595 2026] [proxy_fcgi:error] [pid 32943:tid 33002] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:40.624046 2026] [proxy_fcgi:error] [pid 32943:tid 33015] [client 158.158.43.6:50514] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:28:40.860427 2026] [:error] [pid 32943:tid 33016] [client 158.158.43.6:50514] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ad1uGAtqsULtpZz5NS16GQAAAI8"]
[Tue Apr 14 06:28:44.110364 2026] [:error] [pid 32941:tid 32967] [client 158.158.43.6:50550] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ad1uHKAX0ubdpP7Z66y5eAAAABU"]
[Tue Apr 14 06:28:47.056073 2026] [:error] [pid 32941:tid 32968] [client 158.158.43.6:49905] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ad1uH6AX0ubdpP7Z66y5egAAABY"]
[Tue Apr 14 06:28:48.001254 2026] [:error] [pid 33031:tid 33034] [client 158.158.43.6:53953] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ad1uH_4d7_j9IbSJ_rwBggAAAQA"]
[Tue Apr 14 06:28:49.307372 2026] [:error] [pid 32942:tid 32975] [client 158.158.43.6:53988] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "ad1uIULPfTkkAwENPeqJOwAAAEE"]
[Tue Apr 14 06:28:51.103966 2026] [:error] [pid 32942:tid 32988] [client 158.158.43.6:54004] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "ad1uI0LPfTkkAwENPeqJPwAAAE4"]
[Tue Apr 14 06:28:51.775933 2026] [:error] [pid 32943:tid 33019] [client 158.158.43.6:56331] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "ad1uIwtqsULtpZz5NS16JwAAAJI"]
[Tue Apr 14 06:28:53.060073 2026] [:error] [pid 33031:tid 33050] [client 158.158.43.6:63974] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "ad1uJf4d7_j9IbSJ_rwBhgAAARA"]
[Tue Apr 14 06:28:54.100822 2026] [:error] [pid 32943:tid 33014] [client 158.158.43.6:63974] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ad1uJgtqsULtpZz5NS16KwAAAI0"]
[Tue Apr 14 06:28:55.198729 2026] [:error] [pid 32943:tid 33010] [client 158.158.43.6:49891] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ad1uJwtqsULtpZz5NS16MwAAAIk"]
[Tue Apr 14 06:28:55.851152 2026] [:error] [pid 32943:tid 33025] [client 158.158.43.6:63970] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ad1uJwtqsULtpZz5NS16NgAAAJg"]
[Tue Apr 14 06:28:56.713154 2026] [:error] [pid 32941:tid 32953] [client 158.158.43.6:46118] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "ad1uKKAX0ubdpP7Z66y5igAAAAc"]
[Tue Apr 14 06:28:58.007765 2026] [:error] [pid 32943:tid 33008] [client 158.158.43.6:46682] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper.php"] [unique_id "ad1uKgtqsULtpZz5NS16PAAAAIc"]
[Tue Apr 14 06:28:59.795001 2026] [:error] [pid 32943:tid 33023] [client 158.158.43.6:49873] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper.php"] [unique_id "ad1uKwtqsULtpZz5NS16RAAAAJY"]
[Tue Apr 14 06:29:00.847315 2026] [:error] [pid 32943:tid 33012] [client 158.158.43.6:63967] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper.php"] [unique_id "ad1uLAtqsULtpZz5NS16SwAAAIs"]
[Tue Apr 14 06:29:01.964940 2026] [:error] [pid 32941:tid 32956] [client 158.158.43.6:46668] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper.php"] [unique_id "ad1uLaAX0ubdpP7Z66y5jgAAAAo"]
[Tue Apr 14 06:29:02.921999 2026] [:error] [pid 32943:tid 33005] [client 158.158.43.6:63944] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxpass.php"] [unique_id "ad1uLgtqsULtpZz5NS16UQAAAIQ"]
[Tue Apr 14 06:29:04.126967 2026] [:error] [pid 32942:tid 32993] [client 158.158.43.6:63952] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxpass.php"] [unique_id "ad1uMELPfTkkAwENPeqJUQAAAFM"]
[Tue Apr 14 06:29:05.651745 2026] [:error] [pid 32942:tid 32991] [client 158.158.43.6:49885] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxpass.php"] [unique_id "ad1uMULPfTkkAwENPeqJUwAAAFE"]
[Tue Apr 14 06:29:07.814731 2026] [:error] [pid 32943:tid 33016] [client 158.158.43.6:7490] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wxpass.php"] [unique_id "ad1uMwtqsULtpZz5NS16WwAAAI8"]
[Tue Apr 14 06:29:17.156255 2026] [:error] [pid 33031:tid 33053] [client 158.158.43.6:49866] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "ad1uPf4d7_j9IbSJ_rwBwgAAARM"]
[Tue Apr 14 06:29:36.101892 2026] [:error] [pid 32943:tid 33015] [client 158.158.43.6:50539] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "ad1uUAtqsULtpZz5NS16nAAAAI4"]
[Tue Apr 14 06:29:41.254516 2026] [proxy_fcgi:error] [pid 32943:tid 33016] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:41.507230 2026] [proxy_fcgi:error] [pid 32943:tid 33010] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:41.761148 2026] [proxy_fcgi:error] [pid 32943:tid 33015] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:42.002768 2026] [proxy_fcgi:error] [pid 32943:tid 33018] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:42.262393 2026] [proxy_fcgi:error] [pid 32943:tid 33005] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:42.503467 2026] [proxy_fcgi:error] [pid 32943:tid 33011] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:42.755552 2026] [proxy_fcgi:error] [pid 32943:tid 33009] [client 158.158.43.6:46662] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:43.006312 2026] [:error] [pid 32943:tid 33002] [client 158.158.43.6:46662] [client 158.158.43.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wincust.php"] [unique_id "ad1uVwtqsULtpZz5NS16rQAAAIE"]
[Tue Apr 14 06:29:45.646465 2026] [proxy_fcgi:error] [pid 33031:tid 33047] [client 158.158.43.6:46114] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:45.887346 2026] [proxy_fcgi:error] [pid 33031:tid 33037] [client 158.158.43.6:46114] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:46.134633 2026] [proxy_fcgi:error] [pid 33031:tid 33057] [client 158.158.43.6:46114] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:46.384894 2026] [proxy_fcgi:error] [pid 33031:tid 33048] [client 158.158.43.6:46114] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:29:46.621641 2026] [:error] [pid 33031:tid 33038] [client 158.158.43.6:46114] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "ad1uWv4d7_j9IbSJ_rwCKgAAAQQ"]
[Tue Apr 14 06:29:49.570622 2026] [:error] [pid 32943:tid 33010] [client 158.158.43.6:63991] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "ad1uXQtqsULtpZz5NS16tAAAAIk"]
[Tue Apr 14 06:29:51.257916 2026] [:error] [pid 32941:tid 32959] [client 158.158.43.6:54006] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "ad1uX6AX0ubdpP7Z66y5qwAAAA0"]
[Tue Apr 14 06:29:53.083367 2026] [:error] [pid 32941:tid 32950] [client 158.158.43.6:54002] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "ad1uYaAX0ubdpP7Z66y5rgAAAAQ"]
[Tue Apr 14 06:29:59.237150 2026] [:error] [pid 32942:tid 32983] [client 158.158.43.6:50533] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "ad1uZ0LPfTkkAwENPeqJlQAAAEk"]
[Tue Apr 14 06:30:04.776297 2026] [:error] [pid 32943:tid 33010] [client 158.158.43.6:54633] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "ad1ubAtqsULtpZz5NS160wAAAIk"]
[Tue Apr 14 06:30:07.154587 2026] [:error] [pid 32942:tid 32989] [client 158.158.43.6:49888] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws66.php"] [unique_id "ad1ub0LPfTkkAwENPeqJnwAAAE8"]
[Tue Apr 14 06:30:10.191359 2026] [:error] [pid 33031:tid 33037] [client 158.158.43.6:53963] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "ad1ucv4d7_j9IbSJ_rwCPwAAAQM"]
[Tue Apr 14 06:30:13.363983 2026] [:error] [pid 33031:tid 33044] [client 158.158.43.6:46703] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "ad1udf4d7_j9IbSJ_rwCRQAAAQo"]
[Tue Apr 14 06:30:15.310589 2026] [:error] [pid 33031:tid 33035] [client 158.158.43.6:56321] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "ad1ud_4d7_j9IbSJ_rwCTAAAAQE"]
[Tue Apr 14 06:30:19.120380 2026] [:error] [pid 32942:tid 32984] [client 158.158.43.6:49860] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "ad1ue0LPfTkkAwENPeqJrAAAAEo"]
[Tue Apr 14 06:30:23.822453 2026] [:error] [pid 32942:tid 32998] [client 158.158.43.6:53998] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xynz.php"] [unique_id "ad1uf0LPfTkkAwENPeqJvAAAAFg"]
[Tue Apr 14 06:30:27.686911 2026] [:error] [pid 32943:tid 33018] [client 158.158.43.6:63994] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xynz.php"] [unique_id "ad1ugwtqsULtpZz5NS169AAAAJE"]
[Tue Apr 14 06:30:31.432919 2026] [:error] [pid 32943:tid 33005] [client 158.158.43.6:56351] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xynz.php"] [unique_id "ad1uhwtqsULtpZz5NS16-QAAAIQ"]
[Tue Apr 14 06:30:34.107849 2026] [:error] [pid 32943:tid 33014] [client 158.158.43.6:46093] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xynz.php"] [unique_id "ad1uigtqsULtpZz5NS16-wAAAI0"]
[Tue Apr 14 06:30:35.067439 2026] [:error] [pid 32943:tid 33017] [client 158.158.43.6:56355] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "ad1uiwtqsULtpZz5NS16_gAAAJA"]
[Tue Apr 14 06:30:35.884560 2026] [:error] [pid 32943:tid 33023] [client 158.158.43.6:50521] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "ad1uiwtqsULtpZz5NS17AgAAAJY"]
[Tue Apr 14 06:30:37.974148 2026] [:error] [pid 32942:tid 32987] [client 158.158.43.6:63966] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "ad1ujULPfTkkAwENPeqJ0wAAAE0"]
[Tue Apr 14 06:30:39.869586 2026] [:error] [pid 33031:tid 33042] [client 158.158.43.6:53955] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "ad1uj_4d7_j9IbSJ_rwCkQAAAQg"]
[Tue Apr 14 06:30:42.495455 2026] [:error] [pid 33031:tid 33034] [client 158.158.43.6:46673] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e7.php"] [unique_id "ad1ukv4d7_j9IbSJ_rwCmQAAAQA"]
[Tue Apr 14 06:30:45.103947 2026] [:error] [pid 32943:tid 33006] [client 158.158.43.6:63975] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e7.php"] [unique_id "ad1ulQtqsULtpZz5NS17FQAAAIU"]
[Tue Apr 14 06:30:54.158394 2026] [proxy_fcgi:error] [pid 32943:tid 33017] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:54.980667 2026] [proxy_fcgi:error] [pid 32943:tid 33016] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:55.225805 2026] [proxy_fcgi:error] [pid 32943:tid 33021] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:55.472383 2026] [proxy_fcgi:error] [pid 32943:tid 33023] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:55.713116 2026] [proxy_fcgi:error] [pid 32943:tid 33019] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:55.953696 2026] [proxy_fcgi:error] [pid 32943:tid 33010] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:56.200729 2026] [proxy_fcgi:error] [pid 32943:tid 33025] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:56.469020 2026] [proxy_fcgi:error] [pid 32943:tid 33005] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:56.709748 2026] [proxy_fcgi:error] [pid 32943:tid 33003] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:56.954875 2026] [proxy_fcgi:error] [pid 32943:tid 33024] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:57.197576 2026] [proxy_fcgi:error] [pid 32943:tid 33017] [client 158.158.43.6:49869] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 06:30:57.435030 2026] [:error] [pid 32943:tid 33013] [client 158.158.43.6:49869] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "ad1uoQtqsULtpZz5NS17MQAAAIw"]
[Tue Apr 14 06:30:59.400749 2026] [:error] [pid 32943:tid 33023] [client 158.158.43.6:63941] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "ad1uowtqsULtpZz5NS17NwAAAJY"]
[Tue Apr 14 06:31:03.483403 2026] [:error] [pid 35628:tid 35635] [client 158.158.43.6:46664] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "ad1up-fPm-ozGuwCWXJ8LQAAAAM"]
[Tue Apr 14 06:31:05.041075 2026] [:error] [pid 35628:tid 35651] [client 158.158.43.6:53997] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "ad1uqefPm-ozGuwCWXJ8OgAAABM"]
[Tue Apr 14 06:31:07.476739 2026] [:error] [pid 35628:tid 35645] [client 158.158.43.6:46709] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ad1uq-fPm-ozGuwCWXJ8QwAAAA0"]
[Tue Apr 14 06:31:11.132333 2026] [:error] [pid 35713:tid 35717] [client 158.158.43.6:63939] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ad1ur66-hhx6ZepqOSlKRwAAAME"]
[Tue Apr 14 06:31:15.625232 2026] [:error] [pid 35628:tid 35634] [client 158.158.43.6:50525] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ad1us-fPm-ozGuwCWXJ8VwAAAAI"]
[Tue Apr 14 06:31:17.408247 2026] [:error] [pid 35713:tid 35737] [client 158.158.43.6:46711] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ad1uta6-hhx6ZepqOSlKTwAAANU"]
[Tue Apr 14 06:31:20.367801 2026] [:error] [pid 35713:tid 35737] [client 158.158.43.6:63948] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ad1uuK6-hhx6ZepqOSlKZAAAANU"]
[Tue Apr 14 06:31:22.103009 2026] [:error] [pid 35630:tid 35700] [client 158.158.43.6:63936] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ad1uujer0pVFxOiOauWJIwAAAI4"]
[Tue Apr 14 06:31:25.608141 2026] [:error] [pid 35629:tid 35660] [client 158.158.43.6:63943] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ad1uvTY8VahzC1YJBSiKdAAAAEE"]
[Tue Apr 14 06:31:27.434724 2026] [:error] [pid 35629:tid 35670] [client 158.158.43.6:46087] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ad1uvzY8VahzC1YJBSiKegAAAEs"]
[Tue Apr 14 06:31:28.601838 2026] [:error] [pid 35713:tid 35716] [client 158.158.43.6:54010] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260325043000.php"] [unique_id "ad1uwK6-hhx6ZepqOSlKbgAAAMA"]
[Tue Apr 14 06:31:30.994083 2026] [:error] [pid 35713:tid 35718] [client 158.158.43.6:53999] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260325043000.php"] [unique_id "ad1uwq6-hhx6ZepqOSlKcwAAAMI"]
[Tue Apr 14 06:31:32.723942 2026] [:error] [pid 35628:tid 35653] [client 158.158.43.6:56339] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260325043000.php"] [unique_id "ad1uxOfPm-ozGuwCWXJ8ZwAAABU"]
[Tue Apr 14 06:31:34.468477 2026] [:error] [pid 35630:tid 35695] [client 158.158.43.6:46678] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260325043000.php"] [unique_id "ad1uxjer0pVFxOiOauWJMgAAAIk"]
[Tue Apr 14 06:31:36.431410 2026] [:error] [pid 35713:tid 35739] [client 158.158.43.6:50997] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260401065719.php"] [unique_id "ad1uyK6-hhx6ZepqOSlKdQAAANc"]
[Tue Apr 14 06:31:37.812875 2026] [:error] [pid 35630:tid 35698] [client 158.158.43.6:49865] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260401065719.php"] [unique_id "ad1uyTer0pVFxOiOauWJOQAAAIw"]
[Tue Apr 14 06:31:39.909991 2026] [:error] [pid 35713:tid 35735] [client 158.158.43.6:63982] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260401065719.php"] [unique_id "ad1uy66-hhx6ZepqOSlKggAAANM"]
[Tue Apr 14 06:31:41.145695 2026] [:error] [pid 35630:tid 35691] [client 158.158.43.6:53966] [client 158.158.43.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods_260401065719.php"] [unique_id "ad1uzTer0pVFxOiOauWJPwAAAIU"]
[Tue Apr 14 07:27:43.467224 2026] [:error] [pid 35629:tid 35669] [client 51.75.119.168:34806] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ad177zY8VahzC1YJBSiuawAAAEo"]
[Tue Apr 14 07:27:47.537916 2026] [:error] [pid 35630:tid 35694] [client 51.75.119.168:40642] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad178zer0pVFxOiOauWz-AAAAIg"]
[Tue Apr 14 07:27:51.607833 2026] [:error] [pid 35713:tid 35719] [client 51.75.119.168:51478] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad17966-hhx6ZepqOSmjywAAAMM"]
[Tue Apr 14 07:27:55.141508 2026] [:error] [pid 35628:tid 35636] [client 51.75.119.168:51494] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad17--fPm-ozGuwCWXKgzgAAAAQ"]
[Tue Apr 14 07:27:58.412044 2026] [:error] [pid 37048:tid 37050] [client 51.75.119.168:42904] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ad17_p52Bo1OyzeXo_yAaQAAAQA"]
[Tue Apr 14 07:28:01.971886 2026] [:error] [pid 37048:tid 37055] [client 51.75.119.168:42906] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ad18AZ52Bo1OyzeXo_yAcwAAAQU"]
[Tue Apr 14 07:28:05.429931 2026] [:error] [pid 35630:tid 35706] [client 51.75.119.168:42910] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ad18BTer0pVFxOiOauW0BwAAAJQ"]
[Tue Apr 14 07:28:08.507512 2026] [:error] [pid 35630:tid 35688] [client 51.75.119.168:54180] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ad18CDer0pVFxOiOauW0DwAAAII"]
[Tue Apr 14 07:28:11.990617 2026] [:error] [pid 37048:tid 37073] [client 51.75.119.168:54194] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ad18C552Bo1OyzeXo_yAewAAARY"]
[Tue Apr 14 07:28:15.200185 2026] [:error] [pid 35713:tid 35738] [client 51.75.119.168:54202] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ad18D66-hhx6ZepqOSmj8wAAANY"]
[Tue Apr 14 07:28:18.882845 2026] [:error] [pid 37048:tid 37052] [client 51.75.119.168:53868] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ad18Ep52Bo1OyzeXo_yAigAAAQI"]
[Tue Apr 14 07:28:21.787294 2026] [:error] [pid 37226:tid 37231] [client 51.75.119.168:53874] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ad18FZOA5-IQ0IVmQCqq0AAAAUM"]
[Tue Apr 14 07:28:24.928115 2026] [:error] [pid 37048:tid 37051] [client 51.75.119.168:53886] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ad18GJ52Bo1OyzeXo_yAkwAAAQE"]
[Tue Apr 14 07:28:27.636168 2026] [:error] [pid 35628:tid 35636] [client 51.75.119.168:53900] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ad18G-fPm-ozGuwCWXKg3wAAAAQ"]
[Tue Apr 14 07:28:30.649382 2026] [:error] [pid 35629:tid 35666] [client 51.75.119.168:37678] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ad18HjY8VahzC1YJBSiulAAAAEc"]
[Tue Apr 14 07:28:34.559707 2026] [:error] [pid 35630:tid 35706] [client 51.75.119.168:37684] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ad18Ijer0pVFxOiOauW0HgAAAJQ"]
[Tue Apr 14 07:28:37.387488 2026] [:error] [pid 37226:tid 37247] [client 51.75.119.168:37694] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ad18JZOA5-IQ0IVmQCqq3AAAAVM"]
[Tue Apr 14 07:29:03.801346 2026] [:error] [pid 35628:tid 35646] [client 51.75.119.168:57508] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ad18P-fPm-ozGuwCWXKg-QAAAA4"]
[Tue Apr 14 07:29:06.408354 2026] [:error] [pid 35629:tid 35665] [client 51.75.119.168:57080] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ad18QjY8VahzC1YJBSiupAAAAEY"]
[Tue Apr 14 07:29:08.960531 2026] [:error] [pid 37226:tid 37233] [client 51.75.119.168:34920] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ad18RJOA5-IQ0IVmQCqq_AAAAUU"]
[Tue Apr 14 07:29:11.603310 2026] [:error] [pid 35630:tid 35693] [client 51.75.119.168:34936] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ad18Rzer0pVFxOiOauW0LAAAAIc"]
[Tue Apr 14 07:29:14.364315 2026] [:error] [pid 37226:tid 37234] [client 51.75.119.168:34948] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad18SpOA5-IQ0IVmQCqrAgAAAUY"]
[Tue Apr 14 07:29:16.917638 2026] [:error] [pid 37048:tid 37071] [client 51.75.119.168:34958] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad18TJ52Bo1OyzeXo_yAywAAARQ"]
[Tue Apr 14 07:29:19.707182 2026] [:error] [pid 37048:tid 37069] [client 51.75.119.168:58636] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad18T552Bo1OyzeXo_yAzwAAARI"]
[Tue Apr 14 07:29:22.839347 2026] [:error] [pid 37226:tid 37250] [client 51.75.119.168:58646] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad18UpOA5-IQ0IVmQCqrMAAAAVY"]
[Tue Apr 14 11:59:57.572545 2026] [:error] [pid 4902:tid 4912] [client 182.42.111.213:42040] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad27vYv8vJvl9lGy39hLMgAAAYg"]
[Tue Apr 14 12:06:11.747764 2026] [:error] [pid 35713:tid 35731] [client 49.51.196.42:35150] [client 49.51.196.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad29M66-hhx6ZepqOSky8QAAAM8"]
[Tue Apr 14 16:35:27.630457 2026] [:error] [pid 60074:tid 60088] [client 34.85.144.184:64130] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad38T-tqnEmNU9vpHCkTAAAAAMw"]
[Tue Apr 14 16:35:28.081565 2026] [:error] [pid 59987:tid 60061] [client 34.85.144.184:60415] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad38UFWpk-Tfi6_vLKrLFAAAAI4"]
[Tue Apr 14 16:35:28.516590 2026] [:error] [pid 59987:tid 60065] [client 34.85.144.184:58132] [client 34.85.144.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.85.144.184, counter = 8"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ad38UFWpk-Tfi6_vLKrLFwAAAJI"]
[Tue Apr 14 16:47:27.818945 2026] [:error] [pid 59987:tid 60056] [client 185.238.231.3:31969] [client 185.238.231.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.3, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ad3_H1Wpk-Tfi6_vLKrPGgAAAIk"]
[Tue Apr 14 16:47:27.829996 2026] [proxy_fcgi:error] [pid 59987:tid 60056] [client 185.238.231.3:31969] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 17:40:49.112546 2026] [:error] [pid 60074:tid 60082] [client 170.106.160.90:46650] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad4LoetqnEmNU9vpHClAqQAAAMY"]
[Tue Apr 14 20:50:06.653614 2026] [:error] [pid 60074:tid 60096] [client 35.227.159.195:45766] [client 35.227.159.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad43_utqnEmNU9vpHCmZtwAAANQ"]
[Tue Apr 14 21:40:12.139707 2026] [:error] [pid 59987:tid 60062] [client 65.108.125.120:50780] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad5DvFWpk-Tfi6_vLKo8GAAAAI8"]
[Tue Apr 14 21:40:14.565830 2026] [:error] [pid 3810:tid 3821] [client 65.108.125.120:20000] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad5Dvsqc5XaYZhFXVGevPQAAAYg"]
[Tue Apr 14 21:40:16.363858 2026] [:error] [pid 59985:tid 60006] [client 65.108.125.120:50790] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad5DwOgHaxkvLE6V1klobAAAAA0"]
[Tue Apr 14 21:40:18.427174 2026] [:error] [pid 3810:tid 3826] [client 65.108.125.120:41632] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad5Dwsqc5XaYZhFXVGevRwAAAY0"]
[Tue Apr 14 21:40:20.274996 2026] [:error] [pid 3778:tid 3784] [client 65.108.125.120:41648] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ad5DxBx5DfpNmYF_PaHwYQAAAUQ"]
[Tue Apr 14 21:40:22.306030 2026] [:error] [pid 3778:tid 3791] [client 65.108.125.120:41654] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ad5Dxhx5DfpNmYF_PaHwZgAAAUs"]
[Tue Apr 14 21:40:24.323875 2026] [:error] [pid 59987:tid 60053] [client 65.108.125.120:41666] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad5DyFWpk-Tfi6_vLKo8KgAAAIY"]
[Tue Apr 14 21:40:26.328920 2026] [:error] [pid 59986:tid 60033] [client 65.108.125.120:41670] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad5Dyp6axKeW6bX4H7eJFQAAAE0"]
[Tue Apr 14 21:40:28.363648 2026] [:error] [pid 59986:tid 60032] [client 65.108.125.120:2124] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad5DzJ6axKeW6bX4H7eJGwAAAEw"]
[Tue Apr 14 21:40:30.387778 2026] [:error] [pid 3810:tid 3827] [client 65.108.125.120:2138] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad5Dzsqc5XaYZhFXVGevawAAAY4"]
[Tue Apr 14 21:40:32.381801 2026] [:error] [pid 60074:tid 60090] [client 65.108.125.120:2146] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ad5D0OtqnEmNU9vpHCmtIwAAAM4"]
[Tue Apr 14 21:40:34.271512 2026] [:error] [pid 3810:tid 3828] [client 65.108.125.120:2152] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ad5D0sqc5XaYZhFXVGeveQAAAY8"]
[Tue Apr 14 21:40:36.257334 2026] [:error] [pid 22177:tid 22203] [client 65.108.125.120:2158] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ad5D1ITVeJSXHDIlEDuNMQAAARg"]
[Tue Apr 14 21:40:38.268212 2026] [:error] [pid 59985:tid 60000] [client 65.108.125.120:38962] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ad5D1ugHaxkvLE6V1kloewAAAAc"]
[Tue Apr 14 21:40:40.268164 2026] [:error] [pid 59986:tid 60032] [client 65.108.125.120:38976] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ad5D2J6axKeW6bX4H7eJPAAAAEw"]
[Tue Apr 14 21:40:42.111951 2026] [:error] [pid 3778:tid 3803] [client 65.108.125.120:38980] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ad5D2hx5DfpNmYF_PaHwegAAAVc"]
[Tue Apr 14 21:40:44.111193 2026] [:error] [pid 22177:tid 22200] [client 65.108.125.120:38994] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad5D3ITVeJSXHDIlEDuNRgAAARU"]
[Tue Apr 14 21:40:46.160690 2026] [:error] [pid 60074:tid 60080] [client 65.108.125.120:39008] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad5D3utqnEmNU9vpHCmtMgAAAMQ"]
[Tue Apr 14 21:40:48.175333 2026] [:error] [pid 22177:tid 22179] [client 65.108.125.120:1812] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad5D4ITVeJSXHDIlEDuNSQAAAQA"]
[Tue Apr 14 21:40:50.200587 2026] [:error] [pid 3810:tid 3831] [client 65.108.125.120:1822] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ad5D4sqc5XaYZhFXVGevoQAAAZI"]
[Tue Apr 14 21:40:52.095050 2026] [:error] [pid 60074:tid 60098] [client 65.108.125.120:1834] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ad5D5OtqnEmNU9vpHCmtSAAAANY"]
[Tue Apr 14 21:40:54.095967 2026] [:error] [pid 59986:tid 60029] [client 65.108.125.120:1836] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ad5D5p6axKeW6bX4H7eJXwAAAEk"]
[Tue Apr 14 21:40:56.084942 2026] [:error] [pid 59986:tid 60039] [client 65.108.125.120:1844] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad5D6J6axKeW6bX4H7eJfAAAAFM"]
[Tue Apr 14 21:40:58.662820 2026] [:error] [pid 60074:tid 60089] [client 65.108.125.120:63280] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad5D6utqnEmNU9vpHCmtUwAAAM0"]
[Tue Apr 14 21:41:00.643008 2026] [:error] [pid 59985:tid 59994] [client 65.108.125.120:55948] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ad5D7OgHaxkvLE6V1klokAAAAAE"]
[Tue Apr 14 21:41:02.638265 2026] [:error] [pid 59987:tid 60055] [client 65.108.125.120:55952] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ad5D7lWpk-Tfi6_vLKo81AAAAIg"]
[Tue Apr 14 21:41:04.499316 2026] [:error] [pid 59987:tid 60051] [client 65.108.125.120:55968] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ad5D8FWpk-Tfi6_vLKo82QAAAIQ"]
[Tue Apr 14 21:41:06.497458 2026] [:error] [pid 3810:tid 3814] [client 65.108.125.120:55970] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ad5D8sqc5XaYZhFXVGevvAAAAYE"]
[Tue Apr 14 21:41:08.524057 2026] [:error] [pid 60074:tid 60081] [client 65.108.125.120:56620] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ad5D9OtqnEmNU9vpHCmtfQAAAMU"]
[Tue Apr 14 21:41:33.263709 2026] [:error] [pid 22177:tid 22195] [client 65.108.125.120:10578] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad5EDYTVeJSXHDIlEDuNhwAAARA"]
[Tue Apr 14 21:41:35.262406 2026] [:error] [pid 59986:tid 60027] [client 65.108.125.120:10590] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad5ED56axKeW6bX4H7eKRAAAAEc"]
[Tue Apr 14 21:41:37.794212 2026] [:error] [pid 59986:tid 60041] [client 65.108.125.120:34328] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad5EEZ6axKeW6bX4H7eKVQAAAFU"]
[Tue Apr 14 21:41:39.786554 2026] [:error] [pid 59985:tid 59994] [client 65.108.125.120:30496] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad5EE-gHaxkvLE6V1kloygAAAAE"]
[Tue Apr 14 21:41:41.789814 2026] [:error] [pid 59985:tid 60009] [client 65.108.125.120:30512] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad5EFegHaxkvLE6V1klo0AAAABA"]
[Tue Apr 14 21:41:43.827581 2026] [:error] [pid 22177:tid 22195] [client 65.108.125.120:30522] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad5EF4TVeJSXHDIlEDuNlAAAARA"]
[Tue Apr 14 21:41:46.426823 2026] [:error] [pid 22177:tid 22184] [client 65.108.125.120:44324] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad5EGoTVeJSXHDIlEDuNmQAAAQU"]
[Tue Apr 14 21:41:48.386861 2026] [:error] [pid 59986:tid 60040] [client 65.108.125.120:25938] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad5EHJ6axKeW6bX4H7eKYgAAAFQ"]
[Tue Apr 14 21:41:50.545544 2026] [:error] [pid 3778:tid 3797] [client 65.108.125.120:25954] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad5EHhx5DfpNmYF_PaHw6gAAAVE"]
[Tue Apr 14 21:41:52.473177 2026] [:error] [pid 59987:tid 60051] [client 65.108.125.120:25966] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad5EIFWpk-Tfi6_vLKo9EwAAAIQ"]
[Tue Apr 14 21:41:54.507168 2026] [:error] [pid 59985:tid 60002] [client 65.108.125.120:25976] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad5EIugHaxkvLE6V1klo6AAAAAk"]
[Tue Apr 14 21:41:56.505943 2026] [:error] [pid 59986:tid 60044] [client 65.108.125.120:25982] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad5EJJ6axKeW6bX4H7eKewAAAFg"]
[Tue Apr 14 21:41:59.009039 2026] [:error] [pid 3810:tid 3837] [client 65.108.125.120:45182] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad5EJ8qc5XaYZhFXVGewRQAAAZg"]
[Tue Apr 14 21:42:00.859333 2026] [:error] [pid 3810:tid 3831] [client 65.108.125.120:40424] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad5EKMqc5XaYZhFXVGewTQAAAZI"]
[Tue Apr 14 21:42:02.737406 2026] [:error] [pid 3778:tid 3794] [client 65.108.125.120:40440] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad5EKhx5DfpNmYF_PaHw_wAAAU4"]
[Tue Apr 14 21:42:05.233759 2026] [:error] [pid 3810:tid 3836] [client 65.108.125.120:45198] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad5ELcqc5XaYZhFXVGewYgAAAZc"]
[Tue Apr 14 21:42:07.153433 2026] [:error] [pid 59985:tid 60016] [client 65.108.125.120:40450] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad5EL-gHaxkvLE6V1klo-wAAABc"]
[Tue Apr 14 21:42:09.233873 2026] [:error] [pid 3778:tid 3786] [client 65.108.125.120:24918] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad5EMRx5DfpNmYF_PaHxDAAAAUY"]
[Tue Apr 14 21:42:11.244385 2026] [:error] [pid 59986:tid 60021] [client 65.108.125.120:24930] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad5EM56axKeW6bX4H7eKrwAAAEE"]
[Tue Apr 14 21:42:13.299113 2026] [:error] [pid 60074:tid 60099] [client 65.108.125.120:24934] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad5ENetqnEmNU9vpHCmt0AAAANc"]
[Tue Apr 14 21:42:15.724287 2026] [:error] [pid 3810:tid 3815] [client 65.108.125.120:1980] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad5EN8qc5XaYZhFXVGewawAAAYI"]
[Tue Apr 14 21:42:17.725492 2026] [:error] [pid 60074:tid 60091] [client 65.108.125.120:46784] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad5EOetqnEmNU9vpHCmt2gAAAM8"]
[Tue Apr 14 21:42:27.727084 2026] [:error] [pid 3810:tid 3814] [client 65.108.125.120:58068] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad5EQ8qc5XaYZhFXVGewfQAAAYE"]
[Tue Apr 14 21:42:29.807307 2026] [:error] [pid 59986:tid 60038] [client 65.108.125.120:50826] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ad5ERZ6axKeW6bX4H7eKzQAAAFI"]
[Tue Apr 14 21:42:56.088853 2026] [:error] [pid 60074:tid 60082] [client 65.108.125.120:23340] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad5EYOtqnEmNU9vpHCmuJAAAAMY"]
[Tue Apr 14 21:42:58.121869 2026] [:error] [pid 22177:tid 22196] [client 65.108.125.120:1182] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ad5EYoTVeJSXHDIlEDuN6wAAARE"]
[Tue Apr 14 21:43:00.067531 2026] [:error] [pid 59986:tid 60031] [client 65.108.125.120:1192] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad5EZJ6axKeW6bX4H7eLIgAAAEs"]
[Tue Apr 14 21:43:02.090843 2026] [:error] [pid 3778:tid 3797] [client 65.108.125.120:1204] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad5EZhx5DfpNmYF_PaHxYwAAAVE"]
[Tue Apr 14 21:43:04.118115 2026] [:error] [pid 59986:tid 60022] [client 65.108.125.120:1212] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad5EaJ6axKeW6bX4H7eLLQAAAEI"]
[Tue Apr 14 21:43:06.676206 2026] [:error] [pid 59986:tid 60023] [client 65.108.125.120:22260] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad5Eap6axKeW6bX4H7eLQAAAAEM"]
[Tue Apr 14 21:43:08.736166 2026] [:error] [pid 3810:tid 3832] [client 65.108.125.120:19446] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad5EbMqc5XaYZhFXVGexAwAAAZM"]
[Tue Apr 14 21:43:11.261899 2026] [:error] [pid 60074:tid 60087] [client 65.108.125.120:16390] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad5Eb-tqnEmNU9vpHCmuPwAAAMs"]
[Tue Apr 14 21:43:13.256011 2026] [:error] [pid 59986:tid 60044] [client 65.108.125.120:19456] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad5EcZ6axKeW6bX4H7eLSwAAAFg"]
[Tue Apr 14 21:43:15.224597 2026] [:error] [pid 3810:tid 3827] [client 65.108.125.120:19460] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad5Ec8qc5XaYZhFXVGexDgAAAY4"]
[Tue Apr 14 21:43:17.648022 2026] [:error] [pid 22177:tid 22201] [client 65.108.125.120:16400] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad5EdYTVeJSXHDIlEDuN8wAAARY"]
[Tue Apr 14 21:43:19.654000 2026] [:error] [pid 59986:tid 60039] [client 65.108.125.120:20702] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad5Ed56axKeW6bX4H7eLTwAAAFM"]
[Tue Apr 14 21:43:21.772906 2026] [:error] [pid 22177:tid 22203] [client 65.108.125.120:20718] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad5EeYTVeJSXHDIlEDuN9gAAARg"]
[Tue Apr 14 21:43:23.819640 2026] [:error] [pid 59986:tid 60040] [client 65.108.125.120:20730] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad5Ee56axKeW6bX4H7eLXwAAAFQ"]
[Tue Apr 14 21:43:25.270568 2026] [:error] [pid 59986:tid 60029] [client 65.108.125.120:20740] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad5EfZ6axKeW6bX4H7eLZwAAAEk"]
[Tue Apr 14 21:43:29.196697 2026] [:error] [pid 59986:tid 60029] [client 65.108.125.120:5228] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad5EgZ6axKeW6bX4H7eLeAAAAEk"]
[Tue Apr 14 22:00:52.893926 2026] [:error] [pid 59986:tid 60040] [client 154.66.133.242:24082] [client 154.66.133.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.66.133.242, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ad5IlJ6axKeW6bX4H7eTbgAAAFQ"]
[Tue Apr 14 22:00:52.907838 2026] [proxy_fcgi:error] [pid 59986:tid 60040] [client 154.66.133.242:24082] AH01071: Got error 'Primary script unknown'
[Tue Apr 14 22:54:42.086472 2026] [:error] [pid 3778:tid 3801] [client 72.57.79.14:46702] [client 72.57.79.14] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=video/x-msvideo"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad5VMhx5DfpNmYF_PaEGgwAAAVU"]
[Wed Apr 15 00:28:44.162302 2026] [:error] [pid 3810:tid 3827] [client 43.130.16.140:58200] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad5rPMqc5XaYZhFXVGf7QAAAAY4"]
[Wed Apr 15 00:38:05.051146 2026] [:error] [pid 60074:tid 60078] [client 65.108.125.120:18042] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ad5tbetqnEmNU9vpHCntsgAAAMI"]
[Wed Apr 15 00:38:07.655567 2026] [:error] [pid 59986:tid 60044] [client 65.108.125.120:18072] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ad5tb56axKeW6bX4H7fwOwAAAFg"]
[Wed Apr 15 00:38:09.756817 2026] [:error] [pid 3810:tid 3834] [client 65.108.125.120:54708] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ad5tccqc5XaYZhFXVGf_9AAAAZU"]
[Wed Apr 15 00:38:12.178716 2026] [:error] [pid 3810:tid 3826] [client 65.108.125.120:23948] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ad5tdMqc5XaYZhFXVGf_-wAAAY0"]
[Wed Apr 15 00:38:14.251468 2026] [:error] [pid 3810:tid 3834] [client 65.108.125.120:54724] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ad5tdsqc5XaYZhFXVGcABgAAAZU"]
[Wed Apr 15 00:38:16.756371 2026] [:error] [pid 3810:tid 3830] [client 65.108.125.120:23956] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ad5teMqc5XaYZhFXVGcADwAAAZE"]
[Wed Apr 15 00:38:19.210516 2026] [:error] [pid 3810:tid 3818] [client 65.108.125.120:7130] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ad5te8qc5XaYZhFXVGcAFgAAAYU"]
[Wed Apr 15 00:38:21.111632 2026] [:error] [pid 3810:tid 3815] [client 65.108.125.120:48224] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ad5tfcqc5XaYZhFXVGcAGgAAAYI"]
[Wed Apr 15 00:38:23.642462 2026] [:error] [pid 3810:tid 3835] [client 65.108.125.120:7132] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ad5tf8qc5XaYZhFXVGcAHwAAAZY"]
[Wed Apr 15 00:38:25.698434 2026] [:error] [pid 22177:tid 22200] [client 65.108.125.120:48232] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ad5tgYTVeJSXHDIlEDuySwAAARU"]
[Wed Apr 15 00:38:28.216649 2026] [:error] [pid 22177:tid 22186] [client 65.108.125.120:19280] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ad5thITVeJSXHDIlEDuyTAAAAQc"]
[Wed Apr 15 00:38:30.838201 2026] [:error] [pid 59986:tid 60033] [client 65.108.125.120:19286] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ad5thp6axKeW6bX4H7fwVgAAAE0"]
[Wed Apr 15 00:38:32.923892 2026] [:error] [pid 59986:tid 60040] [client 65.108.125.120:20550] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ad5tiJ6axKeW6bX4H7fwXQAAAFQ"]
[Wed Apr 15 00:38:35.473247 2026] [:error] [pid 59987:tid 60054] [client 65.108.125.120:19302] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ad5ti1Wpk-Tfi6_vLKpm_gAAAIc"]
[Wed Apr 15 00:38:37.440532 2026] [:error] [pid 3778:tid 3786] [client 65.108.125.120:20560] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ad5tjRx5DfpNmYF_PaEkaQAAAUY"]
[Wed Apr 15 00:38:39.810735 2026] [:error] [pid 59986:tid 60023] [client 65.108.125.120:9866] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ad5tj56axKeW6bX4H7fwZQAAAEM"]
[Wed Apr 15 00:38:41.583567 2026] [:error] [pid 59986:tid 60043] [client 65.108.125.120:46488] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ad5tkZ6axKeW6bX4H7fwZgAAAFc"]
[Wed Apr 15 00:38:44.088862 2026] [:error] [pid 59986:tid 60033] [client 65.108.125.120:9868] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ad5tlJ6axKeW6bX4H7fwagAAAE0"]
[Wed Apr 15 00:38:46.203765 2026] [:error] [pid 3810:tid 3828] [client 65.108.125.120:46492] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ad5tlsqc5XaYZhFXVGcAOQAAAY8"]
[Wed Apr 15 00:38:48.711266 2026] [:error] [pid 3810:tid 3825] [client 65.108.125.120:12632] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ad5tmMqc5XaYZhFXVGcARQAAAYw"]
[Wed Apr 15 00:38:51.159359 2026] [:error] [pid 3810:tid 3815] [client 65.108.125.120:12648] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad5tm8qc5XaYZhFXVGcAUAAAAYI"]
[Wed Apr 15 00:38:53.201378 2026] [:error] [pid 59986:tid 60032] [client 65.108.125.120:36754] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ad5tnZ6axKeW6bX4H7fwfgAAAEw"]
[Wed Apr 15 00:38:55.706095 2026] [:error] [pid 59987:tid 60047] [client 65.108.125.120:12664] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad5tn1Wpk-Tfi6_vLKpnAAAAAIA"]
[Wed Apr 15 00:38:57.607615 2026] [:error] [pid 59987:tid 60058] [client 65.108.125.120:48244] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ad5toVWpk-Tfi6_vLKpnBAAAAIs"]
[Wed Apr 15 00:39:00.155152 2026] [:error] [pid 22177:tid 22181] [client 65.108.125.120:12526] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ad5tpITVeJSXHDIlEDuyXgAAAQI"]
[Wed Apr 15 00:39:28.100630 2026] [:error] [pid 59986:tid 60044] [client 65.108.125.120:16050] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "ad5twJ6axKeW6bX4H7fwtwAAAFg"]
[Wed Apr 15 00:39:30.725697 2026] [:error] [pid 22177:tid 22179] [client 65.108.125.120:16056] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad5twoTVeJSXHDIlEDuyeAAAAQA"]
[Wed Apr 15 00:39:33.199846 2026] [:error] [pid 3810:tid 3816] [client 65.108.125.120:16068] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad5txcqc5XaYZhFXVGcAYgAAAYM"]
[Wed Apr 15 00:39:35.720551 2026] [:error] [pid 3810:tid 3828] [client 65.108.125.120:16080] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad5tx8qc5XaYZhFXVGcAbAAAAY8"]
[Wed Apr 15 00:39:38.039916 2026] [:error] [pid 59987:tid 60053] [client 65.108.125.120:16086] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad5tylWpk-Tfi6_vLKpnHQAAAIY"]
[Wed Apr 15 00:39:40.002744 2026] [:error] [pid 59985:tid 60010] [client 65.108.125.120:60604] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ad5tzOgHaxkvLE6V1kmJwQAAABE"]
[Wed Apr 15 00:39:42.556084 2026] [:error] [pid 59987:tid 60049] [client 65.108.125.120:2468] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ad5tzlWpk-Tfi6_vLKpnIgAAAII"]
[Wed Apr 15 00:39:44.540606 2026] [:error] [pid 3810:tid 3831] [client 65.108.125.120:60618] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ad5t0Mqc5XaYZhFXVGcAdgAAAZI"]
[Wed Apr 15 00:39:47.108305 2026] [:error] [pid 60074:tid 60087] [client 65.108.125.120:2478] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ad5t0-tqnEmNU9vpHCnufwAAAMs"]
[Wed Apr 15 00:39:49.628790 2026] [:error] [pid 3810:tid 3835] [client 65.108.125.120:28536] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ad5t1cqc5XaYZhFXVGcAewAAAZY"]
[Wed Apr 15 00:39:51.968844 2026] [:error] [pid 59987:tid 60068] [client 65.108.125.120:28540] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ad5t11Wpk-Tfi6_vLKpnLgAAAJU"]
[Wed Apr 15 00:39:53.979440 2026] [:error] [pid 59987:tid 60056] [client 65.108.125.120:60514] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ad5t2VWpk-Tfi6_vLKpnMQAAAIk"]
[Wed Apr 15 00:39:56.435410 2026] [:error] [pid 59986:tid 60030] [client 65.108.125.120:28556] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ad5t3J6axKeW6bX4H7fwzQAAAEo"]
[Wed Apr 15 00:39:58.376118 2026] [:error] [pid 3810:tid 3824] [client 65.108.125.120:53396] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ad5t3sqc5XaYZhFXVGcAggAAAYs"]
[Wed Apr 15 00:40:00.924938 2026] [:error] [pid 59986:tid 60021] [client 65.108.125.120:64012] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ad5t4J6axKeW6bX4H7fw2AAAAEE"]
[Wed Apr 15 00:40:02.991726 2026] [:error] [pid 59987:tid 60071] [client 65.108.125.120:53398] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ad5t4lWpk-Tfi6_vLKpnOQAAAJg"]
[Wed Apr 15 00:40:05.521815 2026] [:error] [pid 3810:tid 3816] [client 65.108.125.120:64024] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ad5t5cqc5XaYZhFXVGcAmAAAAYM"]
[Wed Apr 15 00:40:07.990133 2026] [:error] [pid 59986:tid 60043] [client 65.108.125.120:64036] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ad5t556axKeW6bX4H7fw3AAAAFc"]
[Wed Apr 15 00:40:10.589941 2026] [:error] [pid 60074:tid 60098] [client 65.108.125.120:1968] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ad5t6utqnEmNU9vpHCnukwAAANY"]
[Wed Apr 15 00:40:12.534564 2026] [:error] [pid 3810:tid 3815] [client 65.108.125.120:29988] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ad5t7Mqc5XaYZhFXVGcAogAAAYI"]
[Wed Apr 15 00:40:14.386561 2026] [:error] [pid 60074:tid 60081] [client 65.108.125.120:29990] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ad5t7utqnEmNU9vpHCnumQAAAMU"]
[Wed Apr 15 00:40:16.435611 2026] [:error] [pid 3810:tid 3823] [client 65.108.125.120:30000] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ad5t8Mqc5XaYZhFXVGcArwAAAYo"]
[Wed Apr 15 00:40:18.453133 2026] [:error] [pid 59986:tid 60021] [client 65.108.125.120:31446] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ad5t8p6axKeW6bX4H7fw6AAAAEE"]
[Wed Apr 15 00:40:20.333339 2026] [:error] [pid 59985:tid 59994] [client 65.108.125.120:31460] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ad5t9OgHaxkvLE6V1kmJyAAAAAE"]
[Wed Apr 15 00:40:22.362155 2026] [:error] [pid 22177:tid 22188] [client 65.108.125.120:31472] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ad5t9oTVeJSXHDIlEDuykwAAAQk"]
[Wed Apr 15 00:40:24.937094 2026] [:error] [pid 3810:tid 3814] [client 65.108.125.120:56360] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ad5t-Mqc5XaYZhFXVGcAvAAAAYE"]
[Wed Apr 15 00:40:50.709480 2026] [:error] [pid 3810:tid 3832] [client 65.108.125.120:17428] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ad5uEsqc5XaYZhFXVGcA2wAAAZM"]
[Wed Apr 15 00:40:52.727612 2026] [:error] [pid 60074:tid 60085] [client 65.108.125.120:17438] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ad5uFOtqnEmNU9vpHCnuuQAAAMk"]
[Wed Apr 15 00:40:54.721553 2026] [:error] [pid 3810:tid 3837] [client 65.108.125.120:17452] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ad5uFsqc5XaYZhFXVGcA4AAAAZg"]
[Wed Apr 15 00:40:57.281839 2026] [:error] [pid 60074:tid 60078] [client 65.108.125.120:40030] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ad5uGetqnEmNU9vpHCnuwAAAAMI"]
[Wed Apr 15 00:40:59.898632 2026] [:error] [pid 22177:tid 22201] [client 65.108.125.120:59708] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad5uG4TVeJSXHDIlEDuyoQAAARY"]
[Wed Apr 15 00:41:02.382004 2026] [:error] [pid 60074:tid 60083] [client 65.108.125.120:59714] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad5uHutqnEmNU9vpHCnuxwAAAMc"]
[Wed Apr 15 00:41:04.735124 2026] [:error] [pid 3810:tid 3826] [client 65.108.125.120:59730] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad5uIMqc5XaYZhFXVGcA7QAAAY0"]
[Wed Apr 15 00:41:07.377375 2026] [:error] [pid 3778:tid 3783] [client 65.108.125.120:59742] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad5uIxx5DfpNmYF_PaEk1wAAAUM"]
[Wed Apr 15 00:41:09.849168 2026] [:error] [pid 59987:tid 60064] [client 65.108.125.120:2022] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad5uJVWpk-Tfi6_vLKpnWwAAAJE"]
[Wed Apr 15 00:41:12.465441 2026] [:error] [pid 22177:tid 22203] [client 65.108.125.120:2030] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad5uKITVeJSXHDIlEDuypAAAARg"]
[Wed Apr 15 00:41:14.770710 2026] [:error] [pid 59987:tid 60065] [client 65.108.125.120:2036] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad5uKlWpk-Tfi6_vLKpnYgAAAJI"]
[Wed Apr 15 00:41:17.329842 2026] [:error] [pid 59987:tid 60052] [client 65.108.125.120:2050] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ad5uLVWpk-Tfi6_vLKpnZwAAAIU"]
[Wed Apr 15 00:41:19.830916 2026] [:error] [pid 59986:tid 60028] [client 65.108.125.120:19466] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ad5uL56axKeW6bX4H7fxPAAAAEg"]
[Wed Apr 15 00:41:22.332689 2026] [:error] [pid 59986:tid 60040] [client 65.108.125.120:19476] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ad5uMp6axKeW6bX4H7fxPgAAAFQ"]
[Wed Apr 15 00:41:24.853110 2026] [:error] [pid 59986:tid 60035] [client 65.108.125.120:19480] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ad5uNJ6axKeW6bX4H7fxQwAAAE8"]
[Wed Apr 15 00:41:27.185710 2026] [:error] [pid 59987:tid 60065] [client 65.108.125.120:19494] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad5uN1Wpk-Tfi6_vLKpnagAAAJI"]
[Wed Apr 15 00:41:29.491691 2026] [:error] [pid 60074:tid 60097] [client 65.108.125.120:16670] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ad5uOetqnEmNU9vpHCnu4AAAANU"]
[Wed Apr 15 00:41:31.976265 2026] [:error] [pid 60074:tid 60096] [client 65.108.125.120:16676] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad5uO-tqnEmNU9vpHCnu4wAAANQ"]
[Wed Apr 15 00:41:34.583290 2026] [:error] [pid 22177:tid 22200] [client 65.108.125.120:16678] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad5uPoTVeJSXHDIlEDuyrAAAARU"]
[Wed Apr 15 00:41:37.193736 2026] [:error] [pid 59986:tid 60022] [client 65.108.125.120:16686] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad5uQZ6axKeW6bX4H7fxSgAAAEI"]
[Wed Apr 15 00:41:39.791246 2026] [:error] [pid 59987:tid 60055] [client 65.108.125.120:62880] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad5uQ1Wpk-Tfi6_vLKpncwAAAIg"]
[Wed Apr 15 00:41:42.277833 2026] [:error] [pid 59986:tid 60027] [client 65.108.125.120:62896] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad5uRp6axKeW6bX4H7fxUQAAAEc"]
[Wed Apr 15 00:41:44.755499 2026] [:error] [pid 59986:tid 60030] [client 65.108.125.120:62912] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad5uSJ6axKeW6bX4H7fxXAAAAEo"]
[Wed Apr 15 00:41:45.809199 2026] [:error] [pid 3778:tid 3783] [client 65.108.125.120:31770] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad5uSRx5DfpNmYF_PaEk-AAAAUM"]
[Wed Apr 15 00:42:11.422310 2026] [:error] [pid 59986:tid 60035] [client 65.108.125.120:31872] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ad5uY56axKeW6bX4H7fxmwAAAE8"]
[Wed Apr 15 00:42:13.419038 2026] [:error] [pid 22177:tid 22191] [client 65.108.125.120:31882] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ad5uZYTVeJSXHDIlEDuyxAAAAQw"]
[Wed Apr 15 00:42:15.432174 2026] [:error] [pid 59985:tid 59994] [client 65.108.125.120:31892] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ad5uZ-gHaxkvLE6V1kmJ-gAAAAE"]
[Wed Apr 15 00:42:17.446967 2026] [:error] [pid 60074:tid 60080] [client 65.108.125.120:31894] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ad5uaetqnEmNU9vpHCnu_QAAAMQ"]
[Wed Apr 15 00:42:19.350026 2026] [:error] [pid 59986:tid 60030] [client 65.108.125.120:38506] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ad5ua56axKeW6bX4H7fxpwAAAEo"]
[Wed Apr 15 00:42:21.345712 2026] [:error] [pid 3778:tid 3797] [client 65.108.125.120:38518] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ad5ubRx5DfpNmYF_PaElEgAAAVE"]
[Wed Apr 15 00:42:23.254406 2026] [:error] [pid 59987:tid 60054] [client 65.108.125.120:38522] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ad5ub1Wpk-Tfi6_vLKpnhgAAAIc"]
[Wed Apr 15 00:42:25.270894 2026] [:error] [pid 3810:tid 3835] [client 65.108.125.120:38534] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ad5uccqc5XaYZhFXVGcBQgAAAZY"]
[Wed Apr 15 00:42:27.170870 2026] [:error] [pid 3810:tid 3836] [client 65.108.125.120:38542] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ad5uc8qc5XaYZhFXVGcBRQAAAZc"]
[Wed Apr 15 00:42:29.190967 2026] [:error] [pid 59985:tid 60013] [client 65.108.125.120:61478] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ad5udegHaxkvLE6V1kmJ_wAAABQ"]
[Wed Apr 15 00:42:31.215313 2026] [:error] [pid 59985:tid 60009] [client 65.108.125.120:61492] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ad5ud-gHaxkvLE6V1kmKAAAAABA"]
[Wed Apr 15 00:42:33.114949 2026] [:error] [pid 3810:tid 3828] [client 65.108.125.120:61500] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ad5uecqc5XaYZhFXVGcBSQAAAY8"]
[Wed Apr 15 00:42:35.125979 2026] [:error] [pid 3810:tid 3830] [client 65.108.125.120:61512] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ad5ue8qc5XaYZhFXVGcBTgAAAZE"]
[Wed Apr 15 00:42:37.148755 2026] [:error] [pid 60074:tid 60095] [client 65.108.125.120:61522] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ad5ufetqnEmNU9vpHCnvGQAAANM"]
[Wed Apr 15 00:42:39.179539 2026] [:error] [pid 60074:tid 60087] [client 65.108.125.120:23602] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ad5uf-tqnEmNU9vpHCnvHgAAAMs"]
[Wed Apr 15 00:42:41.174199 2026] [:error] [pid 59987:tid 60069] [client 65.108.125.120:23618] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ad5ugVWpk-Tfi6_vLKpniwAAAJY"]
[Wed Apr 15 00:42:43.225685 2026] [:error] [pid 3778:tid 3787] [client 65.108.125.120:23632] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ad5ugxx5DfpNmYF_PaElKwAAAUc"]
[Wed Apr 15 00:42:45.284949 2026] [:error] [pid 3778:tid 3802] [client 65.108.125.120:23634] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ad5uhRx5DfpNmYF_PaElLQAAAVY"]
[Wed Apr 15 00:42:47.322407 2026] [:error] [pid 59986:tid 60043] [client 65.108.125.120:23640] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ad5uh56axKeW6bX4H7fx0wAAAFc"]
[Wed Apr 15 00:42:49.369455 2026] [:error] [pid 60074:tid 60095] [client 65.108.125.120:37712] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ad5uietqnEmNU9vpHCnvMAAAANM"]
[Wed Apr 15 00:42:51.368018 2026] [:error] [pid 60074:tid 60099] [client 65.108.125.120:37716] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ad5ui-tqnEmNU9vpHCnvMwAAANc"]
[Wed Apr 15 00:42:53.373707 2026] [:error] [pid 22177:tid 22197] [client 65.108.125.120:37732] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad5ujYTVeJSXHDIlEDuy7AAAARI"]
[Wed Apr 15 00:42:55.447019 2026] [:error] [pid 60074:tid 60086] [client 65.108.125.120:37734] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad5uj-tqnEmNU9vpHCnvQAAAAMo"]
[Wed Apr 15 00:42:57.455847 2026] [:error] [pid 59986:tid 60038] [client 65.108.125.120:37746] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad5ukZ6axKeW6bX4H7fx7AAAAFI"]
[Wed Apr 15 00:42:59.496043 2026] [:error] [pid 59987:tid 60054] [client 65.108.125.120:55788] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad5uk1Wpk-Tfi6_vLKpnogAAAIc"]
[Wed Apr 15 00:43:01.513550 2026] [:error] [pid 59987:tid 60060] [client 65.108.125.120:55800] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad5ulVWpk-Tfi6_vLKpnrAAAAI0"]
[Wed Apr 15 00:43:03.512997 2026] [:error] [pid 59986:tid 60035] [client 65.108.125.120:55810] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad5ul56axKeW6bX4H7fyAgAAAE8"]
[Wed Apr 15 00:43:05.387071 2026] [:error] [pid 59986:tid 60037] [client 65.108.125.120:55824] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad5umZ6axKeW6bX4H7fyBgAAAFE"]
[Wed Apr 15 00:43:07.280292 2026] [:error] [pid 59986:tid 60026] [client 65.108.125.120:55826] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad5um56axKeW6bX4H7fyDAAAAEY"]
[Wed Apr 15 00:43:31.148089 2026] [:error] [pid 3810:tid 3822] [client 65.108.125.120:47604] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ad5us8qc5XaYZhFXVGcBlAAAAYk"]
[Wed Apr 15 00:43:33.182832 2026] [:error] [pid 59987:tid 60051] [client 65.108.125.120:47606] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad5utVWpk-Tfi6_vLKpn1QAAAIQ"]
[Wed Apr 15 00:43:35.175928 2026] [:error] [pid 59986:tid 60020] [client 65.108.125.120:47622] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad5ut56axKeW6bX4H7fyOgAAAEA"]
[Wed Apr 15 00:43:37.156909 2026] [:error] [pid 59986:tid 60029] [client 65.108.125.120:47636] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad5uuZ6axKeW6bX4H7fyQgAAAEk"]
[Wed Apr 15 00:43:39.144177 2026] [:error] [pid 3778:tid 3789] [client 65.108.125.120:16408] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad5uuxx5DfpNmYF_PaElZwAAAUk"]
[Wed Apr 15 01:47:38.393159 2026] [:error] [pid 62297:tid 62363] [client 43.166.142.76:51456] [client 43.166.142.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad59uqvogcWlrafOEaHR_AAAAQk"]
[Wed Apr 15 01:47:55.460029 2026] [:error] [pid 17866:tid 17870] [client 149.22.83.21:35556] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ad59y7x_17kv70EUVIlLywAAAYI"]
[Wed Apr 15 01:47:58.375158 2026] [:error] [pid 62296:tid 62346] [client 149.22.83.21:52134] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad59zsTNd04nWM2DK4SQcQAAAFM"]
[Wed Apr 15 01:48:01.223692 2026] [:error] [pid 17804:tid 17822] [client 149.22.83.21:52140] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad590QAZKYxfpamecKeEOQAAAMw"]
[Wed Apr 15 01:48:04.223758 2026] [:error] [pid 62297:tid 62374] [client 149.22.83.21:52154] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad591KvogcWlrafOEaHSBQAAARQ"]
[Wed Apr 15 01:48:07.130845 2026] [:error] [pid 17734:tid 17749] [client 149.22.83.21:44554] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ad5919N3xsztF3DFLWwNzgAAAIo"]
[Wed Apr 15 01:48:10.084368 2026] [:error] [pid 17926:tid 17955] [client 149.22.83.21:44556] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ad592vKxFvgDwMI04zBbVQAAAdY"]
[Wed Apr 15 01:48:12.823934 2026] [:error] [pid 62295:tid 62306] [client 149.22.83.21:44568] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ad593Bng-JDNFCa0BniGqAAAAAc"]
[Wed Apr 15 01:48:15.626754 2026] [:error] [pid 62296:tid 62341] [client 149.22.83.21:44584] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ad5938TNd04nWM2DK4SQjgAAAE4"]
[Wed Apr 15 01:48:18.387681 2026] [:error] [pid 62295:tid 62321] [client 149.22.83.21:38226] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ad594hng-JDNFCa0BniGsgAAABY"]
[Wed Apr 15 01:48:21.366319 2026] [:error] [pid 62432:tid 62450] [client 149.22.83.21:38230] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ad595bPtNET7V_vfTPfc3QAAAU8"]
[Wed Apr 15 01:48:24.156823 2026] [:error] [pid 17734:tid 17759] [client 149.22.83.21:38232] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ad596NN3xsztF3DFLWwN3QAAAJQ"]
[Wed Apr 15 01:48:26.928336 2026] [:error] [pid 62297:tid 62366] [client 149.22.83.21:40566] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ad596qvogcWlrafOEaHSKAAAAQw"]
[Wed Apr 15 01:48:29.897707 2026] [:error] [pid 62297:tid 62372] [client 149.22.83.21:40568] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ad597avogcWlrafOEaHSKgAAARI"]
[Wed Apr 15 01:48:32.749085 2026] [:error] [pid 62297:tid 62369] [client 149.22.83.21:40574] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ad598KvogcWlrafOEaHSLQAAAQ8"]
[Wed Apr 15 01:48:35.565896 2026] [:error] [pid 17866:tid 17875] [client 149.22.83.21:40582] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ad5987x_17kv70EUVIlL2AAAAYc"]
[Wed Apr 15 01:48:38.337865 2026] [:error] [pid 62297:tid 62363] [client 149.22.83.21:55254] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ad599qvogcWlrafOEaHSOAAAAQk"]
[Wed Apr 15 01:48:41.111540 2026] [:error] [pid 62297:tid 62364] [client 149.22.83.21:55260] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ad59-avogcWlrafOEaHSPQAAAQo"]
[Wed Apr 15 01:48:44.064585 2026] [:error] [pid 62432:tid 62435] [client 149.22.83.21:55276] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ad59_LPtNET7V_vfTPfc4QAAAUA"]
[Wed Apr 15 01:48:46.809053 2026] [:error] [pid 62295:tid 62300] [client 149.22.83.21:35402] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ad59_hng-JDNFCa0BniGxQAAAAE"]
[Wed Apr 15 01:48:49.714584 2026] [:error] [pid 62297:tid 62365] [client 149.22.83.21:35414] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ad5-AavogcWlrafOEaHSSwAAAQs"]
[Wed Apr 15 01:48:52.745766 2026] [:error] [pid 62296:tid 62350] [client 149.22.83.21:35418] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ad5-BMTNd04nWM2DK4SQmAAAAFc"]
[Wed Apr 15 01:49:16.474721 2026] [:error] [pid 17804:tid 17834] [client 149.22.83.21:35422] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad5-HAAZKYxfpamecKeEVwAAANg"]
[Wed Apr 15 01:49:19.355214 2026] [:error] [pid 62296:tid 62342] [client 149.22.83.21:58698] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad5-H8TNd04nWM2DK4SQwQAAAE8"]
[Wed Apr 15 01:49:22.145854 2026] [:error] [pid 62295:tid 62317] [client 149.22.83.21:58712] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad5-Ihng-JDNFCa0BniG5AAAABI"]
[Wed Apr 15 01:49:24.949474 2026] [:error] [pid 62297:tid 62361] [client 149.22.83.21:58722] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad5-JKvogcWlrafOEaHSZgAAAQc"]
[Wed Apr 15 02:12:01.419476 2026] [:error] [pid 62296:tid 62341] [client 216.81.248.211:46626] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "ad6DccTNd04nWM2DK4SaDQAAAE4"]
[Wed Apr 15 08:19:10.503646 2026] [:error] [pid 30644:tid 30650] [client 43.134.28.2:44402] [client 43.134.28.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad7Zfq8vuyJ0N41zsM_jfQAAAMA"]
[Wed Apr 15 09:42:26.586589 2026] [:error] [pid 51186:tid 51210] [client 49.51.233.46:33530] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad7tAlfx1CjK_ZPfY1ROqgAAAVY"]
[Wed Apr 15 13:50:26.575790 2026] [:error] [pid 12396:tid 12417] [client 125.75.66.97:43939] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad8nIsCQWGYUWgxc5kjVTAAAAJM"]
[Wed Apr 15 15:55:41.909763 2026] [:error] [pid 11475:tid 11492] [client 212.227.21.19:55128] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad9EfZ7upE98bj816HPIawAAAU8"]
[Wed Apr 15 15:55:44.447600 2026] [:error] [pid 11385:tid 11447] [client 212.227.21.19:63946] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ad9EgB_mZoXMMCiUoKU-QwAAAME"]
[Wed Apr 15 15:55:46.443176 2026] [:error] [pid 11384:tid 11436] [client 212.227.21.19:55134] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad9EgnOhpt4MrQIXF7CPPwAAAE4"]
[Wed Apr 15 15:55:48.479024 2026] [:error] [pid 11385:tid 11452] [client 212.227.21.19:31388] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad9EhB_mZoXMMCiUoKU-SQAAAMQ"]
[Wed Apr 15 15:55:50.497841 2026] [:error] [pid 11475:tid 11495] [client 212.227.21.19:31390] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ad9Ehp7upE98bj816HPIdAAAAVI"]
[Wed Apr 15 15:55:52.502864 2026] [:error] [pid 12433:tid 12441] [client 212.227.21.19:31396] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ad9EiLwxDHWF005pP_6s-QAAAQY"]
[Wed Apr 15 15:55:54.504593 2026] [:error] [pid 12396:tid 12404] [client 212.227.21.19:31400] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad9EisCQWGYUWgxc5kjyHwAAAIY"]
[Wed Apr 15 15:55:56.331085 2026] [:error] [pid 11475:tid 11496] [client 212.227.21.19:31404] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad9EjJ7upE98bj816HPIeAAAAVM"]
[Wed Apr 15 15:55:58.342147 2026] [:error] [pid 12396:tid 12416] [client 212.227.21.19:13994] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad9EjsCQWGYUWgxc5kjyJAAAAJI"]
[Wed Apr 15 15:56:00.365541 2026] [:error] [pid 12396:tid 12414] [client 212.227.21.19:14006] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad9EkMCQWGYUWgxc5kjyKAAAAJA"]
[Wed Apr 15 15:56:02.355345 2026] [:error] [pid 12396:tid 12412] [client 212.227.21.19:14012] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ad9EksCQWGYUWgxc5kjyKQAAAI4"]
[Wed Apr 15 15:56:04.400593 2026] [:error] [pid 12433:tid 12453] [client 212.227.21.19:14026] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ad9ElLwxDHWF005pP_6tCAAAARI"]
[Wed Apr 15 15:56:06.415630 2026] [:error] [pid 11475:tid 11492] [client 212.227.21.19:14034] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ad9Elp7upE98bj816HPIhAAAAU8"]
[Wed Apr 15 15:56:08.296666 2026] [:error] [pid 11384:tid 11423] [client 212.227.21.19:55638] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ad9EmHOhpt4MrQIXF7CPTAAAAEE"]
[Wed Apr 15 15:56:10.301748 2026] [:error] [pid 12396:tid 12418] [client 212.227.21.19:55650] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ad9EmsCQWGYUWgxc5kjyNwAAAJQ"]
[Wed Apr 15 15:56:12.325355 2026] [:error] [pid 12433:tid 12439] [client 212.227.21.19:55652] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ad9EnLwxDHWF005pP_6tCwAAAQQ"]
[Wed Apr 15 15:56:14.256302 2026] [:error] [pid 12433:tid 12451] [client 212.227.21.19:55658] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad9EnrwxDHWF005pP_6tDQAAARA"]
[Wed Apr 15 15:56:16.254054 2026] [:error] [pid 11384:tid 11426] [client 212.227.21.19:55664] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad9EoHOhpt4MrQIXF7CPYAAAAEQ"]
[Wed Apr 15 15:56:18.111744 2026] [:error] [pid 11384:tid 11428] [client 212.227.21.19:37034] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad9EonOhpt4MrQIXF7CPZQAAAEY"]
[Wed Apr 15 15:56:20.112796 2026] [:error] [pid 11475:tid 11499] [client 212.227.21.19:37044] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ad9EpJ7upE98bj816HPIiQAAAVY"]
[Wed Apr 15 15:56:22.140571 2026] [:error] [pid 11384:tid 11422] [client 212.227.21.19:37058] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ad9EpnOhpt4MrQIXF7CPawAAAEA"]
[Wed Apr 15 15:56:24.021667 2026] [:error] [pid 11384:tid 11440] [client 212.227.21.19:37066] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ad9EqHOhpt4MrQIXF7CPbwAAAFI"]
[Wed Apr 15 15:56:26.037224 2026] [:error] [pid 12433:tid 12437] [client 212.227.21.19:37078] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad9EqrwxDHWF005pP_6tEQAAAQI"]
[Wed Apr 15 15:56:28.564786 2026] [:error] [pid 11475:tid 11491] [client 212.227.21.19:48972] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ad9ErJ7upE98bj816HPIiwAAAU4"]
[Wed Apr 15 15:56:30.548189 2026] [:error] [pid 11475:tid 11483] [client 212.227.21.19:60968] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ad9Erp7upE98bj816HPIjAAAAUY"]
[Wed Apr 15 15:56:32.388597 2026] [:error] [pid 11384:tid 11444] [client 212.227.21.19:60980] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ad9EsHOhpt4MrQIXF7CPfAAAAFY"]
[Wed Apr 15 15:56:34.281857 2026] [:error] [pid 11384:tid 11426] [client 212.227.21.19:60986] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ad9EsnOhpt4MrQIXF7CPgQAAAEQ"]
[Wed Apr 15 15:56:36.326532 2026] [:error] [pid 12433:tid 12451] [client 212.227.21.19:60998] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ad9EtLwxDHWF005pP_6tFAAAARA"]
[Wed Apr 15 15:56:38.203447 2026] [:error] [pid 11475:tid 11485] [client 212.227.21.19:10860] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ad9Etp7upE98bj816HPIjwAAAUg"]
[Wed Apr 15 15:57:02.853854 2026] [:error] [pid 11384:tid 11422] [client 212.227.21.19:39634] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ad9EznOhpt4MrQIXF7CPsQAAAEA"]
[Wed Apr 15 15:57:04.856384 2026] [:error] [pid 11384:tid 11433] [client 212.227.21.19:39650] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad9E0HOhpt4MrQIXF7CPtAAAAEs"]
[Wed Apr 15 15:57:07.350773 2026] [:error] [pid 11383:tid 11401] [client 212.227.21.19:45294] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ad9E0zOMRk2pAgm2-j7GOwAAAAY"]
[Wed Apr 15 15:57:09.179122 2026] [:error] [pid 12433:tid 12451] [client 212.227.21.19:33658] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad9E1bwxDHWF005pP_6tVwAAARA"]
[Wed Apr 15 15:57:11.166338 2026] [:error] [pid 11385:tid 11470] [client 212.227.21.19:33662] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad9E1x_mZoXMMCiUoKU-xwAAANU"]
[Wed Apr 15 15:57:20.354687 2026] [:error] [pid 11385:tid 11455] [client 212.227.21.19:2452] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad9E4B_mZoXMMCiUoKU-zgAAAMY"]
[Wed Apr 15 15:57:22.824839 2026] [:error] [pid 11384:tid 11449] [client 212.227.21.19:26476] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ad9E4nOhpt4MrQIXF7CPxAAAAFc"]
[Wed Apr 15 15:57:24.800691 2026] [:error] [pid 11385:tid 11459] [client 212.227.21.19:2462] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad9E5B_mZoXMMCiUoKU-1gAAAMo"]
[Wed Apr 15 15:57:26.806340 2026] [:error] [pid 11385:tid 11472] [client 212.227.21.19:2476] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ad9E5h_mZoXMMCiUoKU-1wAAANc"]
[Wed Apr 15 15:57:28.768644 2026] [:error] [pid 12433:tid 12453] [client 212.227.21.19:6470] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ad9E6LwxDHWF005pP_6tagAAARI"]
[Wed Apr 15 15:57:30.743635 2026] [:error] [pid 11385:tid 11463] [client 212.227.21.19:6472] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad9E6h_mZoXMMCiUoKU-2gAAAM4"]
[Wed Apr 15 15:57:32.728265 2026] [:error] [pid 11385:tid 11458] [client 212.227.21.19:6480] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad9E7B_mZoXMMCiUoKU-3wAAAMk"]
[Wed Apr 15 15:57:35.254095 2026] [:error] [pid 11475:tid 11493] [client 212.227.21.19:46770] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ad9E757upE98bj816HPIpwAAAVA"]
[Wed Apr 15 15:57:37.050364 2026] [:error] [pid 11475:tid 11480] [client 212.227.21.19:6494] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad9E8Z7upE98bj816HPIqwAAAUM"]
[Wed Apr 15 15:57:39.025903 2026] [:error] [pid 11384:tid 11441] [client 212.227.21.19:58088] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad9E83Ohpt4MrQIXF7CPzgAAAFM"]
[Wed Apr 15 15:57:41.385385 2026] [:error] [pid 11384:tid 11435] [client 212.227.21.19:25206] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ad9E9XOhpt4MrQIXF7CP1gAAAE0"]
[Wed Apr 15 15:57:43.308063 2026] [:error] [pid 11383:tid 11403] [client 212.227.21.19:58092] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad9E9zOMRk2pAgm2-j7GawAAAAg"]
[Wed Apr 15 15:57:45.335418 2026] [:error] [pid 12433:tid 12440] [client 212.227.21.19:58098] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad9E-bwxDHWF005pP_6tbQAAAQU"]
[Wed Apr 15 15:57:47.204836 2026] [:error] [pid 12433:tid 12451] [client 212.227.21.19:58106] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad9E-7wxDHWF005pP_6tcAAAARA"]
[Wed Apr 15 15:57:49.198805 2026] [:error] [pid 11384:tid 11444] [client 212.227.21.19:20502] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad9E_XOhpt4MrQIXF7CP6wAAAFY"]
[Wed Apr 15 15:57:51.713370 2026] [:error] [pid 11475:tid 11491] [client 212.227.21.19:46770] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ad9E_57upE98bj816HPItQAAAU4"]
[Wed Apr 15 15:57:53.631394 2026] [:error] [pid 11385:tid 11457] [client 212.227.21.19:20512] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad9FAR_mZoXMMCiUoKU-6QAAAMg"]
[Wed Apr 15 15:57:55.982463 2026] [:error] [pid 11383:tid 11415] [client 212.227.21.19:46776] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ad9FAzOMRk2pAgm2-j7GcwAAABQ"]
[Wed Apr 15 15:57:57.904704 2026] [:error] [pid 11385:tid 11461] [client 212.227.21.19:34564] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ad9FBR_mZoXMMCiUoKU-6wAAAMw"]
[Wed Apr 15 15:58:23.093613 2026] [:error] [pid 11384:tid 11443] [client 212.227.21.19:29976] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad9FH3Ohpt4MrQIXF7CQBAAAAFU"]
[Wed Apr 15 15:58:25.095670 2026] [:error] [pid 12433:tid 12447] [client 212.227.21.19:29982] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ad9FIbwxDHWF005pP_6tgwAAAQw"]
[Wed Apr 15 15:58:27.104082 2026] [:error] [pid 11384:tid 11444] [client 212.227.21.19:29986] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad9FI3Ohpt4MrQIXF7CQDAAAAFY"]
[Wed Apr 15 15:58:29.101859 2026] [:error] [pid 11384:tid 11439] [client 212.227.21.19:12798] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad9FJXOhpt4MrQIXF7CQDwAAAFE"]
[Wed Apr 15 15:58:31.097746 2026] [:error] [pid 12433:tid 12439] [client 212.227.21.19:12814] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad9FJ7wxDHWF005pP_6tigAAAQQ"]
[Wed Apr 15 15:58:33.616061 2026] [:error] [pid 12396:tid 12399] [client 212.227.21.19:16058] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ad9FKcCQWGYUWgxc5kjynwAAAIE"]
[Wed Apr 15 15:58:35.588679 2026] [:error] [pid 12396:tid 12418] [client 212.227.21.19:12820] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad9FK8CQWGYUWgxc5kjyogAAAJQ"]
[Wed Apr 15 15:58:38.135637 2026] [:error] [pid 12396:tid 12407] [client 212.227.21.19:4520] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ad9FLsCQWGYUWgxc5kjyowAAAIk"]
[Wed Apr 15 15:58:40.084666 2026] [:error] [pid 11384:tid 11423] [client 212.227.21.19:2846] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad9FMHOhpt4MrQIXF7CQHgAAAEE"]
[Wed Apr 15 15:58:42.080513 2026] [:error] [pid 11384:tid 11433] [client 212.227.21.19:2852] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad9FMnOhpt4MrQIXF7CQIgAAAEs"]
[Wed Apr 15 15:58:44.598487 2026] [:error] [pid 12433:tid 12435] [client 212.227.21.19:4524] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ad9FNLwxDHWF005pP_6tqgAAAQA"]
[Wed Apr 15 15:58:46.368411 2026] [:error] [pid 12396:tid 12405] [client 212.227.21.19:2854] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad9FNsCQWGYUWgxc5kjypAAAAIc"]
[Wed Apr 15 15:58:48.249275 2026] [:error] [pid 12433:tid 12438] [client 212.227.21.19:36198] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad9FOLwxDHWF005pP_6trwAAAQM"]
[Wed Apr 15 15:58:50.260139 2026] [:error] [pid 11475:tid 11484] [client 212.227.21.19:36212] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad9FOp7upE98bj816HPIxwAAAUc"]
[Wed Apr 15 15:58:52.299315 2026] [:error] [pid 11384:tid 11436] [client 212.227.21.19:36220] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad9FPHOhpt4MrQIXF7CQKgAAAE4"]
[Wed Apr 15 15:58:56.114642 2026] [:error] [pid 12433:tid 12453] [client 212.227.21.19:36234] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad9FQLwxDHWF005pP_6tsQAAARI"]
[Wed Apr 15 17:13:17.240141 2026] [:error] [pid 11384:tid 11427] [client 43.155.26.193:35110] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad9WrXOhpt4MrQIXF7CgewAAAEU"]
[Wed Apr 15 18:08:39.669174 2026] [:error] [pid 11383:tid 11401] [client 51.68.234.121:47200] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ad9jpzOMRk2pAgm2-j7tuQAAAAY"]
[Wed Apr 15 18:08:42.002474 2026] [:error] [pid 12396:tid 12421] [client 51.68.234.121:59376] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ad9jqsCQWGYUWgxc5kgStwAAAJc"]
[Wed Apr 15 18:08:44.893855 2026] [:error] [pid 11475:tid 11493] [client 51.68.234.121:58210] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ad9jrJ7upE98bj816HP8yAAAAVA"]
[Wed Apr 15 18:08:47.814143 2026] [:error] [pid 11475:tid 11485] [client 51.68.234.121:58226] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ad9jr57upE98bj816HP80QAAAUg"]
[Wed Apr 15 18:08:50.861109 2026] [:error] [pid 11383:tid 11408] [client 51.68.234.121:58240] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ad9jsjOMRk2pAgm2-j7tzQAAAA0"]
[Wed Apr 15 18:08:53.730872 2026] [:error] [pid 11475:tid 11482] [client 51.68.234.121:37858] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ad9jtZ7upE98bj816HP87gAAAUU"]
[Wed Apr 15 18:08:56.151356 2026] [:error] [pid 12433:tid 12443] [client 51.68.234.121:37866] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ad9juLwxDHWF005pP_7K7wAAAQg"]
[Wed Apr 15 18:08:58.885163 2026] [:error] [pid 11475:tid 11479] [client 51.68.234.121:37878] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ad9jup7upE98bj816HP8_AAAAUI"]
[Wed Apr 15 18:09:01.890131 2026] [:error] [pid 11475:tid 11486] [client 51.68.234.121:37890] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ad9jvZ7upE98bj816HP9CgAAAUk"]
[Wed Apr 15 18:09:04.799362 2026] [:error] [pid 11384:tid 11451] [client 51.68.234.121:46648] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ad9jwHOhpt4MrQIXF7CpdAAAAFg"]
[Wed Apr 15 18:09:07.208675 2026] [:error] [pid 12396:tid 12421] [client 51.68.234.121:46652] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ad9jw8CQWGYUWgxc5kgS8AAAAJc"]
[Wed Apr 15 18:09:10.082270 2026] [:error] [pid 11383:tid 11401] [client 51.68.234.121:46656] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ad9jxjOMRk2pAgm2-j7uJAAAAAY"]
[Wed Apr 15 18:09:12.918904 2026] [:error] [pid 11383:tid 11402] [client 51.68.234.121:46666] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ad9jyDOMRk2pAgm2-j7uSwAAAAc"]
[Wed Apr 15 18:09:15.760735 2026] [:error] [pid 11475:tid 11500] [client 51.68.234.121:45380] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ad9jy57upE98bj816HP9NQAAAVc"]
[Wed Apr 15 18:09:18.270370 2026] [:error] [pid 12433:tid 12450] [client 51.68.234.121:45390] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ad9jzrwxDHWF005pP_7K-wAAAQ8"]
[Wed Apr 15 18:09:21.287987 2026] [:error] [pid 12433:tid 12437] [client 51.68.234.121:45396] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "ad9j0bwxDHWF005pP_7K_QAAAQI"]
[Wed Apr 15 18:09:23.702647 2026] [:error] [pid 12396:tid 12405] [client 51.68.234.121:35718] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ad9j08CQWGYUWgxc5kgTJwAAAIc"]
[Wed Apr 15 18:09:26.230839 2026] [:error] [pid 12396:tid 12403] [client 51.68.234.121:35724] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ad9j1sCQWGYUWgxc5kgTMQAAAIU"]
[Wed Apr 15 18:09:28.616828 2026] [:error] [pid 11475:tid 11477] [client 51.68.234.121:35726] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ad9j2J7upE98bj816HP9TgAAAUA"]
[Wed Apr 15 18:09:31.021873 2026] [:error] [pid 11383:tid 11409] [client 51.68.234.121:35734] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ad9j2zOMRk2pAgm2-j7uawAAAA4"]
[Wed Apr 15 18:09:34.064192 2026] [:error] [pid 11383:tid 11402] [client 51.68.234.121:37124] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ad9j3jOMRk2pAgm2-j7udAAAAAc"]
[Wed Apr 15 18:09:36.932500 2026] [:error] [pid 11385:tid 11453] [client 51.68.234.121:37132] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ad9j4B_mZoXMMCiUoKVVXQAAAMU"]
[Wed Apr 15 18:10:08.646621 2026] [:error] [pid 28905:tid 28910] [client 51.68.234.121:34660] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ad9kAO9DZdjJ7KcBw_XPWwAAAAE"]
[Wed Apr 15 18:10:11.088569 2026] [:error] [pid 28907:tid 28982] [client 51.68.234.121:55304] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ad9kAxMbq4Od23S648zgrQAAANI"]
[Wed Apr 15 18:10:13.581204 2026] [:error] [pid 28996:tid 29015] [client 51.68.234.121:55314] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ad9kBYFFoOhUzb2qlTZfSgAAARA"]
[Wed Apr 15 18:10:15.909718 2026] [:error] [pid 28907:tid 28966] [client 51.68.234.121:42024] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ad9kBxMbq4Od23S648zgtgAAAMI"]
[Wed Apr 15 18:10:18.403646 2026] [:error] [pid 28996:tid 29007] [client 51.68.234.121:42030] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ad9kCoFFoOhUzb2qlTZfXgAAAQg"]
[Wed Apr 15 18:10:20.914970 2026] [:error] [pid 28996:tid 29021] [client 51.68.234.121:42036] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ad9kDIFFoOhUzb2qlTZfZAAAARY"]
[Wed Apr 15 18:10:23.256621 2026] [:error] [pid 28907:tid 28976] [client 51.68.234.121:42038] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ad9kDxMbq4Od23S648zgxQAAAMw"]
[Wed Apr 15 18:10:25.733339 2026] [:error] [pid 28907:tid 28968] [client 51.68.234.121:35626] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ad9kERMbq4Od23S648zgywAAAMQ"]
[Wed Apr 15 18:10:28.234750 2026] [:error] [pid 28906:tid 28952] [client 51.68.234.121:35642] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ad9kFFwfXAWrVIHeYzuGGAAAAE8"]
[Wed Apr 15 18:10:30.690105 2026] [:error] [pid 28905:tid 28922] [client 51.68.234.121:35656] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ad9kFu9DZdjJ7KcBw_XPvwAAAA0"]
[Wed Apr 15 18:10:33.166854 2026] [:error] [pid 28907:tid 28975] [client 51.68.234.121:35658] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ad9kGRMbq4Od23S648zg3QAAAMs"]
[Wed Apr 15 18:10:35.641773 2026] [:error] [pid 28907:tid 28967] [client 51.68.234.121:33942] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ad9kGxMbq4Od23S648zg3wAAAMM"]
[Wed Apr 15 18:10:37.973964 2026] [:error] [pid 28905:tid 28929] [client 51.68.234.121:33946] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ad9kHe9DZdjJ7KcBw_XPwwAAABQ"]
[Wed Apr 15 18:10:40.476818 2026] [:error] [pid 28907:tid 28976] [client 51.68.234.121:33956] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ad9kIBMbq4Od23S648zg5QAAAMw"]
[Wed Apr 15 18:10:42.792982 2026] [:error] [pid 28907:tid 28974] [client 51.68.234.121:33964] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ad9kIhMbq4Od23S648zg6wAAAMo"]
[Wed Apr 15 18:10:45.110606 2026] [:error] [pid 28996:tid 29018] [client 51.68.234.121:53566] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ad9kJYFFoOhUzb2qlTZfrgAAARM"]
[Wed Apr 15 18:10:47.561478 2026] [:error] [pid 28996:tid 29023] [client 51.68.234.121:53568] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ad9kJ4FFoOhUzb2qlTZftQAAARg"]
[Wed Apr 15 18:10:50.071359 2026] [:error] [pid 28906:tid 28953] [client 51.68.234.121:53584] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ad9kKlwfXAWrVIHeYzuGNAAAAFA"]
[Wed Apr 15 18:10:52.499364 2026] [:error] [pid 28996:tid 29012] [client 51.68.234.121:53600] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ad9kLIFFoOhUzb2qlTZfwAAAAQ0"]
[Wed Apr 15 18:10:54.829584 2026] [:error] [pid 28996:tid 29009] [client 51.68.234.121:32942] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ad9kLoFFoOhUzb2qlTZfyQAAAQo"]
[Wed Apr 15 18:10:57.946867 2026] [:error] [pid 28907:tid 28973] [client 51.68.234.121:38154] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad9kMRMbq4Od23S648zhXAAAAMk"]
[Wed Apr 15 18:11:01.783913 2026] [:error] [pid 28906:tid 28954] [client 51.68.234.121:38168] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ad9kNVwfXAWrVIHeYzuGQwAAAFE"]
[Wed Apr 15 19:14:42.227567 2026] [core:error] [pid 30958:tid 31018] [client 159.195.51.23:52424] AH00135: Invalid method in request POSTPOST / HTTP/1.1
[Wed Apr 15 19:22:55.686212 2026] [:error] [pid 31053:tid 31076] [client 65.108.2.171:1292] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ad91DxcEkLCmvF0fjDettgAAAJQ"]
[Wed Apr 15 19:27:11.645458 2026] [:error] [pid 37370:tid 37393] [client 145.239.69.40:51832] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ad92D3g-gnM2Ga0cGAAMxQAAARU"]
[Wed Apr 15 19:27:14.111052 2026] [:error] [pid 37370:tid 37374] [client 145.239.69.40:43018] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ad92Eng-gnM2Ga0cGAAMygAAAQI"]
[Wed Apr 15 19:27:16.529346 2026] [:error] [pid 37370:tid 37377] [client 145.239.69.40:43020] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ad92FHg-gnM2Ga0cGAAM2AAAAQU"]
[Wed Apr 15 19:27:18.892960 2026] [:error] [pid 30956:tid 30977] [client 145.239.69.40:43036] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ad92FkBGUpjaWntNYq1i6AAAABE"]
[Wed Apr 15 19:27:21.327941 2026] [:error] [pid 30958:tid 31020] [client 145.239.69.40:44012] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ad92GceG3wSKTO7NWFGPYQAAAMQ"]
[Wed Apr 15 19:27:23.724193 2026] [:error] [pid 30957:tid 31005] [client 145.239.69.40:44018] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ad92G35gwVEVXHfVSipynQAAAFA"]
[Wed Apr 15 19:27:26.115757 2026] [:error] [pid 30956:tid 30974] [client 145.239.69.40:44028] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ad92HkBGUpjaWntNYq1i_wAAAA4"]
[Wed Apr 15 19:27:28.636463 2026] [:error] [pid 30957:tid 30992] [client 145.239.69.40:44032] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ad92IH5gwVEVXHfVSipyoQAAAEM"]
[Wed Apr 15 19:27:31.043072 2026] [:error] [pid 37370:tid 37392] [client 145.239.69.40:57596] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ad92I3g-gnM2Ga0cGAAM_QAAARQ"]
[Wed Apr 15 19:27:33.585837 2026] [:error] [pid 31053:tid 31067] [client 145.239.69.40:57600] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ad92JRcEkLCmvF0fjDev6wAAAIs"]
[Wed Apr 15 19:27:35.965986 2026] [:error] [pid 31053:tid 31068] [client 145.239.69.40:57602] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ad92JxcEkLCmvF0fjDewBgAAAIw"]
[Wed Apr 15 19:27:38.373170 2026] [:error] [pid 30958:tid 31037] [client 145.239.69.40:57618] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ad92KseG3wSKTO7NWFGPfAAAANU"]
[Wed Apr 15 19:27:40.922039 2026] [:error] [pid 31053:tid 31059] [client 145.239.69.40:60268] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ad92LBcEkLCmvF0fjDewEgAAAIM"]
[Wed Apr 15 19:27:43.467777 2026] [:error] [pid 31053:tid 31075] [client 145.239.69.40:60282] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ad92LxcEkLCmvF0fjDewGgAAAJM"]
[Wed Apr 15 19:27:45.867685 2026] [:error] [pid 30957:tid 31003] [client 145.239.69.40:60296] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ad92MX5gwVEVXHfVSipyswAAAE4"]
[Wed Apr 15 19:27:48.260139 2026] [:error] [pid 30958:tid 31035] [client 145.239.69.40:60298] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ad92NMeG3wSKTO7NWFGPiQAAANM"]
[Wed Apr 15 19:27:50.769874 2026] [:error] [pid 30957:tid 30994] [client 145.239.69.40:60368] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ad92Nn5gwVEVXHfVSipyuQAAAEU"]
[Wed Apr 15 19:27:53.159026 2026] [:error] [pid 30956:tid 30978] [client 145.239.69.40:60376] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ad92OUBGUpjaWntNYq1jEAAAABI"]
[Wed Apr 15 19:27:55.686975 2026] [:error] [pid 30957:tid 30994] [client 145.239.69.40:60384] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ad92O35gwVEVXHfVSipywQAAAEU"]
[Wed Apr 15 19:27:58.223901 2026] [:error] [pid 30957:tid 31012] [client 145.239.69.40:60398] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ad92Pn5gwVEVXHfVSipyxwAAAFc"]
[Wed Apr 15 19:28:00.741960 2026] [:error] [pid 37370:tid 37380] [client 145.239.69.40:35602] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ad92QHg-gnM2Ga0cGAANoQAAAQg"]
[Wed Apr 15 19:28:03.266980 2026] [:error] [pid 30958:tid 31025] [client 145.239.69.40:35616] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ad92Q8eG3wSKTO7NWFGPmgAAAMk"]
[Wed Apr 15 19:28:05.633853 2026] [:error] [pid 37370:tid 37377] [client 145.239.69.40:35626] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ad92RXg-gnM2Ga0cGAANtwAAAQU"]
[Wed Apr 15 19:28:08.137106 2026] [:error] [pid 37370:tid 37388] [client 145.239.69.40:35640] [client 145.239.69.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ad92SHg-gnM2Ga0cGAANvAAAARA"]
[Wed Apr 15 22:08:30.267739 2026] [:error] [pid 23913:tid 23932] [client 45.45.237.21:53726] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ad-b3lUaK3MLdSaLOyi9IwAAAVE"]
[Wed Apr 15 22:08:30.270151 2026] [:error] [pid 30957:tid 31013] [client 45.45.237.21:53710] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad-b3n5gwVEVXHfVSiqxDwAAAFg"]
[Thu Apr 16 00:19:44.389743 2026] [:error] [pid 30958:tid 31017] [client 170.106.165.186:53896] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad-6oMeG3wSKTO7NWFH89gAAAME"]
[Thu Apr 16 02:15:22.948317 2026] [:error] [pid 34542:tid 34564] [client 64.236.133.129:60803] [client 64.236.133.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_VugdF4OGi-asleB6VpwAAAVQ"], referer: https://medium.com/
[Thu Apr 16 02:15:28.537224 2026] [:error] [pid 20548:tid 20558] [client 13.83.162.4:37101] [client 13.83.162.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_VwKkpqgnqCHq6bJbAygAAAIc"], referer: https://www.youtube.com/
[Thu Apr 16 02:15:38.599245 2026] [:error] [pid 791:tid 848] [client 52.162.9.246:40468] [client 52.162.9.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_Vyrxl5Y18om2fepneZgAAAEg"]
[Thu Apr 16 02:15:46.711328 2026] [:error] [pid 20548:tid 20561] [client 64.236.201.55:42177] [client 64.236.201.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_V0qkpqgnqCHq6bJbBAAAAAIo"]
[Thu Apr 16 02:15:52.469550 2026] [:error] [pid 912:tid 971] [client 64.236.200.114:60765] [client 64.236.200.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_V2MU0_VzYCBipADk2owAAAQM"], referer: https://github.com/
[Thu Apr 16 02:15:54.854384 2026] [:error] [pid 912:tid 991] [client 135.232.224.82:54935] [client 135.232.224.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_V2sU0_VzYCBipADk2pAAAARc"]
[Thu Apr 16 02:15:54.892950 2026] [:error] [pid 20548:tid 20556] [client 172.174.188.181:60226] [client 172.174.188.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_V2qkpqgnqCHq6bJbBJgAAAIU"], referer: https://www.bing.com/search?q=
[Thu Apr 16 02:16:05.423264 2026] [:error] [pid 792:tid 870] [client 52.165.250.244:60359] [client 52.165.250.244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_V5d3PZ8z30TezIkZkuQAAAME"], referer: https://stackoverflow.com/
[Thu Apr 16 02:16:34.209765 2026] [:error] [pid 912:tid 979] [client 48.214.55.34:23500] [client 48.214.55.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_WAsU0_VzYCBipADk2uQAAAQs"]
[Thu Apr 16 02:16:43.317687 2026] [:error] [pid 34542:tid 34555] [client 20.168.159.162:13632] [client 20.168.159.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_WCwdF4OGi-asleB6WHQAAAUs"]
[Thu Apr 16 02:16:55.756596 2026] [:error] [pid 790:tid 821] [client 20.25.153.53:63112] [client 20.25.153.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_WFyHz-rbrjNOa3VKrHwAAABA"]
[Thu Apr 16 02:17:33.689333 2026] [:error] [pid 34542:tid 34560] [client 40.76.191.164:21234] [client 40.76.191.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_WPQdF4OGi-asleB6WdAAAAVA"]
[Thu Apr 16 02:17:36.118111 2026] [:error] [pid 34542:tid 34551] [client 172.215.217.96:56987] [client 172.215.217.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_WQAdF4OGi-asleB6WggAAAUc"]
[Thu Apr 16 02:26:40.664717 2026] [:error] [pid 34542:tid 34546] [client 172.208.153.11:61517] [client 172.208.153.11] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_YYAdF4OGi-asleB6bKQAAAUI"]
[Thu Apr 16 02:32:05.462663 2026] [:error] [pid 34542:tid 34545] [client 52.161.51.58:1223] [client 52.161.51.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_ZpQdF4OGi-asleB6dCAAAAUE"], referer: https://www.google.com/
[Thu Apr 16 02:32:16.661068 2026] [:error] [pid 54814:tid 54830] [client 52.161.51.53:47233] [client 52.161.51.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_ZsDrHu_-tAAe-BOW4gQAAAYo"], referer: https://outlook.live.com/
[Thu Apr 16 02:33:58.545630 2026] [:error] [pid 54814:tid 54833] [client 128.24.161.179:63745] [client 128.24.161.179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_aFjrHu_-tAAe-BOW5BAAAAY0"], referer: https://twitter.com/
[Thu Apr 16 02:34:08.820357 2026] [:error] [pid 912:tid 986] [client 172.215.217.194:34006] [client 172.215.217.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_aIMU0_VzYCBipADk6fwAAARI"]
[Thu Apr 16 03:03:34.118484 2026] [:error] [pid 54814:tid 54820] [client 172.212.163.17:18440] [client 172.212.163.17] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_hBjrHu_-tAAe-BOXEEgAAAYA"]
[Thu Apr 16 03:04:58.240424 2026] [:error] [pid 791:tid 845] [client 20.62.255.22:48176] [client 20.62.255.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_hWrxl5Y18om2fepnkkAAAAEU"]
[Thu Apr 16 03:11:24.529910 2026] [:error] [pid 792:tid 888] [client 180.110.203.108:34257] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ad_i3N3PZ8z30TezIkZt2wAAAM0"]
[Thu Apr 16 03:25:22.810164 2026] [:error] [pid 54814:tid 54843] [client 172.212.169.145:61318] [client 172.212.169.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ad_mIjrHu_-tAAe-BOXKKAAAAZc"], referer: https://github.com/
[Thu Apr 16 04:47:26.540341 2026] [ssl:error] [pid 57537:tid 57591] [client 143.244.47.83:14390] AH02032: Hostname www.zenjitreasures.nl provided via SNI and hostname switchcreative.net provided via HTTP have no compatible SSL setup
[Thu Apr 16 04:52:14.896803 2026] [:error] [pid 57536:tid 57571] [client 66.90.90.178:65284] [client 66.90.90.178] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "switchcreative.net"] [uri "/"] [unique_id "ad_6fiQU4faGja6jpDtuhAAAABc"]
[Thu Apr 16 04:52:14.897694 2026] [:error] [pid 57536:tid 57571] [client 66.90.90.178:65284] [client 66.90.90.178] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||switchcreative.net|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad_6fiQU4faGja6jpDtuhAAAABc"]
[Thu Apr 16 04:52:14.897768 2026] [:error] [pid 57536:tid 57571] [client 66.90.90.178:65284] [client 66.90.90.178] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ad_6fiQU4faGja6jpDtuhAAAABc"]
[Thu Apr 16 04:58:26.669289 2026] [ssl:error] [pid 57536:tid 57568] [client 143.244.47.83:56768] AH02032: Hostname paulwilliselectrical.co.uk provided via SNI and hostname www.switchcreative.net provided via HTTP have no compatible SSL setup
[Thu Apr 16 05:38:21.688631 2026] [:error] [pid 49094:tid 49110] [client 150.162.148.193:63442] [client 150.162.148.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.162.148.193, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeAFTTbDwvcXorHR_Mxy9gAAAU4"]
[Thu Apr 16 05:38:21.699048 2026] [proxy_fcgi:error] [pid 49094:tid 49110] [client 150.162.148.193:63442] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 07:24:21.091223 2026] [:error] [pid 57537:tid 57591] [client 152.53.187.237:53804] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeAeJVVQRS8nm73ENAk-hwAAAFA"]
[Thu Apr 16 07:24:25.321790 2026] [:error] [pid 57639:tid 57670] [client 152.53.187.237:53820] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeAeKaMCQoTw7TsxWunYDQAAANg"]
[Thu Apr 16 07:24:28.180348 2026] [:error] [pid 49094:tid 49110] [client 152.53.187.237:53832] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeAeLDbDwvcXorHR_MyyOwAAAU4"]
[Thu Apr 16 07:24:32.352470 2026] [:error] [pid 57639:tid 57648] [client 152.53.187.237:61592] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeAeMKMCQoTw7TsxWunYFAAAAMI"]
[Thu Apr 16 08:38:58.300000 2026] [:error] [pid 57537:tid 57598] [client 43.154.250.181:42808] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeAvolVQRS8nm73ENAlPowAAAFc"]
[Thu Apr 16 09:22:50.675345 2026] [:error] [pid 57537:tid 57592] [client 111.172.249.49:44801] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeA56lVQRS8nm73ENAlYdgAAAFE"]
[Thu Apr 16 09:46:38.453745 2026] [:error] [pid 57639:tid 57653] [client 98.93.160.221:45802] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aeA_fqMCQoTw7TsxWukpSgAAAMc"]
[Thu Apr 16 10:02:06.879201 2026] [:error] [pid 57639:tid 57657] [client 51.75.119.229:52184] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeBDHqMCQoTw7TsxWukx2gAAAMs"]
[Thu Apr 16 10:02:08.485098 2026] [:error] [pid 49094:tid 49113] [client 51.75.119.229:54568] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeBDIDbDwvcXorHR_Mz0yAAAAVE"]
[Thu Apr 16 10:02:10.415827 2026] [:error] [pid 57639:tid 57658] [client 51.75.119.229:52200] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeBDIqMCQoTw7TsxWukx3wAAAMw"]
[Thu Apr 16 10:02:12.450757 2026] [:error] [pid 29603:tid 29624] [client 51.75.119.229:52210] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeBDJFfGOR6fpTWUAzoTSgAAARM"]
[Thu Apr 16 10:02:14.423921 2026] [:error] [pid 49094:tid 49102] [client 51.75.119.229:48052] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeBDJjbDwvcXorHR_Mz0zAAAAUY"]
[Thu Apr 16 10:02:16.463814 2026] [:error] [pid 57537:tid 57587] [client 51.75.119.229:48066] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeBDKFVQRS8nm73ENAleKwAAAEw"]
[Thu Apr 16 10:02:18.321510 2026] [:error] [pid 57639:tid 57655] [client 51.75.119.229:48078] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeBDKqMCQoTw7TsxWukx6gAAAMk"]
[Thu Apr 16 10:02:20.262965 2026] [:error] [pid 29603:tid 29623] [client 51.75.119.229:48086] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeBDLFfGOR6fpTWUAzoTUQAAARI"]
[Thu Apr 16 10:02:22.214133 2026] [:error] [pid 57639:tid 57649] [client 51.75.119.229:48102] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeBDLqMCQoTw7TsxWukx7QAAAMM"]
[Thu Apr 16 10:02:24.257699 2026] [:error] [pid 29603:tid 29610] [client 51.75.119.229:57808] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeBDMFfGOR6fpTWUAzoTWAAAAQU"]
[Thu Apr 16 10:02:26.360007 2026] [:error] [pid 57639:tid 57670] [client 51.75.119.229:57816] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeBDMqMCQoTw7TsxWukx9AAAANg"]
[Thu Apr 16 10:02:28.249735 2026] [:error] [pid 49094:tid 49107] [client 51.75.119.229:57826] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeBDNDbDwvcXorHR_Mz01wAAAUs"]
[Thu Apr 16 10:02:30.335704 2026] [:error] [pid 29603:tid 29609] [client 51.75.119.229:57830] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeBDNlfGOR6fpTWUAzoTWwAAAQQ"]
[Thu Apr 16 10:02:32.465764 2026] [:error] [pid 57639:tid 57663] [client 51.75.119.229:57836] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeBDOKMCQoTw7TsxWukx_QAAANE"]
[Thu Apr 16 10:02:34.432533 2026] [:error] [pid 57639:tid 57655] [client 51.75.119.229:33210] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeBDOqMCQoTw7TsxWukyBgAAAMk"]
[Thu Apr 16 10:02:36.475701 2026] [:error] [pid 57639:tid 57667] [client 51.75.119.229:33220] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeBDPKMCQoTw7TsxWukyDAAAANU"]
[Thu Apr 16 10:02:38.366046 2026] [:error] [pid 57538:tid 57621] [client 51.75.119.229:33230] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeBDPsuMaiEF5SVR2BdvAgAAAJM"]
[Thu Apr 16 10:02:40.161810 2026] [:error] [pid 57639:tid 57670] [client 51.75.119.229:33244] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeBDQKMCQoTw7TsxWukyEQAAANg"]
[Thu Apr 16 10:02:42.241269 2026] [:error] [pid 57536:tid 57569] [client 51.75.119.229:33246] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeBDQiQU4faGja6jpDuj_gAAABU"]
[Thu Apr 16 10:02:44.204936 2026] [:error] [pid 57538:tid 57606] [client 51.75.119.229:47516] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeBDRMuMaiEF5SVR2BdvCAAAAIQ"]
[Thu Apr 16 10:02:46.288001 2026] [:error] [pid 49094:tid 49114] [client 51.75.119.229:47522] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeBDRjbDwvcXorHR_Mz09QAAAVI"]
[Thu Apr 16 10:02:48.257548 2026] [:error] [pid 49094:tid 49101] [client 51.75.119.229:47524] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeBDSDbDwvcXorHR_Mz0_AAAAUU"]
[Thu Apr 16 10:02:50.146177 2026] [:error] [pid 49094:tid 49108] [client 51.75.119.229:47528] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeBDSjbDwvcXorHR_Mz1AAAAAUw"]
[Thu Apr 16 10:02:52.588854 2026] [:error] [pid 29603:tid 29612] [client 51.75.119.229:44472] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeBDTFfGOR6fpTWUAzoTbQAAAQc"]
[Thu Apr 16 10:02:54.536976 2026] [:error] [pid 49094:tid 49101] [client 51.75.119.229:55076] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeBDTjbDwvcXorHR_Mz1BQAAAUU"]
[Thu Apr 16 10:02:56.993937 2026] [:error] [pid 57639:tid 57665] [client 51.75.119.229:55090] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeBDUKMCQoTw7TsxWukyKQAAANM"]
[Thu Apr 16 10:02:58.972788 2026] [:error] [pid 29603:tid 29616] [client 51.75.119.229:55102] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeBDUlfGOR6fpTWUAzoTcgAAAQs"]
[Thu Apr 16 10:03:01.475747 2026] [:error] [pid 57639:tid 57666] [client 51.75.119.229:55112] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeBDVaMCQoTw7TsxWukyOAAAANQ"]
[Thu Apr 16 10:03:03.415198 2026] [:error] [pid 57639:tid 57667] [client 51.75.119.229:55116] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeBDV6MCQoTw7TsxWukyRgAAANU"]
[Thu Apr 16 10:03:26.158662 2026] [:error] [pid 49094:tid 49113] [client 51.75.119.229:58890] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeBDbjbDwvcXorHR_Mz1SgAAAVE"]
[Thu Apr 16 10:03:28.243775 2026] [:error] [pid 49094:tid 49112] [client 51.75.119.229:53208] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeBDcDbDwvcXorHR_Mz1UAAAAVA"]
[Thu Apr 16 10:03:30.864119 2026] [:error] [pid 57639:tid 57658] [client 51.75.119.229:44264] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeBDcqMCQoTw7TsxWukycwAAAMw"]
[Thu Apr 16 10:03:32.880671 2026] [:error] [pid 57537:tid 57587] [client 51.75.119.229:53214] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeBDdFVQRS8nm73ENAleWAAAAEw"]
[Thu Apr 16 10:03:34.795279 2026] [:error] [pid 57537:tid 57579] [client 51.75.119.229:47886] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeBDdlVQRS8nm73ENAleXAAAAEQ"]
[Thu Apr 16 10:03:36.799406 2026] [:error] [pid 49094:tid 49111] [client 51.75.119.229:47894] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeBDeDbDwvcXorHR_Mz1YAAAAU8"]
[Thu Apr 16 10:03:39.181870 2026] [:error] [pid 49094:tid 49103] [client 51.75.119.229:40942] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeBDezbDwvcXorHR_Mz1ZQAAAUc"]
[Thu Apr 16 10:03:41.085997 2026] [:error] [pid 57537:tid 57575] [client 51.75.119.229:47910] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeBDfVVQRS8nm73ENAlebQAAAEA"]
[Thu Apr 16 10:03:43.218710 2026] [:error] [pid 57639:tid 57663] [client 51.75.119.229:47912] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeBDf6MCQoTw7TsxWukyiwAAANE"]
[Thu Apr 16 10:03:45.190042 2026] [:error] [pid 57639:tid 57662] [client 51.75.119.229:60680] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeBDgaMCQoTw7TsxWukyjwAAANA"]
[Thu Apr 16 10:03:47.126439 2026] [:error] [pid 57639:tid 57654] [client 51.75.119.229:60686] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeBDg6MCQoTw7TsxWukylwAAAMg"]
[Thu Apr 16 10:03:49.160060 2026] [:error] [pid 29603:tid 29609] [client 51.75.119.229:60700] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeBDhVfGOR6fpTWUAzoTsAAAAQQ"]
[Thu Apr 16 10:03:51.612741 2026] [:error] [pid 57538:tid 57618] [client 51.75.119.229:57666] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeBDh8uMaiEF5SVR2BdvRQAAAJA"]
[Thu Apr 16 10:03:53.982897 2026] [:error] [pid 57639:tid 57647] [client 51.75.119.229:54762] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeBDiaMCQoTw7TsxWukyrQAAAME"]
[Thu Apr 16 10:03:55.891217 2026] [:error] [pid 57639:tid 57669] [client 51.75.119.229:54778] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeBDi6MCQoTw7TsxWukyvAAAANc"]
[Thu Apr 16 10:03:58.398666 2026] [:error] [pid 49094:tid 49099] [client 51.75.119.229:50372] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeBDjjbDwvcXorHR_Mz1dgAAAUM"]
[Thu Apr 16 10:04:00.431828 2026] [:error] [pid 57639:tid 57663] [client 51.75.119.229:54786] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeBDkKMCQoTw7TsxWuky2QAAANE"]
[Thu Apr 16 10:04:02.478408 2026] [:error] [pid 49094:tid 49105] [client 51.75.119.229:54794] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeBDkjbDwvcXorHR_Mz1gwAAAUk"]
[Thu Apr 16 10:04:04.393890 2026] [:error] [pid 29603:tid 29628] [client 51.75.119.229:36036] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeBDlFfGOR6fpTWUAzoTuwAAARc"]
[Thu Apr 16 10:04:06.396563 2026] [:error] [pid 49094:tid 49108] [client 51.75.119.229:36042] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeBDljbDwvcXorHR_Mz1lwAAAUw"]
[Thu Apr 16 10:04:08.847490 2026] [:error] [pid 29603:tid 29610] [client 51.75.119.229:37394] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeBDmFfGOR6fpTWUAzoTwgAAAQU"]
[Thu Apr 16 10:04:11.030367 2026] [:error] [pid 57639:tid 57667] [client 51.75.119.229:36052] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeBDm6MCQoTw7TsxWuky9wAAANU"]
[Thu Apr 16 10:04:13.680319 2026] [:error] [pid 57537:tid 57579] [client 51.75.119.229:37402] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeBDnVVQRS8nm73ENAlegwAAAEQ"]
[Thu Apr 16 10:04:15.697349 2026] [:error] [pid 57639:tid 57664] [client 51.75.119.229:34422] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeBDn6MCQoTw7TsxWukzDQAAANI"]
[Thu Apr 16 10:04:18.105972 2026] [:error] [pid 57537:tid 57582] [client 51.75.119.229:59168] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeBDolVQRS8nm73ENAlejAAAAEc"]
[Thu Apr 16 10:04:20.008927 2026] [:error] [pid 57639:tid 57646] [client 51.75.119.229:34424] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeBDpKMCQoTw7TsxWukzHgAAAMA"]
[Thu Apr 16 10:04:22.312132 2026] [:error] [pid 57639:tid 57651] [client 51.75.119.229:59182] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeBDpqMCQoTw7TsxWukzKwAAAMU"]
[Thu Apr 16 10:04:46.338600 2026] [:error] [pid 57639:tid 57657] [client 51.75.119.229:58080] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeBDvqMCQoTw7TsxWukzswAAAMs"]
[Thu Apr 16 10:04:48.256839 2026] [:error] [pid 57639:tid 57654] [client 51.75.119.229:44566] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeBDwKMCQoTw7TsxWukzxgAAAMg"]
[Thu Apr 16 10:04:50.685191 2026] [:error] [pid 49094:tid 49119] [client 51.75.119.229:58096] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeBDwjbDwvcXorHR_Mz1vAAAAVc"]
[Thu Apr 16 10:04:52.620903 2026] [:error] [pid 49094:tid 49102] [client 51.75.119.229:58034] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeBDxDbDwvcXorHR_Mz1wAAAAUY"]
[Thu Apr 16 10:04:54.669875 2026] [:error] [pid 49094:tid 49111] [client 51.75.119.229:35684] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeBDxjbDwvcXorHR_Mz1xwAAAU8"]
[Thu Apr 16 10:04:57.221713 2026] [:error] [pid 29603:tid 29628] [client 51.75.119.229:37506] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeBDyVfGOR6fpTWUAzoT7wAAARc"]
[Thu Apr 16 10:04:59.241264 2026] [:error] [pid 49094:tid 49099] [client 51.75.119.229:35694] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeBDyzbDwvcXorHR_Mz1zgAAAUM"]
[Thu Apr 16 10:05:01.391048 2026] [:error] [pid 57538:tid 57604] [client 51.75.119.229:35696] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeBDzcuMaiEF5SVR2BdviwAAAII"]
[Thu Apr 16 10:05:03.241652 2026] [:error] [pid 49094:tid 49114] [client 51.75.119.229:35698] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeBDzzbDwvcXorHR_Mz10wAAAVI"]
[Thu Apr 16 10:05:05.143473 2026] [:error] [pid 57639:tid 57666] [client 51.75.119.229:51696] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeBD0aMCQoTw7TsxWukz9AAAANQ"]
[Thu Apr 16 10:05:08.858397 2026] [:error] [pid 57538:tid 57625] [client 51.75.119.229:51712] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeBD1MuMaiEF5SVR2BdvmwAAAJc"]
[Thu Apr 16 10:51:55.799168 2026] [proxy_fcgi:error] [pid 49094:tid 49103] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:55.973033 2026] [proxy_fcgi:error] [pid 49094:tid 49096] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:56.117640 2026] [proxy_fcgi:error] [pid 49094:tid 49102] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:56.261910 2026] [proxy_fcgi:error] [pid 49094:tid 49114] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:56.406672 2026] [proxy_fcgi:error] [pid 49094:tid 49112] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:56.556679 2026] [proxy_fcgi:error] [pid 49094:tid 49113] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:56.872320 2026] [proxy_fcgi:error] [pid 49094:tid 49097] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:57.018070 2026] [proxy_fcgi:error] [pid 49094:tid 49101] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:57.163248 2026] [proxy_fcgi:error] [pid 49094:tid 49105] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:57.309340 2026] [proxy_fcgi:error] [pid 49094:tid 49108] [client 20.235.69.36:3967] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 10:51:57.460101 2026] [:error] [pid 49094:tid 49098] [client 20.235.69.36:3967] [client 20.235.69.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeBOzTbDwvcXorHR_MwGrAAAAUI"]
[Thu Apr 16 10:51:58.045497 2026] [:error] [pid 49094:tid 49110] [client 20.235.69.36:5772] [client 20.235.69.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeBOzjbDwvcXorHR_MwGsQAAAU4"]
[Thu Apr 16 10:51:58.640300 2026] [:error] [pid 57639:tid 57666] [client 20.235.69.36:5769] [client 20.235.69.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeBOzqMCQoTw7TsxWulNJAAAANQ"]
[Thu Apr 16 10:51:59.203905 2026] [:error] [pid 49094:tid 49102] [client 20.235.69.36:6472] [client 20.235.69.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeBOzzbDwvcXorHR_MwGsgAAAUY"]
[Thu Apr 16 11:18:00.574598 2026] [:error] [pid 7880:tid 7894] [client 81.167.26.57:65509] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeBU6Kaezm4fSGc0yUL8NQAAAYk"]
[Thu Apr 16 11:18:03.144218 2026] [:error] [pid 57537:tid 57582] [client 81.167.26.57:22815] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeBU61VQRS8nm73ENAloIgAAAEc"]
[Thu Apr 16 11:18:05.159976 2026] [:error] [pid 49094:tid 49104] [client 81.167.26.57:23813] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeBU7TbDwvcXorHR_MwMzAAAAUg"]
[Thu Apr 16 11:18:07.747122 2026] [:error] [pid 7880:tid 7885] [client 81.167.26.57:9331] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeBU76aezm4fSGc0yUL8RQAAAYA"]
[Thu Apr 16 11:18:09.753775 2026] [:error] [pid 57537:tid 57590] [client 81.167.26.57:37457] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeBU8VVQRS8nm73ENAloKAAAAE8"]
[Thu Apr 16 11:18:12.335295 2026] [:error] [pid 7880:tid 7893] [client 81.167.26.57:44137] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeBU9Kaezm4fSGc0yUL8UQAAAYg"]
[Thu Apr 16 11:18:14.951218 2026] [:error] [pid 57536:tid 57555] [client 81.167.26.57:14397] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeBU9iQU4faGja6jpDutNgAAAAc"]
[Thu Apr 16 11:18:16.979842 2026] [:error] [pid 7880:tid 7887] [client 81.167.26.57:64096] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeBU-Kaezm4fSGc0yUL8XgAAAYI"]
[Thu Apr 16 11:18:19.571384 2026] [:error] [pid 57639:tid 57666] [client 81.167.26.57:23747] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeBU-6MCQoTw7TsxWulXAwAAANQ"]
[Thu Apr 16 11:18:21.587703 2026] [:error] [pid 7880:tid 7887] [client 81.167.26.57:10044] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeBU_aaezm4fSGc0yUL8agAAAYI"]
[Thu Apr 16 11:18:24.176922 2026] [:error] [pid 57536:tid 57555] [client 81.167.26.57:15687] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeBVACQU4faGja6jpDutRgAAAAc"]
[Thu Apr 16 11:18:26.776306 2026] [:error] [pid 57639:tid 57648] [client 81.167.26.57:23082] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeBVAqMCQoTw7TsxWulXHgAAAMI"]
[Thu Apr 16 11:18:28.781461 2026] [:error] [pid 7880:tid 7898] [client 81.167.26.57:2621] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeBVBKaezm4fSGc0yUL8cwAAAY0"]
[Thu Apr 16 11:18:31.349622 2026] [:error] [pid 57639:tid 57657] [client 81.167.26.57:11201] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeBVB6MCQoTw7TsxWulXJwAAAMs"]
[Thu Apr 16 11:18:33.391924 2026] [:error] [pid 57537:tid 57575] [client 81.167.26.57:19689] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeBVCVVQRS8nm73ENAloNgAAAEA"]
[Thu Apr 16 11:18:35.940049 2026] [:error] [pid 57639:tid 57653] [client 81.167.26.57:52985] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeBVC6MCQoTw7TsxWulXRwAAAMc"]
[Thu Apr 16 11:18:37.960191 2026] [:error] [pid 7880:tid 7886] [client 81.167.26.57:32756] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeBVDaaezm4fSGc0yUL8lAAAAYE"]
[Thu Apr 16 11:18:40.554130 2026] [:error] [pid 7880:tid 7886] [client 81.167.26.57:44085] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeBVEKaezm4fSGc0yUL8nQAAAYE"]
[Thu Apr 16 11:18:42.562900 2026] [:error] [pid 7880:tid 7890] [client 81.167.26.57:26286] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeBVEqaezm4fSGc0yUL8pwAAAYU"]
[Thu Apr 16 11:18:45.771199 2026] [:error] [pid 57639:tid 57655] [client 81.167.26.57:31893] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeBVFaMCQoTw7TsxWulXWQAAAMk"]
[Thu Apr 16 11:18:48.351407 2026] [:error] [pid 57639:tid 57650] [client 81.167.26.57:50331] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeBVGKMCQoTw7TsxWulXXgAAAMQ"]
[Thu Apr 16 11:18:50.341263 2026] [:error] [pid 29603:tid 29611] [client 81.167.26.57:17870] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeBVGlfGOR6fpTWUAzok3gAAAQY"]
[Thu Apr 16 11:18:52.923634 2026] [:error] [pid 57639:tid 57648] [client 81.167.26.57:55456] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeBVHKMCQoTw7TsxWulXawAAAMI"]
[Thu Apr 16 11:18:54.936478 2026] [:error] [pid 57538:tid 57612] [client 81.167.26.57:47007] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeBVHsuMaiEF5SVR2Bd8_wAAAIo"]
[Thu Apr 16 11:18:56.911593 2026] [:error] [pid 49094:tid 49106] [client 81.167.26.57:48315] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeBVIDbDwvcXorHR_MwM9wAAAUo"]
[Thu Apr 16 11:19:18.465425 2026] [:error] [pid 49094:tid 49104] [client 81.167.26.57:56700] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeBVNjbDwvcXorHR_MwNHQAAAUg"]
[Thu Apr 16 11:19:20.432644 2026] [:error] [pid 57639:tid 57654] [client 81.167.26.57:24990] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeBVOKMCQoTw7TsxWulXfgAAAMg"]
[Thu Apr 16 11:19:22.865233 2026] [:error] [pid 57639:tid 57653] [client 81.167.26.57:49128] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeBVOqMCQoTw7TsxWulXhgAAAMc"]
[Thu Apr 16 11:19:24.868538 2026] [:error] [pid 57537:tid 57576] [client 81.167.26.57:22734] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeBVPFVQRS8nm73ENAloVAAAAEE"]
[Thu Apr 16 11:19:27.441459 2026] [:error] [pid 57537:tid 57578] [client 81.167.26.57:30430] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeBVP1VQRS8nm73ENAloWQAAAEM"]
[Thu Apr 16 11:19:30.046109 2026] [:error] [pid 57537:tid 57599] [client 81.167.26.57:29199] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeBVQlVQRS8nm73ENAloXQAAAFg"]
[Thu Apr 16 11:19:32.643422 2026] [:error] [pid 57639:tid 57650] [client 81.167.26.57:36646] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeBVRKMCQoTw7TsxWulXlgAAAMQ"]
[Thu Apr 16 11:19:34.505488 2026] [:error] [pid 7880:tid 7901] [client 81.167.26.57:33818] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeBVRqaezm4fSGc0yUL86QAAAZA"]
[Thu Apr 16 11:19:37.079631 2026] [:error] [pid 7880:tid 7898] [client 81.167.26.57:22034] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeBVSaaezm4fSGc0yUL89AAAAY0"]
[Thu Apr 16 11:19:39.098836 2026] [:error] [pid 57536:tid 57559] [client 81.167.26.57:34652] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeBVSyQU4faGja6jpDutZgAAAAs"]
[Thu Apr 16 11:19:41.684177 2026] [:error] [pid 57639:tid 57647] [client 81.167.26.57:35538] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeBVTaMCQoTw7TsxWulXnwAAAME"]
[Thu Apr 16 11:19:43.692624 2026] [:error] [pid 57538:tid 57615] [client 81.167.26.57:6821] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeBVT8uMaiEF5SVR2Bd9LwAAAI0"]
[Thu Apr 16 11:19:46.114949 2026] [:error] [pid 57538:tid 57618] [client 81.167.26.57:49713] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeBVUsuMaiEF5SVR2Bd9MgAAAJA"]
[Thu Apr 16 11:19:48.713843 2026] [:error] [pid 7880:tid 7895] [client 81.167.26.57:58909] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeBVVKaezm4fSGc0yUL9AQAAAYo"]
[Thu Apr 16 11:19:51.315516 2026] [:error] [pid 57639:tid 57666] [client 81.167.26.57:58596] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeBVV6MCQoTw7TsxWulXwAAAANQ"]
[Thu Apr 16 11:19:53.331957 2026] [:error] [pid 29603:tid 29608] [client 81.167.26.57:34675] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeBVWVfGOR6fpTWUAzolTQAAAQM"]
[Thu Apr 16 11:19:55.310516 2026] [:error] [pid 57537:tid 57592] [client 81.167.26.57:23558] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeBVW1VQRS8nm73ENAlobwAAAFE"]
[Thu Apr 16 11:19:57.294595 2026] [:error] [pid 57538:tid 57604] [client 81.167.26.57:15255] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeBVXcuMaiEF5SVR2Bd9RQAAAII"]
[Thu Apr 16 11:19:59.297495 2026] [:error] [pid 57639:tid 57666] [client 81.167.26.57:31995] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeBVX6MCQoTw7TsxWulXzwAAANQ"]
[Thu Apr 16 11:20:01.271376 2026] [:error] [pid 57537:tid 57577] [client 81.167.26.57:23143] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeBVYVVQRS8nm73ENAlocAAAAEI"]
[Thu Apr 16 11:20:03.300842 2026] [:error] [pid 57538:tid 57606] [client 81.167.26.57:33829] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeBVY8uMaiEF5SVR2Bd9UQAAAIQ"]
[Thu Apr 16 11:20:05.849052 2026] [:error] [pid 57538:tid 57613] [client 81.167.26.57:33504] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeBVZcuMaiEF5SVR2Bd9VwAAAIs"]
[Thu Apr 16 11:20:07.858151 2026] [:error] [pid 29603:tid 29619] [client 81.167.26.57:32622] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeBVZ1fGOR6fpTWUAzolVQAAAQ4"]
[Thu Apr 16 11:20:09.860101 2026] [:error] [pid 7880:tid 7901] [client 81.167.26.57:5550] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeBVaaaezm4fSGc0yUL9BAAAAZA"]
[Thu Apr 16 11:20:12.269845 2026] [:error] [pid 7880:tid 7901] [client 81.167.26.57:42634] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeBVbKaezm4fSGc0yUL9GwAAAZA"]
[Thu Apr 16 11:20:14.289968 2026] [:error] [pid 57639:tid 57665] [client 81.167.26.57:63257] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeBVbqMCQoTw7TsxWulX4QAAANM"]
[Thu Apr 16 11:20:36.581314 2026] [:error] [pid 29603:tid 29606] [client 81.167.26.57:51107] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeBVhFfGOR6fpTWUAzolXwAAAQE"]
[Thu Apr 16 11:20:39.147801 2026] [:error] [pid 7880:tid 7893] [client 81.167.26.57:46139] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeBVh6aezm4fSGc0yUL9UQAAAYg"]
[Thu Apr 16 11:20:41.758783 2026] [:error] [pid 29603:tid 29619] [client 81.167.26.57:45380] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeBViVfGOR6fpTWUAzolYgAAAQ4"]
[Thu Apr 16 11:20:44.381859 2026] [:error] [pid 7880:tid 7890] [client 81.167.26.57:32658] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeBVjKaezm4fSGc0yUL9XgAAAYU"]
[Thu Apr 16 11:20:46.972607 2026] [:error] [pid 57639:tid 57670] [client 81.167.26.57:18532] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeBVjqMCQoTw7TsxWulYHAAAANg"]
[Thu Apr 16 11:20:48.990006 2026] [:error] [pid 49094:tid 49103] [client 81.167.26.57:14953] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeBVkDbDwvcXorHR_MwNVQAAAUc"]
[Thu Apr 16 11:20:51.572276 2026] [:error] [pid 49094:tid 49112] [client 81.167.26.57:60421] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeBVkzbDwvcXorHR_MwNXAAAAVA"]
[Thu Apr 16 11:20:54.158455 2026] [:error] [pid 29603:tid 29612] [client 81.167.26.57:10409] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeBVllfGOR6fpTWUAzolaQAAAQc"]
[Thu Apr 16 11:20:56.755938 2026] [:error] [pid 57639:tid 57649] [client 81.167.26.57:5395] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeBVmKMCQoTw7TsxWulYKwAAAMM"]
[Thu Apr 16 11:20:59.371920 2026] [:error] [pid 29603:tid 29619] [client 81.167.26.57:10120] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeBVm1fGOR6fpTWUAzolcAAAAQ4"]
[Thu Apr 16 11:21:01.974935 2026] [:error] [pid 57538:tid 57605] [client 81.167.26.57:11901] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeBVncuMaiEF5SVR2Bd9ewAAAIM"]
[Thu Apr 16 11:21:03.982190 2026] [:error] [pid 7880:tid 7892] [client 81.167.26.57:60348] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeBVn6aezm4fSGc0yUL9eAAAAYc"]
[Thu Apr 16 11:21:07.476896 2026] [:error] [pid 7880:tid 7889] [client 81.167.26.57:4559] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeBVo6aezm4fSGc0yUL9gAAAAYQ"]
[Thu Apr 16 11:21:10.078320 2026] [:error] [pid 7880:tid 7891] [client 81.167.26.57:29623] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeBVpqaezm4fSGc0yUL9ggAAAYY"]
[Thu Apr 16 11:21:12.685267 2026] [:error] [pid 29603:tid 29628] [client 81.167.26.57:2401] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeBVqFfGOR6fpTWUAzoldwAAARc"]
[Thu Apr 16 11:21:15.285461 2026] [:error] [pid 57639:tid 57670] [client 81.167.26.57:20879] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeBVq6MCQoTw7TsxWulYUwAAANg"]
[Thu Apr 16 11:21:17.892935 2026] [:error] [pid 57639:tid 57655] [client 81.167.26.57:61304] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeBVraMCQoTw7TsxWulYYwAAAMk"]
[Thu Apr 16 11:21:20.470724 2026] [:error] [pid 7880:tid 7890] [client 81.167.26.57:51575] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeBVsKaezm4fSGc0yUL9iQAAAYU"]
[Thu Apr 16 11:21:21.736996 2026] [:error] [pid 7880:tid 7890] [client 81.167.26.57:17977] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeBVsaaezm4fSGc0yUL9mwAAAYU"]
[Thu Apr 16 11:21:25.785480 2026] [:error] [pid 7880:tid 7886] [client 81.167.26.57:53249] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeBVtaaezm4fSGc0yUL9rgAAAYE"]
[Thu Apr 16 11:57:17.847813 2026] [proxy_fcgi:error] [pid 49094:tid 49099] [client 158.158.123.234:30370] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 12:15:50.676417 2026] [:error] [pid 57537:tid 57577] [client 192.34.58.141:34908] [client 192.34.58.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aeBidlVQRS8nm73ENAlvwQAAAEI"]
[Thu Apr 16 13:17:20.904845 2026] [:error] [pid 57639:tid 57660] [client 194.247.173.99:60446] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeBw4KMCQoTw7TsxWumF_gAAAM4"]
[Thu Apr 16 13:17:25.515802 2026] [:error] [pid 49094:tid 49116] [client 194.247.173.99:54054] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeBw5TbDwvcXorHR_MwpaQAAAVQ"]
[Thu Apr 16 13:22:08.815902 2026] [:error] [pid 7880:tid 7904] [client 194.247.173.99:43968] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeByAKaezm4fSGc0yUIoSQAAAZM"]
[Thu Apr 16 13:22:12.237736 2026] [:error] [pid 7880:tid 7892] [client 194.247.173.99:33578] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeByBKaezm4fSGc0yUIoUQAAAYc"]
[Thu Apr 16 13:22:15.463986 2026] [:error] [pid 57639:tid 57658] [client 194.247.173.99:33594] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeByB6MCQoTw7TsxWumHkwAAAMw"]
[Thu Apr 16 13:22:18.504796 2026] [:error] [pid 7880:tid 7908] [client 194.247.173.99:33602] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeByCqaezm4fSGc0yUIoWgAAAZc"]
[Thu Apr 16 13:22:21.161462 2026] [:error] [pid 29603:tid 29607] [client 194.247.173.99:40834] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeByDVfGOR6fpTWUAzo6OwAAAQI"]
[Thu Apr 16 13:22:25.913348 2026] [:error] [pid 57639:tid 57650] [client 194.247.173.99:40838] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeByEaMCQoTw7TsxWumHowAAAMQ"]
[Thu Apr 16 13:22:28.489145 2026] [:error] [pid 57537:tid 57593] [client 194.247.173.99:40842] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeByFFVQRS8nm73ENAl38wAAAFI"]
[Thu Apr 16 13:22:31.374139 2026] [:error] [pid 57639:tid 57659] [client 194.247.173.99:47262] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeByF6MCQoTw7TsxWumHpgAAAM0"]
[Thu Apr 16 13:22:34.642144 2026] [:error] [pid 57639:tid 57653] [client 194.247.173.99:47272] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeByGqMCQoTw7TsxWumHqQAAAMc"]
[Thu Apr 16 13:22:37.674073 2026] [:error] [pid 49094:tid 49096] [client 194.247.173.99:47278] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeByHTbDwvcXorHR_Mwp5AAAAUA"]
[Thu Apr 16 13:22:42.127713 2026] [:error] [pid 57536:tid 57555] [client 194.247.173.99:40018] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeByIiQU4faGja6jpDvXuQAAAAc"]
[Thu Apr 16 13:22:44.998341 2026] [:error] [pid 7880:tid 7901] [client 194.247.173.99:40028] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeByJKaezm4fSGc0yUIoeAAAAZA"]
[Thu Apr 16 13:22:48.139570 2026] [:error] [pid 57536:tid 57571] [client 194.247.173.99:40044] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeByKCQU4faGja6jpDvXvQAAABc"]
[Thu Apr 16 13:22:51.725860 2026] [:error] [pid 57538:tid 57610] [client 194.247.173.99:51002] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeByK8uMaiEF5SVR2BeOHQAAAIg"]
[Thu Apr 16 13:22:55.035107 2026] [:error] [pid 57536:tid 57551] [client 194.247.173.99:51008] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeByLyQU4faGja6jpDvXwQAAAAM"]
[Thu Apr 16 13:22:58.134015 2026] [:error] [pid 57538:tid 57608] [client 194.247.173.99:51014] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeByMsuMaiEF5SVR2BeOIwAAAIY"]
[Thu Apr 16 13:23:02.338814 2026] [:error] [pid 49094:tid 49108] [client 194.247.173.99:57178] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeByNjbDwvcXorHR_Mwp9wAAAUw"]
[Thu Apr 16 13:23:05.207999 2026] [:error] [pid 57639:tid 57648] [client 194.247.173.99:57188] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeByOaMCQoTw7TsxWumHswAAAMI"]
[Thu Apr 16 14:07:23.297732 2026] [:error] [pid 57538:tid 57616] [client 49.51.245.241:55026] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeB8m8uMaiEF5SVR2BeSywAAAI4"]
[Thu Apr 16 15:06:10.572444 2026] [:error] [pid 49094:tid 49118] [client 43.157.52.37:41308] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeCKYjbDwvcXorHR_Mw6-wAAAVY"]
[Thu Apr 16 15:46:02.146763 2026] [:error] [pid 29603:tid 29615] [client 122.51.236.174:37640] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeCTulfGOR6fpTWUAzpLMwAAAQo"]
[Thu Apr 16 18:06:53.843291 2026] [autoindex:error] [pid 7880:tid 7903] [client 164.68.124.190:52589] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 16 20:04:07.554253 2026] [:error] [pid 57639:tid 57658] [client 43.156.204.134:45712] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeDQN6MCQoTw7TsxWultqQAAAMw"]
[Thu Apr 16 20:23:23.474360 2026] [:error] [pid 57639:tid 57647] [client 165.22.131.170:51577] [client 165.22.131.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.131.170, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeDUu6MCQoTw7TsxWul7aQAAAME"]
[Thu Apr 16 20:23:23.484541 2026] [proxy_fcgi:error] [pid 57639:tid 57647] [client 165.22.131.170:51577] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:08:53.578719 2026] [:error] [pid 49094:tid 49112] [client 45.130.203.148:48977] [client 45.130.203.148] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/HEAD"] [unique_id "aeDtdTbDwvcXorHR_Mz8MgAAAVA"]
[Thu Apr 16 22:09:47.815618 2026] [:error] [pid 49094:tid 49113] [client 111.172.249.49:55184] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeDtqzbDwvcXorHR_Mz8XQAAAVE"]
[Thu Apr 16 22:18:09.091183 2026] [proxy_fcgi:error] [pid 57639:tid 57646] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:09.336794 2026] [proxy_fcgi:error] [pid 57639:tid 57670] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:09.576550 2026] [proxy_fcgi:error] [pid 57639:tid 57668] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:09.986768 2026] [proxy_fcgi:error] [pid 57639:tid 57661] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:10.261180 2026] [proxy_fcgi:error] [pid 57639:tid 57654] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:10.500637 2026] [proxy_fcgi:error] [pid 57639:tid 57667] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:10.740031 2026] [proxy_fcgi:error] [pid 57639:tid 57669] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:10.996742 2026] [proxy_fcgi:error] [pid 57639:tid 57658] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:11.476610 2026] [proxy_fcgi:error] [pid 57639:tid 57659] [client 20.203.186.201:15195] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:18:11.712150 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:15195] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeDvo6MCQoTw7TsxWunaggAAAMs"]
[Thu Apr 16 22:18:12.395311 2026] [:error] [pid 57536:tid 57554] [client 20.203.186.201:29148] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeDvpCQU4faGja6jpDuYKgAAAAY"]
[Thu Apr 16 22:18:12.989673 2026] [:error] [pid 57536:tid 57551] [client 20.203.186.201:63282] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeDvpCQU4faGja6jpDuYLAAAAAM"]
[Thu Apr 16 22:18:13.597818 2026] [:error] [pid 29603:tid 29620] [client 20.203.186.201:63252] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeDvpVfGOR6fpTWUAzqopwAAAQ8"]
[Thu Apr 16 22:18:14.217186 2026] [:error] [pid 7880:tid 7889] [client 20.203.186.201:49561] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeDvpqaezm4fSGc0yUK_ZwAAAYQ"]
[Thu Apr 16 22:18:14.963949 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:63284] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeDvpqaezm4fSGc0yUK_awAAAZU"]
[Thu Apr 16 22:18:15.564082 2026] [:error] [pid 7880:tid 7892] [client 20.203.186.201:15170] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeDvp6aezm4fSGc0yUK_cAAAAYc"]
[Thu Apr 16 22:18:16.191251 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:15186] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeDvqKMCQoTw7TsxWunaiAAAANI"]
[Thu Apr 16 22:18:16.870363 2026] [:error] [pid 7880:tid 7889] [client 20.203.186.201:29154] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeDvqKaezm4fSGc0yUK_eQAAAYQ"]
[Thu Apr 16 22:18:17.497930 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:63267] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeDvqTbDwvcXorHR_MwAqwAAAUQ"]
[Thu Apr 16 22:18:18.284546 2026] [:error] [pid 29603:tid 29614] [client 20.203.186.201:63249] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeDvqlfGOR6fpTWUAzqorwAAAQk"]
[Thu Apr 16 22:18:19.020492 2026] [:error] [pid 7880:tid 7901] [client 20.203.186.201:63233] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeDvq6aezm4fSGc0yUK_gAAAAZA"]
[Thu Apr 16 22:18:19.967800 2026] [:error] [pid 7880:tid 7888] [client 20.203.186.201:63248] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeDvq6aezm4fSGc0yUK_gQAAAYM"]
[Thu Apr 16 22:18:20.903751 2026] [:error] [pid 57536:tid 57554] [client 20.203.186.201:63258] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeDvrCQU4faGja6jpDuYOgAAAAY"]
[Thu Apr 16 22:18:21.829017 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:63251] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeDvrTbDwvcXorHR_MwAtAAAAUE"]
[Thu Apr 16 22:18:22.685384 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:29144] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeDvrjbDwvcXorHR_MwAuAAAAUg"]
[Thu Apr 16 22:18:23.597551 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:15198] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeDvrzbDwvcXorHR_MwAvQAAAUM"]
[Thu Apr 16 22:18:24.300776 2026] [:error] [pid 29603:tid 29608] [client 20.203.186.201:29150] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeDvsFfGOR6fpTWUAzqouQAAAQM"]
[Thu Apr 16 22:18:25.091417 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:15169] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeDvsVfGOR6fpTWUAzqovQAAAQ0"]
[Thu Apr 16 22:18:25.902169 2026] [:error] [pid 57536:tid 57569] [client 20.203.186.201:15194] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeDvsSQU4faGja6jpDuYRQAAABU"]
[Thu Apr 16 22:18:26.557782 2026] [:error] [pid 57538:tid 57624] [client 20.203.186.201:29143] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeDvssuMaiEF5SVR2BfxhQAAAJY"]
[Thu Apr 16 22:18:27.563808 2026] [:error] [pid 57538:tid 57610] [client 20.203.186.201:63237] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeDvs8uMaiEF5SVR2BfxiAAAAIg"]
[Thu Apr 16 22:18:28.273338 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:29121] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeDvtDbDwvcXorHR_MwAzQAAAUQ"]
[Thu Apr 16 22:18:29.001861 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:29178] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeDvtTbDwvcXorHR_MwA0AAAAUo"]
[Thu Apr 16 22:18:29.834252 2026] [:error] [pid 57536:tid 57556] [client 20.203.186.201:49559] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeDvtSQU4faGja6jpDuYTAAAAAg"]
[Thu Apr 16 22:18:30.609715 2026] [:error] [pid 7880:tid 7885] [client 20.203.186.201:63268] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeDvtqaezm4fSGc0yUK_jwAAAYA"]
[Thu Apr 16 22:18:31.465210 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:49552] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeDvtzbDwvcXorHR_MwA1AAAAUg"]
[Thu Apr 16 22:18:32.299931 2026] [:error] [pid 57536:tid 57569] [client 20.203.186.201:63257] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeDvuCQU4faGja6jpDuYTwAAABU"]
[Thu Apr 16 22:18:32.985368 2026] [:error] [pid 29603:tid 29610] [client 20.203.186.201:15213] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeDvuFfGOR6fpTWUAzqovwAAAQU"]
[Thu Apr 16 22:18:33.934870 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:49540] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeDvuTbDwvcXorHR_MwA3QAAAVU"]
[Thu Apr 16 22:18:34.727958 2026] [:error] [pid 57536:tid 57559] [client 20.203.186.201:29141] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeDvuiQU4faGja6jpDuYWAAAAAs"]
[Thu Apr 16 22:18:35.908656 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:49546] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeDvuyQU4faGja6jpDuYWwAAABM"]
[Thu Apr 16 22:18:37.448958 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:29160] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeDvvTbDwvcXorHR_MwA5AAAAVQ"]
[Thu Apr 16 22:18:38.455181 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:49555] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeDvvqMCQoTw7TsxWunangAAANU"]
[Thu Apr 16 22:18:39.288855 2026] [:error] [pid 57536:tid 57564] [client 20.203.186.201:49570] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeDvvyQU4faGja6jpDuYZAAAABA"]
[Thu Apr 16 22:18:40.629541 2026] [:error] [pid 57536:tid 57551] [client 20.203.186.201:49551] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeDvwCQU4faGja6jpDuYZwAAAAM"]
[Thu Apr 16 22:18:41.699831 2026] [:error] [pid 29603:tid 29609] [client 20.203.186.201:29183] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeDvwVfGOR6fpTWUAzqoyQAAAQQ"]
[Thu Apr 16 22:18:43.477321 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:49539] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeDvw6MCQoTw7TsxWunaqwAAAMY"]
[Thu Apr 16 22:18:44.153545 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:49538] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeDvxKMCQoTw7TsxWunasQAAAMs"]
[Thu Apr 16 22:18:45.179728 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:29120] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeDvxaMCQoTw7TsxWunatAAAANE"]
[Thu Apr 16 22:18:46.131087 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:15212] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeDvxqMCQoTw7TsxWunaugAAAMM"]
[Thu Apr 16 22:18:46.869415 2026] [:error] [pid 29603:tid 29627] [client 20.203.186.201:63294] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeDvxlfGOR6fpTWUAzqozQAAARY"]
[Thu Apr 16 22:18:47.672020 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:15203] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeDvxzbDwvcXorHR_MwA6QAAAUw"]
[Thu Apr 16 22:18:48.541546 2026] [:error] [pid 29603:tid 29606] [client 20.203.186.201:63247] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeDvyFfGOR6fpTWUAzqozwAAAQE"]
[Thu Apr 16 22:18:49.136280 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:15173] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeDvyTbDwvcXorHR_MwA7AAAAVc"]
[Thu Apr 16 22:18:50.198156 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:50471] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeDvyjbDwvcXorHR_MwA8AAAAUc"]
[Thu Apr 16 22:18:50.950019 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:15190] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeDvyjbDwvcXorHR_MwA9AAAAVU"]
[Thu Apr 16 22:18:51.671519 2026] [:error] [pid 49094:tid 49102] [client 20.203.186.201:15184] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeDvyzbDwvcXorHR_MwA-AAAAUY"]
[Thu Apr 16 22:18:52.754708 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:29140] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeDvzDbDwvcXorHR_MwA_AAAAVc"]
[Thu Apr 16 22:18:53.469326 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:15184] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeDvzSQU4faGja6jpDuYeQAAAA4"]
[Thu Apr 16 22:18:54.501014 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:49556] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeDvziQU4faGja6jpDuYfAAAABM"]
[Thu Apr 16 22:18:55.367286 2026] [:error] [pid 57536:tid 57550] [client 20.203.186.201:63255] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeDvzyQU4faGja6jpDuYfgAAAAI"]
[Thu Apr 16 22:18:56.441202 2026] [:error] [pid 57537:tid 57580] [client 20.203.186.201:63264] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeDv0FVQRS8nm73ENAnDOgAAAEU"]
[Thu Apr 16 22:18:57.169018 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:29149] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeDv0aMCQoTw7TsxWunaxAAAANE"]
[Thu Apr 16 22:18:58.169500 2026] [:error] [pid 29603:tid 29606] [client 20.203.186.201:50457] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeDv0lfGOR6fpTWUAzqo2gAAAQE"]
[Thu Apr 16 22:18:59.277389 2026] [:error] [pid 57538:tid 57614] [client 20.203.186.201:50478] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeDv08uMaiEF5SVR2BfxmgAAAIw"]
[Thu Apr 16 22:19:00.113302 2026] [:error] [pid 29603:tid 29612] [client 20.203.186.201:29153] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeDv1FfGOR6fpTWUAzqo4AAAAQc"]
[Thu Apr 16 22:19:00.862867 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:49544] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeDv1FfGOR6fpTWUAzqo4gAAAQ0"]
[Thu Apr 16 22:19:01.921853 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:29168] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeDv1TbDwvcXorHR_MwBBAAAAUQ"]
[Thu Apr 16 22:19:02.637551 2026] [:error] [pid 29603:tid 29614] [client 20.203.186.201:15179] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeDv1lfGOR6fpTWUAzqo5QAAAQk"]
[Thu Apr 16 22:19:03.386553 2026] [:error] [pid 29603:tid 29623] [client 20.203.186.201:29164] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeDv11fGOR6fpTWUAzqo6QAAARI"]
[Thu Apr 16 22:19:04.229361 2026] [:error] [pid 7880:tid 7888] [client 20.203.186.201:29128] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeDv2Kaezm4fSGc0yUK_xQAAAYM"]
[Thu Apr 16 22:19:04.960394 2026] [:error] [pid 57536:tid 57571] [client 20.203.186.201:63260] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeDv2CQU4faGja6jpDuYjAAAABc"]
[Thu Apr 16 22:19:05.780462 2026] [:error] [pid 57639:tid 57662] [client 20.203.186.201:49560] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeDv2aMCQoTw7TsxWuna1AAAANA"]
[Thu Apr 16 22:19:06.674876 2026] [:error] [pid 57538:tid 57612] [client 20.203.186.201:29155] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeDv2suMaiEF5SVR2BfxpQAAAIo"]
[Thu Apr 16 22:19:08.012611 2026] [:error] [pid 29603:tid 29615] [client 20.203.186.201:49536] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeDv3FfGOR6fpTWUAzqo7wAAAQo"]
[Thu Apr 16 22:19:08.964730 2026] [:error] [pid 57537:tid 57575] [client 20.203.186.201:49556] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeDv3FVQRS8nm73ENAnDQgAAAEA"]
[Thu Apr 16 22:19:10.342099 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:63239] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeDv3iQU4faGja6jpDuYlwAAABM"]
[Thu Apr 16 22:19:11.344372 2026] [proxy_fcgi:error] [pid 49094:tid 49110] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:11.649477 2026] [proxy_fcgi:error] [pid 49094:tid 49113] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:11.964763 2026] [proxy_fcgi:error] [pid 49094:tid 49115] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:12.514922 2026] [proxy_fcgi:error] [pid 49094:tid 49111] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:12.816734 2026] [proxy_fcgi:error] [pid 49094:tid 49102] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:13.117197 2026] [proxy_fcgi:error] [pid 49094:tid 49098] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:14.639931 2026] [proxy_fcgi:error] [pid 49094:tid 49101] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:14.945972 2026] [proxy_fcgi:error] [pid 49094:tid 49120] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:15.375552 2026] [proxy_fcgi:error] [pid 49094:tid 49118] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:16.347265 2026] [proxy_fcgi:error] [pid 49094:tid 49099] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:16.658163 2026] [proxy_fcgi:error] [pid 49094:tid 49109] [client 20.203.186.201:63283] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:19:17.013686 2026] [:error] [pid 49094:tid 49110] [client 20.203.186.201:63283] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeDv5TbDwvcXorHR_MwBHQAAAU4"]
[Thu Apr 16 22:19:18.005870 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:15225] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeDv5qMCQoTw7TsxWuna4gAAAMw"]
[Thu Apr 16 22:19:18.978679 2026] [:error] [pid 7880:tid 7888] [client 20.203.186.201:15216] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeDv5qaezm4fSGc0yUK_0wAAAYM"]
[Thu Apr 16 22:19:20.250058 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:29173] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeDv6CQU4faGja6jpDuYngAAAAw"]
[Thu Apr 16 22:19:21.283713 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:29137] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeDv6TbDwvcXorHR_MwBIAAAAUs"]
[Thu Apr 16 22:19:22.436009 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:15199] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeDv6jbDwvcXorHR_MwBIgAAAUw"]
[Thu Apr 16 22:19:23.378070 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:63263] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeDv6zbDwvcXorHR_MwBJAAAAUI"]
[Thu Apr 16 22:19:24.284615 2026] [:error] [pid 29603:tid 29616] [client 20.203.186.201:15189] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeDv7FfGOR6fpTWUAzqo-AAAAQs"]
[Thu Apr 16 22:19:25.068210 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:63272] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeDv7TbDwvcXorHR_MwBKQAAAUg"]
[Thu Apr 16 22:19:26.293710 2026] [:error] [pid 57538:tid 57622] [client 20.203.186.201:29133] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeDv7suMaiEF5SVR2BfxtAAAAJQ"]
[Thu Apr 16 22:19:27.284890 2026] [:error] [pid 57536:tid 57563] [client 20.203.186.201:49576] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeDv7yQU4faGja6jpDuYrAAAAA8"]
[Thu Apr 16 22:19:28.451437 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:63253] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeDv8KMCQoTw7TsxWuna6gAAAMQ"]
[Thu Apr 16 22:19:29.158997 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:63265] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeDv8aMCQoTw7TsxWuna7wAAAMk"]
[Thu Apr 16 22:19:30.103848 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:50658] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeDv8qMCQoTw7TsxWuna9QAAAMI"]
[Thu Apr 16 22:19:30.755832 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:50683] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeDv8jbDwvcXorHR_MwBNgAAAVU"]
[Thu Apr 16 22:19:31.448094 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:49543] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeDv86MCQoTw7TsxWuna-QAAANI"]
[Thu Apr 16 22:19:32.265381 2026] [:error] [pid 57538:tid 57625] [client 20.203.186.201:63241] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeDv9MuMaiEF5SVR2BfxtwAAAJc"]
[Thu Apr 16 22:19:33.220794 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:63275] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeDv9aMCQoTw7TsxWuna_QAAAMc"]
[Thu Apr 16 22:19:33.812748 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:29147] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeDv9aMCQoTw7TsxWuna_wAAAMg"]
[Thu Apr 16 22:19:34.556319 2026] [:error] [pid 57536:tid 57557] [client 20.203.186.201:63269] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeDv9iQU4faGja6jpDuYtQAAAAk"]
[Thu Apr 16 22:19:35.379620 2026] [:error] [pid 57538:tid 57611] [client 20.203.186.201:15230] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeDv98uMaiEF5SVR2BfxvQAAAIk"]
[Thu Apr 16 22:19:36.093438 2026] [:error] [pid 7880:tid 7890] [client 20.203.186.201:29131] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeDv-Kaezm4fSGc0yUK_3wAAAYU"]
[Thu Apr 16 22:19:36.946347 2026] [:error] [pid 57538:tid 57608] [client 20.203.186.201:49586] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeDv-MuMaiEF5SVR2BfxxQAAAIY"]
[Thu Apr 16 22:19:38.210663 2026] [:error] [pid 57536:tid 57562] [client 20.203.186.201:50654] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeDv-iQU4faGja6jpDuYuwAAAA4"]
[Thu Apr 16 22:19:39.159176 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:63238] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeDv-yQU4faGja6jpDuYwAAAAAA"]
[Thu Apr 16 22:19:39.801690 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:49537] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeDv-6aezm4fSGc0yUK_4gAAAZQ"]
[Thu Apr 16 22:19:40.565566 2026] [:error] [pid 57538:tid 57610] [client 20.203.186.201:50480] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeDv_MuMaiEF5SVR2BfxyQAAAIg"]
[Thu Apr 16 22:19:41.205702 2026] [:error] [pid 57538:tid 57619] [client 20.203.186.201:49541] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeDv_cuMaiEF5SVR2BfxywAAAJE"]
[Thu Apr 16 22:19:41.777889 2026] [:error] [pid 57538:tid 57606] [client 20.203.186.201:27207] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeDv_cuMaiEF5SVR2Bfx0AAAAIQ"]
[Thu Apr 16 22:19:42.725317 2026] [:error] [pid 7880:tid 7889] [client 20.203.186.201:50651] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeDv_qaezm4fSGc0yUK_5gAAAYQ"]
[Thu Apr 16 22:19:43.528583 2026] [:error] [pid 7880:tid 7904] [client 20.203.186.201:63234] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeDv_6aezm4fSGc0yUK_6QAAAZM"]
[Thu Apr 16 22:19:44.360796 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:49578] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeDwADbDwvcXorHR_MwBSAAAAUQ"]
[Thu Apr 16 22:19:45.237514 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:29161] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeDwATbDwvcXorHR_MwBSQAAAVQ"]
[Thu Apr 16 22:19:45.905952 2026] [:error] [pid 49094:tid 49101] [client 20.203.186.201:63256] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeDwATbDwvcXorHR_MwBTAAAAUU"]
[Thu Apr 16 22:19:46.485104 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:63292] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeDwAjbDwvcXorHR_MwBTwAAAUE"]
[Thu Apr 16 22:19:47.428047 2026] [:error] [pid 7880:tid 7892] [client 20.203.186.201:63286] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeDwA6aezm4fSGc0yUK_9wAAAYc"]
[Thu Apr 16 22:19:48.284810 2026] [:error] [pid 7880:tid 7901] [client 20.203.186.201:63242] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeDwBKaezm4fSGc0yUK_-QAAAZA"]
[Thu Apr 16 22:19:48.947666 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:29159] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeDwBCQU4faGja6jpDuY0gAAAAc"]
[Thu Apr 16 22:19:50.276767 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:15204] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeDwBqMCQoTw7TsxWunbFAAAAMo"]
[Thu Apr 16 22:19:51.162414 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:15227] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeDwByQU4faGja6jpDuY2gAAAAE"]
[Thu Apr 16 22:19:52.073948 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:50677] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeDwCCQU4faGja6jpDuY4AAAAAQ"]
[Thu Apr 16 22:19:53.072250 2026] [:error] [pid 57538:tid 57603] [client 20.203.186.201:49593] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeDwCcuMaiEF5SVR2Bfx0wAAAIE"]
[Thu Apr 16 22:19:54.789941 2026] [:error] [pid 7880:tid 7890] [client 20.203.186.201:29169] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeDwCqaezm4fSGc0yUK_-gAAAYU"]
[Thu Apr 16 22:19:56.675164 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:15174] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeDwDKMCQoTw7TsxWunbIAAAAMI"]
[Thu Apr 16 22:20:01.236643 2026] [:error] [pid 57538:tid 57614] [client 20.203.186.201:27241] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeDwEcuMaiEF5SVR2Bfx2gAAAIw"]
[Thu Apr 16 22:20:02.138502 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:49548] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeDwEqMCQoTw7TsxWunbNAAAANM"]
[Thu Apr 16 22:20:02.796383 2026] [:error] [pid 49094:tid 49103] [client 20.203.186.201:11156] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeDwEjbDwvcXorHR_MwBagAAAUc"]
[Thu Apr 16 22:20:03.483545 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:63259] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeDwE6MCQoTw7TsxWunbQAAAAMM"]
[Thu Apr 16 22:20:04.426107 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:63270] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeDwFKMCQoTw7TsxWunbRgAAAMk"]
[Thu Apr 16 22:20:05.377462 2026] [:error] [pid 57538:tid 57617] [client 20.203.186.201:50668] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeDwFcuMaiEF5SVR2Bfx3QAAAI8"]
[Thu Apr 16 22:20:06.167472 2026] [:error] [pid 57639:tid 57670] [client 20.203.186.201:50649] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeDwFqMCQoTw7TsxWunbUAAAANg"]
[Thu Apr 16 22:20:06.908269 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:63246] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeDwFqMCQoTw7TsxWunbUgAAANQ"]
[Thu Apr 16 22:20:07.638960 2026] [:error] [pid 29603:tid 29606] [client 20.203.186.201:29145] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeDwF1fGOR6fpTWUAzqpDAAAAQE"]
[Thu Apr 16 22:20:08.512971 2026] [:error] [pid 7880:tid 7891] [client 20.203.186.201:29171] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeDwGKaezm4fSGc0yULAAgAAAYY"]
[Thu Apr 16 22:20:09.175034 2026] [:error] [pid 29603:tid 29615] [client 20.203.186.201:50681] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeDwGVfGOR6fpTWUAzqpDgAAAQo"]
[Thu Apr 16 22:20:10.169203 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:15207] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeDwGiQU4faGja6jpDuY7gAAAAA"]
[Thu Apr 16 22:20:10.785810 2026] [:error] [pid 7880:tid 7903] [client 20.203.186.201:15201] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeDwGqaezm4fSGc0yULABwAAAZI"]
[Thu Apr 16 22:20:11.876573 2026] [:error] [pid 7880:tid 7886] [client 20.203.186.201:15177] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeDwG6aezm4fSGc0yULADAAAAYE"]
[Thu Apr 16 22:20:12.593204 2026] [:error] [pid 57537:tid 57598] [client 20.203.186.201:15168] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeDwHFVQRS8nm73ENAnDWQAAAFc"]
[Thu Apr 16 22:20:13.284918 2026] [:error] [pid 7880:tid 7887] [client 20.203.186.201:49553] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeDwHaaezm4fSGc0yULADwAAAYI"]
[Thu Apr 16 22:20:13.903703 2026] [:error] [pid 57538:tid 57622] [client 20.203.186.201:15188] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeDwHcuMaiEF5SVR2Bfx5wAAAJQ"]
[Thu Apr 16 22:20:14.734653 2026] [:error] [pid 57538:tid 57620] [client 20.203.186.201:63273] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeDwHsuMaiEF5SVR2Bfx6AAAAJI"]
[Thu Apr 16 22:20:15.482856 2026] [:error] [pid 7880:tid 7909] [client 20.203.186.201:15229] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeDwH6aezm4fSGc0yULAEgAAAZg"]
[Thu Apr 16 22:20:16.109428 2026] [proxy_fcgi:error] [pid 57639:tid 57658] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:16.377722 2026] [proxy_fcgi:error] [pid 57639:tid 57661] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:16.666616 2026] [proxy_fcgi:error] [pid 57639:tid 57653] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:16.947402 2026] [proxy_fcgi:error] [pid 57639:tid 57651] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:17.216319 2026] [proxy_fcgi:error] [pid 57639:tid 57646] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:17.496696 2026] [proxy_fcgi:error] [pid 57639:tid 57668] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:17.777141 2026] [proxy_fcgi:error] [pid 57639:tid 57648] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:18.045901 2026] [proxy_fcgi:error] [pid 57639:tid 57665] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:18.328216 2026] [proxy_fcgi:error] [pid 57639:tid 57660] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:18.643717 2026] [proxy_fcgi:error] [pid 57639:tid 57666] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:18.947468 2026] [proxy_fcgi:error] [pid 57639:tid 57663] [client 20.203.186.201:15182] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:20:19.223697 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:15182] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeDwI6MCQoTw7TsxWunbdwAAAMw"]
[Thu Apr 16 22:20:19.811250 2026] [:error] [pid 57538:tid 57610] [client 20.203.186.201:63287] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeDwI8uMaiEF5SVR2Bfx6gAAAIg"]
[Thu Apr 16 22:20:20.597424 2026] [:error] [pid 57537:tid 57589] [client 20.203.186.201:50687] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeDwJFVQRS8nm73ENAnDYwAAAE4"]
[Thu Apr 16 22:20:21.242007 2026] [:error] [pid 57536:tid 57553] [client 20.203.186.201:29182] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeDwJSQU4faGja6jpDuY_QAAAAU"]
[Thu Apr 16 22:20:21.816926 2026] [:error] [pid 7880:tid 7889] [client 20.203.186.201:15206] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeDwJaaezm4fSGc0yULAHQAAAYQ"]
[Thu Apr 16 22:20:22.472560 2026] [:error] [pid 7880:tid 7897] [client 20.203.186.201:49582] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeDwJqaezm4fSGc0yULAIAAAAYw"]
[Thu Apr 16 22:20:23.086599 2026] [:error] [pid 7880:tid 7886] [client 20.203.186.201:15228] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeDwJ6aezm4fSGc0yULAJAAAAYE"]
[Thu Apr 16 22:20:23.724602 2026] [:error] [pid 7880:tid 7896] [client 20.203.186.201:50661] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeDwJ6aezm4fSGc0yULAJgAAAYs"]
[Thu Apr 16 22:20:24.319504 2026] [:error] [pid 57538:tid 57611] [client 20.203.186.201:15231] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeDwKMuMaiEF5SVR2Bfx7QAAAIk"]
[Thu Apr 16 22:20:24.838503 2026] [:error] [pid 57537:tid 57588] [client 20.203.186.201:15211] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeDwKFVQRS8nm73ENAnDbgAAAE0"]
[Thu Apr 16 22:20:25.687555 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:29123] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeDwKaMCQoTw7TsxWunbhAAAAM8"]
[Thu Apr 16 22:20:26.408044 2026] [:error] [pid 7880:tid 7900] [client 20.203.186.201:29165] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeDwKqaezm4fSGc0yULALQAAAY8"]
[Thu Apr 16 22:20:27.181147 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:29134] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeDwK6MCQoTw7TsxWunbiQAAANY"]
[Thu Apr 16 22:20:27.909036 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:50639] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeDwKyQU4faGja6jpDuZEwAAABM"]
[Thu Apr 16 22:20:28.856125 2026] [:error] [pid 7880:tid 7886] [client 20.203.186.201:63289] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeDwLKaezm4fSGc0yULALwAAAYE"]
[Thu Apr 16 22:20:29.579072 2026] [:error] [pid 29603:tid 29624] [client 20.203.186.201:50438] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeDwLVfGOR6fpTWUAzqpFwAAARM"]
[Thu Apr 16 22:20:30.506229 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:50439] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeDwLqMCQoTw7TsxWunblwAAANU"]
[Thu Apr 16 22:20:31.167621 2026] [:error] [pid 57639:tid 57662] [client 20.203.186.201:29122] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeDwL6MCQoTw7TsxWunbnAAAANA"]
[Thu Apr 16 22:20:32.031335 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:50454] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeDwMKMCQoTw7TsxWunboQAAAM0"]
[Thu Apr 16 22:20:32.927356 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:29124] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeDwMKMCQoTw7TsxWunbpAAAANU"]
[Thu Apr 16 22:20:34.210559 2026] [:error] [pid 57537:tid 57575] [client 20.203.186.201:29129] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeDwMlVQRS8nm73ENAnDcgAAAEA"]
[Thu Apr 16 22:20:35.105325 2026] [:error] [pid 49094:tid 49110] [client 20.203.186.201:50686] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeDwMzbDwvcXorHR_MwBewAAAU4"]
[Thu Apr 16 22:20:36.113082 2026] [:error] [pid 7880:tid 7908] [client 20.203.186.201:50432] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeDwNKaezm4fSGc0yULANAAAAZc"]
[Thu Apr 16 22:20:36.941750 2026] [:error] [pid 57538:tid 57619] [client 20.203.186.201:29146] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeDwNMuMaiEF5SVR2Bfx_AAAAJE"]
[Thu Apr 16 22:20:37.623782 2026] [:error] [pid 57639:tid 57655] [client 20.203.186.201:50482] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeDwNaMCQoTw7TsxWunbqwAAAMk"]
[Thu Apr 16 22:20:38.503805 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:63276] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeDwNqMCQoTw7TsxWunbsQAAAM4"]
[Thu Apr 16 22:20:39.268881 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:15205] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeDwNzbDwvcXorHR_MwBggAAAVI"]
[Thu Apr 16 22:20:40.315231 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:49549] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeDwOCQU4faGja6jpDuZIAAAABg"]
[Thu Apr 16 22:20:41.381278 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:63281] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeDwOaMCQoTw7TsxWunbuAAAAM4"]
[Thu Apr 16 22:20:42.026321 2026] [:error] [pid 57537:tid 57581] [client 20.203.186.201:50491] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeDwOlVQRS8nm73ENAnDdwAAAEY"]
[Thu Apr 16 22:20:42.828800 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:63245] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeDwOiQU4faGja6jpDuZIQAAABM"]
[Thu Apr 16 22:20:44.229156 2026] [:error] [pid 57537:tid 57577] [client 20.203.186.201:50643] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeDwPFVQRS8nm73ENAnDewAAAEI"]
[Thu Apr 16 22:20:45.021667 2026] [:error] [pid 57537:tid 57578] [client 20.203.186.201:50646] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeDwPVVQRS8nm73ENAnDfgAAAEM"]
[Thu Apr 16 22:20:45.901414 2026] [:error] [pid 29603:tid 29622] [client 20.203.186.201:27206] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeDwPVfGOR6fpTWUAzqpJwAAARE"]
[Thu Apr 16 22:20:47.249182 2026] [:error] [pid 57538:tid 57610] [client 20.203.186.201:63278] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeDwP8uMaiEF5SVR2BfyBQAAAIg"]
[Thu Apr 16 22:20:48.111056 2026] [:error] [pid 29603:tid 29612] [client 20.203.186.201:29127] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeDwQFfGOR6fpTWUAzqpLwAAAQc"]
[Thu Apr 16 22:20:49.331853 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:29177] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwQTbDwvcXorHR_MwBkAAAAVM"]
[Thu Apr 16 22:20:50.424090 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:29166] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwQqMCQoTw7TsxWunbvQAAANc"]
[Thu Apr 16 22:20:51.585627 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:29139] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwQzbDwvcXorHR_MwBkwAAAVU"]
[Thu Apr 16 22:20:52.456645 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:15172] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwRKMCQoTw7TsxWunbwwAAAMs"]
[Thu Apr 16 22:20:53.170156 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:50446] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeDwRaMCQoTw7TsxWunbyAAAAM4"]
[Thu Apr 16 22:20:54.295597 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:63266] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeDwRqMCQoTw7TsxWunbzgAAANE"]
[Thu Apr 16 22:20:55.027772 2026] [:error] [pid 57536:tid 57553] [client 20.203.186.201:15209] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeDwRyQU4faGja6jpDuZKAAAAAU"]
[Thu Apr 16 22:20:55.902363 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:29135] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeDwR6MCQoTw7TsxWunb3AAAAM0"]
[Thu Apr 16 22:20:56.810599 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:29152] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeDwSKMCQoTw7TsxWunb5QAAANM"]
[Thu Apr 16 22:20:57.884707 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:15226] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeDwSaMCQoTw7TsxWunb7gAAAME"]
[Thu Apr 16 22:20:58.500875 2026] [:error] [pid 57538:tid 57606] [client 20.203.186.201:15191] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeDwSsuMaiEF5SVR2BfyCgAAAIQ"]
[Thu Apr 16 22:20:59.294076 2026] [:error] [pid 57538:tid 57626] [client 20.203.186.201:29174] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeDwS8uMaiEF5SVR2BfyCwAAAJg"]
[Thu Apr 16 22:21:00.035842 2026] [:error] [pid 7880:tid 7909] [client 20.203.186.201:29170] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeDwTKaezm4fSGc0yULATQAAAZg"]
[Thu Apr 16 22:21:00.800327 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:63250] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeDwTFfGOR6fpTWUAzqpOgAAAQ0"]
[Thu Apr 16 22:21:01.861403 2026] [:error] [pid 29603:tid 29622] [client 20.203.186.201:50628] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeDwTVfGOR6fpTWUAzqpQAAAARE"]
[Thu Apr 16 22:21:02.515219 2026] [:error] [pid 7880:tid 7897] [client 20.203.186.201:15217] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeDwTqaezm4fSGc0yULATwAAAYw"]
[Thu Apr 16 22:21:03.575911 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:15187] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeDwT6MCQoTw7TsxWunb-gAAAMQ"]
[Thu Apr 16 22:21:04.325421 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:15181] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeDwUKMCQoTw7TsxWunb-wAAAMA"]
[Thu Apr 16 22:21:05.092573 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:49572] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeDwUaMCQoTw7TsxWunb_gAAAMs"]
[Thu Apr 16 22:21:05.752872 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:49542] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeDwUaMCQoTw7TsxWuncAQAAAMw"]
[Thu Apr 16 22:21:06.730755 2026] [:error] [pid 7880:tid 7908] [client 20.203.186.201:50652] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeDwUqaezm4fSGc0yULAUgAAAZc"]
[Thu Apr 16 22:21:07.653270 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:27234] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeDwU6MCQoTw7TsxWuncCwAAANQ"]
[Thu Apr 16 22:21:08.353128 2026] [:error] [pid 57536:tid 57563] [client 20.203.186.201:50450] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeDwVCQU4faGja6jpDuZUQAAAA8"]
[Thu Apr 16 22:21:09.070353 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:50669] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeDwVaMCQoTw7TsxWuncDwAAANY"]
[Thu Apr 16 22:21:09.914789 2026] [:error] [pid 57537:tid 57593] [client 20.203.186.201:50666] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeDwVVVQRS8nm73ENAnDhgAAAFI"]
[Thu Apr 16 22:21:10.470739 2026] [:error] [pid 49094:tid 49107] [client 20.203.186.201:50663] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeDwVjbDwvcXorHR_MwBtAAAAUs"]
[Thu Apr 16 22:21:11.225745 2026] [:error] [pid 57536:tid 57558] [client 20.203.186.201:63291] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeDwVyQU4faGja6jpDuZWQAAAAo"]
[Thu Apr 16 22:21:11.849031 2026] [:error] [pid 57538:tid 57616] [client 20.203.186.201:25488] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeDwV8uMaiEF5SVR2BfyEgAAAI4"]
[Thu Apr 16 22:21:12.567596 2026] [:error] [pid 57537:tid 57589] [client 20.203.186.201:29162] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeDwWFVQRS8nm73ENAnDhwAAAE4"]
[Thu Apr 16 22:21:13.119789 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:49545] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeDwWTbDwvcXorHR_MwBuwAAAVc"]
[Thu Apr 16 22:21:13.830247 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:27227] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeDwWTbDwvcXorHR_MwBvAAAAUI"]
[Thu Apr 16 22:21:14.471557 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:29167] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeDwWqMCQoTw7TsxWuncEwAAAME"]
[Thu Apr 16 22:21:15.207622 2026] [:error] [pid 49094:tid 49115] [client 20.203.186.201:27200] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "aeDwWzbDwvcXorHR_MwBvwAAAVM"]
[Thu Apr 16 22:21:15.814848 2026] [:error] [pid 57537:tid 57582] [client 20.203.186.201:25488] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "aeDwW1VQRS8nm73ENAnDiAAAAEc"]
[Thu Apr 16 22:21:16.614385 2026] [:error] [pid 49094:tid 49113] [client 20.203.186.201:49574] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "aeDwXDbDwvcXorHR_MwBxAAAAVE"]
[Thu Apr 16 22:21:17.363169 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:15183] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "aeDwXTbDwvcXorHR_MwByAAAAUk"]
[Thu Apr 16 22:21:18.257886 2026] [proxy_fcgi:error] [pid 57536:tid 57556] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:18.530131 2026] [proxy_fcgi:error] [pid 57536:tid 57560] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:18.813700 2026] [proxy_fcgi:error] [pid 57536:tid 57567] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:19.160429 2026] [proxy_fcgi:error] [pid 57536:tid 57559] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:20.030113 2026] [proxy_fcgi:error] [pid 57536:tid 57549] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:20.303285 2026] [proxy_fcgi:error] [pid 57536:tid 57564] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:20.572077 2026] [proxy_fcgi:error] [pid 57536:tid 57557] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:20.893408 2026] [proxy_fcgi:error] [pid 57536:tid 57562] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:22.874965 2026] [proxy_fcgi:error] [pid 57536:tid 57562] [client 20.203.186.201:50625] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:21:23.196117 2026] [:error] [pid 57536:tid 57554] [client 20.203.186.201:50625] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeDwYyQU4faGja6jpDuZgwAAAAY"]
[Thu Apr 16 22:21:23.874425 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:49566] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeDwY6MCQoTw7TsxWuncHQAAAME"]
[Thu Apr 16 22:21:24.773118 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:15222] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeDwZDbDwvcXorHR_MwB2wAAAVA"]
[Thu Apr 16 22:21:25.518439 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:15197] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeDwZTbDwvcXorHR_MwB4QAAAUM"]
[Thu Apr 16 22:21:26.216697 2026] [:error] [pid 57536:tid 57564] [client 20.203.186.201:49571] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeDwZiQU4faGja6jpDuZkAAAABA"]
[Thu Apr 16 22:21:26.892424 2026] [:error] [pid 57536:tid 57557] [client 20.203.186.201:49581] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeDwZiQU4faGja6jpDuZkQAAAAk"]
[Thu Apr 16 22:21:27.549515 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:63277] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeDwZyQU4faGja6jpDuZkgAAAAA"]
[Thu Apr 16 22:21:28.399783 2026] [:error] [pid 7880:tid 7902] [client 20.203.186.201:15208] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeDwaKaezm4fSGc0yULAhgAAAZE"]
[Thu Apr 16 22:21:29.087970 2026] [:error] [pid 57538:tid 57625] [client 20.203.186.201:49597] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwacuMaiEF5SVR2BfyIwAAAJc"]
[Thu Apr 16 22:21:29.714818 2026] [:error] [pid 57537:tid 57579] [client 20.203.186.201:29136] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwaVVQRS8nm73ENAnDkwAAAEQ"]
[Thu Apr 16 22:21:30.369280 2026] [:error] [pid 57536:tid 57561] [client 20.203.186.201:49592] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwaiQU4faGja6jpDuZmgAAAA0"]
[Thu Apr 16 22:21:30.898297 2026] [:error] [pid 57536:tid 57569] [client 20.203.186.201:15224] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwaiQU4faGja6jpDuZnAAAABU"]
[Thu Apr 16 22:21:31.524659 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:29156] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeDwa6aezm4fSGc0yULAkQAAAZQ"]
[Thu Apr 16 22:21:32.241223 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:25509] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeDwbDbDwvcXorHR_MwB8wAAAUQ"]
[Thu Apr 16 22:21:32.896473 2026] [:error] [pid 7880:tid 7891] [client 20.203.186.201:50673] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeDwbKaezm4fSGc0yULAkwAAAYY"]
[Thu Apr 16 22:21:33.660099 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:27260] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeDwbaMCQoTw7TsxWuncIwAAAMY"]
[Thu Apr 16 22:21:34.286294 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:63236] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeDwbiQU4faGja6jpDuZowAAAAc"]
[Thu Apr 16 22:21:34.878603 2026] [:error] [pid 57537:tid 57581] [client 20.203.186.201:29125] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeDwblVQRS8nm73ENAnDlwAAAEY"]
[Thu Apr 16 22:21:35.504496 2026] [:error] [pid 57536:tid 57551] [client 20.203.186.201:50485] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeDwbyQU4faGja6jpDuZpwAAAAM"]
[Thu Apr 16 22:21:36.252182 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:50655] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeDwcDbDwvcXorHR_MwB-wAAAUk"]
[Thu Apr 16 22:21:36.919251 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:50449] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeDwcKMCQoTw7TsxWuncKAAAAMg"]
[Thu Apr 16 22:21:37.681007 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:29158] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeDwcaMCQoTw7TsxWuncKgAAAMo"]
[Thu Apr 16 22:21:38.417622 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:49589] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeDwcjbDwvcXorHR_MwCAwAAAUI"]
[Thu Apr 16 22:21:39.054027 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:50678] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeDwczbDwvcXorHR_MwCBgAAAVQ"]
[Thu Apr 16 22:21:39.844365 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:63280] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeDwczbDwvcXorHR_MwCCAAAAUE"]
[Thu Apr 16 22:21:40.351383 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:50440] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeDwdDbDwvcXorHR_MwCDgAAAVc"]
[Thu Apr 16 22:21:40.991274 2026] [:error] [pid 49094:tid 49120] [client 20.203.186.201:49579] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeDwdDbDwvcXorHR_MwCFAAAAVg"]
[Thu Apr 16 22:21:41.624304 2026] [:error] [pid 57536:tid 57555] [client 20.203.186.201:50445] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeDwdSQU4faGja6jpDuZrgAAAAc"]
[Thu Apr 16 22:21:42.264601 2026] [:error] [pid 57536:tid 57559] [client 20.203.186.201:25475] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeDwdiQU4faGja6jpDuZtQAAAAs"]
[Thu Apr 16 22:21:42.927323 2026] [:error] [pid 57538:tid 57623] [client 20.203.186.201:27201] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeDwdsuMaiEF5SVR2BfyJwAAAJU"]
[Thu Apr 16 22:21:43.668467 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:29178] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeDwd6MCQoTw7TsxWuncMQAAANY"]
[Thu Apr 16 22:21:44.495011 2026] [:error] [pid 7880:tid 7900] [client 20.203.186.201:50436] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeDweKaezm4fSGc0yULApQAAAY8"]
[Thu Apr 16 22:21:45.194019 2026] [:error] [pid 49094:tid 49111] [client 20.203.186.201:50640] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeDweTbDwvcXorHR_MwCHQAAAU8"]
[Thu Apr 16 22:21:46.012639 2026] [:error] [pid 57536:tid 57564] [client 20.203.186.201:49550] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeDweiQU4faGja6jpDuZvwAAABA"]
[Thu Apr 16 22:21:47.070302 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:49590] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeDwe6MCQoTw7TsxWuncNgAAAMg"]
[Thu Apr 16 22:21:47.794874 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:50679] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeDwezbDwvcXorHR_MwCIAAAAUM"]
[Thu Apr 16 22:21:48.428804 2026] [:error] [pid 57538:tid 57621] [client 20.203.186.201:50433] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeDwfMuMaiEF5SVR2BfyLAAAAJM"]
[Thu Apr 16 22:21:49.051579 2026] [:error] [pid 29603:tid 29607] [client 20.203.186.201:49580] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeDwfVfGOR6fpTWUAzqppgAAAQI"]
[Thu Apr 16 22:21:49.834908 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:63261] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeDwfaMCQoTw7TsxWuncPAAAAM8"]
[Thu Apr 16 22:21:50.739389 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:29142] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeDwfqMCQoTw7TsxWuncQwAAAMA"]
[Thu Apr 16 22:21:51.392029 2026] [:error] [pid 57538:tid 57613] [client 20.203.186.201:50685] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeDwf8uMaiEF5SVR2BfyLwAAAIs"]
[Thu Apr 16 22:21:51.956816 2026] [:error] [pid 57536:tid 57571] [client 20.203.186.201:27254] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeDwfyQU4faGja6jpDuZxAAAABc"]
[Thu Apr 16 22:21:52.664460 2026] [:error] [pid 57537:tid 57584] [client 20.203.186.201:50635] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeDwgFVQRS8nm73ENAnDnAAAAEk"]
[Thu Apr 16 22:21:53.414924 2026] [:error] [pid 57537:tid 57587] [client 20.203.186.201:49595] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeDwgVVQRS8nm73ENAnDngAAAEw"]
[Thu Apr 16 22:21:54.216122 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:50459] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeDwgqMCQoTw7TsxWuncSgAAAM8"]
[Thu Apr 16 22:21:54.908085 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:15223] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeDwgqMCQoTw7TsxWuncTAAAAME"]
[Thu Apr 16 22:21:55.542353 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:50626] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeDwg6MCQoTw7TsxWuncTwAAANY"]
[Thu Apr 16 22:21:56.184134 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:50474] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeDwhDbDwvcXorHR_MwCIgAAAUE"]
[Thu Apr 16 22:21:56.732786 2026] [:error] [pid 49094:tid 49108] [client 20.203.186.201:29138] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeDwhDbDwvcXorHR_MwCJQAAAUw"]
[Thu Apr 16 22:21:57.304926 2026] [:error] [pid 29603:tid 29620] [client 20.203.186.201:50667] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeDwhVfGOR6fpTWUAzqprwAAAQ8"]
[Thu Apr 16 22:21:58.002190 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:49583] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeDwhaMCQoTw7TsxWuncVgAAAMA"]
[Thu Apr 16 22:21:58.772847 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:11192] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeDwhiQU4faGja6jpDuZywAAABg"]
[Thu Apr 16 22:21:59.386596 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:29175] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeDwhyQU4faGja6jpDuZzQAAAAQ"]
[Thu Apr 16 22:21:59.987930 2026] [:error] [pid 57536:tid 57561] [client 20.203.186.201:15210] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeDwhyQU4faGja6jpDuZ0AAAAA0"]
[Thu Apr 16 22:22:00.700753 2026] [:error] [pid 57536:tid 57567] [client 20.203.186.201:25481] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeDwiCQU4faGja6jpDuZ2AAAABM"]
[Thu Apr 16 22:22:01.411646 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:50434] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeDwiSQU4faGja6jpDuZ3AAAAAA"]
[Thu Apr 16 22:22:01.991172 2026] [:error] [pid 57536:tid 57572] [client 20.203.186.201:63295] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeDwiSQU4faGja6jpDuZ3gAAABg"]
[Thu Apr 16 22:22:02.564531 2026] [:error] [pid 7880:tid 7890] [client 20.203.186.201:50486] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeDwiqaezm4fSGc0yULAsQAAAYU"]
[Thu Apr 16 22:22:03.142644 2026] [:error] [pid 57536:tid 57561] [client 20.203.186.201:27215] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeDwiyQU4faGja6jpDuZ4gAAAA0"]
[Thu Apr 16 22:22:03.806688 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:50641] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeDwi6MCQoTw7TsxWuncWgAAAMg"]
[Thu Apr 16 22:22:04.489094 2026] [:error] [pid 57536:tid 57565] [client 20.203.186.201:50448] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeDwjCQU4faGja6jpDuZ5wAAABE"]
[Thu Apr 16 22:22:05.064741 2026] [:error] [pid 29603:tid 29622] [client 20.203.186.201:50490] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeDwjVfGOR6fpTWUAzqpsAAAARE"]
[Thu Apr 16 22:22:05.687771 2026] [:error] [pid 49094:tid 49109] [client 20.203.186.201:29163] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeDwjTbDwvcXorHR_MwCKwAAAU0"]
[Thu Apr 16 22:22:06.442216 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:29132] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeDwjlfGOR6fpTWUAzqpsgAAAQ4"]
[Thu Apr 16 22:22:07.157063 2026] [:error] [pid 49094:tid 49104] [client 20.203.186.201:50473] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwjzbDwvcXorHR_MwCLgAAAUg"]
[Thu Apr 16 22:22:07.821787 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:49587] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwj6MCQoTw7TsxWuncYgAAAM8"]
[Thu Apr 16 22:22:08.400000 2026] [:error] [pid 29603:tid 29617] [client 20.203.186.201:27238] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwkFfGOR6fpTWUAzqptAAAAQw"]
[Thu Apr 16 22:22:09.050630 2026] [:error] [pid 57639:tid 57669] [client 20.203.186.201:15220] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeDwkaMCQoTw7TsxWuncZAAAANc"]
[Thu Apr 16 22:22:09.612378 2026] [:error] [pid 57639:tid 57668] [client 20.203.186.201:49555] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeDwkaMCQoTw7TsxWuncZgAAANY"]
[Thu Apr 16 22:22:10.146956 2026] [:error] [pid 57538:tid 57606] [client 20.203.186.201:50680] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeDwksuMaiEF5SVR2BfyOgAAAIQ"]
[Thu Apr 16 22:22:10.645181 2026] [:error] [pid 49094:tid 49100] [client 20.203.186.201:63286] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeDwkjbDwvcXorHR_MwCMQAAAUQ"]
[Thu Apr 16 22:22:11.201838 2026] [:error] [pid 49094:tid 49118] [client 20.203.186.201:49594] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeDwkzbDwvcXorHR_MwCMgAAAVY"]
[Thu Apr 16 22:22:11.751224 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:50657] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeDwk6MCQoTw7TsxWuncagAAAMg"]
[Thu Apr 16 22:22:12.365516 2026] [:error] [pid 57538:tid 57607] [client 20.203.186.201:49554] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeDwlMuMaiEF5SVR2BfyPAAAAIU"]
[Thu Apr 16 22:22:12.878279 2026] [:error] [pid 49094:tid 49116] [client 20.203.186.201:27242] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeDwlDbDwvcXorHR_MwCNAAAAVQ"]
[Thu Apr 16 22:22:13.510200 2026] [:error] [pid 49094:tid 49096] [client 20.203.186.201:50670] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeDwlTbDwvcXorHR_MwCNgAAAUA"]
[Thu Apr 16 22:22:14.045896 2026] [:error] [pid 49094:tid 49119] [client 20.203.186.201:15221] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeDwljbDwvcXorHR_MwCOQAAAVc"]
[Thu Apr 16 22:22:14.564691 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:15192] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeDwlqMCQoTw7TsxWuncbgAAAM8"]
[Thu Apr 16 22:22:15.116723 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:50492] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeDwl6MCQoTw7TsxWunccAAAAMs"]
[Thu Apr 16 22:22:15.624732 2026] [:error] [pid 57639:tid 57660] [client 20.203.186.201:50637] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeDwl6MCQoTw7TsxWuncdAAAAM4"]
[Thu Apr 16 22:22:16.140314 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:63293] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeDwmKMCQoTw7TsxWuncdQAAANU"]
[Thu Apr 16 22:22:16.698899 2026] [:error] [pid 49094:tid 49118] [client 20.203.186.201:50441] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeDwmDbDwvcXorHR_MwCQgAAAVY"]
[Thu Apr 16 22:22:17.289817 2026] [:error] [pid 49094:tid 49097] [client 20.203.186.201:25516] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeDwmTbDwvcXorHR_MwCQwAAAUE"]
[Thu Apr 16 22:22:17.842435 2026] [:error] [pid 57537:tid 57580] [client 20.203.186.201:27203] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeDwmVVQRS8nm73ENAnDqAAAAEU"]
[Thu Apr 16 22:22:18.361621 2026] [:error] [pid 7880:tid 7894] [client 20.203.186.201:50461] [client 20.203.186.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeDwmqaezm4fSGc0yULAtwAAAYk"]
[Thu Apr 16 22:22:19.032082 2026] [:error] [pid 29603:tid 29625] [client 20.203.186.201:50472] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeDwm1fGOR6fpTWUAzqpuwAAARQ"]
[Thu Apr 16 22:22:19.656276 2026] [:error] [pid 7880:tid 7905] [client 20.203.186.201:49536] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeDwm6aezm4fSGc0yULAugAAAZQ"]
[Thu Apr 16 22:22:20.225545 2026] [:error] [pid 29603:tid 29616] [client 20.203.186.201:29176] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeDwnFfGOR6fpTWUAzqpvwAAAQs"]
[Thu Apr 16 22:22:21.045296 2026] [:error] [pid 29603:tid 29619] [client 20.203.186.201:11653] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeDwnVfGOR6fpTWUAzqpxAAAAQ4"]
[Thu Apr 16 22:22:21.750373 2026] [:error] [pid 57538:tid 57603] [client 20.203.186.201:15170] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "aeDwncuMaiEF5SVR2BfyRgAAAIE"]
[Thu Apr 16 22:22:23.304106 2026] [proxy_fcgi:error] [pid 49094:tid 49110] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:23.609322 2026] [proxy_fcgi:error] [pid 49094:tid 49113] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:23.914417 2026] [proxy_fcgi:error] [pid 49094:tid 49106] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:24.190178 2026] [proxy_fcgi:error] [pid 49094:tid 49111] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:24.468271 2026] [proxy_fcgi:error] [pid 49094:tid 49096] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:24.745106 2026] [proxy_fcgi:error] [pid 49094:tid 49108] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:25.023133 2026] [proxy_fcgi:error] [pid 49094:tid 49105] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:25.314138 2026] [proxy_fcgi:error] [pid 49094:tid 49103] [client 20.203.186.201:50444] AH01071: Got error 'Primary script unknown'
[Thu Apr 16 22:22:25.606652 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:50444] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeDwoTbDwvcXorHR_MwCXAAAAVI"]
[Thu Apr 16 22:22:26.160020 2026] [:error] [pid 29603:tid 29627] [client 20.203.186.201:50671] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeDwolfGOR6fpTWUAzqpywAAARY"]
[Thu Apr 16 22:22:26.929537 2026] [:error] [pid 57536:tid 57563] [client 20.203.186.201:27228] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeDwoiQU4faGja6jpDuZ8AAAAA8"]
[Thu Apr 16 22:22:27.438277 2026] [:error] [pid 57538:tid 57606] [client 20.203.186.201:50648] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeDwo8uMaiEF5SVR2BfySAAAAIQ"]
[Thu Apr 16 22:22:28.154736 2026] [:error] [pid 57536:tid 57565] [client 20.203.186.201:27220] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeDwpCQU4faGja6jpDuZ9QAAABE"]
[Thu Apr 16 22:22:28.832368 2026] [:error] [pid 57536:tid 57549] [client 20.203.186.201:27212] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeDwpCQU4faGja6jpDuZ-AAAAAE"]
[Thu Apr 16 22:22:29.525166 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:27211] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeDwpaMCQoTw7TsxWuncfwAAAM8"]
[Thu Apr 16 22:22:30.150045 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:11177] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeDwpqMCQoTw7TsxWunchQAAAMs"]
[Thu Apr 16 22:22:30.788978 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:50633] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeDwpiQU4faGja6jpDuZ_AAAAAQ"]
[Thu Apr 16 22:22:31.364135 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:27205] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeDwp6MCQoTw7TsxWunciAAAANU"]
[Thu Apr 16 22:22:32.036692 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:50451] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeDwqKMCQoTw7TsxWunciwAAANM"]
[Thu Apr 16 22:22:32.805890 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:29148] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeDwqKMCQoTw7TsxWuncjAAAAMc"]
[Thu Apr 16 22:22:33.431439 2026] [:error] [pid 57536:tid 57548] [client 20.203.186.201:27236] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeDwqSQU4faGja6jpDuaBAAAAAA"]
[Thu Apr 16 22:22:33.934743 2026] [:error] [pid 57536:tid 57554] [client 20.203.186.201:63267] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeDwqSQU4faGja6jpDuaCQAAAAY"]
[Thu Apr 16 22:22:34.678543 2026] [:error] [pid 57536:tid 57560] [client 20.203.186.201:27218] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeDwqiQU4faGja6jpDuaEQAAAAw"]
[Thu Apr 16 22:22:35.284177 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:25503] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeDwq6MCQoTw7TsxWuncjwAAAMo"]
[Thu Apr 16 22:22:35.853825 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:29151] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeDwq6MCQoTw7TsxWunclQAAAME"]
[Thu Apr 16 22:22:36.477061 2026] [:error] [pid 57639:tid 57658] [client 20.203.186.201:49575] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeDwrKMCQoTw7TsxWuncmQAAAMw"]
[Thu Apr 16 22:22:37.028825 2026] [:error] [pid 57639:tid 57665] [client 20.203.186.201:15210] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeDwraMCQoTw7TsxWuncnQAAANM"]
[Thu Apr 16 22:22:37.582802 2026] [:error] [pid 57639:tid 57664] [client 20.203.186.201:27249] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeDwraMCQoTw7TsxWuncnwAAANI"]
[Thu Apr 16 22:22:38.244539 2026] [:error] [pid 7880:tid 7906] [client 20.203.186.201:50458] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeDwrqaezm4fSGc0yULAxQAAAZU"]
[Thu Apr 16 22:22:38.773299 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:11669] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeDwrqMCQoTw7TsxWuncpwAAANQ"]
[Thu Apr 16 22:22:39.356725 2026] [:error] [pid 57639:tid 57652] [client 20.203.186.201:49584] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeDwr6MCQoTw7TsxWuncqgAAAMY"]
[Thu Apr 16 22:22:39.849161 2026] [:error] [pid 57639:tid 57661] [client 20.203.186.201:29172] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeDwr6MCQoTw7TsxWuncrgAAAM8"]
[Thu Apr 16 22:22:40.343523 2026] [:error] [pid 7880:tid 7892] [client 20.203.186.201:49569] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeDwsKaezm4fSGc0yULAygAAAYc"]
[Thu Apr 16 22:22:41.347294 2026] [:error] [pid 29603:tid 29624] [client 20.203.186.201:50642] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeDwsVfGOR6fpTWUAzqp0AAAARM"]
[Thu Apr 16 22:22:41.980963 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:50495] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeDwsaMCQoTw7TsxWuncvAAAAMI"]
[Thu Apr 16 22:22:42.663248 2026] [:error] [pid 57639:tid 57647] [client 20.203.186.201:29157] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeDwsqMCQoTw7TsxWuncvQAAAME"]
[Thu Apr 16 22:22:43.265297 2026] [:error] [pid 57639:tid 57649] [client 20.203.186.201:27222] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDws6MCQoTw7TsxWuncvwAAAMM"]
[Thu Apr 16 22:22:43.843170 2026] [:error] [pid 57538:tid 57623] [client 20.203.186.201:49568] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDws8uMaiEF5SVR2BfyTwAAAJU"]
[Thu Apr 16 22:22:44.517093 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:15214] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwtDbDwvcXorHR_MwCZQAAAUo"]
[Thu Apr 16 22:22:45.028065 2026] [:error] [pid 7880:tid 7895] [client 20.203.186.201:15171] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeDwtaaezm4fSGc0yULA2QAAAYo"]
[Thu Apr 16 22:22:45.846875 2026] [:error] [pid 29603:tid 29615] [client 20.203.186.201:15178] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeDwtVfGOR6fpTWUAzqp3AAAAQo"]
[Thu Apr 16 22:22:46.427388 2026] [:error] [pid 57639:tid 57651] [client 20.203.186.201:15175] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeDwtqMCQoTw7TsxWuncxQAAAMU"]
[Thu Apr 16 22:22:47.034983 2026] [:error] [pid 29603:tid 29618] [client 20.203.186.201:50467] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeDwt1fGOR6fpTWUAzqp3wAAAQ0"]
[Thu Apr 16 22:22:47.662943 2026] [:error] [pid 57639:tid 57667] [client 20.203.186.201:50672] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeDwt6MCQoTw7TsxWuncyQAAANU"]
[Thu Apr 16 22:22:48.361702 2026] [:error] [pid 49094:tid 49111] [client 20.203.186.201:49552] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeDwuDbDwvcXorHR_MwCZwAAAU8"]
[Thu Apr 16 22:22:48.950305 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:63279] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeDwuDbDwvcXorHR_MwCaQAAAUI"]
[Thu Apr 16 22:22:49.571733 2026] [:error] [pid 57538:tid 57602] [client 20.203.186.201:49591] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeDwucuMaiEF5SVR2BfyVgAAAIA"]
[Thu Apr 16 22:22:50.589068 2026] [:error] [pid 49094:tid 49105] [client 20.203.186.201:27226] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeDwujbDwvcXorHR_MwCbQAAAUk"]
[Thu Apr 16 22:22:51.216637 2026] [:error] [pid 49094:tid 49114] [client 20.203.186.201:50483] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeDwuzbDwvcXorHR_MwCbgAAAVI"]
[Thu Apr 16 22:22:51.938250 2026] [:error] [pid 57639:tid 57653] [client 20.203.186.201:50675] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeDwu6MCQoTw7TsxWunc0wAAAMc"]
[Thu Apr 16 22:22:52.618921 2026] [:error] [pid 49094:tid 49117] [client 20.203.186.201:15218] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeDwvDbDwvcXorHR_MwCcQAAAVU"]
[Thu Apr 16 22:22:53.129081 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:29144] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeDwvTbDwvcXorHR_MwCcgAAAVA"]
[Thu Apr 16 22:22:53.778733 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:50632] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeDwvaMCQoTw7TsxWunc3gAAAMQ"]
[Thu Apr 16 22:22:54.384482 2026] [:error] [pid 49094:tid 49099] [client 20.203.186.201:25483] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeDwvjbDwvcXorHR_MwCdgAAAUM"]
[Thu Apr 16 22:22:54.947175 2026] [:error] [pid 57538:tid 57618] [client 20.203.186.201:49564] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeDwvsuMaiEF5SVR2BfyWgAAAJA"]
[Thu Apr 16 22:22:55.466162 2026] [:error] [pid 49094:tid 49098] [client 20.203.186.201:11665] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeDwvzbDwvcXorHR_MwCegAAAUI"]
[Thu Apr 16 22:22:55.967701 2026] [:error] [pid 29603:tid 29608] [client 20.203.186.201:15187] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeDwv1fGOR6fpTWUAzqp4gAAAQM"]
[Thu Apr 16 22:22:56.517705 2026] [:error] [pid 49094:tid 49112] [client 20.203.186.201:50674] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeDwwDbDwvcXorHR_MwCgAAAAVA"]
[Thu Apr 16 22:22:57.061184 2026] [:error] [pid 49094:tid 49110] [client 20.203.186.201:15213] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeDwwTbDwvcXorHR_MwCgwAAAU4"]
[Thu Apr 16 22:22:57.619469 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:49561] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeDwwaMCQoTw7TsxWunc6QAAANQ"]
[Thu Apr 16 22:22:58.224837 2026] [:error] [pid 57639:tid 57646] [client 20.203.186.201:11666] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeDwwqMCQoTw7TsxWunc7AAAAMA"]
[Thu Apr 16 22:22:58.956191 2026] [:error] [pid 57639:tid 57656] [client 20.203.186.201:25526] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeDwwqMCQoTw7TsxWunc9QAAAMo"]
[Thu Apr 16 22:22:59.754702 2026] [:error] [pid 57537:tid 57577] [client 20.203.186.201:15195] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeDww1VQRS8nm73ENAnDswAAAEI"]
[Thu Apr 16 22:23:00.559684 2026] [:error] [pid 57639:tid 57659] [client 20.203.186.201:50469] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeDwxKMCQoTw7TsxWunc_AAAAM0"]
[Thu Apr 16 22:23:01.473421 2026] [:error] [pid 29603:tid 29617] [client 20.203.186.201:49573] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeDwxVfGOR6fpTWUAzqp5QAAAQw"]
[Thu Apr 16 22:23:02.174118 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:50442] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeDwxiQU4faGja6jpDuaYQAAAAQ"]
[Thu Apr 16 22:23:02.990427 2026] [:error] [pid 29603:tid 29615] [client 20.203.186.201:50493] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeDwxlfGOR6fpTWUAzqp6AAAAQo"]
[Thu Apr 16 22:23:03.888613 2026] [:error] [pid 57639:tid 57648] [client 20.203.186.201:29150] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeDwx6MCQoTw7TsxWundDgAAAMI"]
[Thu Apr 16 22:23:04.646303 2026] [:error] [pid 29603:tid 29628] [client 20.203.186.201:25527] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeDwyFfGOR6fpTWUAzqp6wAAARc"]
[Thu Apr 16 22:23:05.313312 2026] [:error] [pid 57639:tid 57663] [client 20.203.186.201:50627] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeDwyaMCQoTw7TsxWundGwAAANE"]
[Thu Apr 16 22:23:06.069639 2026] [:error] [pid 57639:tid 57650] [client 20.203.186.201:50452] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeDwyqMCQoTw7TsxWundIgAAAMQ"]
[Thu Apr 16 22:23:06.869579 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:50636] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeDwyiQU4faGja6jpDuadAAAAAQ"]
[Thu Apr 16 22:23:07.615930 2026] [:error] [pid 57536:tid 57550] [client 20.203.186.201:63290] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1da.php"] [unique_id "aeDwyyQU4faGja6jpDuaeQAAAAI"]
[Thu Apr 16 22:23:08.228398 2026] [:error] [pid 49094:tid 49120] [client 20.203.186.201:15200] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1da.php"] [unique_id "aeDwzDbDwvcXorHR_MwCmwAAAVg"]
[Thu Apr 16 22:23:08.750602 2026] [:error] [pid 7880:tid 7893] [client 20.203.186.201:11716] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1da.php"] [unique_id "aeDwzKaezm4fSGc0yULBBgAAAYg"]
[Thu Apr 16 22:23:09.500093 2026] [:error] [pid 49094:tid 49096] [client 20.203.186.201:49558] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x1da.php"] [unique_id "aeDwzTbDwvcXorHR_MwCoAAAAUA"]
[Thu Apr 16 22:23:10.209151 2026] [:error] [pid 49094:tid 49106] [client 20.203.186.201:50665] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "aeDwzjbDwvcXorHR_MwCqAAAAUo"]
[Thu Apr 16 22:23:10.762367 2026] [:error] [pid 57639:tid 57666] [client 20.203.186.201:49551] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "aeDwzqMCQoTw7TsxWundSQAAANQ"]
[Thu Apr 16 22:23:11.351206 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:27225] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "aeDwz6MCQoTw7TsxWundTgAAAMg"]
[Thu Apr 16 22:23:11.916477 2026] [:error] [pid 57639:tid 57657] [client 20.203.186.201:11651] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "aeDwz6MCQoTw7TsxWundUwAAAMs"]
[Thu Apr 16 22:23:12.563130 2026] [:error] [pid 57639:tid 57654] [client 20.203.186.201:49551] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeDw0KMCQoTw7TsxWundWgAAAMg"]
[Thu Apr 16 22:23:13.119611 2026] [:error] [pid 57639:tid 57662] [client 20.203.186.201:29121] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeDw0aMCQoTw7TsxWundYAAAANA"]
[Thu Apr 16 22:23:13.713130 2026] [:error] [pid 57536:tid 57552] [client 20.203.186.201:29143] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeDw0SQU4faGja6jpDuahAAAAAQ"]
[Thu Apr 16 22:23:14.348310 2026] [:error] [pid 57537:tid 57583] [client 20.203.186.201:27257] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeDw0lVQRS8nm73ENAnDvQAAAEg"]
[Fri Apr 17 01:41:04.265952 2026] [:error] [pid 26480:tid 26506] [client 136.109.121.12:59031] [client 136.109.121.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.121.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeEfMAwLDJKTQNfarA1-gAAAAdg"]
[Fri Apr 17 01:41:04.274573 2026] [proxy_fcgi:error] [pid 26480:tid 26506] [client 136.109.121.12:59031] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 01:41:06.653527 2026] [:error] [pid 26480:tid 26485] [client 136.109.121.12:59031] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aeEfMgwLDJKTQNfarA1-jwAAAcM"]
[Fri Apr 17 01:41:10.797582 2026] [:error] [pid 4086:tid 4107] [client 136.109.121.12:60881] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aeEfNllz7gxl_exM0FpKjAAAAVM"]
[Fri Apr 17 01:41:14.842001 2026] [:error] [pid 26480:tid 26485] [client 136.109.121.12:62716] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aeEfOgwLDJKTQNfarA1-ogAAAcM"]
[Fri Apr 17 01:41:16.498904 2026] [:error] [pid 43385:tid 43396] [client 136.109.121.12:63066] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aeEfPMnIxkJaUI8KNs4nPAAAAAc"]
[Fri Apr 17 01:41:19.564787 2026] [:error] [pid 26480:tid 26494] [client 136.109.121.12:63037] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aeEfPwwLDJKTQNfarA1-qgAAAcw"]
[Fri Apr 17 01:41:20.400345 2026] [:error] [pid 43482:tid 43490] [client 136.109.121.12:64025] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aeEfQD9SZnuKxlHrct2k9wAAAMY"]
[Fri Apr 17 01:41:21.013304 2026] [:error] [pid 43482:tid 43499] [client 136.109.121.12:63557] [client 136.109.121.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aeEfQT9SZnuKxlHrct2k_wAAAM8"]
[Fri Apr 17 03:12:15.764503 2026] [:error] [pid 43385:tid 43403] [client 62.84.185.55:18952] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeE0j8nIxkJaUI8KNs458wAAAA4"]
[Fri Apr 17 03:12:21.263921 2026] [:error] [pid 26102:tid 26121] [client 62.84.185.55:2624] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeE0lf127aFqw6ALdnglkAAAAZA"]
[Fri Apr 17 03:12:25.359627 2026] [:error] [pid 43386:tid 43432] [client 62.84.185.55:59650] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeE0me91GAVgUfhPVDH19AAAAEw"]
[Fri Apr 17 03:12:32.693687 2026] [:error] [pid 43387:tid 43469] [client 62.84.185.55:17978] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeE0oCBNsONqHxWTakVlOgAAAJA"]
[Fri Apr 17 03:12:36.489366 2026] [:error] [pid 43387:tid 43470] [client 62.84.185.55:17982] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeE0pCBNsONqHxWTakVlRgAAAJE"]
[Fri Apr 17 03:12:42.385629 2026] [:error] [pid 26480:tid 26492] [client 62.84.185.55:39084] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeE0qgwLDJKTQNfarA2ZFQAAAco"]
[Fri Apr 17 03:12:47.598054 2026] [:error] [pid 11854:tid 11872] [client 62.84.185.55:16152] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeE0r9xJCSIaqP1XSdapfwAAAk8"]
[Fri Apr 17 03:12:54.010500 2026] [:error] [pid 4086:tid 4112] [client 62.84.185.55:16154] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeE0tllz7gxl_exM0FpUNAAAAVc"]
[Fri Apr 17 03:13:00.805594 2026] [:error] [pid 3245:tid 3263] [client 62.84.185.55:61320] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeE0vKESOMTHVLs-uFDh5AAAAQE"]
[Fri Apr 17 03:13:06.867682 2026] [:error] [pid 3245:tid 3276] [client 62.84.185.55:61324] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeE0wqESOMTHVLs-uFDh5gAAAQ4"]
[Fri Apr 17 03:13:16.855329 2026] [:error] [pid 43386:tid 43445] [client 92.97.6.106:57292] [client 92.97.6.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.97.6.106, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeE0zO91GAVgUfhPVDH2kAAAAFg"]
[Fri Apr 17 03:13:16.868853 2026] [proxy_fcgi:error] [pid 43386:tid 43445] [client 92.97.6.106:57292] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 03:14:24.264491 2026] [:error] [pid 43386:tid 43425] [client 62.84.185.55:14506] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeE1EO91GAVgUfhPVDH3FwAAAEU"]
[Fri Apr 17 03:14:30.391223 2026] [:error] [pid 3245:tid 3285] [client 62.84.185.55:46424] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeE1FqESOMTHVLs-uFDiCgAAARc"]
[Fri Apr 17 03:14:38.394424 2026] [:error] [pid 11692:tid 11714] [client 62.84.185.55:17612] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeE1Hs1AYuhm4BZwKNoucQAAAhE"]
[Fri Apr 17 03:14:41.980494 2026] [:error] [pid 3245:tid 3272] [client 62.84.185.55:37562] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeE1IaESOMTHVLs-uFDiEgAAAQo"]
[Fri Apr 17 03:14:46.962518 2026] [:error] [pid 43387:tid 43468] [client 62.84.185.55:37572] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeE1JiBNsONqHxWTakVnLAAAAI8"]
[Fri Apr 17 03:14:53.380336 2026] [:error] [pid 4086:tid 4094] [client 62.84.185.55:14646] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeE1LVlz7gxl_exM0FpUTAAAAUY"]
[Fri Apr 17 03:14:58.705649 2026] [:error] [pid 26480:tid 26485] [client 62.84.185.55:19888] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeE1MgwLDJKTQNfarA2aBgAAAcM"]
[Fri Apr 17 03:15:06.506284 2026] [:error] [pid 43387:tid 43476] [client 62.84.185.55:19898] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeE1OiBNsONqHxWTakVneAAAAJc"]
[Fri Apr 17 03:15:14.416424 2026] [:error] [pid 11854:tid 11860] [client 62.84.185.55:1154] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeE1QtxJCSIaqP1XSdap0gAAAkM"]
[Fri Apr 17 03:16:29.521692 2026] [:error] [pid 43387:tid 43471] [client 62.84.185.55:50580] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeE1jSBNsONqHxWTakVozQAAAJI"]
[Fri Apr 17 03:16:40.097530 2026] [:error] [pid 43386:tid 43441] [client 62.84.185.55:19180] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeE1mO91GAVgUfhPVDH4bQAAAFQ"]
[Fri Apr 17 03:16:43.372161 2026] [:error] [pid 26480:tid 26485] [client 62.84.185.55:63306] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeE1mwwLDJKTQNfarA2akgAAAcM"]
[Fri Apr 17 03:16:50.165912 2026] [:error] [pid 4086:tid 4089] [client 62.84.185.55:10434] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeE1ollz7gxl_exM0FpUfAAAAUE"]
[Fri Apr 17 03:16:55.919963 2026] [:error] [pid 43387:tid 43469] [client 62.84.185.55:10444] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeE1pyBNsONqHxWTakVo_QAAAJA"]
[Fri Apr 17 03:17:00.557487 2026] [:error] [pid 11854:tid 11876] [client 62.84.185.55:60656] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeE1rNxJCSIaqP1XSdap8wAAAlM"]
[Fri Apr 17 03:17:06.491208 2026] [:error] [pid 26480:tid 26500] [client 62.84.185.55:26588] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeE1sgwLDJKTQNfarA2atQAAAdI"]
[Fri Apr 17 03:17:13.664070 2026] [:error] [pid 43387:tid 43465] [client 62.84.185.55:4436] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeE1uSBNsONqHxWTakVpEgAAAIw"]
[Fri Apr 17 03:17:18.852435 2026] [:error] [pid 43387:tid 43456] [client 62.84.185.55:26840] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeE1viBNsONqHxWTakVpLAAAAIU"]
[Fri Apr 17 03:18:23.987173 2026] [:error] [pid 43387:tid 43465] [client 62.84.185.55:32302] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeE1_yBNsONqHxWTakVpiAAAAIw"]
[Fri Apr 17 03:18:27.855923 2026] [:error] [pid 43387:tid 43454] [client 62.84.185.55:15408] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeE2AyBNsONqHxWTakVpnAAAAIQ"]
[Fri Apr 17 03:18:34.704475 2026] [:error] [pid 26480:tid 26490] [client 62.84.185.55:34738] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeE2CgwLDJKTQNfarA2bJwAAAcg"]
[Fri Apr 17 03:18:39.284647 2026] [:error] [pid 43387:tid 43449] [client 62.84.185.55:1254] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeE2DyBNsONqHxWTakVpxwAAAIE"]
[Fri Apr 17 03:18:42.684458 2026] [:error] [pid 43387:tid 43462] [client 62.84.185.55:47814] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeE2EiBNsONqHxWTakVp3wAAAIs"]
[Fri Apr 17 03:18:48.701010 2026] [:error] [pid 11854:tid 11869] [client 62.84.185.55:1268] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeE2GNxJCSIaqP1XSdaqLwAAAkw"]
[Fri Apr 17 03:18:52.209445 2026] [:error] [pid 43482:tid 43489] [client 62.84.185.55:8694] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeE2HD9SZnuKxlHrct3I4QAAAMU"]
[Fri Apr 17 03:18:57.385250 2026] [:error] [pid 43482:tid 43506] [client 62.84.185.55:10928] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeE2IT9SZnuKxlHrct3I6QAAANY"]
[Fri Apr 17 03:19:02.910825 2026] [:error] [pid 43386:tid 43439] [client 62.84.185.55:10934] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aeE2Ju91GAVgUfhPVDH5WAAAAFM"]
[Fri Apr 17 03:19:07.808834 2026] [:error] [pid 11692:tid 11709] [client 62.84.185.55:6240] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aeE2K81AYuhm4BZwKNovLwAAAgw"]
[Fri Apr 17 03:19:12.578202 2026] [:error] [pid 43385:tid 43406] [client 62.84.185.55:25292] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aeE2MMnIxkJaUI8KNs47fQAAABE"]
[Fri Apr 17 03:20:10.984767 2026] [:error] [pid 26102:tid 26111] [client 62.84.185.55:31986] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeE2av127aFqw6ALdngmpgAAAYY"]
[Fri Apr 17 03:20:16.896582 2026] [:error] [pid 26102:tid 26111] [client 62.84.185.55:32892] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeE2cP127aFqw6ALdngmvQAAAYY"]
[Fri Apr 17 03:20:22.805021 2026] [:error] [pid 11692:tid 11719] [client 62.84.185.55:41524] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeE2ds1AYuhm4BZwKNovYwAAAhY"]
[Fri Apr 17 03:20:28.704093 2026] [:error] [pid 43387:tid 43477] [client 62.84.185.55:48598] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeE2fCBNsONqHxWTakVqcgAAAJg"]
[Fri Apr 17 03:20:32.570339 2026] [:error] [pid 43386:tid 43441] [client 62.84.185.55:48614] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeE2gO91GAVgUfhPVDH54QAAAFQ"]
[Fri Apr 17 03:20:38.470938 2026] [:error] [pid 43482:tid 43497] [client 62.84.185.55:34588] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeE2hj9SZnuKxlHrct3JXQAAAM0"]
[Fri Apr 17 03:24:00.971108 2026] [:error] [pid 5958:tid 5967] [client 43.153.15.51:35078] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeE3UOopK-t1vpDHqQqyxQAAAAQ"]
[Fri Apr 17 04:03:53.657856 2026] [:error] [pid 9151:tid 9170] [client 209.38.89.62:47770] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/install.php"] [unique_id "aeFAqchTVuRPkua22vRjaAAAAAk"]
[Fri Apr 17 04:03:53.715901 2026] [:error] [pid 9263:tid 9288] [client 209.38.89.62:47772] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFAqRP68VyHNvj1e56OkAAAANc"]
[Fri Apr 17 04:03:53.871870 2026] [:error] [pid 9151:tid 9164] [client 209.38.89.62:47788] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new/wp-admin/install.php"] [unique_id "aeFAqchTVuRPkua22vRjagAAAAM"]
[Fri Apr 17 04:03:54.043871 2026] [:error] [pid 9263:tid 9265] [client 209.38.89.62:47804] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/old/wp-admin/install.php"] [unique_id "aeFAqhP68VyHNvj1e56OkQAAAMA"]
[Fri Apr 17 04:03:54.138247 2026] [:error] [pid 9152:tid 9209] [client 209.38.89.62:47814] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFAqpJYca8I3TNCwIfOMAAAAFM"]
[Fri Apr 17 04:03:54.175913 2026] [:error] [pid 9153:tid 9228] [client 209.38.89.62:47820] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-admin/install.php"] [unique_id "aeFAquMHGxkTZX3c45eu0AAAAIo"]
[Fri Apr 17 04:03:54.246206 2026] [:error] [pid 9152:tid 9207] [client 209.38.89.62:47836] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFAqpJYca8I3TNCwIfOMQAAAFE"]
[Fri Apr 17 04:03:54.621298 2026] [:error] [pid 9263:tid 9266] [client 209.38.89.62:47842] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFAqhP68VyHNvj1e56OlQAAAME"]
[Fri Apr 17 04:03:54.800004 2026] [:error] [pid 9263:tid 9281] [client 209.38.89.62:45134] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web/wp-admin/install.php"] [unique_id "aeFAqhP68VyHNvj1e56OlwAAANA"]
[Fri Apr 17 04:03:54.956881 2026] [:error] [pid 9153:tid 9234] [client 209.38.89.62:45146] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFAquMHGxkTZX3c45eu0QAAAJA"]
[Fri Apr 17 04:03:55.159598 2026] [:error] [pid 9151:tid 9172] [client 209.38.89.62:45150] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-admin/install.php"] [unique_id "aeFAq8hTVuRPkua22vRjbAAAAAs"]
[Fri Apr 17 04:03:55.425944 2026] [:error] [pid 9152:tid 9206] [client 209.38.89.62:45152] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFAq5JYca8I3TNCwIfONAAAAFA"]
[Fri Apr 17 04:03:55.567200 2026] [:error] [pid 9263:tid 9287] [client 209.38.89.62:45158] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFAqxP68VyHNvj1e56OnAAAANY"]
[Fri Apr 17 05:01:04.319152 2026] [:error] [pid 9152:tid 9202] [client 65.108.125.120:52430] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeFOEJJYca8I3TNCwIf8SAAAAEw"]
[Fri Apr 17 05:01:06.393703 2026] [:error] [pid 9152:tid 9197] [client 65.108.125.120:34938] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeFOEpJYca8I3TNCwIf8TQAAAEc"]
[Fri Apr 17 05:01:08.953658 2026] [:error] [pid 9153:tid 9222] [client 65.108.125.120:29684] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeFOFOMHGxkTZX3c45fnigAAAIQ"]
[Fri Apr 17 05:01:10.904587 2026] [:error] [pid 9151:tid 9162] [client 65.108.125.120:43746] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeFOFshTVuRPkua22vSKqQAAAAE"]
[Fri Apr 17 05:01:13.473452 2026] [:error] [pid 9152:tid 9213] [client 65.108.125.120:29690] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeFOGZJYca8I3TNCwIf8XQAAAFc"]
[Fri Apr 17 05:01:16.091225 2026] [:error] [pid 51878:tid 51888] [client 65.108.125.120:29692] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeFOHEnQhUtMbw9EsgZBywAAAQg"]
[Fri Apr 17 05:01:18.172752 2026] [:error] [pid 9153:tid 9219] [client 65.108.125.120:15884] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeFOHuMHGxkTZX3c45fnmgAAAIE"]
[Fri Apr 17 05:01:20.626482 2026] [:error] [pid 9263:tid 9273] [client 65.108.125.120:4210] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeFOIBP68VyHNvj1e57b7wAAAMg"]
[Fri Apr 17 05:01:22.551502 2026] [:error] [pid 51878:tid 51902] [client 65.108.125.120:15894] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeFOIknQhUtMbw9EsgZB4QAAARY"]
[Fri Apr 17 05:01:25.009066 2026] [:error] [pid 9152:tid 9197] [client 65.108.125.120:4216] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeFOJZJYca8I3TNCwIf8agAAAEc"]
[Fri Apr 17 05:01:27.567082 2026] [:error] [pid 51878:tid 51891] [client 65.108.125.120:4230] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeFOJ0nQhUtMbw9EsgZCGgAAAQs"]
[Fri Apr 17 05:01:29.618884 2026] [:error] [pid 9263:tid 9283] [client 65.108.125.120:33254] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeFOKRP68VyHNvj1e57cCwAAANI"]
[Fri Apr 17 05:01:32.095612 2026] [:error] [pid 9152:tid 9197] [client 65.108.125.120:58328] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeFOLJJYca8I3TNCwIf8gAAAAEc"]
[Fri Apr 17 05:01:34.024749 2026] [:error] [pid 9152:tid 9206] [client 65.108.125.120:33262] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeFOLpJYca8I3TNCwIf8hQAAAFA"]
[Fri Apr 17 05:01:36.586561 2026] [:error] [pid 9263:tid 9265] [client 65.108.125.120:58342] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeFOMBP68VyHNvj1e57cHAAAAMA"]
[Fri Apr 17 05:01:38.667429 2026] [:error] [pid 9151:tid 9169] [client 65.108.125.120:2612] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeFOMshTVuRPkua22vSK-AAAAAg"]
[Fri Apr 17 05:01:41.214412 2026] [:error] [pid 9263:tid 9286] [client 65.108.125.120:22462] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeFONRP68VyHNvj1e57cNQAAANU"]
[Fri Apr 17 05:01:43.175716 2026] [:error] [pid 9152:tid 9200] [client 65.108.125.120:2618] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeFON5JYca8I3TNCwIf8jwAAAEo"]
[Fri Apr 17 05:01:45.740137 2026] [:error] [pid 9263:tid 9280] [client 65.108.125.120:22464] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeFOORP68VyHNvj1e57cbAAAAM8"]
[Fri Apr 17 05:01:48.246230 2026] [:error] [pid 9153:tid 9219] [client 65.108.125.120:56480] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeFOPOMHGxkTZX3c45fn9gAAAIE"]
[Fri Apr 17 05:01:50.324391 2026] [:error] [pid 9153:tid 9228] [client 65.108.125.120:37672] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeFOPuMHGxkTZX3c45fn9wAAAIo"]
[Fri Apr 17 05:01:52.884749 2026] [:error] [pid 9153:tid 9221] [client 65.108.125.120:56510] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeFOQOMHGxkTZX3c45foBAAAAIM"]
[Fri Apr 17 05:01:54.826687 2026] [:error] [pid 9152:tid 9208] [client 65.108.125.120:37674] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeFOQpJYca8I3TNCwIf8zAAAAFI"]
[Fri Apr 17 05:01:56.852496 2026] [:error] [pid 51878:tid 51898] [client 65.108.125.120:37678] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeFOREnQhUtMbw9EsgZC5gAAARI"]
[Fri Apr 17 05:01:59.263049 2026] [:error] [pid 51878:tid 51896] [client 65.108.125.120:3334] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeFOR0nQhUtMbw9EsgZC8wAAARA"]
[Fri Apr 17 05:05:12.596586 2026] [:error] [pid 51878:tid 51898] [client 65.108.125.120:51310] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeFPCEnQhUtMbw9EsgZIEwAAARI"]
[Fri Apr 17 05:05:15.181214 2026] [:error] [pid 9151:tid 9180] [client 65.108.125.120:2628] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeFPC8hTVuRPkua22vSMywAAABM"]
[Fri Apr 17 05:05:17.726938 2026] [:error] [pid 9263:tid 9287] [client 65.108.125.120:2634] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeFPDRP68VyHNvj1e57gIAAAANY"]
[Fri Apr 17 05:05:20.240793 2026] [:error] [pid 9263:tid 9272] [client 65.108.125.120:22718] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeFPEBP68VyHNvj1e57gIwAAAMc"]
[Fri Apr 17 05:05:22.218556 2026] [:error] [pid 51878:tid 51892] [client 65.108.125.120:21442] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeFPEknQhUtMbw9EsgZIVwAAAQw"]
[Fri Apr 17 05:05:24.849327 2026] [:error] [pid 9151:tid 9167] [client 65.108.125.120:22732] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeFPFMhTVuRPkua22vSM4gAAAAY"]
[Fri Apr 17 05:05:25.652402 2026] [:error] [pid 9263:tid 9276] [client 51.103.25.236:62094] [client 51.103.25.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeFPFRP68VyHNvj1e57gOQAAAMs"]
[Fri Apr 17 05:05:26.763916 2026] [:error] [pid 51878:tid 51895] [client 65.108.125.120:21458] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeFPFknQhUtMbw9EsgZIcAAAAQ8"]
[Fri Apr 17 05:05:28.124446 2026] [:error] [pid 9263:tid 9277] [client 51.103.25.236:59611] [client 51.103.25.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeFPGBP68VyHNvj1e57gQAAAAMw"]
[Fri Apr 17 05:05:29.293026 2026] [:error] [pid 9153:tid 9223] [client 51.103.25.236:54364] [client 51.103.25.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeFPGeMHGxkTZX3c45fqRQAAAIU"]
[Fri Apr 17 05:05:29.364650 2026] [:error] [pid 51878:tid 51898] [client 65.108.125.120:9880] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeFPGUnQhUtMbw9EsgZIjAAAARI"]
[Fri Apr 17 05:05:30.569501 2026] [:error] [pid 51878:tid 51888] [client 51.103.25.236:46250] [client 51.103.25.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeFPGknQhUtMbw9EsgZImwAAAQg"]
[Fri Apr 17 05:05:31.147823 2026] [:error] [pid 51878:tid 51899] [client 65.108.125.120:24472] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeFPG0nQhUtMbw9EsgZInQAAARM"]
[Fri Apr 17 05:05:33.704782 2026] [:error] [pid 9152:tid 9207] [client 65.108.125.120:9896] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeFPHZJYca8I3TNCwIf-lgAAAFE"]
[Fri Apr 17 05:05:36.261730 2026] [:error] [pid 9152:tid 9212] [client 65.108.125.120:9908] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeFPIJJYca8I3TNCwIf-mQAAAFY"]
[Fri Apr 17 05:05:38.952490 2026] [:error] [pid 51878:tid 51891] [client 65.108.125.120:39756] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeFPIknQhUtMbw9EsgZIxgAAAQs"]
[Fri Apr 17 05:05:40.915805 2026] [:error] [pid 9152:tid 9192] [client 65.108.125.120:24464] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeFPJJJYca8I3TNCwIf-qwAAAEI"]
[Fri Apr 17 05:05:42.819741 2026] [:error] [pid 9152:tid 9207] [client 65.108.125.120:24476] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeFPJpJYca8I3TNCwIf-twAAAFE"]
[Fri Apr 17 05:05:44.711127 2026] [:error] [pid 51878:tid 51898] [client 65.108.125.120:24484] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeFPKEnQhUtMbw9EsgZI4wAAARI"]
[Fri Apr 17 05:05:46.730357 2026] [:error] [pid 9263:tid 9278] [client 65.108.125.120:24496] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeFPKhP68VyHNvj1e57grQAAAM0"]
[Fri Apr 17 05:05:48.758855 2026] [:error] [pid 51878:tid 51890] [client 65.108.125.120:46908] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeFPLEnQhUtMbw9EsgZI-gAAAQo"]
[Fri Apr 17 05:05:50.657760 2026] [:error] [pid 51878:tid 51880] [client 65.108.125.120:46924] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeFPLknQhUtMbw9EsgZJFQAAAQA"]
[Fri Apr 17 05:05:53.244571 2026] [:error] [pid 9263:tid 9276] [client 65.108.125.120:35860] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeFPMRP68VyHNvj1e57guAAAAMs"]
[Fri Apr 17 05:05:55.251804 2026] [:error] [pid 9153:tid 9222] [client 65.108.125.120:46936] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeFPM-MHGxkTZX3c45fqhgAAAIQ"]
[Fri Apr 17 05:05:57.135065 2026] [:error] [pid 51878:tid 51885] [client 65.108.125.120:46938] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeFPNUnQhUtMbw9EsgZJXgAAAQU"]
[Fri Apr 17 05:05:59.580535 2026] [:error] [pid 51878:tid 51902] [client 65.108.125.120:48304] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeFPN0nQhUtMbw9EsgZJcwAAARY"]
[Fri Apr 17 05:06:01.523907 2026] [:error] [pid 51878:tid 51890] [client 65.108.125.120:32976] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeFPOUnQhUtMbw9EsgZJhAAAAQo"]
[Fri Apr 17 05:06:03.544597 2026] [:error] [pid 9263:tid 9280] [client 65.108.125.120:32980] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeFPOxP68VyHNvj1e57gzAAAAM8"]
[Fri Apr 17 05:06:05.575416 2026] [:error] [pid 9263:tid 9269] [client 65.108.125.120:32982] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeFPPRP68VyHNvj1e57g0gAAAMQ"]
[Fri Apr 17 05:06:07.590359 2026] [:error] [pid 9152:tid 9209] [client 65.108.125.120:34656] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeFPP5JYca8I3TNCwIf-yAAAAFM"]
[Fri Apr 17 05:06:34.886839 2026] [:error] [pid 51878:tid 51899] [client 65.108.125.120:3840] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeFPWknQhUtMbw9EsgZKhQAAARM"]
[Fri Apr 17 05:06:37.507009 2026] [:error] [pid 9152:tid 9190] [client 65.108.125.120:3848] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeFPXZJYca8I3TNCwIf_CQAAAEA"]
[Fri Apr 17 05:06:39.474319 2026] [:error] [pid 9151:tid 9181] [client 65.108.125.120:49634] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeFPX8hTVuRPkua22vSNqgAAABQ"]
[Fri Apr 17 05:06:41.914575 2026] [:error] [pid 9153:tid 9241] [client 65.108.125.120:10854] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeFPYeMHGxkTZX3c45fq4gAAAJc"]
[Fri Apr 17 05:06:44.291696 2026] [:error] [pid 9152:tid 9201] [client 65.108.125.120:10864] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeFPZJJYca8I3TNCwIf_FgAAAEs"]
[Fri Apr 17 05:06:46.804098 2026] [:error] [pid 9151:tid 9184] [client 65.108.125.120:10866] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeFPZshTVuRPkua22vSNxQAAABc"]
[Fri Apr 17 05:06:49.188983 2026] [:error] [pid 51878:tid 51888] [client 65.108.125.120:29862] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeFPaUnQhUtMbw9EsgZKpAAAAQg"]
[Fri Apr 17 05:06:51.573985 2026] [:error] [pid 9263:tid 9266] [client 65.108.125.120:29874] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeFPaxP68VyHNvj1e57hUwAAAME"]
[Fri Apr 17 05:06:53.560637 2026] [:error] [pid 9152:tid 9198] [client 65.108.125.120:33520] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeFPbZJYca8I3TNCwIf_LAAAAEg"]
[Fri Apr 17 05:06:56.087783 2026] [:error] [pid 51878:tid 51881] [client 65.108.125.120:29884] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeFPcEnQhUtMbw9EsgZKtAAAAQE"]
[Fri Apr 17 05:06:58.429560 2026] [:error] [pid 9153:tid 9228] [client 65.108.125.120:41836] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeFPcuMHGxkTZX3c45frUwAAAIo"]
[Fri Apr 17 05:07:00.764053 2026] [:error] [pid 9152:tid 9207] [client 65.108.125.120:41846] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeFPdJJYca8I3TNCwIf_NAAAAFE"]
[Fri Apr 17 05:07:03.172882 2026] [:error] [pid 9153:tid 9220] [client 65.108.125.120:41862] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeFPd-MHGxkTZX3c45frYgAAAII"]
[Fri Apr 17 05:07:05.689728 2026] [:error] [pid 9263:tid 9287] [client 65.108.125.120:41878] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeFPeRP68VyHNvj1e57hWQAAANY"]
[Fri Apr 17 05:07:08.236339 2026] [:error] [pid 9153:tid 9220] [client 65.108.125.120:54432] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeFPfOMHGxkTZX3c45frfAAAAII"]
[Fri Apr 17 05:07:09.570635 2026] [:error] [pid 9153:tid 9227] [client 65.108.125.120:5572] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeFPfeMHGxkTZX3c45frhwAAAIk"]
[Fri Apr 17 05:07:13.493217 2026] [:error] [pid 9152:tid 9193] [client 65.108.125.120:5586] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeFPgZJYca8I3TNCwIf_WAAAAEM"]
[Fri Apr 17 05:54:43.374720 2026] [proxy_fcgi:error] [pid 9153:tid 9221] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:43.611056 2026] [proxy_fcgi:error] [pid 9153:tid 9237] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:43.846977 2026] [proxy_fcgi:error] [pid 9153:tid 9220] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:44.098557 2026] [proxy_fcgi:error] [pid 9153:tid 9218] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:44.335161 2026] [proxy_fcgi:error] [pid 9153:tid 9225] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:44.574410 2026] [proxy_fcgi:error] [pid 9153:tid 9239] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:44.867787 2026] [proxy_fcgi:error] [pid 9153:tid 9238] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:45.103913 2026] [proxy_fcgi:error] [pid 9153:tid 9234] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:45.453092 2026] [proxy_fcgi:error] [pid 9153:tid 9240] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:45.688737 2026] [proxy_fcgi:error] [pid 9153:tid 9241] [client 172.213.152.251:63025] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:54:45.920749 2026] [:error] [pid 9153:tid 9233] [client 172.213.152.251:63025] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeFapeMHGxkTZX3c45cEWAAAAI8"]
[Fri Apr 17 05:54:46.489896 2026] [:error] [pid 9151:tid 9174] [client 172.213.152.251:52064] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeFapshTVuRPkua22vSfjwAAAA0"]
[Fri Apr 17 05:54:46.997568 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:47099] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeFappJYca8I3TNCwIcTIQAAAEM"]
[Fri Apr 17 05:54:47.532902 2026] [:error] [pid 9151:tid 9162] [client 172.213.152.251:58892] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeFap8hTVuRPkua22vSflQAAAAE"]
[Fri Apr 17 05:54:48.047081 2026] [:error] [pid 9152:tid 9192] [client 172.213.152.251:57235] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeFaqJJYca8I3TNCwIcTJAAAAEI"]
[Fri Apr 17 05:54:48.673726 2026] [:error] [pid 9263:tid 9270] [client 172.213.152.251:45180] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeFaqBP68VyHNvj1e54A9wAAAMU"]
[Fri Apr 17 05:54:49.217564 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:5956] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeFaqeMHGxkTZX3c45cEXgAAAIw"]
[Fri Apr 17 05:54:49.699341 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:5978] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeFaqRP68VyHNvj1e54A-gAAAM8"]
[Fri Apr 17 05:54:50.198622 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:40042] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeFaqknQhUtMbw9EsgZ0bwAAAQw"]
[Fri Apr 17 05:54:50.689128 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:58885] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeFaqknQhUtMbw9EsgZ0cwAAARE"]
[Fri Apr 17 05:54:51.198972 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:47076] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeFaq0nQhUtMbw9EsgZ0dgAAARc"]
[Fri Apr 17 05:54:51.852455 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:52068] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeFaq0nQhUtMbw9EsgZ0eQAAAQM"]
[Fri Apr 17 05:54:52.321032 2026] [:error] [pid 9263:tid 9282] [client 172.213.152.251:52051] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeFarBP68VyHNvj1e54A_wAAANE"]
[Fri Apr 17 05:54:52.793788 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:45124] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeFarEnQhUtMbw9EsgZ0fQAAAQI"]
[Fri Apr 17 05:54:53.304898 2026] [:error] [pid 9152:tid 9202] [client 172.213.152.251:6014] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeFarZJYca8I3TNCwIcTLAAAAEw"]
[Fri Apr 17 05:54:53.831591 2026] [:error] [pid 9152:tid 9207] [client 172.213.152.251:47075] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeFarZJYca8I3TNCwIcTMgAAAFE"]
[Fri Apr 17 05:54:54.696878 2026] [:error] [pid 9152:tid 9209] [client 172.213.152.251:64414] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeFarpJYca8I3TNCwIcTOQAAAFM"]
[Fri Apr 17 05:54:55.370583 2026] [:error] [pid 9263:tid 9283] [client 172.213.152.251:45154] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeFarxP68VyHNvj1e54BBAAAANI"]
[Fri Apr 17 05:54:55.989654 2026] [:error] [pid 9263:tid 9285] [client 172.213.152.251:47060] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeFarxP68VyHNvj1e54BBwAAANQ"]
[Fri Apr 17 05:54:56.712670 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:40002] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aeFasBP68VyHNvj1e54BCQAAAMg"]
[Fri Apr 17 05:54:57.180111 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:57239] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeFasRP68VyHNvj1e54BCwAAAMs"]
[Fri Apr 17 05:54:57.698433 2026] [:error] [pid 9152:tid 9196] [client 172.213.152.251:62994] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeFasZJYca8I3TNCwIcTSQAAAEY"]
[Fri Apr 17 05:54:58.262426 2026] [:error] [pid 9153:tid 9236] [client 172.213.152.251:63039] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeFasuMHGxkTZX3c45cEYgAAAJI"]
[Fri Apr 17 05:54:58.803961 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:40013] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeFasuMHGxkTZX3c45cEYwAAAJA"]
[Fri Apr 17 05:54:59.439200 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:57035] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeFas0nQhUtMbw9EsgZ0gQAAARA"]
[Fri Apr 17 05:55:00.023650 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:5971] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeFatBP68VyHNvj1e54BGQAAAMg"]
[Fri Apr 17 05:55:00.689765 2026] [:error] [pid 9263:tid 9286] [client 172.213.152.251:52046] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeFatBP68VyHNvj1e54BHAAAANU"]
[Fri Apr 17 05:55:01.698453 2026] [:error] [pid 9153:tid 9235] [client 172.213.152.251:47069] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aeFateMHGxkTZX3c45cEaAAAAJE"]
[Fri Apr 17 05:55:02.355785 2026] [:error] [pid 9152:tid 9208] [client 172.213.152.251:63089] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "aeFatpJYca8I3TNCwIcTUQAAAFI"]
[Fri Apr 17 05:55:03.000286 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:47074] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "aeFatpJYca8I3TNCwIcTUwAAAFA"]
[Fri Apr 17 05:55:03.800520 2026] [:error] [pid 9263:tid 9289] [client 172.213.152.251:47092] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "aeFatxP68VyHNvj1e54BKgAAANg"]
[Fri Apr 17 05:55:04.507248 2026] [:error] [pid 9263:tid 9267] [client 172.213.152.251:5138] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/water.php"] [unique_id "aeFauBP68VyHNvj1e54BLQAAAMI"]
[Fri Apr 17 05:55:05.322668 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:58936] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aeFauUnQhUtMbw9EsgZ0iQAAAQc"]
[Fri Apr 17 05:55:05.907780 2026] [:error] [pid 9152:tid 9201] [client 172.213.152.251:45141] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aeFauZJYca8I3TNCwIcTVgAAAEs"]
[Fri Apr 17 05:55:06.503350 2026] [:error] [pid 9151:tid 9171] [client 172.213.152.251:40041] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aeFaushTVuRPkua22vSfpAAAAAo"]
[Fri Apr 17 05:55:07.233050 2026] [:error] [pid 9151:tid 9181] [client 172.213.152.251:64428] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aeFau8hTVuRPkua22vSfpQAAABQ"]
[Fri Apr 17 05:55:07.905478 2026] [:error] [pid 9152:tid 9207] [client 172.213.152.251:57028] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeFau5JYca8I3TNCwIcTXAAAAFE"]
[Fri Apr 17 05:55:08.454665 2026] [:error] [pid 9263:tid 9279] [client 172.213.152.251:40028] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeFavBP68VyHNvj1e54BRwAAAM4"]
[Fri Apr 17 05:55:08.944499 2026] [:error] [pid 9153:tid 9221] [client 172.213.152.251:6011] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeFavOMHGxkTZX3c45cEcAAAAIM"]
[Fri Apr 17 05:55:09.572654 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:58925] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aeFaveMHGxkTZX3c45cEcgAAAJA"]
[Fri Apr 17 05:55:10.239531 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:6003] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "aeFavknQhUtMbw9EsgZ0mwAAARQ"]
[Fri Apr 17 05:55:10.710439 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:45143] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "aeFavknQhUtMbw9EsgZ0nAAAAQg"]
[Fri Apr 17 05:55:11.231989 2026] [:error] [pid 9152:tid 9203] [client 172.213.152.251:45166] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "aeFav5JYca8I3TNCwIcTZAAAAE0"]
[Fri Apr 17 05:55:11.854898 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:40005] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wert.php"] [unique_id "aeFav0nQhUtMbw9EsgZ0ngAAARI"]
[Fri Apr 17 05:55:12.596592 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:63098] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeFawEnQhUtMbw9EsgZ0oQAAARU"]
[Fri Apr 17 05:55:13.377649 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:63098] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeFawRP68VyHNvj1e54BUgAAAMw"]
[Fri Apr 17 05:55:13.856641 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:63090] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeFawUnQhUtMbw9EsgZ0qAAAARA"]
[Fri Apr 17 05:55:14.769379 2026] [:error] [pid 9263:tid 9286] [client 172.213.152.251:55564] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aeFawhP68VyHNvj1e54BVQAAANU"]
[Fri Apr 17 05:55:15.421425 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:63029] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeFaw0nQhUtMbw9EsgZ0rAAAAQA"]
[Fri Apr 17 05:55:16.076822 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:64400] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeFaxEnQhUtMbw9EsgZ0sAAAARE"]
[Fri Apr 17 05:55:16.894832 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:40029] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeFaxEnQhUtMbw9EsgZ0tgAAARY"]
[Fri Apr 17 05:55:17.563697 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:64426] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeFaxeMHGxkTZX3c45cEgQAAAJA"]
[Fri Apr 17 05:55:18.160036 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:5129] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "aeFaxknQhUtMbw9EsgZ0vgAAAQc"]
[Fri Apr 17 05:55:18.922689 2026] [:error] [pid 9263:tid 9271] [client 172.213.152.251:63003] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "aeFaxhP68VyHNvj1e54BWAAAAMY"]
[Fri Apr 17 05:55:19.470771 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:55603] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "aeFax0nQhUtMbw9EsgZ0xAAAARQ"]
[Fri Apr 17 05:55:20.114207 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:63018] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oij98gy.php"] [unique_id "aeFayEnQhUtMbw9EsgZ0xQAAARI"]
[Fri Apr 17 05:55:20.861720 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:64441] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeFayOMHGxkTZX3c45cEiQAAAIw"]
[Fri Apr 17 05:55:21.362765 2026] [:error] [pid 9263:tid 9284] [client 172.213.152.251:5182] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeFayRP68VyHNvj1e54BXwAAANM"]
[Fri Apr 17 05:55:21.980167 2026] [:error] [pid 9263:tid 9274] [client 172.213.152.251:63033] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeFayRP68VyHNvj1e54BYQAAAMk"]
[Fri Apr 17 05:55:22.520324 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:57232] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeFayuMHGxkTZX3c45cEkQAAAIc"]
[Fri Apr 17 05:55:23.160803 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:63092] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turkshell.php"] [unique_id "aeFay-MHGxkTZX3c45cElgAAAJM"]
[Fri Apr 17 05:55:23.687604 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:47040] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turkshell.php"] [unique_id "aeFayxP68VyHNvj1e54BZQAAAMM"]
[Fri Apr 17 05:55:24.435773 2026] [:error] [pid 9151:tid 9175] [client 172.213.152.251:55572] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turkshell.php"] [unique_id "aeFazMhTVuRPkua22vSfqwAAAA4"]
[Fri Apr 17 05:55:25.127126 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:58881] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/turkshell.php"] [unique_id "aeFazeMHGxkTZX3c45cEnQAAAIw"]
[Fri Apr 17 05:55:25.985152 2026] [:error] [pid 51878:tid 51884] [client 172.213.152.251:63012] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeFazUnQhUtMbw9EsgZ00gAAAQQ"]
[Fri Apr 17 05:55:26.630533 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:47062] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeFazknQhUtMbw9EsgZ01gAAAQM"]
[Fri Apr 17 05:55:27.281839 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:5167] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeFazxP68VyHNvj1e54BbwAAAM8"]
[Fri Apr 17 05:55:27.785919 2026] [:error] [pid 9153:tid 9220] [client 172.213.152.251:5131] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeFaz-MHGxkTZX3c45cEowAAAII"]
[Fri Apr 17 05:55:28.384749 2026] [:error] [pid 51878:tid 51895] [client 172.213.152.251:5134] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeFa0EnQhUtMbw9EsgZ03gAAAQ8"]
[Fri Apr 17 05:55:29.007803 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:64410] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeFa0UnQhUtMbw9EsgZ04gAAAQ0"]
[Fri Apr 17 05:55:29.476603 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:57044] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeFa0RP68VyHNvj1e54BcwAAAMQ"]
[Fri Apr 17 05:55:30.056335 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:45150] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeFa0uMHGxkTZX3c45cEpAAAAJM"]
[Fri Apr 17 05:55:30.596129 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:57245] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeFa0knQhUtMbw9EsgZ06gAAAQc"]
[Fri Apr 17 05:55:31.265794 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:47067] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeFa00nQhUtMbw9EsgZ07gAAAQ0"]
[Fri Apr 17 05:55:31.909167 2026] [:error] [pid 9153:tid 9226] [client 172.213.152.251:57076] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeFa0-MHGxkTZX3c45cEqQAAAIg"]
[Fri Apr 17 05:55:32.838090 2026] [:error] [pid 9151:tid 9164] [client 172.213.152.251:63006] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeFa1MhTVuRPkua22vSfsQAAAAM"]
[Fri Apr 17 05:55:33.611741 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:57259] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeFa1UnQhUtMbw9EsgZ09gAAARg"]
[Fri Apr 17 05:55:34.852460 2026] [:error] [pid 51878:tid 51881] [client 172.213.152.251:55594] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeFa1knQhUtMbw9EsgZ0-gAAAQE"]
[Fri Apr 17 05:55:35.516729 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:45131] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeFa1xP68VyHNvj1e54BdgAAAMs"]
[Fri Apr 17 05:55:36.065305 2026] [:error] [pid 9263:tid 9287] [client 172.213.152.251:52053] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeFa2BP68VyHNvj1e54BdwAAANY"]
[Fri Apr 17 05:55:36.572531 2026] [:error] [pid 9151:tid 9185] [client 172.213.152.251:5168] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeFa2MhTVuRPkua22vSfuAAAABg"]
[Fri Apr 17 05:55:37.253489 2026] [:error] [pid 9263:tid 9279] [client 172.213.152.251:5145] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeFa2RP68VyHNvj1e54BegAAAM4"]
[Fri Apr 17 05:55:37.778698 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:55919] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeFa2eMHGxkTZX3c45cEsQAAAIs"]
[Fri Apr 17 05:55:38.398916 2026] [:error] [pid 9151:tid 9167] [client 172.213.152.251:5963] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeFa2shTVuRPkua22vSfugAAAAY"]
[Fri Apr 17 05:55:39.174916 2026] [:error] [pid 9263:tid 9278] [client 172.213.152.251:58889] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeFa2xP68VyHNvj1e54BfwAAAM0"]
[Fri Apr 17 05:55:40.836138 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:58923] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeFa3EnQhUtMbw9EsgZ1AQAAARY"]
[Fri Apr 17 05:55:41.557083 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:55890] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeFa3UnQhUtMbw9EsgZ1BQAAAQA"]
[Fri Apr 17 05:55:42.056657 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:63083] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeFa3knQhUtMbw9EsgZ1CAAAAQk"]
[Fri Apr 17 05:55:42.673984 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:52379] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeFa3uMHGxkTZX3c45cEuAAAAJU"]
[Fri Apr 17 05:55:43.389492 2026] [:error] [pid 9151:tid 9183] [client 172.213.152.251:55921] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeFa38hTVuRPkua22vSfvgAAABY"]
[Fri Apr 17 05:55:44.927981 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:55583] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeFa4BP68VyHNvj1e54BggAAAMM"]
[Fri Apr 17 05:55:45.901447 2026] [proxy_fcgi:error] [pid 9263:tid 9276] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:46.167780 2026] [proxy_fcgi:error] [pid 9263:tid 9272] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:46.414391 2026] [proxy_fcgi:error] [pid 9263:tid 9270] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:46.892621 2026] [proxy_fcgi:error] [pid 9263:tid 9285] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:47.128162 2026] [proxy_fcgi:error] [pid 9263:tid 9269] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:47.366705 2026] [proxy_fcgi:error] [pid 9263:tid 9266] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:47.605062 2026] [proxy_fcgi:error] [pid 9263:tid 9284] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:47.842099 2026] [proxy_fcgi:error] [pid 9263:tid 9267] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:48.098826 2026] [proxy_fcgi:error] [pid 9263:tid 9273] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:48.362870 2026] [proxy_fcgi:error] [pid 9263:tid 9265] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:48.600778 2026] [proxy_fcgi:error] [pid 9263:tid 9282] [client 172.213.152.251:63091] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:55:48.837328 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:63091] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeFa5BP68VyHNvj1e54BmAAAAMM"]
[Fri Apr 17 05:55:49.435970 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:5143] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeFa5UnQhUtMbw9EsgZ1DgAAARc"]
[Fri Apr 17 05:55:50.406839 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:44620] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeFa5knQhUtMbw9EsgZ1EQAAARY"]
[Fri Apr 17 05:55:50.991324 2026] [:error] [pid 9151:tid 9172] [client 172.213.152.251:52413] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeFa5shTVuRPkua22vSfwwAAAAs"]
[Fri Apr 17 05:55:51.819287 2026] [:error] [pid 9263:tid 9285] [client 172.213.152.251:53586] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeFa5xP68VyHNvj1e54BngAAANQ"]
[Fri Apr 17 05:55:52.528556 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:52375] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeFa6EnQhUtMbw9EsgZ1FgAAAQg"]
[Fri Apr 17 05:55:53.123997 2026] [:error] [pid 9263:tid 9267] [client 172.213.152.251:57301] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeFa6RP68VyHNvj1e54BnwAAAMI"]
[Fri Apr 17 05:55:53.913063 2026] [:error] [pid 9151:tid 9171] [client 172.213.152.251:49696] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeFa6chTVuRPkua22vSfxQAAAAo"]
[Fri Apr 17 05:55:55.120021 2026] [:error] [pid 9153:tid 9219] [client 172.213.152.251:47423] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeFa6-MHGxkTZX3c45cEyQAAAIE"]
[Fri Apr 17 05:55:55.995280 2026] [:error] [pid 9153:tid 9233] [client 172.213.152.251:58999] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeFa6-MHGxkTZX3c45cEzQAAAI8"]
[Fri Apr 17 05:55:56.731400 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:57333] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeFa7EnQhUtMbw9EsgZ1GQAAARg"]
[Fri Apr 17 05:55:58.105835 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:44628] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeFa7hP68VyHNvj1e54BogAAAMw"]
[Fri Apr 17 05:55:59.057394 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:5903] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeFa70nQhUtMbw9EsgZ1IAAAAQY"]
[Fri Apr 17 05:55:59.968622 2026] [:error] [pid 9152:tid 9195] [client 172.213.152.251:57342] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeFa75JYca8I3TNCwIcTegAAAEU"]
[Fri Apr 17 05:56:00.607712 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:41687] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeFa8EnQhUtMbw9EsgZ1JQAAAQg"]
[Fri Apr 17 05:56:02.132711 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:58923] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeFa8uMHGxkTZX3c45cE1AAAAI4"]
[Fri Apr 17 05:56:02.891919 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:5915] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeFa8knQhUtMbw9EsgZ1LQAAAQU"]
[Fri Apr 17 05:56:03.773067 2026] [:error] [pid 51878:tid 51903] [client 172.213.152.251:40614] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeFa80nQhUtMbw9EsgZ1MAAAARc"]
[Fri Apr 17 05:56:04.611194 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:57291] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeFa9OMHGxkTZX3c45cE2QAAAIc"]
[Fri Apr 17 05:56:05.436388 2026] [:error] [pid 9153:tid 9238] [client 172.213.152.251:5904] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aeFa9eMHGxkTZX3c45cE2wAAAJQ"]
[Fri Apr 17 05:56:06.236726 2026] [:error] [pid 9151:tid 9183] [client 172.213.152.251:57295] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeFa9shTVuRPkua22vSfzAAAABY"]
[Fri Apr 17 05:56:07.533584 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:41701] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeFa9-MHGxkTZX3c45cE4AAAAJM"]
[Fri Apr 17 05:56:08.497136 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:48411] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeFa-BP68VyHNvj1e54BqAAAAME"]
[Fri Apr 17 05:56:09.533971 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:55551] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ass.php"] [unique_id "aeFa-ZJYca8I3TNCwIcTgAAAAEE"]
[Fri Apr 17 05:56:10.322410 2026] [:error] [pid 9263:tid 9265] [client 172.213.152.251:57913] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeFa-hP68VyHNvj1e54BrAAAAMA"]
[Fri Apr 17 05:56:12.382690 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:58423] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeFa_EnQhUtMbw9EsgZ1QwAAARE"]
[Fri Apr 17 05:56:13.446326 2026] [:error] [pid 9152:tid 9196] [client 172.213.152.251:40605] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeFa_ZJYca8I3TNCwIcThQAAAEY"]
[Fri Apr 17 05:56:14.436180 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:48441] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aeFa_knQhUtMbw9EsgZ1TAAAAQM"]
[Fri Apr 17 05:56:15.119292 2026] [:error] [pid 9153:tid 9240] [client 172.213.152.251:64850] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeFa_-MHGxkTZX3c45cE4gAAAJY"]
[Fri Apr 17 05:56:15.820135 2026] [:error] [pid 9153:tid 9223] [client 172.213.152.251:58407] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeFa_-MHGxkTZX3c45cE5AAAAIU"]
[Fri Apr 17 05:56:17.372089 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:53256] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeFbARP68VyHNvj1e54BtwAAAME"]
[Fri Apr 17 05:56:18.660720 2026] [:error] [pid 9263:tid 9287] [client 172.213.152.251:49402] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no18.php"] [unique_id "aeFbAhP68VyHNvj1e54BugAAANY"]
[Fri Apr 17 05:56:19.795111 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:48389] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeFbAxP68VyHNvj1e54BvgAAAMw"]
[Fri Apr 17 05:56:21.049011 2026] [:error] [pid 9263:tid 9272] [client 172.213.152.251:55039] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeFbBRP68VyHNvj1e54BwQAAAMc"]
[Fri Apr 17 05:56:21.769427 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:55532] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeFbBRP68VyHNvj1e54BwgAAAMg"]
[Fri Apr 17 05:56:22.934233 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:41750] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fine.php"] [unique_id "aeFbBhP68VyHNvj1e54BxQAAAMQ"]
[Fri Apr 17 05:56:23.944325 2026] [:error] [pid 9152:tid 9202] [client 172.213.152.251:56165] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "aeFbB5JYca8I3TNCwIcTsQAAAEw"]
[Fri Apr 17 05:56:26.253473 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:49358] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "aeFbCknQhUtMbw9EsgZ1aAAAAQU"]
[Fri Apr 17 05:56:27.577728 2026] [:error] [pid 9151:tid 9177] [client 172.213.152.251:5381] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "aeFbC8hTVuRPkua22vSf0wAAABA"]
[Fri Apr 17 05:56:31.238637 2026] [:error] [pid 9153:tid 9237] [client 172.213.152.251:57931] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zample.php"] [unique_id "aeFbD-MHGxkTZX3c45cE-wAAAJM"]
[Fri Apr 17 05:56:33.634967 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:65440] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeFbEUnQhUtMbw9EsgZ1ewAAAQo"]
[Fri Apr 17 05:56:37.462286 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:65469] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeFbFeMHGxkTZX3c45cFAwAAAIw"]
[Fri Apr 17 05:56:40.450068 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:58551] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeFbGBP68VyHNvj1e54B2wAAAMw"]
[Fri Apr 17 05:56:42.444174 2026] [:error] [pid 9153:tid 9229] [client 172.213.152.251:5285] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeFbGuMHGxkTZX3c45cFCwAAAIs"]
[Fri Apr 17 05:56:47.004528 2026] [:error] [pid 9263:tid 9285] [client 172.213.152.251:58479] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "aeFbHxP68VyHNvj1e54B5QAAANQ"]
[Fri Apr 17 05:56:49.411706 2026] [proxy_fcgi:error] [pid 9263:tid 9277] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:49.651486 2026] [proxy_fcgi:error] [pid 9263:tid 9267] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:49.900275 2026] [proxy_fcgi:error] [pid 9263:tid 9268] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:50.138548 2026] [proxy_fcgi:error] [pid 9263:tid 9265] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:50.386668 2026] [proxy_fcgi:error] [pid 9263:tid 9282] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:50.623355 2026] [proxy_fcgi:error] [pid 9263:tid 9273] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:50.858292 2026] [proxy_fcgi:error] [pid 9263:tid 9270] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:51.095863 2026] [proxy_fcgi:error] [pid 9263:tid 9275] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:51.332668 2026] [proxy_fcgi:error] [pid 9263:tid 9280] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:51.568799 2026] [proxy_fcgi:error] [pid 9263:tid 9288] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:52.941695 2026] [proxy_fcgi:error] [pid 9263:tid 9266] [client 172.213.152.251:58433] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:56:53.175341 2026] [:error] [pid 9263:tid 9269] [client 172.213.152.251:58433] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeFbJRP68VyHNvj1e54B9wAAAMQ"]
[Fri Apr 17 05:56:55.871647 2026] [:error] [pid 9153:tid 9226] [client 172.213.152.251:5787] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeFbJ-MHGxkTZX3c45cFLwAAAIg"]
[Fri Apr 17 05:56:56.518520 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:6103] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeFbKOMHGxkTZX3c45cFMwAAAIc"]
[Fri Apr 17 05:56:57.580515 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:42192] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeFbKUnQhUtMbw9EsgZ1sQAAAQw"]
[Fri Apr 17 05:56:58.460893 2026] [:error] [pid 9151:tid 9166] [client 172.213.152.251:51773] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbKshTVuRPkua22vSf8gAAAAU"]
[Fri Apr 17 05:56:59.127918 2026] [:error] [pid 9263:tid 9274] [client 172.213.152.251:51743] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbKxP68VyHNvj1e54B-QAAAMk"]
[Fri Apr 17 05:57:00.153080 2026] [:error] [pid 9263:tid 9287] [client 172.213.152.251:5258] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbLBP68VyHNvj1e54B-gAAANY"]
[Fri Apr 17 05:57:01.116409 2026] [:error] [pid 51878:tid 51881] [client 172.213.152.251:58178] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbLUnQhUtMbw9EsgZ1swAAAQE"]
[Fri Apr 17 05:57:02.035466 2026] [:error] [pid 9152:tid 9205] [client 172.213.152.251:41022] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeFbLpJYca8I3TNCwIcT9gAAAE8"]
[Fri Apr 17 05:57:03.854270 2026] [:error] [pid 9153:tid 9222] [client 172.213.152.251:55457] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeFbL-MHGxkTZX3c45cFPgAAAIQ"]
[Fri Apr 17 05:57:05.239030 2026] [:error] [pid 9263:tid 9277] [client 172.213.152.251:57780] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeFbMRP68VyHNvj1e54B_QAAAMw"]
[Fri Apr 17 05:57:06.657503 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:5480] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeFbMknQhUtMbw9EsgZ1tAAAARA"]
[Fri Apr 17 05:57:08.572057 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:6122] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeFbNBP68VyHNvj1e54CAAAAAMg"]
[Fri Apr 17 05:57:09.286460 2026] [:error] [pid 9263:tid 9275] [client 172.213.152.251:6101] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeFbNRP68VyHNvj1e54CAgAAAMo"]
[Fri Apr 17 05:57:10.095097 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:5458] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeFbNknQhUtMbw9EsgZ1uAAAARY"]
[Fri Apr 17 05:57:11.632715 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:50816] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeFbN-MHGxkTZX3c45cFSAAAAJA"]
[Fri Apr 17 05:57:12.641514 2026] [:error] [pid 51878:tid 51895] [client 172.213.152.251:40111] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeFbOEnQhUtMbw9EsgZ1xAAAAQ8"]
[Fri Apr 17 05:57:13.565030 2026] [:error] [pid 9153:tid 9238] [client 172.213.152.251:51712] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeFbOeMHGxkTZX3c45cFSQAAAJQ"]
[Fri Apr 17 05:57:14.277743 2026] [:error] [pid 9151:tid 9164] [client 172.213.152.251:54811] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeFbOshTVuRPkua22vSgAQAAAAM"]
[Fri Apr 17 05:57:15.235705 2026] [:error] [pid 51878:tid 51883] [client 172.213.152.251:58202] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeFbO0nQhUtMbw9EsgZ1xwAAAQM"]
[Fri Apr 17 05:57:16.102204 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:51738] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeFbPEnQhUtMbw9EsgZ1ygAAAQc"]
[Fri Apr 17 05:57:16.727575 2026] [:error] [pid 9151:tid 9169] [client 172.213.152.251:40118] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeFbPMhTVuRPkua22vSgAgAAAAg"]
[Fri Apr 17 05:57:17.314184 2026] [:error] [pid 9151:tid 9161] [client 172.213.152.251:61042] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeFbPchTVuRPkua22vSgBAAAAAA"]
[Fri Apr 17 05:57:17.898123 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:50842] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeFbPRP68VyHNvj1e54CEwAAAMg"]
[Fri Apr 17 05:57:18.573972 2026] [:error] [pid 9151:tid 9177] [client 172.213.152.251:61001] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeFbPshTVuRPkua22vSgBgAAABA"]
[Fri Apr 17 05:57:19.500384 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:62955] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeFbPxP68VyHNvj1e54CFgAAAM8"]
[Fri Apr 17 05:57:20.402834 2026] [:error] [pid 51878:tid 51881] [client 172.213.152.251:58613] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeFbQEnQhUtMbw9EsgZ11gAAAQE"]
[Fri Apr 17 05:57:21.748258 2026] [:error] [pid 9152:tid 9203] [client 172.213.152.251:51741] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeFbQZJYca8I3TNCwIcUFQAAAE0"]
[Fri Apr 17 05:57:24.198480 2026] [:error] [pid 9152:tid 9213] [client 172.213.152.251:54815] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeFbRJJYca8I3TNCwIcUFgAAAFc"]
[Fri Apr 17 05:57:26.770425 2026] [:error] [pid 9151:tid 9179] [client 172.213.152.251:58564] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeFbRshTVuRPkua22vSgEgAAABI"]
[Fri Apr 17 05:57:27.869374 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:5375] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeFbR0nQhUtMbw9EsgZ16QAAAQI"]
[Fri Apr 17 05:57:29.324740 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:56566] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeFbSUnQhUtMbw9EsgZ17QAAARM"]
[Fri Apr 17 05:57:30.030755 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:55439] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeFbSknQhUtMbw9EsgZ19AAAAQo"]
[Fri Apr 17 05:57:31.842421 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:57745] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeFbSxP68VyHNvj1e54CKgAAAM8"]
[Fri Apr 17 05:57:33.328965 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:49746] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeFbTRP68VyHNvj1e54CKwAAAMs"]
[Fri Apr 17 05:57:34.900733 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:56553] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeFbTknQhUtMbw9EsgZ1-gAAAQc"]
[Fri Apr 17 05:57:37.092001 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:49773] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbUeMHGxkTZX3c45cFqAAAAJU"]
[Fri Apr 17 05:57:39.753843 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:5676] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbU0nQhUtMbw9EsgZ2AQAAARY"]
[Fri Apr 17 05:57:41.530249 2026] [:error] [pid 9151:tid 9163] [client 172.213.152.251:57732] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbVchTVuRPkua22vSgIAAAAAI"]
[Fri Apr 17 05:57:43.932267 2026] [:error] [pid 9263:tid 9270] [client 172.213.152.251:5669] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbVxP68VyHNvj1e54CPQAAAMU"]
[Fri Apr 17 05:57:45.972126 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:40105] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFbWUnQhUtMbw9EsgZ2IgAAAQk"]
[Fri Apr 17 05:57:46.917504 2026] [:error] [pid 9263:tid 9272] [client 172.213.152.251:58576] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFbWhP68VyHNvj1e54CSwAAAMc"]
[Fri Apr 17 05:57:48.092994 2026] [:error] [pid 9152:tid 9211] [client 172.213.152.251:48506] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFbXJJYca8I3TNCwIcULgAAAFU"]
[Fri Apr 17 05:57:48.982788 2026] [:error] [pid 9263:tid 9267] [client 172.213.152.251:50821] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFbXBP68VyHNvj1e54CTgAAAMI"]
[Fri Apr 17 05:57:49.786288 2026] [:error] [pid 51878:tid 51884] [client 172.213.152.251:49740] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeFbXUnQhUtMbw9EsgZ2KQAAAQQ"]
[Fri Apr 17 05:57:50.333202 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:62943] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeFbXknQhUtMbw9EsgZ2KwAAARQ"]
[Fri Apr 17 05:57:51.000672 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:58563] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeFbXknQhUtMbw9EsgZ2MQAAAQo"]
[Fri Apr 17 05:57:51.617485 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:62938] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless4.php"] [unique_id "aeFbX0nQhUtMbw9EsgZ2NgAAARg"]
[Fri Apr 17 05:57:52.209885 2026] [proxy_fcgi:error] [pid 9263:tid 9276] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:52.500397 2026] [proxy_fcgi:error] [pid 9263:tid 9284] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:52.736564 2026] [proxy_fcgi:error] [pid 9263:tid 9289] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:53.048874 2026] [proxy_fcgi:error] [pid 9263:tid 9287] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:53.285756 2026] [proxy_fcgi:error] [pid 9263:tid 9267] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:53.758511 2026] [proxy_fcgi:error] [pid 9263:tid 9273] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:54.013431 2026] [proxy_fcgi:error] [pid 9263:tid 9280] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:54.249564 2026] [proxy_fcgi:error] [pid 9263:tid 9268] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:54.485085 2026] [proxy_fcgi:error] [pid 9263:tid 9275] [client 172.213.152.251:49770] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:57:54.954388 2026] [:error] [pid 9263:tid 9278] [client 172.213.152.251:49770] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbYhP68VyHNvj1e54CYQAAAM0"]
[Fri Apr 17 05:57:55.867598 2026] [:error] [pid 9152:tid 9212] [client 172.213.152.251:64469] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbY5JYca8I3TNCwIcUSAAAAFY"]
[Fri Apr 17 05:57:56.351559 2026] [:error] [pid 9153:tid 9231] [client 172.213.152.251:53241] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbZOMHGxkTZX3c45cF3wAAAI0"]
[Fri Apr 17 05:57:57.086757 2026] [:error] [pid 9153:tid 9241] [client 172.213.152.251:45068] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeFbZeMHGxkTZX3c45cF4AAAAJc"]
[Fri Apr 17 05:57:58.407867 2026] [:error] [pid 9151:tid 9183] [client 172.213.152.251:45736] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbZshTVuRPkua22vSgKwAAABY"]
[Fri Apr 17 05:57:59.922072 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:48457] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbZ0nQhUtMbw9EsgZ2PQAAAQY"]
[Fri Apr 17 05:58:03.147232 2026] [:error] [pid 9151:tid 9174] [client 172.213.152.251:45734] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFba8hTVuRPkua22vSgMgAAAA0"]
[Fri Apr 17 05:58:06.869133 2026] [:error] [pid 9263:tid 9274] [client 172.213.152.251:62893] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbbhP68VyHNvj1e54CcAAAAMk"]
[Fri Apr 17 05:58:10.895489 2026] [:error] [pid 51878:tid 51902] [client 172.213.152.251:64660] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeFbcknQhUtMbw9EsgZ2QgAAARY"]
[Fri Apr 17 05:58:14.126858 2026] [:error] [pid 51878:tid 51890] [client 172.213.152.251:56472] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeFbdknQhUtMbw9EsgZ2UQAAAQo"]
[Fri Apr 17 05:58:17.966716 2026] [:error] [pid 9152:tid 9191] [client 172.213.152.251:57013] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeFbeZJYca8I3TNCwIcUZwAAAEE"]
[Fri Apr 17 05:58:24.932506 2026] [:error] [pid 51878:tid 51904] [client 172.213.152.251:60539] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeFbgEnQhUtMbw9EsgZ2dwAAARg"]
[Fri Apr 17 05:58:27.408977 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:51324] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeFbg0nQhUtMbw9EsgZ2gAAAAQc"]
[Fri Apr 17 05:58:28.580625 2026] [:error] [pid 9151:tid 9167] [client 172.213.152.251:51303] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeFbhMhTVuRPkua22vSgRQAAAAY"]
[Fri Apr 17 05:58:29.696485 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:41296] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeFbhRP68VyHNvj1e54CcwAAAMg"]
[Fri Apr 17 05:58:30.700415 2026] [:error] [pid 9152:tid 9203] [client 172.213.152.251:57578] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbhpJYca8I3TNCwIcUbAAAAE0"]
[Fri Apr 17 05:58:31.976880 2026] [:error] [pid 9153:tid 9223] [client 172.213.152.251:52898] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbh-MHGxkTZX3c45cF9gAAAIU"]
[Fri Apr 17 05:58:33.802317 2026] [:error] [pid 9153:tid 9219] [client 172.213.152.251:61960] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbieMHGxkTZX3c45cF-QAAAIE"]
[Fri Apr 17 05:58:35.183616 2026] [:error] [pid 9151:tid 9168] [client 172.213.152.251:60534] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeFbi8hTVuRPkua22vSgSQAAAAc"]
[Fri Apr 17 05:58:35.961497 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:56989] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeFbi0nQhUtMbw9EsgZ2oQAAAQA"]
[Fri Apr 17 05:58:37.219913 2026] [:error] [pid 51878:tid 51897] [client 172.213.152.251:50256] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeFbjUnQhUtMbw9EsgZ2pwAAARE"]
[Fri Apr 17 05:58:37.887550 2026] [:error] [pid 9152:tid 9213] [client 172.213.152.251:56777] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeFbjZJYca8I3TNCwIcUcgAAAFc"]
[Fri Apr 17 05:58:39.340650 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:57017] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeFbj0nQhUtMbw9EsgZ2sQAAARQ"]
[Fri Apr 17 05:58:40.143744 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:5850] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeFbkOMHGxkTZX3c45cF_wAAAJU"]
[Fri Apr 17 05:58:41.196414 2026] [:error] [pid 9151:tid 9175] [client 172.213.152.251:56978] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeFbkchTVuRPkua22vSgSgAAAA4"]
[Fri Apr 17 05:58:42.649145 2026] [:error] [pid 51878:tid 51894] [client 172.213.152.251:60484] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeFbkknQhUtMbw9EsgZ2uwAAAQ4"]
[Fri Apr 17 05:58:43.763198 2026] [:error] [pid 51878:tid 51900] [client 172.213.152.251:43027] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeFbk0nQhUtMbw9EsgZ2wAAAARQ"]
[Fri Apr 17 05:58:44.451083 2026] [:error] [pid 51878:tid 51880] [client 172.213.152.251:5505] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeFblEnQhUtMbw9EsgZ2xAAAAQA"]
[Fri Apr 17 05:58:45.614416 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:52099] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeFblUnQhUtMbw9EsgZ2zAAAAQ0"]
[Fri Apr 17 05:58:46.904776 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:43020] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeFblhP68VyHNvj1e54ChQAAAMM"]
[Fri Apr 17 05:58:47.897461 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:57570] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeFblxP68VyHNvj1e54CjAAAAME"]
[Fri Apr 17 05:58:49.160414 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:56980] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFbmUnQhUtMbw9EsgZ21QAAAQU"]
[Fri Apr 17 05:58:50.158187 2026] [:error] [pid 51878:tid 51891] [client 172.213.152.251:51272] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFbmknQhUtMbw9EsgZ22wAAAQs"]
[Fri Apr 17 05:58:51.262646 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:42539] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFbmxP68VyHNvj1e54CmwAAAM8"]
[Fri Apr 17 05:58:52.438961 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:52913] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFbnEnQhUtMbw9EsgZ24wAAAQc"]
[Fri Apr 17 05:58:53.382974 2026] [:error] [pid 9152:tid 9192] [client 172.213.152.251:60521] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeFbnZJYca8I3TNCwIcUkQAAAEI"]
[Fri Apr 17 05:58:54.716343 2026] [proxy_fcgi:error] [pid 51878:tid 51886] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:54.952117 2026] [proxy_fcgi:error] [pid 51878:tid 51892] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:55.457555 2026] [proxy_fcgi:error] [pid 51878:tid 51890] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:55.702017 2026] [proxy_fcgi:error] [pid 51878:tid 51897] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:55.938557 2026] [proxy_fcgi:error] [pid 51878:tid 51902] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:56.437196 2026] [proxy_fcgi:error] [pid 51878:tid 51886] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:56.908940 2026] [proxy_fcgi:error] [pid 51878:tid 51890] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:57.146048 2026] [proxy_fcgi:error] [pid 51878:tid 51897] [client 172.213.152.251:57020] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:58:57.614924 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:57020] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeFboUnQhUtMbw9EsgZ3AAAAAQg"]
[Fri Apr 17 05:58:58.275758 2026] [:error] [pid 9153:tid 9228] [client 172.213.152.251:52125] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeFbouMHGxkTZX3c45cGDQAAAIo"]
[Fri Apr 17 05:58:59.252752 2026] [:error] [pid 9152:tid 9194] [client 172.213.152.251:52916] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeFbo5JYca8I3TNCwIcUngAAAEQ"]
[Fri Apr 17 05:59:00.944531 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:60522] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeFbpEnQhUtMbw9EsgZ3BAAAAQc"]
[Fri Apr 17 05:59:01.776435 2026] [:error] [pid 9151:tid 9172] [client 172.213.152.251:60903] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFbpchTVuRPkua22vSgZwAAAAs"]
[Fri Apr 17 05:59:03.409725 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:60890] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFbp5JYca8I3TNCwIcUpAAAAEM"]
[Fri Apr 17 05:59:05.267705 2026] [:error] [pid 9263:tid 9278] [client 172.213.152.251:50244] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFbqRP68VyHNvj1e54CsQAAAM0"]
[Fri Apr 17 05:59:07.508378 2026] [:error] [pid 9153:tid 9222] [client 172.213.152.251:5561] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFbq-MHGxkTZX3c45cGGgAAAIQ"]
[Fri Apr 17 05:59:10.148373 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:60917] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbrhP68VyHNvj1e54CvQAAAMs"]
[Fri Apr 17 05:59:11.463384 2026] [:error] [pid 9152:tid 9196] [client 172.213.152.251:52891] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbr5JYca8I3TNCwIcUqgAAAEY"]
[Fri Apr 17 05:59:12.524994 2026] [:error] [pid 9152:tid 9206] [client 172.213.152.251:56965] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbsJJYca8I3TNCwIcUrAAAAFA"]
[Fri Apr 17 05:59:13.253073 2026] [:error] [pid 9153:tid 9238] [client 172.213.152.251:5870] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeFbseMHGxkTZX3c45cGHwAAAJQ"]
[Fri Apr 17 05:59:14.700219 2026] [:error] [pid 9263:tid 9280] [client 172.213.152.251:50816] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeFbshP68VyHNvj1e54CzAAAAM8"]
[Fri Apr 17 05:59:16.662331 2026] [:error] [pid 9263:tid 9271] [client 172.213.152.251:52117] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeFbtBP68VyHNvj1e54C0QAAAMY"]
[Fri Apr 17 05:59:17.895182 2026] [:error] [pid 51878:tid 51896] [client 172.213.152.251:60499] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeFbtUnQhUtMbw9EsgZ3EwAAARA"]
[Fri Apr 17 05:59:20.030188 2026] [:error] [pid 9153:tid 9242] [client 172.213.152.251:60790] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeFbuOMHGxkTZX3c45cGJgAAAJg"]
[Fri Apr 17 05:59:21.634617 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:52901] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeFbuUnQhUtMbw9EsgZ3GAAAAQw"]
[Fri Apr 17 05:59:24.140982 2026] [:error] [pid 9153:tid 9219] [client 172.213.152.251:52147] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeFbvOMHGxkTZX3c45cGKAAAAIE"]
[Fri Apr 17 05:59:29.336125 2026] [:error] [pid 9151:tid 9184] [client 172.213.152.251:56772] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeFbwchTVuRPkua22vSgdwAAABc"]
[Fri Apr 17 05:59:31.866321 2026] [:error] [pid 51878:tid 51899] [client 172.213.152.251:43016] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeFbw0nQhUtMbw9EsgZ3MQAAARM"]
[Fri Apr 17 05:59:38.454011 2026] [:error] [pid 51878:tid 51898] [client 172.213.152.251:57780] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeFbyknQhUtMbw9EsgZ3WgAAARI"]
[Fri Apr 17 05:59:41.440988 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:60481] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeFbzUnQhUtMbw9EsgZ3awAAAQw"]
[Fri Apr 17 05:59:47.180876 2026] [:error] [pid 9153:tid 9219] [client 172.213.152.251:52912] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeFb0-MHGxkTZX3c45cGSwAAAIE"]
[Fri Apr 17 05:59:47.781693 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:43011] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeFb0xP68VyHNvj1e54DCAAAAMM"]
[Fri Apr 17 05:59:48.721584 2026] [:error] [pid 51878:tid 51895] [client 172.213.152.251:52865] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeFb1EnQhUtMbw9EsgZ3kwAAAQ8"]
[Fri Apr 17 05:59:49.315750 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:52304] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeFb1RP68VyHNvj1e54DDwAAAME"]
[Fri Apr 17 05:59:50.833807 2026] [:error] [pid 9263:tid 9273] [client 172.213.152.251:50881] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeFb1hP68VyHNvj1e54DFQAAAMg"]
[Fri Apr 17 05:59:52.323474 2026] [:error] [pid 51878:tid 51884] [client 172.213.152.251:43059] [client 172.213.152.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeFb2EnQhUtMbw9EsgZ3nAAAAQQ"]
[Fri Apr 17 05:59:53.024300 2026] [:error] [pid 9152:tid 9214] [client 172.213.152.251:42510] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeFb2ZJYca8I3TNCwIcU1AAAAFg"]
[Fri Apr 17 05:59:53.729496 2026] [:error] [pid 9153:tid 9220] [client 172.213.152.251:50923] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeFb2eMHGxkTZX3c45cGZQAAAII"]
[Fri Apr 17 05:59:54.748660 2026] [:error] [pid 9153:tid 9242] [client 172.213.152.251:54369] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeFb2uMHGxkTZX3c45cGaQAAAJg"]
[Fri Apr 17 05:59:55.282016 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:56827] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeFb2xP68VyHNvj1e54DHwAAAMs"]
[Fri Apr 17 05:59:56.456908 2026] [:error] [pid 9152:tid 9199] [client 172.213.152.251:56966] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "aeFb3JJYca8I3TNCwIcU3wAAAEk"]
[Fri Apr 17 05:59:58.279749 2026] [proxy_fcgi:error] [pid 9153:tid 9226] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:59:58.699788 2026] [proxy_fcgi:error] [pid 9153:tid 9233] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:59:58.944350 2026] [proxy_fcgi:error] [pid 9153:tid 9223] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:59:59.194195 2026] [proxy_fcgi:error] [pid 9153:tid 9234] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 05:59:59.754438 2026] [proxy_fcgi:error] [pid 9153:tid 9242] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:00:00.010980 2026] [proxy_fcgi:error] [pid 9153:tid 9236] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:00:00.256317 2026] [proxy_fcgi:error] [pid 9153:tid 9219] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:00:00.495030 2026] [proxy_fcgi:error] [pid 9153:tid 9225] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:00:00.734627 2026] [proxy_fcgi:error] [pid 9153:tid 9224] [client 172.213.152.251:60748] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:00:01.014391 2026] [:error] [pid 9153:tid 9239] [client 172.213.152.251:60748] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFb4eMHGxkTZX3c45cGfwAAAJU"]
[Fri Apr 17 06:00:02.330382 2026] [:error] [pid 9152:tid 9211] [client 172.213.152.251:49706] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFb4pJYca8I3TNCwIcU6gAAAFU"]
[Fri Apr 17 06:00:04.469363 2026] [:error] [pid 9152:tid 9204] [client 172.213.152.251:60914] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFb5JJYca8I3TNCwIcU8gAAAE4"]
[Fri Apr 17 06:00:07.237144 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:54740] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFb5-MHGxkTZX3c45cGhQAAAI4"]
[Fri Apr 17 06:00:08.096091 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:50927] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeFb6EnQhUtMbw9EsgZ35AAAAQw"]
[Fri Apr 17 06:00:09.519981 2026] [:error] [pid 9153:tid 9230] [client 172.213.152.251:61729] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeFb6eMHGxkTZX3c45cGjgAAAIw"]
[Fri Apr 17 06:00:11.330792 2026] [:error] [pid 51878:tid 51893] [client 172.213.152.251:55590] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeFb60nQhUtMbw9EsgZ38wAAAQ0"]
[Fri Apr 17 06:00:12.742879 2026] [:error] [pid 51878:tid 51901] [client 172.213.152.251:61074] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeFb7EnQhUtMbw9EsgZ3-wAAARU"]
[Fri Apr 17 06:00:13.674864 2026] [:error] [pid 9263:tid 9279] [client 172.213.152.251:55817] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeFb7RP68VyHNvj1e54DVAAAAM4"]
[Fri Apr 17 06:00:14.919549 2026] [:error] [pid 9152:tid 9193] [client 172.213.152.251:47095] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeFb7pJYca8I3TNCwIcU-QAAAEM"]
[Fri Apr 17 06:00:15.880680 2026] [:error] [pid 9151:tid 9181] [client 172.213.152.251:55829] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeFb78hTVuRPkua22vSgrAAAABQ"]
[Fri Apr 17 06:00:17.362652 2026] [:error] [pid 9151:tid 9165] [client 172.213.152.251:47431] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeFb8chTVuRPkua22vSgsAAAAAQ"]
[Fri Apr 17 06:00:19.950931 2026] [:error] [pid 9151:tid 9170] [client 172.213.152.251:55585] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeFb88hTVuRPkua22vSgswAAAAk"]
[Fri Apr 17 06:00:20.613678 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:58928] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeFb9EnQhUtMbw9EsgZ4GgAAAQY"]
[Fri Apr 17 06:00:21.714399 2026] [:error] [pid 51878:tid 51887] [client 172.213.152.251:51663] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeFb9UnQhUtMbw9EsgZ4HwAAAQc"]
[Fri Apr 17 06:00:22.689556 2026] [:error] [pid 9152:tid 9200] [client 172.213.152.251:52039] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeFb9pJYca8I3TNCwIcVEQAAAEo"]
[Fri Apr 17 06:00:25.019482 2026] [:error] [pid 9263:tid 9276] [client 172.213.152.251:47077] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeFb-RP68VyHNvj1e54DYgAAAMs"]
[Fri Apr 17 06:00:26.852555 2026] [:error] [pid 9153:tid 9218] [client 172.213.152.251:40058] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeFb-uMHGxkTZX3c45cGuAAAAIA"]
[Fri Apr 17 06:00:28.625712 2026] [:error] [pid 9153:tid 9232] [client 172.213.152.251:58907] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeFb_OMHGxkTZX3c45cGvAAAAI4"]
[Fri Apr 17 06:00:29.928586 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:40044] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeFb_UnQhUtMbw9EsgZ4NQAAAQY"]
[Fri Apr 17 06:00:31.231060 2026] [:error] [pid 9263:tid 9268] [client 172.213.152.251:46306] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeFb_xP68VyHNvj1e54DcgAAAMM"]
[Fri Apr 17 06:00:32.529432 2026] [:error] [pid 9263:tid 9272] [client 172.213.152.251:53578] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeFcABP68VyHNvj1e54DdAAAAMc"]
[Fri Apr 17 06:00:34.353492 2026] [:error] [pid 9263:tid 9281] [client 172.213.152.251:44655] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeFcAhP68VyHNvj1e54DeQAAANA"]
[Fri Apr 17 06:00:35.688108 2026] [:error] [pid 51878:tid 51888] [client 172.213.152.251:47419] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeFcA0nQhUtMbw9EsgZ4VQAAAQg"]
[Fri Apr 17 06:00:37.059979 2026] [:error] [pid 51878:tid 51889] [client 172.213.152.251:44609] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeFcBUnQhUtMbw9EsgZ4XwAAAQk"]
[Fri Apr 17 06:00:38.421894 2026] [:error] [pid 9151:tid 9178] [client 172.213.152.251:53252] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeFcBshTVuRPkua22vSg0QAAABE"]
[Fri Apr 17 06:00:39.516491 2026] [:error] [pid 9151:tid 9166] [client 172.213.152.251:6014] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeFcB8hTVuRPkua22vSg1gAAAAU"]
[Fri Apr 17 06:00:42.231153 2026] [:error] [pid 9153:tid 9225] [client 172.213.152.251:49349] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeFcCuMHGxkTZX3c45cG2gAAAIc"]
[Fri Apr 17 06:00:43.113004 2026] [:error] [pid 9151:tid 9173] [client 172.213.152.251:57873] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFcC8hTVuRPkua22vSg4QAAAAw"]
[Fri Apr 17 06:00:44.269935 2026] [:error] [pid 9151:tid 9163] [client 172.213.152.251:5990] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFcDMhTVuRPkua22vSg5wAAAAI"]
[Fri Apr 17 06:00:45.213353 2026] [:error] [pid 9152:tid 9214] [client 172.213.152.251:52359] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFcDZJYca8I3TNCwIcVMwAAAFg"]
[Fri Apr 17 06:00:45.938945 2026] [:error] [pid 9153:tid 9234] [client 172.213.152.251:57865] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeFcDeMHGxkTZX3c45cG4QAAAJA"]
[Fri Apr 17 06:00:46.640305 2026] [:error] [pid 51878:tid 51886] [client 172.213.152.251:52390] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeFcDknQhUtMbw9EsgZ4ZAAAAQY"]
[Fri Apr 17 06:00:47.979537 2026] [:error] [pid 51878:tid 51882] [client 172.213.152.251:41788] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeFcD0nQhUtMbw9EsgZ4ZQAAAQI"]
[Fri Apr 17 06:00:48.772028 2026] [:error] [pid 9263:tid 9279] [client 172.213.152.251:57863] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeFcEBP68VyHNvj1e54DkgAAAM4"]
[Fri Apr 17 06:00:50.249183 2026] [:error] [pid 9263:tid 9270] [client 172.213.152.251:52415] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeFcEhP68VyHNvj1e54DlgAAAMU"]
[Fri Apr 17 06:00:51.380814 2026] [:error] [pid 51878:tid 51892] [client 172.213.152.251:48244] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeFcE0nQhUtMbw9EsgZ4cQAAAQw"]
[Fri Apr 17 06:00:52.343446 2026] [:error] [pid 9263:tid 9266] [client 172.213.152.251:58175] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeFcFBP68VyHNvj1e54DogAAAME"]
[Fri Apr 17 06:00:54.220554 2026] [:error] [pid 9152:tid 9204] [client 172.213.152.251:59045] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeFcFpJYca8I3TNCwIcVNQAAAE4"]
[Fri Apr 17 06:00:55.339205 2026] [:error] [pid 9263:tid 9283] [client 172.213.152.251:41745] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeFcFxP68VyHNvj1e54D3gAAANI"]
[Fri Apr 17 06:00:56.525660 2026] [:error] [pid 9263:tid 9286] [client 172.213.152.251:49395] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeFcGBP68VyHNvj1e54D4wAAANU"]
[Fri Apr 17 06:00:57.711087 2026] [:error] [pid 9263:tid 9282] [client 172.213.152.251:54986] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeFcGRP68VyHNvj1e54D6QAAANE"]
[Fri Apr 17 06:00:59.425107 2026] [:error] [pid 51878:tid 51885] [client 172.213.152.251:63311] [client 172.213.152.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeFcG0nQhUtMbw9EsgZ41wAAAQU"]
[Fri Apr 17 06:01:01.315306 2026] [proxy_fcgi:error] [pid 9263:tid 9286] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:01.551839 2026] [proxy_fcgi:error] [pid 9263:tid 9278] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:01.798038 2026] [proxy_fcgi:error] [pid 9263:tid 9289] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:02.034940 2026] [proxy_fcgi:error] [pid 9263:tid 9268] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:02.274403 2026] [proxy_fcgi:error] [pid 9263:tid 9284] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:02.511385 2026] [proxy_fcgi:error] [pid 9263:tid 9270] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:02.747858 2026] [proxy_fcgi:error] [pid 9263:tid 9267] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:02.988404 2026] [proxy_fcgi:error] [pid 9263:tid 9283] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:03.224781 2026] [proxy_fcgi:error] [pid 9263:tid 9287] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:01:03.471514 2026] [proxy_fcgi:error] [pid 9263:tid 9281] [client 172.213.152.251:55529] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:54.498495 2026] [proxy_fcgi:error] [pid 9151:tid 9175] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:54.757745 2026] [proxy_fcgi:error] [pid 9151:tid 9176] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:55.016603 2026] [proxy_fcgi:error] [pid 9151:tid 9179] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:55.276063 2026] [proxy_fcgi:error] [pid 9151:tid 9178] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:55.533704 2026] [proxy_fcgi:error] [pid 9151:tid 9170] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:55.794675 2026] [proxy_fcgi:error] [pid 9151:tid 9173] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:56.058029 2026] [proxy_fcgi:error] [pid 9151:tid 9181] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:56.317893 2026] [proxy_fcgi:error] [pid 9151:tid 9164] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:56.576952 2026] [proxy_fcgi:error] [pid 9151:tid 9183] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:56.836121 2026] [proxy_fcgi:error] [pid 9151:tid 9171] [client 74.248.37.20:8841] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 06:21:57.091571 2026] [:error] [pid 9151:tid 9169] [client 74.248.37.20:8841] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aeFhBchTVuRPkua22vSnoQAAAAg"]
[Fri Apr 17 06:21:57.602005 2026] [:error] [pid 9152:tid 9197] [client 74.248.37.20:21916] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aeFhBZJYca8I3TNCwIccrwAAAEc"]
[Fri Apr 17 06:21:58.112531 2026] [:error] [pid 51878:tid 51894] [client 74.248.37.20:8943] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aeFhBknQhUtMbw9EsgaLxAAAAQ4"]
[Fri Apr 17 06:21:58.623670 2026] [:error] [pid 9263:tid 9275] [client 74.248.37.20:8911] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "aeFhBhP68VyHNvj1e54QKAAAAMo"]
[Fri Apr 17 06:21:59.134649 2026] [:error] [pid 9263:tid 9282] [client 74.248.37.20:12702] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/block-template-utils.php"] [unique_id "aeFhBxP68VyHNvj1e54QMAAAANE"]
[Fri Apr 17 06:21:59.644855 2026] [:error] [pid 51878:tid 51896] [client 74.248.37.20:8871] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/block-template-utils.php"] [unique_id "aeFhB0nQhUtMbw9EsgaLxwAAARA"]
[Fri Apr 17 06:22:00.156006 2026] [:error] [pid 51878:tid 51901] [client 74.248.37.20:10220] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/block-template-utils.php"] [unique_id "aeFhCEnQhUtMbw9EsgaLygAAARU"]
[Fri Apr 17 06:22:00.666383 2026] [:error] [pid 9153:tid 9238] [client 74.248.37.20:15441] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/block-template-utils.php"] [unique_id "aeFhCOMHGxkTZX3c45cRGAAAAJQ"]
[Fri Apr 17 06:22:01.176148 2026] [:error] [pid 51878:tid 51887] [client 74.248.37.20:35555] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/14.php"] [unique_id "aeFhCUnQhUtMbw9EsgaLzQAAAQc"]
[Fri Apr 17 06:22:01.687641 2026] [:error] [pid 9152:tid 9211] [client 74.248.37.20:35534] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/14.php"] [unique_id "aeFhCZJYca8I3TNCwIccswAAAFU"]
[Fri Apr 17 06:22:02.198677 2026] [:error] [pid 9153:tid 9239] [client 74.248.37.20:12024] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/14.php"] [unique_id "aeFhCuMHGxkTZX3c45cRIAAAAJU"]
[Fri Apr 17 06:22:02.709730 2026] [:error] [pid 51878:tid 51885] [client 74.248.37.20:12693] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/14.php"] [unique_id "aeFhCknQhUtMbw9EsgaL2gAAAQU"]
[Fri Apr 17 06:22:03.219793 2026] [:error] [pid 51878:tid 51904] [client 74.248.37.20:11989] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update_with_pics.php"] [unique_id "aeFhC0nQhUtMbw9EsgaL4AAAARg"]
[Fri Apr 17 06:22:03.730526 2026] [:error] [pid 51878:tid 51903] [client 74.248.37.20:8840] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update_with_pics.php"] [unique_id "aeFhC0nQhUtMbw9EsgaL5wAAARc"]
[Fri Apr 17 06:22:04.242521 2026] [:error] [pid 9263:tid 9267] [client 74.248.37.20:11982] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update_with_pics.php"] [unique_id "aeFhDBP68VyHNvj1e54QQAAAAMI"]
[Fri Apr 17 06:22:04.752611 2026] [:error] [pid 51878:tid 51896] [client 74.248.37.20:15082] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update_with_pics.php"] [unique_id "aeFhDEnQhUtMbw9EsgaL8AAAARA"]
[Fri Apr 17 06:22:05.263726 2026] [:error] [pid 9151:tid 9167] [client 74.248.37.20:11990] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/date-object.php"] [unique_id "aeFhDchTVuRPkua22vSnrgAAAAY"]
[Fri Apr 17 06:22:05.773223 2026] [:error] [pid 51878:tid 51893] [client 74.248.37.20:2009] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/date-object.php"] [unique_id "aeFhDUnQhUtMbw9EsgaL9wAAAQ0"]
[Fri Apr 17 06:22:06.284197 2026] [:error] [pid 51878:tid 51890] [client 74.248.37.20:8895] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/date-object.php"] [unique_id "aeFhDknQhUtMbw9EsgaL-QAAAQo"]
[Fri Apr 17 06:22:06.802442 2026] [:error] [pid 51878:tid 51889] [client 74.248.37.20:1995] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/date-object.php"] [unique_id "aeFhDknQhUtMbw9EsgaL-gAAAQk"]
[Fri Apr 17 06:22:07.313411 2026] [:error] [pid 51878:tid 51896] [client 74.248.37.20:35532] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w-1.php"] [unique_id "aeFhD0nQhUtMbw9EsgaL_wAAARA"]
[Fri Apr 17 06:22:07.823757 2026] [:error] [pid 51878:tid 51901] [client 74.248.37.20:21894] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w-1.php"] [unique_id "aeFhD0nQhUtMbw9EsgaMAgAAARU"]
[Fri Apr 17 06:22:08.334548 2026] [:error] [pid 9263:tid 9278] [client 74.248.37.20:8927] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w-1.php"] [unique_id "aeFhEBP68VyHNvj1e54QTAAAAM0"]
[Fri Apr 17 06:22:08.844621 2026] [:error] [pid 51878:tid 51895] [client 74.248.37.20:10237] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w-1.php"] [unique_id "aeFhEEnQhUtMbw9EsgaMCQAAAQ8"]
[Fri Apr 17 06:22:09.355092 2026] [:error] [pid 9153:tid 9231] [client 74.248.37.20:10637] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "aeFhEeMHGxkTZX3c45cRNgAAAI0"]
[Fri Apr 17 06:22:09.866847 2026] [:error] [pid 9263:tid 9289] [client 74.248.37.20:10176] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "aeFhERP68VyHNvj1e54QUgAAANg"]
[Fri Apr 17 06:22:10.378853 2026] [:error] [pid 51878:tid 51880] [client 74.248.37.20:10186] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "aeFhEknQhUtMbw9EsgaMDwAAAQA"]
[Fri Apr 17 06:22:10.888782 2026] [:error] [pid 9152:tid 9210] [client 74.248.37.20:2013] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zwso.php"] [unique_id "aeFhEpJYca8I3TNCwIccvQAAAFQ"]
[Fri Apr 17 06:22:11.398946 2026] [:error] [pid 51878:tid 51888] [client 74.248.37.20:12170] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbh.php"] [unique_id "aeFhE0nQhUtMbw9EsgaMGAAAAQg"]
[Fri Apr 17 06:22:11.910733 2026] [:error] [pid 9263:tid 9281] [client 74.248.37.20:10681] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbh.php"] [unique_id "aeFhExP68VyHNvj1e54QXQAAANA"]
[Fri Apr 17 06:22:12.421219 2026] [:error] [pid 51878:tid 51892] [client 74.248.37.20:35533] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbh.php"] [unique_id "aeFhFEnQhUtMbw9EsgaMJwAAAQw"]
[Fri Apr 17 06:22:12.934794 2026] [:error] [pid 51878:tid 51898] [client 74.248.37.20:28718] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbh.php"] [unique_id "aeFhFEnQhUtMbw9EsgaMMQAAARI"]
[Fri Apr 17 06:22:13.446626 2026] [:error] [pid 51878:tid 51897] [client 74.248.37.20:8913] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gool.php"] [unique_id "aeFhFUnQhUtMbw9EsgaMPQAAARE"]
[Fri Apr 17 06:22:13.957640 2026] [:error] [pid 51878:tid 51891] [client 74.248.37.20:16140] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gool.php"] [unique_id "aeFhFUnQhUtMbw9EsgaMRwAAAQs"]
[Fri Apr 17 06:22:14.468056 2026] [:error] [pid 9152:tid 9214] [client 74.248.37.20:12211] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gool.php"] [unique_id "aeFhFpJYca8I3TNCwIccwgAAAFg"]
[Fri Apr 17 06:22:14.979182 2026] [:error] [pid 9152:tid 9203] [client 74.248.37.20:10172] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gool.php"] [unique_id "aeFhFpJYca8I3TNCwIccxwAAAE0"]
[Fri Apr 17 06:22:15.488400 2026] [:error] [pid 9263:tid 9277] [client 74.248.37.20:12162] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFhFxP68VyHNvj1e54QaAAAAMw"]
[Fri Apr 17 06:22:16.001717 2026] [:error] [pid 9153:tid 9239] [client 74.248.37.20:28702] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFhGOMHGxkTZX3c45cRRwAAAJU"]
[Fri Apr 17 06:22:16.511771 2026] [:error] [pid 51878:tid 51899] [client 74.248.37.20:28715] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFhGEnQhUtMbw9EsgaMZAAAARM"]
[Fri Apr 17 06:22:17.020561 2026] [:error] [pid 51878:tid 51880] [client 74.248.37.20:10175] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-pagebuilders-BDsjLk.php"] [unique_id "aeFhGUnQhUtMbw9EsgaMZwAAAQA"]
[Fri Apr 17 06:22:17.529810 2026] [:error] [pid 51878:tid 51894] [client 74.248.37.20:12216] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iiiihjwn.php"] [unique_id "aeFhGUnQhUtMbw9EsgaMaQAAAQ4"]
[Fri Apr 17 06:22:18.039217 2026] [:error] [pid 9153:tid 9242] [client 74.248.37.20:17208] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iiiihjwn.php"] [unique_id "aeFhGuMHGxkTZX3c45cRTwAAAJg"]
[Fri Apr 17 06:22:18.550105 2026] [:error] [pid 9153:tid 9233] [client 74.248.37.20:28701] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iiiihjwn.php"] [unique_id "aeFhGuMHGxkTZX3c45cRVAAAAI8"]
[Fri Apr 17 06:22:19.060857 2026] [:error] [pid 9153:tid 9231] [client 74.248.37.20:12182] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iiiihjwn.php"] [unique_id "aeFhG-MHGxkTZX3c45cRXAAAAI0"]
[Fri Apr 17 06:22:19.570586 2026] [:error] [pid 9263:tid 9274] [client 74.248.37.20:10631] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFhGxP68VyHNvj1e54QiQAAAMk"]
[Fri Apr 17 06:22:20.082353 2026] [:error] [pid 51878:tid 51889] [client 74.248.37.20:28679] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFhHEnQhUtMbw9EsgaMcAAAAQk"]
[Fri Apr 17 06:22:20.591890 2026] [:error] [pid 9153:tid 9227] [client 74.248.37.20:10653] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFhHOMHGxkTZX3c45cRcAAAAIk"]
[Fri Apr 17 06:22:21.103138 2026] [:error] [pid 9263:tid 9282] [client 74.248.37.20:9128] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ru_RU_lite.mo.php"] [unique_id "aeFhHRP68VyHNvj1e54QlQAAANE"]
[Fri Apr 17 06:22:21.612456 2026] [:error] [pid 9153:tid 9228] [client 74.248.37.20:11448] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpputty.php"] [unique_id "aeFhHeMHGxkTZX3c45cRdwAAAIo"]
[Fri Apr 17 06:22:22.121420 2026] [:error] [pid 9263:tid 9282] [client 74.248.37.20:17184] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpputty.php"] [unique_id "aeFhHhP68VyHNvj1e54QoQAAANE"]
[Fri Apr 17 06:22:22.630736 2026] [:error] [pid 9263:tid 9273] [client 74.248.37.20:9096] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpputty.php"] [unique_id "aeFhHhP68VyHNvj1e54QqwAAAMg"]
[Fri Apr 17 06:22:23.148589 2026] [:error] [pid 9151:tid 9171] [client 74.248.37.20:10118] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpputty.php"] [unique_id "aeFhH8hTVuRPkua22vSnwAAAAAo"]
[Fri Apr 17 06:22:23.657412 2026] [:error] [pid 9151:tid 9179] [client 74.248.37.20:11671] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dodo.php"] [unique_id "aeFhH8hTVuRPkua22vSnxAAAABI"]
[Fri Apr 17 06:22:24.167670 2026] [:error] [pid 9263:tid 9284] [client 74.248.37.20:16155] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dodo.php"] [unique_id "aeFhIBP68VyHNvj1e54QswAAANM"]
[Fri Apr 17 06:22:24.677816 2026] [:error] [pid 51878:tid 51892] [client 74.248.37.20:16144] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dodo.php"] [unique_id "aeFhIEnQhUtMbw9EsgaMdgAAAQw"]
[Fri Apr 17 06:22:25.188150 2026] [:error] [pid 51878:tid 51889] [client 74.248.37.20:14579] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dodo.php"] [unique_id "aeFhIUnQhUtMbw9EsgaMegAAAQk"]
[Fri Apr 17 06:22:25.698765 2026] [:error] [pid 51878:tid 51904] [client 74.248.37.20:17205] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-post-data.php"] [unique_id "aeFhIUnQhUtMbw9EsgaMhQAAARg"]
[Fri Apr 17 06:22:26.209195 2026] [:error] [pid 9152:tid 9198] [client 74.248.37.20:17158] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-post-data.php"] [unique_id "aeFhIpJYca8I3TNCwIcc8wAAAEg"]
[Fri Apr 17 06:22:26.720997 2026] [:error] [pid 9151:tid 9171] [client 74.248.37.20:10465] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-post-data.php"] [unique_id "aeFhIshTVuRPkua22vSn1gAAAAo"]
[Fri Apr 17 06:22:27.231483 2026] [:error] [pid 9151:tid 9175] [client 74.248.37.20:12163] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-post-data.php"] [unique_id "aeFhI8hTVuRPkua22vSn2AAAAA4"]
[Fri Apr 17 06:22:27.740813 2026] [:error] [pid 9152:tid 9196] [client 74.248.37.20:10126] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFhI5JYca8I3TNCwIcc_QAAAEY"]
[Fri Apr 17 06:22:28.250375 2026] [:error] [pid 9263:tid 9269] [client 74.248.37.20:10141] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFhJBP68VyHNvj1e54QzQAAAMQ"]
[Fri Apr 17 06:22:28.760702 2026] [:error] [pid 9263:tid 9273] [client 74.248.37.20:16152] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFhJBP68VyHNvj1e54Q0QAAAMg"]
[Fri Apr 17 06:22:29.271002 2026] [:error] [pid 9151:tid 9181] [client 74.248.37.20:9106] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-recovery-mode-key-service-add.php"] [unique_id "aeFhJchTVuRPkua22vSn6wAAABQ"]
[Fri Apr 17 06:22:29.781389 2026] [:error] [pid 9263:tid 9284] [client 74.248.37.20:10130] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Marvins.php"] [unique_id "aeFhJRP68VyHNvj1e54Q3AAAANM"]
[Fri Apr 17 06:22:30.292974 2026] [:error] [pid 9151:tid 9163] [client 74.248.37.20:1288] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Marvins.php"] [unique_id "aeFhJshTVuRPkua22vSn9QAAAAI"]
[Fri Apr 17 06:22:30.803143 2026] [:error] [pid 51878:tid 51890] [client 74.248.37.20:20373] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Marvins.php"] [unique_id "aeFhJknQhUtMbw9EsgaMlQAAAQo"]
[Fri Apr 17 06:22:31.312807 2026] [:error] [pid 51878:tid 51882] [client 74.248.37.20:11395] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Marvins.php"] [unique_id "aeFhJ0nQhUtMbw9EsgaMnAAAAQI"]
[Fri Apr 17 06:22:31.822774 2026] [:error] [pid 9153:tid 9238] [client 74.248.37.20:16661] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/astab.php"] [unique_id "aeFhJ-MHGxkTZX3c45cRowAAAJQ"]
[Fri Apr 17 06:22:32.354799 2026] [:error] [pid 9263:tid 9288] [client 74.248.37.20:14578] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/astab.php"] [unique_id "aeFhKBP68VyHNvj1e54Q7QAAANc"]
[Fri Apr 17 06:22:32.865642 2026] [:error] [pid 9153:tid 9240] [client 74.248.37.20:14590] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/astab.php"] [unique_id "aeFhKOMHGxkTZX3c45cRtQAAAJY"]
[Fri Apr 17 06:22:33.375894 2026] [:error] [pid 51878:tid 51884] [client 74.248.37.20:11392] [client 74.248.37.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/astab.php"] [unique_id "aeFhKUnQhUtMbw9EsgaMrAAAAQQ"]
[Fri Apr 17 06:57:07.155144 2026] [:error] [pid 9153:tid 9240] [client 51.83.101.126:50548] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeFpQ-MHGxkTZX3c45dGQgAAAJY"]
[Fri Apr 17 06:57:09.634162 2026] [:error] [pid 51878:tid 51895] [client 51.83.101.126:37022] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeFpRUnQhUtMbw9EsgbAWQAAAQ8"]
[Fri Apr 17 06:57:12.169405 2026] [:error] [pid 25010:tid 25022] [client 51.83.101.126:37028] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeFpSI-7kkf42RarqQ3VaAAAAUk"]
[Fri Apr 17 06:57:14.671081 2026] [:error] [pid 9153:tid 9230] [client 51.83.101.126:37044] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeFpSuMHGxkTZX3c45dGtQAAAIw"]
[Fri Apr 17 06:57:17.245005 2026] [:error] [pid 51878:tid 51902] [client 51.83.101.126:40780] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeFpTUnQhUtMbw9EsgbAagAAARY"]
[Fri Apr 17 06:57:19.595459 2026] [:error] [pid 9151:tid 9183] [client 51.83.101.126:40786] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeFpT8hTVuRPkua22vTBVAAAABY"]
[Fri Apr 17 06:57:22.233782 2026] [:error] [pid 25010:tid 25036] [client 51.83.101.126:40788] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeFpUo-7kkf42RarqQ3VvAAAAVc"]
[Fri Apr 17 06:57:24.647127 2026] [:error] [pid 9263:tid 9272] [client 51.83.101.126:40798] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeFpVBP68VyHNvj1e5440wAAAMc"]
[Fri Apr 17 06:57:27.213775 2026] [:error] [pid 51878:tid 51881] [client 51.83.101.126:52002] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeFpV0nQhUtMbw9EsgbAmgAAAQE"]
[Fri Apr 17 06:57:29.695674 2026] [:error] [pid 9152:tid 9204] [client 51.83.101.126:52010] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeFpWZJYca8I3TNCwIc7ZQAAAE4"]
[Fri Apr 17 06:57:32.341338 2026] [:error] [pid 9263:tid 9279] [client 51.83.101.126:52012] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeFpXBP68VyHNvj1e544-QAAAM4"]
[Fri Apr 17 06:57:34.848324 2026] [:error] [pid 51878:tid 51883] [client 51.83.101.126:52024] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeFpXknQhUtMbw9EsgbAyAAAAQM"]
[Fri Apr 17 06:57:37.267758 2026] [:error] [pid 25010:tid 25030] [client 51.83.101.126:46736] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeFpYY-7kkf42RarqQ3V4wAAAVE"]
[Fri Apr 17 06:57:39.743745 2026] [:error] [pid 9151:tid 9164] [client 51.83.101.126:46752] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeFpY8hTVuRPkua22vTB0QAAAAM"]
[Fri Apr 17 06:57:42.194839 2026] [:error] [pid 9152:tid 9210] [client 51.83.101.126:46766] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeFpZpJYca8I3TNCwIc7tgAAAFQ"]
[Fri Apr 17 06:57:44.754163 2026] [:error] [pid 51878:tid 51888] [client 51.83.101.126:46770] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeFpaEnQhUtMbw9EsgbA4QAAAQg"]
[Fri Apr 17 06:57:47.203701 2026] [:error] [pid 9153:tid 9219] [client 51.83.101.126:46236] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeFpa-MHGxkTZX3c45dHoAAAAIE"]
[Fri Apr 17 06:57:49.774767 2026] [:error] [pid 9263:tid 9287] [client 51.83.101.126:46246] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeFpbRP68VyHNvj1e545LAAAANY"]
[Fri Apr 17 06:57:52.237251 2026] [:error] [pid 9153:tid 9232] [client 51.83.101.126:46252] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeFpcOMHGxkTZX3c45dH4QAAAI4"]
[Fri Apr 17 06:57:54.682755 2026] [:error] [pid 9151:tid 9169] [client 51.83.101.126:46258] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeFpcshTVuRPkua22vTCAgAAAAg"]
[Fri Apr 17 06:57:57.317405 2026] [:error] [pid 9153:tid 9223] [client 51.83.101.126:39434] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeFpdeMHGxkTZX3c45dIBQAAAIU"]
[Fri Apr 17 06:57:59.917747 2026] [:error] [pid 51878:tid 51896] [client 51.83.101.126:39446] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeFpd0nQhUtMbw9EsgbBCwAAARA"]
[Fri Apr 17 06:58:02.328814 2026] [:error] [pid 25010:tid 25028] [client 51.83.101.126:39454] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeFpeo-7kkf42RarqQ3WbAAAAU8"]
[Fri Apr 17 06:58:04.786191 2026] [:error] [pid 51878:tid 51887] [client 51.83.101.126:39464] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeFpfEnQhUtMbw9EsgbBKgAAAQc"]
[Fri Apr 17 06:58:25.515922 2026] [:error] [pid 25010:tid 25037] [client 51.83.101.126:47164] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeFpkY-7kkf42RarqQ3XRgAAAVg"]
[Fri Apr 17 09:20:02.546006 2026] [:error] [pid 9263:tid 9269] [client 43.130.37.243:52540] [client 43.130.37.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeGKwhP68VyHNvj1e55hhwAAAMQ"]
[Fri Apr 17 10:20:56.628148 2026] [:error] [pid 34273:tid 34282] [client 193.151.188.226:42169] [client 193.151.188.226] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeGZCGuQDW686mK3dgGGpQAAAYc"]
[Fri Apr 17 10:20:56.628489 2026] [:error] [pid 34273:tid 34282] [client 193.151.188.226:42169] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.151.188.226, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeGZCGuQDW686mK3dgGGpQAAAYc"]
[Fri Apr 17 10:20:56.639530 2026] [proxy_fcgi:error] [pid 34273:tid 34282] [client 193.151.188.226:42169] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 10:20:57.976463 2026] [:error] [pid 34273:tid 34295] [client 193.151.188.226:16081] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.151.188.226, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeGZCWuQDW686mK3dgGGqQAAAZQ"], referer: https://www.google.com
[Fri Apr 17 10:20:57.980993 2026] [proxy_fcgi:error] [pid 34273:tid 34295] [client 193.151.188.226:16081] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 10:20:59.320567 2026] [:error] [pid 9151:tid 9177] [client 193.151.188.226:39423] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.151.188.226, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeGZC8hTVuRPkua22vT2MQAAABA"], referer: https://www.google.com
[Fri Apr 17 10:20:59.325425 2026] [proxy_fcgi:error] [pid 9151:tid 9177] [client 193.151.188.226:39423] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 10:21:00.656745 2026] [proxy_fcgi:error] [pid 34273:tid 34296] [client 193.151.188.226:25501] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 10:21:01.983966 2026] [:error] [pid 9152:tid 9195] [client 193.151.188.226:47749] [client 193.151.188.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "switchcreative.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aeGZDZJYca8I3TNCwIeuQQAAAEU"], referer: https://www.google.com
[Fri Apr 17 10:21:04.693495 2026] [:error] [pid 34273:tid 34290] [client 193.151.188.226:26599] [client 193.151.188.226] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeGZEGuQDW686mK3dgGGtwAAAY8"]
[Fri Apr 17 10:21:04.693755 2026] [:error] [pid 34273:tid 34290] [client 193.151.188.226:26599] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.151.188.226, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeGZEGuQDW686mK3dgGGtwAAAY8"]
[Fri Apr 17 10:21:04.698599 2026] [proxy_fcgi:error] [pid 34273:tid 34290] [client 193.151.188.226:26599] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 10:21:06.040694 2026] [:error] [pid 34273:tid 34288] [client 193.151.188.226:32137] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.151.188.226, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeGZEmuQDW686mK3dgGGuQAAAY0"], referer: https://www.google.com
[Fri Apr 17 10:21:06.045602 2026] [proxy_fcgi:error] [pid 34273:tid 34288] [client 193.151.188.226:32137] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 10:21:07.401324 2026] [:error] [pid 34273:tid 34284] [client 193.151.188.226:49415] [client 193.151.188.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.151.188.226, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeGZE2uQDW686mK3dgGGvAAAAYk"], referer: https://www.google.com
[Fri Apr 17 10:21:07.405409 2026] [proxy_fcgi:error] [pid 34273:tid 34284] [client 193.151.188.226:49415] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 10:21:09.015068 2026] [proxy_fcgi:error] [pid 34273:tid 34289] [client 193.151.188.226:18221] AH01071: Got error 'Primary script unknown', referer: https://www.google.com
[Fri Apr 17 15:22:26.320252 2026] [proxy_fcgi:error] [pid 9263:tid 9287] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:26.580206 2026] [proxy_fcgi:error] [pid 9263:tid 9271] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:26.847918 2026] [proxy_fcgi:error] [pid 9263:tid 9280] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:27.107401 2026] [proxy_fcgi:error] [pid 9263:tid 9279] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:27.440303 2026] [proxy_fcgi:error] [pid 9263:tid 9286] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:27.763145 2026] [proxy_fcgi:error] [pid 9263:tid 9265] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:28.118658 2026] [proxy_fcgi:error] [pid 9263:tid 9269] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:28.380007 2026] [proxy_fcgi:error] [pid 9263:tid 9282] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:28.646779 2026] [proxy_fcgi:error] [pid 9263:tid 9280] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:29.256964 2026] [proxy_fcgi:error] [pid 9263:tid 9275] [client 20.215.250.20:63533] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:22:29.512122 2026] [:error] [pid 9263:tid 9280] [client 20.215.250.20:63533] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eetu.php"] [unique_id "aeHftRP68VyHNvj1e565gAAAAM8"]
[Fri Apr 17 15:22:30.437595 2026] [:error] [pid 61523:tid 61557] [client 20.215.250.20:63499] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eetu.php"] [unique_id "aeHftsOaH-Pgc7WEf4NXpAAAAc8"]
[Fri Apr 17 15:22:31.364346 2026] [:error] [pid 9151:tid 9164] [client 20.215.250.20:63586] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eetu.php"] [unique_id "aeHft8hTVuRPkua22vQZbgAAAAM"]
[Fri Apr 17 15:22:31.962899 2026] [:error] [pid 9153:tid 9225] [client 20.215.250.20:62963] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eetu.php"] [unique_id "aeHft-MHGxkTZX3c45fWWAAAAIc"]
[Fri Apr 17 15:22:32.686809 2026] [:error] [pid 9153:tid 9221] [client 20.215.250.20:63575] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/C1.php"] [unique_id "aeHfuOMHGxkTZX3c45fWWgAAAIM"]
[Fri Apr 17 15:22:33.479926 2026] [:error] [pid 9153:tid 9237] [client 20.215.250.20:63599] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/C1.php"] [unique_id "aeHfueMHGxkTZX3c45fWXQAAAJM"]
[Fri Apr 17 15:22:34.357695 2026] [:error] [pid 9152:tid 9210] [client 20.215.250.20:62940] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/C1.php"] [unique_id "aeHfupJYca8I3TNCwIcKNQAAAFQ"]
[Fri Apr 17 15:22:35.157581 2026] [:error] [pid 61523:tid 61555] [client 20.215.250.20:62916] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/C1.php"] [unique_id "aeHfu8OaH-Pgc7WEf4NXqgAAAc0"]
[Fri Apr 17 15:22:35.873652 2026] [:error] [pid 9152:tid 9201] [client 20.215.250.20:63523] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b35.php"] [unique_id "aeHfu5JYca8I3TNCwIcKOwAAAEs"]
[Fri Apr 17 15:22:36.426716 2026] [:error] [pid 61523:tid 61548] [client 20.215.250.20:63550] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b35.php"] [unique_id "aeHfvMOaH-Pgc7WEf4NXrQAAAcY"]
[Fri Apr 17 15:22:37.308205 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:62961] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b35.php"] [unique_id "aeHfvRP68VyHNvj1e565xgAAAMA"]
[Fri Apr 17 15:22:37.964038 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:62926] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b35.php"] [unique_id "aeHfvRP68VyHNvj1e565ywAAAME"]
[Fri Apr 17 15:22:38.680627 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:63506] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeHfvhP68VyHNvj1e5650QAAAMA"]
[Fri Apr 17 15:22:39.454504 2026] [:error] [pid 51878:tid 51896] [client 20.215.250.20:63532] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeHfv0nQhUtMbw9EsgYlxAAAARA"]
[Fri Apr 17 15:22:41.194819 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:62973] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeHfwRP68VyHNvj1e5652gAAAMA"]
[Fri Apr 17 15:22:42.138158 2026] [:error] [pid 9263:tid 9279] [client 20.215.250.20:63493] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeHfwhP68VyHNvj1e5653AAAAM4"]
[Fri Apr 17 15:22:42.773498 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:62965] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-un.php"] [unique_id "aeHfwsOaH-Pgc7WEf4NXswAAAcE"]
[Fri Apr 17 15:22:43.772353 2026] [:error] [pid 61523:tid 61552] [client 20.215.250.20:62955] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-un.php"] [unique_id "aeHfw8OaH-Pgc7WEf4NXtgAAAco"]
[Fri Apr 17 15:22:44.533473 2026] [:error] [pid 9263:tid 9271] [client 20.215.250.20:63539] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-un.php"] [unique_id "aeHfxBP68VyHNvj1e5654wAAAMY"]
[Fri Apr 17 15:22:45.186393 2026] [:error] [pid 61523:tid 61548] [client 20.215.250.20:62946] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-un.php"] [unique_id "aeHfxcOaH-Pgc7WEf4NXuQAAAcY"]
[Fri Apr 17 15:22:45.904808 2026] [:error] [pid 51878:tid 51903] [client 20.215.250.20:63576] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aeHfxUnQhUtMbw9EsgYlygAAARc"]
[Fri Apr 17 15:22:46.827758 2026] [:error] [pid 9263:tid 9289] [client 20.215.250.20:63606] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aeHfxhP68VyHNvj1e5656AAAANg"]
[Fri Apr 17 15:22:47.951350 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:63510] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aeHfxxP68VyHNvj1e5657QAAAMc"]
[Fri Apr 17 15:22:48.663726 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:63586] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aeHfyBP68VyHNvj1e5658AAAAMk"]
[Fri Apr 17 15:22:49.532542 2026] [:error] [pid 9153:tid 9242] [client 20.215.250.20:64170] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeHfyeMHGxkTZX3c45fWZwAAAJg"]
[Fri Apr 17 15:22:50.267492 2026] [:error] [pid 9152:tid 9190] [client 20.215.250.20:63555] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeHfypJYca8I3TNCwIcKRAAAAEA"]
[Fri Apr 17 15:22:51.124552 2026] [:error] [pid 9263:tid 9282] [client 20.215.250.20:64140] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeHfyxP68VyHNvj1e565_AAAANE"]
[Fri Apr 17 15:22:51.916299 2026] [:error] [pid 9263:tid 9276] [client 20.215.250.20:64192] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeHfyxP68VyHNvj1e565_wAAAMs"]
[Fri Apr 17 15:22:52.619860 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:64162] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeHfzMOaH-Pgc7WEf4NXzwAAAcE"]
[Fri Apr 17 15:22:53.301663 2026] [:error] [pid 51878:tid 51882] [client 20.215.250.20:63508] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeHfzUnQhUtMbw9EsgYlzwAAAQI"]
[Fri Apr 17 15:22:54.119293 2026] [:error] [pid 34273:tid 34279] [client 20.215.250.20:64201] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeHfzmuQDW686mK3dgHK1wAAAYQ"]
[Fri Apr 17 15:22:54.821834 2026] [:error] [pid 9263:tid 9267] [client 20.215.250.20:64207] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeHfzhP68VyHNvj1e566GwAAAMI"]
[Fri Apr 17 15:22:55.563906 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64218] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeHfzxP68VyHNvj1e566HQAAAME"]
[Fri Apr 17 15:22:56.282929 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:64204] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeHf0BP68VyHNvj1e566IQAAANM"]
[Fri Apr 17 15:22:57.537414 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:64211] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeHf0RP68VyHNvj1e566JwAAANU"]
[Fri Apr 17 15:22:58.239090 2026] [:error] [pid 9152:tid 9194] [client 20.215.250.20:64209] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeHf0pJYca8I3TNCwIcKZwAAAEQ"]
[Fri Apr 17 15:22:59.189772 2026] [:error] [pid 9152:tid 9196] [client 20.215.250.20:64161] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eterezrezt.php"] [unique_id "aeHf05JYca8I3TNCwIcKawAAAEY"]
[Fri Apr 17 15:23:00.251497 2026] [:error] [pid 9263:tid 9277] [client 20.215.250.20:64214] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eterezrezt.php"] [unique_id "aeHf1BP68VyHNvj1e566LQAAAMw"]
[Fri Apr 17 15:23:00.813852 2026] [:error] [pid 9153:tid 9231] [client 20.215.250.20:63529] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eterezrezt.php"] [unique_id "aeHf1OMHGxkTZX3c45fWmAAAAI0"]
[Fri Apr 17 15:23:01.751208 2026] [:error] [pid 9263:tid 9288] [client 20.215.250.20:64197] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eterezrezt.php"] [unique_id "aeHf1RP68VyHNvj1e566MAAAANc"]
[Fri Apr 17 15:23:02.730736 2026] [:error] [pid 61523:tid 61546] [client 20.215.250.20:64235] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeHf1sOaH-Pgc7WEf4NX2QAAAcQ"]
[Fri Apr 17 15:23:03.343480 2026] [:error] [pid 61523:tid 61558] [client 20.215.250.20:63565] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeHf18OaH-Pgc7WEf4NX2gAAAdA"]
[Fri Apr 17 15:23:03.980361 2026] [:error] [pid 9152:tid 9202] [client 20.215.250.20:64158] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeHf15JYca8I3TNCwIcKdAAAAEw"]
[Fri Apr 17 15:23:04.695495 2026] [:error] [pid 25010:tid 25023] [client 20.215.250.20:63489] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeHf2I-7kkf42RarqQ1KwAAAAUo"]
[Fri Apr 17 15:23:05.348065 2026] [:error] [pid 9263:tid 9270] [client 20.215.250.20:64221] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeHf2RP68VyHNvj1e566QAAAAMU"]
[Fri Apr 17 15:23:06.111062 2026] [:error] [pid 34273:tid 34292] [client 20.215.250.20:64182] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeHf2muQDW686mK3dgHK3wAAAZE"]
[Fri Apr 17 15:23:06.772164 2026] [:error] [pid 51878:tid 51884] [client 20.215.250.20:63563] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeHf2knQhUtMbw9EsgYl2gAAAQQ"]
[Fri Apr 17 15:23:07.359543 2026] [:error] [pid 9263:tid 9281] [client 20.215.250.20:63613] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeHf2xP68VyHNvj1e566RwAAANA"]
[Fri Apr 17 15:23:08.274499 2026] [:error] [pid 9153:tid 9239] [client 20.215.250.20:63556] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeHf3OMHGxkTZX3c45fWmwAAAJU"]
[Fri Apr 17 15:23:08.836078 2026] [:error] [pid 9263:tid 9283] [client 20.215.250.20:64223] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeHf3BP68VyHNvj1e566SQAAANI"]
[Fri Apr 17 15:23:09.408006 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:63577] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeHf3RP68VyHNvj1e566SwAAAMc"]
[Fri Apr 17 15:23:10.034847 2026] [:error] [pid 9263:tid 9267] [client 20.215.250.20:64134] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeHf3hP68VyHNvj1e566TQAAAMI"]
[Fri Apr 17 15:23:10.622720 2026] [:error] [pid 51878:tid 51891] [client 20.215.250.20:63593] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeHf3knQhUtMbw9EsgYl3gAAAQs"]
[Fri Apr 17 15:23:11.362252 2026] [:error] [pid 9153:tid 9224] [client 20.215.250.20:63538] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeHf3-MHGxkTZX3c45fWnQAAAIY"]
[Fri Apr 17 15:23:12.096954 2026] [:error] [pid 61523:tid 61544] [client 20.215.250.20:64179] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeHf4MOaH-Pgc7WEf4NX3wAAAcI"]
[Fri Apr 17 15:23:12.800941 2026] [:error] [pid 61523:tid 61545] [client 20.215.250.20:62907] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeHf4MOaH-Pgc7WEf4NX4gAAAcM"]
[Fri Apr 17 15:23:13.415139 2026] [:error] [pid 61523:tid 61563] [client 20.215.250.20:64193] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeHf4cOaH-Pgc7WEf4NX5AAAAdU"]
[Fri Apr 17 15:23:14.029968 2026] [:error] [pid 34273:tid 34282] [client 20.215.250.20:64206] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeHf4muQDW686mK3dgHK6wAAAYc"]
[Fri Apr 17 15:23:15.343993 2026] [:error] [pid 9263:tid 9271] [client 20.215.250.20:64141] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeHf4xP68VyHNvj1e566VQAAAMY"]
[Fri Apr 17 15:23:16.087718 2026] [:error] [pid 25010:tid 25022] [client 20.215.250.20:64239] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeHf5I-7kkf42RarqQ1KxAAAAUk"]
[Fri Apr 17 15:23:16.879299 2026] [:error] [pid 9151:tid 9175] [client 20.215.250.20:63562] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeHf5MhTVuRPkua22vQZdwAAAA4"]
[Fri Apr 17 15:23:17.744444 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:64771] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeHf5RP68VyHNvj1e566WQAAAMA"]
[Fri Apr 17 15:23:18.334989 2026] [:error] [pid 61523:tid 61565] [client 20.215.250.20:64206] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeHf5sOaH-Pgc7WEf4NX6QAAAdc"]
[Fri Apr 17 15:23:19.234426 2026] [:error] [pid 9263:tid 9289] [client 20.215.250.20:64150] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "aeHf5xP68VyHNvj1e566YQAAANg"]
[Fri Apr 17 15:23:19.846316 2026] [:error] [pid 9263:tid 9268] [client 20.215.250.20:64232] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeHf5xP68VyHNvj1e566ZAAAAMM"]
[Fri Apr 17 15:23:20.496444 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:64889] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeHf6BP68VyHNvj1e566aAAAAMA"]
[Fri Apr 17 15:23:21.111723 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:64877] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeHf6RP68VyHNvj1e566bAAAANU"]
[Fri Apr 17 15:23:21.918779 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:64792] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "aeHf6cOaH-Pgc7WEf4NX6wAAAcE"]
[Fri Apr 17 15:23:22.935077 2026] [:error] [pid 9153:tid 9236] [client 20.215.250.20:64865] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeHf6uMHGxkTZX3c45fWqQAAAJI"]
[Fri Apr 17 15:23:23.662603 2026] [:error] [pid 9152:tid 9195] [client 20.215.250.20:64171] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeHf65JYca8I3TNCwIcKnQAAAEU"]
[Fri Apr 17 15:23:24.386392 2026] [:error] [pid 9152:tid 9198] [client 20.215.250.20:64163] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeHf7JJYca8I3TNCwIcKngAAAEg"]
[Fri Apr 17 15:23:25.087037 2026] [:error] [pid 9152:tid 9211] [client 20.215.250.20:64174] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aeHf7ZJYca8I3TNCwIcKogAAAFU"]
[Fri Apr 17 15:23:26.101242 2026] [:error] [pid 9263:tid 9279] [client 20.215.250.20:64839] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeHf7hP68VyHNvj1e566hwAAAM4"]
[Fri Apr 17 15:23:27.924904 2026] [:error] [pid 61523:tid 61550] [client 20.215.250.20:64254] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeHf78OaH-Pgc7WEf4NYBQAAAcg"]
[Fri Apr 17 15:23:28.670283 2026] [:error] [pid 51878:tid 51883] [client 20.215.250.20:64196] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nwflm.php"] [unique_id "aeHf8EnQhUtMbw9EsgYl8AAAAQM"]
[Fri Apr 17 15:23:29.321317 2026] [proxy_fcgi:error] [pid 61523:tid 61545] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:29.698994 2026] [proxy_fcgi:error] [pid 61523:tid 61559] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:29.957441 2026] [proxy_fcgi:error] [pid 61523:tid 61563] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:30.230020 2026] [proxy_fcgi:error] [pid 61523:tid 61552] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:30.506836 2026] [proxy_fcgi:error] [pid 61523:tid 61555] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:30.764505 2026] [proxy_fcgi:error] [pid 61523:tid 61541] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:31.033092 2026] [proxy_fcgi:error] [pid 61523:tid 61548] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:31.307256 2026] [proxy_fcgi:error] [pid 61523:tid 61544] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:31.572586 2026] [proxy_fcgi:error] [pid 61523:tid 61551] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:32.089757 2026] [proxy_fcgi:error] [pid 61523:tid 61557] [client 20.215.250.20:63516] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:23:32.348124 2026] [:error] [pid 61523:tid 61545] [client 20.215.250.20:63516] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeHf9MOaH-Pgc7WEf4NYGwAAAcM"]
[Fri Apr 17 15:23:33.216260 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:63554] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeHf9RP68VyHNvj1e566ngAAANM"]
[Fri Apr 17 15:23:34.193858 2026] [:error] [pid 9153:tid 9234] [client 20.215.250.20:64872] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeHf9uMHGxkTZX3c45fWsgAAAJA"]
[Fri Apr 17 15:23:34.966065 2026] [:error] [pid 9263:tid 9279] [client 20.215.250.20:64144] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeHf9hP68VyHNvj1e566pAAAAM4"]
[Fri Apr 17 15:23:35.720510 2026] [:error] [pid 9263:tid 9277] [client 20.215.250.20:64152] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeHf9xP68VyHNvj1e566pwAAAMw"]
[Fri Apr 17 15:23:36.757905 2026] [:error] [pid 9263:tid 9278] [client 20.215.250.20:64829] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeHf-BP68VyHNvj1e566qAAAAM0"]
[Fri Apr 17 15:23:37.835780 2026] [:error] [pid 9263:tid 9279] [client 20.215.250.20:64815] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeHf-RP68VyHNvj1e566rQAAAM4"]
[Fri Apr 17 15:23:38.911688 2026] [:error] [pid 9263:tid 9275] [client 20.215.250.20:64205] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeHf-hP68VyHNvj1e566sQAAAMo"]
[Fri Apr 17 15:23:39.894135 2026] [:error] [pid 9153:tid 9238] [client 20.215.250.20:64779] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeHf--MHGxkTZX3c45fWswAAAJQ"]
[Fri Apr 17 15:23:40.859015 2026] [:error] [pid 61523:tid 61560] [client 20.215.250.20:64841] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeHf_MOaH-Pgc7WEf4NYIAAAAdI"]
[Fri Apr 17 15:23:42.143837 2026] [:error] [pid 51878:tid 51888] [client 20.215.250.20:64797] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeHf_knQhUtMbw9EsgYl_wAAAQg"]
[Fri Apr 17 15:23:42.858522 2026] [:error] [pid 9152:tid 9191] [client 20.215.250.20:64157] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeHf_pJYca8I3TNCwIcKzgAAAEE"]
[Fri Apr 17 15:23:43.885985 2026] [:error] [pid 51878:tid 51892] [client 20.215.250.20:64838] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeHf_0nQhUtMbw9EsgYmAAAAAQw"]
[Fri Apr 17 15:23:44.471457 2026] [:error] [pid 34273:tid 34282] [client 20.215.250.20:64891] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeHgAGuQDW686mK3dgHK8gAAAYc"]
[Fri Apr 17 15:23:45.338233 2026] [:error] [pid 25010:tid 25019] [client 20.215.250.20:64800] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeHgAY-7kkf42RarqQ1K3QAAAUY"]
[Fri Apr 17 15:23:45.897269 2026] [:error] [pid 9263:tid 9270] [client 20.215.250.20:64172] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeHgARP68VyHNvj1e5661QAAAMU"]
[Fri Apr 17 15:23:46.630570 2026] [:error] [pid 9263:tid 9275] [client 20.215.250.20:64782] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeHgAhP68VyHNvj1e5662QAAAMo"]
[Fri Apr 17 15:23:47.389089 2026] [:error] [pid 61523:tid 61547] [client 20.215.250.20:64821] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeHgA8OaH-Pgc7WEf4NYbAAAAcU"]
[Fri Apr 17 15:23:48.310959 2026] [:error] [pid 51878:tid 51882] [client 20.215.250.20:64225] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeHgBEnQhUtMbw9EsgYmAQAAAQI"]
[Fri Apr 17 15:23:49.193905 2026] [:error] [pid 61523:tid 61545] [client 20.215.250.20:65462] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeHgBcOaH-Pgc7WEf4NYcAAAAcM"]
[Fri Apr 17 15:23:49.982787 2026] [:error] [pid 61523:tid 61563] [client 20.215.250.20:64893] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeHgBcOaH-Pgc7WEf4NYcQAAAdU"]
[Fri Apr 17 15:23:51.171816 2026] [:error] [pid 9152:tid 9210] [client 20.215.250.20:64884] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeHgB5JYca8I3TNCwIcK_wAAAFQ"]
[Fri Apr 17 15:23:52.235594 2026] [:error] [pid 9152:tid 9206] [client 20.215.250.20:65526] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeHgCJJYca8I3TNCwIcLAAAAAFA"]
[Fri Apr 17 15:23:52.981874 2026] [:error] [pid 9153:tid 9237] [client 20.215.250.20:65456] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeHgCOMHGxkTZX3c45fWtgAAAJM"]
[Fri Apr 17 15:23:53.907296 2026] [:error] [pid 51878:tid 51885] [client 20.215.250.20:64836] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeHgCUnQhUtMbw9EsgYmBwAAAQU"]
[Fri Apr 17 15:23:54.824532 2026] [:error] [pid 9152:tid 9194] [client 20.215.250.20:65431] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeHgCpJYca8I3TNCwIcLAQAAAEQ"]
[Fri Apr 17 15:23:55.574845 2026] [:error] [pid 9153:tid 9235] [client 20.215.250.20:64177] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeHgC-MHGxkTZX3c45fWtwAAAJE"]
[Fri Apr 17 15:23:56.828307 2026] [:error] [pid 9151:tid 9164] [client 20.215.250.20:62318] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeHgDMhTVuRPkua22vQZgwAAAAM"]
[Fri Apr 17 15:23:57.661741 2026] [:error] [pid 9152:tid 9212] [client 20.215.250.20:65457] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeHgDZJYca8I3TNCwIcLBQAAAFY"]
[Fri Apr 17 15:23:58.283502 2026] [:error] [pid 9152:tid 9196] [client 20.215.250.20:63548] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeHgDpJYca8I3TNCwIcLBwAAAEY"]
[Fri Apr 17 15:23:58.953679 2026] [:error] [pid 9152:tid 9208] [client 20.215.250.20:64788] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeHgDpJYca8I3TNCwIcLCQAAAFI"]
[Fri Apr 17 15:23:59.574495 2026] [:error] [pid 9152:tid 9195] [client 20.215.250.20:65510] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeHgD5JYca8I3TNCwIcLCgAAAEU"]
[Fri Apr 17 15:24:00.232284 2026] [:error] [pid 51878:tid 51901] [client 20.215.250.20:65426] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeHgEEnQhUtMbw9EsgYmCwAAARU"]
[Fri Apr 17 15:24:00.880422 2026] [:error] [pid 61523:tid 61561] [client 20.215.250.20:65498] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeHgEMOaH-Pgc7WEf4NYhAAAAdM"]
[Fri Apr 17 15:24:01.855572 2026] [:error] [pid 25010:tid 25016] [client 20.215.250.20:64835] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeHgEY-7kkf42RarqQ1K6AAAAUM"]
[Fri Apr 17 15:24:02.671194 2026] [:error] [pid 61523:tid 61553] [client 20.215.250.20:65495] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeHgEsOaH-Pgc7WEf4NYiwAAAcs"]
[Fri Apr 17 15:24:03.301134 2026] [:error] [pid 9152:tid 9203] [client 20.215.250.20:64831] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "aeHgE5JYca8I3TNCwIcLEgAAAE0"]
[Fri Apr 17 15:24:04.043189 2026] [:error] [pid 34273:tid 34278] [client 20.215.250.20:65459] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "aeHgFGuQDW686mK3dgHLGAAAAYM"]
[Fri Apr 17 15:24:04.663417 2026] [:error] [pid 51878:tid 51903] [client 20.215.250.20:65512] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "aeHgFEnQhUtMbw9EsgYmDgAAARc"]
[Fri Apr 17 15:24:05.259372 2026] [:error] [pid 51878:tid 51888] [client 20.215.250.20:65499] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "aeHgFUnQhUtMbw9EsgYmEQAAAQg"]
[Fri Apr 17 15:24:05.966969 2026] [:error] [pid 61523:tid 61551] [client 20.215.250.20:64843] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "aeHgFcOaH-Pgc7WEf4NYkAAAAck"]
[Fri Apr 17 15:24:06.575056 2026] [:error] [pid 9152:tid 9212] [client 20.215.250.20:64883] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "aeHgFpJYca8I3TNCwIcLFAAAAFY"]
[Fri Apr 17 15:24:07.408595 2026] [:error] [pid 51878:tid 51881] [client 20.215.250.20:64858] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "aeHgF0nQhUtMbw9EsgYmEwAAAQE"]
[Fri Apr 17 15:24:08.243000 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:63531] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "aeHgGBP68VyHNvj1e567LAAAANU"]
[Fri Apr 17 15:24:09.203490 2026] [:error] [pid 9263:tid 9282] [client 20.215.250.20:64808] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeHgGRP68VyHNvj1e567MAAAANE"]
[Fri Apr 17 15:24:09.780934 2026] [:error] [pid 25010:tid 25029] [client 20.215.250.20:62852] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeHgGY-7kkf42RarqQ1K8QAAAVA"]
[Fri Apr 17 15:24:10.455598 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:65479] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeHgGhP68VyHNvj1e567NgAAANM"]
[Fri Apr 17 15:24:11.130179 2026] [:error] [pid 9153:tid 9240] [client 20.215.250.20:65453] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "aeHgG-MHGxkTZX3c45fWvgAAAJY"]
[Fri Apr 17 15:24:11.772822 2026] [:error] [pid 25010:tid 25030] [client 20.215.250.20:65525] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeHgG4-7kkf42RarqQ1K8wAAAVE"]
[Fri Apr 17 15:24:12.339792 2026] [:error] [pid 25010:tid 25032] [client 20.215.250.20:64887] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeHgHI-7kkf42RarqQ1K9QAAAVM"]
[Fri Apr 17 15:24:13.008187 2026] [:error] [pid 51878:tid 51903] [client 20.215.250.20:64833] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeHgHUnQhUtMbw9EsgYmGgAAARc"]
[Fri Apr 17 15:24:13.554616 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:65451] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aeHgHRP68VyHNvj1e567PAAAANU"]
[Fri Apr 17 15:24:14.102956 2026] [:error] [pid 9152:tid 9207] [client 20.215.250.20:64195] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeHgHpJYca8I3TNCwIcLHAAAAFE"]
[Fri Apr 17 15:24:14.662297 2026] [:error] [pid 9152:tid 9202] [client 20.215.250.20:65523] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeHgHpJYca8I3TNCwIcLHQAAAEw"]
[Fri Apr 17 15:24:15.268356 2026] [:error] [pid 9263:tid 9269] [client 20.215.250.20:65503] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeHgHxP68VyHNvj1e567QAAAAMQ"]
[Fri Apr 17 15:24:15.869872 2026] [:error] [pid 9152:tid 9197] [client 20.215.250.20:64857] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aeHgH5JYca8I3TNCwIcLIAAAAEc"]
[Fri Apr 17 15:24:16.424878 2026] [:error] [pid 9152:tid 9212] [client 20.215.250.20:64242] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeHgIJJYca8I3TNCwIcLIwAAAFY"]
[Fri Apr 17 15:24:16.955360 2026] [:error] [pid 34273:tid 34289] [client 20.215.250.20:65505] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeHgIGuQDW686mK3dgHLIgAAAY4"]
[Fri Apr 17 15:24:17.481703 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:64812] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeHgIRP68VyHNvj1e567QgAAAMk"]
[Fri Apr 17 15:24:18.027437 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:64867] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aeHgIhP68VyHNvj1e567QwAAAMc"]
[Fri Apr 17 15:24:18.633249 2026] [:error] [pid 9153:tid 9226] [client 20.215.250.20:65491] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeHgIuMHGxkTZX3c45fWwAAAAIg"]
[Fri Apr 17 15:24:19.232542 2026] [:error] [pid 34273:tid 34294] [client 20.215.250.20:65434] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeHgI2uQDW686mK3dgHLIwAAAZM"]
[Fri Apr 17 15:24:19.776196 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:65425] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeHgIxP68VyHNvj1e567SAAAAMA"]
[Fri Apr 17 15:24:20.292904 2026] [:error] [pid 9263:tid 9275] [client 20.215.250.20:65450] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "aeHgJBP68VyHNvj1e567TgAAAMo"]
[Fri Apr 17 15:24:20.866138 2026] [:error] [pid 9263:tid 9271] [client 20.215.250.20:64870] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeHgJBP68VyHNvj1e567UQAAAMY"]
[Fri Apr 17 15:24:21.378414 2026] [:error] [pid 9263:tid 9288] [client 20.215.250.20:65433] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeHgJRP68VyHNvj1e567VgAAANc"]
[Fri Apr 17 15:24:21.927683 2026] [:error] [pid 9263:tid 9273] [client 20.215.250.20:63585] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeHgJRP68VyHNvj1e567WQAAAMg"]
[Fri Apr 17 15:24:22.470631 2026] [:error] [pid 9263:tid 9283] [client 20.215.250.20:64786] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aeHgJhP68VyHNvj1e567XAAAANI"]
[Fri Apr 17 15:24:23.106596 2026] [:error] [pid 9263:tid 9289] [client 20.215.250.20:65522] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeHgJxP68VyHNvj1e567XwAAANg"]
[Fri Apr 17 15:24:23.904578 2026] [:error] [pid 9263:tid 9281] [client 20.215.250.20:64851] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeHgJxP68VyHNvj1e567YwAAANA"]
[Fri Apr 17 15:24:24.745993 2026] [:error] [pid 9263:tid 9273] [client 20.215.250.20:64856] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeHgKBP68VyHNvj1e567ZgAAAMg"]
[Fri Apr 17 15:24:25.424197 2026] [:error] [pid 9152:tid 9190] [client 20.215.250.20:64822] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/111.php"] [unique_id "aeHgKZJYca8I3TNCwIcLMgAAAEA"]
[Fri Apr 17 15:24:26.009437 2026] [:error] [pid 9263:tid 9289] [client 20.215.250.20:65427] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeHgKhP68VyHNvj1e567agAAANg"]
[Fri Apr 17 15:24:26.729093 2026] [:error] [pid 61523:tid 61555] [client 20.215.250.20:64805] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeHgKsOaH-Pgc7WEf4NYoAAAAc0"]
[Fri Apr 17 15:24:27.588131 2026] [:error] [pid 9263:tid 9270] [client 20.215.250.20:63569] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeHgKxP68VyHNvj1e567dAAAAMU"]
[Fri Apr 17 15:24:28.346856 2026] [:error] [pid 9263:tid 9283] [client 20.215.250.20:64789] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1.php"] [unique_id "aeHgLBP68VyHNvj1e567dgAAANI"]
[Fri Apr 17 15:24:28.890049 2026] [:error] [pid 9152:tid 9194] [client 20.215.250.20:62945] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeHgLJJYca8I3TNCwIcLNgAAAEQ"]
[Fri Apr 17 15:24:29.525514 2026] [:error] [pid 9151:tid 9179] [client 20.215.250.20:64818] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeHgLchTVuRPkua22vQZjwAAABI"]
[Fri Apr 17 15:24:30.109272 2026] [:error] [pid 9151:tid 9174] [client 20.215.250.20:65417] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeHgLshTVuRPkua22vQZkgAAAA0"]
[Fri Apr 17 15:24:30.670551 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:65474] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aeHgLhP68VyHNvj1e567dwAAANM"]
[Fri Apr 17 15:24:31.261855 2026] [:error] [pid 51878:tid 51892] [client 20.215.250.20:64245] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeHgL0nQhUtMbw9EsgYmIQAAAQw"]
[Fri Apr 17 15:24:31.856974 2026] [:error] [pid 9153:tid 9218] [client 20.215.250.20:65484] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeHgL-MHGxkTZX3c45fWyAAAAIA"]
[Fri Apr 17 15:24:32.389748 2026] [proxy_fcgi:error] [pid 61523:tid 61550] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:32.654890 2026] [proxy_fcgi:error] [pid 61523:tid 61560] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:32.914112 2026] [proxy_fcgi:error] [pid 61523:tid 61562] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:33.187425 2026] [proxy_fcgi:error] [pid 61523:tid 61544] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:33.446944 2026] [proxy_fcgi:error] [pid 61523:tid 61551] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:33.714912 2026] [proxy_fcgi:error] [pid 61523:tid 61549] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:33.975087 2026] [proxy_fcgi:error] [pid 61523:tid 61547] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:34.234220 2026] [proxy_fcgi:error] [pid 61523:tid 61559] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:34.500701 2026] [proxy_fcgi:error] [pid 61523:tid 61561] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:34.760350 2026] [proxy_fcgi:error] [pid 61523:tid 61555] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:35.022261 2026] [proxy_fcgi:error] [pid 61523:tid 61552] [client 20.215.250.20:63560] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:24:35.278131 2026] [:error] [pid 61523:tid 61558] [client 20.215.250.20:63560] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeHgM8OaH-Pgc7WEf4NYswAAAdA"]
[Fri Apr 17 15:24:35.878438 2026] [:error] [pid 9263:tid 9281] [client 20.215.250.20:65518] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeHgMxP68VyHNvj1e567eQAAANA"]
[Fri Apr 17 15:24:36.440021 2026] [:error] [pid 9152:tid 9198] [client 20.215.250.20:65445] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeHgNJJYca8I3TNCwIcLPgAAAEg"]
[Fri Apr 17 15:24:36.962549 2026] [:error] [pid 9263:tid 9283] [client 20.215.250.20:64809] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeHgNBP68VyHNvj1e567fgAAANI"]
[Fri Apr 17 15:24:37.558190 2026] [:error] [pid 9152:tid 9208] [client 20.215.250.20:65446] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "aeHgNZJYca8I3TNCwIcLPwAAAFI"]
[Fri Apr 17 15:24:38.845251 2026] [:error] [pid 61523:tid 61564] [client 20.215.250.20:63584] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "aeHgNsOaH-Pgc7WEf4NYtwAAAdY"]
[Fri Apr 17 15:24:39.738836 2026] [:error] [pid 61523:tid 61551] [client 20.215.250.20:65502] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "aeHgN8OaH-Pgc7WEf4NYuQAAAck"]
[Fri Apr 17 15:24:40.603555 2026] [:error] [pid 9263:tid 9265] [client 20.215.250.20:65467] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "aeHgOBP68VyHNvj1e567hwAAAMA"]
[Fri Apr 17 15:24:41.333335 2026] [:error] [pid 9263:tid 9269] [client 20.215.250.20:64226] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeHgORP68VyHNvj1e567igAAAMQ"]
[Fri Apr 17 15:24:42.170917 2026] [:error] [pid 34273:tid 34282] [client 20.215.250.20:65437] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeHgOmuQDW686mK3dgHLOQAAAYc"]
[Fri Apr 17 15:24:43.394815 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:64166] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeHgOxP68VyHNvj1e567kgAAAMk"]
[Fri Apr 17 15:24:44.355488 2026] [:error] [pid 9152:tid 9209] [client 20.215.250.20:65520] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeHgPJJYca8I3TNCwIcLRQAAAFM"]
[Fri Apr 17 15:24:44.929359 2026] [:error] [pid 25010:tid 25032] [client 20.215.250.20:65527] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeHgPI-7kkf42RarqQ1LDAAAAVM"]
[Fri Apr 17 15:24:45.602664 2026] [:error] [pid 34273:tid 34295] [client 20.215.250.20:64830] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeHgPWuQDW686mK3dgHLPgAAAZQ"]
[Fri Apr 17 15:24:46.293805 2026] [:error] [pid 9152:tid 9212] [client 20.215.250.20:64820] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeHgPpJYca8I3TNCwIcLSwAAAFY"]
[Fri Apr 17 15:24:47.087904 2026] [:error] [pid 9152:tid 9211] [client 20.215.250.20:65452] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeHgP5JYca8I3TNCwIcLTQAAAFU"]
[Fri Apr 17 15:24:47.882125 2026] [:error] [pid 9152:tid 9210] [client 20.215.250.20:65410] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeHgP5JYca8I3TNCwIcLUAAAAFQ"]
[Fri Apr 17 15:24:48.547118 2026] [:error] [pid 9152:tid 9208] [client 20.215.250.20:63574] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeHgQJJYca8I3TNCwIcLUgAAAFI"]
[Fri Apr 17 15:24:49.210036 2026] [:error] [pid 9152:tid 9200] [client 20.215.250.20:64795] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeHgQZJYca8I3TNCwIcLVAAAAEo"]
[Fri Apr 17 15:24:49.911181 2026] [:error] [pid 9151:tid 9168] [client 20.215.250.20:64251] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeHgQchTVuRPkua22vQZnQAAAAc"]
[Fri Apr 17 15:24:50.593588 2026] [:error] [pid 34273:tid 34281] [client 20.215.250.20:65516] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeHgQmuQDW686mK3dgHLQwAAAYY"]
[Fri Apr 17 15:24:51.143550 2026] [:error] [pid 34273:tid 34280] [client 20.215.250.20:65472] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeHgQ2uQDW686mK3dgHLTAAAAYU"]
[Fri Apr 17 15:24:51.701566 2026] [:error] [pid 9263:tid 9273] [client 20.215.250.20:65411] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeHgQxP68VyHNvj1e567pAAAAMg"]
[Fri Apr 17 15:24:52.273332 2026] [:error] [pid 9263:tid 9282] [client 20.215.250.20:64847] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeHgRBP68VyHNvj1e567qAAAANE"]
[Fri Apr 17 15:24:52.882537 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64844] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeHgRBP68VyHNvj1e567qwAAAME"]
[Fri Apr 17 15:24:53.555069 2026] [:error] [pid 61523:tid 61551] [client 20.215.250.20:64216] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeHgRcOaH-Pgc7WEf4NYvgAAAck"]
[Fri Apr 17 15:24:54.162717 2026] [:error] [pid 61523:tid 61566] [client 20.215.250.20:65471] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeHgRsOaH-Pgc7WEf4NYvwAAAdg"]
[Fri Apr 17 15:24:54.913631 2026] [:error] [pid 34273:tid 34297] [client 20.215.250.20:64774] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeHgRmuQDW686mK3dgHLZQAAAZY"]
[Fri Apr 17 15:24:55.544292 2026] [:error] [pid 9153:tid 9229] [client 20.215.250.20:65471] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeHgR-MHGxkTZX3c45fW1AAAAIs"]
[Fri Apr 17 15:24:56.338251 2026] [:error] [pid 61523:tid 61563] [client 20.215.250.20:65419] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeHgSMOaH-Pgc7WEf4NYxAAAAdU"]
[Fri Apr 17 15:24:56.962376 2026] [:error] [pid 9263:tid 9273] [client 20.215.250.20:64154] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeHgSBP68VyHNvj1e567tQAAAMg"]
[Fri Apr 17 15:24:57.802335 2026] [:error] [pid 9263:tid 9276] [client 20.215.250.20:65490] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeHgSRP68VyHNvj1e567uwAAAMs"]
[Fri Apr 17 15:24:58.588971 2026] [:error] [pid 51878:tid 51882] [client 20.215.250.20:64787] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeHgSknQhUtMbw9EsgYmYAAAAQI"]
[Fri Apr 17 15:24:59.310729 2026] [:error] [pid 61523:tid 61548] [client 20.215.250.20:64803] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeHgS8OaH-Pgc7WEf4NYxgAAAcY"]
[Fri Apr 17 15:24:59.964510 2026] [:error] [pid 61523:tid 61554] [client 20.215.250.20:65424] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeHgS8OaH-Pgc7WEf4NYxwAAAcw"]
[Fri Apr 17 15:25:00.517481 2026] [:error] [pid 34273:tid 34296] [client 20.215.250.20:64873] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeHgTGuQDW686mK3dgHLaQAAAZU"]
[Fri Apr 17 15:25:01.073521 2026] [:error] [pid 61523:tid 61553] [client 20.215.250.20:63495] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeHgTcOaH-Pgc7WEf4NYygAAAcs"]
[Fri Apr 17 15:25:01.727763 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:64796] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeHgTRP68VyHNvj1e567wQAAANM"]
[Fri Apr 17 15:25:02.506994 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64160] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeHgThP68VyHNvj1e567wwAAAME"]
[Fri Apr 17 15:25:03.238958 2026] [:error] [pid 9151:tid 9180] [client 20.215.250.20:64173] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeHgT8hTVuRPkua22vQZoQAAABM"]
[Fri Apr 17 15:25:03.893292 2026] [:error] [pid 9151:tid 9172] [client 20.215.250.20:64894] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeHgT8hTVuRPkua22vQZogAAAAs"]
[Fri Apr 17 15:25:04.758679 2026] [:error] [pid 9263:tid 9275] [client 20.215.250.20:62966] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeHgUBP68VyHNvj1e567xwAAAMo"]
[Fri Apr 17 15:25:05.545190 2026] [:error] [pid 61523:tid 61555] [client 20.215.250.20:63592] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeHgUcOaH-Pgc7WEf4NY0wAAAc0"]
[Fri Apr 17 15:25:06.176025 2026] [:error] [pid 25010:tid 25032] [client 20.215.250.20:64135] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeHgUo-7kkf42RarqQ1LHQAAAVM"]
[Fri Apr 17 15:25:07.268009 2026] [:error] [pid 51878:tid 51890] [client 20.215.250.20:64837] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeHgU0nQhUtMbw9EsgYmZQAAAQo"]
[Fri Apr 17 15:25:08.246597 2026] [:error] [pid 9153:tid 9235] [client 20.215.250.20:63488] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeHgVOMHGxkTZX3c45fW3wAAAJE"]
[Fri Apr 17 15:25:09.306940 2026] [:error] [pid 61523:tid 61559] [client 20.215.250.20:64220] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeHgVcOaH-Pgc7WEf4NY5AAAAdE"]
[Fri Apr 17 15:25:09.858775 2026] [:error] [pid 9151:tid 9184] [client 20.215.250.20:65477] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeHgVchTVuRPkua22vQZpwAAABc"]
[Fri Apr 17 15:25:10.642631 2026] [:error] [pid 9153:tid 9219] [client 20.215.250.20:65421] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeHgVuMHGxkTZX3c45fW4AAAAIE"]
[Fri Apr 17 15:25:11.210160 2026] [:error] [pid 51878:tid 51904] [client 20.215.250.20:65507] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeHgV0nQhUtMbw9EsgYmawAAARg"]
[Fri Apr 17 15:25:11.761881 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:63607] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeHgVxP68VyHNvj1e567yQAAANM"]
[Fri Apr 17 15:25:12.414891 2026] [:error] [pid 9153:tid 9218] [client 20.215.250.20:65478] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeHgWOMHGxkTZX3c45fW4gAAAIA"]
[Fri Apr 17 15:25:13.033228 2026] [:error] [pid 9153:tid 9237] [client 20.215.250.20:64208] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeHgWeMHGxkTZX3c45fW4wAAAJM"]
[Fri Apr 17 15:25:13.724536 2026] [:error] [pid 9263:tid 9281] [client 20.215.250.20:64869] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeHgWRP68VyHNvj1e567zwAAANA"]
[Fri Apr 17 15:25:14.387399 2026] [:error] [pid 9263:tid 9285] [client 20.215.250.20:64151] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeHgWhP68VyHNvj1e5670AAAANQ"]
[Fri Apr 17 15:25:14.958569 2026] [:error] [pid 9263:tid 9288] [client 20.215.250.20:64799] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeHgWhP68VyHNvj1e5670gAAANc"]
[Fri Apr 17 15:25:15.532653 2026] [:error] [pid 34273:tid 34275] [client 20.215.250.20:64769] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeHgW2uQDW686mK3dgHLewAAAYA"]
[Fri Apr 17 15:25:16.175537 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:64791] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeHgXBP68VyHNvj1e5671gAAANU"]
[Fri Apr 17 15:25:16.721275 2026] [:error] [pid 9153:tid 9226] [client 20.215.250.20:65455] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeHgXOMHGxkTZX3c45fW5wAAAIg"]
[Fri Apr 17 15:25:17.263181 2026] [:error] [pid 9153:tid 9220] [client 20.215.250.20:64198] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeHgXeMHGxkTZX3c45fW6AAAAII"]
[Fri Apr 17 15:25:17.823319 2026] [:error] [pid 9152:tid 9202] [client 20.215.250.20:64853] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgXZJYca8I3TNCwIcLcQAAAEw"]
[Fri Apr 17 15:25:18.556932 2026] [:error] [pid 9263:tid 9287] [client 20.215.250.20:64194] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgXhP68VyHNvj1e5672wAAANY"]
[Fri Apr 17 15:25:19.226090 2026] [:error] [pid 9152:tid 9204] [client 20.215.250.20:63601] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgX5JYca8I3TNCwIcLcwAAAE4"]
[Fri Apr 17 15:25:19.923274 2026] [:error] [pid 61523:tid 61558] [client 20.215.250.20:65524] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgX8OaH-Pgc7WEf4NY6AAAAdA"]
[Fri Apr 17 15:25:20.461094 2026] [:error] [pid 61523:tid 61547] [client 20.215.250.20:63570] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeHgYMOaH-Pgc7WEf4NY6QAAAcU"]
[Fri Apr 17 15:25:21.052812 2026] [:error] [pid 9153:tid 9228] [client 20.215.250.20:62856] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeHgYeMHGxkTZX3c45fW6wAAAIo"]
[Fri Apr 17 15:25:21.717493 2026] [:error] [pid 61523:tid 61545] [client 20.215.250.20:63515] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeHgYcOaH-Pgc7WEf4NY7AAAAcM"]
[Fri Apr 17 15:25:22.456000 2026] [:error] [pid 61523:tid 61554] [client 20.215.250.20:64871] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeHgYsOaH-Pgc7WEf4NY8AAAAcw"]
[Fri Apr 17 15:25:23.011169 2026] [:error] [pid 9152:tid 9204] [client 20.215.250.20:64807] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeHgY5JYca8I3TNCwIcLiQAAAE4"]
[Fri Apr 17 15:25:23.762448 2026] [:error] [pid 34273:tid 34288] [client 20.215.250.20:64845] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeHgY2uQDW686mK3dgHLiAAAAY0"]
[Fri Apr 17 15:25:24.467082 2026] [:error] [pid 51878:tid 51897] [client 20.215.250.20:64848] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeHgZEnQhUtMbw9EsgYmcAAAARE"]
[Fri Apr 17 15:25:25.393778 2026] [:error] [pid 51878:tid 51885] [client 20.215.250.20:65514] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "aeHgZUnQhUtMbw9EsgYmdgAAAQU"]
[Fri Apr 17 15:25:25.976355 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:64231] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeHgZcOaH-Pgc7WEf4NY-QAAAcE"]
[Fri Apr 17 15:25:26.644459 2026] [:error] [pid 9263:tid 9277] [client 20.215.250.20:64895] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeHgZhP68VyHNvj1e5678QAAAMw"]
[Fri Apr 17 15:25:27.208122 2026] [:error] [pid 51878:tid 51896] [client 20.215.250.20:64784] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeHgZ0nQhUtMbw9EsgYmegAAARA"]
[Fri Apr 17 15:25:27.939083 2026] [:error] [pid 9152:tid 9192] [client 20.215.250.20:64790] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xqq.php"] [unique_id "aeHgZ5JYca8I3TNCwIcLnQAAAEI"]
[Fri Apr 17 15:25:28.724349 2026] [:error] [pid 9152:tid 9195] [client 20.215.250.20:65494] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeHgaJJYca8I3TNCwIcLoAAAAEU"]
[Fri Apr 17 15:25:29.482450 2026] [:error] [pid 9151:tid 9181] [client 20.215.250.20:65519] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeHgachTVuRPkua22vQZrQAAABQ"]
[Fri Apr 17 15:25:30.106748 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:64852] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeHgahP68VyHNvj1e567-gAAAMc"]
[Fri Apr 17 15:25:30.661655 2026] [:error] [pid 9263:tid 9279] [client 20.215.250.20:64892] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plss3.php"] [unique_id "aeHgahP68VyHNvj1e567-wAAAM4"]
[Fri Apr 17 15:25:31.200861 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:64180] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeHgaxP68VyHNvj1e568AAAAAMk"]
[Fri Apr 17 15:25:31.802907 2026] [:error] [pid 61523:tid 61555] [client 20.215.250.20:65428] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeHga8OaH-Pgc7WEf4NY-wAAAc0"]
[Fri Apr 17 15:25:32.389849 2026] [:error] [pid 61523:tid 61561] [client 20.215.250.20:64834] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeHgbMOaH-Pgc7WEf4NY_AAAAdM"]
[Fri Apr 17 15:25:32.962651 2026] [:error] [pid 25010:tid 25030] [client 20.215.250.20:64880] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "aeHgbI-7kkf42RarqQ1LIAAAAVE"]
[Fri Apr 17 15:25:33.511409 2026] [:error] [pid 51878:tid 51881] [client 20.215.250.20:64189] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeHgbUnQhUtMbw9EsgYmfgAAAQE"]
[Fri Apr 17 15:25:34.091291 2026] [:error] [pid 51878:tid 51891] [client 20.215.250.20:64778] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeHgbknQhUtMbw9EsgYmggAAAQs"]
[Fri Apr 17 15:25:34.627750 2026] [:error] [pid 34273:tid 34286] [client 20.215.250.20:63564] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeHgbmuQDW686mK3dgHLiwAAAYs"]
[Fri Apr 17 15:25:35.366421 2026] [proxy_fcgi:error] [pid 61523:tid 61547] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:35.892721 2026] [proxy_fcgi:error] [pid 61523:tid 61550] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:36.155828 2026] [proxy_fcgi:error] [pid 61523:tid 61546] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:36.414927 2026] [proxy_fcgi:error] [pid 61523:tid 61553] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:36.673892 2026] [proxy_fcgi:error] [pid 61523:tid 61566] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:37.462663 2026] [proxy_fcgi:error] [pid 61523:tid 61543] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:37.722616 2026] [proxy_fcgi:error] [pid 61523:tid 61558] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:37.992296 2026] [proxy_fcgi:error] [pid 61523:tid 61562] [client 20.215.250.20:64827] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:25:38.264140 2026] [:error] [pid 61523:tid 61563] [client 20.215.250.20:64827] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeHgcsOaH-Pgc7WEf4NZFQAAAdU"]
[Fri Apr 17 15:25:38.928056 2026] [:error] [pid 9263:tid 9285] [client 20.215.250.20:64828] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeHgchP68VyHNvj1e568CAAAANQ"]
[Fri Apr 17 15:25:39.544550 2026] [:error] [pid 9153:tid 9237] [client 20.215.250.20:64138] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeHgc-MHGxkTZX3c45fW7gAAAJM"]
[Fri Apr 17 15:25:40.435838 2026] [:error] [pid 61523:tid 61556] [client 20.215.250.20:65414] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeHgdMOaH-Pgc7WEf4NZGAAAAc4"]
[Fri Apr 17 15:25:41.082866 2026] [:error] [pid 34273:tid 34292] [client 20.215.250.20:64255] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeHgdWuQDW686mK3dgHLkQAAAZE"]
[Fri Apr 17 15:25:41.686992 2026] [:error] [pid 9263:tid 9269] [client 20.215.250.20:64849] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeHgdRP68VyHNvj1e568EQAAAMQ"]
[Fri Apr 17 15:25:42.272542 2026] [:error] [pid 61523:tid 61564] [client 20.215.250.20:64155] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeHgdsOaH-Pgc7WEf4NZHQAAAdY"]
[Fri Apr 17 15:25:43.005620 2026] [:error] [pid 9263:tid 9270] [client 20.215.250.20:64817] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeHgdxP68VyHNvj1e568FQAAAMU"]
[Fri Apr 17 15:25:43.647373 2026] [:error] [pid 61523:tid 61552] [client 20.215.250.20:65464] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeHgd8OaH-Pgc7WEf4NZHwAAAco"]
[Fri Apr 17 15:25:44.180426 2026] [:error] [pid 9152:tid 9198] [client 20.215.250.20:62297] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeHgeJJYca8I3TNCwIcL4AAAAEg"]
[Fri Apr 17 15:25:44.829401 2026] [:error] [pid 9151:tid 9183] [client 20.215.250.20:64814] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeHgeMhTVuRPkua22vQZsQAAABY"]
[Fri Apr 17 15:25:45.753765 2026] [:error] [pid 34273:tid 34282] [client 20.215.250.20:65482] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeHgeWuQDW686mK3dgHLkgAAAYc"]
[Fri Apr 17 15:25:46.342083 2026] [:error] [pid 9151:tid 9163] [client 20.215.250.20:64842] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeHgeshTVuRPkua22vQZtQAAAAI"]
[Fri Apr 17 15:25:47.210280 2026] [:error] [pid 25010:tid 25019] [client 20.215.250.20:64801] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeHge4-7kkf42RarqQ1LJQAAAUY"]
[Fri Apr 17 15:25:48.935916 2026] [:error] [pid 61523:tid 61564] [client 20.215.250.20:65439] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeHgfMOaH-Pgc7WEf4NZJgAAAdY"]
[Fri Apr 17 15:25:49.669580 2026] [:error] [pid 51878:tid 51893] [client 20.215.250.20:63588] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeHgfUnQhUtMbw9EsgYmigAAAQ0"]
[Fri Apr 17 15:25:50.568770 2026] [:error] [pid 34273:tid 34296] [client 20.215.250.20:63595] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHgfmuQDW686mK3dgHLlAAAAZU"]
[Fri Apr 17 15:25:51.332861 2026] [:error] [pid 9152:tid 9193] [client 20.215.250.20:64773] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHgf5JYca8I3TNCwIcL-AAAAEM"]
[Fri Apr 17 15:25:51.995623 2026] [:error] [pid 25010:tid 25021] [client 20.215.250.20:64224] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHgf4-7kkf42RarqQ1LKwAAAUg"]
[Fri Apr 17 15:25:53.274707 2026] [:error] [pid 9153:tid 9235] [client 20.215.250.20:64862] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHggeMHGxkTZX3c45fW8wAAAJE"]
[Fri Apr 17 15:25:54.226638 2026] [:error] [pid 61523:tid 61556] [client 20.215.250.20:63583] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeHggsOaH-Pgc7WEf4NZKQAAAc4"]
[Fri Apr 17 15:25:54.885658 2026] [:error] [pid 61523:tid 61565] [client 20.215.250.20:63611] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeHggsOaH-Pgc7WEf4NZKwAAAdc"]
[Fri Apr 17 15:25:55.959567 2026] [:error] [pid 25010:tid 25014] [client 20.215.250.20:63517] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeHgg4-7kkf42RarqQ1LLwAAAUE"]
[Fri Apr 17 15:25:56.575159 2026] [:error] [pid 25010:tid 25019] [client 20.215.250.20:64243] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeHghI-7kkf42RarqQ1LMAAAAUY"]
[Fri Apr 17 15:25:57.183873 2026] [:error] [pid 9153:tid 9234] [client 20.215.250.20:65443] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeHgheMHGxkTZX3c45fW9QAAAJA"]
[Fri Apr 17 15:25:58.008996 2026] [:error] [pid 9152:tid 9204] [client 20.215.250.20:64823] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeHghpJYca8I3TNCwIcMBAAAAE4"]
[Fri Apr 17 15:25:59.035525 2026] [:error] [pid 25010:tid 25033] [client 20.215.250.20:64793] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeHgh4-7kkf42RarqQ1LMgAAAVQ"]
[Fri Apr 17 15:26:00.014148 2026] [:error] [pid 9153:tid 9238] [client 20.215.250.20:64783] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aeHgiOMHGxkTZX3c45fW-wAAAJQ"]
[Fri Apr 17 15:26:00.809604 2026] [:error] [pid 9263:tid 9285] [client 20.215.250.20:64866] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeHgiBP68VyHNvj1e568RwAAANQ"]
[Fri Apr 17 15:26:01.424524 2026] [:error] [pid 9153:tid 9226] [client 20.215.250.20:63505] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeHgieMHGxkTZX3c45fW_AAAAIg"]
[Fri Apr 17 15:26:02.087099 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:64876] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeHgisOaH-Pgc7WEf4NZOQAAAcE"]
[Fri Apr 17 15:26:02.867360 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:64802] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeHgihP68VyHNvj1e568VwAAANM"]
[Fri Apr 17 15:26:04.045100 2026] [:error] [pid 61523:tid 61541] [client 20.215.250.20:64234] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeHgjMOaH-Pgc7WEf4NZPwAAAcA"]
[Fri Apr 17 15:26:04.966117 2026] [:error] [pid 61523:tid 61564] [client 20.215.250.20:64860] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeHgjMOaH-Pgc7WEf4NZQwAAAdY"]
[Fri Apr 17 15:26:05.672096 2026] [:error] [pid 9152:tid 9204] [client 20.215.250.20:64215] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeHgjZJYca8I3TNCwIcMBwAAAE4"]
[Fri Apr 17 15:26:06.239033 2026] [:error] [pid 9152:tid 9195] [client 20.215.250.20:64798] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-michan.php"] [unique_id "aeHgjpJYca8I3TNCwIcMCgAAAEU"]
[Fri Apr 17 15:26:06.789038 2026] [:error] [pid 51878:tid 51891] [client 20.215.250.20:64832] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeHgjknQhUtMbw9EsgYmkQAAAQs"]
[Fri Apr 17 15:26:07.549337 2026] [:error] [pid 51878:tid 51901] [client 20.215.250.20:65488] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeHgj0nQhUtMbw9EsgYmlAAAARU"]
[Fri Apr 17 15:26:08.291476 2026] [:error] [pid 51878:tid 51884] [client 20.215.250.20:63604] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeHgkEnQhUtMbw9EsgYmlgAAAQQ"]
[Fri Apr 17 15:26:08.913044 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:64250] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeHgkBP68VyHNvj1e568awAAANU"]
[Fri Apr 17 15:26:09.749059 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:64859] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeHgkRP68VyHNvj1e568cwAAAMc"]
[Fri Apr 17 15:26:10.500940 2026] [:error] [pid 34273:tid 34280] [client 20.215.250.20:64149] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeHgkmuQDW686mK3dgHLnAAAAYU"]
[Fri Apr 17 15:26:11.163448 2026] [:error] [pid 9152:tid 9208] [client 20.215.250.20:65480] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeHgk5JYca8I3TNCwIcMDgAAAFI"]
[Fri Apr 17 15:26:12.056932 2026] [:error] [pid 9152:tid 9199] [client 20.215.250.20:65430] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "aeHglJJYca8I3TNCwIcMEQAAAEk"]
[Fri Apr 17 15:26:12.767305 2026] [:error] [pid 51878:tid 51900] [client 20.215.250.20:64840] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeHglEnQhUtMbw9EsgYmmwAAARQ"]
[Fri Apr 17 15:26:13.387291 2026] [:error] [pid 9152:tid 9194] [client 20.215.250.20:64785] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeHglZJYca8I3TNCwIcMFQAAAEQ"]
[Fri Apr 17 15:26:13.922170 2026] [:error] [pid 9152:tid 9191] [client 20.215.250.20:63509] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeHglZJYca8I3TNCwIcMFgAAAEE"]
[Fri Apr 17 15:26:14.459732 2026] [:error] [pid 34273:tid 34286] [client 20.215.250.20:63488] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "aeHglmuQDW686mK3dgHLqQAAAYs"]
[Fri Apr 17 15:26:15.065373 2026] [:error] [pid 9263:tid 9287] [client 20.215.250.20:65435] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeHglxP68VyHNvj1e568igAAANY"]
[Fri Apr 17 15:26:15.575094 2026] [:error] [pid 34273:tid 34284] [client 20.215.250.20:63603] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeHgl2uQDW686mK3dgHLrAAAAYk"]
[Fri Apr 17 15:26:16.167555 2026] [:error] [pid 34273:tid 34287] [client 20.215.250.20:65493] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeHgmGuQDW686mK3dgHLrQAAAYw"]
[Fri Apr 17 15:26:16.680984 2026] [:error] [pid 34273:tid 34282] [client 20.215.250.20:65476] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "aeHgmGuQDW686mK3dgHLsQAAAYc"]
[Fri Apr 17 15:26:17.217353 2026] [:error] [pid 9263:tid 9272] [client 20.215.250.20:65447] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeHgmRP68VyHNvj1e568kwAAAMc"]
[Fri Apr 17 15:26:17.809321 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64237] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeHgmRP68VyHNvj1e568lwAAAME"]
[Fri Apr 17 15:26:18.529169 2026] [:error] [pid 9263:tid 9287] [client 20.215.250.20:65418] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeHgmhP68VyHNvj1e568nAAAANY"]
[Fri Apr 17 15:26:19.268576 2026] [:error] [pid 9263:tid 9281] [client 20.215.250.20:62974] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wen.php"] [unique_id "aeHgmxP68VyHNvj1e568oQAAANA"]
[Fri Apr 17 15:26:20.238778 2026] [:error] [pid 61523:tid 61549] [client 20.215.250.20:62887] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeHgnMOaH-Pgc7WEf4NZSAAAAcc"]
[Fri Apr 17 15:26:20.963669 2026] [:error] [pid 61523:tid 61563] [client 20.215.250.20:63524] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeHgnMOaH-Pgc7WEf4NZTAAAAdU"]
[Fri Apr 17 15:26:21.525774 2026] [:error] [pid 34273:tid 34288] [client 20.215.250.20:64813] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeHgnWuQDW686mK3dgHLtQAAAY0"]
[Fri Apr 17 15:26:22.081906 2026] [:error] [pid 51878:tid 51890] [client 20.215.250.20:65511] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeHgnknQhUtMbw9EsgYmogAAAQo"]
[Fri Apr 17 15:26:22.642669 2026] [:error] [pid 34273:tid 34294] [client 20.215.250.20:64222] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeHgnmuQDW686mK3dgHLvAAAAZM"]
[Fri Apr 17 15:26:23.211614 2026] [:error] [pid 25010:tid 25025] [client 20.215.250.20:64143] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeHgn4-7kkf42RarqQ1LOQAAAUw"]
[Fri Apr 17 15:26:23.843066 2026] [:error] [pid 34273:tid 34292] [client 20.215.250.20:64777] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeHgn2uQDW686mK3dgHLxAAAAZE"]
[Fri Apr 17 15:26:24.422006 2026] [:error] [pid 25010:tid 25028] [client 20.215.250.20:64881] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "aeHgoI-7kkf42RarqQ1LPAAAAU8"]
[Fri Apr 17 15:26:25.032606 2026] [:error] [pid 61523:tid 61550] [client 20.215.250.20:63598] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeHgocOaH-Pgc7WEf4NZVAAAAcg"]
[Fri Apr 17 15:26:25.725856 2026] [:error] [pid 61523:tid 61547] [client 20.215.250.20:62941] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeHgocOaH-Pgc7WEf4NZWQAAAcU"]
[Fri Apr 17 15:26:26.302198 2026] [:error] [pid 61523:tid 61561] [client 20.215.250.20:63572] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeHgosOaH-Pgc7WEf4NZXAAAAdM"]
[Fri Apr 17 15:26:27.082968 2026] [:error] [pid 61523:tid 61562] [client 20.215.250.20:62295] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aeHgo8OaH-Pgc7WEf4NZYwAAAdQ"]
[Fri Apr 17 15:26:27.672539 2026] [:error] [pid 61523:tid 61553] [client 20.215.250.20:64202] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeHgo8OaH-Pgc7WEf4NZZwAAAcs"]
[Fri Apr 17 15:26:28.456033 2026] [:error] [pid 51878:tid 51899] [client 20.215.250.20:64148] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeHgpEnQhUtMbw9EsgYmowAAARM"]
[Fri Apr 17 15:26:29.177528 2026] [:error] [pid 9263:tid 9268] [client 20.215.250.20:62932] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeHgpRP68VyHNvj1e568qwAAAMM"]
[Fri Apr 17 15:26:29.960572 2026] [:error] [pid 51878:tid 51882] [client 20.215.250.20:65442] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeHgpUnQhUtMbw9EsgYmpAAAAQI"]
[Fri Apr 17 15:26:30.623815 2026] [:error] [pid 51878:tid 51880] [client 20.215.250.20:64878] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgpknQhUtMbw9EsgYmpQAAAQA"]
[Fri Apr 17 15:26:31.164500 2026] [:error] [pid 61523:tid 61558] [client 20.215.250.20:63552] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgp8OaH-Pgc7WEf4NZcwAAAdA"]
[Fri Apr 17 15:26:31.718870 2026] [:error] [pid 9263:tid 9286] [client 20.215.250.20:65521] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgpxP68VyHNvj1e568sAAAANU"]
[Fri Apr 17 15:26:32.354199 2026] [:error] [pid 25010:tid 25032] [client 20.215.250.20:65475] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeHgqI-7kkf42RarqQ1LPgAAAVM"]
[Fri Apr 17 15:26:33.145872 2026] [:error] [pid 34273:tid 34284] [client 20.215.250.20:65440] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeHgqWuQDW686mK3dgHL5QAAAYk"]
[Fri Apr 17 15:26:33.861018 2026] [:error] [pid 9153:tid 9226] [client 20.215.250.20:64217] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeHgqeMHGxkTZX3c45fXBAAAAIg"]
[Fri Apr 17 15:26:34.648768 2026] [:error] [pid 34273:tid 34289] [client 20.215.250.20:64249] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeHgqmuQDW686mK3dgHL6QAAAY4"]
[Fri Apr 17 15:26:35.570318 2026] [:error] [pid 51878:tid 51903] [client 20.215.250.20:65496] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aeHgq0nQhUtMbw9EsgYmrAAAARc"]
[Fri Apr 17 15:26:36.728849 2026] [:error] [pid 25010:tid 25036] [client 20.215.250.20:63536] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aeHgrI-7kkf42RarqQ1LPwAAAVc"]
[Fri Apr 17 15:26:37.618174 2026] [proxy_fcgi:error] [pid 51878:tid 51893] [client 20.215.250.20:64804] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:37.888553 2026] [proxy_fcgi:error] [pid 51878:tid 51890] [client 20.215.250.20:64804] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:38.399710 2026] [:error] [pid 51878:tid 51880] [client 20.215.250.20:64804] [client 20.215.250.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeHgrknQhUtMbw9EsgYmtAAAAQA"]
[Fri Apr 17 15:26:39.375276 2026] [proxy_fcgi:error] [pid 9152:tid 9201] [client 20.215.250.20:64227] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:40.642138 2026] [proxy_fcgi:error] [pid 9152:tid 9195] [client 20.215.250.20:64227] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:40.924789 2026] [proxy_fcgi:error] [pid 9152:tid 9210] [client 20.215.250.20:64227] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:41.186668 2026] [proxy_fcgi:error] [pid 9152:tid 9194] [client 20.215.250.20:64227] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:41.458184 2026] [proxy_fcgi:error] [pid 9152:tid 9206] [client 20.215.250.20:64227] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:26:41.712807 2026] [:error] [pid 9152:tid 9202] [client 20.215.250.20:64227] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "aeHgsZJYca8I3TNCwIcMIAAAAEw"]
[Fri Apr 17 15:26:42.569736 2026] [:error] [pid 61523:tid 61556] [client 20.215.250.20:63567] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "aeHgssOaH-Pgc7WEf4NZeAAAAc4"]
[Fri Apr 17 15:26:43.996930 2026] [:error] [pid 34273:tid 34289] [client 20.215.250.20:64850] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "aeHgs2uQDW686mK3dgHL8wAAAY4"]
[Fri Apr 17 15:26:45.050124 2026] [:error] [pid 25010:tid 25029] [client 20.215.250.20:64200] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "aeHgtY-7kkf42RarqQ1LSAAAAVA"]
[Fri Apr 17 15:26:46.157555 2026] [:error] [pid 61523:tid 61543] [client 20.215.250.20:64188] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "aeHgtsOaH-Pgc7WEf4NZfAAAAcE"]
[Fri Apr 17 15:26:46.936272 2026] [:error] [pid 9153:tid 9241] [client 20.215.250.20:63544] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "aeHgtuMHGxkTZX3c45fXEAAAAJc"]
[Fri Apr 17 15:26:47.515974 2026] [:error] [pid 61523:tid 61560] [client 20.215.250.20:64816] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "aeHgt8OaH-Pgc7WEf4NZfgAAAdI"]
[Fri Apr 17 15:26:48.100836 2026] [:error] [pid 61523:tid 61551] [client 20.215.250.20:63535] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "aeHguMOaH-Pgc7WEf4NZfwAAAck"]
[Fri Apr 17 15:26:48.746113 2026] [:error] [pid 61523:tid 61565] [client 20.215.250.20:64168] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aeHguMOaH-Pgc7WEf4NZggAAAdc"]
[Fri Apr 17 15:26:49.306690 2026] [:error] [pid 9263:tid 9289] [client 20.215.250.20:65458] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aeHguRP68VyHNvj1e568tgAAANg"]
[Fri Apr 17 15:26:50.096017 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:65485] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aeHguhP68VyHNvj1e568uAAAAMk"]
[Fri Apr 17 15:26:51.045130 2026] [:error] [pid 9152:tid 9197] [client 20.215.250.20:64139] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "aeHgu5JYca8I3TNCwIcMIwAAAEc"]
[Fri Apr 17 15:26:51.827075 2026] [:error] [pid 9263:tid 9267] [client 20.215.250.20:64781] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeHguxP68VyHNvj1e568uwAAAMI"]
[Fri Apr 17 15:26:52.582578 2026] [:error] [pid 9152:tid 9213] [client 20.215.250.20:62960] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeHgvJJYca8I3TNCwIcMJwAAAFc"]
[Fri Apr 17 15:26:53.440744 2026] [:error] [pid 61523:tid 61557] [client 20.215.250.20:64806] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeHgvcOaH-Pgc7WEf4NZigAAAc8"]
[Fri Apr 17 15:26:54.287492 2026] [:error] [pid 61523:tid 61559] [client 20.215.250.20:63589] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeHgvsOaH-Pgc7WEf4NZjQAAAdE"]
[Fri Apr 17 15:26:55.352331 2026] [:error] [pid 9153:tid 9232] [client 20.215.250.20:64863] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeHgv-MHGxkTZX3c45fXHQAAAI4"]
[Fri Apr 17 15:26:56.433338 2026] [:error] [pid 9263:tid 9275] [client 20.215.250.20:63514] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeHgwBP68VyHNvj1e568vgAAAMo"]
[Fri Apr 17 15:26:57.514993 2026] [:error] [pid 51878:tid 51891] [client 20.215.250.20:64181] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeHgwUnQhUtMbw9EsgYmwQAAAQs"]
[Fri Apr 17 15:26:58.505300 2026] [:error] [pid 51878:tid 51897] [client 20.215.250.20:64868] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeHgwknQhUtMbw9EsgYmxAAAARE"]
[Fri Apr 17 15:26:59.161597 2026] [:error] [pid 51878:tid 51888] [client 20.215.250.20:62931] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeHgw0nQhUtMbw9EsgYmxgAAAQg"]
[Fri Apr 17 15:27:00.822733 2026] [:error] [pid 9152:tid 9203] [client 20.215.250.20:65463] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeHgxJJYca8I3TNCwIcMLgAAAE0"]
[Fri Apr 17 15:27:03.489089 2026] [:error] [pid 9153:tid 9237] [client 20.215.250.20:64810] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeHgx-MHGxkTZX3c45fXIQAAAJM"]
[Fri Apr 17 15:27:04.090278 2026] [:error] [pid 34273:tid 34289] [client 20.215.250.20:62952] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeHgyGuQDW686mK3dgHMAwAAAY4"]
[Fri Apr 17 15:27:04.925458 2026] [:error] [pid 9152:tid 9196] [client 20.215.250.20:63607] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeHgyJJYca8I3TNCwIcMNQAAAEY"]
[Fri Apr 17 15:27:06.071109 2026] [:error] [pid 51878:tid 51886] [client 20.215.250.20:65487] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeHgyknQhUtMbw9EsgYmzgAAAQY"]
[Fri Apr 17 15:27:07.424172 2026] [:error] [pid 61523:tid 61565] [client 20.215.250.20:65456] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeHgy8OaH-Pgc7WEf4NZkwAAAdc"]
[Fri Apr 17 15:27:08.134189 2026] [:error] [pid 25010:tid 25014] [client 20.215.250.20:64886] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeHgzI-7kkf42RarqQ1LTAAAAUE"]
[Fri Apr 17 15:27:08.692839 2026] [:error] [pid 51878:tid 51901] [client 20.215.250.20:65436] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeHgzEnQhUtMbw9EsgYm1gAAARU"]
[Fri Apr 17 15:27:09.348615 2026] [:error] [pid 51878:tid 51882] [client 20.215.250.20:64811] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeHgzUnQhUtMbw9EsgYm1wAAAQI"]
[Fri Apr 17 15:27:09.991500 2026] [:error] [pid 51878:tid 51889] [client 20.215.250.20:63597] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeHgzUnQhUtMbw9EsgYm4wAAAQk"]
[Fri Apr 17 15:27:10.613847 2026] [:error] [pid 25010:tid 25033] [client 20.215.250.20:64184] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeHgzo-7kkf42RarqQ1LbAAAAVQ"]
[Fri Apr 17 15:27:11.174297 2026] [:error] [pid 51878:tid 51895] [client 20.215.250.20:64770] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeHgz0nQhUtMbw9EsgYm7QAAAQ8"]
[Fri Apr 17 15:27:11.755563 2026] [:error] [pid 34273:tid 34291] [client 20.215.250.20:64241] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeHgz2uQDW686mK3dgHMDAAAAZA"]
[Fri Apr 17 15:27:12.282739 2026] [:error] [pid 9263:tid 9274] [client 20.215.250.20:65420] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeHg0BP68VyHNvj1e568wgAAAMk"]
[Fri Apr 17 15:27:12.817500 2026] [:error] [pid 9153:tid 9218] [client 20.215.250.20:64214] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeHg0OMHGxkTZX3c45fXJQAAAIA"]
[Fri Apr 17 15:27:13.353950 2026] [:error] [pid 9263:tid 9278] [client 20.215.250.20:62894] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeHg0RP68VyHNvj1e568xwAAAM0"]
[Fri Apr 17 15:27:13.890671 2026] [:error] [pid 25010:tid 25030] [client 20.215.250.20:63502] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeHg0Y-7kkf42RarqQ1LdQAAAVE"]
[Fri Apr 17 15:27:14.426172 2026] [:error] [pid 9153:tid 9219] [client 20.215.250.20:64176] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeHg0uMHGxkTZX3c45fXKQAAAIE"]
[Fri Apr 17 15:27:15.170969 2026] [:error] [pid 61523:tid 61541] [client 20.215.250.20:64825] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeHg08OaH-Pgc7WEf4NZmAAAAcA"]
[Fri Apr 17 15:27:15.708551 2026] [:error] [pid 9263:tid 9276] [client 20.215.250.20:64228] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHg0xP68VyHNvj1e568yQAAAMs"]
[Fri Apr 17 15:27:16.266485 2026] [:error] [pid 61523:tid 61560] [client 20.215.250.20:64156] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHg1MOaH-Pgc7WEf4NZmQAAAdI"]
[Fri Apr 17 15:27:16.872592 2026] [:error] [pid 25010:tid 25027] [client 20.215.250.20:64183] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHg1I-7kkf42RarqQ1LewAAAU4"]
[Fri Apr 17 15:27:17.703384 2026] [:error] [pid 25010:tid 25018] [client 20.215.250.20:65486] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeHg1Y-7kkf42RarqQ1LfQAAAUU"]
[Fri Apr 17 15:27:18.254163 2026] [:error] [pid 51878:tid 51884] [client 20.215.250.20:62931] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeHg1knQhUtMbw9EsgYm9AAAAQQ"]
[Fri Apr 17 15:27:19.033314 2026] [:error] [pid 51878:tid 51899] [client 20.215.250.20:64768] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeHg10nQhUtMbw9EsgYm9QAAARM"]
[Fri Apr 17 15:27:19.620893 2026] [:error] [pid 34273:tid 34284] [client 20.215.250.20:64140] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeHg12uQDW686mK3dgHMGgAAAYk"]
[Fri Apr 17 15:27:20.140810 2026] [:error] [pid 61523:tid 61552] [client 20.215.250.20:63565] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeHg2MOaH-Pgc7WEf4NZogAAAco"]
[Fri Apr 17 15:27:20.798921 2026] [:error] [pid 9263:tid 9283] [client 20.215.250.20:64128] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeHg2BP68VyHNvj1e5681gAAANI"]
[Fri Apr 17 15:27:21.465524 2026] [:error] [pid 51878:tid 51900] [client 20.215.250.20:65517] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeHg2UnQhUtMbw9EsgYm9wAAARQ"]
[Fri Apr 17 15:27:22.114545 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64772] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeHg2hP68VyHNvj1e5682gAAAME"]
[Fri Apr 17 15:27:23.102905 2026] [:error] [pid 51878:tid 51902] [client 20.215.250.20:65448] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeHg20nQhUtMbw9EsgYm-AAAARY"]
[Fri Apr 17 15:27:23.825656 2026] [:error] [pid 61523:tid 61541] [client 20.215.250.20:62890] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeHg28OaH-Pgc7WEf4NZpQAAAcA"]
[Fri Apr 17 15:27:24.472358 2026] [:error] [pid 9153:tid 9230] [client 20.215.250.20:64150] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeHg3OMHGxkTZX3c45fXLgAAAIw"]
[Fri Apr 17 15:27:25.366327 2026] [:error] [pid 61523:tid 61552] [client 20.215.250.20:62250] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeHg3cOaH-Pgc7WEf4NZqwAAAco"]
[Fri Apr 17 15:27:26.527772 2026] [:error] [pid 34273:tid 34296] [client 20.215.250.20:64201] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeHg3muQDW686mK3dgHMJQAAAZU"]
[Fri Apr 17 15:27:27.408669 2026] [:error] [pid 61523:tid 61564] [client 20.215.250.20:64819] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeHg38OaH-Pgc7WEf4NZrQAAAdY"]
[Fri Apr 17 15:27:28.535817 2026] [:error] [pid 61523:tid 61554] [client 20.215.250.20:64864] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeHg4MOaH-Pgc7WEf4NZrwAAAcw"]
[Fri Apr 17 15:27:29.363792 2026] [:error] [pid 61523:tid 61560] [client 20.215.250.20:63578] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeHg4cOaH-Pgc7WEf4NZsgAAAdI"]
[Fri Apr 17 15:27:30.865663 2026] [:error] [pid 61523:tid 61552] [client 20.215.250.20:63557] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeHg4sOaH-Pgc7WEf4NZuAAAAco"]
[Fri Apr 17 15:27:31.511627 2026] [:error] [pid 61523:tid 61550] [client 20.215.250.20:63520] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeHg48OaH-Pgc7WEf4NZvQAAAcg"]
[Fri Apr 17 15:27:32.062414 2026] [:error] [pid 61523:tid 61554] [client 20.215.250.20:64247] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeHg5MOaH-Pgc7WEf4NZvwAAAcw"]
[Fri Apr 17 15:27:32.631042 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:62954] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeHg5BP68VyHNvj1e569BgAAAME"]
[Fri Apr 17 15:27:33.215559 2026] [:error] [pid 61523:tid 61551] [client 20.215.250.20:64775] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeHg5cOaH-Pgc7WEf4NZyAAAAck"]
[Fri Apr 17 15:27:33.760794 2026] [:error] [pid 9263:tid 9284] [client 20.215.250.20:64889] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeHg5RP68VyHNvj1e569EgAAANM"]
[Fri Apr 17 15:27:34.278657 2026] [:error] [pid 61523:tid 61545] [client 20.215.250.20:64792] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeHg5sOaH-Pgc7WEf4NZ3wAAAcM"]
[Fri Apr 17 15:27:34.793924 2026] [:error] [pid 61523:tid 61557] [client 20.215.250.20:63558] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeHg5sOaH-Pgc7WEf4NZ5gAAAc8"]
[Fri Apr 17 15:27:35.337472 2026] [:error] [pid 9263:tid 9267] [client 20.215.250.20:62947] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vee.php"] [unique_id "aeHg5xP68VyHNvj1e569GwAAAMI"]
[Fri Apr 17 15:27:35.889314 2026] [:error] [pid 9263:tid 9285] [client 20.215.250.20:63556] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeHg5xP68VyHNvj1e569HQAAANQ"]
[Fri Apr 17 15:27:36.436345 2026] [:error] [pid 9152:tid 9200] [client 20.215.250.20:64203] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeHg6JJYca8I3TNCwIcMPAAAAEo"]
[Fri Apr 17 15:27:37.064433 2026] [:error] [pid 9151:tid 9178] [client 20.215.250.20:65501] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeHg6chTVuRPkua22vQZ0gAAABE"]
[Fri Apr 17 15:27:37.892076 2026] [:error] [pid 9263:tid 9266] [client 20.215.250.20:64246] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cabs.php"] [unique_id "aeHg6RP68VyHNvj1e569JQAAAME"]
[Fri Apr 17 15:27:38.632960 2026] [:error] [pid 25010:tid 25024] [client 20.215.250.20:62933] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeHg6o-7kkf42RarqQ1LhgAAAUs"]
[Fri Apr 17 15:27:39.476217 2026] [:error] [pid 9263:tid 9273] [client 20.215.250.20:64232] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeHg6xP68VyHNvj1e569KwAAAMg"]
[Fri Apr 17 15:27:40.185230 2026] [:error] [pid 9153:tid 9226] [client 20.215.250.20:62929] [client 20.215.250.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeHg7OMHGxkTZX3c45fXjQAAAIg"]
[Fri Apr 17 15:27:41.590658 2026] [proxy_fcgi:error] [pid 51878:tid 51897] [client 20.215.250.20:64145] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:27:41.861152 2026] [proxy_fcgi:error] [pid 51878:tid 51883] [client 20.215.250.20:64145] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 15:27:42.476196 2026] [proxy_fcgi:error] [pid 51878:tid 51895] [client 20.215.250.20:64145] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 16:18:22.423007 2026] [:error] [pid 9153:tid 9238] [client 103.216.221.91:23095] [client 103.216.221.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.91, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeHszuMHGxkTZX3c45feOQAAAJQ"]
[Fri Apr 17 16:18:22.557755 2026] [proxy_fcgi:error] [pid 9153:tid 9238] [client 103.216.221.91:23095] AH01071: Got error 'Primary script unknown'
[Fri Apr 17 16:51:42.453869 2026] [:error] [pid 9263:tid 9289] [client 43.159.132.207:55718] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeH0nhP68VyHNvj1e57l1wAAANg"]
[Fri Apr 17 17:42:00.875199 2026] [:error] [pid 61523:tid 61547] [client 182.43.70.143:53143] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeIAaMOaH-Pgc7WEf4OFrAAAAcU"]
[Fri Apr 17 20:42:17.332983 2026] [:error] [pid 51878:tid 51886] [client 51.83.237.175:43656] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeIqqUnQhUtMbw9EsgaKHgAAAQY"]
[Fri Apr 17 20:42:18.463958 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:44176] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aeIqqpJYca8I3TNCwIdacwAAAEA"]
[Fri Apr 17 20:42:19.441962 2026] [:error] [pid 9263:tid 9268] [client 51.83.237.175:44948] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeIqqxP68VyHNvj1e540fwAAAMM"]
[Fri Apr 17 20:42:20.455501 2026] [:error] [pid 51878:tid 51884] [client 51.83.237.175:44958] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeIqrEnQhUtMbw9EsgaKHwAAAQQ"]
[Fri Apr 17 20:42:22.149667 2026] [:error] [pid 9263:tid 9280] [client 51.83.237.175:44974] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeIqrhP68VyHNvj1e540hQAAAM8"]
[Fri Apr 17 20:42:22.647651 2026] [:error] [pid 9152:tid 9206] [client 51.83.237.175:44978] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeIqrpJYca8I3TNCwIdaegAAAFA"]
[Fri Apr 17 20:42:23.787425 2026] [:error] [pid 9153:tid 9222] [client 51.83.237.175:39050] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqr-MHGxkTZX3c45cHUgAAAIQ"]
[Fri Apr 17 20:42:24.239839 2026] [:error] [pid 61523:tid 61557] [client 51.83.237.175:44990] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqsMOaH-Pgc7WEf4PINAAAAc8"]
[Fri Apr 17 20:42:24.712580 2026] [:error] [pid 9263:tid 9265] [client 51.83.237.175:44994] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeIqsBP68VyHNvj1e540iQAAAMA"]
[Fri Apr 17 20:42:26.248882 2026] [:error] [pid 61523:tid 61547] [client 51.83.237.175:39058] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqssOaH-Pgc7WEf4PIQwAAAcU"]
[Fri Apr 17 20:42:28.198781 2026] [:error] [pid 25010:tid 25033] [client 51.83.237.175:43780] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqtI-7kkf42RarqQ10AQAAAVQ"]
[Fri Apr 17 20:42:28.218727 2026] [:error] [pid 9263:tid 9268] [client 51.83.237.175:32920] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqtBP68VyHNvj1e540jgAAAMM"]
[Fri Apr 17 20:42:30.892582 2026] [:error] [pid 51878:tid 51895] [client 51.83.237.175:32930] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqtknQhUtMbw9EsgaKKwAAAQ8"]
[Fri Apr 17 20:42:31.125514 2026] [:error] [pid 9263:tid 9289] [client 51.83.237.175:43790] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeIqtxP68VyHNvj1e540mAAAANg"]
[Fri Apr 17 20:42:33.542746 2026] [:error] [pid 9263:tid 9270] [client 51.83.237.175:43796] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeIquRP68VyHNvj1e540nAAAAMU"]
[Fri Apr 17 20:42:33.909155 2026] [:error] [pid 9263:tid 9268] [client 51.83.237.175:43812] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeIquRP68VyHNvj1e540ngAAAMM"]
[Fri Apr 17 20:42:34.700836 2026] [:error] [pid 9153:tid 9240] [client 51.83.237.175:32936] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIquuMHGxkTZX3c45cHWwAAAJY"]
[Fri Apr 17 20:42:35.836556 2026] [:error] [pid 9153:tid 9232] [client 51.83.237.175:43820] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeIqu-MHGxkTZX3c45cHYAAAAI4"]
[Fri Apr 17 20:42:38.036442 2026] [:error] [pid 9263:tid 9273] [client 51.83.237.175:39380] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeIqvhP68VyHNvj1e540owAAAMg"]
[Fri Apr 17 20:42:38.424676 2026] [:error] [pid 9263:tid 9266] [client 51.83.237.175:39382] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeIqvhP68VyHNvj1e540pgAAAME"]
[Fri Apr 17 20:42:39.890699 2026] [:error] [pid 9263:tid 9286] [client 51.83.237.175:53608] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIqvxP68VyHNvj1e540qAAAANU"]
[Fri Apr 17 20:42:40.610589 2026] [:error] [pid 61523:tid 61556] [client 51.83.237.175:39394] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeIqwMOaH-Pgc7WEf4PITgAAAc4"]
[Fri Apr 17 20:42:40.871908 2026] [:error] [pid 9263:tid 9285] [client 51.83.237.175:39410] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeIqwBP68VyHNvj1e540qQAAANQ"]
[Fri Apr 17 20:42:42.835161 2026] [:error] [pid 51878:tid 51900] [client 51.83.237.175:39416] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeIqwknQhUtMbw9EsgaKMwAAARQ"]
[Fri Apr 17 20:42:43.027338 2026] [:error] [pid 9153:tid 9223] [client 51.83.237.175:39420] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeIqw-MHGxkTZX3c45cHZAAAAIU"]
[Fri Apr 17 20:42:44.827570 2026] [:error] [pid 9263:tid 9281] [client 51.83.237.175:39428] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeIqxBP68VyHNvj1e540tAAAANA"]
[Fri Apr 17 20:42:45.145822 2026] [:error] [pid 9263:tid 9289] [client 51.83.237.175:39432] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeIqxRP68VyHNvj1e540tQAAANg"]
[Fri Apr 17 20:42:46.895527 2026] [:error] [pid 25010:tid 25028] [client 51.83.237.175:42650] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeIqxo-7kkf42RarqQ10CQAAAU8"]
[Fri Apr 17 20:42:47.090495 2026] [:error] [pid 51878:tid 51901] [client 51.83.237.175:42658] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeIqx0nQhUtMbw9EsgaKVAAAARU"]
[Fri Apr 17 20:42:48.880170 2026] [:error] [pid 51878:tid 51904] [client 51.83.237.175:42668] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeIqyEnQhUtMbw9EsgaKXwAAARg"]
[Fri Apr 17 20:42:49.007340 2026] [:error] [pid 51878:tid 51903] [client 51.83.237.175:42684] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeIqyUnQhUtMbw9EsgaKYgAAARc"]
[Fri Apr 17 20:42:50.930213 2026] [:error] [pid 25010:tid 25037] [client 51.83.237.175:42696] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeIqyo-7kkf42RarqQ10DQAAAVg"]
[Fri Apr 17 20:42:51.119321 2026] [:error] [pid 51878:tid 51888] [client 51.83.237.175:42702] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeIqy0nQhUtMbw9EsgaKZgAAAQg"]
[Fri Apr 17 20:42:52.827932 2026] [:error] [pid 9263:tid 9288] [client 51.83.237.175:42704] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeIqzBP68VyHNvj1e540wAAAANc"]
[Fri Apr 17 20:42:53.144358 2026] [:error] [pid 51878:tid 51900] [client 51.83.237.175:42710] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeIqzUnQhUtMbw9EsgaKawAAARQ"]
[Fri Apr 17 20:42:55.076887 2026] [:error] [pid 25010:tid 25013] [client 51.83.237.175:42712] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeIqz4-7kkf42RarqQ10EwAAAUA"]
[Fri Apr 17 20:42:55.184360 2026] [:error] [pid 9263:tid 9272] [client 51.83.237.175:42722] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeIqzxP68VyHNvj1e540xAAAAMc"]
[Fri Apr 17 20:42:57.199913 2026] [:error] [pid 9151:tid 9176] [client 51.83.237.175:48788] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeIq0chTVuRPkua22vQ7rQAAAA8"]
[Fri Apr 17 20:42:57.499401 2026] [:error] [pid 51878:tid 51900] [client 51.83.237.175:48804] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeIq0UnQhUtMbw9EsgaKcgAAARQ"]
[Fri Apr 17 20:42:59.271630 2026] [:error] [pid 9263:tid 9272] [client 51.83.237.175:48810] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeIq0xP68VyHNvj1e5400gAAAMc"]
[Fri Apr 17 20:42:59.942202 2026] [:error] [pid 25010:tid 25020] [client 51.83.237.175:48822] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeIq04-7kkf42RarqQ10GgAAAUc"]
[Fri Apr 17 20:43:01.424081 2026] [:error] [pid 61523:tid 61556] [client 51.83.237.175:48828] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeIq1cOaH-Pgc7WEf4PIZwAAAc4"]
[Fri Apr 17 20:43:01.877797 2026] [:error] [pid 51878:tid 51880] [client 51.83.237.175:48842] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeIq1UnQhUtMbw9EsgaKgwAAAQA"]
[Fri Apr 17 20:43:03.560852 2026] [:error] [pid 9263:tid 9271] [client 51.83.237.175:48856] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeIq1xP68VyHNvj1e5403AAAAMY"]
[Fri Apr 17 20:43:04.235438 2026] [:error] [pid 51878:tid 51898] [client 51.83.237.175:48870] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeIq2EnQhUtMbw9EsgaKlAAAARI"]
[Fri Apr 17 20:43:06.134116 2026] [:error] [pid 51878:tid 51895] [client 51.83.237.175:48874] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeIq2knQhUtMbw9EsgaKngAAAQ8"]
[Fri Apr 17 20:43:06.485982 2026] [:error] [pid 61523:tid 61556] [client 51.83.237.175:48882] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeIq2sOaH-Pgc7WEf4PIdAAAAc4"]
[Fri Apr 17 20:43:08.272679 2026] [:error] [pid 51878:tid 51884] [client 51.83.237.175:51754] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeIq3EnQhUtMbw9EsgaKowAAAQQ"]
[Fri Apr 17 20:43:08.418640 2026] [:error] [pid 34273:tid 34281] [client 51.83.237.175:51770] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeIq3GuQDW686mK3dgECqwAAAYY"]
[Fri Apr 17 20:43:10.349572 2026] [:error] [pid 34273:tid 34286] [client 51.83.237.175:51782] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeIq3muQDW686mK3dgECrwAAAYs"]
[Fri Apr 17 20:43:10.451054 2026] [:error] [pid 51878:tid 51901] [client 51.83.237.175:51794] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeIq3knQhUtMbw9EsgaKqQAAARU"]
[Fri Apr 17 20:43:12.403064 2026] [:error] [pid 34273:tid 34298] [client 51.83.237.175:51798] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeIq4GuQDW686mK3dgECtgAAAZc"]
[Fri Apr 17 20:43:12.657742 2026] [:error] [pid 61523:tid 61556] [client 51.83.237.175:51814] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeIq4MOaH-Pgc7WEf4PIfwAAAc4"]
[Fri Apr 17 20:43:14.524565 2026] [:error] [pid 51878:tid 51894] [client 51.83.237.175:51826] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeIq4knQhUtMbw9EsgaKuQAAAQ4"]
[Fri Apr 17 20:43:14.524574 2026] [:error] [pid 51878:tid 51891] [client 51.83.237.175:51830] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeIq4knQhUtMbw9EsgaKugAAAQs"]
[Fri Apr 17 20:43:26.451500 2026] [:error] [pid 9153:tid 9219] [client 51.83.237.175:51858] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeIq7uMHGxkTZX3c45cHewAAAIE"]
[Fri Apr 17 20:43:28.221044 2026] [:error] [pid 61523:tid 61555] [client 51.83.237.175:51844] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeIq8MOaH-Pgc7WEf4PIpgAAAc0"]
[Fri Apr 17 20:43:28.334971 2026] [:error] [pid 25010:tid 25029] [client 51.83.237.175:50248] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeIq8I-7kkf42RarqQ10JwAAAVA"]
[Fri Apr 17 20:43:30.309484 2026] [:error] [pid 25010:tid 25021] [client 51.83.237.175:50262] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeIq8o-7kkf42RarqQ10KwAAAUg"]
[Fri Apr 17 20:43:30.581877 2026] [:error] [pid 25010:tid 25014] [client 51.83.237.175:50274] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeIq8o-7kkf42RarqQ10LAAAAUE"]
[Fri Apr 17 20:43:32.381480 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:50286] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeIq9JJYca8I3TNCwIdaxgAAAEA"]
[Fri Apr 17 20:43:32.438218 2026] [:error] [pid 9152:tid 9194] [client 51.83.237.175:50290] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeIq9JJYca8I3TNCwIdaxwAAAEQ"]
[Fri Apr 17 20:43:34.075986 2026] [:error] [pid 34273:tid 34281] [client 51.83.237.175:50304] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIq9muQDW686mK3dgEC0wAAAYY"]
[Fri Apr 17 20:43:34.326602 2026] [:error] [pid 34273:tid 34296] [client 51.83.237.175:50314] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeIq9muQDW686mK3dgEC1AAAAZU"]
[Fri Apr 17 20:43:34.421703 2026] [:error] [pid 25010:tid 25019] [client 51.83.237.175:50324] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeIq9o-7kkf42RarqQ10MQAAAUY"]
[Fri Apr 17 20:43:36.493186 2026] [:error] [pid 9151:tid 9179] [client 51.83.237.175:50330] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeIq-MhTVuRPkua22vQ7uAAAABI"]
[Fri Apr 17 20:43:36.733752 2026] [:error] [pid 9263:tid 9275] [client 51.83.237.175:50336] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeIq-BP68VyHNvj1e541EgAAAMo"]
[Fri Apr 17 20:43:37.844745 2026] [:error] [pid 9151:tid 9169] [client 51.83.237.175:46346] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIq-chTVuRPkua22vQ7vgAAAAg"]
[Fri Apr 17 20:43:38.689234 2026] [:error] [pid 9263:tid 9289] [client 51.83.237.175:46352] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeIq-hP68VyHNvj1e541GAAAANg"]
[Fri Apr 17 20:43:38.693450 2026] [:error] [pid 34273:tid 34275] [client 51.83.237.175:46350] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeIq-muQDW686mK3dgEC2AAAAYA"]
[Fri Apr 17 20:43:40.678024 2026] [:error] [pid 51878:tid 51899] [client 51.83.237.175:46368] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeIq_EnQhUtMbw9EsgaLCwAAARM"]
[Fri Apr 17 20:43:41.100909 2026] [:error] [pid 9263:tid 9279] [client 51.83.237.175:46380] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeIq_RP68VyHNvj1e541KAAAAM4"]
[Fri Apr 17 20:43:43.103537 2026] [:error] [pid 51878:tid 51902] [client 51.83.237.175:46394] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeIq_0nQhUtMbw9EsgaLGQAAARY"]
[Fri Apr 17 20:43:43.181792 2026] [:error] [pid 34273:tid 34276] [client 51.83.237.175:46396] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeIq_2uQDW686mK3dgEC4wAAAYE"]
[Fri Apr 17 20:43:45.129382 2026] [:error] [pid 9153:tid 9225] [client 51.83.237.175:46402] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeIrAeMHGxkTZX3c45cHfAAAAIc"]
[Fri Apr 17 20:43:45.200554 2026] [:error] [pid 9153:tid 9229] [client 51.83.237.175:46406] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeIrAeMHGxkTZX3c45cHfQAAAIs"]
[Fri Apr 17 20:43:47.062828 2026] [:error] [pid 25010:tid 25025] [client 51.83.237.175:48380] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeIrA4-7kkf42RarqQ10OwAAAUw"]
[Fri Apr 17 20:43:47.526098 2026] [:error] [pid 51878:tid 51891] [client 51.83.237.175:48392] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeIrA0nQhUtMbw9EsgaLJwAAAQs"]
[Fri Apr 17 20:43:49.140068 2026] [:error] [pid 25010:tid 25033] [client 51.83.237.175:48398] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeIrBY-7kkf42RarqQ10PAAAAVQ"]
[Fri Apr 17 20:43:49.624029 2026] [:error] [pid 9152:tid 9214] [client 51.83.237.175:48408] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeIrBZJYca8I3TNCwIda2gAAAFg"]
[Fri Apr 17 20:43:51.654952 2026] [:error] [pid 25010:tid 25032] [client 51.83.237.175:48424] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeIrB4-7kkf42RarqQ10QAAAAVM"]
[Fri Apr 17 20:43:51.833186 2026] [:error] [pid 51878:tid 51901] [client 51.83.237.175:48426] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeIrB0nQhUtMbw9EsgaLLAAAARU"]
[Fri Apr 17 20:43:53.719409 2026] [:error] [pid 9263:tid 9286] [client 51.83.237.175:48436] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeIrCRP68VyHNvj1e541SgAAANU"]
[Fri Apr 17 20:43:53.926823 2026] [:error] [pid 9263:tid 9285] [client 51.83.237.175:48444] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeIrCRP68VyHNvj1e541TAAAANQ"]
[Fri Apr 17 20:43:56.072089 2026] [:error] [pid 9263:tid 9289] [client 51.83.237.175:48450] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeIrDBP68VyHNvj1e541VgAAANg"]
[Fri Apr 17 20:43:56.165600 2026] [:error] [pid 9152:tid 9209] [client 51.83.237.175:48466] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeIrDJJYca8I3TNCwIda5AAAAFM"]
[Fri Apr 17 20:43:58.392881 2026] [:error] [pid 9263:tid 9267] [client 51.83.237.175:38882] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeIrDhP68VyHNvj1e541XwAAAMI"]
[Fri Apr 17 20:43:58.428733 2026] [:error] [pid 9263:tid 9271] [client 51.83.237.175:38890] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeIrDhP68VyHNvj1e541YAAAAMY"]
[Fri Apr 17 20:44:00.352385 2026] [:error] [pid 61523:tid 61543] [client 51.83.237.175:38902] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeIrEMOaH-Pgc7WEf4PIvgAAAcE"]
[Fri Apr 17 20:44:00.555893 2026] [:error] [pid 9152:tid 9197] [client 51.83.237.175:38904] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeIrEJJYca8I3TNCwIda6QAAAEc"]
[Fri Apr 17 20:44:02.404729 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:38920] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeIrEpJYca8I3TNCwIda6gAAAEA"]
[Fri Apr 17 20:44:03.163295 2026] [:error] [pid 61523:tid 61561] [client 51.83.237.175:38930] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeIrE8OaH-Pgc7WEf4PIzQAAAdM"]
[Fri Apr 17 20:44:04.461763 2026] [:error] [pid 61523:tid 61546] [client 51.83.237.175:38938] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeIrFMOaH-Pgc7WEf4PI0QAAAcQ"]
[Fri Apr 17 20:44:05.029131 2026] [:error] [pid 61523:tid 61549] [client 51.83.237.175:38946] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeIrFcOaH-Pgc7WEf4PI0wAAAcc"]
[Fri Apr 17 20:44:06.382167 2026] [:error] [pid 25010:tid 25037] [client 51.83.237.175:38958] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeIrFo-7kkf42RarqQ10TQAAAVg"]
[Fri Apr 17 20:44:07.016506 2026] [:error] [pid 9153:tid 9236] [client 51.83.237.175:56810] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeIrF-MHGxkTZX3c45cHiAAAAJI"]
[Fri Apr 17 20:44:08.904136 2026] [:error] [pid 61523:tid 61548] [client 51.83.237.175:56816] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeIrGMOaH-Pgc7WEf4PI2wAAAcY"]
[Fri Apr 17 20:44:09.092576 2026] [:error] [pid 34273:tid 34296] [client 51.83.237.175:56824] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeIrGWuQDW686mK3dgEC8AAAAZU"]
[Fri Apr 17 20:44:10.925943 2026] [:error] [pid 9152:tid 9199] [client 51.83.237.175:56840] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeIrGpJYca8I3TNCwIda8wAAAEk"]
[Fri Apr 17 20:44:11.201781 2026] [:error] [pid 25010:tid 25014] [client 51.83.237.175:56846] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeIrG4-7kkf42RarqQ10WwAAAUE"]
[Fri Apr 17 20:44:13.418047 2026] [:error] [pid 61523:tid 61551] [client 51.83.237.175:56850] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeIrHcOaH-Pgc7WEf4PI4AAAAck"]
[Fri Apr 17 20:44:13.763449 2026] [:error] [pid 9153:tid 9242] [client 51.83.237.175:56854] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeIrHeMHGxkTZX3c45cHkgAAAJg"]
[Fri Apr 17 20:44:15.246884 2026] [:error] [pid 9263:tid 9284] [client 51.83.237.175:56866] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeIrHxP68VyHNvj1e541agAAANM"]
[Fri Apr 17 20:44:15.788686 2026] [:error] [pid 51878:tid 51900] [client 51.83.237.175:56870] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeIrH0nQhUtMbw9EsgaLUQAAARQ"]
[Fri Apr 17 20:44:17.281903 2026] [:error] [pid 34273:tid 34297] [client 51.83.237.175:41074] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeIrIWuQDW686mK3dgEC-gAAAZY"]
[Fri Apr 17 20:44:18.463624 2026] [:error] [pid 25010:tid 25022] [client 51.83.237.175:41086] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeIrIo-7kkf42RarqQ10YwAAAUk"]
[Fri Apr 17 20:44:19.201454 2026] [:error] [pid 61523:tid 61560] [client 51.83.237.175:41092] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeIrI8OaH-Pgc7WEf4PI7QAAAdI"]
[Fri Apr 17 20:44:20.441742 2026] [:error] [pid 25010:tid 25023] [client 51.83.237.175:41102] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeIrJI-7kkf42RarqQ10bAAAAUo"]
[Fri Apr 17 20:44:21.640470 2026] [:error] [pid 51878:tid 51893] [client 51.83.237.175:41104] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeIrJUnQhUtMbw9EsgaLWgAAAQ0"]
[Fri Apr 17 20:44:22.612479 2026] [:error] [pid 51878:tid 51895] [client 51.83.237.175:41110] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeIrJknQhUtMbw9EsgaLXwAAAQ8"]
[Fri Apr 17 20:44:24.179516 2026] [:error] [pid 34273:tid 34287] [client 51.83.237.175:41126] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeIrKGuQDW686mK3dgEDAgAAAYw"]
[Fri Apr 17 20:44:24.467806 2026] [:error] [pid 34273:tid 34288] [client 51.83.237.175:41142] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeIrKGuQDW686mK3dgEDBQAAAY0"]
[Fri Apr 17 20:44:36.817719 2026] [:error] [pid 51878:tid 51881] [client 51.83.237.175:54766] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aeIrNEnQhUtMbw9EsgaLgQAAAQE"]
[Fri Apr 17 20:44:38.391135 2026] [:error] [pid 9152:tid 9209] [client 51.83.237.175:41148] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeIrNpJYca8I3TNCwIdbEwAAAFM"]
[Fri Apr 17 20:44:39.255713 2026] [:error] [pid 9263:tid 9270] [client 51.83.237.175:51952] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aeIrNxP68VyHNvj1e541gQAAAMU"]
[Fri Apr 17 20:44:40.595707 2026] [:error] [pid 9153:tid 9242] [client 51.83.237.175:51966] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeIrOOMHGxkTZX3c45cHmgAAAJg"]
[Fri Apr 17 20:44:41.647870 2026] [:error] [pid 51878:tid 51897] [client 51.83.237.175:51974] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeIrOUnQhUtMbw9EsgaLiQAAARE"]
[Fri Apr 17 20:44:42.242670 2026] [:error] [pid 61523:tid 61562] [client 51.83.237.175:51978] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrOsOaH-Pgc7WEf4PJHgAAAdQ"]
[Fri Apr 17 20:44:42.594797 2026] [:error] [pid 34273:tid 34285] [client 51.83.237.175:51980] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeIrOmuQDW686mK3dgEDLQAAAYo"]
[Fri Apr 17 20:44:43.715141 2026] [:error] [pid 9263:tid 9280] [client 51.83.237.175:51990] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeIrOxP68VyHNvj1e541igAAAM8"]
[Fri Apr 17 20:44:44.610476 2026] [:error] [pid 61523:tid 61541] [client 51.83.237.175:51994] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeIrPMOaH-Pgc7WEf4PJJwAAAcA"]
[Fri Apr 17 20:44:45.589683 2026] [:error] [pid 61523:tid 61560] [client 51.83.237.175:52006] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeIrPcOaH-Pgc7WEf4PJMAAAAdI"]
[Fri Apr 17 20:44:46.461554 2026] [:error] [pid 9263:tid 9277] [client 51.83.237.175:52008] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrPhP68VyHNvj1e541kQAAAMw"]
[Fri Apr 17 20:44:47.417600 2026] [:error] [pid 9263:tid 9268] [client 51.83.237.175:54868] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeIrPxP68VyHNvj1e541kwAAAMM"]
[Fri Apr 17 20:44:47.592936 2026] [:error] [pid 9153:tid 9229] [client 51.83.237.175:54876] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeIrP-MHGxkTZX3c45cHnwAAAIs"]
[Fri Apr 17 20:44:49.476555 2026] [:error] [pid 34273:tid 34282] [client 51.83.237.175:54892] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeIrQWuQDW686mK3dgEDNwAAAYc"]
[Fri Apr 17 20:44:49.927610 2026] [:error] [pid 9151:tid 9166] [client 51.83.237.175:54900] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeIrQchTVuRPkua22vQ76gAAAAU"]
[Fri Apr 17 20:44:51.887022 2026] [:error] [pid 61523:tid 61552] [client 51.83.237.175:54908] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeIrQ8OaH-Pgc7WEf4PJPQAAAco"]
[Fri Apr 17 20:44:52.071047 2026] [:error] [pid 61523:tid 61551] [client 51.83.237.175:54920] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeIrRMOaH-Pgc7WEf4PJPgAAAck"]
[Fri Apr 17 20:44:54.767628 2026] [:error] [pid 9263:tid 9281] [client 51.83.237.175:54934] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeIrRhP68VyHNvj1e541qAAAANA"]
[Fri Apr 17 20:44:54.781819 2026] [:error] [pid 9263:tid 9272] [client 51.83.237.175:54940] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeIrRhP68VyHNvj1e541qQAAAMc"]
[Fri Apr 17 20:44:54.883694 2026] [:error] [pid 9152:tid 9206] [client 51.83.237.175:46028] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrRpJYca8I3TNCwIdbGgAAAFA"]
[Fri Apr 17 20:44:56.831006 2026] [:error] [pid 9153:tid 9229] [client 51.83.237.175:41476] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeIrSOMHGxkTZX3c45cHqgAAAIs"]
[Fri Apr 17 20:44:56.841704 2026] [:error] [pid 9151:tid 9183] [client 51.83.237.175:41488] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeIrSMhTVuRPkua22vQ77QAAABY"]
[Fri Apr 17 20:44:58.802211 2026] [:error] [pid 9152:tid 9195] [client 51.83.237.175:41500] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeIrSpJYca8I3TNCwIdbGwAAAEU"]
[Fri Apr 17 20:44:59.399914 2026] [:error] [pid 9263:tid 9276] [client 51.83.237.175:41514] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeIrSxP68VyHNvj1e541sgAAAMs"]
[Fri Apr 17 20:44:59.431977 2026] [:error] [pid 9152:tid 9203] [client 51.83.237.175:56896] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrS5JYca8I3TNCwIdbHgAAAE0"]
[Fri Apr 17 20:44:59.894668 2026] [:error] [pid 9263:tid 9283] [client 51.83.237.175:41518] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrSxP68VyHNvj1e541tQAAANI"]
[Fri Apr 17 20:45:01.332818 2026] [:error] [pid 51878:tid 51903] [client 51.83.237.175:41532] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeIrTUnQhUtMbw9EsgaLsAAAARc"]
[Fri Apr 17 20:45:03.266722 2026] [:error] [pid 9153:tid 9222] [client 51.83.237.175:41548] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeIrT-MHGxkTZX3c45cHsAAAAIQ"]
[Fri Apr 17 20:45:03.738739 2026] [:error] [pid 61523:tid 61545] [client 51.83.237.175:41550] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrT8OaH-Pgc7WEf4PJVAAAAcM"]
[Fri Apr 17 20:45:04.408333 2026] [:error] [pid 51878:tid 51889] [client 51.83.237.175:41554] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrUEnQhUtMbw9EsgaLwAAAAQk"]
[Fri Apr 17 20:45:08.197790 2026] [:error] [pid 9151:tid 9176] [client 51.83.237.175:54750] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrVMhTVuRPkua22vQ79AAAAA8"]
[Fri Apr 17 20:45:17.252930 2026] [:error] [pid 61523:tid 61565] [client 51.83.237.175:49794] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrXcOaH-Pgc7WEf4PJYwAAAdc"]
[Fri Apr 17 20:45:21.619815 2026] [:error] [pid 61523:tid 61559] [client 51.83.237.175:49800] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrYcOaH-Pgc7WEf4PJaQAAAdE"]
[Fri Apr 17 20:45:28.150358 2026] [:error] [pid 25010:tid 25023] [client 51.83.237.175:42684] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIraI-7kkf42RarqQ10nQAAAUo"]
[Fri Apr 17 20:45:32.943065 2026] [:error] [pid 25010:tid 25030] [client 51.83.237.175:42690] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrbI-7kkf42RarqQ10pwAAAVE"]
[Fri Apr 17 20:46:19.610611 2026] [:error] [pid 9263:tid 9278] [client 51.83.237.175:39884] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeIrmxP68VyHNvj1e542MwAAAM0"]
[Fri Apr 17 20:46:21.585924 2026] [:error] [pid 9152:tid 9197] [client 51.83.237.175:39724] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeIrnZJYca8I3TNCwIdbdAAAAEc"]
[Fri Apr 17 20:46:21.672196 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:39736] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIrnZJYca8I3TNCwIdbdQAAAEA"]
[Fri Apr 17 20:46:23.531456 2026] [:error] [pid 25010:tid 25025] [client 51.83.237.175:39742] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeIrn4-7kkf42RarqQ10-wAAAUw"]
[Fri Apr 17 20:46:25.461984 2026] [:error] [pid 61523:tid 61544] [client 51.83.237.175:39754] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeIrocOaH-Pgc7WEf4PJyAAAAcI"]
[Fri Apr 17 20:46:25.483166 2026] [:error] [pid 51878:tid 51891] [client 51.83.237.175:39756] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIroUnQhUtMbw9EsgaMeAAAAQs"]
[Fri Apr 17 20:46:27.781507 2026] [:error] [pid 9152:tid 9196] [client 51.83.237.175:49160] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeIro5JYca8I3TNCwIdbfwAAAEY"]
[Fri Apr 17 20:46:29.742421 2026] [:error] [pid 9151:tid 9179] [client 51.83.237.175:49174] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeIrpchTVuRPkua22vQ8iwAAABI"]
[Fri Apr 17 20:46:32.007565 2026] [:error] [pid 9153:tid 9226] [client 51.83.237.175:49188] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeIrqOMHGxkTZX3c45cH7wAAAIg"]
[Fri Apr 17 20:46:34.086408 2026] [:error] [pid 61523:tid 61565] [client 51.83.237.175:49196] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeIrqsOaH-Pgc7WEf4PJ7AAAAdc"]
[Fri Apr 17 20:46:36.083808 2026] [:error] [pid 9151:tid 9165] [client 51.83.237.175:49210] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeIrrMhTVuRPkua22vQ8qwAAAAQ"]
[Fri Apr 17 20:46:38.912952 2026] [:error] [pid 51878:tid 51903] [client 51.83.237.175:49258] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeIrrknQhUtMbw9EsgaMkAAAARc"]
[Fri Apr 17 20:46:41.318195 2026] [:error] [pid 9151:tid 9165] [client 51.83.237.175:49262] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeIrschTVuRPkua22vQ8vgAAAAQ"]
[Fri Apr 17 20:46:44.396399 2026] [:error] [pid 9263:tid 9266] [client 51.83.237.175:49274] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeIrtBP68VyHNvj1e542igAAAME"]
[Fri Apr 17 20:46:47.985635 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:51594] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeIrt5JYca8I3TNCwIdblQAAAEA"]
[Fri Apr 17 20:46:51.083546 2026] [:error] [pid 51878:tid 51888] [client 51.83.237.175:51600] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeIru0nQhUtMbw9EsgaMtAAAAQg"]
[Fri Apr 17 20:46:54.027511 2026] [:error] [pid 61523:tid 61544] [client 51.83.237.175:51608] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeIrvsOaH-Pgc7WEf4PKTgAAAcI"]
[Fri Apr 17 20:46:58.346448 2026] [:error] [pid 9151:tid 9179] [client 51.83.237.175:46338] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeIrwshTVuRPkua22vQ8xwAAABI"]
[Fri Apr 17 20:47:01.301202 2026] [:error] [pid 9152:tid 9213] [client 51.83.237.175:46346] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeIrxZJYca8I3TNCwIdbtQAAAFc"]
[Fri Apr 17 20:47:03.413992 2026] [:error] [pid 9153:tid 9236] [client 51.83.237.175:46348] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aeIrx-MHGxkTZX3c45cIBwAAAJI"]
[Fri Apr 17 20:47:06.064961 2026] [:error] [pid 9263:tid 9277] [client 51.83.237.175:46352] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aeIryhP68VyHNvj1e5428AAAAMw"]
[Fri Apr 17 20:47:08.798706 2026] [:error] [pid 51878:tid 51894] [client 51.83.237.175:51154] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aeIrzEnQhUtMbw9EsgaM7gAAAQ4"]
[Fri Apr 17 20:47:12.846062 2026] [:error] [pid 61523:tid 61558] [client 51.83.237.175:51170] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeIr0MOaH-Pgc7WEf4PKdQAAAdA"]
[Fri Apr 17 20:47:14.977308 2026] [:error] [pid 9153:tid 9224] [client 51.83.237.175:51174] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeIr0uMHGxkTZX3c45cIEQAAAIY"]
[Fri Apr 17 20:47:47.339663 2026] [:error] [pid 9263:tid 9276] [client 51.83.237.175:40852] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeIr8xP68VyHNvj1e543NQAAAMs"]
[Fri Apr 17 20:47:51.414552 2026] [:error] [pid 9263:tid 9269] [client 51.83.237.175:37952] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeIr9xP68VyHNvj1e543SwAAAMQ"]
[Fri Apr 17 20:47:54.021024 2026] [:error] [pid 51878:tid 51885] [client 51.83.237.175:37956] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeIr-knQhUtMbw9EsgaOCQAAAQU"]
[Fri Apr 17 20:47:56.433662 2026] [:error] [pid 9152:tid 9195] [client 51.83.237.175:37964] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeIr_JJYca8I3TNCwIdcFQAAAEU"]
[Fri Apr 17 20:48:00.372892 2026] [:error] [pid 9153:tid 9219] [client 51.83.237.175:54572] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeIsAOMHGxkTZX3c45cIOwAAAIE"]
[Fri Apr 17 20:48:02.950436 2026] [:error] [pid 51878:tid 51894] [client 51.83.237.175:54588] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeIsAknQhUtMbw9EsgaOOwAAAQ4"]
[Fri Apr 17 20:48:05.590063 2026] [:error] [pid 51878:tid 51880] [client 51.83.237.175:54602] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeIsBUnQhUtMbw9EsgaORQAAAQA"]
[Fri Apr 17 20:48:08.308202 2026] [:error] [pid 9153:tid 9239] [client 51.83.237.175:49414] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeIsCOMHGxkTZX3c45cISQAAAJU"]
[Fri Apr 17 20:48:10.759522 2026] [:error] [pid 9152:tid 9198] [client 51.83.237.175:49430] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeIsCpJYca8I3TNCwIdcLQAAAEg"]
[Fri Apr 17 20:48:12.915485 2026] [:error] [pid 51878:tid 51881] [client 51.83.237.175:49440] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeIsDEnQhUtMbw9EsgaOfQAAAQE"]
[Fri Apr 17 20:48:14.888100 2026] [:error] [pid 51878:tid 51902] [client 51.83.237.175:49454] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeIsDknQhUtMbw9EsgaOjAAAARY"]
[Fri Apr 17 20:48:16.811776 2026] [:error] [pid 9152:tid 9194] [client 51.83.237.175:38830] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeIsEJJYca8I3TNCwIdcMwAAAEQ"]
[Fri Apr 17 20:48:18.950738 2026] [:error] [pid 61523:tid 61564] [client 51.83.237.175:38838] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeIsEsOaH-Pgc7WEf4PLRwAAAdY"]
[Fri Apr 17 20:48:21.258924 2026] [:error] [pid 61523:tid 61561] [client 51.83.237.175:38842] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeIsFcOaH-Pgc7WEf4PLUgAAAdM"]
[Fri Apr 17 20:48:24.522663 2026] [:error] [pid 9152:tid 9190] [client 51.83.237.175:38856] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeIsGJJYca8I3TNCwIdcPQAAAEA"]
[Fri Apr 17 20:48:27.133988 2026] [:error] [pid 9263:tid 9279] [client 51.83.237.175:58660] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeIsGxP68VyHNvj1e543mwAAAM4"]
[Fri Apr 17 20:48:30.317264 2026] [:error] [pid 34273:tid 34280] [client 51.83.237.175:58670] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeIsHmuQDW686mK3dgEEOQAAAYU"]
[Fri Apr 17 20:51:52.061531 2026] [:error] [pid 9153:tid 9230] [client 51.83.237.175:52464] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeIs6OMHGxkTZX3c45cJPAAAAIw"]
[Fri Apr 17 20:51:54.067280 2026] [:error] [pid 9151:tid 9169] [client 51.83.237.175:56132] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeIs6shTVuRPkua22vQ9xgAAAAg"]
[Fri Apr 17 20:51:56.384077 2026] [:error] [pid 61523:tid 61560] [client 51.83.237.175:52474] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeIs7MOaH-Pgc7WEf4PNIQAAAdI"]
[Fri Apr 17 20:51:58.580366 2026] [:error] [pid 9152:tid 9195] [client 51.83.237.175:37256] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeIs7pJYca8I3TNCwIddGwAAAEU"]
[Fri Apr 17 20:52:00.651794 2026] [:error] [pid 9153:tid 9225] [client 51.83.237.175:37264] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeIs8OMHGxkTZX3c45cJTgAAAIc"]
[Fri Apr 17 20:52:03.131282 2026] [:error] [pid 61523:tid 61544] [client 51.83.237.175:37272] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeIs88OaH-Pgc7WEf4PNNAAAAcI"]
[Fri Apr 17 20:52:05.735666 2026] [:error] [pid 9153:tid 9233] [client 51.83.237.175:37288] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeIs9eMHGxkTZX3c45cJWAAAAI8"]
[Fri Apr 17 20:52:08.833090 2026] [:error] [pid 9152:tid 9199] [client 51.83.237.175:35460] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeIs-JJYca8I3TNCwIddKwAAAEk"]
[Fri Apr 17 20:52:11.337460 2026] [:error] [pid 51878:tid 51890] [client 51.83.237.175:35470] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeIs-0nQhUtMbw9EsgaRnwAAAQo"]
[Fri Apr 17 20:52:13.950583 2026] [:error] [pid 9152:tid 9210] [client 51.83.237.175:35474] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeIs_ZJYca8I3TNCwIddLQAAAFQ"]
[Fri Apr 17 20:52:16.361824 2026] [:error] [pid 34273:tid 34275] [client 51.83.237.175:35484] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeItAGuQDW686mK3dgEFdgAAAYA"]
[Fri Apr 17 20:52:18.912885 2026] [:error] [pid 9152:tid 9197] [client 51.83.237.175:42786] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeItApJYca8I3TNCwIddNwAAAEc"]
[Fri Apr 17 20:52:21.921229 2026] [:error] [pid 25010:tid 25026] [client 51.83.237.175:42796] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeItBY-7kkf42RarqQ12iAAAAU0"]
[Fri Apr 17 20:52:24.280286 2026] [:error] [pid 9153:tid 9227] [client 51.83.237.175:42798] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeItCOMHGxkTZX3c45cJeAAAAIk"]
[Fri Apr 17 20:52:26.302450 2026] [:error] [pid 9152:tid 9212] [client 51.83.237.175:42808] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeItCpJYca8I3TNCwIddPAAAAFY"]
[Fri Apr 17 20:52:28.273976 2026] [:error] [pid 51878:tid 51892] [client 51.83.237.175:54646] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeItDEnQhUtMbw9EsgaRsgAAAQw"]
[Fri Apr 17 20:52:30.256595 2026] [:error] [pid 51878:tid 51898] [client 51.83.237.175:54650] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeItDknQhUtMbw9EsgaRvwAAARI"]
[Fri Apr 17 20:52:33.614841 2026] [:error] [pid 51878:tid 51903] [client 51.83.237.175:54654] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeItEUnQhUtMbw9EsgaRzgAAARc"]
[Fri Apr 17 20:52:36.055476 2026] [:error] [pid 51878:tid 51893] [client 51.83.237.175:54668] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeItFEnQhUtMbw9EsgaR2wAAAQ0"]
[Fri Apr 17 20:52:38.621563 2026] [:error] [pid 51878:tid 51882] [client 51.83.237.175:36416] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeItFknQhUtMbw9EsgaR6AAAAQI"]
[Fri Apr 17 20:52:41.758422 2026] [:error] [pid 61523:tid 61566] [client 51.83.237.175:36430] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeItGcOaH-Pgc7WEf4PNjAAAAdg"]
[Fri Apr 17 20:52:43.859003 2026] [:error] [pid 34273:tid 34299] [client 51.83.237.175:36434] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeItG2uQDW686mK3dgEFngAAAZg"]
[Fri Apr 17 20:52:46.716442 2026] [:error] [pid 51878:tid 51886] [client 51.83.237.175:36448] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeItHknQhUtMbw9EsgaSEwAAAQY"]
[Fri Apr 17 20:54:13.958501 2026] [:error] [pid 9151:tid 9175] [client 51.83.237.175:37328] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeItdchTVuRPkua22vQ-HgAAAA4"]
[Fri Apr 17 20:55:02.044999 2026] [:error] [pid 51878:tid 51887] [client 51.83.237.175:35354] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeItpknQhUtMbw9EsgaTKAAAAQc"]
[Fri Apr 17 20:55:04.671782 2026] [:error] [pid 25010:tid 25019] [client 51.83.237.175:41518] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeItqI-7kkf42RarqQ127QAAAUY"]
[Fri Apr 17 20:55:06.837936 2026] [:error] [pid 51878:tid 51887] [client 51.83.237.175:51948] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeItqknQhUtMbw9EsgaTPwAAAQc"]
[Fri Apr 17 20:55:11.140566 2026] [:error] [pid 9153:tid 9231] [client 51.83.237.175:51954] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeItr-MHGxkTZX3c45cKOAAAAI0"]
[Fri Apr 17 20:55:18.450661 2026] [:error] [pid 9263:tid 9268] [client 51.83.237.175:46392] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeItthP68VyHNvj1e546xAAAAMM"]
[Fri Apr 17 20:55:31.712327 2026] [:error] [pid 25010:tid 25030] [client 51.83.237.175:46396] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeItw4-7kkf42RarqQ13DwAAAVE"]
[Fri Apr 17 20:55:40.459631 2026] [:error] [pid 9152:tid 9207] [client 51.83.237.175:39568] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeItzJJYca8I3TNCwIdeAAAAAFE"]
[Fri Apr 17 20:55:44.880250 2026] [:error] [pid 9153:tid 9241] [client 51.83.237.175:50320] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeIt0OMHGxkTZX3c45cKXwAAAJc"]
[Fri Apr 17 20:55:48.883907 2026] [:error] [pid 61523:tid 61564] [client 51.83.237.175:34320] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeIt1MOaH-Pgc7WEf4PPDQAAAdY"]
[Fri Apr 17 20:55:53.926598 2026] [:error] [pid 9151:tid 9184] [client 51.83.237.175:53074] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeIt2chTVuRPkua22vQ-cgAAABc"]
[Fri Apr 17 20:55:56.397346 2026] [:error] [pid 51878:tid 51890] [client 51.83.237.175:34336] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeIt3EnQhUtMbw9EsgaT4gAAAQo"]
[Fri Apr 17 21:00:08.414863 2026] [:error] [pid 9263:tid 9270] [client 51.83.237.175:52162] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeIu2BP68VyHNvj1e548VAAAAMU"]
[Fri Apr 17 21:00:10.209647 2026] [:error] [pid 9153:tid 9239] [client 51.83.237.175:33112] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeIu2uMHGxkTZX3c45cLcAAAAJU"]
[Fri Apr 17 21:00:12.257549 2026] [:error] [pid 9152:tid 9210] [client 51.83.237.175:52174] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeIu3JJYca8I3TNCwIdfmgAAAFQ"]
[Fri Apr 17 21:00:15.368919 2026] [:error] [pid 61523:tid 61564] [client 51.83.237.175:52190] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeIu38OaH-Pgc7WEf4PRUQAAAdY"]
[Fri Apr 17 21:00:19.072968 2026] [:error] [pid 9263:tid 9287] [client 51.83.237.175:53824] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeIu4xP68VyHNvj1e548YgAAANY"]
[Fri Apr 17 21:00:21.096928 2026] [:error] [pid 51878:tid 51904] [client 51.83.237.175:49510] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeIu5UnQhUtMbw9EsgaWhwAAARg"]
[Fri Apr 17 21:00:23.357173 2026] [:error] [pid 9263:tid 9274] [client 51.83.237.175:49512] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeIu5xP68VyHNvj1e548ZwAAAMk"]
[Fri Apr 17 21:00:26.545116 2026] [:error] [pid 34273:tid 34288] [client 51.83.237.175:49520] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeIu6muQDW686mK3dgEH9gAAAY0"]
[Fri Apr 17 21:00:28.506785 2026] [:error] [pid 51878:tid 51888] [client 51.83.237.175:55202] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIu7EnQhUtMbw9EsgaWnQAAAQg"]
[Fri Apr 17 21:00:32.410708 2026] [:error] [pid 61523:tid 61566] [client 51.83.237.175:55204] [client 51.83.237.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeIu8MOaH-Pgc7WEf4PRigAAAdg"]
[Fri Apr 17 22:37:24.567481 2026] [:error] [pid 25010:tid 25034] [client 54.37.252.152:54554] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeJFpI-7kkf42RarqQ2JbgAAAVU"]
[Fri Apr 17 22:37:28.693935 2026] [:error] [pid 61523:tid 61566] [client 54.37.252.152:47454] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeJFqMOaH-Pgc7WEf4PypgAAAdg"]
[Fri Apr 17 22:37:30.589404 2026] [:error] [pid 25010:tid 25015] [client 54.37.252.152:37754] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeJFqo-7kkf42RarqQ2JdwAAAUI"]
[Fri Apr 17 22:37:33.056794 2026] [:error] [pid 9263:tid 9265] [client 54.37.252.152:42454] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeJFrRP68VyHNvj1e552uwAAAMA"]
[Fri Apr 17 22:37:35.468474 2026] [:error] [pid 34273:tid 34290] [client 54.37.252.152:42460] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeJFr2uQDW686mK3dgEf_QAAAY8"]
[Fri Apr 17 22:37:37.378136 2026] [:error] [pid 61523:tid 61544] [client 54.37.252.152:60136] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeJFscOaH-Pgc7WEf4PyugAAAcI"]
[Fri Apr 17 22:37:39.867623 2026] [:error] [pid 9263:tid 9279] [client 54.37.252.152:42474] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeJFsxP68VyHNvj1e5520AAAAM4"]
[Fri Apr 17 22:37:41.756058 2026] [:error] [pid 9152:tid 9214] [client 54.37.252.152:57666] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeJFtZJYca8I3TNCwId9BwAAAFg"]
[Fri Apr 17 22:37:44.320143 2026] [:error] [pid 25010:tid 25020] [client 54.37.252.152:47214] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeJFuI-7kkf42RarqQ2JiQAAAUc"]
[Fri Apr 17 22:37:46.766678 2026] [:error] [pid 61523:tid 61558] [client 54.37.252.152:47228] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeJFusOaH-Pgc7WEf4Py4QAAAdA"]
[Fri Apr 17 22:37:48.753167 2026] [:error] [pid 9263:tid 9265] [client 54.37.252.152:57682] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeJFvBP68VyHNvj1e553CgAAAMA"]
[Fri Apr 17 22:37:51.211682 2026] [:error] [pid 51878:tid 51883] [client 54.37.252.152:47242] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeJFv0nQhUtMbw9EsgbG7QAAAQM"]
[Fri Apr 17 22:37:53.257974 2026] [:error] [pid 9263:tid 9279] [client 54.37.252.152:44994] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeJFwRP68VyHNvj1e553GwAAAM4"]
[Fri Apr 17 22:37:55.837961 2026] [:error] [pid 9152:tid 9206] [client 54.37.252.152:42840] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeJFw5JYca8I3TNCwId9HgAAAFA"]
[Fri Apr 17 22:37:57.959407 2026] [:error] [pid 9263:tid 9279] [client 54.37.252.152:45008] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeJFxRP68VyHNvj1e553PAAAAM4"]
[Fri Apr 17 22:38:00.522525 2026] [:error] [pid 51878:tid 51880] [client 54.37.252.152:42852] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeJFyEnQhUtMbw9EsgbHDgAAAQA"]
[Fri Apr 17 22:38:02.468768 2026] [:error] [pid 9151:tid 9185] [client 54.37.252.152:44040] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeJFyshTVuRPkua22vROqwAAABg"]
[Fri Apr 17 22:38:05.076955 2026] [:error] [pid 61523:tid 61551] [client 54.37.252.152:59938] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeJFzcOaH-Pgc7WEf4Py-QAAAck"]
[Fri Apr 17 22:38:07.440887 2026] [:error] [pid 51878:tid 51885] [client 54.37.252.152:59940] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeJFz0nQhUtMbw9EsgbHIAAAAQU"]
[Fri Apr 17 22:38:09.465342 2026] [:error] [pid 9263:tid 9281] [client 54.37.252.152:44056] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeJF0RP68VyHNvj1e553VwAAANA"]
[Fri Apr 17 22:38:12.037477 2026] [:error] [pid 9263:tid 9279] [client 54.37.252.152:45582] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeJF1BP68VyHNvj1e553XQAAAM4"]
[Fri Apr 17 22:38:14.120146 2026] [:error] [pid 34273:tid 34285] [client 54.37.252.152:38626] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeJF1muQDW686mK3dgEgLgAAAYo"]
[Fri Apr 17 22:38:16.056497 2026] [:error] [pid 9151:tid 9177] [client 54.37.252.152:38638] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeJF2MhTVuRPkua22vROuwAAABA"]
[Fri Apr 17 22:38:18.291905 2026] [:error] [pid 25010:tid 25027] [client 54.37.252.152:45598] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeJF2o-7kkf42RarqQ2JlwAAAU4"]
[Fri Apr 17 22:38:20.235574 2026] [:error] [pid 9152:tid 9202] [client 54.37.252.152:38652] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aeJF3JJYca8I3TNCwId9PAAAAEw"]
[Fri Apr 17 22:38:43.909373 2026] [:error] [pid 9263:tid 9270] [client 54.37.252.152:59476] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeJF8xP68VyHNvj1e5534AAAAMU"]
[Fri Apr 17 22:38:45.654543 2026] [:error] [pid 61523:tid 61543] [client 54.37.252.152:55234] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeJF9cOaH-Pgc7WEf4PzRwAAAcE"]
[Fri Apr 17 22:38:47.982405 2026] [:error] [pid 51878:tid 51891] [client 54.37.252.152:46386] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeJF90nQhUtMbw9EsgbHlgAAAQs"]
[Fri Apr 17 22:38:50.410112 2026] [:error] [pid 34273:tid 34280] [client 54.37.252.152:46394] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeJF-muQDW686mK3dgEgQwAAAYU"]
[Fri Apr 17 22:38:52.426582 2026] [:error] [pid 9263:tid 9267] [client 54.37.252.152:54822] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeJF_BP68VyHNvj1e5536AAAAMI"]
[Fri Apr 17 22:38:55.119173 2026] [:error] [pid 9153:tid 9222] [client 54.37.252.152:48416] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeJF_-MHGxkTZX3c45ceLgAAAIQ"]
[Fri Apr 17 22:38:57.041353 2026] [:error] [pid 25010:tid 25031] [client 54.37.252.152:54826] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeJGAY-7kkf42RarqQ2JtAAAAVI"]
[Fri Apr 17 22:38:59.466853 2026] [:error] [pid 9263:tid 9288] [client 54.37.252.152:48432] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeJGAxP68VyHNvj1e554BAAAANc"]
[Fri Apr 17 22:39:01.464879 2026] [:error] [pid 34273:tid 34279] [client 54.37.252.152:34148] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeJGBWuQDW686mK3dgEgZgAAAYQ"]
[Fri Apr 17 22:39:03.936838 2026] [:error] [pid 61523:tid 61564] [client 54.37.252.152:34342] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeJGB8OaH-Pgc7WEf4PzdAAAAdY"]
[Fri Apr 17 22:39:06.332638 2026] [:error] [pid 9263:tid 9282] [client 54.37.252.152:34348] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeJGChP68VyHNvj1e554DgAAANE"]
[Fri Apr 17 22:39:08.693016 2026] [:error] [pid 34273:tid 34292] [client 54.37.252.152:34364] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeJGDGuQDW686mK3dgEgdAAAAZE"]
[Fri Apr 17 22:39:10.722129 2026] [:error] [pid 61523:tid 61548] [client 54.37.252.152:34164] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeJGDsOaH-Pgc7WEf4PzigAAAcY"]
[Fri Apr 17 22:39:12.603013 2026] [:error] [pid 51878:tid 51894] [client 54.37.252.152:50108] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeJGEEnQhUtMbw9EsgbHqwAAAQ4"]
[Fri Apr 17 22:39:14.630957 2026] [:error] [pid 34273:tid 34275] [client 54.37.252.152:50112] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeJGEmuQDW686mK3dgEgdgAAAYA"]
[Fri Apr 17 22:39:16.672729 2026] [:error] [pid 9263:tid 9277] [client 54.37.252.152:50116] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeJGFBP68VyHNvj1e554GAAAAMw"]
[Fri Apr 17 22:39:18.599606 2026] [:error] [pid 51878:tid 51899] [client 54.37.252.152:50128] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeJGFknQhUtMbw9EsgbHtgAAARM"]
[Fri Apr 17 22:39:20.654546 2026] [:error] [pid 9263:tid 9280] [client 54.37.252.152:50142] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeJGGBP68VyHNvj1e554IgAAAM8"]
[Fri Apr 17 22:39:23.031938 2026] [:error] [pid 61523:tid 61559] [client 54.37.252.152:35944] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeJGG8OaH-Pgc7WEf4PzoAAAAdE"]
[Fri Apr 17 22:39:25.095064 2026] [:error] [pid 9263:tid 9287] [client 54.37.252.152:58558] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeJGHRP68VyHNvj1e554OgAAANY"]
[Fri Apr 17 22:39:26.975849 2026] [:error] [pid 9263:tid 9289] [client 54.37.252.152:58560] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeJGHhP68VyHNvj1e554TAAAANg"]
[Fri Apr 17 22:39:29.520784 2026] [:error] [pid 9152:tid 9205] [client 54.37.252.152:35946] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeJGIZJYca8I3TNCwId9cQAAAE8"]
[Fri Apr 17 22:39:31.511319 2026] [:error] [pid 9263:tid 9274] [client 54.37.252.152:43932] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeJGIxP68VyHNvj1e554XwAAAMk"]
[Fri Apr 17 22:39:33.521319 2026] [:error] [pid 9263:tid 9280] [client 54.37.252.152:43948] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeJGJRP68VyHNvj1e554bQAAAM8"]
[Fri Apr 17 22:39:35.323015 2026] [:error] [pid 61523:tid 61548] [client 54.37.252.152:43954] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeJGJ8OaH-Pgc7WEf4PzqAAAAcY"]
[Fri Apr 17 22:39:37.369843 2026] [:error] [pid 51878:tid 51882] [client 54.37.252.152:43956] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeJGKUnQhUtMbw9EsgbH0wAAAQI"]
[Fri Apr 17 22:39:39.743767 2026] [:error] [pid 25010:tid 25035] [client 54.37.252.152:44216] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeJGK4-7kkf42RarqQ2JzQAAAVY"]
[Fri Apr 17 22:40:02.062313 2026] [:error] [pid 51878:tid 51904] [client 54.37.252.152:39478] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeJGQknQhUtMbw9EsgbIEQAAARg"]
[Fri Apr 17 22:40:04.008905 2026] [:error] [pid 9263:tid 9270] [client 54.37.252.152:42538] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeJGRBP68VyHNvj1e554mwAAAMU"]
[Fri Apr 17 22:40:06.396618 2026] [:error] [pid 9263:tid 9285] [client 54.37.252.152:57668] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeJGRhP68VyHNvj1e554qwAAANQ"]
[Fri Apr 17 22:40:08.709426 2026] [:error] [pid 51878:tid 51900] [client 54.37.252.152:57674] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeJGSEnQhUtMbw9EsgbIHAAAARQ"]
[Fri Apr 17 22:40:11.196766 2026] [:error] [pid 9263:tid 9288] [client 54.37.252.152:57688] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeJGSxP68VyHNvj1e554vwAAANc"]
[Fri Apr 17 22:40:13.698494 2026] [:error] [pid 9263:tid 9282] [client 54.37.252.152:56164] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeJGTRP68VyHNvj1e554zwAAANE"]
[Fri Apr 17 22:40:16.205886 2026] [:error] [pid 34273:tid 34281] [client 54.37.252.152:56166] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeJGUGuQDW686mK3dgEhCwAAAYY"]
[Fri Apr 17 22:40:18.034152 2026] [:error] [pid 9263:tid 9280] [client 54.37.252.152:48160] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeJGUhP68VyHNvj1e5545gAAAM8"]
[Fri Apr 17 22:40:20.552523 2026] [:error] [pid 34273:tid 34288] [client 54.37.252.152:56180] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeJGVGuQDW686mK3dgEhEwAAAY0"]
[Fri Apr 17 22:40:23.021624 2026] [:error] [pid 25010:tid 25034] [client 54.37.252.152:44814] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeJGV4-7kkf42RarqQ2J2gAAAVU"]
[Fri Apr 17 22:40:25.340704 2026] [:error] [pid 34273:tid 34286] [client 54.37.252.152:44830] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeJGWWuQDW686mK3dgEhFgAAAYs"]
[Fri Apr 17 22:40:27.683901 2026] [:error] [pid 51878:tid 51898] [client 54.37.252.152:44840] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeJGW0nQhUtMbw9EsgbIRgAAARI"]
[Fri Apr 17 22:40:30.204842 2026] [:error] [pid 9152:tid 9203] [client 54.37.252.152:44846] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeJGXpJYca8I3TNCwId9nQAAAE0"]
[Fri Apr 17 22:40:32.675352 2026] [:error] [pid 9263:tid 9284] [client 54.37.252.152:46060] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeJGYBP68VyHNvj1e555KgAAANM"]
[Fri Apr 17 22:40:34.506508 2026] [:error] [pid 61523:tid 61549] [client 54.37.252.152:54130] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeJGYsOaH-Pgc7WEf4Pz6gAAAcc"]
[Fri Apr 17 22:40:38.388993 2026] [:error] [pid 9153:tid 9221] [client 54.37.252.152:54134] [client 54.37.252.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeJGZuMHGxkTZX3c45cekwAAAIM"]
[Sat Apr 18 00:29:10.515832 2026] [:error] [pid 59136:tid 59158] [client 54.37.86.225:56840] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeJf1iaoiUyiIR3EhLWmCgAAANM"]
[Sat Apr 18 00:29:13.689741 2026] [:error] [pid 59042:tid 59060] [client 54.37.86.225:55240] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeJf2Z6p5oql0UklEBIuPAAAAA0"]
[Sat Apr 18 00:29:16.425099 2026] [:error] [pid 59042:tid 59070] [client 54.37.86.225:55252] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeJf3J6p5oql0UklEBIuQwAAABc"]
[Sat Apr 18 00:29:19.289706 2026] [:error] [pid 59136:tid 59160] [client 54.37.86.225:55258] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeJf3yaoiUyiIR3EhLWmJAAAANU"]
[Sat Apr 18 00:29:22.382373 2026] [:error] [pid 59042:tid 59066] [client 54.37.86.225:55274] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeJf4p6p5oql0UklEBIuXQAAABM"]
[Sat Apr 18 00:29:25.534110 2026] [:error] [pid 59044:tid 59101] [client 54.37.86.225:50654] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeJf5QFamkFyEtD_SMGtpwAAAIA"]
[Sat Apr 18 00:29:28.922844 2026] [:error] [pid 59043:tid 59079] [client 54.37.86.225:50660] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeJf6IRtUGE9SfUh2wwFMQAAAEU"]
[Sat Apr 18 00:29:32.078184 2026] [:error] [pid 59042:tid 59058] [client 54.37.86.225:50674] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeJf7J6p5oql0UklEBIuiQAAAAs"]
[Sat Apr 18 00:29:35.155515 2026] [:error] [pid 59042:tid 59060] [client 54.37.86.225:34724] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeJf756p5oql0UklEBIukgAAAA0"]
[Sat Apr 18 00:29:38.051493 2026] [:error] [pid 59136:tid 59146] [client 54.37.86.225:34732] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeJf8iaoiUyiIR3EhLWmVwAAAMc"]
[Sat Apr 18 00:29:40.890942 2026] [:error] [pid 59042:tid 59049] [client 54.37.86.225:34734] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeJf9J6p5oql0UklEBIuuQAAAAI"]
[Sat Apr 18 00:29:43.896803 2026] [:error] [pid 59136:tid 59149] [client 54.37.86.225:39016] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeJf9yaoiUyiIR3EhLWmaAAAAMo"]
[Sat Apr 18 00:29:47.131701 2026] [:error] [pid 59042:tid 59059] [client 54.37.86.225:39030] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeJf-56p5oql0UklEBIvCAAAAAw"]
[Sat Apr 18 00:29:50.199913 2026] [:error] [pid 59043:tid 59089] [client 54.37.86.225:39044] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeJf_oRtUGE9SfUh2wwFfgAAAE8"]
[Sat Apr 18 00:29:53.147222 2026] [:error] [pid 59044:tid 59121] [client 54.37.86.225:60360] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeJgAQFamkFyEtD_SMGt-QAAAJQ"]
[Sat Apr 18 00:29:56.458849 2026] [:error] [pid 59136:tid 59143] [client 54.37.86.225:60362] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeJgBCaoiUyiIR3EhLWmgQAAAMQ"]
[Sat Apr 18 00:29:59.334252 2026] [:error] [pid 59136:tid 59158] [client 54.37.86.225:60368] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeJgByaoiUyiIR3EhLWmiAAAANM"]
[Sat Apr 18 00:30:02.157472 2026] [:error] [pid 59044:tid 59103] [client 54.37.86.225:60384] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeJgCgFamkFyEtD_SMGuEAAAAII"]
[Sat Apr 18 00:30:05.231479 2026] [:error] [pid 59136:tid 59143] [client 54.37.86.225:42844] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeJgDSaoiUyiIR3EhLWmnQAAAMQ"]
[Sat Apr 18 00:30:29.975910 2026] [:error] [pid 59042:tid 59064] [client 54.37.86.225:42860] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeJgJZ6p5oql0UklEBIwAQAAABE"]
[Sat Apr 18 00:30:32.597677 2026] [:error] [pid 59044:tid 59110] [client 54.37.86.225:35736] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeJgKAFamkFyEtD_SMGuSgAAAIk"]
[Sat Apr 18 00:30:35.590603 2026] [:error] [pid 59042:tid 59051] [client 54.37.86.225:36358] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeJgK56p5oql0UklEBIwEgAAAAQ"]
[Sat Apr 18 00:30:38.249791 2026] [:error] [pid 59043:tid 59078] [client 54.37.86.225:36360] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeJgLoRtUGE9SfUh2wwFywAAAEQ"]
[Sat Apr 18 00:30:41.019377 2026] [:error] [pid 59042:tid 59071] [client 54.37.86.225:36362] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeJgMZ6p5oql0UklEBIwJAAAABg"]
[Sat Apr 18 00:30:43.644385 2026] [:error] [pid 59042:tid 59053] [client 54.37.86.225:56066] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeJgM56p5oql0UklEBIwLQAAAAY"]
[Sat Apr 18 00:30:46.278797 2026] [:error] [pid 59042:tid 59048] [client 54.37.86.225:56070] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeJgNp6p5oql0UklEBIwNQAAAAE"]
[Sat Apr 18 00:30:48.771917 2026] [:error] [pid 59043:tid 59088] [client 54.37.86.225:56078] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeJgOIRtUGE9SfUh2wwF5AAAAE4"]
[Sat Apr 18 03:13:20.373892 2026] [:error] [pid 63702:tid 63739] [client 35.212.229.187:36342] [client 35.212.229.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "aeKGUMTL05PWYsKqTEZAQAAAAUE"]
[Sat Apr 18 12:58:05.930550 2026] [:error] [pid 34237:tid 34251] [client 175.6.217.4:56398] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeMPXRBmX4Wq5a6rxfYsDQAAAUw"]
[Sat Apr 18 14:53:12.714354 2026] [:error] [pid 34290:tid 34340] [client 54.37.252.231:55234] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeMqWBqX6WpmmAXOBi_FRgAAAdU"]
[Sat Apr 18 14:53:14.353290 2026] [:error] [pid 34288:tid 34305] [client 54.37.252.231:50902] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeMqWuTIiy__PtiLmpmqPgAAAY0"]
[Sat Apr 18 14:53:16.209150 2026] [:error] [pid 34288:tid 34304] [client 54.37.252.231:55238] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeMqXOTIiy__PtiLmpmqRwAAAYw"]
[Sat Apr 18 14:53:18.201113 2026] [:error] [pid 34288:tid 34306] [client 54.37.252.231:55252] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeMqXuTIiy__PtiLmpmqTwAAAY4"]
[Sat Apr 18 14:53:20.131376 2026] [:error] [pid 34288:tid 34296] [client 54.37.252.231:55262] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeMqYOTIiy__PtiLmpmqVgAAAYQ"]
[Sat Apr 18 14:53:21.901011 2026] [:error] [pid 34237:tid 34240] [client 54.37.252.231:55276] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeMqYRBmX4Wq5a6rxfY6UAAAAUE"]
[Sat Apr 18 14:53:23.743115 2026] [:error] [pid 9865:tid 9957] [client 54.37.252.231:36692] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeMqY6zb5knECIY-C-g-TwAAAJQ"]
[Sat Apr 18 14:53:25.781433 2026] [:error] [pid 9865:tid 9958] [client 54.37.252.231:36708] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeMqZazb5knECIY-C-g-VAAAAJU"]
[Sat Apr 18 14:53:27.659857 2026] [:error] [pid 34237:tid 34249] [client 54.37.252.231:36722] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeMqZxBmX4Wq5a6rxfY6XwAAAUo"]
[Sat Apr 18 14:53:29.668813 2026] [:error] [pid 9864:tid 9910] [client 54.37.252.231:36724] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeMqaYCFeowknfXHM7m5TwAAAEU"]
[Sat Apr 18 14:53:31.654715 2026] [:error] [pid 34237:tid 34261] [client 54.37.252.231:36738] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeMqaxBmX4Wq5a6rxfY6YgAAAVY"]
[Sat Apr 18 14:53:33.669975 2026] [:error] [pid 34237:tid 34259] [client 54.37.252.231:44892] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeMqbRBmX4Wq5a6rxfY6aAAAAVQ"]
[Sat Apr 18 14:53:35.636248 2026] [:error] [pid 34288:tid 34316] [client 54.37.252.231:44904] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeMqb-TIiy__PtiLmpmqWQAAAZg"]
[Sat Apr 18 14:53:37.639102 2026] [:error] [pid 9865:tid 9942] [client 54.37.252.231:44916] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeMqcazb5knECIY-C-g-YAAAAIU"]
[Sat Apr 18 14:53:39.623383 2026] [:error] [pid 34288:tid 34313] [client 54.37.252.231:44926] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeMqc-TIiy__PtiLmpmqWgAAAZU"]
[Sat Apr 18 14:53:41.612877 2026] [:error] [pid 34290:tid 34342] [client 54.37.252.231:44932] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeMqdRqX6WpmmAXOBi_FVQAAAdc"]
[Sat Apr 18 14:53:43.615573 2026] [:error] [pid 34288:tid 34315] [client 54.37.252.231:44636] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeMqd-TIiy__PtiLmpmqZQAAAZc"]
[Sat Apr 18 14:53:45.604745 2026] [:error] [pid 9863:tid 9887] [client 54.37.252.231:44640] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeMqeTjjiypiFrTucbKh0QAAAA4"]
[Sat Apr 18 14:53:47.439864 2026] [:error] [pid 9863:tid 9895] [client 54.37.252.231:44650] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeMqezjjiypiFrTucbKh1AAAABY"]
[Sat Apr 18 14:53:49.435893 2026] [:error] [pid 9864:tid 9909] [client 54.37.252.231:44656] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeMqfYCFeowknfXHM7m5XAAAAEQ"]
[Sat Apr 18 14:53:51.441396 2026] [:error] [pid 34288:tid 34302] [client 54.37.252.231:44666] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeMqf-TIiy__PtiLmpmqcAAAAYo"]
[Sat Apr 18 14:53:53.428647 2026] [:error] [pid 9865:tid 9945] [client 54.37.252.231:34192] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeMqgazb5knECIY-C-g-bQAAAIg"]
[Sat Apr 18 14:53:55.423895 2026] [:error] [pid 9864:tid 9930] [client 54.37.252.231:34198] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeMqg4CFeowknfXHM7m5ZAAAAFg"]
[Sat Apr 18 14:53:57.751989 2026] [:error] [pid 9863:tid 9885] [client 54.37.252.231:37372] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeMqhTjjiypiFrTucbKh1wAAAAw"]
[Sat Apr 18 14:53:59.712615 2026] [:error] [pid 34237:tid 34239] [client 54.37.252.231:34202] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeMqhxBmX4Wq5a6rxfY6dwAAAUA"]
[Sat Apr 18 14:54:01.701230 2026] [:error] [pid 13023:tid 13044] [client 54.37.252.231:34204] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeMqif1e7hG8DAeABB_DnQAAARM"]
[Sat Apr 18 14:54:03.716463 2026] [:error] [pid 13023:tid 13043] [client 54.37.252.231:34078] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeMqi_1e7hG8DAeABB_DngAAARI"]
[Sat Apr 18 14:54:05.710592 2026] [:error] [pid 9970:tid 9997] [client 54.37.252.231:34084] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeMqjSYdRLRhVmaIMx1rygAAANc"]
[Sat Apr 18 14:54:07.698456 2026] [:error] [pid 34290:tid 34331] [client 54.37.252.231:34090] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeMqjxqX6WpmmAXOBi_FZwAAAcw"]
[Sat Apr 18 14:54:09.681925 2026] [:error] [pid 34288:tid 34316] [client 54.37.252.231:34096] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeMqkeTIiy__PtiLmpmqiQAAAZg"]
[Sat Apr 18 14:54:31.735881 2026] [:error] [pid 9970:tid 9978] [client 54.37.252.231:34100] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeMqpyYdRLRhVmaIMx1r3wAAAMQ"]
[Sat Apr 18 14:54:34.005870 2026] [:error] [pid 34237:tid 34254] [client 54.37.252.231:48318] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeMqqhBmX4Wq5a6rxfY6gQAAAU8"]
[Sat Apr 18 14:54:35.998669 2026] [:error] [pid 34290:tid 34336] [client 54.37.252.231:37240] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeMqqxqX6WpmmAXOBi_FqgAAAdE"]
[Sat Apr 18 14:54:37.998302 2026] [:error] [pid 9863:tid 9890] [client 54.37.252.231:37252] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeMqrTjjiypiFrTucbKh5AAAABE"]
[Sat Apr 18 14:54:39.988563 2026] [:error] [pid 9863:tid 9878] [client 54.37.252.231:37264] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeMqrzjjiypiFrTucbKh5QAAAAU"]
[Sat Apr 18 14:54:42.491689 2026] [:error] [pid 9864:tid 9916] [client 54.37.252.231:48328] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeMqsoCFeowknfXHM7m5cQAAAEo"]
[Sat Apr 18 14:54:44.448904 2026] [:error] [pid 34288:tid 34300] [client 54.37.252.231:59294] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeMqtOTIiy__PtiLmpmqrQAAAYg"]
[Sat Apr 18 14:54:46.440964 2026] [:error] [pid 34288:tid 34308] [client 54.37.252.231:59298] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeMqtuTIiy__PtiLmpmqrgAAAZA"]
[Sat Apr 18 14:54:48.450352 2026] [:error] [pid 34237:tid 34256] [client 54.37.252.231:59308] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeMquBBmX4Wq5a6rxfY6hQAAAVE"]
[Sat Apr 18 14:54:50.439415 2026] [:error] [pid 34288:tid 34316] [client 54.37.252.231:59316] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeMquuTIiy__PtiLmpmqsQAAAZg"]
[Sat Apr 18 14:54:52.445799 2026] [:error] [pid 34237:tid 34247] [client 54.37.252.231:50230] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeMqvBBmX4Wq5a6rxfY6iAAAAUg"]
[Sat Apr 18 14:54:54.922673 2026] [:error] [pid 34288:tid 34304] [client 54.37.252.231:43570] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeMqvuTIiy__PtiLmpmquAAAAYw"]
[Sat Apr 18 14:54:56.749994 2026] [:error] [pid 34288:tid 34310] [client 54.37.252.231:50246] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeMqwOTIiy__PtiLmpmquwAAAZI"]
[Sat Apr 18 14:54:58.742953 2026] [:error] [pid 34288:tid 34304] [client 54.37.252.231:50256] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeMqwuTIiy__PtiLmpmqwwAAAYw"]
[Sat Apr 18 14:55:01.210366 2026] [:error] [pid 9865:tid 9956] [client 54.37.252.231:43572] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeMqxazb5knECIY-C-g-oQAAAJM"]
[Sat Apr 18 14:55:03.186195 2026] [:error] [pid 13023:tid 13049] [client 54.37.252.231:54064] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeMqx_1e7hG8DAeABB_DtQAAARg"]
[Sat Apr 18 14:55:05.186618 2026] [:error] [pid 34237:tid 34259] [client 54.37.252.231:54068] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeMqyRBmX4Wq5a6rxfY6igAAAVQ"]
[Sat Apr 18 14:55:07.181706 2026] [:error] [pid 9970:tid 9979] [client 54.37.252.231:54074] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeMqyyYdRLRhVmaIMx1r8AAAAMU"]
[Sat Apr 18 14:55:09.161676 2026] [:error] [pid 34288:tid 34315] [client 54.37.252.231:54080] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeMqzeTIiy__PtiLmpmqzwAAAZc"]
[Sat Apr 18 14:55:11.663284 2026] [:error] [pid 34288:tid 34303] [client 54.37.252.231:47848] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeMqz-TIiy__PtiLmpmq1QAAAYs"]
[Sat Apr 18 14:55:13.622529 2026] [:error] [pid 9865:tid 9958] [client 54.37.252.231:33276] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeMq0azb5knECIY-C-g-rAAAAJU"]
[Sat Apr 18 14:55:16.106060 2026] [:error] [pid 9865:tid 9938] [client 54.37.252.231:36316] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeMq1Kzb5knECIY-C-g-ugAAAIE"]
[Sat Apr 18 14:55:18.095019 2026] [:error] [pid 9864:tid 9905] [client 54.37.252.231:33290] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeMq1oCFeowknfXHM7m5hAAAAEA"]
[Sat Apr 18 14:55:20.569278 2026] [:error] [pid 9865:tid 9938] [client 54.37.252.231:36328] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeMq2Kzb5knECIY-C-g-zAAAAIE"]
[Sat Apr 18 14:55:22.435787 2026] [:error] [pid 9865:tid 9957] [client 54.37.252.231:36822] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeMq2qzb5knECIY-C-g-1QAAAJQ"]
[Sat Apr 18 14:55:24.942195 2026] [:error] [pid 9865:tid 9957] [client 54.37.252.231:56690] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeMq3Kzb5knECIY-C-g-4QAAAJQ"]
[Sat Apr 18 14:55:26.900078 2026] [:error] [pid 9970:tid 9985] [client 54.37.252.231:36828] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeMq3iYdRLRhVmaIMx1r8wAAAMs"]
[Sat Apr 18 14:55:28.901157 2026] [:error] [pid 9864:tid 9906] [client 54.37.252.231:36836] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeMq4ICFeowknfXHM7m5hgAAAEE"]
[Sat Apr 18 14:55:50.822547 2026] [:error] [pid 34288:tid 34304] [client 54.37.252.231:34900] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeMq9uTIiy__PtiLmpmrHgAAAYw"]
[Sat Apr 18 14:55:52.530470 2026] [:error] [pid 13023:tid 13033] [client 54.37.252.231:36840] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeMq-P1e7hG8DAeABB_DzwAAAQg"]
[Sat Apr 18 14:55:54.453899 2026] [:error] [pid 34290:tid 34342] [client 54.37.252.231:55984] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeMq-hqX6WpmmAXOBi_GEwAAAdc"]
[Sat Apr 18 14:55:56.948221 2026] [:error] [pid 9865:tid 9954] [client 54.37.252.231:49748] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeMq_Kzb5knECIY-C-g_OQAAAJE"]
[Sat Apr 18 14:55:58.910729 2026] [:error] [pid 9864:tid 9918] [client 54.37.252.231:55996] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeMq_oCFeowknfXHM7m5ngAAAEw"]
[Sat Apr 18 15:40:00.097344 2026] [:error] [pid 9864:tid 9929] [client 43.157.98.187:34920] [client 43.157.98.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeM1UICFeowknfXHM7nBlQAAAFc"]
[Sat Apr 18 16:19:35.328443 2026] [:error] [pid 9863:tid 9889] [client 54.37.86.225:40916] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeM-lzjjiypiFrTucbKrwgAAABA"]
[Sat Apr 18 16:19:37.953868 2026] [:error] [pid 34290:tid 34330] [client 54.37.86.225:45800] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeM-mRqX6WpmmAXOBi_YQAAAAcs"]
[Sat Apr 18 16:19:39.971367 2026] [:error] [pid 9865:tid 9957] [client 54.37.86.225:51906] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeM-m6zb5knECIY-C-hWQAAAAJQ"]
[Sat Apr 18 16:19:42.623608 2026] [:error] [pid 34290:tid 34325] [client 54.37.86.225:45814] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeM-nhqX6WpmmAXOBi_YSgAAAcY"]
[Sat Apr 18 16:19:44.582685 2026] [:error] [pid 9970:tid 9980] [client 54.37.86.225:42628] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeM-oCYdRLRhVmaIMx18fQAAAMY"]
[Sat Apr 18 16:19:46.941720 2026] [:error] [pid 9970:tid 9982] [client 54.37.86.225:46324] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeM-oiYdRLRhVmaIMx18gwAAAMg"]
[Sat Apr 18 16:19:49.329782 2026] [:error] [pid 34288:tid 34300] [client 54.37.86.225:46338] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeM-peTIiy__PtiLmpm2XwAAAYg"]
[Sat Apr 18 16:19:51.282352 2026] [:error] [pid 9970:tid 9995] [client 54.37.86.225:42640] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeM-pyYdRLRhVmaIMx18jQAAANU"]
[Sat Apr 18 16:19:53.624512 2026] [:error] [pid 13023:tid 13036] [client 54.37.86.225:43048] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeM-qf1e7hG8DAeABB_MjAAAAQs"]
[Sat Apr 18 16:19:55.592749 2026] [:error] [pid 9970:tid 9982] [client 54.37.86.225:48684] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeM-qyYdRLRhVmaIMx18lAAAAMg"]
[Sat Apr 18 16:19:58.200171 2026] [:error] [pid 9863:tid 9878] [client 54.37.86.225:43054] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeM-rjjjiypiFrTucbKrzgAAAAU"]
[Sat Apr 18 16:20:00.626841 2026] [:error] [pid 34290:tid 34343] [client 54.37.86.225:43060] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeM-sBqX6WpmmAXOBi_YXwAAAdg"]
[Sat Apr 18 16:20:02.534613 2026] [:error] [pid 9864:tid 9906] [client 54.37.86.225:34542] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeM-soCFeowknfXHM7nKEQAAAEE"]
[Sat Apr 18 16:20:04.962204 2026] [:error] [pid 9970:tid 9989] [client 54.37.86.225:50988] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeM-tCYdRLRhVmaIMx18oAAAAM8"]
[Sat Apr 18 16:20:06.875569 2026] [:error] [pid 34290:tid 34325] [client 54.37.86.225:34550] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeM-thqX6WpmmAXOBi_YYQAAAcY"]
[Sat Apr 18 16:20:09.312029 2026] [:error] [pid 34237:tid 34242] [client 54.37.86.225:50996] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeM-uRBmX4Wq5a6rxfZKBAAAAUM"]
[Sat Apr 18 16:20:11.151153 2026] [:error] [pid 34290:tid 34338] [client 54.37.86.225:34558] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeM-uxqX6WpmmAXOBi_YZAAAAdM"]
[Sat Apr 18 16:20:13.547955 2026] [:error] [pid 34290:tid 34341] [client 54.37.86.225:58386] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeM-vRqX6WpmmAXOBi_YaQAAAdY"]
[Sat Apr 18 16:20:15.582341 2026] [:error] [pid 34290:tid 34320] [client 54.37.86.225:33788] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeM-vxqX6WpmmAXOBi_YcgAAAcE"]
[Sat Apr 18 16:20:17.998100 2026] [:error] [pid 9864:tid 9928] [client 54.37.86.225:58398] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeM-wYCFeowknfXHM7nKJwAAAFY"]
[Sat Apr 18 16:20:20.415646 2026] [:error] [pid 9864:tid 9905] [client 54.37.86.225:58406] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeM-xICFeowknfXHM7nKLAAAAEA"]
[Sat Apr 18 16:20:22.443697 2026] [:error] [pid 9970:tid 9995] [client 54.37.86.225:49210] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeM-xiYdRLRhVmaIMx18sAAAANU"]
[Sat Apr 18 16:20:24.998710 2026] [:error] [pid 9863:tid 9886] [client 54.37.86.225:54158] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeM-yDjjiypiFrTucbKr0wAAAA0"]
[Sat Apr 18 16:20:26.884067 2026] [:error] [pid 34288:tid 34298] [client 54.37.86.225:49224] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeM-yuTIiy__PtiLmpm2aQAAAYY"]
[Sat Apr 18 16:20:28.807112 2026] [:error] [pid 34288:tid 34301] [client 54.37.86.225:49234] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeM-zOTIiy__PtiLmpm2bgAAAYk"]
[Sat Apr 18 16:20:31.341239 2026] [:error] [pid 34288:tid 34305] [client 54.37.86.225:54162] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeM-z-TIiy__PtiLmpm2dAAAAY0"]
[Sat Apr 18 16:20:54.483344 2026] [:error] [pid 9970:tid 9995] [client 54.37.86.225:51196] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeM-5iYdRLRhVmaIMx185QAAANU"]
[Sat Apr 18 16:20:56.221889 2026] [:error] [pid 9864:tid 9919] [client 54.37.86.225:35366] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeM-6ICFeowknfXHM7nKVAAAAE0"]
[Sat Apr 18 16:20:58.515183 2026] [:error] [pid 9864:tid 9914] [client 54.37.86.225:58256] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeM-6oCFeowknfXHM7nKXQAAAEg"]
[Sat Apr 18 16:21:01.073456 2026] [:error] [pid 9864:tid 9912] [client 54.37.86.225:58262] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeM-7YCFeowknfXHM7nKZQAAAEY"]
[Sat Apr 18 16:21:03.577827 2026] [:error] [pid 9865:tid 9940] [client 54.37.86.225:37590] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeM-76zb5knECIY-C-hWcAAAAIM"]
[Sat Apr 18 16:21:05.594623 2026] [:error] [pid 34288:tid 34295] [client 54.37.86.225:40116] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeM-8eTIiy__PtiLmpm2hgAAAYM"]
[Sat Apr 18 16:21:08.086427 2026] [:error] [pid 9970:tid 9976] [client 54.37.86.225:37606] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeM-9CYdRLRhVmaIMx187QAAAMI"]
[Sat Apr 18 16:21:10.107738 2026] [:error] [pid 34290:tid 34334] [client 54.37.86.225:40122] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeM-9hqX6WpmmAXOBi_YpwAAAc8"]
[Sat Apr 18 16:21:12.605767 2026] [:error] [pid 34288:tid 34306] [client 54.37.86.225:37612] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeM--OTIiy__PtiLmpm2hwAAAY4"]
[Sat Apr 18 16:21:14.612082 2026] [:error] [pid 9863:tid 9886] [client 54.37.86.225:52600] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeM--jjjiypiFrTucbKr_gAAAA0"]
[Sat Apr 18 16:21:17.098787 2026] [:error] [pid 34290:tid 34330] [client 54.37.86.225:57452] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeM-_RqX6WpmmAXOBi_YrgAAAcs"]
[Sat Apr 18 16:21:19.433429 2026] [:error] [pid 9865:tid 9938] [client 54.37.86.225:57454] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeM-_6zb5knECIY-C-hWgQAAAIE"]
[Sat Apr 18 16:21:21.932960 2026] [:error] [pid 9865:tid 9944] [client 54.37.86.225:57460] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeM_Aazb5knECIY-C-hWggAAAIc"]
[Sat Apr 18 16:21:23.785446 2026] [:error] [pid 9864:tid 9928] [client 54.37.86.225:55570] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeM_A4CFeowknfXHM7nKqAAAAFY"]
[Sat Apr 18 16:21:25.803194 2026] [:error] [pid 9863:tid 9881] [client 54.37.86.225:55580] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeM_BTjjiypiFrTucbKsAQAAAAg"]
[Sat Apr 18 16:21:27.832505 2026] [:error] [pid 9863:tid 9880] [client 54.37.86.225:55592] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeM_BzjjiypiFrTucbKsCQAAAAc"]
[Sat Apr 18 16:21:29.701802 2026] [:error] [pid 34290:tid 34334] [client 54.37.86.225:55606] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeM_CRqX6WpmmAXOBi_YwQAAAc8"]
[Sat Apr 18 16:21:31.696402 2026] [:error] [pid 9864:tid 9924] [client 54.37.86.225:55616] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeM_C4CFeowknfXHM7nKvwAAAFI"]
[Sat Apr 18 16:21:33.736506 2026] [:error] [pid 9865:tid 9941] [client 54.37.86.225:60502] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeM_Dazb5knECIY-C-hWlwAAAIQ"]
[Sat Apr 18 16:21:36.256210 2026] [:error] [pid 9864:tid 9905] [client 54.37.86.225:39314] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeM_EICFeowknfXHM7nKyQAAAEA"]
[Sat Apr 18 16:21:38.278970 2026] [:error] [pid 9863:tid 9873] [client 54.37.86.225:60512] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeM_EjjjiypiFrTucbKsDwAAAAA"]
[Sat Apr 18 16:21:40.005473 2026] [:error] [pid 13023:tid 13047] [client 54.37.86.225:60524] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeM_FP1e7hG8DAeABB_MsgAAARY"]
[Sat Apr 18 16:21:42.541443 2026] [:error] [pid 34237:tid 34261] [client 54.37.86.225:39330] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeM_FhBmX4Wq5a6rxfZKMQAAAVY"]
[Sat Apr 18 16:21:44.526081 2026] [:error] [pid 9970:tid 9991] [client 54.37.86.225:38556] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeM_GCYdRLRhVmaIMx19RAAAANE"]
[Sat Apr 18 16:21:46.535250 2026] [:error] [pid 9970:tid 9979] [client 54.37.86.225:38566] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeM_GiYdRLRhVmaIMx19RQAAAMU"]
[Sat Apr 18 16:21:48.560312 2026] [:error] [pid 9863:tid 9892] [client 54.37.86.225:38574] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeM_HDjjiypiFrTucbKsEQAAABM"]
[Sat Apr 18 16:21:50.579843 2026] [:error] [pid 9864:tid 9916] [client 54.37.86.225:38576] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeM_HoCFeowknfXHM7nK8gAAAEo"]
[Sat Apr 18 16:22:12.724946 2026] [:error] [pid 34290:tid 34338] [client 54.37.86.225:40152] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeM_NBqX6WpmmAXOBi_ZBgAAAdM"]
[Sat Apr 18 16:22:15.157357 2026] [:error] [pid 9970:tid 9983] [client 54.37.86.225:49094] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeM_NyYdRLRhVmaIMx19XwAAAMk"]
[Sat Apr 18 16:22:16.999462 2026] [:error] [pid 34290:tid 34339] [client 54.37.86.225:56032] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeM_OBqX6WpmmAXOBi_ZEQAAAdQ"]
[Sat Apr 18 16:22:19.494749 2026] [:error] [pid 9864:tid 9906] [client 54.37.86.225:49100] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeM_O4CFeowknfXHM7nLJwAAAEE"]
[Sat Apr 18 16:22:21.942130 2026] [:error] [pid 34237:tid 34245] [client 54.37.86.225:49110] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeM_PRBmX4Wq5a6rxfZKWAAAAUY"]
[Sat Apr 18 16:22:24.413853 2026] [:error] [pid 34237:tid 34248] [client 54.37.86.225:38208] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeM_QBBmX4Wq5a6rxfZKXAAAAUk"]
[Sat Apr 18 16:22:26.738039 2026] [:error] [pid 9863:tid 9890] [client 54.37.86.225:38214] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeM_QjjjiypiFrTucbKsKQAAABE"]
[Sat Apr 18 16:22:29.201564 2026] [:error] [pid 9865:tid 9961] [client 54.37.86.225:38222] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeM_Razb5knECIY-C-hWtQAAAJg"]
[Sat Apr 18 16:22:31.180855 2026] [:error] [pid 9864:tid 9913] [client 54.37.86.225:42182] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeM_R4CFeowknfXHM7nLLAAAAEc"]
[Sat Apr 18 16:22:33.670543 2026] [:error] [pid 9863:tid 9893] [client 54.37.86.225:59246] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeM_STjjiypiFrTucbKsLQAAABQ"]
[Sat Apr 18 16:22:36.130540 2026] [:error] [pid 34288:tid 34299] [client 54.37.86.225:59252] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeM_TOTIiy__PtiLmpm2pwAAAYc"]
[Sat Apr 18 16:22:38.587383 2026] [:error] [pid 34237:tid 34253] [client 54.37.86.225:59262] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeM_ThBmX4Wq5a6rxfZKZAAAAU4"]
[Sat Apr 18 16:22:41.042586 2026] [:error] [pid 9864:tid 9926] [client 54.37.86.225:59268] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeM_UYCFeowknfXHM7nLNgAAAFQ"]
[Sat Apr 18 16:22:43.364548 2026] [:error] [pid 9865:tid 9943] [client 54.37.86.225:56724] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeM_U6zb5knECIY-C-hWwwAAAIY"]
[Sat Apr 18 16:22:45.689993 2026] [:error] [pid 34288:tid 34299] [client 54.37.86.225:56738] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeM_VeTIiy__PtiLmpm2sQAAAYc"]
[Sat Apr 18 16:22:47.702326 2026] [:error] [pid 34288:tid 34294] [client 54.37.86.225:55790] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeM_V-TIiy__PtiLmpm2tgAAAYI"]
[Sat Apr 18 16:22:51.490355 2026] [:error] [pid 34288:tid 34298] [client 54.37.86.225:55796] [client 54.37.86.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeM_W-TIiy__PtiLmpm2vQAAAYY"]
[Sat Apr 18 16:59:46.160294 2026] [:error] [pid 34288:tid 34313] [client 43.166.244.192:58176] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeNIAuTIiy__PtiLmpm7PAAAAZU"]
[Sat Apr 18 19:26:22.817166 2026] [:error] [pid 9863:tid 9884] [client 185.208.206.98:55842] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeNqXjjjiypiFrTucbLE-AAAAAs"]
[Sat Apr 18 19:26:25.420658 2026] [:error] [pid 9863:tid 9889] [client 185.208.206.98:40758] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeNqYTjjiypiFrTucbLE_wAAABA"]
[Sat Apr 18 19:26:28.097184 2026] [:error] [pid 34290:tid 34337] [client 185.208.206.98:40768] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeNqZBqX6WpmmAXOBi8LQwAAAdI"]
[Sat Apr 18 19:26:30.546764 2026] [:error] [pid 34237:tid 34248] [client 185.208.206.98:40782] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeNqZhBmX4Wq5a6rxfaNWgAAAUk"]
[Sat Apr 18 19:26:33.047829 2026] [:error] [pid 9970:tid 9994] [client 185.208.206.98:33710] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeNqaSYdRLRhVmaIMx2o3QAAANQ"]
[Sat Apr 18 19:26:35.610361 2026] [:error] [pid 34290:tid 34339] [client 185.208.206.98:33712] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeNqaxqX6WpmmAXOBi8LVQAAAdQ"]
[Sat Apr 18 19:26:38.248097 2026] [:error] [pid 9865:tid 9944] [client 185.208.206.98:33716] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeNqbqzb5knECIY-C-h41AAAAIc"]
[Sat Apr 18 19:26:40.913030 2026] [:error] [pid 34290:tid 34327] [client 185.208.206.98:33718] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeNqcBqX6WpmmAXOBi8LXgAAAcg"]
[Sat Apr 18 19:26:43.557135 2026] [:error] [pid 9865:tid 9945] [client 185.208.206.98:52482] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeNqc6zb5knECIY-C-h41QAAAIg"]
[Sat Apr 18 19:26:46.056143 2026] [:error] [pid 9864:tid 9920] [client 185.208.206.98:52488] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aeNqdoCFeowknfXHM7kGYwAAAE4"]
[Sat Apr 18 19:26:48.484628 2026] [:error] [pid 9970:tid 9994] [client 185.208.206.98:52492] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aeNqeCYdRLRhVmaIMx2o6wAAANQ"]
[Sat Apr 18 19:26:51.032345 2026] [:error] [pid 9863:tid 9882] [client 185.208.206.98:52494] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeNqezjjiypiFrTucbLFIAAAAAk"]
[Sat Apr 18 19:26:53.520440 2026] [:error] [pid 9864:tid 9922] [client 185.208.206.98:55440] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeNqfYCFeowknfXHM7kGbAAAAFA"]
[Sat Apr 18 19:26:56.033257 2026] [:error] [pid 9970:tid 9981] [client 185.208.206.98:55454] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeNqgCYdRLRhVmaIMx2o-AAAAMc"]
[Sat Apr 18 19:26:58.634564 2026] [:error] [pid 9970:tid 9976] [client 185.208.206.98:55460] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeNqgiYdRLRhVmaIMx2pBgAAAMI"]
[Sat Apr 18 19:27:01.333224 2026] [:error] [pid 9970:tid 9996] [client 185.208.206.98:55462] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeNqhSYdRLRhVmaIMx2pDgAAANY"]
[Sat Apr 18 19:27:03.874927 2026] [:error] [pid 34237:tid 34245] [client 185.208.206.98:59258] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeNqhxBmX4Wq5a6rxfaNfQAAAUY"]
[Sat Apr 18 19:27:06.296006 2026] [:error] [pid 34237:tid 34251] [client 185.208.206.98:59272] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeNqihBmX4Wq5a6rxfaNgwAAAUw"]
[Sat Apr 18 19:27:08.846665 2026] [:error] [pid 9864:tid 9912] [client 185.208.206.98:59276] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeNqjICFeowknfXHM7kGegAAAEY"]
[Sat Apr 18 19:27:11.512184 2026] [:error] [pid 34237:tid 34245] [client 185.208.206.98:59286] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeNqjxBmX4Wq5a6rxfaNiQAAAUY"]
[Sat Apr 18 19:27:14.160889 2026] [:error] [pid 34237:tid 34254] [client 185.208.206.98:56484] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeNqkhBmX4Wq5a6rxfaNkQAAAU8"]
[Sat Apr 18 19:27:16.752370 2026] [:error] [pid 9864:tid 9910] [client 185.208.206.98:56500] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeNqlICFeowknfXHM7kGhAAAAEU"]
[Sat Apr 18 19:27:19.290388 2026] [:error] [pid 34237:tid 34239] [client 185.208.206.98:56516] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeNqlxBmX4Wq5a6rxfaNoAAAAUA"]
[Sat Apr 18 19:27:40.361094 2026] [:error] [pid 34290:tid 34341] [client 185.208.206.98:56528] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeNqrBqX6WpmmAXOBi8LoQAAAdY"]
[Sat Apr 18 19:27:42.892534 2026] [:error] [pid 9864:tid 9912] [client 185.208.206.98:41860] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeNqroCFeowknfXHM7kGqgAAAEY"]
[Sat Apr 18 19:27:45.528655 2026] [:error] [pid 9970:tid 9976] [client 185.208.206.98:49368] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeNqsSYdRLRhVmaIMx2pMAAAAMI"]
[Sat Apr 18 19:27:48.222296 2026] [:error] [pid 9864:tid 9927] [client 185.208.206.98:49372] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeNqtICFeowknfXHM7kGtAAAAFU"]
[Sat Apr 18 19:27:50.857228 2026] [:error] [pid 34290:tid 34338] [client 185.208.206.98:49382] [client 185.208.206.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeNqthqX6WpmmAXOBi8LtQAAAdM"]
[Sat Apr 18 19:50:55.906422 2026] [:error] [pid 34290:tid 34329] [client 159.26.107.55:53053] [client 159.26.107.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.107.55, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeNwHxqX6WpmmAXOBi8SngAAAco"]
[Sat Apr 18 19:50:56.211274 2026] [proxy_fcgi:error] [pid 34290:tid 34329] [client 159.26.107.55:53053] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 21:53:07.153718 2026] [:error] [pid 32647:tid 32655] [client 49.51.72.236:48778] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeOMw0kxooM0iRo6e54rIgAAAgU"]
[Sat Apr 18 22:06:39.480260 2026] [proxy_fcgi:error] [pid 9970:tid 9991] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:39.748903 2026] [proxy_fcgi:error] [pid 9970:tid 9979] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:40.044002 2026] [proxy_fcgi:error] [pid 9970:tid 9989] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:40.303014 2026] [proxy_fcgi:error] [pid 9970:tid 9987] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:40.564077 2026] [proxy_fcgi:error] [pid 9970:tid 9996] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:40.837015 2026] [proxy_fcgi:error] [pid 9970:tid 9993] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:41.110892 2026] [proxy_fcgi:error] [pid 9970:tid 9988] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:41.461830 2026] [proxy_fcgi:error] [pid 9970:tid 9987] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:41.724129 2026] [proxy_fcgi:error] [pid 9970:tid 9980] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:41.991060 2026] [proxy_fcgi:error] [pid 9970:tid 9974] [client 158.158.124.190:19574] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:06:42.246455 2026] [:error] [pid 9970:tid 9981] [client 158.158.124.190:19574] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aeOP8iYdRLRhVmaIMx3SSgAAAMc"]
[Sat Apr 18 22:06:45.540732 2026] [:error] [pid 9970:tid 9978] [client 158.158.124.190:17578] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aeOP9SYdRLRhVmaIMx3SWQAAAMQ"]
[Sat Apr 18 22:06:46.425792 2026] [:error] [pid 13023:tid 13027] [client 158.158.124.190:18325] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aeOP9v1e7hG8DAeABB8uJQAAAQI"]
[Sat Apr 18 22:06:47.518504 2026] [:error] [pid 9864:tid 9905] [client 158.158.124.190:15564] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aeOP94CFeowknfXHM7ksVgAAAEA"]
[Sat Apr 18 22:06:48.437295 2026] [:error] [pid 32678:tid 32728] [client 158.158.124.190:18316] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "aeOP-BUlAXU_ZWUu5y8IiAAAApU"]
[Sat Apr 18 22:06:50.727285 2026] [:error] [pid 9863:tid 9892] [client 158.158.124.190:16860] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "aeOP-jjjiypiFrTucbLWKgAAABM"]
[Sat Apr 18 22:06:51.721304 2026] [:error] [pid 13023:tid 13027] [client 158.158.124.190:28325] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "aeOP-_1e7hG8DAeABB8uNwAAAQI"]
[Sat Apr 18 22:06:53.000075 2026] [:error] [pid 9970:tid 9974] [client 158.158.124.190:47366] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboute.php"] [unique_id "aeOP_CYdRLRhVmaIMx3SYQAAAMA"]
[Sat Apr 18 22:06:53.829380 2026] [:error] [pid 9864:tid 9925] [client 158.158.124.190:27598] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeOP_YCFeowknfXHM7ksWwAAAFM"]
[Sat Apr 18 22:06:55.092433 2026] [:error] [pid 32678:tid 32710] [client 158.158.124.190:53691] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeOP_xUlAXU_ZWUu5y8IkgAAAoM"]
[Sat Apr 18 22:06:56.546202 2026] [:error] [pid 32678:tid 32724] [client 158.158.124.190:22993] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeOQABUlAXU_ZWUu5y8IlgAAApE"]
[Sat Apr 18 22:06:57.301161 2026] [:error] [pid 32647:tid 32650] [client 158.158.124.190:1847] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeOQAUkxooM0iRo6e54syAAAAgA"]
[Sat Apr 18 22:06:58.580068 2026] [:error] [pid 32647:tid 32666] [client 158.158.124.190:20325] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "aeOQAkkxooM0iRo6e54sygAAAhA"]
[Sat Apr 18 22:07:01.990413 2026] [:error] [pid 9970:tid 9992] [client 158.158.124.190:12939] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "aeOQBSYdRLRhVmaIMx3ScgAAANI"]
[Sat Apr 18 22:07:05.764281 2026] [:error] [pid 9970:tid 9989] [client 158.158.124.190:31949] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "aeOQCSYdRLRhVmaIMx3SfwAAAM8"]
[Sat Apr 18 22:07:07.816859 2026] [:error] [pid 9970:tid 9992] [client 158.158.124.190:23320] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "aeOQCyYdRLRhVmaIMx3SiwAAANI"]
[Sat Apr 18 22:07:09.012115 2026] [:error] [pid 13023:tid 13046] [client 158.158.124.190:23019] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeOQDf1e7hG8DAeABB8uagAAARU"]
[Sat Apr 18 22:07:16.608635 2026] [:error] [pid 32647:tid 32652] [client 158.158.124.190:36080] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeOQFEkxooM0iRo6e54szgAAAgI"]
[Sat Apr 18 22:07:18.592621 2026] [:error] [pid 32647:tid 32672] [client 158.158.124.190:27088] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeOQFkkxooM0iRo6e54s0gAAAhY"]
[Sat Apr 18 22:07:19.384104 2026] [:error] [pid 9863:tid 9886] [client 158.158.124.190:18424] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "aeOQFzjjiypiFrTucbLWMQAAAA0"]
[Sat Apr 18 22:07:20.488126 2026] [:error] [pid 13023:tid 13042] [client 158.158.124.190:16613] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "aeOQGP1e7hG8DAeABB8ujQAAARE"]
[Sat Apr 18 22:07:23.741593 2026] [:error] [pid 13023:tid 13045] [client 158.158.124.190:60766] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "aeOQG_1e7hG8DAeABB8umAAAARQ"]
[Sat Apr 18 22:07:24.548685 2026] [:error] [pid 13023:tid 13047] [client 158.158.124.190:60776] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "aeOQHP1e7hG8DAeABB8unAAAARY"]
[Sat Apr 18 22:07:26.069354 2026] [:error] [pid 9864:tid 9916] [client 158.158.124.190:23304] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "aeOQHoCFeowknfXHM7ksawAAAEo"]
[Sat Apr 18 22:07:31.142157 2026] [:error] [pid 9970:tid 9982] [client 158.158.124.190:28939] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeOQIyYdRLRhVmaIMx3SmwAAAMg"]
[Sat Apr 18 22:07:36.578893 2026] [:error] [pid 9864:tid 9928] [client 158.158.124.190:28933] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeOQKICFeowknfXHM7kscgAAAFY"]
[Sat Apr 18 22:07:37.737647 2026] [:error] [pid 32677:tid 32700] [client 158.158.124.190:47986] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeOQKRngmUE3LdC-wP7pzAAAAlQ"]
[Sat Apr 18 22:07:41.213005 2026] [proxy_fcgi:error] [pid 32647:tid 32663] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:41.459037 2026] [proxy_fcgi:error] [pid 32647:tid 32672] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:41.701385 2026] [proxy_fcgi:error] [pid 32647:tid 32660] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:41.950830 2026] [proxy_fcgi:error] [pid 32647:tid 32674] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:42.201080 2026] [proxy_fcgi:error] [pid 32647:tid 32669] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:42.443892 2026] [proxy_fcgi:error] [pid 32647:tid 32661] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:42.685467 2026] [proxy_fcgi:error] [pid 32647:tid 32671] [client 158.158.124.190:58188] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:43.069310 2026] [:error] [pid 32647:tid 32662] [client 158.158.124.190:58188] [client 158.158.124.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "aeOQL0kxooM0iRo6e54s5QAAAgw"]
[Sat Apr 18 22:07:45.843171 2026] [proxy_fcgi:error] [pid 9970:tid 9976] [client 158.158.124.190:21064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:46.099028 2026] [proxy_fcgi:error] [pid 9970:tid 9997] [client 158.158.124.190:21064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:46.353398 2026] [proxy_fcgi:error] [pid 9970:tid 9987] [client 158.158.124.190:21064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:07:46.595213 2026] [:error] [pid 9970:tid 9983] [client 158.158.124.190:21064] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "aeOQMiYdRLRhVmaIMx3SwwAAAMk"]
[Sat Apr 18 22:07:50.122288 2026] [:error] [pid 9970:tid 9991] [client 158.158.124.190:12629] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "aeOQNiYdRLRhVmaIMx3SzQAAANE"]
[Sat Apr 18 22:07:50.958893 2026] [:error] [pid 34290:tid 34329] [client 158.158.124.190:56565] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "aeOQNhqX6WpmmAXOBi8oiwAAAco"]
[Sat Apr 18 22:07:51.933626 2026] [:error] [pid 9865:tid 9950] [client 158.158.124.190:14811] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/roksad1.php"] [unique_id "aeOQN6zb5knECIY-C-iZkAAAAI0"]
[Sat Apr 18 22:07:52.761168 2026] [:error] [pid 32677:tid 32697] [client 158.158.124.190:41057] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOQOBngmUE3LdC-wP7p1gAAAlE"]
[Sat Apr 18 22:07:54.637802 2026] [:error] [pid 32678:tid 32719] [client 158.158.124.190:1033] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOQOhUlAXU_ZWUu5y8IwgAAAow"]
[Sat Apr 18 22:07:57.765647 2026] [:error] [pid 9970:tid 9986] [client 158.158.124.190:14829] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOQPSYdRLRhVmaIMx3S8QAAAMw"]
[Sat Apr 18 22:07:59.000298 2026] [:error] [pid 13023:tid 13047] [client 158.158.124.190:30452] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOQPv1e7hG8DAeABB8u6QAAARY"]
[Sat Apr 18 22:07:59.939408 2026] [:error] [pid 34290:tid 34333] [client 158.158.124.190:17869] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aeOQPxqX6WpmmAXOBi8onQAAAc4"]
[Sat Apr 18 22:08:01.289507 2026] [:error] [pid 32677:tid 32695] [client 158.158.124.190:30426] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aeOQQRngmUE3LdC-wP7p6QAAAk8"]
[Sat Apr 18 22:08:02.648686 2026] [:error] [pid 9865:tid 9940] [client 158.158.124.190:28974] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aeOQQqzb5knECIY-C-iZmAAAAIM"]
[Sat Apr 18 22:08:03.692857 2026] [:error] [pid 9864:tid 9928] [client 158.158.124.190:41076] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.php"] [unique_id "aeOQQ4CFeowknfXHM7kskQAAAFY"]
[Sat Apr 18 22:08:04.666181 2026] [:error] [pid 9863:tid 9874] [client 158.158.124.190:14531] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aeOQRDjjiypiFrTucbLWPwAAAAE"]
[Sat Apr 18 22:08:05.548073 2026] [:error] [pid 9865:tid 9952] [client 158.158.124.190:56541] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aeOQRazb5knECIY-C-iZngAAAI8"]
[Sat Apr 18 22:08:07.131777 2026] [:error] [pid 13023:tid 13047] [client 158.158.124.190:12613] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aeOQR_1e7hG8DAeABB8u9AAAARY"]
[Sat Apr 18 22:08:07.824001 2026] [:error] [pid 32677:tid 32701] [client 158.158.124.190:14558] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aeOQRxngmUE3LdC-wP7p8QAAAlU"]
[Sat Apr 18 22:08:08.843825 2026] [:error] [pid 32677:tid 32702] [client 158.158.124.190:30443] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOQSBngmUE3LdC-wP7p9QAAAlY"]
[Sat Apr 18 22:08:09.692084 2026] [:error] [pid 9865:tid 9961] [client 158.158.124.190:17899] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOQSazb5knECIY-C-iZpAAAAJg"]
[Sat Apr 18 22:08:10.564134 2026] [:error] [pid 32647:tid 32664] [client 158.158.124.190:14833] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOQSkkxooM0iRo6e54s-AAAAg4"]
[Sat Apr 18 22:08:11.649614 2026] [:error] [pid 13023:tid 13043] [client 158.158.124.190:41064] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOQS_1e7hG8DAeABB8vAAAAARI"]
[Sat Apr 18 22:08:12.851889 2026] [:error] [pid 9970:tid 9994] [client 158.158.124.190:35972] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeOQTCYdRLRhVmaIMx3S9QAAANQ"]
[Sat Apr 18 22:08:13.906049 2026] [:error] [pid 9970:tid 9995] [client 158.158.124.190:30432] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeOQTSYdRLRhVmaIMx3S9wAAANU"]
[Sat Apr 18 22:08:15.001295 2026] [:error] [pid 13023:tid 13048] [client 158.158.124.190:58190] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeOQT_1e7hG8DAeABB8vBQAAARc"]
[Sat Apr 18 22:08:16.470989 2026] [:error] [pid 9970:tid 9976] [client 158.158.124.190:30434] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeOQUCYdRLRhVmaIMx3S_wAAAMI"]
[Sat Apr 18 22:08:18.415588 2026] [:error] [pid 9970:tid 9981] [client 158.158.124.190:14824] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeOQUiYdRLRhVmaIMx3TBgAAAMc"]
[Sat Apr 18 22:08:19.648631 2026] [:error] [pid 9865:tid 9944] [client 158.158.124.190:14577] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeOQU6zb5knECIY-C-iZswAAAIc"]
[Sat Apr 18 22:08:21.495938 2026] [:error] [pid 9865:tid 9950] [client 158.158.124.190:35974] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeOQVazb5knECIY-C-iZvQAAAI0"]
[Sat Apr 18 22:08:22.947877 2026] [:error] [pid 13023:tid 13026] [client 158.158.124.190:25507] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "aeOQVv1e7hG8DAeABB8vFQAAAQE"]
[Sat Apr 18 22:08:24.298942 2026] [:error] [pid 13023:tid 13036] [client 158.158.124.190:41087] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "aeOQWP1e7hG8DAeABB8vHwAAAQs"]
[Sat Apr 18 22:08:25.316817 2026] [:error] [pid 9970:tid 9978] [client 158.158.124.190:22642] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "aeOQWSYdRLRhVmaIMx3TDAAAAMQ"]
[Sat Apr 18 22:08:30.224160 2026] [:error] [pid 32677:tid 32702] [client 158.158.124.190:17910] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "aeOQXhngmUE3LdC-wP7p_AAAAlY"]
[Sat Apr 18 22:08:32.224322 2026] [:error] [pid 9865:tid 9949] [client 158.158.124.190:29946] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wglum1.php"] [unique_id "aeOQYKzb5knECIY-C-iZxgAAAIw"]
[Sat Apr 18 22:08:33.735553 2026] [:error] [pid 32678:tid 32707] [client 158.158.124.190:17915] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "aeOQYRUlAXU_ZWUu5y8I8AAAAoA"]
[Sat Apr 18 22:08:35.900179 2026] [:error] [pid 13023:tid 13027] [client 158.158.124.190:31926] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "aeOQY_1e7hG8DAeABB8vMwAAAQI"]
[Sat Apr 18 22:08:37.295319 2026] [:error] [pid 13023:tid 13028] [client 158.158.124.190:30448] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "aeOQZf1e7hG8DAeABB8vOwAAAQM"]
[Sat Apr 18 22:08:42.031431 2026] [:error] [pid 13023:tid 13046] [client 158.158.124.190:12620] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "aeOQav1e7hG8DAeABB8vSQAAARU"]
[Sat Apr 18 22:08:44.887280 2026] [:error] [pid 13023:tid 13042] [client 158.158.124.190:14823] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wgift1.php"] [unique_id "aeOQbP1e7hG8DAeABB8vWgAAARE"]
[Sat Apr 18 22:08:46.364876 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:46.627667 2026] [proxy_fcgi:error] [pid 13023:tid 13048] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:47.126593 2026] [proxy_fcgi:error] [pid 13023:tid 13027] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:47.470388 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:47.712924 2026] [proxy_fcgi:error] [pid 13023:tid 13040] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:47.955583 2026] [proxy_fcgi:error] [pid 13023:tid 13039] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:48.266977 2026] [proxy_fcgi:error] [pid 13023:tid 13037] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:48.511154 2026] [proxy_fcgi:error] [pid 13023:tid 13027] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:48.770295 2026] [proxy_fcgi:error] [pid 13023:tid 13041] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:49.018380 2026] [proxy_fcgi:error] [pid 13023:tid 13046] [client 158.158.124.190:41040] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:08:49.313301 2026] [:error] [pid 13023:tid 13047] [client 158.158.124.190:41040] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeOQcf1e7hG8DAeABB8veQAAARY"]
[Sat Apr 18 22:08:51.245498 2026] [:error] [pid 9865:tid 9948] [client 158.158.124.190:41027] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeOQc6zb5knECIY-C-iZ2AAAAIs"]
[Sat Apr 18 22:08:53.296134 2026] [:error] [pid 32677:tid 32699] [client 158.158.124.190:30869] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeOQdRngmUE3LdC-wP7qBQAAAlM"]
[Sat Apr 18 22:08:54.324035 2026] [:error] [pid 9865:tid 9954] [client 158.158.124.190:29940] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aeOQdqzb5knECIY-C-iZ2gAAAJE"]
[Sat Apr 18 22:08:55.042941 2026] [:error] [pid 32647:tid 32667] [client 158.158.124.190:1417] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeOQd0kxooM0iRo6e54tBwAAAhE"]
[Sat Apr 18 22:08:55.854216 2026] [:error] [pid 32677:tid 32691] [client 158.158.124.190:17859] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeOQdxngmUE3LdC-wP7qCwAAAks"]
[Sat Apr 18 22:08:57.015867 2026] [:error] [pid 13023:tid 13034] [client 158.158.124.190:29948] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeOQef1e7hG8DAeABB8vfAAAAQk"]
[Sat Apr 18 22:08:58.158139 2026] [:error] [pid 13023:tid 13035] [client 158.158.124.190:17907] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeOQev1e7hG8DAeABB8vgQAAAQo"]
[Sat Apr 18 22:09:00.736314 2026] [:error] [pid 9970:tid 9992] [client 158.158.124.190:31873] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "aeOQfCYdRLRhVmaIMx3TVQAAANI"]
[Sat Apr 18 22:09:01.961900 2026] [:error] [pid 9970:tid 9982] [client 158.158.124.190:26547] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "aeOQfSYdRLRhVmaIMx3TWQAAAMg"]
[Sat Apr 18 22:09:03.288559 2026] [:error] [pid 9970:tid 9983] [client 158.158.124.190:29897] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "aeOQfyYdRLRhVmaIMx3TXQAAAMk"]
[Sat Apr 18 22:09:05.209291 2026] [:error] [pid 9865:tid 9941] [client 158.158.124.190:21493] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "aeOQgazb5knECIY-C-iZ5AAAAIQ"]
[Sat Apr 18 22:09:07.417079 2026] [:error] [pid 9865:tid 9942] [client 158.158.124.190:12379] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeOQg6zb5knECIY-C-iZ7AAAAIU"]
[Sat Apr 18 22:09:09.933785 2026] [:error] [pid 9970:tid 9989] [client 158.158.124.190:14772] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeOQhSYdRLRhVmaIMx3TZgAAAM8"]
[Sat Apr 18 22:09:10.762464 2026] [:error] [pid 13023:tid 13048] [client 158.158.124.190:13171] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeOQhv1e7hG8DAeABB8vkgAAARc"]
[Sat Apr 18 22:09:11.691973 2026] [:error] [pid 13023:tid 13045] [client 158.158.124.190:15041] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeOQh_1e7hG8DAeABB8vmAAAARQ"]
[Sat Apr 18 22:09:12.708900 2026] [:error] [pid 9970:tid 9995] [client 158.158.124.190:13512] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "aeOQiCYdRLRhVmaIMx3TbAAAANU"]
[Sat Apr 18 22:09:14.576942 2026] [:error] [pid 9970:tid 9976] [client 158.158.124.190:36611] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "aeOQiiYdRLRhVmaIMx3TcAAAAMI"]
[Sat Apr 18 22:09:15.424192 2026] [:error] [pid 9864:tid 9929] [client 158.158.124.190:24466] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "aeOQi4CFeowknfXHM7ksnAAAAFc"]
[Sat Apr 18 22:09:16.874035 2026] [:error] [pid 32677:tid 32681] [client 158.158.124.190:21764] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gelio1.php"] [unique_id "aeOQjBngmUE3LdC-wP7qFwAAAkE"]
[Sat Apr 18 22:09:18.167961 2026] [:error] [pid 32678:tid 32727] [client 158.158.124.190:12441] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "aeOQjhUlAXU_ZWUu5y8JEAAAApQ"]
[Sat Apr 18 22:09:19.969076 2026] [:error] [pid 9970:tid 9974] [client 158.158.124.190:20707] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "aeOQjyYdRLRhVmaIMx3TewAAAMA"]
[Sat Apr 18 22:09:21.469922 2026] [:error] [pid 9970:tid 9989] [client 158.158.124.190:23393] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "aeOQkSYdRLRhVmaIMx3TfwAAAM8"]
[Sat Apr 18 22:09:23.396127 2026] [:error] [pid 34290:tid 34331] [client 158.158.124.190:13639] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws82.php"] [unique_id "aeOQkxqX6WpmmAXOBi8orAAAAcw"]
[Sat Apr 18 22:09:25.481918 2026] [:error] [pid 32678:tid 32716] [client 158.158.124.190:48656] [client 158.158.124.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeOQlRUlAXU_ZWUu5y8JGQAAAok"]
[Sat Apr 18 22:09:27.577179 2026] [:error] [pid 9970:tid 9985] [client 158.158.124.190:13446] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aeOQlyYdRLRhVmaIMx3TgwAAAMs"]
[Sat Apr 18 22:09:30.405992 2026] [:error] [pid 9970:tid 9989] [client 158.158.124.190:12927] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aeOQmiYdRLRhVmaIMx3ThgAAAM8"]
[Sat Apr 18 22:09:32.603898 2026] [:error] [pid 32677:tid 32702] [client 158.158.124.190:12925] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aeOQnBngmUE3LdC-wP7qHgAAAlY"]
[Sat Apr 18 22:09:36.133670 2026] [:error] [pid 9970:tid 9974] [client 158.158.124.190:48024] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class.php"] [unique_id "aeOQoCYdRLRhVmaIMx3TjwAAAMA"]
[Sat Apr 18 22:09:40.518560 2026] [:error] [pid 9864:tid 9929] [client 158.158.124.190:12734] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "aeOQpICFeowknfXHM7ksqAAAAFc"]
[Sat Apr 18 22:09:42.149277 2026] [:error] [pid 13023:tid 13041] [client 158.158.124.190:1613] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "aeOQpv1e7hG8DAeABB8vqgAAARA"]
[Sat Apr 18 22:09:43.174803 2026] [:error] [pid 9864:tid 9930] [client 158.158.124.190:15838] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "aeOQp4CFeowknfXHM7ksqgAAAFg"]
[Sat Apr 18 22:09:44.022661 2026] [:error] [pid 9863:tid 9881] [client 158.158.124.190:21389] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "aeOQqDjjiypiFrTucbLWUQAAAAg"]
[Sat Apr 18 22:09:44.573827 2026] [:error] [pid 32647:tid 32665] [client 158.158.124.190:19161] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aeOQqEkxooM0iRo6e54tHAAAAg8"]
[Sat Apr 18 22:09:45.798715 2026] [:error] [pid 9863:tid 9877] [client 158.158.124.190:13406] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aeOQqTjjiypiFrTucbLWUwAAAAQ"]
[Sat Apr 18 22:09:46.779527 2026] [:error] [pid 9864:tid 9927] [client 158.158.124.190:18696] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aeOQqoCFeowknfXHM7ksrwAAAFU"]
[Sat Apr 18 22:09:47.508863 2026] [:error] [pid 32677:tid 32698] [client 158.158.124.190:30948] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws85.php"] [unique_id "aeOQqxngmUE3LdC-wP7qIgAAAlI"]
[Sat Apr 18 22:09:49.434044 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:49.898477 2026] [proxy_fcgi:error] [pid 13023:tid 13049] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:50.158188 2026] [proxy_fcgi:error] [pid 13023:tid 13039] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:50.427829 2026] [proxy_fcgi:error] [pid 13023:tid 13025] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:50.689309 2026] [proxy_fcgi:error] [pid 13023:tid 13030] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:50.947429 2026] [proxy_fcgi:error] [pid 13023:tid 13032] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:51.214132 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:51.481060 2026] [proxy_fcgi:error] [pid 13023:tid 13042] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:51.741361 2026] [proxy_fcgi:error] [pid 13023:tid 13041] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:52.009675 2026] [proxy_fcgi:error] [pid 13023:tid 13026] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:52.278744 2026] [proxy_fcgi:error] [pid 13023:tid 13031] [client 158.158.124.190:13439] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:09:52.576466 2026] [:error] [pid 13023:tid 13038] [client 158.158.124.190:13439] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "aeOQsP1e7hG8DAeABB8vwgAAAQ0"]
[Sat Apr 18 22:09:53.191543 2026] [:error] [pid 32677:tid 32689] [client 158.158.124.190:13426] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "aeOQsRngmUE3LdC-wP7qKgAAAkk"]
[Sat Apr 18 22:09:53.871730 2026] [:error] [pid 9970:tid 9982] [client 158.158.124.190:22269] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "aeOQsSYdRLRhVmaIMx3TtAAAAMg"]
[Sat Apr 18 22:09:55.106418 2026] [:error] [pid 9970:tid 9990] [client 158.158.124.190:22942] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "aeOQsyYdRLRhVmaIMx3TuwAAANA"]
[Sat Apr 18 22:09:56.816229 2026] [:error] [pid 9970:tid 9994] [client 158.158.124.190:14212] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeOQtCYdRLRhVmaIMx3TxQAAANQ"]
[Sat Apr 18 22:09:58.930120 2026] [:error] [pid 9970:tid 9984] [client 158.158.124.190:16076] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeOQtiYdRLRhVmaIMx3TzgAAAMo"]
[Sat Apr 18 22:10:00.291754 2026] [:error] [pid 9970:tid 9997] [client 158.158.124.190:21850] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeOQuCYdRLRhVmaIMx3T0gAAANc"]
[Sat Apr 18 22:10:01.143741 2026] [:error] [pid 13023:tid 13036] [client 158.158.124.190:17326] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "aeOQuf1e7hG8DAeABB8vzAAAAQs"]
[Sat Apr 18 22:10:04.062158 2026] [:error] [pid 9864:tid 9920] [client 158.158.124.190:26059] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeOQvICFeowknfXHM7ksvAAAAE4"]
[Sat Apr 18 22:10:05.469042 2026] [:error] [pid 9865:tid 9941] [client 158.158.124.190:30356] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeOQvazb5knECIY-C-iaGwAAAIQ"]
[Sat Apr 18 22:10:07.695526 2026] [:error] [pid 9970:tid 9990] [client 158.158.124.190:29422] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeOQvyYdRLRhVmaIMx3T3QAAANA"]
[Sat Apr 18 22:10:08.825497 2026] [:error] [pid 9863:tid 9895] [client 158.158.124.190:29402] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index.php"] [unique_id "aeOQwDjjiypiFrTucbLWWAAAABY"]
[Sat Apr 18 22:10:12.665832 2026] [:error] [pid 9970:tid 9987] [client 158.158.124.190:28411] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "aeOQxCYdRLRhVmaIMx3T6gAAAM0"]
[Sat Apr 18 22:10:13.531626 2026] [:error] [pid 9970:tid 9988] [client 158.158.124.190:28414] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "aeOQxSYdRLRhVmaIMx3T7QAAAM4"]
[Sat Apr 18 22:10:14.806445 2026] [:error] [pid 9970:tid 9992] [client 158.158.124.190:26609] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "aeOQxiYdRLRhVmaIMx3T9QAAANI"]
[Sat Apr 18 22:10:16.428849 2026] [:error] [pid 9970:tid 9980] [client 158.158.124.190:28374] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maxro.php"] [unique_id "aeOQyCYdRLRhVmaIMx3T_QAAAMY"]
[Sat Apr 18 22:10:18.898111 2026] [:error] [pid 34290:tid 34323] [client 158.158.124.190:13581] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aeOQyhqX6WpmmAXOBi8ovQAAAcQ"]
[Sat Apr 18 22:10:20.059382 2026] [:error] [pid 34290:tid 34335] [client 158.158.124.190:28372] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aeOQzBqX6WpmmAXOBi8ovgAAAdA"]
[Sat Apr 18 22:10:20.834293 2026] [:error] [pid 32647:tid 32667] [client 158.158.124.190:12743] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aeOQzEkxooM0iRo6e54tKgAAAhE"]
[Sat Apr 18 22:10:22.503603 2026] [:error] [pid 9970:tid 9982] [client 158.158.124.190:13614] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aeOQziYdRLRhVmaIMx3UAAAAAMg"]
[Sat Apr 18 22:10:24.070132 2026] [:error] [pid 9970:tid 9979] [client 158.158.124.190:1114] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "aeOQ0CYdRLRhVmaIMx3UAgAAAMU"]
[Sat Apr 18 22:10:24.724484 2026] [:error] [pid 9970:tid 9985] [client 158.158.124.190:1106] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "aeOQ0CYdRLRhVmaIMx3UBAAAAMs"]
[Sat Apr 18 22:10:25.875059 2026] [:error] [pid 32678:tid 32712] [client 158.158.124.190:28370] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "aeOQ0RUlAXU_ZWUu5y8JNgAAAoU"]
[Sat Apr 18 22:10:26.974326 2026] [:error] [pid 32677:tid 32682] [client 158.158.124.190:54317] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "aeOQ0hngmUE3LdC-wP7qRAAAAkI"]
[Sat Apr 18 22:10:27.560214 2026] [:error] [pid 34288:tid 34309] [client 158.158.124.190:28739] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeOQ0-TIiy__PtiLmpnbJgAAAZE"]
[Sat Apr 18 22:10:28.837763 2026] [:error] [pid 32677:tid 32700] [client 158.158.124.190:13600] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeOQ1BngmUE3LdC-wP7qSgAAAlQ"]
[Sat Apr 18 22:10:29.631714 2026] [:error] [pid 9970:tid 9998] [client 158.158.124.190:12760] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeOQ1SYdRLRhVmaIMx3UBwAAANg"]
[Sat Apr 18 22:10:30.375634 2026] [:error] [pid 9865:tid 9960] [client 158.158.124.190:41040] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "aeOQ1qzb5knECIY-C-iaMQAAAJc"]
[Sat Apr 18 22:10:31.251560 2026] [:error] [pid 9863:tid 9894] [client 158.158.124.190:26614] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "aeOQ1zjjiypiFrTucbLWXQAAABU"]
[Sat Apr 18 22:10:32.134350 2026] [:error] [pid 13023:tid 13049] [client 158.158.124.190:1918] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "aeOQ2P1e7hG8DAeABB8v9AAAARg"]
[Sat Apr 18 22:10:32.937682 2026] [:error] [pid 13023:tid 13039] [client 158.158.124.190:16535] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "aeOQ2P1e7hG8DAeABB8v9gAAAQ4"]
[Sat Apr 18 22:10:33.826610 2026] [:error] [pid 13023:tid 13040] [client 158.158.124.190:12748] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/areak1.php"] [unique_id "aeOQ2f1e7hG8DAeABB8v_AAAAQ8"]
[Sat Apr 18 22:10:34.783783 2026] [:error] [pid 9970:tid 9997] [client 158.158.124.190:31448] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "aeOQ2iYdRLRhVmaIMx3UCwAAANc"]
[Sat Apr 18 22:10:36.705641 2026] [:error] [pid 32678:tid 32730] [client 158.158.124.190:26582] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "aeOQ3BUlAXU_ZWUu5y8JOAAAApc"]
[Sat Apr 18 22:10:38.234006 2026] [:error] [pid 13023:tid 13044] [client 158.158.124.190:14303] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "aeOQ3v1e7hG8DAeABB8wBwAAARM"]
[Sat Apr 18 22:10:38.969982 2026] [:error] [pid 9970:tid 9995] [client 158.158.124.190:26617] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "aeOQ3iYdRLRhVmaIMx3UFwAAANU"]
[Sat Apr 18 22:10:40.171977 2026] [:error] [pid 32678:tid 32726] [client 158.158.124.190:28376] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "aeOQ4BUlAXU_ZWUu5y8JOwAAApM"]
[Sat Apr 18 22:10:41.217599 2026] [:error] [pid 9970:tid 9990] [client 158.158.124.190:31461] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "aeOQ4SYdRLRhVmaIMx3UHQAAANA"]
[Sat Apr 18 22:10:43.996716 2026] [:error] [pid 32677:tid 32687] [client 158.158.124.190:24972] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "aeOQ4xngmUE3LdC-wP7qTwAAAkc"]
[Sat Apr 18 22:10:45.175029 2026] [:error] [pid 9865:tid 9937] [client 158.158.124.190:27923] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tiny2.php"] [unique_id "aeOQ5azb5knECIY-C-iaRAAAAIA"]
[Sat Apr 18 22:10:45.877893 2026] [:error] [pid 9864:tid 9928] [client 158.158.124.190:12795] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeOQ5YCFeowknfXHM7ks1QAAAFY"]
[Sat Apr 18 22:10:47.194993 2026] [:error] [pid 9865:tid 9952] [client 158.158.124.190:16530] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeOQ56zb5knECIY-C-iaRgAAAI8"]
[Sat Apr 18 22:10:48.528869 2026] [:error] [pid 32677:tid 32681] [client 158.158.124.190:16557] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeOQ6BngmUE3LdC-wP7qUwAAAkE"]
[Sat Apr 18 22:10:49.458468 2026] [:error] [pid 9864:tid 9914] [client 158.158.124.190:27918] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeOQ6YCFeowknfXHM7ks3QAAAEg"]
[Sat Apr 18 22:10:50.115345 2026] [:error] [pid 9864:tid 9909] [client 158.158.124.190:12759] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "aeOQ6oCFeowknfXHM7ks3gAAAEQ"]
[Sat Apr 18 22:10:51.070429 2026] [:error] [pid 13023:tid 13040] [client 158.158.124.190:13609] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "aeOQ6_1e7hG8DAeABB8wHQAAAQ8"]
[Sat Apr 18 22:10:51.707146 2026] [:error] [pid 32647:tid 32650] [client 158.158.124.190:31471] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gz.php"] [unique_id "aeOQ60kxooM0iRo6e54tNgAAAgA"]
[Sat Apr 18 22:10:52.457547 2026] [proxy_fcgi:error] [pid 9970:tid 9984] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:52.703202 2026] [proxy_fcgi:error] [pid 9970:tid 9990] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:52.981648 2026] [proxy_fcgi:error] [pid 9970:tid 9993] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:53.375081 2026] [proxy_fcgi:error] [pid 9970:tid 9983] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:53.629568 2026] [proxy_fcgi:error] [pid 9970:tid 9987] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:53.975538 2026] [proxy_fcgi:error] [pid 9970:tid 9980] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:54.231477 2026] [proxy_fcgi:error] [pid 9970:tid 9995] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:54.572614 2026] [proxy_fcgi:error] [pid 9970:tid 9976] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:54.828436 2026] [proxy_fcgi:error] [pid 9970:tid 9989] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:55.076014 2026] [proxy_fcgi:error] [pid 9970:tid 9991] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:55.327250 2026] [proxy_fcgi:error] [pid 9970:tid 9986] [client 158.158.124.190:1115] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 22:10:55.570355 2026] [:error] [pid 9970:tid 9997] [client 158.158.124.190:1115] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "aeOQ7yYdRLRhVmaIMx3UQQAAANc"]
[Sat Apr 18 22:10:56.263642 2026] [:error] [pid 9864:tid 9923] [client 158.158.124.190:28721] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "aeOQ8ICFeowknfXHM7ks5AAAAFE"]
[Sat Apr 18 22:10:56.949680 2026] [:error] [pid 9864:tid 9905] [client 158.158.124.190:46936] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "aeOQ8ICFeowknfXHM7ks5QAAAEA"]
[Sat Apr 18 22:10:57.566687 2026] [:error] [pid 9864:tid 9914] [client 158.158.124.190:1886] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws84.php"] [unique_id "aeOQ8YCFeowknfXHM7ks5wAAAEg"]
[Sat Apr 18 22:10:58.192412 2026] [:error] [pid 34290:tid 34331] [client 158.158.124.190:1770] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "aeOQ8hqX6WpmmAXOBi8oygAAAcw"]
[Sat Apr 18 22:10:59.020517 2026] [:error] [pid 9970:tid 9980] [client 158.158.124.190:1090] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "aeOQ8yYdRLRhVmaIMx3UQwAAAMY"]
[Sat Apr 18 22:10:59.714188 2026] [:error] [pid 9970:tid 9976] [client 158.158.124.190:17663] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "aeOQ8yYdRLRhVmaIMx3URQAAAMI"]
[Sat Apr 18 22:11:01.433398 2026] [:error] [pid 9970:tid 9984] [client 158.158.124.190:46947] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws61.php"] [unique_id "aeOQ9SYdRLRhVmaIMx3USwAAAMo"]
[Sat Apr 18 22:11:02.261325 2026] [:error] [pid 9863:tid 9897] [client 158.158.124.190:24975] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "aeOQ9jjjiypiFrTucbLWYwAAABg"]
[Sat Apr 18 22:11:02.920976 2026] [:error] [pid 13023:tid 13026] [client 158.158.124.190:1245] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "aeOQ9v1e7hG8DAeABB8wLwAAAQE"]
[Sat Apr 18 22:11:03.593907 2026] [:error] [pid 13023:tid 13047] [client 158.158.124.190:29002] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "aeOQ9_1e7hG8DAeABB8wMwAAARY"]
[Sat Apr 18 22:11:04.238862 2026] [:error] [pid 13023:tid 13045] [client 158.158.124.190:1128] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp-image.php"] [unique_id "aeOQ-P1e7hG8DAeABB8wNgAAARQ"]
[Sat Apr 18 23:04:44.990269 2026] [proxy_fcgi:error] [pid 13023:tid 13037] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:45.373125 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:45.927742 2026] [proxy_fcgi:error] [pid 13023:tid 13029] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:46.238888 2026] [proxy_fcgi:error] [pid 13023:tid 13031] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:46.523530 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:46.835155 2026] [proxy_fcgi:error] [pid 13023:tid 13027] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:47.137446 2026] [proxy_fcgi:error] [pid 13023:tid 13040] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:47.463702 2026] [proxy_fcgi:error] [pid 13023:tid 13035] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:47.779288 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:48.134159 2026] [proxy_fcgi:error] [pid 13023:tid 13032] [client 20.215.249.162:13305] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:04:48.455834 2026] [:error] [pid 13023:tid 13025] [client 20.215.249.162:13305] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "aeOdkP1e7hG8DAeABB9HRgAAAQA"]
[Sat Apr 18 23:04:49.294887 2026] [:error] [pid 34290:tid 34322] [client 20.215.249.162:32890] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "aeOdkRqX6WpmmAXOBi8uSQAAAcM"]
[Sat Apr 18 23:04:51.436119 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:32888] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "aeOdkyYdRLRhVmaIMx3ncgAAANg"]
[Sat Apr 18 23:04:52.544319 2026] [:error] [pid 9865:tid 9943] [client 20.215.249.162:38508] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/eursi.php"] [unique_id "aeOdlKzb5knECIY-C-ioLAAAAIY"]
[Sat Apr 18 23:04:54.127002 2026] [:error] [pid 9864:tid 9915] [client 20.215.249.162:21710] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gkojz.php"] [unique_id "aeOdloCFeowknfXHM7k0ewAAAEk"]
[Sat Apr 18 23:04:57.518427 2026] [:error] [pid 9970:tid 9981] [client 20.215.249.162:1249] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gkojz.php"] [unique_id "aeOdmSYdRLRhVmaIMx3ngwAAAMc"]
[Sat Apr 18 23:05:00.094755 2026] [:error] [pid 9970:tid 9980] [client 20.215.249.162:23240] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gkojz.php"] [unique_id "aeOdnCYdRLRhVmaIMx3njgAAAMY"]
[Sat Apr 18 23:05:02.704968 2026] [:error] [pid 32678:tid 32730] [client 20.215.249.162:25295] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gkojz.php"] [unique_id "aeOdnhUlAXU_ZWUu5y8VeQAAApc"]
[Sat Apr 18 23:05:05.789080 2026] [:error] [pid 9970:tid 9989] [client 20.215.249.162:21278] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/isvqf.php"] [unique_id "aeOdoSYdRLRhVmaIMx3nogAAAM8"]
[Sat Apr 18 23:05:06.797881 2026] [:error] [pid 32678:tid 32711] [client 20.215.249.162:21730] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/isvqf.php"] [unique_id "aeOdohUlAXU_ZWUu5y8VfgAAAoQ"]
[Sat Apr 18 23:05:08.447032 2026] [:error] [pid 9970:tid 9996] [client 20.215.249.162:29074] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/isvqf.php"] [unique_id "aeOdpCYdRLRhVmaIMx3nqQAAANY"]
[Sat Apr 18 23:05:10.079369 2026] [:error] [pid 9863:tid 9894] [client 20.215.249.162:29654] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/isvqf.php"] [unique_id "aeOdpjjjiypiFrTucbLanwAAABU"]
[Sat Apr 18 23:05:16.564464 2026] [:error] [pid 9864:tid 9908] [client 20.215.249.162:13306] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ppxhp.php"] [unique_id "aeOdrICFeowknfXHM7k0gwAAAEM"]
[Sat Apr 18 23:05:18.157183 2026] [:error] [pid 9970:tid 9980] [client 20.215.249.162:1223] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ppxhp.php"] [unique_id "aeOdriYdRLRhVmaIMx3nwwAAAMY"]
[Sat Apr 18 23:05:19.906138 2026] [:error] [pid 9864:tid 9915] [client 20.215.249.162:1533] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ppxhp.php"] [unique_id "aeOdr4CFeowknfXHM7k0hwAAAEk"]
[Sat Apr 18 23:05:24.644369 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:13254] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ppxhp.php"] [unique_id "aeOdtCYdRLRhVmaIMx3n0gAAAMM"]
[Sat Apr 18 23:05:34.144226 2026] [:error] [pid 9865:tid 9939] [client 20.215.249.162:42558] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/whtrq.php"] [unique_id "aeOdvqzb5knECIY-C-ioOAAAAII"]
[Sat Apr 18 23:05:37.440293 2026] [:error] [pid 9863:tid 9886] [client 20.215.249.162:22490] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/whtrq.php"] [unique_id "aeOdwTjjiypiFrTucbLarwAAAA0"]
[Sat Apr 18 23:05:38.628163 2026] [:error] [pid 9970:tid 9985] [client 20.215.249.162:21270] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/whtrq.php"] [unique_id "aeOdwiYdRLRhVmaIMx3n5gAAAMs"]
[Sat Apr 18 23:05:41.932485 2026] [:error] [pid 9864:tid 9927] [client 20.215.249.162:20191] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rkiea.php"] [unique_id "aeOdxYCFeowknfXHM7k0pQAAAFU"]
[Sat Apr 18 23:05:44.785643 2026] [:error] [pid 9864:tid 9905] [client 20.215.249.162:41793] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rkiea.php"] [unique_id "aeOdyICFeowknfXHM7k0rAAAAEA"]
[Sat Apr 18 23:05:49.034446 2026] [proxy_fcgi:error] [pid 9970:tid 9998] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:49.537101 2026] [proxy_fcgi:error] [pid 9970:tid 9995] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:49.995899 2026] [proxy_fcgi:error] [pid 9970:tid 9993] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:50.282188 2026] [proxy_fcgi:error] [pid 9970:tid 9982] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:50.652724 2026] [proxy_fcgi:error] [pid 9970:tid 9980] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:50.969293 2026] [proxy_fcgi:error] [pid 9970:tid 9976] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:51.404717 2026] [proxy_fcgi:error] [pid 9970:tid 9987] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:51.688138 2026] [proxy_fcgi:error] [pid 9970:tid 9986] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:52.134109 2026] [proxy_fcgi:error] [pid 9970:tid 9983] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:52.527506 2026] [proxy_fcgi:error] [pid 9970:tid 9988] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:52.828508 2026] [proxy_fcgi:error] [pid 9970:tid 9996] [client 20.215.249.162:39943] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:05:53.312143 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:39943] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "aeOd0SYdRLRhVmaIMx3oGQAAANM"]
[Sat Apr 18 23:06:01.454039 2026] [:error] [pid 34290:tid 34336] [client 20.215.249.162:59899] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "aeOd2RqX6WpmmAXOBi8uaQAAAdE"]
[Sat Apr 18 23:06:04.070934 2026] [:error] [pid 9970:tid 9997] [client 20.215.249.162:30599] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "aeOd3CYdRLRhVmaIMx3oIwAAANc"]
[Sat Apr 18 23:06:05.058468 2026] [:error] [pid 34288:tid 34300] [client 20.215.249.162:59863] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "aeOd3eTIiy__PtiLmpnfNgAAAYg"]
[Sat Apr 18 23:06:09.377940 2026] [:error] [pid 9863:tid 9886] [client 20.215.249.162:34827] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mjq.php"] [unique_id "aeOd4TjjiypiFrTucbLawgAAAA0"]
[Sat Apr 18 23:06:42.071935 2026] [:error] [pid 9863:tid 9894] [client 20.215.249.162:19177] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zu.php"] [unique_id "aeOeAjjjiypiFrTucbLa3QAAABU"]
[Sat Apr 18 23:07:00.497189 2026] [proxy_fcgi:error] [pid 9865:tid 9954] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:01.490503 2026] [proxy_fcgi:error] [pid 9865:tid 9945] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:01.928048 2026] [proxy_fcgi:error] [pid 9865:tid 9961] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:02.212869 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:02.514499 2026] [proxy_fcgi:error] [pid 9865:tid 9948] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:02.796078 2026] [proxy_fcgi:error] [pid 9865:tid 9946] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:03.087723 2026] [proxy_fcgi:error] [pid 9865:tid 9958] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:03.410008 2026] [proxy_fcgi:error] [pid 9865:tid 9949] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:03.812200 2026] [proxy_fcgi:error] [pid 9865:tid 9944] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:04.153901 2026] [proxy_fcgi:error] [pid 9865:tid 9938] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:04.450191 2026] [proxy_fcgi:error] [pid 9865:tid 9941] [client 20.215.249.162:15321] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:07:05.380832 2026] [:error] [pid 9865:tid 9947] [client 20.215.249.162:15321] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aeOeGazb5knECIY-C-ioZgAAAIo"]
[Sat Apr 18 23:07:06.581111 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:12936] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aeOeGiYdRLRhVmaIMx3obAAAAMM"]
[Sat Apr 18 23:07:08.669951 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:16825] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aeOeHBUlAXU_ZWUu5y8V2wAAAo8"]
[Sat Apr 18 23:07:12.354539 2026] [:error] [pid 32678:tid 32723] [client 20.215.249.162:16817] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aeOeIBUlAXU_ZWUu5y8V5wAAApA"]
[Sat Apr 18 23:07:13.495022 2026] [:error] [pid 9864:tid 9908] [client 20.215.249.162:40025] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aeOeIYCFeowknfXHM7k0zQAAAEM"]
[Sat Apr 18 23:07:14.467480 2026] [:error] [pid 32677:tid 32686] [client 20.215.249.162:14329] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aeOeIhngmUE3LdC-wP7zqQAAAkY"]
[Sat Apr 18 23:07:15.816093 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:31151] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aeOeI6zb5knECIY-C-ioawAAAJc"]
[Sat Apr 18 23:07:17.240140 2026] [:error] [pid 13023:tid 13045] [client 20.215.249.162:19184] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aeOeJf1e7hG8DAeABB9HogAAARQ"]
[Sat Apr 18 23:07:19.113666 2026] [:error] [pid 13023:tid 13046] [client 20.215.249.162:38969] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "aeOeJ_1e7hG8DAeABB9HrQAAARU"]
[Sat Apr 18 23:07:21.137302 2026] [:error] [pid 9865:tid 9938] [client 20.215.249.162:27701] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "aeOeKazb5knECIY-C-iocQAAAIE"]
[Sat Apr 18 23:07:22.379602 2026] [:error] [pid 34288:tid 34307] [client 20.215.249.162:35451] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "aeOeKuTIiy__PtiLmpnfVQAAAY8"]
[Sat Apr 18 23:07:23.992169 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:14050] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kbfr.php"] [unique_id "aeOeK6zb5knECIY-C-iodQAAAJc"]
[Sat Apr 18 23:07:28.652179 2026] [:error] [pid 9863:tid 9884] [client 20.215.249.162:44212] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abhjr.php"] [unique_id "aeOeMDjjiypiFrTucbLa7QAAAAs"]
[Sat Apr 18 23:07:29.689449 2026] [:error] [pid 13023:tid 13045] [client 20.215.249.162:14238] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abhjr.php"] [unique_id "aeOeMf1e7hG8DAeABB9HwQAAARQ"]
[Sat Apr 18 23:07:34.987727 2026] [:error] [pid 9970:tid 9997] [client 20.215.249.162:18160] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abhjr.php"] [unique_id "aeOeNiYdRLRhVmaIMx3ojgAAANc"]
[Sat Apr 18 23:07:36.943941 2026] [:error] [pid 9864:tid 9912] [client 20.215.249.162:27721] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abhjr.php"] [unique_id "aeOeOICFeowknfXHM7k05gAAAEY"]
[Sat Apr 18 23:07:37.725675 2026] [:error] [pid 9864:tid 9907] [client 20.215.249.162:1665] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/anczg.php"] [unique_id "aeOeOYCFeowknfXHM7k05wAAAEI"]
[Sat Apr 18 23:07:39.089677 2026] [:error] [pid 13023:tid 13039] [client 20.215.249.162:32173] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/anczg.php"] [unique_id "aeOeO_1e7hG8DAeABB9H1wAAAQ4"]
[Sat Apr 18 23:07:41.221501 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:22470] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/anczg.php"] [unique_id "aeOePSYdRLRhVmaIMx3onwAAANg"]
[Sat Apr 18 23:07:45.259877 2026] [:error] [pid 32677:tid 32689] [client 20.215.249.162:42551] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/anczg.php"] [unique_id "aeOeQRngmUE3LdC-wP7zywAAAkk"]
[Sat Apr 18 23:07:46.089369 2026] [:error] [pid 9970:tid 9990] [client 20.215.249.162:29115] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ardsw.php"] [unique_id "aeOeQiYdRLRhVmaIMx3opQAAANA"]
[Sat Apr 18 23:07:47.166386 2026] [:error] [pid 32677:tid 32696] [client 20.215.249.162:32860] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ardsw.php"] [unique_id "aeOeQxngmUE3LdC-wP7zzQAAAlA"]
[Sat Apr 18 23:07:48.772691 2026] [:error] [pid 13023:tid 13041] [client 20.215.249.162:57228] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ardsw.php"] [unique_id "aeOeRP1e7hG8DAeABB9H3wAAARA"]
[Sat Apr 18 23:07:50.255702 2026] [:error] [pid 9865:tid 9961] [client 20.215.249.162:18650] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ardsw.php"] [unique_id "aeOeRqzb5knECIY-C-ioigAAAJg"]
[Sat Apr 18 23:08:00.374337 2026] [:error] [pid 9970:tid 9982] [client 20.215.249.162:37922] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atfis.php"] [unique_id "aeOeUCYdRLRhVmaIMx3osgAAAMg"]
[Sat Apr 18 23:08:03.232144 2026] [:error] [pid 34290:tid 34319] [client 20.215.249.162:43089] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atfis.php"] [unique_id "aeOeUxqX6WpmmAXOBi8uqAAAAcA"]
[Sat Apr 18 23:08:07.254759 2026] [proxy_fcgi:error] [pid 9864:tid 9916] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:08.789111 2026] [proxy_fcgi:error] [pid 9864:tid 9921] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:09.055631 2026] [proxy_fcgi:error] [pid 9864:tid 9920] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:09.327579 2026] [proxy_fcgi:error] [pid 9864:tid 9923] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:09.680668 2026] [proxy_fcgi:error] [pid 9864:tid 9915] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:09.981703 2026] [proxy_fcgi:error] [pid 9864:tid 9913] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:10.415817 2026] [proxy_fcgi:error] [pid 9864:tid 9906] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:10.820397 2026] [proxy_fcgi:error] [pid 9864:tid 9928] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:11.183668 2026] [proxy_fcgi:error] [pid 9864:tid 9912] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:11.453679 2026] [proxy_fcgi:error] [pid 9864:tid 9905] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:11.745723 2026] [proxy_fcgi:error] [pid 9864:tid 9908] [client 20.215.249.162:12735] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:08:12.004514 2026] [:error] [pid 9864:tid 9914] [client 20.215.249.162:12735] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dhjqs.php"] [unique_id "aeOeXICFeowknfXHM7k1BAAAAEg"]
[Sat Apr 18 23:08:14.779345 2026] [:error] [pid 32678:tid 32710] [client 20.215.249.162:18076] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dhjqs.php"] [unique_id "aeOeXhUlAXU_ZWUu5y8WCgAAAoM"]
[Sat Apr 18 23:08:21.479100 2026] [:error] [pid 34290:tid 34326] [client 20.215.249.162:20576] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dhjqs.php"] [unique_id "aeOeZRqX6WpmmAXOBi8urwAAAcc"]
[Sat Apr 18 23:08:23.454599 2026] [:error] [pid 9864:tid 9924] [client 20.215.249.162:16116] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dhjqs.php"] [unique_id "aeOeZ4CFeowknfXHM7k1CAAAAFI"]
[Sat Apr 18 23:08:25.617702 2026] [:error] [pid 9970:tid 9980] [client 20.215.249.162:30081] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/diayd.php"] [unique_id "aeOeaSYdRLRhVmaIMx3o8QAAAMY"]
[Sat Apr 18 23:08:28.908584 2026] [:error] [pid 9863:tid 9885] [client 20.215.249.162:13716] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/diayd.php"] [unique_id "aeOebDjjiypiFrTucbLbCgAAAAw"]
[Sat Apr 18 23:08:31.027319 2026] [:error] [pid 9864:tid 9910] [client 20.215.249.162:30092] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/diayd.php"] [unique_id "aeOeb4CFeowknfXHM7k1EgAAAEU"]
[Sat Apr 18 23:08:37.279324 2026] [:error] [pid 9865:tid 9939] [client 20.215.249.162:19807] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/diayd.php"] [unique_id "aeOedazb5knECIY-C-iosgAAAII"]
[Sat Apr 18 23:08:42.442499 2026] [:error] [pid 13023:tid 13040] [client 20.215.249.162:57883] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dljpy.php"] [unique_id "aeOeev1e7hG8DAeABB9IJwAAAQ8"]
[Sat Apr 18 23:08:44.208860 2026] [:error] [pid 13023:tid 13032] [client 20.215.249.162:21363] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dljpy.php"] [unique_id "aeOefP1e7hG8DAeABB9IKwAAAQc"]
[Sat Apr 18 23:08:48.376860 2026] [:error] [pid 34288:tid 34298] [client 20.215.249.162:19763] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dljpy.php"] [unique_id "aeOegOTIiy__PtiLmpnfcAAAAYY"]
[Sat Apr 18 23:08:53.815734 2026] [:error] [pid 34290:tid 34325] [client 20.215.249.162:35908] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dqagu.php"] [unique_id "aeOehRqX6WpmmAXOBi8utgAAAcY"]
[Sat Apr 18 23:08:55.825457 2026] [:error] [pid 9865:tid 9941] [client 20.215.249.162:1759] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dqagu.php"] [unique_id "aeOeh6zb5knECIY-C-iowAAAAIQ"]
[Sat Apr 18 23:08:59.462349 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:1290] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dqagu.php"] [unique_id "aeOeiyYdRLRhVmaIMx3pHwAAANM"]
[Sat Apr 18 23:09:25.456370 2026] [proxy_fcgi:error] [pid 9865:tid 9958] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:25.720854 2026] [proxy_fcgi:error] [pid 9865:tid 9960] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:26.016554 2026] [proxy_fcgi:error] [pid 9865:tid 9955] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:26.274894 2026] [proxy_fcgi:error] [pid 9865:tid 9942] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:26.679330 2026] [proxy_fcgi:error] [pid 9865:tid 9951] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:27.103306 2026] [proxy_fcgi:error] [pid 9865:tid 9961] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:27.369748 2026] [proxy_fcgi:error] [pid 9865:tid 9954] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:27.996727 2026] [proxy_fcgi:error] [pid 9865:tid 9952] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:28.288231 2026] [proxy_fcgi:error] [pid 9865:tid 9956] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:28.562298 2026] [proxy_fcgi:error] [pid 9865:tid 9937] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:28.827754 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 20.215.249.162:17036] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:09:29.328681 2026] [:error] [pid 9865:tid 9950] [client 20.215.249.162:17036] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gedim.php"] [unique_id "aeOeqazb5knECIY-C-io2wAAAI0"]
[Sat Apr 18 23:09:31.508803 2026] [:error] [pid 9865:tid 9951] [client 20.215.249.162:35901] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gedim.php"] [unique_id "aeOeq6zb5knECIY-C-io4AAAAI4"]
[Sat Apr 18 23:09:33.675717 2026] [:error] [pid 9970:tid 9985] [client 20.215.249.162:24854] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gedim.php"] [unique_id "aeOerSYdRLRhVmaIMx3pOAAAAMs"]
[Sat Apr 18 23:09:40.997155 2026] [:error] [pid 9970:tid 9981] [client 20.215.249.162:35871] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gedim.php"] [unique_id "aeOetCYdRLRhVmaIMx3pUwAAAMc"]
[Sat Apr 18 23:09:43.826970 2026] [:error] [pid 32677:tid 32702] [client 20.215.249.162:16569] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibano.php"] [unique_id "aeOetxngmUE3LdC-wP7z8QAAAlY"]
[Sat Apr 18 23:09:46.812284 2026] [:error] [pid 9970:tid 9996] [client 20.215.249.162:35859] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibano.php"] [unique_id "aeOeuiYdRLRhVmaIMx3pbAAAANY"]
[Sat Apr 18 23:09:52.715199 2026] [:error] [pid 9864:tid 9919] [client 20.215.249.162:13042] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibano.php"] [unique_id "aeOewICFeowknfXHM7k1NAAAAE0"]
[Sat Apr 18 23:09:55.336683 2026] [:error] [pid 32677:tid 32693] [client 20.215.249.162:20135] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ibano.php"] [unique_id "aeOewxngmUE3LdC-wP7z_QAAAk0"]
[Sat Apr 18 23:09:58.370832 2026] [:error] [pid 9865:tid 9954] [client 20.215.249.162:16564] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifrea.php"] [unique_id "aeOexqzb5knECIY-C-ipAwAAAJE"]
[Sat Apr 18 23:10:00.717840 2026] [:error] [pid 9865:tid 9957] [client 20.215.249.162:29581] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifrea.php"] [unique_id "aeOeyKzb5knECIY-C-ipBQAAAJQ"]
[Sat Apr 18 23:10:03.366643 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:27199] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifrea.php"] [unique_id "aeOey6zb5knECIY-C-ipCAAAAJc"]
[Sat Apr 18 23:10:06.115694 2026] [:error] [pid 32678:tid 32713] [client 20.215.249.162:27177] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ifrea.php"] [unique_id "aeOezhUlAXU_ZWUu5y8WPwAAAoY"]
[Sat Apr 18 23:10:09.309669 2026] [:error] [pid 32678:tid 32721] [client 20.215.249.162:44247] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/itlvk.php"] [unique_id "aeOe0RUlAXU_ZWUu5y8WQwAAAo4"]
[Sat Apr 18 23:10:10.121439 2026] [:error] [pid 13023:tid 13031] [client 20.215.249.162:21681] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/itlvk.php"] [unique_id "aeOe0v1e7hG8DAeABB9IcwAAAQY"]
[Sat Apr 18 23:10:11.089847 2026] [:error] [pid 13023:tid 13027] [client 20.215.249.162:21662] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/itlvk.php"] [unique_id "aeOe0_1e7hG8DAeABB9IdgAAAQI"]
[Sat Apr 18 23:10:12.570723 2026] [:error] [pid 32677:tid 32704] [client 20.215.249.162:13543] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/itlvk.php"] [unique_id "aeOe1BngmUE3LdC-wP70BgAAAlg"]
[Sat Apr 18 23:10:14.131557 2026] [:error] [pid 9970:tid 9976] [client 20.215.249.162:22456] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jctyd.php"] [unique_id "aeOe1iYdRLRhVmaIMx3poQAAAMI"]
[Sat Apr 18 23:10:17.487536 2026] [:error] [pid 13023:tid 13044] [client 20.215.249.162:22419] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jctyd.php"] [unique_id "aeOe2f1e7hG8DAeABB9IgAAAARM"]
[Sat Apr 18 23:10:18.734815 2026] [:error] [pid 34290:tid 34320] [client 20.215.249.162:28552] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jctyd.php"] [unique_id "aeOe2hqX6WpmmAXOBi8u2AAAAcE"]
[Sat Apr 18 23:10:21.056150 2026] [:error] [pid 32678:tid 32718] [client 20.215.249.162:18405] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jctyd.php"] [unique_id "aeOe3RUlAXU_ZWUu5y8WUQAAAos"]
[Sat Apr 18 23:10:22.792178 2026] [:error] [pid 9970:tid 9991] [client 20.215.249.162:16575] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtfocpif.php"] [unique_id "aeOe3iYdRLRhVmaIMx3pqgAAANE"]
[Sat Apr 18 23:10:24.349904 2026] [:error] [pid 13023:tid 13029] [client 20.215.249.162:22427] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtfocpif.php"] [unique_id "aeOe4P1e7hG8DAeABB9IjgAAAQQ"]
[Sat Apr 18 23:10:25.720431 2026] [:error] [pid 32678:tid 32729] [client 20.215.249.162:13516] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jtfocpif.php"] [unique_id "aeOe4RUlAXU_ZWUu5y8WUwAAApY"]
[Sat Apr 18 23:10:29.723361 2026] [proxy_fcgi:error] [pid 32677:tid 32700] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:30.011888 2026] [proxy_fcgi:error] [pid 32677:tid 32680] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:30.301843 2026] [proxy_fcgi:error] [pid 32677:tid 32684] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:31.143686 2026] [proxy_fcgi:error] [pid 32677:tid 32698] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:31.666527 2026] [proxy_fcgi:error] [pid 32677:tid 32695] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:31.954759 2026] [proxy_fcgi:error] [pid 32677:tid 32694] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:32.247622 2026] [proxy_fcgi:error] [pid 32677:tid 32696] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:32.690251 2026] [proxy_fcgi:error] [pid 32677:tid 32682] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:33.061513 2026] [proxy_fcgi:error] [pid 32677:tid 32685] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:33.391530 2026] [proxy_fcgi:error] [pid 32677:tid 32681] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:33.917400 2026] [proxy_fcgi:error] [pid 32677:tid 32699] [client 20.215.249.162:57337] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:10:34.212165 2026] [:error] [pid 32677:tid 32702] [client 20.215.249.162:57337] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xbbih.php"] [unique_id "aeOe6hngmUE3LdC-wP70IAAAAlY"]
[Sat Apr 18 23:10:35.043145 2026] [:error] [pid 9863:tid 9897] [client 20.215.249.162:31682] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xbbih.php"] [unique_id "aeOe6zjjiypiFrTucbLbLwAAABg"]
[Sat Apr 18 23:10:36.241966 2026] [:error] [pid 32677:tid 32691] [client 20.215.249.162:26772] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xbbih.php"] [unique_id "aeOe7BngmUE3LdC-wP70IwAAAks"]
[Sat Apr 18 23:10:38.947549 2026] [:error] [pid 32647:tid 32663] [client 20.215.249.162:24506] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xbbih.php"] [unique_id "aeOe7kkxooM0iRo6e540ZAAAAg0"]
[Sat Apr 18 23:10:40.035282 2026] [:error] [pid 32677:tid 32689] [client 20.215.249.162:21648] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xcakx.php"] [unique_id "aeOe8BngmUE3LdC-wP70JwAAAkk"]
[Sat Apr 18 23:10:41.384334 2026] [:error] [pid 32647:tid 32657] [client 20.215.249.162:21656] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xcakx.php"] [unique_id "aeOe8UkxooM0iRo6e540ZgAAAgc"]
[Sat Apr 18 23:10:43.968273 2026] [:error] [pid 9970:tid 9997] [client 20.215.249.162:57312] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xcakx.php"] [unique_id "aeOe8yYdRLRhVmaIMx3pwQAAANc"]
[Sat Apr 18 23:10:44.815192 2026] [:error] [pid 9864:tid 9912] [client 20.215.249.162:23559] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xcakx.php"] [unique_id "aeOe9ICFeowknfXHM7k1TgAAAEY"]
[Sat Apr 18 23:10:46.671558 2026] [:error] [pid 9864:tid 9929] [client 20.215.249.162:23562] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xjgdw.php"] [unique_id "aeOe9oCFeowknfXHM7k1TwAAAFc"]
[Sat Apr 18 23:10:48.493351 2026] [:error] [pid 9863:tid 9882] [client 20.215.249.162:21633] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xjgdw.php"] [unique_id "aeOe-DjjiypiFrTucbLbOQAAAAk"]
[Sat Apr 18 23:10:49.448522 2026] [:error] [pid 32678:tid 32718] [client 20.215.249.162:24498] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xjgdw.php"] [unique_id "aeOe-RUlAXU_ZWUu5y8WXgAAAos"]
[Sat Apr 18 23:10:50.455875 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:22449] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xjgdw.php"] [unique_id "aeOe-iYdRLRhVmaIMx3p0gAAAMM"]
[Sat Apr 18 23:10:53.523823 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:23557] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xopgt.php"] [unique_id "aeOe_SYdRLRhVmaIMx3p3AAAANM"]
[Sat Apr 18 23:10:55.500604 2026] [:error] [pid 9970:tid 9996] [client 20.215.249.162:20867] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xopgt.php"] [unique_id "aeOe_yYdRLRhVmaIMx3p5AAAANY"]
[Sat Apr 18 23:10:59.329739 2026] [:error] [pid 9970:tid 9983] [client 20.215.249.162:26766] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xopgt.php"] [unique_id "aeOfAyYdRLRhVmaIMx3p6wAAAMk"]
[Sat Apr 18 23:11:13.552585 2026] [:error] [pid 32677:tid 32687] [client 20.215.249.162:13199] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsjtz.php"] [unique_id "aeOfERngmUE3LdC-wP70PAAAAkc"]
[Sat Apr 18 23:11:30.737439 2026] [:error] [pid 13023:tid 13048] [client 20.215.249.162:26808] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xsjtz.php"] [unique_id "aeOfIv1e7hG8DAeABB9IwQAAARc"]
[Sat Apr 18 23:11:39.943195 2026] [proxy_fcgi:error] [pid 32678:tid 32714] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:40.668605 2026] [proxy_fcgi:error] [pid 32678:tid 32725] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:40.951938 2026] [proxy_fcgi:error] [pid 32678:tid 32718] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:41.458777 2026] [proxy_fcgi:error] [pid 32678:tid 32717] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:41.770771 2026] [proxy_fcgi:error] [pid 32678:tid 32722] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:42.059635 2026] [proxy_fcgi:error] [pid 32678:tid 32707] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:42.344314 2026] [proxy_fcgi:error] [pid 32678:tid 32709] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:42.664981 2026] [proxy_fcgi:error] [pid 32678:tid 32711] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:42.946880 2026] [proxy_fcgi:error] [pid 32678:tid 32710] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:43.234508 2026] [proxy_fcgi:error] [pid 32678:tid 32723] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:43.902742 2026] [proxy_fcgi:error] [pid 32678:tid 32730] [client 20.215.249.162:31117] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:11:44.203011 2026] [:error] [pid 32678:tid 32714] [client 20.215.249.162:31117] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOfMBUlAXU_ZWUu5y8WmgAAAoc"]
[Sat Apr 18 23:11:47.497414 2026] [:error] [pid 9970:tid 9989] [client 20.215.249.162:12777] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOfMyYdRLRhVmaIMx3qNwAAAM8"]
[Sat Apr 18 23:11:49.046986 2026] [:error] [pid 32678:tid 32731] [client 20.215.249.162:31147] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOfNRUlAXU_ZWUu5y8WogAAApg"]
[Sat Apr 18 23:11:51.167507 2026] [:error] [pid 9865:tid 9950] [client 20.215.249.162:1424] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOfN6zb5knECIY-C-ipSwAAAI0"]
[Sat Apr 18 23:11:52.277561 2026] [:error] [pid 9865:tid 9953] [client 20.215.249.162:1441] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/l10n.php"] [unique_id "aeOfOKzb5knECIY-C-ipUQAAAJA"]
[Sat Apr 18 23:11:53.662295 2026] [:error] [pid 9863:tid 9885] [client 20.215.249.162:30180] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/l10n.php"] [unique_id "aeOfOTjjiypiFrTucbLbTwAAAAw"]
[Sat Apr 18 23:11:54.612244 2026] [:error] [pid 32677:tid 32686] [client 20.215.249.162:43741] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/l10n.php"] [unique_id "aeOfOhngmUE3LdC-wP70XAAAAkY"]
[Sat Apr 18 23:11:56.981584 2026] [:error] [pid 32678:tid 32709] [client 20.215.249.162:13975] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/l10n.php"] [unique_id "aeOfPBUlAXU_ZWUu5y8WsAAAAoI"]
[Sat Apr 18 23:11:59.573723 2026] [:error] [pid 9970:tid 9984] [client 20.215.249.162:13959] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abpxrnwe.php"] [unique_id "aeOfPyYdRLRhVmaIMx3qSwAAAMo"]
[Sat Apr 18 23:12:01.110221 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:33287] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abpxrnwe.php"] [unique_id "aeOfQazb5knECIY-C-ipcQAAAJc"]
[Sat Apr 18 23:12:03.630489 2026] [:error] [pid 32647:tid 32663] [client 20.215.249.162:27237] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abpxrnwe.php"] [unique_id "aeOfQ0kxooM0iRo6e540fgAAAg0"]
[Sat Apr 18 23:12:05.448656 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:34340] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abpxrnwe.php"] [unique_id "aeOfRSYdRLRhVmaIMx3qXQAAANM"]
[Sat Apr 18 23:12:16.882331 2026] [:error] [pid 9865:tid 9959] [client 20.215.249.162:1852] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abalqdol.php"] [unique_id "aeOfUKzb5knECIY-C-ipfgAAAJY"]
[Sat Apr 18 23:12:24.272580 2026] [:error] [pid 9865:tid 9938] [client 20.215.249.162:33321] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aqotrjkg.php"] [unique_id "aeOfWKzb5knECIY-C-ipiQAAAIE"]
[Sat Apr 18 23:12:25.513822 2026] [:error] [pid 32677:tid 32696] [client 20.215.249.162:1641] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aqotrjkg.php"] [unique_id "aeOfWRngmUE3LdC-wP70agAAAlA"]
[Sat Apr 18 23:12:27.221935 2026] [:error] [pid 13023:tid 13036] [client 20.215.249.162:27680] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aqotrjkg.php"] [unique_id "aeOfW_1e7hG8DAeABB9JGQAAAQs"]
[Sat Apr 18 23:12:28.310554 2026] [:error] [pid 9970:tid 9974] [client 20.215.249.162:37457] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aqotrjkg.php"] [unique_id "aeOfXCYdRLRhVmaIMx3qrAAAAMA"]
[Sat Apr 18 23:12:29.399913 2026] [:error] [pid 13023:tid 13035] [client 20.215.249.162:37458] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhigtouj.php"] [unique_id "aeOfXf1e7hG8DAeABB9JIwAAAQo"]
[Sat Apr 18 23:12:35.400498 2026] [:error] [pid 13023:tid 13034] [client 20.215.249.162:1628] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhigtouj.php"] [unique_id "aeOfY_1e7hG8DAeABB9JOgAAAQk"]
[Sat Apr 18 23:12:45.205505 2026] [proxy_fcgi:error] [pid 34288:tid 34297] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:45.861977 2026] [proxy_fcgi:error] [pid 34288:tid 34307] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:46.144700 2026] [proxy_fcgi:error] [pid 34288:tid 34306] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:46.429762 2026] [proxy_fcgi:error] [pid 34288:tid 34298] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:46.712526 2026] [proxy_fcgi:error] [pid 34288:tid 34304] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:46.994665 2026] [proxy_fcgi:error] [pid 34288:tid 34316] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:47.282879 2026] [proxy_fcgi:error] [pid 34288:tid 34313] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:47.587433 2026] [proxy_fcgi:error] [pid 34288:tid 34294] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:47.967186 2026] [proxy_fcgi:error] [pid 34288:tid 34310] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:49.169526 2026] [proxy_fcgi:error] [pid 34288:tid 34309] [client 20.215.249.162:28137] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:12:50.558132 2026] [:error] [pid 34288:tid 34293] [client 20.215.249.162:28137] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gh.php"] [unique_id "aeOfcuTIiy__PtiLmpnfugAAAYE"]
[Sat Apr 18 23:12:52.453844 2026] [:error] [pid 9970:tid 9989] [client 20.215.249.162:1355] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gh.php"] [unique_id "aeOfdCYdRLRhVmaIMx3q4gAAAM8"]
[Sat Apr 18 23:12:58.141178 2026] [:error] [pid 9970:tid 9983] [client 20.215.249.162:25798] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gh.php"] [unique_id "aeOfeiYdRLRhVmaIMx3q6QAAAMk"]
[Sat Apr 18 23:13:03.223984 2026] [:error] [pid 9864:tid 9918] [client 20.215.249.162:41733] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gh.php"] [unique_id "aeOff4CFeowknfXHM7k1mAAAAEw"]
[Sat Apr 18 23:13:05.023091 2026] [:error] [pid 34288:tid 34302] [client 20.215.249.162:19838] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeOfgeTIiy__PtiLmpnfvgAAAYo"]
[Sat Apr 18 23:13:06.641829 2026] [:error] [pid 32678:tid 32710] [client 20.215.249.162:17854] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeOfghUlAXU_ZWUu5y8W0AAAAoM"]
[Sat Apr 18 23:13:08.839448 2026] [:error] [pid 13023:tid 13031] [client 20.215.249.162:37395] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeOfhP1e7hG8DAeABB9JXgAAAQY"]
[Sat Apr 18 23:13:13.471897 2026] [:error] [pid 13023:tid 13048] [client 20.215.249.162:30113] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aeOfif1e7hG8DAeABB9JZwAAARc"]
[Sat Apr 18 23:13:15.330715 2026] [:error] [pid 32677:tid 32691] [client 20.215.249.162:29124] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aeOfixngmUE3LdC-wP70kgAAAks"]
[Sat Apr 18 23:13:21.890441 2026] [:error] [pid 13023:tid 13036] [client 20.215.249.162:30140] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aeOfkf1e7hG8DAeABB9JfQAAAQs"]
[Sat Apr 18 23:13:24.834597 2026] [:error] [pid 9863:tid 9894] [client 20.215.249.162:41759] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aeOflDjjiypiFrTucbLbZwAAABU"]
[Sat Apr 18 23:13:27.364720 2026] [:error] [pid 32647:tid 32674] [client 20.215.249.162:30118] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aeOfl0kxooM0iRo6e540mwAAAhg"]
[Sat Apr 18 23:13:30.864621 2026] [:error] [pid 34288:tid 34303] [client 20.215.249.162:39548] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xigmltad.php"] [unique_id "aeOfmuTIiy__PtiLmpnfygAAAYs"]
[Sat Apr 18 23:13:32.166909 2026] [:error] [pid 32647:tid 32663] [client 20.215.249.162:30099] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xigmltad.php"] [unique_id "aeOfnEkxooM0iRo6e540nwAAAg0"]
[Sat Apr 18 23:13:33.230867 2026] [:error] [pid 13023:tid 13036] [client 20.215.249.162:1272] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xigmltad.php"] [unique_id "aeOfnf1e7hG8DAeABB9JhAAAAQs"]
[Sat Apr 18 23:13:37.554964 2026] [:error] [pid 9864:tid 9930] [client 20.215.249.162:30100] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xigmltad.php"] [unique_id "aeOfoYCFeowknfXHM7k1pgAAAFg"]
[Sat Apr 18 23:13:39.921845 2026] [:error] [pid 9865:tid 9940] [client 20.215.249.162:32250] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "aeOfo6zb5knECIY-C-ip8gAAAIM"]
[Sat Apr 18 23:13:48.103362 2026] [:error] [pid 9970:tid 9989] [client 20.215.249.162:40634] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "aeOfrCYdRLRhVmaIMx3rHwAAAM8"]
[Sat Apr 18 23:13:52.109050 2026] [proxy_fcgi:error] [pid 9864:tid 9926] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:52.391489 2026] [proxy_fcgi:error] [pid 9864:tid 9912] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:52.651779 2026] [proxy_fcgi:error] [pid 9864:tid 9915] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:52.925733 2026] [proxy_fcgi:error] [pid 9864:tid 9928] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:53.185641 2026] [proxy_fcgi:error] [pid 9864:tid 9921] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:53.450896 2026] [proxy_fcgi:error] [pid 9864:tid 9910] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:53.733780 2026] [proxy_fcgi:error] [pid 9864:tid 9924] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:53.993111 2026] [proxy_fcgi:error] [pid 9864:tid 9907] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:54.253855 2026] [proxy_fcgi:error] [pid 9864:tid 9927] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:54.515854 2026] [proxy_fcgi:error] [pid 9864:tid 9930] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:54.790332 2026] [proxy_fcgi:error] [pid 9864:tid 9909] [client 20.215.249.162:29108] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:13:55.087493 2026] [:error] [pid 9864:tid 9918] [client 20.215.249.162:29108] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "aeOfs4CFeowknfXHM7k1zgAAAEw"]
[Sat Apr 18 23:13:57.423379 2026] [:error] [pid 32647:tid 32664] [client 20.215.249.162:12730] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "aeOftUkxooM0iRo6e540rAAAAg4"]
[Sat Apr 18 23:13:58.716798 2026] [:error] [pid 34290:tid 34340] [client 20.215.249.162:37960] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "aeOfthqX6WpmmAXOBi8vGwAAAdU"]
[Sat Apr 18 23:14:00.767016 2026] [:error] [pid 13023:tid 13027] [client 20.215.249.162:17313] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wdf.php"] [unique_id "aeOfuP1e7hG8DAeABB9JkwAAAQI"]
[Sat Apr 18 23:14:03.698567 2026] [:error] [pid 9970:tid 9990] [client 20.215.249.162:18615] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aeOfuyYdRLRhVmaIMx3rWgAAANA"]
[Sat Apr 18 23:14:07.336079 2026] [:error] [pid 13023:tid 13026] [client 20.215.249.162:22489] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aeOfv_1e7hG8DAeABB9JngAAAQE"]
[Sat Apr 18 23:14:08.753724 2026] [:error] [pid 13023:tid 13047] [client 20.215.249.162:36865] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aeOfwP1e7hG8DAeABB9JoQAAARY"]
[Sat Apr 18 23:14:10.760368 2026] [:error] [pid 32677:tid 32703] [client 20.215.249.162:32794] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nc4.php"] [unique_id "aeOfwhngmUE3LdC-wP70pwAAAlc"]
[Sat Apr 18 23:14:11.975777 2026] [:error] [pid 9864:tid 9915] [client 20.215.249.162:19374] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aeOfw4CFeowknfXHM7k2BgAAAEk"]
[Sat Apr 18 23:14:13.913794 2026] [:error] [pid 32677:tid 32688] [client 20.215.249.162:37981] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aeOfxRngmUE3LdC-wP70qwAAAkg"]
[Sat Apr 18 23:14:15.114292 2026] [:error] [pid 32677:tid 32691] [client 20.215.249.162:29652] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aeOfxxngmUE3LdC-wP70rwAAAks"]
[Sat Apr 18 23:14:19.660351 2026] [:error] [pid 9970:tid 9976] [client 20.215.249.162:26841] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aeOfyyYdRLRhVmaIMx3rbgAAAMI"]
[Sat Apr 18 23:14:21.157172 2026] [:error] [pid 32678:tid 32711] [client 20.215.249.162:23276] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zyjhr.php"] [unique_id "aeOfzRUlAXU_ZWUu5y8XEQAAAoQ"]
[Sat Apr 18 23:14:23.749181 2026] [:error] [pid 9863:tid 9890] [client 20.215.249.162:17867] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zyjhr.php"] [unique_id "aeOfzzjjiypiFrTucbLbdgAAABE"]
[Sat Apr 18 23:14:25.632005 2026] [:error] [pid 9865:tid 9959] [client 20.215.249.162:23242] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zyjhr.php"] [unique_id "aeOf0azb5knECIY-C-iqAwAAAJY"]
[Sat Apr 18 23:14:27.357409 2026] [:error] [pid 13023:tid 13048] [client 20.215.249.162:31178] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zyjhr.php"] [unique_id "aeOf0_1e7hG8DAeABB9JsAAAARc"]
[Sat Apr 18 23:14:28.725373 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:21251] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b7cdb465.php"] [unique_id "aeOf1BUlAXU_ZWUu5y8XGwAAAo8"]
[Sat Apr 18 23:14:32.362822 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:26834] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b7cdb465.php"] [unique_id "aeOf2CYdRLRhVmaIMx3reAAAANM"]
[Sat Apr 18 23:14:33.492881 2026] [:error] [pid 34288:tid 34306] [client 20.215.249.162:31228] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b7cdb465.php"] [unique_id "aeOf2eTIiy__PtiLmpnf0gAAAY4"]
[Sat Apr 18 23:14:34.261904 2026] [:error] [pid 34288:tid 34294] [client 20.215.249.162:29682] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/b7cdb465.php"] [unique_id "aeOf2uTIiy__PtiLmpnf0wAAAYI"]
[Sat Apr 18 23:14:36.139015 2026] [:error] [pid 9864:tid 9907] [client 20.215.249.162:14371] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123.php"] [unique_id "aeOf3ICFeowknfXHM7k2HgAAAEI"]
[Sat Apr 18 23:14:39.262487 2026] [:error] [pid 9970:tid 9985] [client 20.215.249.162:36986] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123.php"] [unique_id "aeOf3yYdRLRhVmaIMx3rgAAAAMs"]
[Sat Apr 18 23:14:40.785071 2026] [:error] [pid 9970:tid 9993] [client 20.215.249.162:1530] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123.php"] [unique_id "aeOf4CYdRLRhVmaIMx3rgQAAANM"]
[Sat Apr 18 23:14:44.837214 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:36460] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x123.php"] [unique_id "aeOf5BUlAXU_ZWUu5y8XKQAAAo8"]
[Sat Apr 18 23:14:48.896898 2026] [:error] [pid 13023:tid 13034] [client 20.215.249.162:21713] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aeOf6P1e7hG8DAeABB9JygAAAQk"]
[Sat Apr 18 23:14:51.006250 2026] [:error] [pid 9970:tid 9989] [client 20.215.249.162:18684] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aeOf6yYdRLRhVmaIMx3rlAAAAM8"]
[Sat Apr 18 23:14:55.068433 2026] [proxy_fcgi:error] [pid 9864:tid 9923] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:55.327945 2026] [proxy_fcgi:error] [pid 9864:tid 9925] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:55.621444 2026] [proxy_fcgi:error] [pid 9864:tid 9916] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:55.961269 2026] [proxy_fcgi:error] [pid 9864:tid 9912] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:56.418690 2026] [proxy_fcgi:error] [pid 9864:tid 9906] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:56.678489 2026] [proxy_fcgi:error] [pid 9864:tid 9910] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:56.943141 2026] [proxy_fcgi:error] [pid 9864:tid 9930] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:57.256615 2026] [proxy_fcgi:error] [pid 9864:tid 9909] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:57.672004 2026] [proxy_fcgi:error] [pid 9864:tid 9923] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:57.933756 2026] [proxy_fcgi:error] [pid 9864:tid 9925] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:58.207287 2026] [proxy_fcgi:error] [pid 9864:tid 9916] [client 20.215.249.162:38471] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:14:58.519125 2026] [:error] [pid 9864:tid 9922] [client 20.215.249.162:38471] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/camara.php"] [unique_id "aeOf8oCFeowknfXHM7k2SQAAAFA"]
[Sat Apr 18 23:14:59.736329 2026] [:error] [pid 32678:tid 32712] [client 20.215.249.162:13299] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/camara.php"] [unique_id "aeOf8xUlAXU_ZWUu5y8XQQAAAoU"]
[Sat Apr 18 23:15:09.976439 2026] [:error] [pid 32678:tid 32717] [client 20.215.249.162:17566] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/camara.php"] [unique_id "aeOf_RUlAXU_ZWUu5y8XUwAAAoo"]
[Sat Apr 18 23:15:11.020706 2026] [:error] [pid 13023:tid 13041] [client 20.215.249.162:36468] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/camara.php"] [unique_id "aeOf__1e7hG8DAeABB9J5AAAARA"]
[Sat Apr 18 23:15:12.903917 2026] [:error] [pid 32678:tid 32730] [client 20.215.249.162:21716] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assacc.php"] [unique_id "aeOgABUlAXU_ZWUu5y8XVgAAApc"]
[Sat Apr 18 23:15:15.149930 2026] [:error] [pid 32677:tid 32686] [client 20.215.249.162:39978] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assacc.php"] [unique_id "aeOgAxngmUE3LdC-wP700gAAAkY"]
[Sat Apr 18 23:15:21.986953 2026] [:error] [pid 9970:tid 9981] [client 20.215.249.162:21754] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assacc.php"] [unique_id "aeOgCSYdRLRhVmaIMx3rwgAAAMc"]
[Sat Apr 18 23:15:23.729752 2026] [:error] [pid 32677:tid 32692] [client 20.215.249.162:23636] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/assacc.php"] [unique_id "aeOgCxngmUE3LdC-wP703gAAAkw"]
[Sat Apr 18 23:15:25.344781 2026] [:error] [pid 32677:tid 32685] [client 20.215.249.162:24959] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "aeOgDRngmUE3LdC-wP705QAAAkU"]
[Sat Apr 18 23:15:26.730449 2026] [:error] [pid 32677:tid 32693] [client 20.215.249.162:23619] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "aeOgDhngmUE3LdC-wP707gAAAk0"]
[Sat Apr 18 23:15:30.302242 2026] [:error] [pid 32678:tid 32708] [client 20.215.249.162:28662] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "aeOgEhUlAXU_ZWUu5y8XYQAAAoE"]
[Sat Apr 18 23:15:31.484374 2026] [:error] [pid 9865:tid 9955] [client 20.215.249.162:23641] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws83.php"] [unique_id "aeOgE6zb5knECIY-C-iqNQAAAJI"]
[Sat Apr 18 23:15:32.454512 2026] [:error] [pid 9865:tid 9954] [client 20.215.249.162:1069] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aeOgFKzb5knECIY-C-iqNwAAAJE"]
[Sat Apr 18 23:15:42.062893 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:1031] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aeOgHqzb5knECIY-C-iqRQAAAJc"]
[Sat Apr 18 23:15:43.918856 2026] [:error] [pid 13023:tid 13042] [client 20.215.249.162:13458] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aeOgH_1e7hG8DAeABB9KFwAAARE"]
[Sat Apr 18 23:15:46.463513 2026] [:error] [pid 9865:tid 9944] [client 20.215.249.162:36353] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "aeOgIqzb5knECIY-C-iqRwAAAIc"]
[Sat Apr 18 23:15:48.250090 2026] [:error] [pid 9970:tid 9995] [client 20.215.249.162:12938] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/%E3%81%AE.php"] [unique_id "aeOgJCYdRLRhVmaIMx3r_AAAANU"]
[Sat Apr 18 23:15:50.306498 2026] [:error] [pid 34288:tid 34293] [client 20.215.249.162:20970] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/%E3%81%AE.php"] [unique_id "aeOgJuTIiy__PtiLmpnf-QAAAYE"]
[Sat Apr 18 23:15:51.520100 2026] [:error] [pid 9970:tid 9995] [client 20.215.249.162:57977] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/%E3%81%AE.php"] [unique_id "aeOgJyYdRLRhVmaIMx3sDQAAANU"]
[Sat Apr 18 23:16:03.884960 2026] [proxy_fcgi:error] [pid 13023:tid 13038] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:04.171113 2026] [proxy_fcgi:error] [pid 13023:tid 13040] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:04.464867 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:04.751452 2026] [proxy_fcgi:error] [pid 13023:tid 13030] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:05.688870 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:05.997369 2026] [proxy_fcgi:error] [pid 13023:tid 13043] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:06.342153 2026] [proxy_fcgi:error] [pid 13023:tid 13048] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:06.633056 2026] [proxy_fcgi:error] [pid 13023:tid 13040] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:06.948312 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:07.277943 2026] [proxy_fcgi:error] [pid 13023:tid 13046] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:08.085812 2026] [proxy_fcgi:error] [pid 13023:tid 13049] [client 20.215.249.162:15822] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:16:08.366364 2026] [:error] [pid 13023:tid 13032] [client 20.215.249.162:15822] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "aeOgOP1e7hG8DAeABB9KYwAAAQc"]
[Sat Apr 18 23:16:10.215730 2026] [:error] [pid 9970:tid 9992] [client 20.215.249.162:24939] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vaza.php"] [unique_id "aeOgOiYdRLRhVmaIMx3sQAAAANI"]
[Sat Apr 18 23:16:30.626164 2026] [:error] [pid 9970:tid 9992] [client 20.215.249.162:27194] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeOgTiYdRLRhVmaIMx3seQAAANI"]
[Sat Apr 18 23:16:34.169600 2026] [:error] [pid 9970:tid 9987] [client 20.215.249.162:17382] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeOgUiYdRLRhVmaIMx3sjAAAAM0"]
[Sat Apr 18 23:16:36.585865 2026] [:error] [pid 9864:tid 9929] [client 20.215.249.162:17566] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeOgVICFeowknfXHM7k2gAAAAFc"]
[Sat Apr 18 23:16:39.003131 2026] [:error] [pid 9970:tid 9995] [client 20.215.249.162:20497] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeOgVyYdRLRhVmaIMx3sowAAANU"]
[Sat Apr 18 23:16:44.686358 2026] [:error] [pid 32647:tid 32654] [client 20.215.249.162:16079] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeOgXEkxooM0iRo6e5408AAAAgQ"]
[Sat Apr 18 23:16:46.286725 2026] [:error] [pid 13023:tid 13044] [client 20.215.249.162:27758] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeOgXv1e7hG8DAeABB9KmQAAARM"]
[Sat Apr 18 23:16:56.327851 2026] [:error] [pid 9864:tid 9917] [client 20.215.249.162:22431] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "aeOgaICFeowknfXHM7k2ngAAAEs"]
[Sat Apr 18 23:16:59.765313 2026] [:error] [pid 32678:tid 32727] [client 20.215.249.162:31151] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "aeOgaxUlAXU_ZWUu5y8XvgAAApQ"]
[Sat Apr 18 23:17:01.303958 2026] [:error] [pid 9865:tid 9956] [client 20.215.249.162:31153] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "aeOgbazb5knECIY-C-iqnQAAAJM"]
[Sat Apr 18 23:17:03.177850 2026] [:error] [pid 13023:tid 13035] [client 20.215.249.162:16535] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drhunthq.php"] [unique_id "aeOgb_1e7hG8DAeABB9KpgAAAQo"]
[Sat Apr 18 23:17:04.329291 2026] [:error] [pid 9863:tid 9892] [client 20.215.249.162:38917] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "aeOgcDjjiypiFrTucbLbxAAAABM"]
[Sat Apr 18 23:17:06.365862 2026] [:error] [pid 32678:tid 32727] [client 20.215.249.162:38971] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "aeOgchUlAXU_ZWUu5y8XzAAAApQ"]
[Sat Apr 18 23:17:10.899015 2026] [proxy_fcgi:error] [pid 9970:tid 9989] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:11.299603 2026] [proxy_fcgi:error] [pid 9970:tid 9994] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:11.569177 2026] [proxy_fcgi:error] [pid 9970:tid 9998] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:11.836172 2026] [proxy_fcgi:error] [pid 9970:tid 9995] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:12.241417 2026] [proxy_fcgi:error] [pid 9970:tid 9989] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:13.808338 2026] [proxy_fcgi:error] [pid 9970:tid 9995] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:14.325969 2026] [proxy_fcgi:error] [pid 9970:tid 9985] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:14.853964 2026] [proxy_fcgi:error] [pid 9970:tid 9977] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:15.134735 2026] [proxy_fcgi:error] [pid 9970:tid 9984] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:15.397848 2026] [proxy_fcgi:error] [pid 9970:tid 9989] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:16.014982 2026] [proxy_fcgi:error] [pid 9970:tid 9992] [client 20.215.249.162:24862] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:17:16.405374 2026] [:error] [pid 9970:tid 9996] [client 20.215.249.162:24862] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "aeOgfCYdRLRhVmaIMx3tCAAAANY"]
[Sat Apr 18 23:17:26.193333 2026] [:error] [pid 9864:tid 9905] [client 20.215.249.162:24892] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "aeOghoCFeowknfXHM7k2sQAAAEA"]
[Sat Apr 18 23:17:35.711491 2026] [:error] [pid 9863:tid 9884] [client 20.215.249.162:1550] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "aeOgjzjjiypiFrTucbLbzAAAAAs"]
[Sat Apr 18 23:17:36.686084 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:15546] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "aeOgkKzb5knECIY-C-iqrwAAAJc"]
[Sat Apr 18 23:17:40.336794 2026] [:error] [pid 32677:tid 32686] [client 20.215.249.162:15545] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "aeOglBngmUE3LdC-wP71PwAAAkY"]
[Sat Apr 18 23:17:41.290207 2026] [:error] [pid 32677:tid 32688] [client 20.215.249.162:21648] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/baixy.php"] [unique_id "aeOglRngmUE3LdC-wP71SQAAAkg"]
[Sat Apr 18 23:17:44.796634 2026] [:error] [pid 13023:tid 13042] [client 20.215.249.162:27698] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeOgmP1e7hG8DAeABB9LAQAAARE"]
[Sat Apr 18 23:17:46.744727 2026] [:error] [pid 13023:tid 13033] [client 20.215.249.162:19393] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeOgmv1e7hG8DAeABB9LDgAAAQg"]
[Sat Apr 18 23:17:49.549955 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:33355] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "aeOgnRUlAXU_ZWUu5y8YCgAAAo8"]
[Sat Apr 18 23:17:58.498753 2026] [:error] [pid 9865:tid 9958] [client 20.215.249.162:17838] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "aeOgpqzb5knECIY-C-iqvAAAAJU"]
[Sat Apr 18 23:18:02.440833 2026] [:error] [pid 9863:tid 9873] [client 20.215.249.162:19723] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "aeOgqjjjiypiFrTucbLb0wAAAAA"]
[Sat Apr 18 23:18:04.036644 2026] [:error] [pid 9864:tid 9909] [client 20.215.249.162:17844] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "aeOgrICFeowknfXHM7k24QAAAEQ"]
[Sat Apr 18 23:18:06.556552 2026] [:error] [pid 32677:tid 32680] [client 20.215.249.162:28128] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/torsa1.php"] [unique_id "aeOgrhngmUE3LdC-wP71cQAAAkA"]
[Sat Apr 18 23:18:07.836520 2026] [:error] [pid 32647:tid 32654] [client 20.215.249.162:14405] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "aeOgr0kxooM0iRo6e541FAAAAgQ"]
[Sat Apr 18 23:18:09.678523 2026] [:error] [pid 9865:tid 9956] [client 20.215.249.162:17821] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "aeOgsazb5knECIY-C-iq1gAAAJM"]
[Sat Apr 18 23:18:12.454817 2026] [:error] [pid 13023:tid 13038] [client 20.215.249.162:1751] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "aeOgtP1e7hG8DAeABB9LOgAAAQ0"]
[Sat Apr 18 23:18:14.503618 2026] [:error] [pid 13023:tid 13047] [client 20.215.249.162:41750] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bjfl.php"] [unique_id "aeOgtv1e7hG8DAeABB9LRAAAARY"]
[Sat Apr 18 23:18:15.738244 2026] [:error] [pid 32678:tid 32709] [client 20.215.249.162:35330] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buc.php"] [unique_id "aeOgtxUlAXU_ZWUu5y8YOQAAAoI"]
[Sat Apr 18 23:18:16.648854 2026] [proxy_fcgi:error] [pid 32647:tid 32666] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:16.911321 2026] [proxy_fcgi:error] [pid 32647:tid 32659] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:17.178980 2026] [proxy_fcgi:error] [pid 32647:tid 32654] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:17.548541 2026] [proxy_fcgi:error] [pid 32647:tid 32664] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:17.807725 2026] [proxy_fcgi:error] [pid 32647:tid 32663] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:18.068893 2026] [proxy_fcgi:error] [pid 32647:tid 32660] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:18.548027 2026] [proxy_fcgi:error] [pid 32647:tid 32670] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:18.818089 2026] [proxy_fcgi:error] [pid 32647:tid 32672] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:19.081511 2026] [proxy_fcgi:error] [pid 32647:tid 32661] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:19.351657 2026] [proxy_fcgi:error] [pid 32647:tid 32655] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:19.632868 2026] [proxy_fcgi:error] [pid 32647:tid 32665] [client 20.215.249.162:43064] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:18:19.891334 2026] [:error] [pid 32647:tid 32667] [client 20.215.249.162:43064] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeOgu0kxooM0iRo6e541JwAAAhE"]
[Sat Apr 18 23:18:21.364174 2026] [:error] [pid 32678:tid 32726] [client 20.215.249.162:34334] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeOgvRUlAXU_ZWUu5y8YPwAAApM"]
[Sat Apr 18 23:18:23.402648 2026] [:error] [pid 32678:tid 32711] [client 20.215.249.162:43026] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeOgvxUlAXU_ZWUu5y8YQQAAAoQ"]
[Sat Apr 18 23:18:24.727352 2026] [:error] [pid 34290:tid 34334] [client 20.215.249.162:38405] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aeOgwBqX6WpmmAXOBi8vgQAAAc8"]
[Sat Apr 18 23:18:27.188611 2026] [:error] [pid 9865:tid 9955] [client 20.215.249.162:43023] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lowpr.php"] [unique_id "aeOgw6zb5knECIY-C-iq4gAAAJI"]
[Sat Apr 18 23:18:43.724164 2026] [:error] [pid 9865:tid 9944] [client 20.215.249.162:43103] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aeOg06zb5knECIY-C-iq7wAAAIc"]
[Sat Apr 18 23:18:45.097272 2026] [:error] [pid 9970:tid 9994] [client 20.215.249.162:57870] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aeOg1SYdRLRhVmaIMx3tsgAAANQ"]
[Sat Apr 18 23:18:46.830657 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:59879] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aeOg1qzb5knECIY-C-iq_gAAAJc"]
[Sat Apr 18 23:18:48.371906 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:13510] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wtiiy.php"] [unique_id "aeOg2CYdRLRhVmaIMx3tuQAAAMM"]
[Sat Apr 18 23:18:49.589696 2026] [:error] [pid 9970:tid 9975] [client 20.215.249.162:33836] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aeOg2SYdRLRhVmaIMx3tzAAAAME"]
[Sat Apr 18 23:18:52.468191 2026] [:error] [pid 9865:tid 9957] [client 20.215.249.162:43114] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aeOg3Kzb5knECIY-C-irCQAAAJQ"]
[Sat Apr 18 23:18:53.638353 2026] [:error] [pid 9863:tid 9884] [client 20.215.249.162:1344] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aeOg3TjjiypiFrTucbLb4gAAAAs"]
[Sat Apr 18 23:18:55.895833 2026] [:error] [pid 32678:tid 32723] [client 20.215.249.162:41254] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aeOg3xUlAXU_ZWUu5y8YVwAAApA"]
[Sat Apr 18 23:18:57.523520 2026] [:error] [pid 9864:tid 9910] [client 20.215.249.162:57859] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "aeOg4YCFeowknfXHM7k3BQAAAEU"]
[Sat Apr 18 23:18:59.584302 2026] [:error] [pid 9970:tid 9990] [client 20.215.249.162:30135] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "aeOg4yYdRLRhVmaIMx3t7QAAANA"]
[Sat Apr 18 23:19:00.691790 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:1407] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "aeOg5CYdRLRhVmaIMx3t_QAAANg"]
[Sat Apr 18 23:19:02.046982 2026] [:error] [pid 32678:tid 32719] [client 20.215.249.162:30102] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "aeOg5hUlAXU_ZWUu5y8YXAAAAow"]
[Sat Apr 18 23:19:03.149906 2026] [:error] [pid 13023:tid 13033] [client 20.215.249.162:43091] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aeOg5_1e7hG8DAeABB9LpAAAAQg"]
[Sat Apr 18 23:19:05.439906 2026] [:error] [pid 9970:tid 9986] [client 20.215.249.162:15280] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aeOg6SYdRLRhVmaIMx3uHQAAAMw"]
[Sat Apr 18 23:19:06.864902 2026] [:error] [pid 9863:tid 9883] [client 20.215.249.162:40583] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aeOg6jjjiypiFrTucbLb8AAAAAo"]
[Sat Apr 18 23:19:08.378712 2026] [:error] [pid 9970:tid 9994] [client 20.215.249.162:59873] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/csv.php"] [unique_id "aeOg7CYdRLRhVmaIMx3uJgAAANQ"]
[Sat Apr 18 23:19:10.736732 2026] [:error] [pid 32677:tid 32703] [client 20.215.249.162:40593] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "aeOg7hngmUE3LdC-wP71qwAAAlc"]
[Sat Apr 18 23:19:11.950733 2026] [:error] [pid 9865:tid 9944] [client 20.215.249.162:35954] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "aeOg76zb5knECIY-C-irJgAAAIc"]
[Sat Apr 18 23:19:13.134943 2026] [:error] [pid 9865:tid 9957] [client 20.215.249.162:43085] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "aeOg8azb5knECIY-C-irKgAAAJQ"]
[Sat Apr 18 23:19:15.407286 2026] [:error] [pid 9970:tid 9982] [client 20.215.249.162:15090] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sale.php"] [unique_id "aeOg8yYdRLRhVmaIMx3uPQAAAMg"]
[Sat Apr 18 23:19:16.639577 2026] [:error] [pid 9864:tid 9920] [client 20.215.249.162:38971] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa21.php"] [unique_id "aeOg9ICFeowknfXHM7k3EAAAAE4"]
[Sat Apr 18 23:19:19.108374 2026] [proxy_fcgi:error] [pid 32678:tid 32719] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:19.460289 2026] [proxy_fcgi:error] [pid 32678:tid 32712] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:19.897311 2026] [proxy_fcgi:error] [pid 32678:tid 32718] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:20.218621 2026] [proxy_fcgi:error] [pid 32678:tid 32720] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:20.502074 2026] [proxy_fcgi:error] [pid 32678:tid 32717] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:20.787138 2026] [proxy_fcgi:error] [pid 32678:tid 32727] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:21.154391 2026] [proxy_fcgi:error] [pid 32678:tid 32726] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:21.439479 2026] [proxy_fcgi:error] [pid 32678:tid 32725] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:21.763925 2026] [proxy_fcgi:error] [pid 32678:tid 32723] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:22.221424 2026] [proxy_fcgi:error] [pid 32678:tid 32721] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:22.583513 2026] [proxy_fcgi:error] [pid 32678:tid 32711] [client 20.215.249.162:20593] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:19:22.918779 2026] [:error] [pid 32678:tid 32729] [client 20.215.249.162:20593] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "aeOg-hUlAXU_ZWUu5y8YdAAAApY"]
[Sat Apr 18 23:19:24.862076 2026] [:error] [pid 9865:tid 9942] [client 20.215.249.162:1108] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "aeOg_Kzb5knECIY-C-irOwAAAIU"]
[Sat Apr 18 23:19:25.865344 2026] [:error] [pid 9865:tid 9961] [client 20.215.249.162:18875] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "aeOg_azb5knECIY-C-irPgAAAJg"]
[Sat Apr 18 23:19:29.062863 2026] [:error] [pid 13023:tid 13043] [client 20.215.249.162:17872] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2ksm17n.php"] [unique_id "aeOhAf1e7hG8DAeABB9L1AAAARI"]
[Sat Apr 18 23:19:35.543411 2026] [:error] [pid 9865:tid 9958] [client 20.215.249.162:1107] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "aeOhB6zb5knECIY-C-irSQAAAJU"]
[Sat Apr 18 23:19:37.500556 2026] [:error] [pid 9970:tid 9996] [client 20.215.249.162:1902] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "aeOhCSYdRLRhVmaIMx3uawAAANY"]
[Sat Apr 18 23:19:39.715193 2026] [:error] [pid 9970:tid 9983] [client 20.215.249.162:26793] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "aeOhCyYdRLRhVmaIMx3udgAAAMk"]
[Sat Apr 18 23:19:42.637873 2026] [:error] [pid 13023:tid 13049] [client 20.215.249.162:18583] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "aeOhDv1e7hG8DAeABB9L6QAAARg"]
[Sat Apr 18 23:19:46.141834 2026] [:error] [pid 32678:tid 32725] [client 20.215.249.162:18068] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeOhEhUlAXU_ZWUu5y8YfgAAApI"]
[Sat Apr 18 23:19:49.127856 2026] [:error] [pid 9863:tid 9880] [client 20.215.249.162:14338] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeOhFTjjiypiFrTucbLcAAAAAAc"]
[Sat Apr 18 23:19:54.254257 2026] [:error] [pid 9970:tid 9994] [client 20.215.249.162:13264] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeOhGiYdRLRhVmaIMx3umwAAANQ"]
[Sat Apr 18 23:19:56.017463 2026] [:error] [pid 32678:tid 32731] [client 20.215.249.162:26756] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "aeOhHBUlAXU_ZWUu5y8YiAAAApg"]
[Sat Apr 18 23:19:57.145502 2026] [:error] [pid 9970:tid 9988] [client 20.215.249.162:38524] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeOhHSYdRLRhVmaIMx3uoQAAAM4"]
[Sat Apr 18 23:20:02.726914 2026] [:error] [pid 9865:tid 9950] [client 20.215.249.162:1496] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeOhIqzb5knECIY-C-irYQAAAI0"]
[Sat Apr 18 23:20:08.496916 2026] [:error] [pid 32678:tid 32712] [client 20.215.249.162:33864] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeOhKBUlAXU_ZWUu5y8YjgAAAoU"]
[Sat Apr 18 23:20:10.056509 2026] [:error] [pid 32678:tid 32727] [client 20.215.249.162:17307] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeOhKhUlAXU_ZWUu5y8YkgAAApQ"]
[Sat Apr 18 23:20:11.420841 2026] [:error] [pid 9864:tid 9908] [client 20.215.249.162:29637] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsgdjkl.php"] [unique_id "aeOhK4CFeowknfXHM7k3IQAAAEM"]
[Sat Apr 18 23:20:12.282029 2026] [:error] [pid 34288:tid 34313] [client 20.215.249.162:29652] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsgdjkl.php"] [unique_id "aeOhLOTIiy__PtiLmpngTgAAAZU"]
[Sat Apr 18 23:20:13.686741 2026] [:error] [pid 34288:tid 34293] [client 20.215.249.162:1503] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsgdjkl.php"] [unique_id "aeOhLeTIiy__PtiLmpngUAAAAYE"]
[Sat Apr 18 23:20:15.495034 2026] [:error] [pid 13023:tid 13048] [client 20.215.249.162:25751] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsgdjkl.php"] [unique_id "aeOhL_1e7hG8DAeABB9MCAAAARc"]
[Sat Apr 18 23:20:16.897823 2026] [:error] [pid 9864:tid 9915] [client 20.215.249.162:34926] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aeOhMICFeowknfXHM7k3KAAAAEk"]
[Sat Apr 18 23:20:19.340411 2026] [:error] [pid 34288:tid 34314] [client 20.215.249.162:36407] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aeOhM-TIiy__PtiLmpngVgAAAZY"]
[Sat Apr 18 23:20:24.804649 2026] [proxy_fcgi:error] [pid 9865:tid 9956] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:25.453278 2026] [proxy_fcgi:error] [pid 9865:tid 9939] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:25.865129 2026] [proxy_fcgi:error] [pid 9865:tid 9946] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:26.215061 2026] [proxy_fcgi:error] [pid 9865:tid 9952] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:26.734422 2026] [proxy_fcgi:error] [pid 9865:tid 9949] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:27.075186 2026] [proxy_fcgi:error] [pid 9865:tid 9937] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:27.338370 2026] [proxy_fcgi:error] [pid 9865:tid 9944] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:27.768765 2026] [proxy_fcgi:error] [pid 9865:tid 9945] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:28.128943 2026] [proxy_fcgi:error] [pid 9865:tid 9960] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:28.387977 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:28.682884 2026] [proxy_fcgi:error] [pid 9865:tid 9950] [client 20.215.249.162:17322] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:20:28.938368 2026] [:error] [pid 9865:tid 9943] [client 20.215.249.162:17322] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aeOhPKzb5knECIY-C-irhQAAAIY"]
[Sat Apr 18 23:20:30.872009 2026] [:error] [pid 32678:tid 32725] [client 20.215.249.162:17554] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aeOhPhUlAXU_ZWUu5y8YpwAAApI"]
[Sat Apr 18 23:20:34.458011 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:57257] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aeOhQiYdRLRhVmaIMx3uvwAAAMM"]
[Sat Apr 18 23:20:35.251741 2026] [:error] [pid 9970:tid 9990] [client 20.215.249.162:25308] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/CDX2.php"] [unique_id "aeOhQyYdRLRhVmaIMx3uwAAAANA"]
[Sat Apr 18 23:20:36.148215 2026] [:error] [pid 34290:tid 34327] [client 20.215.249.162:34893] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aeOhRBqX6WpmmAXOBi8vqAAAAcg"]
[Sat Apr 18 23:20:46.953318 2026] [:error] [pid 9970:tid 9976] [client 20.215.249.162:25301] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/only.php"] [unique_id "aeOhTiYdRLRhVmaIMx3u1AAAAMI"]
[Sat Apr 18 23:21:15.788421 2026] [:error] [pid 34288:tid 34305] [client 20.215.249.162:24954] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "aeOha-TIiy__PtiLmpngaAAAAY0"]
[Sat Apr 18 23:21:17.945457 2026] [:error] [pid 34288:tid 34306] [client 20.215.249.162:16088] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "aeOhbeTIiy__PtiLmpngcAAAAY4"]
[Sat Apr 18 23:21:20.196147 2026] [:error] [pid 34290:tid 34336] [client 20.215.249.162:34839] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "aeOhcBqX6WpmmAXOBi8vtwAAAdE"]
[Sat Apr 18 23:21:22.629259 2026] [:error] [pid 32647:tid 32656] [client 20.215.249.162:16871] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Geforce.php"] [unique_id "aeOhckkxooM0iRo6e541gAAAAgY"]
[Sat Apr 18 23:21:23.400371 2026] [:error] [pid 32677:tid 32691] [client 20.215.249.162:22410] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "aeOhcxngmUE3LdC-wP713gAAAks"]
[Sat Apr 18 23:21:26.289055 2026] [:error] [pid 9865:tid 9959] [client 20.215.249.162:16068] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dichku.php"] [unique_id "aeOhdqzb5knECIY-C-irvwAAAJY"]
[Sat Apr 18 23:21:28.021897 2026] [proxy_fcgi:error] [pid 9865:tid 9957] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:28.441813 2026] [proxy_fcgi:error] [pid 9865:tid 9951] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:28.931100 2026] [proxy_fcgi:error] [pid 9865:tid 9941] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:29.207755 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:29.657950 2026] [proxy_fcgi:error] [pid 9865:tid 9939] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:29.919661 2026] [proxy_fcgi:error] [pid 9865:tid 9953] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:30.245002 2026] [proxy_fcgi:error] [pid 9865:tid 9940] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:30.504355 2026] [proxy_fcgi:error] [pid 9865:tid 9946] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:30.830203 2026] [proxy_fcgi:error] [pid 9865:tid 9949] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:31.093200 2026] [proxy_fcgi:error] [pid 9865:tid 9952] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:31.393671 2026] [proxy_fcgi:error] [pid 9865:tid 9937] [client 20.215.249.162:22426] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:21:31.715226 2026] [:error] [pid 9865:tid 9955] [client 20.215.249.162:22426] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ynjli.php"] [unique_id "aeOhe6zb5knECIY-C-ir1gAAAJI"]
[Sat Apr 18 23:21:33.272661 2026] [:error] [pid 13023:tid 13037] [client 20.215.249.162:40047] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ynjli.php"] [unique_id "aeOhff1e7hG8DAeABB9MNwAAAQw"]
[Sat Apr 18 23:21:34.921681 2026] [:error] [pid 9865:tid 9945] [client 20.215.249.162:38976] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ynjli.php"] [unique_id "aeOhfqzb5knECIY-C-ir1wAAAIg"]
[Sat Apr 18 23:21:36.316900 2026] [:error] [pid 32678:tid 32718] [client 20.215.249.162:12752] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ynjli.php"] [unique_id "aeOhgBUlAXU_ZWUu5y8Y4wAAAos"]
[Sat Apr 18 23:21:38.049320 2026] [:error] [pid 9864:tid 9925] [client 20.215.249.162:16882] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOhgoCFeowknfXHM7k3aAAAAFM"]
[Sat Apr 18 23:21:39.439904 2026] [:error] [pid 13023:tid 13028] [client 20.215.249.162:22428] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOhg_1e7hG8DAeABB9MTwAAAQM"]
[Sat Apr 18 23:21:40.811146 2026] [:error] [pid 13023:tid 13032] [client 20.215.249.162:14078] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOhhP1e7hG8DAeABB9MUQAAAQc"]
[Sat Apr 18 23:21:42.487042 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:16838] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "aeOhhqzb5knECIY-C-ir4gAAAJc"]
[Sat Apr 18 23:21:43.463634 2026] [:error] [pid 32677:tid 32702] [client 20.215.249.162:13755] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rogsa.php"] [unique_id "aeOhhxngmUE3LdC-wP715wAAAlY"]
[Sat Apr 18 23:21:45.739377 2026] [:error] [pid 13023:tid 13038] [client 20.215.249.162:40055] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rogsa.php"] [unique_id "aeOhif1e7hG8DAeABB9MXgAAAQ0"]
[Sat Apr 18 23:21:46.660289 2026] [:error] [pid 9864:tid 9920] [client 20.215.249.162:17397] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rogsa.php"] [unique_id "aeOhioCFeowknfXHM7k3eAAAAE4"]
[Sat Apr 18 23:21:50.463581 2026] [:error] [pid 9865:tid 9958] [client 20.215.249.162:24945] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rogsa.php"] [unique_id "aeOhjqzb5knECIY-C-ir7gAAAJU"]
[Sat Apr 18 23:21:51.658989 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:14214] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aeOhjyYdRLRhVmaIMx3vRAAAANg"]
[Sat Apr 18 23:21:52.488838 2026] [:error] [pid 13023:tid 13028] [client 20.215.249.162:13750] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aeOhkP1e7hG8DAeABB9MbAAAAQM"]
[Sat Apr 18 23:21:53.786990 2026] [:error] [pid 9864:tid 9921] [client 20.215.249.162:16841] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aeOhkYCFeowknfXHM7k3egAAAE8"]
[Sat Apr 18 23:21:54.826844 2026] [:error] [pid 9970:tid 9997] [client 20.215.249.162:34837] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aeOhkiYdRLRhVmaIMx3vTwAAANc"]
[Sat Apr 18 23:21:58.860085 2026] [:error] [pid 13023:tid 13028] [client 20.215.249.162:57948] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aeOhlv1e7hG8DAeABB9MeAAAAQM"]
[Sat Apr 18 23:22:03.554940 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:20535] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aeOhmxUlAXU_ZWUu5y8Y7AAAAo8"]
[Sat Apr 18 23:22:05.467461 2026] [:error] [pid 9864:tid 9917] [client 20.215.249.162:20541] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aeOhnYCFeowknfXHM7k3hAAAAEs"]
[Sat Apr 18 23:22:07.616329 2026] [:error] [pid 32678:tid 32711] [client 20.215.249.162:20506] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new3.php"] [unique_id "aeOhnxUlAXU_ZWUu5y8Y8QAAAoQ"]
[Sat Apr 18 23:22:10.134070 2026] [:error] [pid 32678:tid 32714] [client 20.215.249.162:57966] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aeOhohUlAXU_ZWUu5y8Y9QAAAoc"]
[Sat Apr 18 23:22:11.389638 2026] [:error] [pid 9970:tid 9991] [client 20.215.249.162:17547] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aeOhoyYdRLRhVmaIMx3vZAAAANE"]
[Sat Apr 18 23:22:13.724724 2026] [:error] [pid 32677:tid 32692] [client 20.215.249.162:22829] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aeOhpRngmUE3LdC-wP72DQAAAkw"]
[Sat Apr 18 23:22:15.946243 2026] [:error] [pid 13023:tid 13033] [client 20.215.249.162:20966] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0yellow.php"] [unique_id "aeOhp_1e7hG8DAeABB9MjQAAAQg"]
[Sat Apr 18 23:22:19.250725 2026] [:error] [pid 9864:tid 9916] [client 20.215.249.162:22834] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aeOhq4CFeowknfXHM7k3jQAAAEo"]
[Sat Apr 18 23:22:20.887949 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:34930] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aeOhrCYdRLRhVmaIMx3vggAAANg"]
[Sat Apr 18 23:22:22.915509 2026] [:error] [pid 32678:tid 32729] [client 20.215.249.162:43686] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aeOhrhUlAXU_ZWUu5y8Y_wAAApY"]
[Sat Apr 18 23:22:33.625694 2026] [proxy_fcgi:error] [pid 9865:tid 9950] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:34.170167 2026] [proxy_fcgi:error] [pid 9865:tid 9944] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:34.473578 2026] [proxy_fcgi:error] [pid 9865:tid 9949] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:34.746718 2026] [proxy_fcgi:error] [pid 9865:tid 9953] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:35.037459 2026] [proxy_fcgi:error] [pid 9865:tid 9958] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:35.301181 2026] [proxy_fcgi:error] [pid 9865:tid 9960] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:35.560767 2026] [proxy_fcgi:error] [pid 9865:tid 9943] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:36.370565 2026] [proxy_fcgi:error] [pid 9865:tid 9961] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:36.629864 2026] [proxy_fcgi:error] [pid 9865:tid 9959] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:36.889164 2026] [proxy_fcgi:error] [pid 9865:tid 9945] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:37.212047 2026] [proxy_fcgi:error] [pid 9865:tid 9948] [client 20.215.249.162:23187] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:22:37.468987 2026] [:error] [pid 9865:tid 9937] [client 20.215.249.162:23187] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "aeOhvazb5knECIY-C-isJAAAAIA"]
[Sat Apr 18 23:22:39.335597 2026] [:error] [pid 9864:tid 9910] [client 20.215.249.162:57861] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "aeOhv4CFeowknfXHM7k3oQAAAEU"]
[Sat Apr 18 23:22:41.500606 2026] [:error] [pid 13023:tid 13045] [client 20.215.249.162:1129] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "aeOhwf1e7hG8DAeABB9MqQAAARQ"]
[Sat Apr 18 23:22:43.964113 2026] [:error] [pid 9970:tid 9997] [client 20.215.249.162:15243] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "aeOhwyYdRLRhVmaIMx3vnQAAANc"]
[Sat Apr 18 23:22:45.761497 2026] [:error] [pid 9970:tid 9981] [client 20.215.249.162:57281] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hanyatersenyum.php"] [unique_id "aeOhxSYdRLRhVmaIMx3vpwAAAMc"]
[Sat Apr 18 23:22:50.010204 2026] [:error] [pid 32677:tid 32693] [client 20.215.249.162:59902] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hanyatersenyum.php"] [unique_id "aeOhyhngmUE3LdC-wP72GwAAAk0"]
[Sat Apr 18 23:22:53.011323 2026] [:error] [pid 32677:tid 32680] [client 20.215.249.162:18416] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hanyatersenyum.php"] [unique_id "aeOhzRngmUE3LdC-wP72HgAAAkA"]
[Sat Apr 18 23:22:55.432638 2026] [:error] [pid 32647:tid 32669] [client 20.215.249.162:40606] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hanyatersenyum.php"] [unique_id "aeOhz0kxooM0iRo6e541pwAAAhM"]
[Sat Apr 18 23:22:59.762421 2026] [:error] [pid 9864:tid 9925] [client 20.215.249.162:13519] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "aeOh04CFeowknfXHM7k3rQAAAFM"]
[Sat Apr 18 23:23:01.848339 2026] [:error] [pid 32647:tid 32668] [client 20.215.249.162:25854] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "aeOh1UkxooM0iRo6e541rAAAAhI"]
[Sat Apr 18 23:23:04.089433 2026] [:error] [pid 32647:tid 32654] [client 20.215.249.162:34348] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "aeOh2EkxooM0iRo6e541rQAAAgQ"]
[Sat Apr 18 23:23:05.688596 2026] [:error] [pid 13023:tid 13043] [client 20.215.249.162:16277] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/161dfd072f.php"] [unique_id "aeOh2f1e7hG8DAeABB9MvAAAARI"]
[Sat Apr 18 23:23:11.173179 2026] [:error] [pid 9970:tid 9978] [client 20.215.249.162:19454] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/maintura.php"] [unique_id "aeOh3yYdRLRhVmaIMx3v4AAAAMQ"]
[Sat Apr 18 23:23:45.607933 2026] [proxy_fcgi:error] [pid 13023:tid 13028] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:45.881414 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:46.229581 2026] [proxy_fcgi:error] [pid 13023:tid 13027] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:46.521327 2026] [proxy_fcgi:error] [pid 13023:tid 13025] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:46.866199 2026] [proxy_fcgi:error] [pid 13023:tid 13047] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:47.248245 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:47.514952 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:47.774112 2026] [proxy_fcgi:error] [pid 13023:tid 13032] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:48.191183 2026] [proxy_fcgi:error] [pid 13023:tid 13035] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:48.450045 2026] [proxy_fcgi:error] [pid 13023:tid 13042] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:48.781307 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:27700] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:23:49.285789 2026] [:error] [pid 13023:tid 13027] [client 20.215.249.162:27700] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "aeOiBf1e7hG8DAeABB9NCQAAAQI"]
[Sat Apr 18 23:23:52.193808 2026] [:error] [pid 9970:tid 9983] [client 20.215.249.162:27674] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "aeOiCCYdRLRhVmaIMx3wIQAAAMk"]
[Sat Apr 18 23:23:54.436313 2026] [:error] [pid 32647:tid 32674] [client 20.215.249.162:19738] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "aeOiCkkxooM0iRo6e541ygAAAhg"]
[Sat Apr 18 23:23:55.943767 2026] [:error] [pid 9970:tid 9975] [client 20.215.249.162:21644] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albrt.php"] [unique_id "aeOiCyYdRLRhVmaIMx3wLwAAAME"]
[Sat Apr 18 23:23:56.989603 2026] [:error] [pid 9970:tid 9990] [client 20.215.249.162:19719] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aeOiDCYdRLRhVmaIMx3wMgAAANA"]
[Sat Apr 18 23:23:59.191360 2026] [:error] [pid 9865:tid 9952] [client 20.215.249.162:13216] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aeOiD6zb5knECIY-C-isQQAAAI8"]
[Sat Apr 18 23:24:00.530436 2026] [:error] [pid 13023:tid 13038] [client 20.215.249.162:21358] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aeOiEP1e7hG8DAeABB9NFAAAAQ0"]
[Sat Apr 18 23:24:01.946024 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:15578] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hhxc.php"] [unique_id "aeOiESYdRLRhVmaIMx3wQwAAAMM"]
[Sat Apr 18 23:24:04.139596 2026] [:error] [pid 9865:tid 9945] [client 20.215.249.162:19718] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "aeOiFKzb5knECIY-C-isRwAAAIg"]
[Sat Apr 18 23:24:04.850704 2026] [:error] [pid 9865:tid 9942] [client 20.215.249.162:15593] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "aeOiFKzb5knECIY-C-isSQAAAIU"]
[Sat Apr 18 23:24:06.541044 2026] [:error] [pid 34290:tid 34321] [client 20.215.249.162:13221] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "aeOiFhqX6WpmmAXOBi8v2AAAAcI"]
[Sat Apr 18 23:24:08.940275 2026] [:error] [pid 32678:tid 32717] [client 20.215.249.162:42507] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9EaklzMysJ.php"] [unique_id "aeOiGBUlAXU_ZWUu5y8ZXQAAAoo"]
[Sat Apr 18 23:24:12.361352 2026] [:error] [pid 34290:tid 34320] [client 20.215.249.162:22875] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "aeOiHBqX6WpmmAXOBi8v3gAAAcE"]
[Sat Apr 18 23:24:13.788716 2026] [:error] [pid 34290:tid 34326] [client 20.215.249.162:15521] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "aeOiHRqX6WpmmAXOBi8v4QAAAcc"]
[Sat Apr 18 23:24:15.117747 2026] [:error] [pid 32678:tid 32715] [client 20.215.249.162:15530] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "aeOiHxUlAXU_ZWUu5y8ZYQAAAog"]
[Sat Apr 18 23:24:15.802014 2026] [:error] [pid 9865:tid 9952] [client 20.215.249.162:16623] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2nzyHnOkEg.php"] [unique_id "aeOiH6zb5knECIY-C-isVgAAAI8"]
[Sat Apr 18 23:24:23.504244 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:40701] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "aeOiJ6zb5knECIY-C-isXwAAAJc"]
[Sat Apr 18 23:24:24.858618 2026] [:error] [pid 32678:tid 32712] [client 20.215.249.162:27662] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "aeOiKBUlAXU_ZWUu5y8ZcAAAAoU"]
[Sat Apr 18 23:24:26.990068 2026] [:error] [pid 9863:tid 9895] [client 20.215.249.162:24488] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "aeOiKjjjiypiFrTucbLcPQAAABY"]
[Sat Apr 18 23:24:28.398931 2026] [:error] [pid 32647:tid 32653] [client 20.215.249.162:22883] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "aeOiLEkxooM0iRo6e541zgAAAgM"]
[Sat Apr 18 23:24:30.307325 2026] [:error] [pid 32647:tid 32657] [client 20.215.249.162:35439] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "aeOiLkkxooM0iRo6e5411QAAAgc"]
[Sat Apr 18 23:24:31.558764 2026] [:error] [pid 32647:tid 32650] [client 20.215.249.162:19713] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "aeOiL0kxooM0iRo6e5412gAAAgA"]
[Sat Apr 18 23:24:33.057249 2026] [:error] [pid 9864:tid 9912] [client 20.215.249.162:21672] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "aeOiMYCFeowknfXHM7k4AQAAAEY"]
[Sat Apr 18 23:24:34.597721 2026] [:error] [pid 34288:tid 34306] [client 20.215.249.162:22887] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HLA-dd.php"] [unique_id "aeOiMuTIiy__PtiLmpngtAAAAY4"]
[Sat Apr 18 23:24:36.683126 2026] [:error] [pid 34290:tid 34327] [client 20.215.249.162:22882] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "aeOiNBqX6WpmmAXOBi8v5wAAAcg"]
[Sat Apr 18 23:24:38.003286 2026] [:error] [pid 9865:tid 9959] [client 20.215.249.162:22899] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "aeOiNqzb5knECIY-C-isYwAAAJY"]
[Sat Apr 18 23:24:39.419062 2026] [:error] [pid 9970:tid 9978] [client 20.215.249.162:22869] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "aeOiNyYdRLRhVmaIMx3wiwAAAMQ"]
[Sat Apr 18 23:24:41.986582 2026] [:error] [pid 9865:tid 9952] [client 20.215.249.162:16626] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "aeOiOazb5knECIY-C-isZwAAAI8"]
[Sat Apr 18 23:24:43.651515 2026] [:error] [pid 9864:tid 9909] [client 20.215.249.162:35453] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/SS72_kKKjT.php"] [unique_id "aeOiO4CFeowknfXHM7k4DQAAAEQ"]
[Sat Apr 18 23:24:54.726842 2026] [proxy_fcgi:error] [pid 13023:tid 13029] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:55.355001 2026] [proxy_fcgi:error] [pid 13023:tid 13048] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:55.675288 2026] [proxy_fcgi:error] [pid 13023:tid 13049] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:56.051615 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:56.398217 2026] [proxy_fcgi:error] [pid 13023:tid 13046] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:56.714974 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:57.041314 2026] [proxy_fcgi:error] [pid 13023:tid 13043] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:57.301531 2026] [proxy_fcgi:error] [pid 13023:tid 13047] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:57.560454 2026] [proxy_fcgi:error] [pid 13023:tid 13027] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:57.918905 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:58.354064 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 20.215.249.162:35424] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:24:58.986833 2026] [:error] [pid 13023:tid 13030] [client 20.215.249.162:35424] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3akp.php"] [unique_id "aeOiSv1e7hG8DAeABB9NYwAAAQU"]
[Sat Apr 18 23:25:02.728029 2026] [:error] [pid 9864:tid 9914] [client 20.215.249.162:24481] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3akp.php"] [unique_id "aeOiToCFeowknfXHM7k4HAAAAEg"]
[Sat Apr 18 23:25:04.293844 2026] [:error] [pid 9864:tid 9917] [client 20.215.249.162:37928] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3akp.php"] [unique_id "aeOiUICFeowknfXHM7k4IAAAAEs"]
[Sat Apr 18 23:25:07.622482 2026] [:error] [pid 32647:tid 32650] [client 20.215.249.162:45103] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3akp.php"] [unique_id "aeOiU0kxooM0iRo6e5417AAAAgA"]
[Sat Apr 18 23:25:19.403437 2026] [:error] [pid 32677:tid 32698] [client 20.215.249.162:19726] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sde.php"] [unique_id "aeOiXxngmUE3LdC-wP72fAAAAlI"]
[Sat Apr 18 23:25:20.109760 2026] [:error] [pid 34290:tid 34323] [client 20.215.249.162:1740] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sde.php"] [unique_id "aeOiYBqX6WpmmAXOBi8v_wAAAcQ"]
[Sat Apr 18 23:25:21.282718 2026] [:error] [pid 34288:tid 34304] [client 20.215.249.162:19715] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sde.php"] [unique_id "aeOiYeTIiy__PtiLmpngzQAAAYw"]
[Sat Apr 18 23:25:23.918064 2026] [:error] [pid 32678:tid 32730] [client 20.215.249.162:31152] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "aeOiYxUlAXU_ZWUu5y8ZpgAAApc"]
[Sat Apr 18 23:25:25.081506 2026] [:error] [pid 34288:tid 34307] [client 20.215.249.162:37943] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "aeOiZeTIiy__PtiLmpng1QAAAY8"]
[Sat Apr 18 23:25:26.163670 2026] [:error] [pid 9865:tid 9950] [client 20.215.249.162:44262] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "aeOiZqzb5knECIY-C-isiQAAAI0"]
[Sat Apr 18 23:25:27.269676 2026] [:error] [pid 9864:tid 9930] [client 20.215.249.162:24466] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdn3.php"] [unique_id "aeOiZ4CFeowknfXHM7k4LAAAAFg"]
[Sat Apr 18 23:25:30.175075 2026] [:error] [pid 9865:tid 9960] [client 20.215.249.162:15610] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOiaqzb5knECIY-C-isjAAAAJc"]
[Sat Apr 18 23:25:30.914335 2026] [:error] [pid 9865:tid 9956] [client 20.215.249.162:31110] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOiaqzb5knECIY-C-iskwAAAJM"]
[Sat Apr 18 23:25:33.746461 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:27224] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOibSYdRLRhVmaIMx3wtgAAANg"]
[Sat Apr 18 23:25:35.079104 2026] [:error] [pid 9865:tid 9947] [client 20.215.249.162:35447] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aeOib6zb5knECIY-C-ismwAAAIo"]
[Sat Apr 18 23:25:37.132718 2026] [:error] [pid 9863:tid 9888] [client 20.215.249.162:19722] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "aeOicTjjiypiFrTucbLcaQAAAA8"]
[Sat Apr 18 23:25:38.373200 2026] [:error] [pid 9970:tid 9983] [client 20.215.249.162:16608] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "aeOiciYdRLRhVmaIMx3wuQAAAMk"]
[Sat Apr 18 23:25:39.354090 2026] [:error] [pid 34288:tid 34314] [client 20.215.249.162:31112] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-220.php"] [unique_id "aeOic-TIiy__PtiLmpng2wAAAZY"]
[Sat Apr 18 23:26:25.810930 2026] [proxy_fcgi:error] [pid 13023:tid 13047] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:26.381767 2026] [proxy_fcgi:error] [pid 13023:tid 13038] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:26.696546 2026] [proxy_fcgi:error] [pid 13023:tid 13030] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:27.306862 2026] [proxy_fcgi:error] [pid 13023:tid 13048] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:27.589834 2026] [proxy_fcgi:error] [pid 13023:tid 13026] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:27.913196 2026] [proxy_fcgi:error] [pid 13023:tid 13043] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:28.241390 2026] [proxy_fcgi:error] [pid 13023:tid 13032] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:28.615767 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:29.222377 2026] [proxy_fcgi:error] [pid 13023:tid 13038] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:29.506419 2026] [proxy_fcgi:error] [pid 13023:tid 13033] [client 20.215.249.162:57961] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:26:29.788360 2026] [:error] [pid 13023:tid 13040] [client 20.215.249.162:57961] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oco.php"] [unique_id "aeOipf1e7hG8DAeABB9NtwAAAQ8"]
[Sat Apr 18 23:26:31.654771 2026] [:error] [pid 9865:tid 9958] [client 20.215.249.162:39019] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oco.php"] [unique_id "aeOip6zb5knECIY-C-iszAAAAJU"]
[Sat Apr 18 23:26:33.077479 2026] [:error] [pid 13023:tid 13031] [client 20.215.249.162:15809] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oco.php"] [unique_id "aeOiqf1e7hG8DAeABB9NvwAAAQY"]
[Sat Apr 18 23:26:34.668051 2026] [:error] [pid 13023:tid 13026] [client 20.215.249.162:23649] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oco.php"] [unique_id "aeOiqv1e7hG8DAeABB9NxgAAAQE"]
[Sat Apr 18 23:26:35.612846 2026] [:error] [pid 13023:tid 13032] [client 20.215.249.162:22136] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogr.php"] [unique_id "aeOiq_1e7hG8DAeABB9NyAAAAQc"]
[Sat Apr 18 23:26:37.740119 2026] [:error] [pid 32678:tid 32710] [client 20.215.249.162:15866] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogr.php"] [unique_id "aeOirRUlAXU_ZWUu5y8ZwgAAAoM"]
[Sat Apr 18 23:26:39.542654 2026] [:error] [pid 34288:tid 34307] [client 20.215.249.162:28631] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogr.php"] [unique_id "aeOir-TIiy__PtiLmpng5wAAAY8"]
[Sat Apr 18 23:26:40.702022 2026] [:error] [pid 9865:tid 9955] [client 20.215.249.162:12933] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ogr.php"] [unique_id "aeOisKzb5knECIY-C-is2AAAAJI"]
[Sat Apr 18 23:26:41.636307 2026] [:error] [pid 9864:tid 9916] [client 20.215.249.162:15819] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oti.php"] [unique_id "aeOisYCFeowknfXHM7k4YgAAAEo"]
[Sat Apr 18 23:26:45.658925 2026] [:error] [pid 9865:tid 9941] [client 20.215.249.162:36418] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oti.php"] [unique_id "aeOitazb5knECIY-C-is4QAAAIQ"]
[Sat Apr 18 23:26:47.513047 2026] [:error] [pid 34288:tid 34315] [client 20.215.249.162:22443] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oti.php"] [unique_id "aeOit-TIiy__PtiLmpng7AAAAZc"]
[Sat Apr 18 23:26:48.558228 2026] [:error] [pid 32677:tid 32702] [client 20.215.249.162:12756] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oti.php"] [unique_id "aeOiuBngmUE3LdC-wP72uwAAAlY"]
[Sat Apr 18 23:26:49.912092 2026] [:error] [pid 9970:tid 9998] [client 20.215.249.162:23666] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-124.php"] [unique_id "aeOiuSYdRLRhVmaIMx3xNgAAANg"]
[Sat Apr 18 23:26:51.250398 2026] [:error] [pid 32647:tid 32665] [client 20.215.249.162:12795] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-124.php"] [unique_id "aeOiu0kxooM0iRo6e542HAAAAg8"]
[Sat Apr 18 23:26:54.262368 2026] [:error] [pid 13023:tid 13049] [client 20.215.249.162:15829] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-124.php"] [unique_id "aeOivv1e7hG8DAeABB9N2AAAARg"]
[Sat Apr 18 23:26:58.825055 2026] [:error] [pid 13023:tid 13041] [client 20.215.249.162:57980] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-124.php"] [unique_id "aeOiwv1e7hG8DAeABB9N3wAAARA"]
[Sat Apr 18 23:27:00.895766 2026] [:error] [pid 9970:tid 9977] [client 20.215.249.162:28646] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "aeOixCYdRLRhVmaIMx3xRQAAAMM"]
[Sat Apr 18 23:27:02.168522 2026] [:error] [pid 13023:tid 13044] [client 20.215.249.162:57959] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "aeOixv1e7hG8DAeABB9N7AAAARM"]
[Sat Apr 18 23:27:05.037307 2026] [:error] [pid 13023:tid 13043] [client 20.215.249.162:20110] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "aeOiyf1e7hG8DAeABB9N7QAAARI"]
[Sat Apr 18 23:27:12.711874 2026] [:error] [pid 13023:tid 13044] [client 20.215.249.162:17349] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpls.php"] [unique_id "aeOi0P1e7hG8DAeABB9N8QAAARM"]
[Sat Apr 18 23:27:15.748123 2026] [:error] [pid 32678:tid 32731] [client 20.215.249.162:21692] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aeOi0xUlAXU_ZWUu5y8Z2AAAApg"]
[Sat Apr 18 23:27:20.141769 2026] [:error] [pid 13023:tid 13049] [client 20.215.249.162:38956] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aeOi2P1e7hG8DAeABB9N-QAAARg"]
[Sat Apr 18 23:27:21.817809 2026] [:error] [pid 9863:tid 9877] [client 20.215.249.162:44256] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aeOi2TjjiypiFrTucbLclwAAAAQ"]
[Sat Apr 18 23:27:23.103047 2026] [:error] [pid 32678:tid 32716] [client 20.215.249.162:35418] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aeOi2xUlAXU_ZWUu5y8Z3wAAAok"]
[Sat Apr 18 23:27:23.810329 2026] [:error] [pid 32678:tid 32722] [client 20.215.249.162:1623] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "aeOi2xUlAXU_ZWUu5y8Z4QAAAo8"]
[Sat Apr 18 23:27:25.400952 2026] [:error] [pid 9970:tid 9975] [client 20.215.249.162:44267] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "aeOi3SYdRLRhVmaIMx3xYQAAAME"]
[Sat Apr 18 23:27:27.917697 2026] [:error] [pid 32647:tid 32670] [client 20.215.249.162:19729] [client 20.215.249.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "aeOi30kxooM0iRo6e542KwAAAhQ"]
[Sat Apr 18 23:27:29.901684 2026] [proxy_fcgi:error] [pid 13023:tid 13034] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:30.161422 2026] [proxy_fcgi:error] [pid 13023:tid 13029] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:30.449571 2026] [proxy_fcgi:error] [pid 13023:tid 13044] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:30.710271 2026] [proxy_fcgi:error] [pid 13023:tid 13038] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:31.117005 2026] [proxy_fcgi:error] [pid 13023:tid 13035] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:31.385779 2026] [proxy_fcgi:error] [pid 13023:tid 13031] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:31.644771 2026] [proxy_fcgi:error] [pid 13023:tid 13036] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:31.903488 2026] [proxy_fcgi:error] [pid 13023:tid 13026] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 23:27:32.162823 2026] [proxy_fcgi:error] [pid 13023:tid 13048] [client 20.215.249.162:34378] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 01:52:01.287721 2026] [:error] [pid 32167:tid 32243] [client 152.53.16.126:51608] [client 152.53.16.126] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=image/gif"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aePEwUyD4Jm27Mb3NJh7TQAAAJI"]
[Sun Apr 19 02:01:52.866653 2026] [proxy_fcgi:error] [pid 32167:tid 32227] [client 20.172.36.113:51032] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 02:03:24.897549 2026] [:error] [pid 60910:tid 60927] [client 182.44.10.67:43479] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aePHbHFWunkyacYqsD09pAAAAU8"]
[Sun Apr 19 04:42:19.720477 2026] [:error] [pid 47772:tid 47794] [client 2.24.211.46:38434] [client 2.24.211.46] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "aePsq4c0L16cb4smAz-H4QAAAAU"]
[Sun Apr 19 05:24:20.309903 2026] [:error] [pid 15694:tid 15744] [client 43.134.141.244:44604] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeP2hLimB-jol1fwqAq5sQAAAZI"]
[Sun Apr 19 05:36:13.003558 2026] [:error] [pid 15760:tid 15784] [client 24.144.82.99:61913] [client 24.144.82.99] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aeP5TfSdD_XHQMJ_ISsYpAAAAdA"]
[Sun Apr 19 13:19:02.682408 2026] [:error] [pid 15764:tid 15846] [client 170.106.167.214:50572] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeRlxmLL_sqdSHoVp-R6PgAAAlQ"]
[Sun Apr 19 14:38:37.894597 2026] [:error] [pid 47775:tid 47866] [client 49.233.45.47:40800] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeR4bbmztjlk9tsmoezaEgAAAJc"]
[Sun Apr 19 18:40:41.187010 2026] [:error] [pid 15760:tid 15792] [client 103.216.221.88:35677] [client 103.216.221.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.88, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeSxKfSdD_XHQMJ_ISvZaQAAAdg"]
[Sun Apr 19 18:40:41.321020 2026] [proxy_fcgi:error] [pid 15760:tid 15792] [client 103.216.221.88:35677] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 18:44:21.152730 2026] [:error] [pid 15763:tid 15802] [client 103.105.11.118:55105] [client 103.105.11.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.105.11.118, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeSyBbMXv1Y1THOoxaDOqwAAAgY"]
[Sun Apr 19 18:44:21.164277 2026] [proxy_fcgi:error] [pid 15763:tid 15802] [client 103.105.11.118:55105] AH01071: Got error 'Primary script unknown'
[Sun Apr 19 19:13:49.714171 2026] [:error] [pid 47773:tid 47825] [client 213.35.109.170:58615] [client 213.35.109.170] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:auth outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||switchcreative.net|F|3"] [data "ARGS:auth=\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-automatic/inc/csv.php"] [unique_id "aeS47eiBHdnCJDuPq9AnlwAAAEk"]
[Sun Apr 19 21:07:14.206064 2026] [:error] [pid 47772:tid 47792] [client 43.159.145.153:53192] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeTTgoc0L16cb4smAz-3bgAAAAM"]
[Sun Apr 19 21:18:34.070613 2026] [:error] [pid 15760:tid 15781] [client 182.44.10.67:56911] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeTWKvSdD_XHQMJ_ISssLgAAAc0"]
[Sun Apr 19 22:50:47.606363 2026] [:error] [pid 47773:tid 47818] [client 146.70.194.222:43408] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeTrx-iBHdnCJDuPq9BWswAAAEI"]
[Sun Apr 19 22:50:48.120892 2026] [:error] [pid 47775:tid 47867] [client 146.70.194.222:43808] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeTryLmztjlk9tsmoewnZwAAAJg"]
[Sun Apr 19 22:50:48.647548 2026] [:error] [pid 47773:tid 47830] [client 146.70.194.222:44076] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "aeTryOiBHdnCJDuPq9BWuwAAAE4"]
[Sun Apr 19 22:50:49.171120 2026] [:error] [pid 15693:tid 15717] [client 146.70.194.222:44604] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "aeTrycNMD-ccazQlTslkCwAAAVU"]
[Sun Apr 19 22:50:49.691240 2026] [:error] [pid 15760:tid 15769] [client 146.70.194.222:45284] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "aeTryfSdD_XHQMJ_IStfigAAAcE"]
[Sun Apr 19 22:50:50.224542 2026] [:error] [pid 15763:tid 15817] [client 146.70.194.222:46026] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "aeTryrMXv1Y1THOoxaATHAAAAhU"]
[Sun Apr 19 22:50:50.754150 2026] [:error] [pid 15760:tid 15788] [client 146.70.194.222:46914] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "aeTryvSdD_XHQMJ_IStf2gAAAdQ"]
[Sun Apr 19 22:50:51.269057 2026] [:error] [pid 47773:tid 47816] [client 146.70.194.222:47680] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "aeTry-iBHdnCJDuPq9BW4QAAAEA"]
[Mon Apr 20 00:42:13.960442 2026] [:error] [pid 15760:tid 15770] [client 51.75.128.94:34114] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeUF5fSdD_XHQMJ_ISuUsQAAAcI"]
[Mon Apr 20 00:42:15.960795 2026] [:error] [pid 47775:tid 47847] [client 51.75.128.94:45764] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeUF57mztjlk9tsmoew62AAAAIQ"]
[Mon Apr 20 00:42:18.544417 2026] [:error] [pid 15760:tid 15775] [client 51.75.128.94:43420] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeUF6vSdD_XHQMJ_ISuUxQAAAcc"]
[Mon Apr 20 00:42:20.648405 2026] [:error] [pid 47775:tid 47855] [client 51.75.128.94:54810] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeUF7Lmztjlk9tsmoew62wAAAIw"]
[Mon Apr 20 00:42:22.583470 2026] [:error] [pid 15764:tid 15840] [client 51.75.128.94:54826] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeUF7mLL_sqdSHoVp-RhNwAAAk4"]
[Mon Apr 20 00:42:25.093412 2026] [:error] [pid 15760:tid 15791] [client 51.75.128.94:43428] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeUF8fSdD_XHQMJ_ISuUzgAAAdc"]
[Mon Apr 20 00:42:26.985509 2026] [:error] [pid 15763:tid 15817] [client 51.75.128.94:60838] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeUF8rMXv1Y1THOoxaAsmwAAAhU"]
[Mon Apr 20 00:42:28.974806 2026] [:error] [pid 47773:tid 47820] [client 51.75.128.94:60850] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeUF9OiBHdnCJDuPq9BrPQAAAEQ"]
[Mon Apr 20 00:42:30.940538 2026] [:error] [pid 47886:tid 47891] [client 51.75.128.94:60854] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeUF9kSe8yiyuPrD7yOU1AAAAMM"]
[Mon Apr 20 00:42:32.773781 2026] [:error] [pid 15760:tid 15769] [client 51.75.128.94:60868] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeUF-PSdD_XHQMJ_ISuU3AAAAcE"]
[Mon Apr 20 00:42:34.754300 2026] [:error] [pid 15764:tid 15847] [client 51.75.128.94:60884] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeUF-mLL_sqdSHoVp-RhSgAAAlU"]
[Mon Apr 20 00:42:36.858005 2026] [:error] [pid 47886:tid 47912] [client 51.75.128.94:37826] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeUF_ESe8yiyuPrD7yOU1wAAANg"]
[Mon Apr 20 00:42:38.759421 2026] [:error] [pid 15764:tid 15850] [client 51.75.128.94:37834] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeUF_mLL_sqdSHoVp-RhUgAAAlc"]
[Mon Apr 20 00:42:40.695851 2026] [:error] [pid 15764:tid 15837] [client 51.75.128.94:37850] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeUGAGLL_sqdSHoVp-RhVAAAAks"]
[Mon Apr 20 00:42:42.760686 2026] [:error] [pid 47773:tid 47819] [client 51.75.128.94:37852] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeUGAuiBHdnCJDuPq9BrTAAAAEM"]
[Mon Apr 20 00:42:44.653403 2026] [:error] [pid 47773:tid 47821] [client 51.75.128.94:37858] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeUGBOiBHdnCJDuPq9BrTwAAAEU"]
[Mon Apr 20 00:42:46.581313 2026] [:error] [pid 47773:tid 47836] [client 51.75.128.94:60824] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeUGBuiBHdnCJDuPq9BrVwAAAFQ"]
[Mon Apr 20 00:42:48.496896 2026] [:error] [pid 47775:tid 47845] [client 51.75.128.94:60836] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeUGCLmztjlk9tsmoew67AAAAII"]
[Mon Apr 20 00:42:50.432306 2026] [:error] [pid 47886:tid 47902] [client 51.75.128.94:60840] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeUGCkSe8yiyuPrD7yOU4gAAAM4"]
[Mon Apr 20 00:42:52.377450 2026] [:error] [pid 15765:tid 15870] [client 51.75.128.94:60844] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeUGDPRqinw-W5EwQ74V1AAAApE"]
[Mon Apr 20 00:42:54.293678 2026] [:error] [pid 15765:tid 15871] [client 51.75.128.94:60848] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeUGDvRqinw-W5EwQ74V1QAAApI"]
[Mon Apr 20 00:42:56.353882 2026] [:error] [pid 47886:tid 47895] [client 51.75.128.94:53354] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeUGEESe8yiyuPrD7yOU6AAAAMc"]
[Mon Apr 20 00:42:58.240210 2026] [:error] [pid 47772:tid 47805] [client 51.75.128.94:53364] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeUGEoc0L16cb4smAz_6IgAAABA"]
[Mon Apr 20 00:43:00.130561 2026] [:error] [pid 15765:tid 15864] [client 51.75.128.94:53372] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeUGFPRqinw-W5EwQ74V2gAAAos"]
[Mon Apr 20 00:43:02.162549 2026] [:error] [pid 47773:tid 47828] [client 51.75.128.94:53380] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeUGFuiBHdnCJDuPq9BrigAAAEw"]
[Mon Apr 20 00:43:04.055295 2026] [:error] [pid 15760:tid 15776] [client 51.75.128.94:53386] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeUGGPSdD_XHQMJ_ISuU-gAAAcg"]
[Mon Apr 20 00:43:05.974753 2026] [:error] [pid 15694:tid 15724] [client 51.75.128.94:53394] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeUGGbimB-jol1fwqAokBgAAAYE"]
[Mon Apr 20 00:43:08.351946 2026] [:error] [pid 15760:tid 15791] [client 51.75.128.94:34856] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeUGHPSdD_XHQMJ_ISuU_wAAAdc"]
[Mon Apr 20 00:43:10.191774 2026] [:error] [pid 47886:tid 47888] [client 51.75.128.94:33298] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeUGHkSe8yiyuPrD7yOU8QAAAMA"]
[Mon Apr 20 00:43:31.533316 2026] [:error] [pid 15760:tid 15791] [client 51.75.128.94:33304] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeUGM_SdD_XHQMJ_ISuVSgAAAdc"]
[Mon Apr 20 00:43:33.509277 2026] [:error] [pid 15765:tid 15874] [client 51.75.128.94:38150] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeUGNfRqinw-W5EwQ74V6wAAApU"]
[Mon Apr 20 00:43:36.016296 2026] [:error] [pid 47772:tid 47789] [client 51.75.128.94:37782] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeUGOIc0L16cb4smAz_6OgAAAAA"]
[Mon Apr 20 00:43:38.057679 2026] [:error] [pid 15760:tid 15782] [client 51.75.128.94:54464] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeUGOvSdD_XHQMJ_ISuVbAAAAc4"]
[Mon Apr 20 00:43:40.099826 2026] [:error] [pid 15764:tid 15828] [client 51.75.128.94:54472] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeUGPGLL_sqdSHoVp-RhfQAAAkI"]
[Mon Apr 20 00:43:42.005677 2026] [:error] [pid 15760:tid 15792] [client 51.75.128.94:54480] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeUGPvSdD_XHQMJ_ISuVfAAAAdg"]
[Mon Apr 20 00:43:43.896728 2026] [:error] [pid 15693:tid 15708] [client 51.75.128.94:54494] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeUGP8NMD-ccazQlTsltEgAAAUw"]
[Mon Apr 20 00:43:46.418196 2026] [:error] [pid 15764:tid 15841] [client 51.75.128.94:40124] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeUGQmLL_sqdSHoVp-RhhgAAAk8"]
[Mon Apr 20 00:43:48.463176 2026] [:error] [pid 15693:tid 15706] [client 51.75.128.94:45118] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeUGRMNMD-ccazQlTsltFAAAAUo"]
[Mon Apr 20 00:43:50.507953 2026] [:error] [pid 15693:tid 15711] [client 51.75.128.94:45120] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeUGRsNMD-ccazQlTsltFwAAAU8"]
[Mon Apr 20 00:43:52.388097 2026] [:error] [pid 15760:tid 15773] [client 51.75.128.94:45128] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeUGSPSdD_XHQMJ_ISuVqAAAAcU"]
[Mon Apr 20 00:43:54.913292 2026] [:error] [pid 47772:tid 47797] [client 51.75.128.94:52594] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeUGSoc0L16cb4smAz_6SQAAAAg"]
[Mon Apr 20 00:43:56.927607 2026] [:error] [pid 15693:tid 15714] [client 51.75.128.94:38946] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeUGTMNMD-ccazQlTsltGAAAAVI"]
[Mon Apr 20 00:43:58.953727 2026] [:error] [pid 15763:tid 15808] [client 51.75.128.94:38960] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeUGTrMXv1Y1THOoxaAs6AAAAgw"]
[Mon Apr 20 00:44:00.840720 2026] [:error] [pid 15760:tid 15784] [client 51.75.128.94:38966] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeUGUPSdD_XHQMJ_ISuV1wAAAdA"]
[Mon Apr 20 00:44:02.857643 2026] [:error] [pid 15760:tid 15774] [client 51.75.128.94:38972] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeUGUvSdD_XHQMJ_ISuV7wAAAcY"]
[Mon Apr 20 00:44:04.744102 2026] [:error] [pid 15760:tid 15788] [client 51.75.128.94:38988] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeUGVPSdD_XHQMJ_ISuV-QAAAdQ"]
[Mon Apr 20 00:44:07.279278 2026] [:error] [pid 15763:tid 15802] [client 51.75.128.94:37740] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeUGV7MXv1Y1THOoxaAs_QAAAgY"]
[Mon Apr 20 00:44:09.314415 2026] [:error] [pid 15694:tid 15732] [client 51.75.128.94:52274] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeUGWbimB-jol1fwqAokEgAAAYY"]
[Mon Apr 20 00:44:11.340489 2026] [:error] [pid 47886:tid 47889] [client 51.75.128.94:52278] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeUGW0Se8yiyuPrD7yOVCgAAAME"]
[Mon Apr 20 00:44:13.731963 2026] [:error] [pid 47772:tid 47813] [client 51.75.128.94:37744] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeUGXYc0L16cb4smAz_6agAAABg"]
[Mon Apr 20 00:44:15.746586 2026] [:error] [pid 15763:tid 15807] [client 51.75.128.94:52280] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeUGX7MXv1Y1THOoxaAtCwAAAgs"]
[Mon Apr 20 00:44:17.816991 2026] [:error] [pid 15764:tid 15843] [client 51.75.128.94:46458] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeUGYWLL_sqdSHoVp-RhowAAAlE"]
[Mon Apr 20 00:44:19.668288 2026] [:error] [pid 47775:tid 47857] [client 51.75.128.94:46472] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeUGY7mztjlk9tsmoew7DgAAAI4"]
[Mon Apr 20 00:44:21.709135 2026] [:error] [pid 47772:tid 47791] [client 51.75.128.94:46480] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeUGZYc0L16cb4smAz_6hgAAAAI"]
[Mon Apr 20 00:44:24.229737 2026] [:error] [pid 15764:tid 15829] [client 51.75.128.94:59414] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aeUGaGLL_sqdSHoVp-RhpgAAAkM"]
[Mon Apr 20 00:44:26.328644 2026] [:error] [pid 47772:tid 47798] [client 51.75.128.94:38018] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeUGaoc0L16cb4smAz_6jgAAAAk"]
[Mon Apr 20 00:44:28.830652 2026] [:error] [pid 47773:tid 47833] [client 51.75.128.94:48166] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeUGbOiBHdnCJDuPq9Br0wAAAFE"]
[Mon Apr 20 00:44:50.873515 2026] [:error] [pid 47772:tid 47806] [client 51.75.128.94:38032] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeUGgoc0L16cb4smAz_6sgAAABE"]
[Mon Apr 20 00:44:52.815800 2026] [:error] [pid 47772:tid 47800] [client 51.75.128.94:44796] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeUGhIc0L16cb4smAz_6tAAAAAs"]
[Mon Apr 20 00:44:54.831749 2026] [:error] [pid 47886:tid 47902] [client 51.75.128.94:44812] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeUGhkSe8yiyuPrD7yOVIwAAAM4"]
[Mon Apr 20 00:44:56.859162 2026] [:error] [pid 15763:tid 15805] [client 51.75.128.94:50770] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeUGiLMXv1Y1THOoxaAtOgAAAgk"]
[Mon Apr 20 00:44:58.725994 2026] [:error] [pid 15764:tid 15835] [client 51.75.128.94:50786] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeUGimLL_sqdSHoVp-Rh-wAAAkk"]
[Mon Apr 20 00:45:00.776501 2026] [:error] [pid 47772:tid 47804] [client 51.75.128.94:50798] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeUGjIc0L16cb4smAz_6ugAAAA8"]
[Mon Apr 20 00:45:03.296977 2026] [:error] [pid 47772:tid 47812] [client 51.75.128.94:43184] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeUGj4c0L16cb4smAz_6vgAAABc"]
[Mon Apr 20 00:45:05.308330 2026] [:error] [pid 47775:tid 47852] [client 51.75.128.94:50814] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeUGkbmztjlk9tsmoew7JgAAAIk"]
[Mon Apr 20 00:45:07.800791 2026] [:error] [pid 15764:tid 15838] [client 51.75.128.94:36428] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeUGk2LL_sqdSHoVp-RiBAAAAkw"]
[Mon Apr 20 00:45:09.783470 2026] [:error] [pid 15764:tid 15835] [client 51.75.128.94:34958] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeUGlWLL_sqdSHoVp-RiCQAAAkk"]
[Mon Apr 20 00:45:11.784686 2026] [:error] [pid 15764:tid 15838] [client 51.75.128.94:34960] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeUGl2LL_sqdSHoVp-RiEQAAAkw"]
[Mon Apr 20 00:45:14.288710 2026] [:error] [pid 47772:tid 47791] [client 51.75.128.94:36432] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeUGmoc0L16cb4smAz_6zgAAAAI"]
[Mon Apr 20 00:45:16.254808 2026] [:error] [pid 15760:tid 15770] [client 51.75.128.94:56010] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeUGnPSdD_XHQMJ_ISuWigAAAcI"]
[Mon Apr 20 00:45:18.267994 2026] [:error] [pid 47772:tid 47797] [client 51.75.128.94:56018] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeUGnoc0L16cb4smAz_61QAAAAg"]
[Mon Apr 20 00:45:20.275571 2026] [:error] [pid 47775:tid 47850] [client 51.75.128.94:56020] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeUGoLmztjlk9tsmoew7MAAAAIc"]
[Mon Apr 20 00:45:23.148333 2026] [:error] [pid 15763:tid 15796] [client 51.75.128.94:56026] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUGo7MXv1Y1THOoxaAtRwAAAgA"]
[Mon Apr 20 00:45:26.877590 2026] [:error] [pid 15763:tid 15805] [client 51.75.128.94:42894] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUGprMXv1Y1THOoxaAtSQAAAgk"]
[Mon Apr 20 02:32:13.063832 2026] [:error] [pid 15764:tid 15835] [client 147.135.252.148:51008] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeUfrWLL_sqdSHoVp-SBtgAAAkk"]
[Mon Apr 20 02:32:14.752141 2026] [:error] [pid 15760:tid 15792] [client 147.135.252.148:48876] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeUfrvSdD_XHQMJ_ISu2owAAAdg"]
[Mon Apr 20 02:32:17.281886 2026] [:error] [pid 15763:tid 15801] [client 147.135.252.148:46868] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeUfsbMXv1Y1THOoxaA_ZQAAAgU"]
[Mon Apr 20 02:32:19.312033 2026] [:error] [pid 15760:tid 15778] [client 147.135.252.148:55842] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeUfs_SdD_XHQMJ_ISu2pgAAAco"]
[Mon Apr 20 02:32:21.811950 2026] [:error] [pid 47772:tid 47792] [client 147.135.252.148:46882] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeUftYc0L16cb4smAz8QigAAAAM"]
[Mon Apr 20 02:32:23.693608 2026] [:error] [pid 15763:tid 15806] [client 147.135.252.148:55844] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeUft7MXv1Y1THOoxaA_aQAAAgo"]
[Mon Apr 20 02:32:26.181955 2026] [:error] [pid 15764:tid 15834] [client 147.135.252.148:46884] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeUfumLL_sqdSHoVp-SB1QAAAkg"]
[Mon Apr 20 02:32:28.666583 2026] [:error] [pid 47772:tid 47811] [client 147.135.252.148:45536] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeUfvIc0L16cb4smAz8QlAAAABY"]
[Mon Apr 20 02:32:30.549279 2026] [:error] [pid 15765:tid 15852] [client 147.135.252.148:35778] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeUfvvRqinw-W5EwQ74gAgAAAoA"]
[Mon Apr 20 02:32:33.045857 2026] [:error] [pid 47886:tid 47899] [client 147.135.252.148:45552] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeUfwUSe8yiyuPrD7yOgqgAAAMs"]
[Mon Apr 20 02:32:35.012870 2026] [:error] [pid 15760:tid 15774] [client 147.135.252.148:35792] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeUfw_SdD_XHQMJ_ISu2tQAAAcY"]
[Mon Apr 20 02:32:37.537481 2026] [:error] [pid 15694:tid 15747] [client 147.135.252.148:53154] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeUfxbimB-jol1fwqAo3RAAAAZU"]
[Mon Apr 20 02:32:40.073659 2026] [:error] [pid 15760:tid 15792] [client 147.135.252.148:53156] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeUfyPSdD_XHQMJ_ISu2tgAAAdg"]
[Mon Apr 20 02:32:42.169948 2026] [:error] [pid 47772:tid 47802] [client 147.135.252.148:50620] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeUfyoc0L16cb4smAz8QnQAAAA0"]
[Mon Apr 20 02:32:44.870599 2026] [:error] [pid 15763:tid 15798] [client 147.135.252.148:53172] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeUfzLMXv1Y1THOoxaA_fAAAAgI"]
[Mon Apr 20 02:32:46.978351 2026] [:error] [pid 15764:tid 15844] [client 147.135.252.148:53222] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeUfzmLL_sqdSHoVp-SB_gAAAlI"]
[Mon Apr 20 02:32:49.509551 2026] [:error] [pid 47773:tid 47834] [client 147.135.252.148:60410] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeUf0eiBHdnCJDuPq9B67wAAAFI"]
[Mon Apr 20 02:32:51.937461 2026] [:error] [pid 15694:tid 15748] [client 147.135.252.148:60420] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeUf07imB-jol1fwqAo3WgAAAZY"]
[Mon Apr 20 02:32:54.462571 2026] [:error] [pid 15694:tid 15741] [client 147.135.252.148:60434] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aeUf1rimB-jol1fwqAo3YwAAAY8"]
[Mon Apr 20 02:32:56.967280 2026] [:error] [pid 15694:tid 15735] [client 147.135.252.148:33806] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeUf2LimB-jol1fwqAo3bwAAAYk"]
[Mon Apr 20 02:32:59.559714 2026] [:error] [pid 15694:tid 15730] [client 147.135.252.148:33822] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeUf27imB-jol1fwqAo3eAAAAYQ"]
[Mon Apr 20 02:33:02.027133 2026] [:error] [pid 15694:tid 15736] [client 147.135.252.148:33838] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeUf3rimB-jol1fwqAo3fAAAAYo"]
[Mon Apr 20 02:33:04.483678 2026] [:error] [pid 47772:tid 47794] [client 147.135.252.148:33844] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeUf4Ic0L16cb4smAz8QpgAAAAU"]
[Mon Apr 20 02:33:06.844888 2026] [:error] [pid 15694:tid 15738] [client 147.135.252.148:60234] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeUf4rimB-jol1fwqAo3hwAAAYw"]
[Mon Apr 20 02:33:08.728912 2026] [:error] [pid 15763:tid 15819] [client 147.135.252.148:47022] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeUf5LMXv1Y1THOoxaA_gQAAAhc"]
[Mon Apr 20 02:33:32.125564 2026] [:error] [pid 15764:tid 15846] [client 147.135.252.148:33004] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "aeUf_GLL_sqdSHoVp-SCNQAAAlQ"]
[Mon Apr 20 02:33:34.565281 2026] [:error] [pid 15693:tid 15712] [client 147.135.252.148:54124] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeUf_sNMD-ccazQlTsl0BgAAAVA"]
[Mon Apr 20 02:33:35.143074 2026] [:error] [pid 47775:tid 47867] [client 147.135.252.148:54126] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUf_7mztjlk9tsmoexIRQAAAJg"]
[Mon Apr 20 02:33:37.074312 2026] [:error] [pid 15763:tid 15808] [client 147.135.252.148:45722] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeUgAbMXv1Y1THOoxaA_mQAAAgw"]
[Mon Apr 20 02:33:39.604884 2026] [:error] [pid 47886:tid 47900] [client 147.135.252.148:45738] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUgA0Se8yiyuPrD7yOguwAAAMw"]
[Mon Apr 20 02:33:39.708653 2026] [:error] [pid 47886:tid 47903] [client 147.135.252.148:45744] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeUgA0Se8yiyuPrD7yOgvAAAAM8"]
[Mon Apr 20 02:33:40.994630 2026] [:error] [pid 15764:tid 15826] [client 147.135.252.148:39516] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUgBGLL_sqdSHoVp-SCVQAAAkA"]
[Mon Apr 20 02:33:42.244055 2026] [:error] [pid 15764:tid 15848] [client 147.135.252.148:45754] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeUgBmLL_sqdSHoVp-SCXQAAAlY"]
[Mon Apr 20 02:33:44.215066 2026] [:error] [pid 15763:tid 15812] [client 147.135.252.148:39528] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeUgCLMXv1Y1THOoxaA_ogAAAhA"]
[Mon Apr 20 02:33:44.929412 2026] [:error] [pid 47772:tid 47799] [client 147.135.252.148:39538] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUgCIc0L16cb4smAz8Q0wAAAAo"]
[Mon Apr 20 02:33:46.809884 2026] [:error] [pid 15760:tid 15778] [client 147.135.252.148:39372] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeUgCvSdD_XHQMJ_ISu21AAAAco"]
[Mon Apr 20 02:33:48.763293 2026] [:error] [pid 15693:tid 15710] [client 147.135.252.148:39646] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeUgDMNMD-ccazQlTsl0CAAAAU4"]
[Mon Apr 20 02:33:51.199410 2026] [:error] [pid 15760:tid 15771] [client 147.135.252.148:39384] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeUgD_SdD_XHQMJ_ISu22gAAAcM"]
[Mon Apr 20 02:33:53.896000 2026] [:error] [pid 47773:tid 47838] [client 147.135.252.148:39400] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeUgEeiBHdnCJDuPq9B6_AAAAFY"]
[Mon Apr 20 02:33:55.814345 2026] [:error] [pid 47775:tid 47867] [client 147.135.252.148:39662] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeUgE7mztjlk9tsmoexITgAAAJg"]
[Mon Apr 20 02:33:58.737356 2026] [:error] [pid 15694:tid 15736] [client 147.135.252.148:46784] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeUgFrimB-jol1fwqAo3twAAAYo"]
[Mon Apr 20 02:34:00.885837 2026] [:error] [pid 15694:tid 15730] [client 147.135.252.148:44810] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeUgGLimB-jol1fwqAo3wQAAAYQ"]
[Mon Apr 20 02:34:03.557015 2026] [:error] [pid 15694:tid 15734] [client 147.135.252.148:46796] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeUgG7imB-jol1fwqAo32AAAAYg"]
[Mon Apr 20 02:34:06.940132 2026] [:error] [pid 15693:tid 15706] [client 147.135.252.148:45850] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeUgHsNMD-ccazQlTsl0CwAAAUo"]
[Mon Apr 20 02:34:09.887330 2026] [:error] [pid 15763:tid 15810] [client 147.135.252.148:45854] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeUgIbMXv1Y1THOoxaA_twAAAg4"]
[Mon Apr 20 02:34:12.070803 2026] [:error] [pid 15760:tid 15775] [client 147.135.252.148:46982] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeUgJPSdD_XHQMJ_ISu27gAAAcc"]
[Mon Apr 20 02:34:14.688112 2026] [:error] [pid 15764:tid 15842] [client 147.135.252.148:46998] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeUgJmLL_sqdSHoVp-SCdwAAAlA"]
[Mon Apr 20 02:34:16.745870 2026] [:error] [pid 15765:tid 15874] [client 147.135.252.148:47694] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeUgKPRqinw-W5EwQ74gHAAAApU"]
[Mon Apr 20 02:34:19.106815 2026] [:error] [pid 15764:tid 15834] [client 147.135.252.148:47698] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeUgK2LL_sqdSHoVp-SCjQAAAkg"]
[Mon Apr 20 02:34:21.565369 2026] [:error] [pid 15763:tid 15817] [client 147.135.252.148:47700] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeUgLbMXv1Y1THOoxaA_wAAAAhU"]
[Mon Apr 20 02:34:23.902399 2026] [:error] [pid 47775:tid 47853] [client 147.135.252.148:47706] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeUgL7mztjlk9tsmoexIWgAAAIo"]
[Mon Apr 20 02:34:27.148312 2026] [:error] [pid 47775:tid 47844] [client 147.135.252.148:37672] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aeUgM7mztjlk9tsmoexIYQAAAIE"]
[Mon Apr 20 02:34:50.114137 2026] [:error] [pid 15694:tid 15740] [client 147.135.252.148:38896] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUgSrimB-jol1fwqAo4JwAAAY4"]
[Mon Apr 20 02:34:50.549453 2026] [:error] [pid 15694:tid 15737] [client 147.135.252.148:38892] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeUgSrimB-jol1fwqAo4KgAAAYs"]
[Mon Apr 20 02:34:52.442350 2026] [:error] [pid 47775:tid 47859] [client 147.135.252.148:37684] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeUgTLmztjlk9tsmoexIdQAAAJA"]
[Mon Apr 20 02:34:53.995472 2026] [:error] [pid 15694:tid 15736] [client 147.135.252.148:38910] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeUgTbimB-jol1fwqAo4QgAAAYo"]
[Mon Apr 20 02:34:54.469751 2026] [:error] [pid 15694:tid 15748] [client 147.135.252.148:38924] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeUgTrimB-jol1fwqAo4RQAAAZY"]
[Mon Apr 20 02:34:57.275582 2026] [:error] [pid 15764:tid 15850] [client 147.135.252.148:41946] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeUgUWLL_sqdSHoVp-SCrgAAAlc"]
[Mon Apr 20 02:34:59.405769 2026] [:error] [pid 15694:tid 15736] [client 147.135.252.148:50966] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeUgU7imB-jol1fwqAo4SwAAAYo"]
[Mon Apr 20 02:35:01.902658 2026] [:error] [pid 15760:tid 15781] [client 147.135.252.148:41958] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aeUgVfSdD_XHQMJ_ISu3DwAAAc0"]
[Mon Apr 20 02:35:03.893892 2026] [:error] [pid 15694:tid 15733] [client 147.135.252.148:50974] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeUgV7imB-jol1fwqAo4UAAAAYc"]
[Mon Apr 20 02:35:05.975101 2026] [:error] [pid 15694:tid 15734] [client 147.135.252.148:50976] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeUgWbimB-jol1fwqAo4VQAAAYg"]
[Mon Apr 20 02:35:08.608582 2026] [:error] [pid 15694:tid 15726] [client 147.135.252.148:48292] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeUgXLimB-jol1fwqAo4XgAAAYM"]
[Mon Apr 20 02:35:10.724969 2026] [:error] [pid 47886:tid 47911] [client 147.135.252.148:39990] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeUgXkSe8yiyuPrD7yOg3wAAANc"]
[Mon Apr 20 02:35:13.385609 2026] [:error] [pid 47773:tid 47818] [client 147.135.252.148:48298] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeUgYeiBHdnCJDuPq9B7JwAAAEI"]
[Mon Apr 20 02:35:15.896473 2026] [:error] [pid 47772:tid 47795] [client 147.135.252.148:48300] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeUgY4c0L16cb4smAz8REQAAAAY"]
[Mon Apr 20 02:35:18.414642 2026] [:error] [pid 15760:tid 15781] [client 147.135.252.148:45802] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeUgZvSdD_XHQMJ_ISu3JQAAAc0"]
[Mon Apr 20 02:35:21.053512 2026] [:error] [pid 15760:tid 15778] [client 147.135.252.148:45812] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeUgafSdD_XHQMJ_ISu3MQAAAco"]
[Mon Apr 20 02:35:23.777473 2026] [:error] [pid 47772:tid 47795] [client 147.135.252.148:45814] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeUga4c0L16cb4smAz8RGwAAAAY"]
[Mon Apr 20 02:35:26.212127 2026] [:error] [pid 15694:tid 15724] [client 147.135.252.148:45826] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aeUgbrimB-jol1fwqAo4eAAAAYE"]
[Mon Apr 20 02:35:29.092655 2026] [:error] [pid 15694:tid 15749] [client 147.135.252.148:33696] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aeUgcbimB-jol1fwqAo4fwAAAZc"]
[Mon Apr 20 02:35:31.621083 2026] [:error] [pid 15694:tid 15725] [client 147.135.252.148:33708] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aeUgc7imB-jol1fwqAo4gwAAAYI"]
[Mon Apr 20 02:35:34.050746 2026] [:error] [pid 47772:tid 47808] [client 147.135.252.148:33716] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeUgdoc0L16cb4smAz8RHgAAABM"]
[Mon Apr 20 02:35:36.467308 2026] [:error] [pid 15765:tid 15857] [client 147.135.252.148:33724] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeUgePRqinw-W5EwQ74gKgAAAoQ"]
[Mon Apr 20 02:35:38.844322 2026] [:error] [pid 15694:tid 15742] [client 147.135.252.148:35432] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeUgerimB-jol1fwqAo4jgAAAZA"]
[Mon Apr 20 02:35:41.770009 2026] [:error] [pid 47772:tid 47794] [client 147.135.252.148:35440] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeUgfYc0L16cb4smAz8RIAAAAAU"]
[Mon Apr 20 02:35:44.500930 2026] [:error] [pid 47772:tid 47792] [client 147.135.252.148:35444] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeUggIc0L16cb4smAz8RIQAAAAM"]
[Mon Apr 20 02:35:47.062693 2026] [:error] [pid 15694:tid 15747] [client 147.135.252.148:44720] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeUgg7imB-jol1fwqAo4nAAAAZU"]
[Mon Apr 20 02:36:09.698491 2026] [:error] [pid 15694:tid 15743] [client 147.135.252.148:37436] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeUgmbimB-jol1fwqAo47wAAAZE"]
[Mon Apr 20 02:36:11.698636 2026] [:error] [pid 47773:tid 47836] [client 147.135.252.148:50522] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aeUgm-iBHdnCJDuPq9B7PAAAAFQ"]
[Mon Apr 20 02:36:13.868402 2026] [:error] [pid 15764:tid 15842] [client 147.135.252.148:50536] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeUgnWLL_sqdSHoVp-SC5QAAAlA"]
[Mon Apr 20 02:36:15.994382 2026] [:error] [pid 15760:tid 15789] [client 147.135.252.148:50538] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aeUgn_SdD_XHQMJ_ISu3VgAAAdU"]
[Mon Apr 20 02:36:17.800520 2026] [:error] [pid 47772:tid 47795] [client 147.135.252.148:38366] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeUgoYc0L16cb4smAz8ROQAAAAY"]
[Mon Apr 20 02:36:19.913827 2026] [:error] [pid 15693:tid 15713] [client 147.135.252.148:38382] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeUgo8NMD-ccazQlTsl0JAAAAVE"]
[Mon Apr 20 02:36:22.060478 2026] [:error] [pid 47773:tid 47828] [client 147.135.252.148:38390] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeUgpuiBHdnCJDuPq9B7QQAAAEw"]
[Mon Apr 20 02:36:23.990756 2026] [:error] [pid 15694:tid 15744] [client 147.135.252.148:38402] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeUgp7imB-jol1fwqAo49wAAAZI"]
[Mon Apr 20 02:36:25.942995 2026] [:error] [pid 15764:tid 15836] [client 147.135.252.148:38418] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeUgqWLL_sqdSHoVp-SC7gAAAko"]
[Mon Apr 20 02:36:28.074461 2026] [:error] [pid 15764:tid 15828] [client 147.135.252.148:58450] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeUgrGLL_sqdSHoVp-SC8QAAAkI"]
[Mon Apr 20 02:36:30.213541 2026] [:error] [pid 15764:tid 15829] [client 147.135.252.148:58458] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeUgrmLL_sqdSHoVp-SC9gAAAkM"]
[Mon Apr 20 02:36:32.397794 2026] [:error] [pid 15694:tid 15742] [client 147.135.252.148:58464] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeUgsLimB-jol1fwqAo5CAAAAZA"]
[Mon Apr 20 02:36:34.278582 2026] [:error] [pid 15765:tid 15856] [client 147.135.252.148:58478] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeUgsvRqinw-W5EwQ74gNwAAAoM"]
[Mon Apr 20 02:36:36.373016 2026] [:error] [pid 15764:tid 15841] [client 147.135.252.148:46884] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeUgtGLL_sqdSHoVp-SC_wAAAk8"]
[Mon Apr 20 02:36:38.649099 2026] [:error] [pid 15764:tid 15838] [client 147.135.252.148:46892] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeUgtmLL_sqdSHoVp-SDBAAAAkw"]
[Mon Apr 20 02:36:40.701021 2026] [:error] [pid 47886:tid 47911] [client 147.135.252.148:46894] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeUguESe8yiyuPrD7yOg8AAAANc"]
[Mon Apr 20 02:36:42.714796 2026] [:error] [pid 15760:tid 15772] [client 147.135.252.148:46908] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeUguvSdD_XHQMJ_ISu3dAAAAcQ"]
[Mon Apr 20 02:36:44.825263 2026] [:error] [pid 15760:tid 15768] [client 147.135.252.148:46910] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeUgvPSdD_XHQMJ_ISu3ewAAAcA"]
[Mon Apr 20 02:36:46.881655 2026] [:error] [pid 15760:tid 15789] [client 147.135.252.148:49180] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeUgvvSdD_XHQMJ_ISu3fQAAAdU"]
[Mon Apr 20 02:36:49.017998 2026] [:error] [pid 47775:tid 47867] [client 147.135.252.148:49192] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeUgwbmztjlk9tsmoexIrQAAAJg"]
[Mon Apr 20 02:36:50.994495 2026] [:error] [pid 15765:tid 15865] [client 147.135.252.148:49196] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeUgwvRqinw-W5EwQ74gQgAAAow"]
[Mon Apr 20 02:36:53.090737 2026] [:error] [pid 47775:tid 47846] [client 147.135.252.148:49212] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeUgxbmztjlk9tsmoexIsQAAAIM"]
[Mon Apr 20 02:36:55.169784 2026] [:error] [pid 15765:tid 15866] [client 147.135.252.148:49224] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeUgx_Rqinw-W5EwQ74gRAAAAo0"]
[Mon Apr 20 02:36:57.373568 2026] [:error] [pid 15763:tid 15815] [client 147.135.252.148:44036] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeUgybMXv1Y1THOoxaA_7gAAAhM"]
[Mon Apr 20 02:36:59.660782 2026] [:error] [pid 47886:tid 47892] [client 147.135.252.148:44048] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeUgy0Se8yiyuPrD7yOg9AAAAMQ"]
[Mon Apr 20 02:37:02.064829 2026] [:error] [pid 47886:tid 47910] [client 147.135.252.148:44052] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeUgzkSe8yiyuPrD7yOg9QAAANY"]
[Mon Apr 20 02:37:04.180514 2026] [:error] [pid 15760:tid 15790] [client 147.135.252.148:44064] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeUg0PSdD_XHQMJ_ISu3hwAAAdY"]
[Mon Apr 20 02:37:06.264585 2026] [:error] [pid 15694:tid 15746] [client 147.135.252.148:39464] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeUg0rimB-jol1fwqAo5FAAAAZQ"]
[Mon Apr 20 02:37:27.870801 2026] [:error] [pid 15765:tid 15852] [client 147.135.252.148:39466] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeUg5_Rqinw-W5EwQ74gXAAAAoA"]
[Mon Apr 20 02:37:29.872747 2026] [:error] [pid 15694:tid 15726] [client 147.135.252.148:52980] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeUg6bimB-jol1fwqAo5NQAAAYM"]
[Mon Apr 20 02:37:31.845393 2026] [:error] [pid 15764:tid 15851] [client 147.135.252.148:52988] [client 147.135.252.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeUg62LL_sqdSHoVp-SDPwAAAlg"]
[Mon Apr 20 04:10:32.147707 2026] [:error] [pid 64440:tid 64466] [client 185.61.20.154:24255] [client 185.61.20.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.61.20.154, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeU2uNkVUvTgp8p7mrO79AAAANc"]
[Mon Apr 20 04:10:32.160280 2026] [proxy_fcgi:error] [pid 64440:tid 64466] [client 185.61.20.154:24255] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 04:32:20.971309 2026] [:error] [pid 64333:tid 64391] [client 54.37.252.231:41420] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeU71HZav9wH8wxMd_sscAAAAE8"]
[Mon Apr 20 04:32:23.541620 2026] [:error] [pid 64333:tid 64382] [client 54.37.252.231:48010] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeU713Zav9wH8wxMd_sseQAAAEY"]
[Mon Apr 20 04:32:26.063451 2026] [:error] [pid 64440:tid 64453] [client 54.37.252.231:48022] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeU72tkVUvTgp8p7mrPGzgAAAMo"]
[Mon Apr 20 04:32:28.488898 2026] [:error] [pid 64332:tid 64363] [client 54.37.252.231:48026] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeU73MAQ57uMKAVSYEnnOQAAABU"]
[Mon Apr 20 04:32:30.962070 2026] [:error] [pid 64332:tid 64353] [client 54.37.252.231:48030] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeU73sAQ57uMKAVSYEnnPAAAAAs"]
[Mon Apr 20 04:32:33.513372 2026] [:error] [pid 64334:tid 64403] [client 54.37.252.231:40804] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aeU74cNh9IxxDqsrPyNzHQAAAIA"]
[Mon Apr 20 04:32:36.005011 2026] [:error] [pid 64332:tid 64353] [client 54.37.252.231:40812] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeU75MAQ57uMKAVSYEnnQwAAAAs"]
[Mon Apr 20 04:32:38.525677 2026] [:error] [pid 64440:tid 64463] [client 54.37.252.231:40824] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeU75tkVUvTgp8p7mrPG5AAAANQ"]
[Mon Apr 20 04:32:41.039789 2026] [:error] [pid 64333:tid 64392] [client 54.37.252.231:40828] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeU76XZav9wH8wxMd_ssiQAAAFA"]
[Mon Apr 20 04:32:43.540824 2026] [:error] [pid 64334:tid 64413] [client 54.37.252.231:41522] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeU768Nh9IxxDqsrPyNzRQAAAIo"]
[Mon Apr 20 04:32:46.061627 2026] [:error] [pid 64334:tid 64420] [client 54.37.252.231:41524] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeU77sNh9IxxDqsrPyNzSgAAAJE"]
[Mon Apr 20 04:32:48.545084 2026] [:error] [pid 64333:tid 64384] [client 54.37.252.231:41530] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeU78HZav9wH8wxMd_sslAAAAEg"]
[Mon Apr 20 04:32:51.019654 2026] [:error] [pid 64334:tid 64416] [client 54.37.252.231:41534] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeU788Nh9IxxDqsrPyNzUwAAAI0"]
[Mon Apr 20 04:32:53.551724 2026] [:error] [pid 64332:tid 64351] [client 54.37.252.231:46694] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeU79cAQ57uMKAVSYEnnUwAAAAk"]
[Mon Apr 20 04:32:56.051334 2026] [:error] [pid 64440:tid 64452] [client 54.37.252.231:46706] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeU7-NkVUvTgp8p7mrPG9QAAAMk"]
[Mon Apr 20 04:32:58.548302 2026] [:error] [pid 64332:tid 64366] [client 54.37.252.231:46708] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeU7-sAQ57uMKAVSYEnnVwAAABg"]
[Mon Apr 20 04:33:01.017142 2026] [:error] [pid 64440:tid 64443] [client 54.37.252.231:46722] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeU7_dkVUvTgp8p7mrPG_wAAAMA"]
[Mon Apr 20 04:33:03.494215 2026] [:error] [pid 64334:tid 64420] [client 54.37.252.231:54826] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeU7_8Nh9IxxDqsrPyNzYgAAAJE"]
[Mon Apr 20 04:33:05.982217 2026] [:error] [pid 64333:tid 64386] [client 54.37.252.231:54830] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeU8AXZav9wH8wxMd_sspwAAAEo"]
[Mon Apr 20 04:33:08.269170 2026] [:error] [pid 64334:tid 64422] [client 54.37.252.231:54838] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeU8BMNh9IxxDqsrPyNzcQAAAJM"]
[Mon Apr 20 04:33:10.742004 2026] [:error] [pid 64334:tid 64416] [client 54.37.252.231:54846] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeU8BsNh9IxxDqsrPyNzdAAAAI0"]
[Mon Apr 20 04:33:13.199178 2026] [:error] [pid 64334:tid 64410] [client 54.37.252.231:42918] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeU8CcNh9IxxDqsrPyNzeAAAAIc"]
[Mon Apr 20 04:33:15.654917 2026] [:error] [pid 64332:tid 64365] [client 54.37.252.231:42920] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeU8C8AQ57uMKAVSYEnnaAAAABc"]
[Mon Apr 20 04:33:17.585627 2026] [:error] [pid 64333:tid 64394] [client 54.37.252.231:43592] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeU8DXZav9wH8wxMd_sssQAAAFI"]
[Mon Apr 20 05:55:29.525037 2026] [proxy_fcgi:error] [pid 47731:tid 47747] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:29.791679 2026] [proxy_fcgi:error] [pid 47731:tid 47746] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:30.058526 2026] [proxy_fcgi:error] [pid 47731:tid 47736] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:30.326698 2026] [proxy_fcgi:error] [pid 47731:tid 47739] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:30.592616 2026] [proxy_fcgi:error] [pid 47731:tid 47735] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:30.859406 2026] [proxy_fcgi:error] [pid 47731:tid 47757] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:31.126801 2026] [proxy_fcgi:error] [pid 47731:tid 47749] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 05:55:31.393945 2026] [proxy_fcgi:error] [pid 47731:tid 47754] [client 20.91.204.74:16624] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:45.806612 2026] [proxy_fcgi:error] [pid 64333:tid 64387] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:46.072554 2026] [proxy_fcgi:error] [pid 64333:tid 64392] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:46.453876 2026] [proxy_fcgi:error] [pid 64333:tid 64388] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:46.719048 2026] [proxy_fcgi:error] [pid 64333:tid 64391] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:47.251628 2026] [proxy_fcgi:error] [pid 64333:tid 64390] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:47.529194 2026] [proxy_fcgi:error] [pid 64333:tid 64395] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:47.803446 2026] [proxy_fcgi:error] [pid 64333:tid 64392] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:48.069942 2026] [proxy_fcgi:error] [pid 64333:tid 64388] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:48.335368 2026] [proxy_fcgi:error] [pid 64333:tid 64376] [client 4.223.64.52:19344] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:40:48.599159 2026] [:error] [pid 64333:tid 64379] [client 4.223.64.52:19344] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aeVoAHZav9wH8wxMd_t5SQAAAEM"]
[Mon Apr 20 07:40:49.864635 2026] [:error] [pid 47731:tid 47745] [client 4.223.64.52:8180] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aeVoAVOwpc-h7Nzn-iO2XAAAAQw"]
[Mon Apr 20 07:40:52.367154 2026] [:error] [pid 64334:tid 64412] [client 4.223.64.52:4510] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aeVoBMNh9IxxDqsrPyOwmAAAAIk"]
[Mon Apr 20 07:40:53.451643 2026] [:error] [pid 64332:tid 64364] [client 4.223.64.52:14290] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "aeVoBcAQ57uMKAVSYEke-AAAABY"]
[Mon Apr 20 07:40:58.646985 2026] [:error] [pid 64334:tid 64410] [client 4.223.64.52:11886] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeVoCsNh9IxxDqsrPyOwpQAAAIc"]
[Mon Apr 20 07:41:03.452014 2026] [:error] [pid 47731:tid 47734] [client 4.223.64.52:3705] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeVoD1Owpc-h7Nzn-iO2bgAAAQE"]
[Mon Apr 20 07:41:05.602575 2026] [:error] [pid 64440:tid 64461] [client 4.223.64.52:19004] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "aeVoEdkVUvTgp8p7mrP4PAAAANI"]
[Mon Apr 20 07:41:13.325866 2026] [:error] [pid 64440:tid 64447] [client 4.223.64.52:11900] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ihodcrk.php"] [unique_id "aeVoGdkVUvTgp8p7mrP4QwAAAMQ"]
[Mon Apr 20 07:41:15.046005 2026] [:error] [pid 64334:tid 64422] [client 4.223.64.52:3549] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ihodcrk.php"] [unique_id "aeVoG8Nh9IxxDqsrPyOwvQAAAJM"]
[Mon Apr 20 07:41:21.744957 2026] [:error] [pid 64332:tid 64350] [client 4.223.64.52:16516] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ihodcrk.php"] [unique_id "aeVoIcAQ57uMKAVSYEkfCwAAAAg"]
[Mon Apr 20 07:41:29.234424 2026] [:error] [pid 64332:tid 64344] [client 4.223.64.52:19343] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "aeVoKcAQ57uMKAVSYEkfEwAAAAI"]
[Mon Apr 20 07:41:48.093483 2026] [proxy_fcgi:error] [pid 64333:tid 64400] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:48.466030 2026] [proxy_fcgi:error] [pid 64333:tid 64390] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:49.675406 2026] [proxy_fcgi:error] [pid 64333:tid 64393] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:49.956021 2026] [proxy_fcgi:error] [pid 64333:tid 64376] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:50.247061 2026] [proxy_fcgi:error] [pid 64333:tid 64382] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:50.513760 2026] [proxy_fcgi:error] [pid 64333:tid 64386] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:50.802718 2026] [proxy_fcgi:error] [pid 64333:tid 64381] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:51.071598 2026] [proxy_fcgi:error] [pid 64333:tid 64378] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:51.343562 2026] [proxy_fcgi:error] [pid 64333:tid 64397] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 07:41:51.611855 2026] [proxy_fcgi:error] [pid 64333:tid 64380] [client 4.223.64.52:19831] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 10:05:09.071897 2026] [:error] [pid 64333:tid 64386] [client 182.43.70.143:47755] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeWJ1XZav9wH8wxMd_vCrAAAAEo"]
[Mon Apr 20 13:37:29.479298 2026] [:error] [pid 42014:tid 42028] [client 103.65.237.216:50243] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "aeW7mcek-00-ZI0f1Nrw7wAAAQw"]
[Mon Apr 20 13:37:29.782508 2026] [:error] [pid 11441:tid 11446] [client 103.65.237.216:50324] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "aeW7mcixByFUvmh319D4gQAAAMM"]
[Mon Apr 20 14:24:29.136726 2026] [:error] [pid 11441:tid 11455] [client 173.239.214.8:61729] [client 173.239.214.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeXGncixByFUvmh319AK_wAAAMw"]
[Mon Apr 20 14:25:38.286410 2026] [proxy_fcgi:error] [pid 11350:tid 11371] [client 20.107.194.250:5708] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 14:25:38.570726 2026] [proxy_fcgi:error] [pid 11350:tid 11363] [client 20.107.194.250:5708] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 14:25:38.852692 2026] [proxy_fcgi:error] [pid 11350:tid 11366] [client 20.107.194.250:5708] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 14:25:39.134692 2026] [proxy_fcgi:error] [pid 11350:tid 11361] [client 20.107.194.250:5708] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 14:25:39.425657 2026] [proxy_fcgi:error] [pid 11350:tid 11375] [client 20.107.194.250:5708] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 15:28:41.815280 2026] [:error] [pid 11351:tid 11411] [client 43.166.244.66:41238] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeXVqQN8Z1-vktaI_tObtAAAAFg"]
[Mon Apr 20 16:25:20.828217 2026] [:error] [pid 6928:tid 6945] [client 82.35.35.193:60579] [client 82.35.35.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.35.35.193, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeXi8B3y7MHq1iB0qYpYkwAAAU8"]
[Mon Apr 20 16:25:20.841191 2026] [proxy_fcgi:error] [pid 6928:tid 6945] [client 82.35.35.193:60579] AH01071: Got error 'Primary script unknown'
[Mon Apr 20 19:01:35.231061 2026] [:error] [pid 11351:tid 11411] [client 51.83.100.230:46572] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeYHjwN8Z1-vktaI_tPPNwAAAFg"]
[Mon Apr 20 19:01:37.358447 2026] [:error] [pid 11441:tid 11459] [client 51.83.100.230:56292] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeYHkcixByFUvmh319CA7wAAANA"]
[Mon Apr 20 19:01:39.859375 2026] [:error] [pid 42014:tid 42027] [client 51.83.100.230:45674] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aeYHk8ek-00-ZI0f1NpuIQAAAQs"]
[Mon Apr 20 19:01:41.749124 2026] [:error] [pid 11352:tid 11415] [client 51.83.100.230:56304] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeYHlWl10mhMSfJ7ir_HLwAAAIE"]
[Mon Apr 20 19:01:44.047691 2026] [:error] [pid 11494:tid 11506] [client 51.83.100.230:56316] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeYHmMgko5iFiE8YoyTBdwAAAYo"]
[Mon Apr 20 19:01:46.898504 2026] [:error] [pid 11441:tid 11458] [client 51.83.100.230:59734] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aeYHmsixByFUvmh319CA-wAAAM8"]
[Mon Apr 20 19:01:49.042790 2026] [:error] [pid 11441:tid 11445] [client 51.83.100.230:46300] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeYHncixByFUvmh319CA_gAAAMI"]
[Mon Apr 20 19:01:50.983019 2026] [:error] [pid 11350:tid 11383] [client 51.83.100.230:46308] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aeYHnv4EoMBgOJuJnT1wwgAAABg"]
[Mon Apr 20 19:01:53.052138 2026] [:error] [pid 11351:tid 11406] [client 51.83.100.230:46312] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aeYHoQN8Z1-vktaI_tPPOwAAAFM"]
[Mon Apr 20 19:01:55.205968 2026] [:error] [pid 11441:tid 11451] [client 51.83.100.230:34702] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeYHo8ixByFUvmh319CBAwAAAMg"]
[Mon Apr 20 19:01:58.788559 2026] [:error] [pid 11494:tid 11516] [client 51.83.100.230:34712] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeYHpsgko5iFiE8YoyTBfgAAAZQ"]
[Mon Apr 20 19:02:00.929041 2026] [:error] [pid 11351:tid 11392] [client 51.83.100.230:34720] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeYHqAN8Z1-vktaI_tPPPgAAAEU"]
[Mon Apr 20 19:02:03.635446 2026] [:error] [pid 11350:tid 11360] [client 51.83.100.230:34734] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeYHq_4EoMBgOJuJnT1w2AAAAAE"]
[Mon Apr 20 19:02:05.912036 2026] [:error] [pid 6928:tid 6933] [client 51.83.100.230:49516] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeYHrR3y7MHq1iB0qYqZtgAAAUM"]
[Mon Apr 20 19:02:08.380808 2026] [:error] [pid 11350:tid 11362] [client 51.83.100.230:49522] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeYHsP4EoMBgOJuJnT1w5gAAAAM"]
[Mon Apr 20 19:02:10.482818 2026] [:error] [pid 11350:tid 11363] [client 51.83.100.230:49530] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeYHsv4EoMBgOJuJnT1w7QAAAAQ"]
[Mon Apr 20 19:02:12.674175 2026] [:error] [pid 11351:tid 11397] [client 51.83.100.230:49542] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeYHtAN8Z1-vktaI_tPPRwAAAEo"]
[Mon Apr 20 19:02:15.074599 2026] [:error] [pid 11352:tid 11414] [client 51.83.100.230:60536] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeYHt2l10mhMSfJ7ir_HOAAAAIA"]
[Mon Apr 20 19:02:17.244836 2026] [:error] [pid 11351:tid 11388] [client 51.83.100.230:60540] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeYHuQN8Z1-vktaI_tPPTwAAAEE"]
[Mon Apr 20 19:02:19.749752 2026] [:error] [pid 11351:tid 11387] [client 51.83.100.230:60556] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aeYHuwN8Z1-vktaI_tPPXAAAAEA"]
[Mon Apr 20 19:02:21.999497 2026] [:error] [pid 11441:tid 11450] [client 51.83.100.230:60568] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aeYHvcixByFUvmh319CBEwAAAMc"]
[Mon Apr 20 19:02:24.314379 2026] [:error] [pid 11350:tid 11370] [client 51.83.100.230:46828] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aeYHwP4EoMBgOJuJnT1xcwAAAAs"]
[Mon Apr 20 19:02:26.510622 2026] [:error] [pid 11441:tid 11453] [client 51.83.100.230:46838] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeYHwsixByFUvmh319CBFwAAAMo"]
[Mon Apr 20 19:02:28.939664 2026] [:error] [pid 11350:tid 11373] [client 51.83.100.230:46844] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeYHxP4EoMBgOJuJnT1xigAAAA4"]
[Mon Apr 20 19:02:30.975438 2026] [:error] [pid 11351:tid 11402] [client 51.83.100.230:46846] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeYHxgN8Z1-vktaI_tPPfgAAAE8"]
[Mon Apr 20 19:02:59.638912 2026] [:error] [pid 11351:tid 11405] [client 51.83.100.230:57690] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeYH4wN8Z1-vktaI_tPPtAAAAFI"]
[Mon Apr 20 19:03:03.099432 2026] [:error] [pid 11441:tid 11453] [client 51.83.100.230:35542] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeYH58ixByFUvmh319CBZwAAAMo"]
[Mon Apr 20 19:03:05.635263 2026] [:error] [pid 11351:tid 11393] [client 51.83.100.230:57586] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeYH6QN8Z1-vktaI_tPP6QAAAEY"]
[Mon Apr 20 19:03:07.876099 2026] [:error] [pid 11350:tid 11378] [client 51.83.100.230:57600] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeYH6_4EoMBgOJuJnT1yCgAAABM"]
[Mon Apr 20 19:03:10.112520 2026] [:error] [pid 11351:tid 11389] [client 51.83.100.230:57606] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeYH7gN8Z1-vktaI_tPP7wAAAEI"]
[Mon Apr 20 19:03:12.803555 2026] [:error] [pid 11351:tid 11389] [client 51.83.100.230:42760] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeYH8AN8Z1-vktaI_tPP-gAAAEI"]
[Mon Apr 20 19:03:15.346846 2026] [:error] [pid 11350:tid 11362] [client 51.83.100.230:37688] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeYH8_4EoMBgOJuJnT1yFAAAAAM"]
[Mon Apr 20 19:03:18.059143 2026] [:error] [pid 11352:tid 11437] [client 51.83.100.230:37700] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeYH9ml10mhMSfJ7ir_HRwAAAJc"]
[Mon Apr 20 19:03:21.093561 2026] [:error] [pid 11350:tid 11371] [client 51.83.100.230:37716] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeYH-f4EoMBgOJuJnT1yTAAAAAw"]
[Mon Apr 20 19:03:23.331636 2026] [:error] [pid 11494:tid 11499] [client 51.83.100.230:37728] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeYH-8gko5iFiE8YoyTB1wAAAYM"]
[Mon Apr 20 19:03:26.524605 2026] [:error] [pid 11350:tid 11374] [client 51.83.100.230:52806] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeYH_v4EoMBgOJuJnT1yVwAAAA8"]
[Mon Apr 20 19:03:29.750759 2026] [:error] [pid 42014:tid 42032] [client 51.83.100.230:58312] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aeYIAcek-00-ZI0f1NpuWwAAARA"]
[Mon Apr 20 19:03:31.886773 2026] [:error] [pid 42014:tid 42022] [client 51.83.100.230:58326] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aeYIA8ek-00-ZI0f1NpuXAAAAQY"]
[Mon Apr 20 19:03:34.085070 2026] [:error] [pid 6928:tid 6931] [client 51.83.100.230:58334] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeYIBh3y7MHq1iB0qYqZ4wAAAUE"]
[Mon Apr 20 19:03:37.388924 2026] [:error] [pid 11351:tid 11403] [client 51.83.100.230:58112] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeYICQN8Z1-vktaI_tPQDwAAAFA"]
[Mon Apr 20 19:03:39.516458 2026] [:error] [pid 11351:tid 11394] [client 51.83.100.230:52026] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aeYICwN8Z1-vktaI_tPQEgAAAEc"]
[Mon Apr 20 19:03:42.755122 2026] [:error] [pid 11351:tid 11406] [client 51.83.100.230:52042] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aeYIDgN8Z1-vktaI_tPQGQAAAFM"]
[Mon Apr 20 19:03:45.033432 2026] [:error] [pid 11352:tid 11414] [client 51.83.100.230:46842] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aeYIEWl10mhMSfJ7ir_HUAAAAIA"]
[Mon Apr 20 19:03:47.338391 2026] [:error] [pid 11494:tid 11514] [client 51.83.100.230:46848] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeYIE8gko5iFiE8YoyTB4gAAAZI"]
[Mon Apr 20 19:03:50.152052 2026] [:error] [pid 11441:tid 11452] [client 51.83.100.230:46856] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeYIFsixByFUvmh319CBfgAAAMk"]
[Mon Apr 20 19:03:53.318350 2026] [:error] [pid 11351:tid 11391] [client 51.83.100.230:49138] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeYIGQN8Z1-vktaI_tPQKgAAAEQ"]
[Mon Apr 20 19:03:55.284601 2026] [:error] [pid 11441:tid 11465] [client 51.83.100.230:53430] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeYIG8ixByFUvmh319CBgAAAANY"]
[Mon Apr 20 19:04:28.430285 2026] [:error] [pid 11350:tid 11368] [client 51.83.100.230:34966] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeYIPP4EoMBgOJuJnT1zAAAAAAk"]
[Mon Apr 20 19:04:30.931283 2026] [:error] [pid 11441:tid 11461] [client 51.83.100.230:34978] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeYIPsixByFUvmh319CB-wAAANI"]
[Mon Apr 20 19:04:33.541930 2026] [:error] [pid 6928:tid 6942] [client 51.83.100.230:34982] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeYIQR3y7MHq1iB0qYqaFAAAAUw"]
[Mon Apr 20 19:04:35.611818 2026] [:error] [pid 11494:tid 11520] [client 51.83.100.230:59054] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeYIQ8gko5iFiE8YoyTCRgAAAZg"]
[Mon Apr 20 19:04:37.831032 2026] [:error] [pid 11494:tid 11519] [client 51.83.100.230:59068] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeYIRcgko5iFiE8YoyTCRwAAAZc"]
[Mon Apr 20 19:04:40.470090 2026] [:error] [pid 11494:tid 11512] [client 51.83.100.230:55904] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeYISMgko5iFiE8YoyTCTAAAAZA"]
[Mon Apr 20 19:04:42.736962 2026] [:error] [pid 11441:tid 11454] [client 51.83.100.230:59082] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeYISsixByFUvmh319CCAQAAAMs"]
[Mon Apr 20 19:04:46.067335 2026] [:error] [pid 11350:tid 11363] [client 51.83.100.230:43414] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeYITv4EoMBgOJuJnT1zSQAAAAQ"]
[Mon Apr 20 19:04:48.353114 2026] [:error] [pid 11351:tid 11396] [client 51.83.100.230:35880] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeYIUAN8Z1-vktaI_tPQbwAAAEk"]
[Mon Apr 20 19:04:50.659005 2026] [:error] [pid 11351:tid 11407] [client 51.83.100.230:35896] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeYIUgN8Z1-vktaI_tPQcQAAAFQ"]
[Mon Apr 20 19:04:53.360133 2026] [:error] [pid 6928:tid 6934] [client 51.83.100.230:43418] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeYIVR3y7MHq1iB0qYqaJQAAAUQ"]
[Mon Apr 20 19:04:55.899385 2026] [:error] [pid 11350:tid 11360] [client 51.83.100.230:32812] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aeYIV_4EoMBgOJuJnT1zYwAAAAE"]
[Mon Apr 20 19:04:58.208531 2026] [:error] [pid 11351:tid 11396] [client 51.83.100.230:32826] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aeYIWgN8Z1-vktaI_tPQdQAAAEk"]
[Mon Apr 20 19:05:00.766245 2026] [:error] [pid 6928:tid 6943] [client 51.83.100.230:32838] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aeYIXB3y7MHq1iB0qYqaLAAAAU0"]
[Mon Apr 20 19:05:03.118414 2026] [:error] [pid 11352:tid 11435] [client 51.83.100.230:32846] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeYIX2l10mhMSfJ7ir_HbQAAAJU"]
[Mon Apr 20 19:05:07.501616 2026] [:error] [pid 11350:tid 11365] [client 51.83.100.230:60550] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeYIY_4EoMBgOJuJnT1zfAAAAAY"]
[Mon Apr 20 22:55:02.286634 2026] [:error] [pid 11441:tid 11463] [client 182.42.105.144:33005] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeY-RsixByFUvmh319C3twAAANQ"]
[Tue Apr 21 00:57:53.707894 2026] [proxy_fcgi:error] [pid 11351:tid 11398] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:53.948637 2026] [proxy_fcgi:error] [pid 11351:tid 11393] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:54.215759 2026] [proxy_fcgi:error] [pid 11351:tid 11396] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:54.454570 2026] [proxy_fcgi:error] [pid 11351:tid 11399] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:55.116152 2026] [proxy_fcgi:error] [pid 11351:tid 11409] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:55.378905 2026] [proxy_fcgi:error] [pid 11351:tid 11395] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:55.859512 2026] [proxy_fcgi:error] [pid 11351:tid 11388] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:56.098694 2026] [proxy_fcgi:error] [pid 11351:tid 11402] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:56.337976 2026] [proxy_fcgi:error] [pid 11351:tid 11408] [client 20.216.130.159:14166] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:57:56.579486 2026] [:error] [pid 11351:tid 11405] [client 20.216.130.159:14166] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "aeZbFAN8Z1-vktaI_tOB6QAAAFI"]
[Tue Apr 21 00:57:58.338723 2026] [:error] [pid 6928:tid 6935] [client 20.216.130.159:14154] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "aeZbFh3y7MHq1iB0qYrh5QAAAUU"]
[Tue Apr 21 00:57:59.406283 2026] [:error] [pid 11350:tid 11375] [client 20.216.130.159:9023] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "aeZbF_4EoMBgOJuJnT0V-QAAABA"]
[Tue Apr 21 00:58:00.345059 2026] [:error] [pid 11352:tid 11428] [client 20.216.130.159:13601] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/166.php"] [unique_id "aeZbGGl10mhMSfJ7ir_7OwAAAI4"]
[Tue Apr 21 00:58:06.699313 2026] [:error] [pid 11352:tid 11435] [client 20.216.130.159:1535] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "aeZbHml10mhMSfJ7ir_7SQAAAJU"]
[Tue Apr 21 00:58:10.607710 2026] [:error] [pid 11351:tid 11392] [client 20.216.130.159:14135] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "aeZbIgN8Z1-vktaI_tOB-wAAAEU"]
[Tue Apr 21 00:58:25.977866 2026] [:error] [pid 11351:tid 11389] [client 20.216.130.159:4303] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "aeZbMQN8Z1-vktaI_tOCJwAAAEI"]
[Tue Apr 21 00:58:33.357832 2026] [:error] [pid 11351:tid 11399] [client 20.216.130.159:7299] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "aeZbOQN8Z1-vktaI_tOCTQAAAEw"]
[Tue Apr 21 00:58:39.419803 2026] [:error] [pid 11350:tid 11359] [client 20.216.130.159:41591] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "aeZbP_4EoMBgOJuJnT0WggAAAAA"]
[Tue Apr 21 00:58:43.427490 2026] [:error] [pid 11350:tid 11367] [client 20.216.130.159:9151] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tt.php"] [unique_id "aeZbQ_4EoMBgOJuJnT0WmAAAAAg"]
[Tue Apr 21 00:58:54.297876 2026] [:error] [pid 11351:tid 11401] [client 20.216.130.159:1454] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "aeZbTgN8Z1-vktaI_tOCpQAAAE4"]
[Tue Apr 21 00:58:58.022850 2026] [proxy_fcgi:error] [pid 11351:tid 11390] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:58:58.975870 2026] [proxy_fcgi:error] [pid 11351:tid 11392] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:00.266615 2026] [proxy_fcgi:error] [pid 11351:tid 11396] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:00.523208 2026] [proxy_fcgi:error] [pid 11351:tid 11409] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:00.762878 2026] [proxy_fcgi:error] [pid 11351:tid 11404] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:01.005118 2026] [proxy_fcgi:error] [pid 11351:tid 11405] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:01.264578 2026] [proxy_fcgi:error] [pid 11351:tid 11389] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:01.917589 2026] [proxy_fcgi:error] [pid 11351:tid 11406] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:02.159011 2026] [proxy_fcgi:error] [pid 11351:tid 11392] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:02.398445 2026] [proxy_fcgi:error] [pid 11351:tid 11410] [client 20.216.130.159:1438] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 00:59:02.752149 2026] [:error] [pid 11351:tid 11408] [client 20.216.130.159:1438] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi001.PhP7"] [unique_id "aeZbVgN8Z1-vktaI_tOCywAAAFU"]
[Tue Apr 21 00:59:05.594363 2026] [:error] [pid 6928:tid 6939] [client 20.216.130.159:1809] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi001.PhP7"] [unique_id "aeZbWR3y7MHq1iB0qYriLgAAAUk"]
[Tue Apr 21 00:59:06.440447 2026] [:error] [pid 11351:tid 11387] [client 20.216.130.159:1262] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi001.PhP7"] [unique_id "aeZbWgN8Z1-vktaI_tOC1wAAAEA"]
[Tue Apr 21 00:59:07.531821 2026] [:error] [pid 11350:tid 11371] [client 20.216.130.159:18355] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi001.PhP7"] [unique_id "aeZbW_4EoMBgOJuJnT0W9AAAAAw"]
[Tue Apr 21 00:59:09.740333 2026] [:error] [pid 11350:tid 11362] [client 20.216.130.159:41492] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kikikoko.php"] [unique_id "aeZbXf4EoMBgOJuJnT0W_AAAAAM"]
[Tue Apr 21 00:59:12.410308 2026] [:error] [pid 11350:tid 11372] [client 20.216.130.159:1062] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kikikoko.php"] [unique_id "aeZbYP4EoMBgOJuJnT0XCAAAAA0"]
[Tue Apr 21 00:59:13.813548 2026] [:error] [pid 11494:tid 11499] [client 20.216.130.159:25731] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kikikoko.php"] [unique_id "aeZbYcgko5iFiE8YoyQr0AAAAYM"]
[Tue Apr 21 00:59:15.283391 2026] [:error] [pid 11352:tid 11437] [client 20.216.130.159:29829] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kikikoko.php"] [unique_id "aeZbY2l10mhMSfJ7ir_7kwAAAJc"]
[Tue Apr 21 00:59:19.439993 2026] [:error] [pid 11494:tid 11498] [client 20.216.130.159:1066] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeZbZ8gko5iFiE8YoyQr-gAAAYI"]
[Tue Apr 21 00:59:21.888138 2026] [:error] [pid 11350:tid 11372] [client 20.216.130.159:7361] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeZbaf4EoMBgOJuJnT0XHwAAAA0"]
[Tue Apr 21 00:59:24.520884 2026] [:error] [pid 11350:tid 11379] [client 20.216.130.159:10314] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeZbbP4EoMBgOJuJnT0XMAAAABQ"]
[Tue Apr 21 00:59:28.334628 2026] [:error] [pid 11441:tid 11443] [client 20.216.130.159:7414] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "aeZbcMixByFUvmh319DWQQAAAMA"]
[Tue Apr 21 00:59:31.626125 2026] [:error] [pid 6928:tid 6941] [client 20.216.130.159:11176] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeZbcx3y7MHq1iB0qYriZwAAAUs"]
[Tue Apr 21 00:59:35.589342 2026] [:error] [pid 6928:tid 6944] [client 20.216.130.159:12943] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeZbdx3y7MHq1iB0qYricgAAAU4"]
[Tue Apr 21 00:59:47.940922 2026] [:error] [pid 11441:tid 11451] [client 20.216.130.159:1213] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "aeZbg8ixByFUvmh319DWaQAAAMg"]
[Tue Apr 21 00:59:49.933152 2026] [:error] [pid 11350:tid 11364] [client 20.216.130.159:13184] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "aeZbhf4EoMBgOJuJnT0XXgAAAAU"]
[Tue Apr 21 00:59:51.763271 2026] [:error] [pid 11494:tid 11520] [client 20.216.130.159:2033] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "aeZbh8gko5iFiE8YoyQsTwAAAZg"]
[Tue Apr 21 00:59:56.187339 2026] [:error] [pid 6928:tid 6937] [client 20.216.130.159:4187] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "aeZbjB3y7MHq1iB0qYrikwAAAUc"]
[Tue Apr 21 01:00:02.443719 2026] [proxy_fcgi:error] [pid 11350:tid 11370] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:02.686036 2026] [proxy_fcgi:error] [pid 11350:tid 11374] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:02.925677 2026] [proxy_fcgi:error] [pid 11350:tid 11380] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:04.258798 2026] [proxy_fcgi:error] [pid 11350:tid 11367] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:05.865307 2026] [proxy_fcgi:error] [pid 11350:tid 11380] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:06.109739 2026] [proxy_fcgi:error] [pid 11350:tid 11379] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:06.349316 2026] [proxy_fcgi:error] [pid 11350:tid 11375] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:06.598944 2026] [proxy_fcgi:error] [pid 11350:tid 11371] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:06.863118 2026] [proxy_fcgi:error] [pid 11350:tid 11366] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:07.102276 2026] [proxy_fcgi:error] [pid 11350:tid 11377] [client 20.216.130.159:9667] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:00:07.337674 2026] [:error] [pid 11350:tid 11382] [client 20.216.130.159:9667] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeZbl_4EoMBgOJuJnT0XqAAAABc"]
[Tue Apr 21 01:00:09.895416 2026] [:error] [pid 11494:tid 11518] [client 20.216.130.159:1623] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeZbmcgko5iFiE8YoyQshAAAAZY"]
[Tue Apr 21 01:00:12.588779 2026] [:error] [pid 11351:tid 11399] [client 20.216.130.159:60708] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeZbnAN8Z1-vktaI_tODmgAAAEw"]
[Tue Apr 21 01:00:15.218963 2026] [:error] [pid 42014:tid 42024] [client 20.216.130.159:1906] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeZbn8ek-00-ZI0f1NqmrgAAAQg"]
[Tue Apr 21 01:00:17.914161 2026] [:error] [pid 11351:tid 11399] [client 20.216.130.159:20343] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aeZboQN8Z1-vktaI_tODrwAAAEw"]
[Tue Apr 21 01:00:19.638519 2026] [:error] [pid 11350:tid 11366] [client 20.216.130.159:13917] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aeZbo_4EoMBgOJuJnT0X2QAAAAc"]
[Tue Apr 21 01:00:21.150493 2026] [:error] [pid 11441:tid 11463] [client 20.216.130.159:61955] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aeZbpcixByFUvmh319DWqwAAANQ"]
[Tue Apr 21 01:00:23.400630 2026] [:error] [pid 11350:tid 11381] [client 20.216.130.159:13911] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aeZbp_4EoMBgOJuJnT0X5gAAABY"]
[Tue Apr 21 01:00:25.735854 2026] [:error] [pid 11350:tid 11373] [client 20.216.130.159:10514] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aeZbqf4EoMBgOJuJnT0X8AAAAA4"]
[Tue Apr 21 01:00:29.585807 2026] [:error] [pid 11350:tid 11366] [client 20.216.130.159:7489] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aeZbrf4EoMBgOJuJnT0X-wAAAAc"]
[Tue Apr 21 01:00:33.746592 2026] [:error] [pid 6928:tid 6934] [client 20.216.130.159:31549] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aeZbsR3y7MHq1iB0qYri3AAAAUQ"]
[Tue Apr 21 01:00:35.317041 2026] [:error] [pid 11494:tid 11501] [client 20.216.130.159:1870] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aeZbs8gko5iFiE8YoyQsugAAAYU"]
[Tue Apr 21 01:00:36.520097 2026] [:error] [pid 6928:tid 6931] [client 20.216.130.159:60686] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aeZbtB3y7MHq1iB0qYri3gAAAUE"]
[Tue Apr 21 01:00:39.572065 2026] [:error] [pid 11350:tid 11360] [client 20.216.130.159:26600] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aeZbt_4EoMBgOJuJnT0YIwAAAAE"]
[Tue Apr 21 01:00:42.282821 2026] [:error] [pid 11352:tid 11416] [client 20.216.130.159:8900] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aeZbuml10mhMSfJ7ir_8CQAAAII"]
[Tue Apr 21 01:00:43.905809 2026] [:error] [pid 11494:tid 11520] [client 20.216.130.159:13851] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aeZbu8gko5iFiE8YoyQsxAAAAZg"]
[Tue Apr 21 01:00:45.633856 2026] [:error] [pid 11351:tid 11390] [client 20.216.130.159:4223] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "aeZbvQN8Z1-vktaI_tOD4QAAAEM"]
[Tue Apr 21 01:00:47.567907 2026] [:error] [pid 11352:tid 11438] [client 20.216.130.159:11194] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "aeZbv2l10mhMSfJ7ir_8CgAAAJg"]
[Tue Apr 21 01:00:49.219363 2026] [:error] [pid 6928:tid 6934] [client 20.216.130.159:58816] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "aeZbwR3y7MHq1iB0qYri6AAAAUQ"]
[Tue Apr 21 01:00:51.893011 2026] [:error] [pid 6928:tid 6945] [client 20.216.130.159:20205] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Jcrop.php"] [unique_id "aeZbwx3y7MHq1iB0qYri7AAAAU8"]
[Tue Apr 21 01:00:54.648569 2026] [:error] [pid 6928:tid 6941] [client 20.216.130.159:7749] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "aeZbxh3y7MHq1iB0qYri9gAAAUs"]
[Tue Apr 21 01:00:59.492798 2026] [:error] [pid 11352:tid 11419] [client 20.216.130.159:7430] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "aeZby2l10mhMSfJ7ir_8EQAAAIU"]
[Tue Apr 21 01:01:04.146284 2026] [:error] [pid 42014:tid 42026] [client 20.216.130.159:21672] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "aeZb0Mek-00-ZI0f1Nqm1QAAAQo"]
[Tue Apr 21 01:01:05.885085 2026] [:error] [pid 11441:tid 11454] [client 20.216.130.159:30632] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abc.php"] [unique_id "aeZb0cixByFUvmh319DW6gAAAMs"]
[Tue Apr 21 01:01:07.948910 2026] [proxy_fcgi:error] [pid 6928:tid 6944] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:08.189717 2026] [proxy_fcgi:error] [pid 6928:tid 6951] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:08.434536 2026] [proxy_fcgi:error] [pid 6928:tid 6943] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:08.919797 2026] [proxy_fcgi:error] [pid 6928:tid 6933] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:09.158846 2026] [proxy_fcgi:error] [pid 6928:tid 6942] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:09.427393 2026] [proxy_fcgi:error] [pid 6928:tid 6938] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:09.668633 2026] [proxy_fcgi:error] [pid 6928:tid 6949] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:09.921387 2026] [proxy_fcgi:error] [pid 6928:tid 6935] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:10.184157 2026] [proxy_fcgi:error] [pid 6928:tid 6932] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:10.423298 2026] [proxy_fcgi:error] [pid 6928:tid 6941] [client 20.216.130.159:11231] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:01:10.672567 2026] [:error] [pid 6928:tid 6947] [client 20.216.130.159:11231] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeZb1h3y7MHq1iB0qYrjGAAAAVE"]
[Tue Apr 21 01:01:12.776129 2026] [:error] [pid 42014:tid 42039] [client 20.216.130.159:42506] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeZb2Mek-00-ZI0f1Nqm3wAAARc"]
[Tue Apr 21 01:01:16.945578 2026] [:error] [pid 11351:tid 11401] [client 20.216.130.159:30300] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeZb3AN8Z1-vktaI_tOEPwAAAE4"]
[Tue Apr 21 01:01:19.611855 2026] [:error] [pid 6928:tid 6948] [client 20.216.130.159:20530] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeZb3x3y7MHq1iB0qYrjGwAAAVI"]
[Tue Apr 21 01:01:23.907017 2026] [:error] [pid 11350:tid 11380] [client 20.216.130.159:4397] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aeZb4_4EoMBgOJuJnT0YWgAAABU"]
[Tue Apr 21 01:01:26.589903 2026] [:error] [pid 11351:tid 11399] [client 20.216.130.159:27483] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aeZb5gN8Z1-vktaI_tOEVAAAAEw"]
[Tue Apr 21 01:01:32.990008 2026] [:error] [pid 11351:tid 11398] [client 20.216.130.159:7215] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aeZb7AN8Z1-vktaI_tOEbgAAAEs"]
[Tue Apr 21 01:01:38.533050 2026] [:error] [pid 11351:tid 11395] [client 20.216.130.159:5593] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/900.php"] [unique_id "aeZb8gN8Z1-vktaI_tOEhAAAAEg"]
[Tue Apr 21 01:02:03.692725 2026] [:error] [pid 11351:tid 11391] [client 20.216.130.159:5591] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "aeZcCwN8Z1-vktaI_tOEwgAAAEQ"]
[Tue Apr 21 01:02:08.884708 2026] [:error] [pid 11351:tid 11391] [client 20.216.130.159:16206] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "aeZcEAN8Z1-vktaI_tOE1AAAAEQ"]
[Tue Apr 21 01:02:14.548918 2026] [proxy_fcgi:error] [pid 6928:tid 6935] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:16.552541 2026] [proxy_fcgi:error] [pid 6928:tid 6951] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:16.821121 2026] [proxy_fcgi:error] [pid 6928:tid 6937] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:17.084948 2026] [proxy_fcgi:error] [pid 6928:tid 6940] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:17.324641 2026] [proxy_fcgi:error] [pid 6928:tid 6944] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:17.589792 2026] [proxy_fcgi:error] [pid 6928:tid 6933] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:17.828789 2026] [proxy_fcgi:error] [pid 6928:tid 6936] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:18.069517 2026] [proxy_fcgi:error] [pid 6928:tid 6943] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:18.310085 2026] [proxy_fcgi:error] [pid 6928:tid 6952] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:18.550316 2026] [proxy_fcgi:error] [pid 6928:tid 6930] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:18.795351 2026] [proxy_fcgi:error] [pid 6928:tid 6948] [client 20.216.130.159:8999] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:02:19.032817 2026] [:error] [pid 6928:tid 6942] [client 20.216.130.159:8999] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeZcGx3y7MHq1iB0qYrjZAAAAUw"]
[Tue Apr 21 01:02:20.723138 2026] [:error] [pid 42014:tid 42022] [client 20.216.130.159:19669] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeZcHMek-00-ZI0f1NqnRwAAAQY"]
[Tue Apr 21 01:02:22.355363 2026] [:error] [pid 11352:tid 11427] [client 20.216.130.159:57837] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeZcHml10mhMSfJ7ir_8VwAAAI0"]
[Tue Apr 21 01:02:23.789939 2026] [:error] [pid 11352:tid 11417] [client 20.216.130.159:1482] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "aeZcH2l10mhMSfJ7ir_8WgAAAIM"]
[Tue Apr 21 01:02:25.122806 2026] [:error] [pid 11352:tid 11416] [client 20.216.130.159:8998] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aeZcIWl10mhMSfJ7ir_8XQAAAII"]
[Tue Apr 21 01:02:27.168870 2026] [:error] [pid 11441:tid 11448] [client 20.216.130.159:13571] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aeZcI8ixByFUvmh319DXYQAAAMU"]
[Tue Apr 21 01:02:28.264400 2026] [:error] [pid 11351:tid 11397] [client 20.216.130.159:8977] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aeZcJAN8Z1-vktaI_tOE7AAAAEo"]
[Tue Apr 21 01:02:36.862112 2026] [:error] [pid 42014:tid 42028] [client 20.216.130.159:14090] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/an.php"] [unique_id "aeZcLMek-00-ZI0f1NqnaAAAAQw"]
[Tue Apr 21 01:02:40.623221 2026] [:error] [pid 6928:tid 6933] [client 20.216.130.159:9655] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t.php"] [unique_id "aeZcMB3y7MHq1iB0qYrjigAAAUM"]
[Tue Apr 21 01:03:07.610092 2026] [:error] [pid 6928:tid 6937] [client 20.216.130.159:6404] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeZcSx3y7MHq1iB0qYrjnwAAAUc"]
[Tue Apr 21 01:03:13.054985 2026] [:error] [pid 11350:tid 11382] [client 20.216.130.159:4310] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeZcUf4EoMBgOJuJnT0ZJQAAABc"]
[Tue Apr 21 01:03:14.283213 2026] [:error] [pid 6928:tid 6930] [client 20.216.130.159:9029] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profile.php"] [unique_id "aeZcUh3y7MHq1iB0qYrjpAAAAUA"]
[Tue Apr 21 01:03:19.951801 2026] [proxy_fcgi:error] [pid 11494:tid 11510] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:20.194356 2026] [proxy_fcgi:error] [pid 11494:tid 11506] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:20.456427 2026] [proxy_fcgi:error] [pid 11494:tid 11496] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:20.700982 2026] [proxy_fcgi:error] [pid 11494:tid 11508] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:20.942667 2026] [proxy_fcgi:error] [pid 11494:tid 11503] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:21.186244 2026] [proxy_fcgi:error] [pid 11494:tid 11504] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:21.436527 2026] [proxy_fcgi:error] [pid 11494:tid 11498] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:22.852020 2026] [proxy_fcgi:error] [pid 11494:tid 11516] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:23.111596 2026] [proxy_fcgi:error] [pid 11494:tid 11497] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:23.366795 2026] [proxy_fcgi:error] [pid 11494:tid 11509] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:23.606871 2026] [proxy_fcgi:error] [pid 11494:tid 11517] [client 20.216.130.159:8867] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:03:23.847878 2026] [:error] [pid 11494:tid 11519] [client 20.216.130.159:8867] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mk.php"] [unique_id "aeZcW8gko5iFiE8YoyQtSwAAAZc"]
[Tue Apr 21 01:03:25.969168 2026] [:error] [pid 11494:tid 11501] [client 20.216.130.159:22486] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mk.php"] [unique_id "aeZcXcgko5iFiE8YoyQtTQAAAYU"]
[Tue Apr 21 01:03:28.059452 2026] [:error] [pid 11494:tid 11512] [client 20.216.130.159:25769] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mk.php"] [unique_id "aeZcYMgko5iFiE8YoyQtVAAAAZA"]
[Tue Apr 21 01:03:29.456922 2026] [:error] [pid 11351:tid 11405] [client 20.216.130.159:12536] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mk.php"] [unique_id "aeZcYQN8Z1-vktaI_tOFVAAAAFI"]
[Tue Apr 21 01:03:30.323215 2026] [:error] [pid 6928:tid 6944] [client 20.216.130.159:26195] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeZcYh3y7MHq1iB0qYrjsAAAAU4"]
[Tue Apr 21 01:03:31.276164 2026] [:error] [pid 11350:tid 11379] [client 20.216.130.159:7639] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeZcY_4EoMBgOJuJnT0ZRwAAABQ"]
[Tue Apr 21 01:03:32.071347 2026] [:error] [pid 11351:tid 11393] [client 20.216.130.159:1441] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeZcZAN8Z1-vktaI_tOFXgAAAEY"]
[Tue Apr 21 01:03:33.016339 2026] [:error] [pid 11494:tid 11519] [client 20.216.130.159:12523] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeZcZcgko5iFiE8YoyQtXwAAAZc"]
[Tue Apr 21 01:03:34.686505 2026] [:error] [pid 11350:tid 11362] [client 20.216.130.159:5871] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "aeZcZv4EoMBgOJuJnT0ZTgAAAAM"]
[Tue Apr 21 01:03:35.749327 2026] [:error] [pid 11494:tid 11505] [client 20.216.130.159:9115] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "aeZcZ8gko5iFiE8YoyQtZAAAAYk"]
[Tue Apr 21 01:03:36.708250 2026] [:error] [pid 6928:tid 6953] [client 20.216.130.159:1447] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "aeZcaB3y7MHq1iB0qYrjtgAAAVc"]
[Tue Apr 21 01:03:37.926206 2026] [:error] [pid 11351:tid 11398] [client 20.216.130.159:12498] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a4.php"] [unique_id "aeZcaQN8Z1-vktaI_tOFewAAAEs"]
[Tue Apr 21 01:03:39.114059 2026] [:error] [pid 11352:tid 11434] [client 20.216.130.159:5835] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/retu11.PhP7"] [unique_id "aeZca2l10mhMSfJ7ir_8jgAAAJQ"]
[Tue Apr 21 01:03:39.899747 2026] [:error] [pid 11351:tid 11398] [client 20.216.130.159:57772] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/retu11.PhP7"] [unique_id "aeZcawN8Z1-vktaI_tOFhgAAAEs"]
[Tue Apr 21 01:03:40.950636 2026] [:error] [pid 11351:tid 11406] [client 20.216.130.159:25728] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/retu11.PhP7"] [unique_id "aeZcbAN8Z1-vktaI_tOFkAAAAFM"]
[Tue Apr 21 01:03:42.615321 2026] [:error] [pid 11350:tid 11371] [client 20.216.130.159:5300] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/retu11.PhP7"] [unique_id "aeZcbv4EoMBgOJuJnT0ZVAAAAAw"]
[Tue Apr 21 01:03:44.776085 2026] [:error] [pid 11494:tid 11501] [client 20.216.130.159:7388] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeZccMgko5iFiE8YoyQtdAAAAYU"]
[Tue Apr 21 01:03:46.694972 2026] [:error] [pid 11350:tid 11371] [client 20.216.130.159:7363] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeZccv4EoMBgOJuJnT0ZagAAAAw"]
[Tue Apr 21 01:03:48.059887 2026] [:error] [pid 11351:tid 11408] [client 20.216.130.159:7402] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeZcdAN8Z1-vktaI_tOFvgAAAFU"]
[Tue Apr 21 01:03:51.768292 2026] [:error] [pid 6928:tid 6943] [client 20.216.130.159:1828] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "aeZcdx3y7MHq1iB0qYrjwgAAAU0"]
[Tue Apr 21 01:03:54.695816 2026] [:error] [pid 11351:tid 11406] [client 20.216.130.159:19404] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeZcegN8Z1-vktaI_tOF0gAAAFM"]
[Tue Apr 21 01:03:59.093937 2026] [:error] [pid 11494:tid 11515] [client 20.216.130.159:5278] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeZcf8gko5iFiE8YoyQtnQAAAZM"]
[Tue Apr 21 01:04:06.199823 2026] [:error] [pid 11441:tid 11461] [client 20.216.130.159:19995] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeZchsixByFUvmh319DX4AAAANI"]
[Tue Apr 21 01:04:14.507308 2026] [:error] [pid 11352:tid 11434] [client 20.216.130.159:26149] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoo.php"] [unique_id "aeZcjml10mhMSfJ7ir_8qQAAAJQ"]
[Tue Apr 21 01:04:20.877478 2026] [:error] [pid 11494:tid 11509] [client 20.216.130.159:1665] [client 20.216.130.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoo.php"] [unique_id "aeZclMgko5iFiE8YoyQtvQAAAY0"]
[Tue Apr 21 01:04:23.856952 2026] [proxy_fcgi:error] [pid 11351:tid 11409] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:24.096845 2026] [proxy_fcgi:error] [pid 11351:tid 11401] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:24.335650 2026] [proxy_fcgi:error] [pid 11351:tid 11400] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:24.576082 2026] [proxy_fcgi:error] [pid 11351:tid 11388] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:24.817152 2026] [proxy_fcgi:error] [pid 11351:tid 11394] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:25.056527 2026] [proxy_fcgi:error] [pid 11351:tid 11406] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:25.303986 2026] [proxy_fcgi:error] [pid 11351:tid 11411] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:25.543295 2026] [proxy_fcgi:error] [pid 11351:tid 11392] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:25.792673 2026] [proxy_fcgi:error] [pid 11351:tid 11409] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:26.037729 2026] [proxy_fcgi:error] [pid 11351:tid 11398] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:04:26.286214 2026] [proxy_fcgi:error] [pid 11351:tid 11395] [client 20.216.130.159:30251] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 01:05:44.732320 2026] [:error] [pid 11351:tid 11391] [client 103.226.237.174:58612] [client 103.226.237.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.226.237.174, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aeZc6AN8Z1-vktaI_tOHPAAAAEQ"]
[Tue Apr 21 01:05:44.743496 2026] [proxy_fcgi:error] [pid 11351:tid 11391] [client 103.226.237.174:58612] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 04:00:21.902295 2026] [:error] [pid 35415:tid 35450] [client 185.194.178.2:27295] [client 185.194.178.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.2, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aeaF1UiqDinI4_22zzjjngAAANc"]
[Tue Apr 21 04:00:21.986082 2026] [proxy_fcgi:error] [pid 35415:tid 35450] [client 185.194.178.2:27295] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 04:31:40.827529 2026] [:error] [pid 35322:tid 35363] [client 43.155.188.157:38540] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeaNLKPoAfV40BTfVKxtXgAAAIY"]
[Tue Apr 21 05:03:16.748589 2026] [:error] [pid 5377:tid 5410] [client 117.33.163.216:43104] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeaUlLBKychFlrHBdvsAhQAAAdg"]
[Tue Apr 21 05:50:25.806082 2026] [:error] [pid 35415:tid 35432] [client 43.133.187.11:42350] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeafoUiqDinI4_22zzj5RwAAAMU"]
[Tue Apr 21 12:39:41.729185 2026] [:error] [pid 35320:tid 35352] [client 147.135.252.145:41240] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeb_jYJW6fdXWO6agMHbDwAAABY"]
[Tue Apr 21 12:39:43.817776 2026] [:error] [pid 35320:tid 35350] [client 147.135.252.145:38412] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeb_j4JW6fdXWO6agMHbEQAAABQ"]
[Tue Apr 21 12:39:46.324686 2026] [:error] [pid 5377:tid 5398] [client 147.135.252.145:38428] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeb_krBKychFlrHBdvuLUwAAAcw"]
[Tue Apr 21 12:39:48.607742 2026] [:error] [pid 4823:tid 4862] [client 147.135.252.145:38432] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aeb_lPc8mke3PfHqsxFCfwAAAYk"]
[Tue Apr 21 12:39:50.609920 2026] [:error] [pid 5377:tid 5390] [client 147.135.252.145:38448] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeb_lrBKychFlrHBdvuLWgAAAcQ"]
[Tue Apr 21 12:39:52.831923 2026] [:error] [pid 4777:tid 4802] [client 147.135.252.145:46206] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeb_mKxXur6bykKyLZRS-gAAAQ4"]
[Tue Apr 21 12:39:54.896151 2026] [:error] [pid 4823:tid 4868] [client 147.135.252.145:46214] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeb_mvc8mke3PfHqsxFChwAAAY8"]
[Tue Apr 21 12:39:57.348248 2026] [:error] [pid 4822:tid 4849] [client 147.135.252.145:46226] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aeb_nSAteFQFwS_23JkjzgAAAVc"]
[Tue Apr 21 12:40:00.185840 2026] [:error] [pid 4822:tid 4844] [client 147.135.252.145:46238] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aeb_oCAteFQFwS_23Jkj0wAAAVI"]
[Tue Apr 21 12:40:02.262406 2026] [:error] [pid 4822:tid 4833] [client 147.135.252.145:42318] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aeb_oiAteFQFwS_23Jkj2AAAAUc"]
[Tue Apr 21 12:40:04.375281 2026] [:error] [pid 4822:tid 4830] [client 147.135.252.145:42324] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aeb_pCAteFQFwS_23Jkj2wAAAUQ"]
[Tue Apr 21 12:40:06.752983 2026] [:error] [pid 4822:tid 4845] [client 147.135.252.145:42328] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aeb_piAteFQFwS_23Jkj3wAAAVM"]
[Tue Apr 21 12:40:08.997719 2026] [:error] [pid 4822:tid 4830] [client 147.135.252.145:42340] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeb_qCAteFQFwS_23Jkj5wAAAUQ"]
[Tue Apr 21 12:40:11.060090 2026] [:error] [pid 4822:tid 4836] [client 147.135.252.145:39788] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aeb_qyAteFQFwS_23Jkj7wAAAUo"]
[Tue Apr 21 12:40:13.463763 2026] [:error] [pid 35322:tid 35361] [client 147.135.252.145:39802] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aeb_raPoAfV40BTfVKycKAAAAIQ"]
[Tue Apr 21 12:40:15.559894 2026] [:error] [pid 4822:tid 4848] [client 147.135.252.145:39804] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aeb_ryAteFQFwS_23Jkj-wAAAVY"]
[Tue Apr 21 12:40:17.779436 2026] [:error] [pid 35320:tid 35354] [client 147.135.252.145:39818] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aeb_sYJW6fdXWO6agMHbJwAAABg"]
[Tue Apr 21 12:40:20.101352 2026] [:error] [pid 5377:tid 5401] [client 147.135.252.145:39828] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeb_tLBKychFlrHBdvuLcwAAAc8"]
[Tue Apr 21 12:40:22.315373 2026] [:error] [pid 5377:tid 5387] [client 147.135.252.145:45626] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aeb_trBKychFlrHBdvuLdgAAAcE"]
[Tue Apr 21 12:40:24.391859 2026] [:error] [pid 5377:tid 5408] [client 147.135.252.145:45632] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeb_uLBKychFlrHBdvuLewAAAdY"]
[Tue Apr 21 12:40:26.552414 2026] [:error] [pid 4823:tid 4873] [client 147.135.252.145:45646] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeb_uvc8mke3PfHqsxFCwAAAAZQ"]
[Tue Apr 21 12:40:29.102723 2026] [:error] [pid 4777:tid 4801] [client 147.135.252.145:45650] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeb_vaxXur6bykKyLZRTAwAAAQ0"]
[Tue Apr 21 12:40:31.324399 2026] [:error] [pid 35415:tid 35442] [client 147.135.252.145:34208] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aeb_v0iqDinI4_22zzgp6gAAAM8"]
[Tue Apr 21 12:40:33.443876 2026] [:error] [pid 4823:tid 4858] [client 147.135.252.145:39490] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeb_wfc8mke3PfHqsxFCzwAAAYU"]
[Tue Apr 21 12:40:37.821456 2026] [:error] [pid 35320:tid 35342] [client 147.135.252.145:39492] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeb_xYJW6fdXWO6agMHbNAAAAAw"]
[Tue Apr 21 12:41:06.856300 2026] [:error] [pid 35320:tid 35344] [client 147.135.252.145:34216] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aeb_4oJW6fdXWO6agMHbaQAAAA4"]
[Tue Apr 21 12:41:09.364577 2026] [:error] [pid 4823:tid 4864] [client 147.135.252.145:54944] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aeb_5fc8mke3PfHqsxFC9AAAAYs"]
[Tue Apr 21 12:41:12.383354 2026] [:error] [pid 4777:tid 4799] [client 147.135.252.145:51698] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aeb_6KxXur6bykKyLZRTEwAAAQs"]
[Tue Apr 21 12:41:15.621617 2026] [:error] [pid 35320:tid 35350] [client 147.135.252.145:51704] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aeb_64JW6fdXWO6agMHbagAAABQ"]
[Tue Apr 21 12:41:18.433608 2026] [:error] [pid 5377:tid 5397] [client 147.135.252.145:51706] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeb_7rBKychFlrHBdvuLoQAAAcs"]
[Tue Apr 21 12:41:21.548042 2026] [:error] [pid 5377:tid 5394] [client 147.135.252.145:34532] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aeb_8bBKychFlrHBdvuLpwAAAcg"]
[Tue Apr 21 12:41:24.116080 2026] [:error] [pid 4823:tid 4873] [client 147.135.252.145:34538] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aeb_9Pc8mke3PfHqsxFDBAAAAZQ"]
[Tue Apr 21 12:41:26.927604 2026] [:error] [pid 5377:tid 5401] [client 147.135.252.145:34542] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aeb_9rBKychFlrHBdvuLrgAAAc8"]
[Tue Apr 21 12:41:29.120177 2026] [:error] [pid 35320:tid 35345] [client 147.135.252.145:34544] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aeb_-YJW6fdXWO6agMHbcQAAAA8"]
[Tue Apr 21 12:41:31.917961 2026] [:error] [pid 4823:tid 4863] [client 147.135.252.145:47636] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aeb_-_c8mke3PfHqsxFDEAAAAYo"]
[Tue Apr 21 12:41:35.486891 2026] [:error] [pid 35322:tid 35371] [client 147.135.252.145:47642] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aeb__6PoAfV40BTfVKycUgAAAI4"]
[Tue Apr 21 12:41:37.737933 2026] [:error] [pid 35321:tid 35397] [client 147.135.252.145:47646] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aecAATeHLhVUuu8cVXxzkQAAAE0"]
[Tue Apr 21 12:41:40.582936 2026] [:error] [pid 5377:tid 5398] [client 147.135.252.145:47650] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aecABLBKychFlrHBdvuLxAAAAcw"]
[Tue Apr 21 12:41:42.634445 2026] [:error] [pid 35321:tid 35396] [client 147.135.252.145:40352] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aecABjeHLhVUuu8cVXxzkgAAAEw"]
[Tue Apr 21 12:41:44.635579 2026] [:error] [pid 35321:tid 35403] [client 147.135.252.145:40360] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aecACDeHLhVUuu8cVXxzkwAAAFM"]
[Tue Apr 21 12:41:47.127891 2026] [:error] [pid 4823:tid 4854] [client 147.135.252.145:40372] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aecAC_c8mke3PfHqsxFDHQAAAYE"]
[Tue Apr 21 12:41:51.428271 2026] [:error] [pid 5377:tid 5386] [client 147.135.252.145:57596] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aecAD7BKychFlrHBdvuLywAAAcA"]
[Tue Apr 21 14:01:14.875842 2026] [:error] [pid 35322:tid 35361] [client 43.130.139.177:52978] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aecSqqPoAfV40BTfVKymVAAAAIQ"]
[Tue Apr 21 14:22:56.890773 2026] [:error] [pid 35320:tid 35341] [client 216.24.210.22:29591] [client 216.24.210.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aecXwIJW6fdXWO6agMH1awAAAAs"]
[Tue Apr 21 15:37:35.501420 2026] [:error] [pid 5377:tid 5388] [client 213.35.109.170:57960] [client 213.35.109.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aecpP7BKychFlrHBdvvlIwAAAcI"]
[Tue Apr 21 15:37:35.697965 2026] [:error] [pid 53978:tid 54004] [client 213.35.109.170:55278] [client 213.35.109.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aecpP51ivsR4hcOSQbaxdQAAApg"]
[Tue Apr 21 15:56:25.256287 2026] [:error] [pid 53978:tid 53982] [client 194.247.173.99:53498] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aectqZ1ivsR4hcOSQba7BwAAAoI"]
[Tue Apr 21 15:56:26.946309 2026] [:error] [pid 4823:tid 4860] [client 194.247.173.99:60848] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aectqvc8mke3PfHqsxHM-wAAAYc"]
[Tue Apr 21 15:56:29.459298 2026] [:error] [pid 53832:tid 53840] [client 194.247.173.99:48808] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aectrdzkuxsE_OhM9UItGgAAAkU"]
[Tue Apr 21 15:56:31.499429 2026] [:error] [pid 35320:tid 35336] [client 194.247.173.99:43908] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aectr4JW6fdXWO6agMEo3gAAAAY"]
[Tue Apr 21 15:56:34.046441 2026] [:error] [pid 35321:tid 35393] [client 194.247.173.99:50922] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aectsjeHLhVUuu8cVXzKHQAAAEk"]
[Tue Apr 21 15:56:36.099569 2026] [:error] [pid 53832:tid 53854] [client 194.247.173.99:40944] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aecttNzkuxsE_OhM9UItOgAAAlM"]
[Tue Apr 21 15:56:38.651424 2026] [:error] [pid 53832:tid 53837] [client 194.247.173.99:50932] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aectttzkuxsE_OhM9UItSQAAAkI"]
[Tue Apr 21 15:56:41.249310 2026] [:error] [pid 4777:tid 4788] [client 194.247.173.99:50934] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aectuaxXur6bykKyLZSMLwAAAQA"]
[Tue Apr 21 15:56:43.290317 2026] [:error] [pid 4823:tid 4857] [client 194.247.173.99:56034] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aectu_c8mke3PfHqsxHNFwAAAYQ"]
[Tue Apr 21 15:56:45.701381 2026] [:error] [pid 35321:tid 35386] [client 194.247.173.99:52276] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aectvTeHLhVUuu8cVXzKSQAAAEI"]
[Tue Apr 21 15:56:47.736733 2026] [:error] [pid 35321:tid 35401] [client 194.247.173.99:56046] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aectvzeHLhVUuu8cVXzKUwAAAFE"]
[Tue Apr 21 15:56:50.279564 2026] [:error] [pid 35321:tid 35392] [client 194.247.173.99:52286] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aectwjeHLhVUuu8cVXzKZwAAAEg"]
[Tue Apr 21 15:56:52.887447 2026] [:error] [pid 4823:tid 4871] [client 194.247.173.99:52296] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aectxPc8mke3PfHqsxHNKgAAAZI"]
[Tue Apr 21 15:56:54.915867 2026] [:error] [pid 35321:tid 35405] [client 194.247.173.99:38094] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aectxjeHLhVUuu8cVXzKgwAAAFU"]
[Tue Apr 21 15:56:57.463960 2026] [:error] [pid 35322:tid 35376] [client 194.247.173.99:54268] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aectyaPoAfV40BTfVKzH8gAAAJM"]
[Tue Apr 21 15:56:59.486048 2026] [:error] [pid 53731:tid 53742] [client 194.247.173.99:38106] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aecty12I9THUR-bRVGzicAAAAgc"]
[Tue Apr 21 15:57:02.027187 2026] [:error] [pid 4777:tid 4793] [client 194.247.173.99:54278] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aectzqxXur6bykKyLZSMNgAAAQU"]
[Tue Apr 21 15:57:04.073487 2026] [:error] [pid 4823:tid 4869] [client 194.247.173.99:45404] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aect0Pc8mke3PfHqsxHNLwAAAZA"]
[Tue Apr 21 15:57:06.615803 2026] [:error] [pid 35321:tid 35400] [client 194.247.173.99:33134] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aect0jeHLhVUuu8cVXzKxgAAAFA"]
[Tue Apr 21 15:57:08.513398 2026] [:error] [pid 53978:tid 54004] [client 194.247.173.99:45408] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aect1J1ivsR4hcOSQba7KgAAApg"]
[Tue Apr 21 15:57:11.674033 2026] [:error] [pid 4823:tid 4867] [client 194.247.173.99:33142] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aect1_c8mke3PfHqsxHNOwAAAY4"]
[Tue Apr 21 15:57:13.720710 2026] [:error] [pid 35321:tid 35391] [client 194.247.173.99:56282] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aect2TeHLhVUuu8cVXzK8gAAAEc"]
[Tue Apr 21 15:57:16.282328 2026] [:error] [pid 35321:tid 35392] [client 194.247.173.99:35062] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aect3DeHLhVUuu8cVXzLCAAAAEg"]
[Tue Apr 21 15:57:18.338254 2026] [:error] [pid 35415:tid 35434] [client 194.247.173.99:56286] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aect3kiqDinI4_22zzhb1AAAAMc"]
[Tue Apr 21 15:57:21.496960 2026] [:error] [pid 53731:tid 53742] [client 194.247.173.99:35068] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aect4V2I9THUR-bRVGzifQAAAgc"]
[Tue Apr 21 15:57:45.246839 2026] [:error] [pid 35415:tid 35444] [client 194.247.173.99:48150] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aect-UiqDinI4_22zzhb8QAAANE"]
[Tue Apr 21 15:57:46.768057 2026] [:error] [pid 53978:tid 53989] [client 194.247.173.99:54480] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aect-p1ivsR4hcOSQba7TQAAAok"]
[Tue Apr 21 15:57:49.298527 2026] [:error] [pid 35321:tid 35388] [client 194.247.173.99:33534] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aect_TeHLhVUuu8cVXzLjAAAAEQ"]
[Tue Apr 21 15:57:51.938957 2026] [:error] [pid 35321:tid 35408] [client 194.247.173.99:46862] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aect_zeHLhVUuu8cVXzLnQAAAFg"]
[Tue Apr 21 15:57:54.339992 2026] [:error] [pid 4823:tid 4855] [client 194.247.173.99:53960] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aecuAvc8mke3PfHqsxHNZAAAAYI"]
[Tue Apr 21 15:57:56.363248 2026] [:error] [pid 53832:tid 53846] [client 194.247.173.99:38680] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aecuBNzkuxsE_OhM9UIt2wAAAks"]
[Tue Apr 21 15:57:58.900991 2026] [:error] [pid 35322:tid 35381] [client 194.247.173.99:53964] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aecuBqPoAfV40BTfVKzIDAAAAJg"]
[Tue Apr 21 15:58:01.348854 2026] [:error] [pid 4777:tid 4810] [client 194.247.173.99:53980] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aecuCaxXur6bykKyLZSMUQAAARY"]
[Tue Apr 21 15:58:03.376141 2026] [:error] [pid 35320:tid 35332] [client 194.247.173.99:47744] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "aecuC4JW6fdXWO6agMEpRwAAAAI"]
[Tue Apr 21 15:58:05.925683 2026] [:error] [pid 35322:tid 35372] [client 194.247.173.99:45836] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "aecuDaPoAfV40BTfVKzIEgAAAI8"]
[Tue Apr 21 15:58:08.502870 2026] [:error] [pid 53832:tid 53849] [client 194.247.173.99:45838] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aecuENzkuxsE_OhM9UIuAgAAAk4"]
[Tue Apr 21 15:58:10.954877 2026] [:error] [pid 35321:tid 35396] [client 194.247.173.99:45850] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aecuEjeHLhVUuu8cVXzLwQAAAEw"]
[Tue Apr 21 15:58:13.420194 2026] [:error] [pid 53731:tid 53753] [client 194.247.173.99:45860] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aecuFV2I9THUR-bRVGzipgAAAhE"]
[Tue Apr 21 15:58:15.973191 2026] [:error] [pid 4823:tid 4853] [client 194.247.173.99:33140] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aecuF_c8mke3PfHqsxHNfwAAAYA"]
[Tue Apr 21 15:58:17.992006 2026] [:error] [pid 35321:tid 35385] [client 194.247.173.99:45610] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aecuGTeHLhVUuu8cVXzL4gAAAEE"]
[Tue Apr 21 15:58:20.399918 2026] [:error] [pid 35321:tid 35397] [client 194.247.173.99:33146] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aecuHDeHLhVUuu8cVXzL8AAAAE0"]
[Tue Apr 21 15:58:22.982855 2026] [:error] [pid 53832:tid 53841] [client 194.247.173.99:33150] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aecuHtzkuxsE_OhM9UIuMAAAAkY"]
[Tue Apr 21 15:58:25.568598 2026] [:error] [pid 35321:tid 35393] [client 194.247.173.99:55912] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aecuITeHLhVUuu8cVXzMBQAAAEk"]
[Tue Apr 21 15:58:28.173999 2026] [:error] [pid 53832:tid 53840] [client 194.247.173.99:55918] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aecuJNzkuxsE_OhM9UIuSAAAAkU"]
[Tue Apr 21 15:58:30.604651 2026] [:error] [pid 53832:tid 53837] [client 194.247.173.99:55932] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aecuJtzkuxsE_OhM9UIuUAAAAkI"]
[Tue Apr 21 15:58:33.211080 2026] [:error] [pid 35321:tid 35389] [client 194.247.173.99:55944] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aecuKTeHLhVUuu8cVXzMIwAAAEU"]
[Tue Apr 21 15:58:35.789063 2026] [:error] [pid 53731:tid 53742] [client 194.247.173.99:40084] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aecuK12I9THUR-bRVGzirAAAAgc"]
[Tue Apr 21 15:58:38.225619 2026] [:error] [pid 35321:tid 35387] [client 194.247.173.99:40088] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aecuLjeHLhVUuu8cVXzMNwAAAEM"]
[Tue Apr 21 15:58:40.809841 2026] [:error] [pid 53832:tid 53843] [client 194.247.173.99:40096] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aecuMNzkuxsE_OhM9UIufQAAAkg"]
[Tue Apr 21 15:59:04.970788 2026] [:error] [pid 53832:tid 53848] [client 194.247.173.99:40106] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aecuSNzkuxsE_OhM9UIuqAAAAk0"]
[Tue Apr 21 15:59:06.640056 2026] [:error] [pid 54080:tid 54103] [client 194.247.173.99:51618] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aecuSozEbQHHxtmWbaZkOwAAAtU"]
[Tue Apr 21 15:59:09.170863 2026] [:error] [pid 4823:tid 4865] [client 194.247.173.99:53126] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aecuTfc8mke3PfHqsxHN0QAAAYw"]
[Tue Apr 21 15:59:11.042748 2026] [:error] [pid 53832:tid 53853] [client 194.247.173.99:51620] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aecuT9zkuxsE_OhM9UIuugAAAlI"]
[Tue Apr 21 15:59:13.021189 2026] [:error] [pid 35415:tid 35451] [client 194.247.173.99:51630] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aecuUUiqDinI4_22zzhcDQAAANg"]
[Tue Apr 21 15:59:15.405554 2026] [:error] [pid 53832:tid 53845] [client 194.247.173.99:52932] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aecuU9zkuxsE_OhM9UIuzQAAAko"]
[Tue Apr 21 15:59:17.434395 2026] [:error] [pid 53978:tid 53995] [client 194.247.173.99:33290] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aecuVZ1ivsR4hcOSQba7ogAAAo8"]
[Tue Apr 21 15:59:19.259152 2026] [:error] [pid 35320:tid 35342] [client 194.247.173.99:33298] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aecuV4JW6fdXWO6agMEpiAAAAAw"]
[Tue Apr 21 15:59:21.230773 2026] [:error] [pid 53832:tid 53844] [client 194.247.173.99:33310] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aecuWdzkuxsE_OhM9UIu5AAAAkk"]
[Tue Apr 21 15:59:24.351082 2026] [:error] [pid 4823:tid 4859] [client 194.247.173.99:52948] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aecuXPc8mke3PfHqsxHN-gAAAYY"]
[Tue Apr 21 15:59:26.993548 2026] [:error] [pid 53978:tid 53986] [client 194.247.173.99:57196] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aecuXp1ivsR4hcOSQba7pwAAAoY"]
[Tue Apr 21 15:59:29.003151 2026] [:error] [pid 35321:tid 35385] [client 194.247.173.99:33974] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aecuYTeHLhVUuu8cVXzM4gAAAEE"]
[Tue Apr 21 15:59:30.987749 2026] [:error] [pid 53832:tid 53843] [client 194.247.173.99:33976] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aecuYtzkuxsE_OhM9UIu-AAAAkg"]
[Tue Apr 21 15:59:33.348532 2026] [:error] [pid 35321:tid 35403] [client 194.247.173.99:57208] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aecuZTeHLhVUuu8cVXzM_QAAAFM"]
[Tue Apr 21 15:59:37.023116 2026] [:error] [pid 35321:tid 35400] [client 194.247.173.99:58398] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aecuaTeHLhVUuu8cVXzNEgAAAFA"]
[Tue Apr 21 15:59:39.030971 2026] [:error] [pid 4823:tid 4859] [client 194.247.173.99:55070] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aecua_c8mke3PfHqsxHOEAAAAYY"]
[Tue Apr 21 15:59:41.003916 2026] [:error] [pid 4823:tid 4862] [client 194.247.173.99:55080] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aecubfc8mke3PfHqsxHOFAAAAYk"]
[Tue Apr 21 15:59:42.983834 2026] [:error] [pid 53832:tid 53850] [client 194.247.173.99:55094] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aecubtzkuxsE_OhM9UIvEQAAAk8"]
[Tue Apr 21 15:59:44.894568 2026] [:error] [pid 53978:tid 53991] [client 194.247.173.99:55682] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aecucJ1ivsR4hcOSQba7rAAAAos"]
[Tue Apr 21 15:59:47.541819 2026] [:error] [pid 53832:tid 53857] [client 194.247.173.99:46932] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aecuc9zkuxsE_OhM9UIvLgAAAlY"]
[Tue Apr 21 15:59:50.747304 2026] [:error] [pid 35320:tid 35354] [client 194.247.173.99:46946] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aecudoJW6fdXWO6agMEpoAAAABg"]
[Tue Apr 21 15:59:52.729512 2026] [:error] [pid 35321:tid 35400] [client 194.247.173.99:55692] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aecueDeHLhVUuu8cVXzNUAAAAFA"]
[Tue Apr 21 15:59:56.264951 2026] [:error] [pid 35321:tid 35406] [client 194.247.173.99:38748] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aecufDeHLhVUuu8cVXzNbQAAAFY"]
[Tue Apr 21 15:59:58.761604 2026] [:error] [pid 35321:tid 35400] [client 194.247.173.99:38764] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aecufjeHLhVUuu8cVXzNdgAAAFA"]
[Tue Apr 21 16:00:00.776290 2026] [:error] [pid 35321:tid 35396] [client 194.247.173.99:51866] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aecugDeHLhVUuu8cVXzNgwAAAEw"]
[Tue Apr 21 16:00:24.825088 2026] [:error] [pid 53832:tid 53838] [client 194.247.173.99:38774] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aecumNzkuxsE_OhM9UIvfwAAAkM"]
[Tue Apr 21 16:00:27.343384 2026] [:error] [pid 53832:tid 53851] [client 194.247.173.99:39248] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aecum9zkuxsE_OhM9UIvgQAAAlA"]
[Tue Apr 21 16:00:31.224683 2026] [:error] [pid 54080:tid 54096] [client 194.247.173.99:39264] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aecun4zEbQHHxtmWbaZknwAAAs4"]
[Tue Apr 21 16:00:33.738874 2026] [:error] [pid 35321:tid 35395] [client 194.247.173.99:39274] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aecuoTeHLhVUuu8cVXzN2AAAAEs"]
[Tue Apr 21 16:00:36.182648 2026] [:error] [pid 4823:tid 4871] [client 194.247.173.99:32846] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aecupPc8mke3PfHqsxHOUgAAAZI"]
[Tue Apr 21 16:00:38.757451 2026] [:error] [pid 35321:tid 35396] [client 194.247.173.99:32858] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aecupjeHLhVUuu8cVXzN-AAAAEw"]
[Tue Apr 21 16:00:41.246900 2026] [:error] [pid 35321:tid 35398] [client 194.247.173.99:32864] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aecuqTeHLhVUuu8cVXzOBwAAAE4"]
[Tue Apr 21 16:00:43.773408 2026] [:error] [pid 35321:tid 35390] [client 194.247.173.99:32876] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aecuqzeHLhVUuu8cVXzOGAAAAEY"]
[Tue Apr 21 16:00:46.455003 2026] [:error] [pid 54080:tid 54095] [client 194.247.173.99:52108] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aecurozEbQHHxtmWbaZkzQAAAs0"]
[Tue Apr 21 16:00:49.072848 2026] [:error] [pid 35320:tid 35330] [client 194.247.173.99:52116] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aecusYJW6fdXWO6agMEpywAAAAA"]
[Tue Apr 21 16:00:51.660071 2026] [:error] [pid 54080:tid 54089] [client 194.247.173.99:52128] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aecus4zEbQHHxtmWbaZk1wAAAsc"]
[Tue Apr 21 16:00:54.085634 2026] [:error] [pid 35321:tid 35393] [client 194.247.173.99:48188] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aecutjeHLhVUuu8cVXzORAAAAEk"]
[Tue Apr 21 16:00:56.666467 2026] [:error] [pid 54080:tid 54090] [client 194.247.173.99:48204] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aecuuIzEbQHHxtmWbaZk2wAAAsg"]
[Tue Apr 21 16:00:59.257592 2026] [:error] [pid 35321:tid 35389] [client 194.247.173.99:48210] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aecuuzeHLhVUuu8cVXzOZQAAAEU"]
[Tue Apr 21 16:01:01.846976 2026] [:error] [pid 35321:tid 35398] [client 194.247.173.99:48226] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aecuvTeHLhVUuu8cVXzOeAAAAE4"]
[Tue Apr 21 16:01:03.740492 2026] [:error] [pid 35321:tid 35398] [client 194.247.173.99:48226] [client 194.247.173.99] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "52.167.144.150_3d3ac58d8463837308f32ae367c2da2fbbbe11de"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aecuvTeHLhVUuu8cVXzOeAAAAE4"]
[Tue Apr 21 16:01:04.438216 2026] [:error] [pid 54080:tid 54089] [client 194.247.173.99:46450] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aecuwIzEbQHHxtmWbaZk5gAAAsc"]
[Tue Apr 21 16:01:07.637752 2026] [:error] [pid 54080:tid 54100] [client 194.247.173.99:46456] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aecuw4zEbQHHxtmWbaZk9QAAAtI"]
[Tue Apr 21 16:01:10.283215 2026] [:error] [pid 35321:tid 35386] [client 194.247.173.99:46470] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aecuxjeHLhVUuu8cVXzOlQAAAEI"]
[Tue Apr 21 16:01:12.660512 2026] [:error] [pid 53832:tid 53841] [client 194.247.173.99:58322] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aecuyNzkuxsE_OhM9UIv8QAAAkY"]
[Tue Apr 21 16:01:16.501310 2026] [:error] [pid 54080:tid 54085] [client 194.247.173.99:57108] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aecuzIzEbQHHxtmWbaZlBQAAAsM"]
[Tue Apr 21 16:33:43.567841 2026] [:error] [pid 54080:tid 54089] [client 18.143.166.75:45000] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aec2Z4zEbQHHxtmWbaZ0bQAAAsc"]
[Tue Apr 21 16:33:44.128439 2026] [:error] [pid 54080:tid 54096] [client 18.143.166.75:45010] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "aec2aIzEbQHHxtmWbaZ0dAAAAs4"]
[Tue Apr 21 16:33:44.562843 2026] [:error] [pid 54080:tid 54085] [client 18.143.166.75:45026] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.local"] [unique_id "aec2aIzEbQHHxtmWbaZ0eAAAAsM"]
[Tue Apr 21 16:33:44.997364 2026] [:error] [pid 54080:tid 54094] [client 18.143.166.75:45042] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.production"] [unique_id "aec2aIzEbQHHxtmWbaZ0fQAAAsw"]
[Tue Apr 21 16:33:45.436435 2026] [:error] [pid 35320:tid 35349] [client 18.143.166.75:45044] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.staging"] [unique_id "aec2aYJW6fdXWO6agME-kgAAABM"]
[Tue Apr 21 16:33:45.873501 2026] [:error] [pid 35320:tid 35354] [client 18.143.166.75:45052] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.development"] [unique_id "aec2aYJW6fdXWO6agME-lgAAABg"]
[Tue Apr 21 16:33:46.307972 2026] [:error] [pid 53832:tid 53858] [client 18.143.166.75:45058] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.test"] [unique_id "aec2atzkuxsE_OhM9UI9RwAAAlc"]
[Tue Apr 21 16:33:46.741892 2026] [:error] [pid 35321:tid 35401] [client 18.143.166.75:45066] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.remote"] [unique_id "aec2ajeHLhVUuu8cVXze_wAAAFE"]
[Tue Apr 21 16:33:47.184520 2026] [:error] [pid 35320:tid 35335] [client 18.143.166.75:45072] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.bak"] [unique_id "aec2a4JW6fdXWO6agME-nAAAAAU"]
[Tue Apr 21 16:33:47.624460 2026] [:error] [pid 35321:tid 35408] [client 18.143.166.75:45080] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.backup"] [unique_id "aec2azeHLhVUuu8cVXzfBAAAAFg"]
[Tue Apr 21 16:33:48.060137 2026] [:error] [pid 35320:tid 35346] [client 18.143.166.75:45094] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.save"] [unique_id "aec2bIJW6fdXWO6agME-ngAAABA"]
[Tue Apr 21 16:33:48.492295 2026] [:error] [pid 35320:tid 35330] [client 18.143.166.75:45102] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.old"] [unique_id "aec2bIJW6fdXWO6agME-ogAAAAA"]
[Tue Apr 21 16:33:48.925842 2026] [:error] [pid 35320:tid 35345] [client 18.143.166.75:45116] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.sample"] [unique_id "aec2bIJW6fdXWO6agME-pwAAAA8"]
[Tue Apr 21 16:33:49.361676 2026] [:error] [pid 4823:tid 4874] [client 18.143.166.75:45120] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.example"] [unique_id "aec2bfc8mke3PfHqsxHZcQAAAZU"]
[Tue Apr 21 16:33:49.797114 2026] [:error] [pid 4823:tid 4873] [client 18.143.166.75:45130] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.dev"] [unique_id "aec2bfc8mke3PfHqsxHZcgAAAZQ"]
[Tue Apr 21 16:33:50.231981 2026] [:error] [pid 35321:tid 35390] [client 18.143.166.75:45138] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.prod"] [unique_id "aec2bjeHLhVUuu8cVXzfDgAAAEY"]
[Tue Apr 21 16:33:50.668528 2026] [:error] [pid 54080:tid 54096] [client 18.143.166.75:35950] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.stage"] [unique_id "aec2bozEbQHHxtmWbaZ0iwAAAs4"]
[Tue Apr 21 16:33:53.022567 2026] [:error] [pid 53978:tid 53985] [client 18.143.166.75:35952] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.docker"] [unique_id "aec2cZ1ivsR4hcOSQbbBjwAAAoU"]
[Tue Apr 21 16:33:53.458307 2026] [:error] [pid 54080:tid 54091] [client 18.143.166.75:35956] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.live"] [unique_id "aec2cYzEbQHHxtmWbaZ0jwAAAsk"]
[Tue Apr 21 16:33:53.890734 2026] [:error] [pid 4823:tid 4876] [client 18.143.166.75:35964] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.preprod"] [unique_id "aec2cfc8mke3PfHqsxHZdwAAAZc"]
[Tue Apr 21 16:33:54.324530 2026] [:error] [pid 53832:tid 53850] [client 18.143.166.75:35980] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.uat"] [unique_id "aec2ctzkuxsE_OhM9UI9UQAAAk8"]
[Tue Apr 21 16:33:56.343462 2026] [:error] [pid 35321:tid 35396] [client 18.143.166.75:35988] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.swp"] [unique_id "aec2dDeHLhVUuu8cVXzfIAAAAEw"]
[Tue Apr 21 16:33:56.781580 2026] [:error] [pid 53978:tid 54003] [client 18.143.166.75:35990] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env~"] [unique_id "aec2dJ1ivsR4hcOSQbbBlQAAApc"]
[Tue Apr 21 16:33:57.217873 2026] [:error] [pid 53731:tid 53742] [client 18.143.166.75:35996] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env"] [unique_id "aec2dV2I9THUR-bRVGznSwAAAgc"]
[Tue Apr 21 16:33:57.650165 2026] [:error] [pid 53731:tid 53759] [client 18.143.166.75:36006] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/apps/.env"] [unique_id "aec2dV2I9THUR-bRVGznTAAAAhc"]
[Tue Apr 21 16:33:58.083671 2026] [:error] [pid 35320:tid 35343] [client 18.143.166.75:36016] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/api/.env"] [unique_id "aec2doJW6fdXWO6agME-uQAAAA0"]
[Tue Apr 21 16:33:58.517120 2026] [:error] [pid 35320:tid 35339] [client 18.143.166.75:36020] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/web/.env"] [unique_id "aec2doJW6fdXWO6agME-wAAAAAk"]
[Tue Apr 21 16:33:58.948603 2026] [:error] [pid 35320:tid 35342] [client 18.143.166.75:36024] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/site/.env"] [unique_id "aec2doJW6fdXWO6agME-xgAAAAw"]
[Tue Apr 21 16:33:59.384507 2026] [:error] [pid 53978:tid 53994] [client 18.143.166.75:36030] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/public/.env"] [unique_id "aec2d51ivsR4hcOSQbbBmAAAAo4"]
[Tue Apr 21 16:33:59.817534 2026] [:error] [pid 54080:tid 54085] [client 18.143.166.75:36036] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/admin/.env"] [unique_id "aec2d4zEbQHHxtmWbaZ0nQAAAsM"]
[Tue Apr 21 16:34:00.251895 2026] [:error] [pid 53978:tid 53995] [client 18.143.166.75:36048] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/backend/.env"] [unique_id "aec2eJ1ivsR4hcOSQbbBnAAAAo8"]
[Tue Apr 21 16:34:00.684725 2026] [:error] [pid 35321:tid 35402] [client 18.143.166.75:36496] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/server/.env"] [unique_id "aec2eDeHLhVUuu8cVXzfKAAAAFI"]
[Tue Apr 21 16:34:01.118748 2026] [:error] [pid 53731:tid 53757] [client 18.143.166.75:36498] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/frontend/.env"] [unique_id "aec2eV2I9THUR-bRVGznTQAAAhU"]
[Tue Apr 21 16:34:01.554712 2026] [:error] [pid 54080:tid 54087] [client 18.143.166.75:36510] [client 18.143.166.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/src/.env"] [unique_id "aec2eYzEbQHHxtmWbaZ0oAAAAsU"]
[Tue Apr 21 16:55:03.365579 2026] [proxy_fcgi:error] [pid 53731:tid 53755] [client 172.213.24.111:24265] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:55:03.620644 2026] [proxy_fcgi:error] [pid 53731:tid 53740] [client 172.213.24.111:24265] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:55:03.863326 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:24265] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "aec7Z12I9THUR-bRVGzx-QAAAgY"]
[Tue Apr 21 16:55:05.619214 2026] [:error] [pid 53731:tid 53750] [client 172.213.24.111:11190] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "aec7aV2I9THUR-bRVGzyBgAAAg8"]
[Tue Apr 21 16:55:10.983622 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:14533] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "aec7bl2I9THUR-bRVGzyEAAAAg4"]
[Tue Apr 21 16:55:13.944678 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:17203] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "aec7cYJW6fdXWO6agMFJCgAAAAc"]
[Tue Apr 21 16:55:16.686959 2026] [:error] [pid 35320:tid 35352] [client 172.213.24.111:23477] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "aec7dIJW6fdXWO6agMFJEgAAABY"]
[Tue Apr 21 16:55:18.409999 2026] [:error] [pid 35321:tid 35395] [client 172.213.24.111:23453] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "aec7djeHLhVUuu8cVXzp5AAAAEs"]
[Tue Apr 21 16:55:19.827976 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:10891] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "aec7dzeHLhVUuu8cVXzp6gAAAFE"]
[Tue Apr 21 16:55:21.175997 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:9353] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ta0ol.php"] [unique_id "aec7eV2I9THUR-bRVGzyFgAAAg4"]
[Tue Apr 21 16:55:22.498867 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:11200] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aec7el2I9THUR-bRVGzyIAAAAhA"]
[Tue Apr 21 16:55:24.607214 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:11416] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aec7fF2I9THUR-bRVGzyIgAAAgo"]
[Tue Apr 21 16:55:27.168745 2026] [:error] [pid 35415:tid 35444] [client 172.213.24.111:3582] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aec7f0iqDinI4_22zzhg7wAAANE"]
[Tue Apr 21 16:55:29.281483 2026] [:error] [pid 4777:tid 4801] [client 172.213.24.111:30184] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aligk.php"] [unique_id "aec7gaxXur6bykKyLZSSewAAAQ0"]
[Tue Apr 21 16:55:31.523193 2026] [:error] [pid 4777:tid 4795] [client 172.213.24.111:11246] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aec7g6xXur6bykKyLZSSfAAAAQc"]
[Tue Apr 21 16:55:33.705741 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:30158] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aec7hZ1ivsR4hcOSQbbLLQAAAoQ"]
[Tue Apr 21 16:55:35.162301 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:23458] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aec7h51ivsR4hcOSQbbLLgAAAoY"]
[Tue Apr 21 16:55:39.948018 2026] [:error] [pid 53731:tid 53737] [client 172.213.24.111:11217] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/users.php"] [unique_id "aec7i12I9THUR-bRVGzyOwAAAgI"]
[Tue Apr 21 16:55:42.514509 2026] [:error] [pid 53731:tid 53757] [client 172.213.24.111:3514] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "aec7jl2I9THUR-bRVGzySgAAAhU"]
[Tue Apr 21 16:55:45.325885 2026] [:error] [pid 53731:tid 53747] [client 172.213.24.111:22345] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "aec7kV2I9THUR-bRVGzyUwAAAgw"]
[Tue Apr 21 16:55:50.080130 2026] [:error] [pid 4777:tid 4789] [client 172.213.24.111:26245] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/vx.php"] [unique_id "aec7lqxXur6bykKyLZSSfwAAAQE"]
[Tue Apr 21 16:56:18.516942 2026] [proxy_fcgi:error] [pid 53731:tid 53747] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:18.768997 2026] [proxy_fcgi:error] [pid 53731:tid 53756] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:19.008298 2026] [proxy_fcgi:error] [pid 53731:tid 53743] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:19.259202 2026] [proxy_fcgi:error] [pid 53731:tid 53738] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:19.744497 2026] [proxy_fcgi:error] [pid 53731:tid 53736] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:19.990827 2026] [proxy_fcgi:error] [pid 53731:tid 53741] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:20.231685 2026] [proxy_fcgi:error] [pid 53731:tid 53739] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:20.477292 2026] [proxy_fcgi:error] [pid 53731:tid 53747] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:20.714780 2026] [proxy_fcgi:error] [pid 53731:tid 53750] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:20.951978 2026] [proxy_fcgi:error] [pid 53731:tid 53753] [client 172.213.24.111:13731] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:56:21.185381 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:13731] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aec7tV2I9THUR-bRVGzyxQAAAgU"]
[Tue Apr 21 16:56:24.605383 2026] [:error] [pid 53731:tid 53736] [client 172.213.24.111:45361] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "aec7uF2I9THUR-bRVGzy1gAAAgE"]
[Tue Apr 21 16:56:52.733670 2026] [:error] [pid 53978:tid 53983] [client 172.213.24.111:27497] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aec71J1ivsR4hcOSQbbLyAAAAoM"]
[Tue Apr 21 16:56:55.557438 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:26607] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aec714zEbQHHxtmWbaZ9jgAAAtQ"]
[Tue Apr 21 16:56:59.935796 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:12285] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aec7212I9THUR-bRVGzzhAAAAg4"]
[Tue Apr 21 16:57:05.304353 2026] [:error] [pid 4823:tid 4876] [client 172.213.24.111:25415] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aec74fc8mke3PfHqsxHd4AAAAZc"]
[Tue Apr 21 16:57:06.866253 2026] [:error] [pid 53731:tid 53743] [client 172.213.24.111:11687] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "aec74l2I9THUR-bRVGzzowAAAgg"]
[Tue Apr 21 16:57:17.017711 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:35063] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "aec77YJW6fdXWO6agMFJ4QAAAAQ"]
[Tue Apr 21 16:57:20.304297 2026] [proxy_fcgi:error] [pid 35320:tid 35350] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:20.541421 2026] [proxy_fcgi:error] [pid 35320:tid 35332] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:20.795213 2026] [proxy_fcgi:error] [pid 35320:tid 35340] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:21.032068 2026] [proxy_fcgi:error] [pid 35320:tid 35339] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:21.549789 2026] [proxy_fcgi:error] [pid 35320:tid 35337] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:21.786212 2026] [proxy_fcgi:error] [pid 35320:tid 35341] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:22.023206 2026] [proxy_fcgi:error] [pid 35320:tid 35352] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:22.279457 2026] [proxy_fcgi:error] [pid 35320:tid 35345] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:23.056388 2026] [proxy_fcgi:error] [pid 35320:tid 35344] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:24.695205 2026] [proxy_fcgi:error] [pid 35320:tid 35350] [client 172.213.24.111:16825] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:57:24.941015 2026] [:error] [pid 35320:tid 35331] [client 172.213.24.111:16825] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aec79IJW6fdXWO6agMFJ9gAAAAE"]
[Tue Apr 21 16:57:28.397461 2026] [:error] [pid 53731:tid 53759] [client 172.213.24.111:17643] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aec7-F2I9THUR-bRVGzz6gAAAhc"]
[Tue Apr 21 16:57:30.162000 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:3405] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aec7-p1ivsR4hcOSQbbMWAAAApQ"]
[Tue Apr 21 16:57:33.366321 2026] [:error] [pid 53978:tid 53992] [client 172.213.24.111:26764] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "aec7_Z1ivsR4hcOSQbbMWwAAAow"]
[Tue Apr 21 16:57:40.905188 2026] [:error] [pid 4823:tid 4855] [client 172.213.24.111:20331] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aec8BPc8mke3PfHqsxHd8QAAAYI"]
[Tue Apr 21 16:57:44.915399 2026] [:error] [pid 35321:tid 35405] [client 172.213.24.111:16790] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aec8CDeHLhVUuu8cVXzq5wAAAFU"]
[Tue Apr 21 16:57:47.575348 2026] [:error] [pid 35321:tid 35398] [client 172.213.24.111:30670] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "aec8CzeHLhVUuu8cVXzq9AAAAE4"]
[Tue Apr 21 16:57:51.761092 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:15705] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "aec8D4JW6fdXWO6agMFKIgAAAAs"]
[Tue Apr 21 16:57:56.265705 2026] [:error] [pid 35321:tid 35400] [client 172.213.24.111:26311] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "aec8FDeHLhVUuu8cVXzrDQAAAFA"]
[Tue Apr 21 16:58:43.876381 2026] [proxy_fcgi:error] [pid 53731:tid 53743] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:44.113963 2026] [proxy_fcgi:error] [pid 53731:tid 53754] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:44.351358 2026] [proxy_fcgi:error] [pid 53731:tid 53737] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:44.588059 2026] [proxy_fcgi:error] [pid 53731:tid 53748] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:44.828319 2026] [proxy_fcgi:error] [pid 53731:tid 53744] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:45.067905 2026] [proxy_fcgi:error] [pid 53731:tid 53757] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:45.305312 2026] [proxy_fcgi:error] [pid 53731:tid 53739] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:45.542437 2026] [proxy_fcgi:error] [pid 53731:tid 53760] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:46.465824 2026] [proxy_fcgi:error] [pid 53731:tid 53741] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:46.776896 2026] [proxy_fcgi:error] [pid 53731:tid 53736] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:47.014728 2026] [proxy_fcgi:error] [pid 53731:tid 53757] [client 172.213.24.111:27398] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:58:47.248429 2026] [:error] [pid 53731:tid 53750] [client 172.213.24.111:27398] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aec8R12I9THUR-bRVGz0ZAAAAg8"]
[Tue Apr 21 16:58:49.743816 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:26000] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aec8SV2I9THUR-bRVGz0dAAAAhE"]
[Tue Apr 21 16:58:50.901929 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:3763] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aec8SozEbQHHxtmWbaZ-awAAAsc"]
[Tue Apr 21 16:58:52.356096 2026] [:error] [pid 4777:tid 4802] [client 172.213.24.111:26015] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "aec8TKxXur6bykKyLZSS0gAAAQ4"]
[Tue Apr 21 16:58:53.421083 2026] [:error] [pid 53978:tid 53995] [client 172.213.24.111:28709] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aec8TZ1ivsR4hcOSQbbNCAAAAo8"]
[Tue Apr 21 16:58:54.300681 2026] [:error] [pid 53832:tid 53849] [client 172.213.24.111:26002] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aec8TtzkuxsE_OhM9UJC4wAAAk4"]
[Tue Apr 21 16:58:55.219383 2026] [:error] [pid 35320:tid 35353] [client 172.213.24.111:35442] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "aec8T4JW6fdXWO6agMFKqAAAABc"]
[Tue Apr 21 16:59:11.063488 2026] [:error] [pid 53832:tid 53839] [client 172.213.24.111:14722] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aec8X9zkuxsE_OhM9UJC7QAAAkQ"]
[Tue Apr 21 16:59:12.708125 2026] [:error] [pid 35322:tid 35380] [client 172.213.24.111:42335] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aec8YKPoAfV40BTfVKzMtAAAAJc"]
[Tue Apr 21 16:59:17.374907 2026] [:error] [pid 35321:tid 35389] [client 172.213.24.111:26005] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aec8ZTeHLhVUuu8cVXzsngAAAEU"]
[Tue Apr 21 16:59:20.158459 2026] [:error] [pid 35320:tid 35335] [client 172.213.24.111:26863] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "aec8aIJW6fdXWO6agMFK8QAAAAU"]
[Tue Apr 21 16:59:22.847560 2026] [:error] [pid 53731:tid 53744] [client 172.213.24.111:25986] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "aec8al2I9THUR-bRVGz03QAAAgk"]
[Tue Apr 21 16:59:27.935320 2026] [:error] [pid 53832:tid 53859] [client 172.213.24.111:27032] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "aec8b9zkuxsE_OhM9UJC8gAAAlg"]
[Tue Apr 21 16:59:31.078360 2026] [:error] [pid 4777:tid 4802] [client 172.213.24.111:9399] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "aec8c6xXur6bykKyLZSS2gAAAQ4"]
[Tue Apr 21 16:59:34.941192 2026] [:error] [pid 35321:tid 35405] [client 172.213.24.111:9370] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "aec8djeHLhVUuu8cVXzsrwAAAFU"]
[Tue Apr 21 16:59:36.372852 2026] [:error] [pid 53978:tid 53995] [client 172.213.24.111:3211] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aec8eJ1ivsR4hcOSQbbNKgAAAo8"]
[Tue Apr 21 16:59:37.151147 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:9347] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aec8eV2I9THUR-bRVGz1BQAAAhE"]
[Tue Apr 21 16:59:38.699834 2026] [:error] [pid 53731:tid 53747] [client 172.213.24.111:9378] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aec8el2I9THUR-bRVGz1EQAAAgw"]
[Tue Apr 21 16:59:39.500422 2026] [:error] [pid 35322:tid 35363] [client 172.213.24.111:11179] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "aec8e6PoAfV40BTfVKzMuwAAAIY"]
[Tue Apr 21 16:59:40.501942 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:17173] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aec8fIJW6fdXWO6agMFLDAAAAAw"]
[Tue Apr 21 16:59:41.374223 2026] [:error] [pid 35321:tid 35406] [client 172.213.24.111:17173] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aec8fTeHLhVUuu8cVXzsuAAAAFY"]
[Tue Apr 21 16:59:42.269148 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:11198] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aec8fp1ivsR4hcOSQbbNMwAAAoA"]
[Tue Apr 21 16:59:43.207027 2026] [:error] [pid 53832:tid 53847] [client 172.213.24.111:11184] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "aec8f9zkuxsE_OhM9UJC-wAAAkw"]
[Tue Apr 21 16:59:45.174413 2026] [:error] [pid 35320:tid 35354] [client 172.213.24.111:24319] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aec8gYJW6fdXWO6agMFLFQAAABg"]
[Tue Apr 21 16:59:46.210783 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:14521] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp9.php"] [unique_id "aec8gp1ivsR4hcOSQbbNPwAAAoA"]
[Tue Apr 21 16:59:48.524318 2026] [proxy_fcgi:error] [pid 35321:tid 35390] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:48.780659 2026] [proxy_fcgi:error] [pid 35321:tid 35396] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:49.107912 2026] [proxy_fcgi:error] [pid 35321:tid 35397] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:49.786361 2026] [proxy_fcgi:error] [pid 35321:tid 35384] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:50.023606 2026] [proxy_fcgi:error] [pid 35321:tid 35398] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:50.260754 2026] [proxy_fcgi:error] [pid 35321:tid 35406] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:50.514959 2026] [proxy_fcgi:error] [pid 35321:tid 35387] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:50.772528 2026] [proxy_fcgi:error] [pid 35321:tid 35405] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:51.012093 2026] [proxy_fcgi:error] [pid 35321:tid 35408] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:51.287611 2026] [proxy_fcgi:error] [pid 35321:tid 35400] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:51.528990 2026] [proxy_fcgi:error] [pid 35321:tid 35403] [client 172.213.24.111:16446] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 16:59:51.762593 2026] [:error] [pid 35321:tid 35390] [client 172.213.24.111:16446] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "aec8hzeHLhVUuu8cVXzs0AAAAEY"]
[Tue Apr 21 16:59:52.706562 2026] [:error] [pid 53731:tid 53756] [client 172.213.24.111:15664] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "aec8iF2I9THUR-bRVGz1YgAAAhQ"]
[Tue Apr 21 17:00:06.712700 2026] [:error] [pid 35320:tid 35350] [client 172.213.24.111:23887] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "aec8loJW6fdXWO6agMFLOAAAABQ"]
[Tue Apr 21 17:00:17.929724 2026] [:error] [pid 53978:tid 53997] [client 172.213.24.111:3591] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aec8oZ1ivsR4hcOSQbbNvAAAApE"]
[Tue Apr 21 17:00:21.735410 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:13548] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "aec8pZ1ivsR4hcOSQbbNwwAAAoA"]
[Tue Apr 21 17:00:28.431898 2026] [:error] [pid 53978:tid 54004] [client 172.213.24.111:3599] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "aec8rJ1ivsR4hcOSQbbN0AAAApg"]
[Tue Apr 21 17:00:32.158789 2026] [:error] [pid 53978:tid 54001] [client 172.213.24.111:23053] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "aec8sJ1ivsR4hcOSQbbN3AAAApU"]
[Tue Apr 21 17:00:39.255343 2026] [:error] [pid 53832:tid 53849] [client 172.213.24.111:20238] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "aec8t9zkuxsE_OhM9UJDHQAAAk4"]
[Tue Apr 21 17:00:41.842004 2026] [:error] [pid 54080:tid 54087] [client 172.213.24.111:19760] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aec8uYzEbQHHxtmWbaZ-5QAAAsU"]
[Tue Apr 21 17:00:43.393388 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:24619] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aec8u51ivsR4hcOSQbbN6AAAAoU"]
[Tue Apr 21 17:00:45.166791 2026] [:error] [pid 54080:tid 54088] [client 172.213.24.111:32965] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aec8vYzEbQHHxtmWbaZ-6gAAAsY"]
[Tue Apr 21 17:00:46.553551 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:45314] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "aec8vp1ivsR4hcOSQbbN8wAAAoQ"]
[Tue Apr 21 17:00:50.484119 2026] [:error] [pid 53731:tid 53739] [client 172.213.24.111:45341] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "aec8wl2I9THUR-bRVGz27AAAAgQ"]
[Tue Apr 21 17:00:53.925558 2026] [proxy_fcgi:error] [pid 53978:tid 53984] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:54.162116 2026] [proxy_fcgi:error] [pid 53978:tid 53996] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:54.398522 2026] [proxy_fcgi:error] [pid 53978:tid 54003] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:54.638462 2026] [proxy_fcgi:error] [pid 53978:tid 53981] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:54.934394 2026] [proxy_fcgi:error] [pid 53978:tid 53999] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:55.172684 2026] [proxy_fcgi:error] [pid 53978:tid 53986] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:55.410158 2026] [proxy_fcgi:error] [pid 53978:tid 53991] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:55.657078 2026] [proxy_fcgi:error] [pid 53978:tid 53988] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:55.907540 2026] [proxy_fcgi:error] [pid 53978:tid 53997] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:56.144662 2026] [proxy_fcgi:error] [pid 53978:tid 53980] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:56.394784 2026] [proxy_fcgi:error] [pid 53978:tid 53983] [client 172.213.24.111:24594] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:00:56.629503 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:24594] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "aec8yJ1ivsR4hcOSQbbODQAAApY"]
[Tue Apr 21 17:00:58.710556 2026] [:error] [pid 53731:tid 53742] [client 172.213.24.111:31106] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "aec8yl2I9THUR-bRVGz3AAAAAgc"]
[Tue Apr 21 17:01:02.815955 2026] [:error] [pid 53731:tid 53746] [client 172.213.24.111:13737] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "aec8zl2I9THUR-bRVGz3CgAAAgs"]
[Tue Apr 21 17:01:07.635468 2026] [:error] [pid 54080:tid 54088] [client 172.213.24.111:27511] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "aec804zEbQHHxtmWbaZ-8gAAAsY"]
[Tue Apr 21 17:01:14.394178 2026] [:error] [pid 53978:tid 53990] [client 172.213.24.111:3465] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "aec82p1ivsR4hcOSQbbOKQAAAoo"]
[Tue Apr 21 17:01:30.609983 2026] [:error] [pid 53978:tid 53996] [client 172.213.24.111:24655] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "aec86p1ivsR4hcOSQbbOVAAAApA"]
[Tue Apr 21 17:01:31.844467 2026] [:error] [pid 53978:tid 53989] [client 172.213.24.111:29631] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "aec8651ivsR4hcOSQbbOXwAAAok"]
[Tue Apr 21 17:01:34.857375 2026] [:error] [pid 53731:tid 53738] [client 172.213.24.111:25458] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "aec87l2I9THUR-bRVGz3PgAAAgM"]
[Tue Apr 21 17:01:36.882691 2026] [:error] [pid 53731:tid 53735] [client 172.213.24.111:29600] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "aec88F2I9THUR-bRVGz3UAAAAgA"]
[Tue Apr 21 17:01:39.083203 2026] [:error] [pid 35322:tid 35378] [client 172.213.24.111:25438] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aec886PoAfV40BTfVKzMxgAAAJU"]
[Tue Apr 21 17:01:39.962114 2026] [:error] [pid 35415:tid 35430] [client 172.213.24.111:29581] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aec880iqDinI4_22zzhhWgAAAMM"]
[Tue Apr 21 17:01:42.181317 2026] [:error] [pid 35321:tid 35400] [client 172.213.24.111:31557] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aec89jeHLhVUuu8cVXztfwAAAFA"]
[Tue Apr 21 17:01:45.023776 2026] [:error] [pid 53731:tid 53759] [client 172.213.24.111:21441] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "aec8-V2I9THUR-bRVGz3dQAAAhc"]
[Tue Apr 21 17:01:46.669940 2026] [:error] [pid 53731:tid 53743] [client 172.213.24.111:15267] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aec8-l2I9THUR-bRVGz3fAAAAgg"]
[Tue Apr 21 17:01:53.046675 2026] [:error] [pid 35415:tid 35439] [client 172.213.24.111:8350] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aec9AUiqDinI4_22zzhhYQAAAMw"]
[Tue Apr 21 17:01:53.902069 2026] [:error] [pid 35320:tid 35351] [client 172.213.24.111:17620] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aec9AYJW6fdXWO6agMFLowAAABU"]
[Tue Apr 21 17:01:55.472997 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:35024] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "aec9A12I9THUR-bRVGz3wgAAAg0"]
[Tue Apr 21 17:01:56.189427 2026] [proxy_fcgi:error] [pid 35321:tid 35393] [client 172.213.24.111:8383] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:01:56.703740 2026] [proxy_fcgi:error] [pid 35321:tid 35396] [client 172.213.24.111:8383] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 17:01:56.939870 2026] [proxy_fcgi:error] [pid 35321:tid 35402] [client 172.213.24.111:8383] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 19:12:11.980058 2026] [:error] [pid 35321:tid 35384] [client 143.110.131.62:57578] [client 143.110.131.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.131.62, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aedbizeHLhVUuu8cVXxJZAAAAEA"]
[Tue Apr 21 19:12:11.992847 2026] [proxy_fcgi:error] [pid 35321:tid 35384] [client 143.110.131.62:57578] AH01071: Got error 'Primary script unknown'
[Tue Apr 21 20:15:56.021466 2026] [:error] [pid 53731:tid 53759] [client 170.106.161.78:35820] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aedqfF2I9THUR-bRVGxU8wAAAhc"]
[Wed Apr 22 00:26:05.472320 2026] [:error] [pid 35320:tid 35330] [client 182.42.104.32:43451] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeelHYJW6fdXWO6agMFP4AAAAAA"]
[Wed Apr 22 03:56:31.761513 2026] [:error] [pid 21682:tid 21724] [client 216.24.210.148:28303] [client 216.24.210.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aefWb5lXWQZUlmPHS3rMWgAAAEE"]
[Wed Apr 22 03:59:33.431364 2026] [:error] [pid 21788:tid 21808] [client 170.106.193.108:60014] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aefXJX7OM27rzVpef243hgAAANI"]
[Wed Apr 22 05:11:11.269885 2026] [:error] [pid 23041:tid 23049] [client 51.77.216.36:52502] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn70TXx_lUa7xwAb6qIgAAAQU"]
[Wed Apr 22 05:11:11.293684 2026] [:error] [pid 23041:tid 23061] [client 51.77.216.36:33896] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefn70TXx_lUa7xwAb6qIwAAARE"]
[Wed Apr 22 05:11:11.417717 2026] [:error] [pid 21788:tid 21795] [client 51.77.216.36:39956] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefn737OM27rzVpef25naAAAAMU"]
[Wed Apr 22 05:11:12.082829 2026] [:error] [pid 21788:tid 21807] [client 51.77.216.36:38408] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefn8H7OM27rzVpef25naQAAANE"]
[Wed Apr 22 05:11:12.663641 2026] [:error] [pid 21788:tid 21798] [client 51.77.216.36:49756] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefn8H7OM27rzVpef25nbwAAAMg"]
[Wed Apr 22 05:11:13.416852 2026] [:error] [pid 21683:tid 21774] [client 51.77.216.36:55486] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefn8VZBWT-0diZyYyZ0CgAAAJg"]
[Wed Apr 22 05:11:14.574990 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:55220] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn8kTXx_lUa7xwAb6qJwAAARI"]
[Wed Apr 22 05:11:14.655962 2026] [:error] [pid 23041:tid 23065] [client 51.77.216.36:36686] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefn8kTXx_lUa7xwAb6qKAAAARU"]
[Wed Apr 22 05:11:15.450271 2026] [:error] [pid 21788:tid 21810] [client 51.77.216.36:35282] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefn837OM27rzVpef25nfAAAANQ"]
[Wed Apr 22 05:11:15.926948 2026] [:error] [pid 23041:tid 23058] [client 51.77.216.36:44042] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn80TXx_lUa7xwAb6qKwAAAQ4"]
[Wed Apr 22 05:11:16.281885 2026] [:error] [pid 21788:tid 21804] [client 51.77.216.36:49280] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefn9H7OM27rzVpef25ngwAAAM4"]
[Wed Apr 22 05:11:16.374953 2026] [:error] [pid 23041:tid 23055] [client 51.77.216.36:58458] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefn9ETXx_lUa7xwAb6qLQAAAQs"]
[Wed Apr 22 05:11:17.049612 2026] [:error] [pid 21683:tid 21756] [client 51.77.216.36:52510] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn9VZBWT-0diZyYyZ0EQAAAIY"]
[Wed Apr 22 05:11:17.861093 2026] [:error] [pid 21683:tid 21764] [client 51.77.216.36:47522] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn9VZBWT-0diZyYyZ0FAAAAI4"]
[Wed Apr 22 05:11:18.535880 2026] [:error] [pid 21682:tid 21728] [client 51.77.216.36:35290] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefn9plXWQZUlmPHS3rmFgAAAEU"]
[Wed Apr 22 05:11:18.650731 2026] [:error] [pid 21681:tid 21714] [client 51.77.216.36:36694] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefn9t5LmJziq-yZYawiagAAABg"]
[Wed Apr 22 05:11:18.658580 2026] [:error] [pid 21682:tid 21725] [client 51.77.216.36:55230] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn9plXWQZUlmPHS3rmFwAAAEI"]
[Wed Apr 22 05:11:19.025019 2026] [:error] [pid 21788:tid 21797] [client 51.77.216.36:49288] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn937OM27rzVpef25nhwAAAMc"]
[Wed Apr 22 05:11:19.300740 2026] [:error] [pid 21682:tid 21724] [client 51.77.216.36:58460] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefn95lXWQZUlmPHS3rmGgAAAEE"]
[Wed Apr 22 05:11:20.989461 2026] [:error] [pid 21683:tid 21766] [client 51.77.216.36:33104] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefn-FZBWT-0diZyYyZ0IgAAAJA"]
[Wed Apr 22 05:11:22.027642 2026] [:error] [pid 23041:tid 23066] [client 51.77.216.36:39266] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefn-kTXx_lUa7xwAb6qNgAAARY"]
[Wed Apr 22 05:11:22.237335 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:42294] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-kTXx_lUa7xwAb6qOAAAARI"]
[Wed Apr 22 05:11:22.318412 2026] [:error] [pid 21681:tid 21695] [client 51.77.216.36:35496] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefn-t5LmJziq-yZYawicgAAAAU"]
[Wed Apr 22 05:11:22.587936 2026] [:error] [pid 23041:tid 23068] [client 51.77.216.36:59650] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-kTXx_lUa7xwAb6qOQAAARg"]
[Wed Apr 22 05:11:22.712349 2026] [:error] [pid 21788:tid 21796] [client 51.77.216.36:57882] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-n7OM27rzVpef25nkAAAAMY"]
[Wed Apr 22 05:11:23.029670 2026] [:error] [pid 21788:tid 21792] [client 51.77.216.36:60626] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-37OM27rzVpef25nkQAAAMI"]
[Wed Apr 22 05:11:23.182694 2026] [:error] [pid 21683:tid 21752] [client 51.77.216.36:33114] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-1ZBWT-0diZyYyZ0KwAAAII"]
[Wed Apr 22 05:11:23.516345 2026] [:error] [pid 21788:tid 21799] [client 51.77.216.36:36468] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn-37OM27rzVpef25nkgAAAMk"]
[Wed Apr 22 05:11:25.021648 2026] [:error] [pid 21682:tid 21744] [client 51.77.216.36:44225] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn_ZlXWQZUlmPHS3rmKwAAAFU"]
[Wed Apr 22 05:11:25.276490 2026] [:error] [pid 23041:tid 23051] [client 51.77.216.36:51166] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefn_UTXx_lUa7xwAb6qPQAAAQc"]
[Wed Apr 22 05:11:26.498697 2026] [:error] [pid 23041:tid 23050] [client 51.77.216.36:42304] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn_kTXx_lUa7xwAb6qPwAAAQY"]
[Wed Apr 22 05:11:27.074635 2026] [:error] [pid 21683:tid 21770] [client 51.77.216.36:57898] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn_1ZBWT-0diZyYyZ0NAAAAJQ"]
[Wed Apr 22 05:11:27.217789 2026] [:error] [pid 21683:tid 21771] [client 51.77.216.36:35498] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefn_1ZBWT-0diZyYyZ0NgAAAJU"]
[Wed Apr 22 05:11:27.387509 2026] [:error] [pid 21681:tid 21698] [client 51.77.216.36:41990] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefn_95LmJziq-yZYawifAAAAAg"]
[Wed Apr 22 05:11:27.388906 2026] [:error] [pid 21682:tid 21737] [client 51.77.216.36:33122] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefn_5lXWQZUlmPHS3rmOAAAAE4"]
[Wed Apr 22 05:11:27.872840 2026] [:error] [pid 21681:tid 21711] [client 51.77.216.36:51168] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefn_95LmJziq-yZYawigQAAABU"]
[Wed Apr 22 05:11:29.092504 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:60634] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoAUTXx_lUa7xwAb6qRgAAARI"]
[Wed Apr 22 05:11:29.349853 2026] [:error] [pid 21682:tid 21733] [client 51.77.216.36:42002] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoAZlXWQZUlmPHS3rmPQAAAEo"]
[Wed Apr 22 05:11:29.351202 2026] [:error] [pid 21681:tid 21690] [client 51.77.216.36:49672] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoAd5LmJziq-yZYawihwAAAAA"]
[Wed Apr 22 05:11:29.358132 2026] [:error] [pid 21682:tid 21723] [client 51.77.216.36:59388] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoAZlXWQZUlmPHS3rmPgAAAEA"]
[Wed Apr 22 05:11:29.603459 2026] [:error] [pid 21681:tid 21712] [client 51.77.216.36:59660] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoAd5LmJziq-yZYawiiQAAABY"]
[Wed Apr 22 05:11:30.065303 2026] [:error] [pid 21682:tid 21739] [client 51.77.216.36:51172] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoAplXWQZUlmPHS3rmQwAAAFA"]
[Wed Apr 22 05:11:30.379414 2026] [:error] [pid 21788:tid 21810] [client 51.77.216.36:51342] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoAn7OM27rzVpef25nmQAAANQ"]
[Wed Apr 22 05:11:31.640927 2026] [:error] [pid 23041:tid 23063] [client 51.77.216.36:39210] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoA0TXx_lUa7xwAb6qTQAAARM"]
[Wed Apr 22 05:11:31.886483 2026] [:error] [pid 23041:tid 23044] [client 51.77.216.36:52646] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoA0TXx_lUa7xwAb6qTwAAAQA"]
[Wed Apr 22 05:11:32.322746 2026] [:error] [pid 23041:tid 23054] [client 51.77.216.36:55918] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoBETXx_lUa7xwAb6qUgAAAQo"]
[Wed Apr 22 05:11:32.515897 2026] [:error] [pid 21681:tid 21708] [client 51.77.216.36:53838] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoBN5LmJziq-yZYawilQAAABI"]
[Wed Apr 22 05:11:32.768394 2026] [:error] [pid 23041:tid 23066] [client 51.77.216.36:59208] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoBETXx_lUa7xwAb6qVQAAARY"]
[Wed Apr 22 05:11:32.989312 2026] [:error] [pid 21788:tid 21792] [client 51.77.216.36:42904] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoBH7OM27rzVpef25nnwAAAMI"]
[Wed Apr 22 05:11:33.041461 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:38988] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoBUTXx_lUa7xwAb6qVwAAARI"]
[Wed Apr 22 05:11:33.328036 2026] [:error] [pid 21788:tid 21804] [client 51.77.216.36:39876] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoBX7OM27rzVpef25noQAAAM4"]
[Wed Apr 22 05:11:33.503474 2026] [:error] [pid 21788:tid 21793] [client 51.77.216.36:56310] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoBX7OM27rzVpef25nogAAAMM"]
[Wed Apr 22 05:11:34.183330 2026] [:error] [pid 21788:tid 21800] [client 51.77.216.36:33590] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoBn7OM27rzVpef25npgAAAMo"]
[Wed Apr 22 05:11:34.274624 2026] [:error] [pid 21788:tid 21812] [client 51.77.216.36:45184] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoBn7OM27rzVpef25npwAAANY"]
[Wed Apr 22 05:11:34.309369 2026] [:error] [pid 21788:tid 21814] [client 51.77.216.36:39212] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoBn7OM27rzVpef25nqAAAANg"]
[Wed Apr 22 05:11:34.434398 2026] [:error] [pid 21683:tid 21754] [client 51.77.216.36:42918] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoBlZBWT-0diZyYyZ0RgAAAIQ"]
[Wed Apr 22 05:11:34.963978 2026] [:error] [pid 21681:tid 21691] [client 51.77.216.36:40122] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoBt5LmJziq-yZYawimgAAAAE"]
[Wed Apr 22 05:11:35.264299 2026] [:error] [pid 21681:tid 21696] [client 51.77.216.36:55928] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoB95LmJziq-yZYawinAAAAAY"]
[Wed Apr 22 05:11:35.669001 2026] [:error] [pid 21682:tid 21739] [client 51.77.216.36:59212] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoB5lXWQZUlmPHS3rmVgAAAFA"]
[Wed Apr 22 05:11:35.860770 2026] [:error] [pid 21682:tid 21747] [client 51.77.216.36:53850] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoB5lXWQZUlmPHS3rmWAAAAFg"]
[Wed Apr 22 05:11:35.881553 2026] [:error] [pid 21683:tid 21755] [client 51.77.216.36:56322] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoB1ZBWT-0diZyYyZ0TAAAAIU"]
[Wed Apr 22 05:11:36.301255 2026] [:error] [pid 21682:tid 21724] [client 51.77.216.36:52650] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoCJlXWQZUlmPHS3rmWwAAAEE"]
[Wed Apr 22 05:11:36.438356 2026] [:error] [pid 21683:tid 21771] [client 51.77.216.36:55942] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoCFZBWT-0diZyYyZ0TgAAAJU"]
[Wed Apr 22 05:11:36.485872 2026] [:error] [pid 21682:tid 21728] [client 51.77.216.36:38992] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoCJlXWQZUlmPHS3rmXQAAAEU"]
[Wed Apr 22 05:11:36.551413 2026] [:error] [pid 21682:tid 21732] [client 51.77.216.36:39222] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoCJlXWQZUlmPHS3rmXgAAAEk"]
[Wed Apr 22 05:11:36.580679 2026] [:error] [pid 21683:tid 21758] [client 51.77.216.36:45198] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoCFZBWT-0diZyYyZ0UAAAAIg"]
[Wed Apr 22 05:11:36.832568 2026] [:error] [pid 23041:tid 23063] [client 51.77.216.36:53696] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoCETXx_lUa7xwAb6qXQAAARM"]
[Wed Apr 22 05:11:37.603905 2026] [:error] [pid 21683:tid 21767] [client 51.77.216.36:53860] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoCVZBWT-0diZyYyZ0VgAAAJE"]
[Wed Apr 22 05:11:37.706825 2026] [:error] [pid 21683:tid 21756] [client 51.77.216.36:39238] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoCVZBWT-0diZyYyZ0VwAAAIY"]
[Wed Apr 22 05:11:37.728778 2026] [:error] [pid 21683:tid 21757] [client 51.77.216.36:40124] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoCVZBWT-0diZyYyZ0WAAAAIc"]
[Wed Apr 22 05:11:37.852925 2026] [:error] [pid 23041:tid 23051] [client 51.77.216.36:59228] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoCUTXx_lUa7xwAb6qYQAAAQc"]
[Wed Apr 22 05:11:38.549678 2026] [:error] [pid 21682:tid 21738] [client 51.77.216.36:54386] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoCplXWQZUlmPHS3rmZAAAAE8"]
[Wed Apr 22 05:11:38.586415 2026] [:error] [pid 21682:tid 21741] [client 51.77.216.36:56338] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoCplXWQZUlmPHS3rmZQAAAFI"]
[Wed Apr 22 05:11:38.714598 2026] [:error] [pid 21788:tid 21802] [client 51.77.216.36:48698] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoCn7OM27rzVpef25nrwAAAMw"]
[Wed Apr 22 05:11:39.102155 2026] [:error] [pid 21788:tid 21804] [client 51.77.216.36:39008] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoC37OM27rzVpef25nswAAAM4"]
[Wed Apr 22 05:11:39.237892 2026] [:error] [pid 21788:tid 21811] [client 51.77.216.36:42924] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoC37OM27rzVpef25ntQAAANU"]
[Wed Apr 22 05:11:39.411502 2026] [:error] [pid 23041:tid 23054] [client 51.77.216.36:45214] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoC0TXx_lUa7xwAb6qZQAAAQo"]
[Wed Apr 22 05:11:39.484876 2026] [:error] [pid 21683:tid 21768] [client 51.77.216.36:53700] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoC1ZBWT-0diZyYyZ0YgAAAJI"]
[Wed Apr 22 05:11:39.728452 2026] [:error] [pid 21682:tid 21739] [client 51.77.216.36:52654] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoC5lXWQZUlmPHS3rmaQAAAFA"]
[Wed Apr 22 05:11:40.403747 2026] [:error] [pid 23041:tid 23049] [client 51.77.216.36:56934] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoDETXx_lUa7xwAb6qaAAAAQU"]
[Wed Apr 22 05:11:40.522068 2026] [:error] [pid 23041:tid 23045] [client 51.77.216.36:48248] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoDETXx_lUa7xwAb6qaQAAAQE"]
[Wed Apr 22 05:11:40.559545 2026] [:error] [pid 21683:tid 21760] [client 51.77.216.36:58956] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoDFZBWT-0diZyYyZ0aQAAAIo"]
[Wed Apr 22 05:11:41.024000 2026] [:error] [pid 21683:tid 21756] [client 51.77.216.36:52162] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoDVZBWT-0diZyYyZ0bQAAAIY"]
[Wed Apr 22 05:11:41.186440 2026] [:error] [pid 21683:tid 21764] [client 51.77.216.36:38840] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoDVZBWT-0diZyYyZ0bwAAAI4"]
[Wed Apr 22 05:11:41.943590 2026] [:error] [pid 23041:tid 23050] [client 51.77.216.36:55986] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoDUTXx_lUa7xwAb6qbgAAAQY"]
[Wed Apr 22 05:11:42.044211 2026] [:error] [pid 23041:tid 23061] [client 51.77.216.36:52702] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoDkTXx_lUa7xwAb6qbwAAARE"]
[Wed Apr 22 05:11:42.105697 2026] [:error] [pid 23041:tid 23046] [client 51.77.216.36:43114] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoDkTXx_lUa7xwAb6qcQAAAQI"]
[Wed Apr 22 05:11:42.322893 2026] [:error] [pid 23041:tid 23068] [client 51.77.216.36:39934] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoDkTXx_lUa7xwAb6qcwAAARg"]
[Wed Apr 22 05:11:42.384462 2026] [:error] [pid 21682:tid 21737] [client 51.77.216.36:47664] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoDplXWQZUlmPHS3rmcwAAAE4"]
[Wed Apr 22 05:11:43.178986 2026] [:error] [pid 21682:tid 21735] [client 51.77.216.36:48252] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoD5lXWQZUlmPHS3rmdQAAAEw"]
[Wed Apr 22 05:11:43.281410 2026] [:error] [pid 21788:tid 21798] [client 51.77.216.36:53086] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoD37OM27rzVpef25nxwAAAMg"]
[Wed Apr 22 05:11:43.390187 2026] [:error] [pid 21681:tid 21705] [client 51.77.216.36:37984] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoD95LmJziq-yZYawiowAAAA8"]
[Wed Apr 22 05:11:43.807359 2026] [:error] [pid 21683:tid 21758] [client 51.77.216.36:36518] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoD1ZBWT-0diZyYyZ0dwAAAIg"]
[Wed Apr 22 05:11:43.867505 2026] [:error] [pid 23041:tid 23054] [client 51.77.216.36:53604] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoD0TXx_lUa7xwAb6qewAAAQo"]
[Wed Apr 22 05:11:44.075739 2026] [:error] [pid 23041:tid 23052] [client 51.77.216.36:41838] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoEETXx_lUa7xwAb6qfAAAAQg"]
[Wed Apr 22 05:11:44.341464 2026] [:error] [pid 21682:tid 21742] [client 51.77.216.36:43120] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoEJlXWQZUlmPHS3rmfwAAAFM"]
[Wed Apr 22 05:11:44.347141 2026] [:error] [pid 23041:tid 23053] [client 51.77.216.36:34128] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoEETXx_lUa7xwAb6qfQAAAQk"]
[Wed Apr 22 05:11:45.006356 2026] [:error] [pid 23041:tid 23056] [client 51.77.216.36:42948] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoEUTXx_lUa7xwAb6qgAAAAQw"]
[Wed Apr 22 05:11:45.541855 2026] [:error] [pid 23041:tid 23050] [client 51.77.216.36:52936] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoEUTXx_lUa7xwAb6qggAAAQY"]
[Wed Apr 22 05:11:45.554956 2026] [:error] [pid 23041:tid 23059] [client 51.77.216.36:55992] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoEUTXx_lUa7xwAb6qgwAAAQ8"]
[Wed Apr 22 05:11:45.840339 2026] [:error] [pid 21683:tid 21759] [client 51.77.216.36:36670] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoEVZBWT-0diZyYyZ0ggAAAIk"]
[Wed Apr 22 05:11:45.878244 2026] [:error] [pid 21681:tid 21690] [client 51.77.216.36:36528] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoEd5LmJziq-yZYawiqQAAAAA"]
[Wed Apr 22 05:11:45.907339 2026] [:error] [pid 21681:tid 21713] [client 51.77.216.36:37988] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoEd5LmJziq-yZYawiqgAAABc"]
[Wed Apr 22 05:11:46.038612 2026] [:error] [pid 21682:tid 21737] [client 51.77.216.36:53092] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoEplXWQZUlmPHS3rmhQAAAE4"]
[Wed Apr 22 05:11:46.055586 2026] [:error] [pid 21682:tid 21729] [client 51.77.216.36:53618] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoEplXWQZUlmPHS3rmhgAAAEY"]
[Wed Apr 22 05:11:46.075293 2026] [:error] [pid 21682:tid 21725] [client 51.77.216.36:52176] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoEplXWQZUlmPHS3rmhwAAAEI"]
[Wed Apr 22 05:11:46.880336 2026] [:error] [pid 21683:tid 21768] [client 51.77.216.36:48676] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoElZBWT-0diZyYyZ0iQAAAJI"]
[Wed Apr 22 05:11:47.230545 2026] [:error] [pid 23041:tid 23044] [client 51.77.216.36:43124] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoE0TXx_lUa7xwAb6qhwAAAQA"]
[Wed Apr 22 05:11:47.468410 2026] [:error] [pid 21683:tid 21767] [client 51.77.216.36:58962] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aefoE1ZBWT-0diZyYyZ0jAAAAJE"]
[Wed Apr 22 05:11:47.479892 2026] [:error] [pid 21683:tid 21756] [client 51.77.216.36:52706] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoE1ZBWT-0diZyYyZ0jQAAAIY"]
[Wed Apr 22 05:11:48.186965 2026] [:error] [pid 23041:tid 23055] [client 51.77.216.36:55998] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoFETXx_lUa7xwAb6qiAAAAQs"]
[Wed Apr 22 05:11:48.286277 2026] [:error] [pid 21683:tid 21761] [client 51.77.216.36:36672] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoFFZBWT-0diZyYyZ0kQAAAIs"]
[Wed Apr 22 05:11:48.435490 2026] [:error] [pid 23041:tid 23047] [client 51.77.216.36:38000] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoFETXx_lUa7xwAb6qiQAAAQM"]
[Wed Apr 22 05:11:48.926918 2026] [:error] [pid 21683:tid 21753] [client 51.77.216.36:53626] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoFFZBWT-0diZyYyZ0lgAAAIM"]
[Wed Apr 22 05:11:48.989942 2026] [:error] [pid 21683:tid 21755] [client 51.77.216.36:53104] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoFFZBWT-0diZyYyZ0lwAAAIU"]
[Wed Apr 22 05:11:49.023919 2026] [:error] [pid 21683:tid 21751] [client 51.77.216.36:52192] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoFVZBWT-0diZyYyZ0mAAAAIE"]
[Wed Apr 22 05:11:49.217780 2026] [:error] [pid 23041:tid 23058] [client 51.77.216.36:52940] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoFUTXx_lUa7xwAb6qiwAAAQ4"]
[Wed Apr 22 05:11:49.315926 2026] [:error] [pid 21788:tid 21803] [client 51.77.216.36:48680] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoFX7OM27rzVpef25n0AAAAM0"]
[Wed Apr 22 05:11:50.044917 2026] [:error] [pid 21682:tid 21725] [client 51.77.216.36:43136] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoFplXWQZUlmPHS3rmmwAAAEI"]
[Wed Apr 22 05:11:50.304520 2026] [:error] [pid 21788:tid 21806] [client 51.77.216.36:43198] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoFn7OM27rzVpef25n0wAAANA"]
[Wed Apr 22 05:11:50.520653 2026] [:error] [pid 21788:tid 21809] [client 51.77.216.36:41044] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoFn7OM27rzVpef25n1AAAANM"]
[Wed Apr 22 05:11:51.153742 2026] [:error] [pid 21788:tid 21798] [client 51.77.216.36:49992] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoF37OM27rzVpef25n1wAAAMg"]
[Wed Apr 22 05:11:51.357984 2026] [:error] [pid 21788:tid 21804] [client 51.77.216.36:56700] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoF37OM27rzVpef25n2QAAAM4"]
[Wed Apr 22 05:11:51.443160 2026] [:error] [pid 21788:tid 21811] [client 51.77.216.36:56666] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoF37OM27rzVpef25n2gAAANU"]
[Wed Apr 22 05:11:51.770536 2026] [:error] [pid 21788:tid 21813] [client 51.77.216.36:42644] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoF37OM27rzVpef25n3gAAANc"]
[Wed Apr 22 05:11:52.166451 2026] [:error] [pid 21788:tid 21799] [client 51.77.216.36:58974] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoGH7OM27rzVpef25n3wAAAMk"]
[Wed Apr 22 05:11:52.301554 2026] [:error] [pid 21788:tid 21800] [client 51.77.216.36:57550] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoGH7OM27rzVpef25n4QAAAMo"]
[Wed Apr 22 05:11:52.461534 2026] [:error] [pid 21788:tid 21803] [client 51.77.216.36:43206] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoGH7OM27rzVpef25n5AAAAM0"]
[Wed Apr 22 05:11:53.235693 2026] [:error] [pid 23041:tid 23053] [client 51.77.216.36:39452] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoGUTXx_lUa7xwAb6qjgAAAQk"]
[Wed Apr 22 05:11:54.060906 2026] [:error] [pid 21681:tid 21697] [client 51.77.216.36:41056] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoGt5LmJziq-yZYawirwAAAAc"]
[Wed Apr 22 05:11:54.081263 2026] [:error] [pid 21681:tid 21702] [client 51.77.216.36:56678] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoGt5LmJziq-yZYawisAAAAAw"]
[Wed Apr 22 05:11:54.246024 2026] [:error] [pid 21681:tid 21692] [client 51.77.216.36:42652] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoGt5LmJziq-yZYawisQAAAAI"]
[Wed Apr 22 05:11:55.088042 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:57564] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoG0TXx_lUa7xwAb6qlQAAARI"]
[Wed Apr 22 05:11:56.207197 2026] [:error] [pid 21788:tid 21800] [client 51.77.216.36:42494] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoHH7OM27rzVpef25n8gAAAMo"]
[Wed Apr 22 05:11:56.757392 2026] [:error] [pid 21788:tid 21812] [client 51.77.216.36:56688] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoHH7OM27rzVpef25n9QAAANY"]
[Wed Apr 22 05:11:57.474960 2026] [:error] [pid 21682:tid 21745] [client 51.77.216.36:39462] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoHZlXWQZUlmPHS3rmrgAAAFY"]
[Wed Apr 22 05:11:59.061476 2026] [:error] [pid 21682:tid 21723] [client 51.77.216.36:57574] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoH5lXWQZUlmPHS3rmuQAAAEA"]
[Wed Apr 22 05:11:59.268721 2026] [:error] [pid 21788:tid 21790] [client 51.77.216.36:56696] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoH37OM27rzVpef25oAAAAAMA"]
[Wed Apr 22 05:11:59.564251 2026] [:error] [pid 21788:tid 21803] [client 51.77.216.36:42496] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoH37OM27rzVpef25oAgAAAM0"]
[Wed Apr 22 05:12:00.002537 2026] [:error] [pid 21683:tid 21758] [client 51.77.216.36:32924] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoIFZBWT-0diZyYyZ0ywAAAIg"]
[Wed Apr 22 05:12:01.654089 2026] [:error] [pid 21683:tid 21774] [client 51.77.216.36:40446] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoIVZBWT-0diZyYyZ00QAAAJg"]
[Wed Apr 22 05:12:02.271115 2026] [:error] [pid 21681:tid 21690] [client 51.77.216.36:37682] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoIt5LmJziq-yZYawiuAAAAAA"]
[Wed Apr 22 05:12:02.380804 2026] [:error] [pid 21788:tid 21796] [client 51.77.216.36:35034] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoIn7OM27rzVpef25oDgAAAMY"]
[Wed Apr 22 05:12:02.610357 2026] [:error] [pid 21788:tid 21811] [client 51.77.216.36:44544] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoIn7OM27rzVpef25oEQAAANU"]
[Wed Apr 22 05:12:02.763887 2026] [:error] [pid 21788:tid 21792] [client 51.77.216.36:42956] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoIn7OM27rzVpef25oEwAAAMI"]
[Wed Apr 22 05:12:03.828632 2026] [:error] [pid 21788:tid 21806] [client 51.77.216.36:56330] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoI37OM27rzVpef25oGwAAANA"]
[Wed Apr 22 05:12:03.840156 2026] [:error] [pid 21788:tid 21809] [client 51.77.216.36:40456] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoI37OM27rzVpef25oHAAAANM"]
[Wed Apr 22 05:12:04.592036 2026] [:error] [pid 21788:tid 21804] [client 51.77.216.36:35040] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoJH7OM27rzVpef25oIQAAAM4"]
[Wed Apr 22 05:12:05.246113 2026] [:error] [pid 21682:tid 21746] [client 51.77.216.36:51390] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoJZlXWQZUlmPHS3rmxgAAAFc"]
[Wed Apr 22 05:12:05.428055 2026] [:error] [pid 21682:tid 21726] [client 51.77.216.36:46208] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoJZlXWQZUlmPHS3rmyAAAAEM"]
[Wed Apr 22 05:12:06.260932 2026] [:error] [pid 21683:tid 21764] [client 51.77.216.36:40472] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoJlZBWT-0diZyYyZ05AAAAI4"]
[Wed Apr 22 05:12:06.324034 2026] [:error] [pid 21683:tid 21760] [client 51.77.216.36:44558] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoJlZBWT-0diZyYyZ05QAAAIo"]
[Wed Apr 22 05:12:06.966047 2026] [:error] [pid 23041:tid 23060] [client 51.77.216.36:35054] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoJkTXx_lUa7xwAb6qpQAAARA"]
[Wed Apr 22 05:12:07.030825 2026] [:error] [pid 21683:tid 21756] [client 51.77.216.36:56344] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoJ1ZBWT-0diZyYyZ07AAAAIY"]
[Wed Apr 22 05:12:07.592927 2026] [:error] [pid 21683:tid 21771] [client 51.77.216.36:51398] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoJ1ZBWT-0diZyYyZ08AAAAJU"]
[Wed Apr 22 05:12:08.338342 2026] [:error] [pid 21788:tid 21798] [client 51.77.216.36:46218] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoKH7OM27rzVpef25oLgAAAMg"]
[Wed Apr 22 05:12:12.894071 2026] [:error] [pid 21788:tid 21794] [client 51.77.216.36:58144] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aefoLH7OM27rzVpef25oXQAAAMQ"]
[Wed Apr 22 05:12:13.091161 2026] [:error] [pid 21681:tid 21698] [client 51.77.216.36:48764] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoLd5LmJziq-yZYawiwwAAAAg"]
[Wed Apr 22 05:12:13.341044 2026] [:error] [pid 21788:tid 21810] [client 51.77.216.36:44054] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoLX7OM27rzVpef25oYgAAANQ"]
[Wed Apr 22 05:12:13.966188 2026] [:error] [pid 21682:tid 21744] [client 51.77.216.36:60288] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoLZlXWQZUlmPHS3rm4gAAAFU"]
[Wed Apr 22 05:12:14.212971 2026] [:error] [pid 21682:tid 21732] [client 51.77.216.36:54056] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoLplXWQZUlmPHS3rm5AAAAEk"]
[Wed Apr 22 05:12:15.193883 2026] [:error] [pid 21682:tid 21725] [client 51.77.216.36:40868] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoL5lXWQZUlmPHS3rm5gAAAEI"]
[Wed Apr 22 05:12:15.550562 2026] [:error] [pid 21682:tid 21738] [client 51.77.216.36:58150] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aefoL5lXWQZUlmPHS3rm6AAAAE8"]
[Wed Apr 22 05:12:15.792547 2026] [:error] [pid 21681:tid 21710] [client 51.77.216.36:38754] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoL95LmJziq-yZYawixgAAABQ"]
[Wed Apr 22 05:12:16.595699 2026] [:error] [pid 21681:tid 21708] [client 51.77.216.36:60298] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoMN5LmJziq-yZYawixwAAABI"]
[Wed Apr 22 05:12:17.135389 2026] [:error] [pid 21681:tid 21703] [client 51.77.216.36:54070] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoMd5LmJziq-yZYawiyAAAAA0"]
[Wed Apr 22 05:12:17.172568 2026] [:error] [pid 21681:tid 21694] [client 51.77.216.36:54934] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoMd5LmJziq-yZYawiyQAAAAQ"]
[Wed Apr 22 05:12:17.443578 2026] [:error] [pid 23041:tid 23051] [client 51.77.216.36:40880] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoMUTXx_lUa7xwAb6qtQAAAQc"]
[Wed Apr 22 05:12:18.126106 2026] [:error] [pid 21681:tid 21704] [client 51.77.216.36:38768] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoMt5LmJziq-yZYawizQAAAA4"]
[Wed Apr 22 05:12:18.294252 2026] [:error] [pid 21683:tid 21753] [client 51.77.216.36:58164] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aefoMlZBWT-0diZyYyZ1FgAAAIM"]
[Wed Apr 22 05:12:19.539453 2026] [:error] [pid 23041:tid 23049] [client 51.77.216.36:60306] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoM0TXx_lUa7xwAb6quAAAAQU"]
[Wed Apr 22 05:12:19.677675 2026] [:error] [pid 23041:tid 23048] [client 51.77.216.36:54074] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoM0TXx_lUa7xwAb6quQAAAQQ"]
[Wed Apr 22 05:12:19.853792 2026] [:error] [pid 23041:tid 23062] [client 51.77.216.36:54936] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoM0TXx_lUa7xwAb6qvgAAARI"]
[Wed Apr 22 05:12:20.367933 2026] [:error] [pid 23041:tid 23068] [client 51.77.216.36:34802] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoNETXx_lUa7xwAb6qwgAAARg"]
[Wed Apr 22 05:12:20.993815 2026] [:error] [pid 23041:tid 23055] [client 51.77.216.36:56456] [client 51.77.216.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aefoNETXx_lUa7xwAb6qxgAAAQs"]
[Wed Apr 22 06:32:37.447074 2026] [:error] [pid 21682:tid 21738] [client 121.229.185.160:36388] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aef7BZlXWQZUlmPHS3r9FAAAAE8"]
[Wed Apr 22 06:33:42.384156 2026] [:error] [pid 21682:tid 21736] [client 51.83.7.81:48762] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aef7RplXWQZUlmPHS3r9WAAAAE0"]
[Wed Apr 22 06:33:46.247173 2026] [:error] [pid 23041:tid 23052] [client 51.83.7.81:48766] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aef7SkTXx_lUa7xwAb7RngAAAQg"]
[Wed Apr 22 06:33:51.767551 2026] [:error] [pid 31755:tid 31772] [client 51.83.7.81:37790] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aef7Twz2mYMkg3X8q1tZ0gAAAgk"]
[Wed Apr 22 06:33:56.057611 2026] [:error] [pid 23041:tid 23067] [client 51.83.7.81:41200] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aef7VETXx_lUa7xwAb7RtwAAARc"]
[Wed Apr 22 08:20:12.988635 2026] [:error] [pid 23041:tid 23066] [client 195.201.199.99:54830] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aegUPETXx_lUa7xwAb4NrwAAARY"]
[Wed Apr 22 08:20:17.011392 2026] [:error] [pid 31756:tid 31815] [client 195.201.199.99:54088] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aegUQd_WbkXbHaEfhd3rhAAAAlc"]
[Wed Apr 22 08:20:21.193685 2026] [:error] [pid 23041:tid 23055] [client 195.201.199.99:56780] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aegURUTXx_lUa7xwAb4NvQAAAQs"]
[Wed Apr 22 08:20:25.099636 2026] [:error] [pid 21683:tid 21751] [client 195.201.199.99:59416] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aegUSVZBWT-0diZyYyalqAAAAIE"]
[Wed Apr 22 08:20:29.472015 2026] [:error] [pid 31756:tid 31791] [client 195.201.199.99:33930] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aegUTd_WbkXbHaEfhd3rjQAAAkE"]
[Wed Apr 22 08:20:35.314195 2026] [:error] [pid 31756:tid 31809] [client 195.201.199.99:37456] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aegUU9_WbkXbHaEfhd3rkwAAAlE"]
[Wed Apr 22 08:20:39.699897 2026] [:error] [pid 31706:tid 31733] [client 195.201.199.99:39710] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aegUV7GSe9Rnd4Q_z1ikdAAAAdg"]
[Wed Apr 22 08:20:43.571077 2026] [:error] [pid 31755:tid 31786] [client 195.201.199.99:41760] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aegUWwz2mYMkg3X8q1uOFAAAAhc"]
[Wed Apr 22 08:20:48.322831 2026] [:error] [pid 23041:tid 23044] [client 195.201.199.99:44486] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aegUYETXx_lUa7xwAb4N7gAAAQA"]
[Wed Apr 22 08:20:53.125238 2026] [:error] [pid 21683:tid 21752] [client 195.201.199.99:47474] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aegUZVZBWT-0diZyYyaluAAAAII"]
[Wed Apr 22 08:20:58.127323 2026] [:error] [pid 31755:tid 31781] [client 195.201.199.99:50656] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aegUagz2mYMkg3X8q1uOHwAAAhI"]
[Wed Apr 22 08:21:01.885956 2026] [:error] [pid 21682:tid 21739] [client 195.201.199.99:53348] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aegUbZlXWQZUlmPHS3odqwAAAFA"]
[Wed Apr 22 08:21:06.895043 2026] [:error] [pid 31755:tid 31780] [client 195.201.199.99:56786] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aegUcgz2mYMkg3X8q1uOLgAAAhE"]
[Wed Apr 22 08:21:59.246906 2026] [:error] [pid 31844:tid 31865] [client 195.201.199.99:56014] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aegUp2tAU9CprTB4b3I21gAAApM"]
[Wed Apr 22 08:22:04.140137 2026] [:error] [pid 31756:tid 31809] [client 195.201.199.99:36382] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aegUrN_WbkXbHaEfhd3r1QAAAlE"]
[Wed Apr 22 08:22:08.765615 2026] [:error] [pid 31755:tid 31774] [client 195.201.199.99:39246] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aegUsAz2mYMkg3X8q1uOdQAAAgs"]
[Wed Apr 22 08:22:12.758719 2026] [:error] [pid 31706:tid 31733] [client 195.201.199.99:39314] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aegUtLGSe9Rnd4Q_z1ikkQAAAdg"]
[Wed Apr 22 08:22:17.289376 2026] [:error] [pid 31755:tid 31772] [client 195.201.199.99:44396] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aegUuQz2mYMkg3X8q1uOoQAAAgk"]
[Wed Apr 22 08:22:22.598010 2026] [:error] [pid 31755:tid 31769] [client 195.201.199.99:47518] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aegUvgz2mYMkg3X8q1uOpgAAAgY"]
[Wed Apr 22 08:22:26.796067 2026] [:error] [pid 31755:tid 31774] [client 195.201.199.99:49966] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aegUwgz2mYMkg3X8q1uOsAAAAgs"]
[Wed Apr 22 08:22:31.259906 2026] [:error] [pid 32053:tid 32078] [client 195.201.199.99:52666] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aegUxwzPjXx_ocfbYhs9SAAAA1c"]
[Wed Apr 22 08:22:37.354009 2026] [:error] [pid 23041:tid 23045] [client 195.201.199.99:53678] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aegUzUTXx_lUa7xwAb4OzAAAAQE"]
[Wed Apr 22 08:22:40.413016 2026] [:error] [pid 31706:tid 31718] [client 195.201.199.99:57904] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aegU0LGSe9Rnd4Q_z1iklgAAAck"]
[Wed Apr 22 08:22:46.811708 2026] [:error] [pid 23041:tid 23061] [client 195.201.199.99:59046] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aegU1kTXx_lUa7xwAb4O0QAAARE"]
[Wed Apr 22 08:22:52.225645 2026] [:error] [pid 31949:tid 31963] [client 195.201.199.99:36740] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aegU3H2WtGZh5JfbMUdI5QAAAws"]
[Wed Apr 22 08:23:46.766572 2026] [:error] [pid 23041:tid 23045] [client 195.201.199.99:40558] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aegVEkTXx_lUa7xwAb4POAAAAQE"]
[Wed Apr 22 08:23:51.707917 2026] [:error] [pid 31755:tid 31775] [client 195.201.199.99:46066] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aegVFwz2mYMkg3X8q1uPQwAAAgw"]
[Wed Apr 22 08:23:55.202213 2026] [:error] [pid 23041:tid 23044] [client 195.201.199.99:48226] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aegVG0TXx_lUa7xwAb4PvAAAAQA"]
[Wed Apr 22 08:23:59.905412 2026] [:error] [pid 31949:tid 31958] [client 195.201.199.99:51084] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aegVH32WtGZh5JfbMUdI_QAAAwY"]
[Wed Apr 22 08:24:02.790195 2026] [:error] [pid 31706:tid 31723] [client 195.201.199.99:52874] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aegVIrGSe9Rnd4Q_z1ikpwAAAc4"]
[Wed Apr 22 08:24:06.660011 2026] [:error] [pid 31755:tid 31785] [client 195.201.199.99:55034] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aegVJgz2mYMkg3X8q1uPVQAAAhY"]
[Wed Apr 22 08:24:10.027146 2026] [:error] [pid 31756:tid 31814] [client 195.201.199.99:57100] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aegVKt_WbkXbHaEfhd3sDAAAAlY"]
[Wed Apr 22 08:24:14.010404 2026] [:error] [pid 32095:tid 32110] [client 195.201.199.99:59914] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aegVLtfu5Cv628YPe59-fAAAA4w"]
[Wed Apr 22 08:24:18.533277 2026] [:error] [pid 21683:tid 21759] [client 195.201.199.99:34212] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aegVMlZBWT-0diZyYyamEwAAAIk"]
[Wed Apr 22 08:24:22.861157 2026] [:error] [pid 31755:tid 31786] [client 195.201.199.99:36856] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aegVNgz2mYMkg3X8q1uPZAAAAhc"]
[Wed Apr 22 08:24:26.907149 2026] [:error] [pid 31949:tid 31968] [client 195.201.199.99:39352] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aegVOn2WtGZh5JfbMUdJBAAAAxA"]
[Wed Apr 22 08:24:31.447472 2026] [:error] [pid 31755:tid 31765] [client 195.201.199.99:42046] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegVPwz2mYMkg3X8q1uPfgAAAgI"]
[Wed Apr 22 08:24:37.055733 2026] [:error] [pid 31755:tid 31766] [client 195.201.199.99:45424] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegVRQz2mYMkg3X8q1uPkgAAAgM"]
[Wed Apr 22 09:44:56.708990 2026] [:error] [pid 31755:tid 31771] [client 43.155.162.41:40436] [client 43.155.162.41] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aegoGAz2mYMkg3X8q1u8rQAAAgg"]
[Wed Apr 22 09:46:11.396007 2026] [proxy_fcgi:error] [pid 31755:tid 31787] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:11.690098 2026] [proxy_fcgi:error] [pid 31755:tid 31770] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:11.963019 2026] [proxy_fcgi:error] [pid 31755:tid 31768] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:12.275088 2026] [proxy_fcgi:error] [pid 31755:tid 31769] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:12.553370 2026] [proxy_fcgi:error] [pid 31755:tid 31787] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:12.831772 2026] [proxy_fcgi:error] [pid 31755:tid 31777] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:13.104142 2026] [proxy_fcgi:error] [pid 31755:tid 31773] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:13.380026 2026] [proxy_fcgi:error] [pid 31755:tid 31784] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:13.974078 2026] [proxy_fcgi:error] [pid 31755:tid 31771] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:14.257631 2026] [proxy_fcgi:error] [pid 31755:tid 31785] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:14.611393 2026] [proxy_fcgi:error] [pid 31755:tid 31769] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:14.882909 2026] [proxy_fcgi:error] [pid 31755:tid 31774] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:15.155040 2026] [proxy_fcgi:error] [pid 31755:tid 31775] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:15.428035 2026] [proxy_fcgi:error] [pid 31755:tid 31767] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:15.699377 2026] [proxy_fcgi:error] [pid 31755:tid 31779] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:15.978547 2026] [proxy_fcgi:error] [pid 31755:tid 31763] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:16.252562 2026] [proxy_fcgi:error] [pid 31755:tid 31777] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:16.525987 2026] [proxy_fcgi:error] [pid 31755:tid 31786] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:18.834322 2026] [proxy_fcgi:error] [pid 31755:tid 31785] [client 185.192.71.240:22779] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 09:46:20.722006 2026] [:error] [pid 31755:tid 31784] [client 185.192.71.240:22779] [client 185.192.71.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aegobAz2mYMkg3X8q1u-MwAAAhU"]
[Wed Apr 22 10:18:57.047299 2026] [:error] [pid 31706:tid 31709] [client 51.77.43.178:48598] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aegwEbGSe9Rnd4Q_z1is1wAAAcA"]
[Wed Apr 22 10:18:57.870099 2026] [:error] [pid 23041:tid 23056] [client 51.77.43.178:34900] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aegwEUTXx_lUa7xwAb5C-QAAAQw"]
[Wed Apr 22 10:18:59.110700 2026] [:error] [pid 23041:tid 23045] [client 51.77.43.178:52896] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwE0TXx_lUa7xwAb5C_wAAAQE"]
[Wed Apr 22 10:19:00.956176 2026] [:error] [pid 31755:tid 31773] [client 51.77.43.178:52908] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aegwFAz2mYMkg3X8q1vR8gAAAgo"]
[Wed Apr 22 10:19:01.236712 2026] [:error] [pid 23041:tid 23051] [client 51.77.43.178:34916] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aegwFUTXx_lUa7xwAb5DAwAAAQc"]
[Wed Apr 22 10:19:04.005288 2026] [:error] [pid 31949:tid 31973] [client 51.77.43.178:34924] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwGH2WtGZh5JfbMUdbzwAAAxU"]
[Wed Apr 22 10:19:04.928325 2026] [:error] [pid 23041:tid 23057] [client 51.77.43.178:52920] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwGETXx_lUa7xwAb5DDAAAAQ0"]
[Wed Apr 22 10:19:05.778760 2026] [:error] [pid 31755:tid 31764] [client 51.77.43.178:52926] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aegwGQz2mYMkg3X8q1vR_wAAAgE"]
[Wed Apr 22 10:19:06.940723 2026] [:error] [pid 23041:tid 23067] [client 51.77.43.178:34928] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwGkTXx_lUa7xwAb5DEAAAARc"]
[Wed Apr 22 10:19:08.073385 2026] [:error] [pid 31844:tid 31847] [client 51.77.43.178:49948] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwHGtAU9CprTB4b3JAxgAAAoE"]
[Wed Apr 22 10:19:08.696130 2026] [:error] [pid 23041:tid 23068] [client 51.77.43.178:49954] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "aegwHETXx_lUa7xwAb5DFQAAARg"]
[Wed Apr 22 10:19:11.489675 2026] [:error] [pid 31756:tid 31804] [client 51.77.43.178:49956] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "aegwH9_WbkXbHaEfhd0I4QAAAkw"]
[Wed Apr 22 10:19:13.249061 2026] [:error] [pid 31756:tid 31790] [client 51.77.43.178:49962] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwId_WbkXbHaEfhd0I5gAAAkA"]
[Wed Apr 22 10:19:14.392690 2026] [:error] [pid 31755:tid 31786] [client 51.77.43.178:49966] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwIgz2mYMkg3X8q1vSEAAAAhc"]
[Wed Apr 22 10:19:20.072767 2026] [:error] [pid 31755:tid 31770] [client 51.77.43.178:42348] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegwKAz2mYMkg3X8q1vSJgAAAgc"]
[Wed Apr 22 10:23:40.936990 2026] [:error] [pid 31844:tid 31870] [client 51.77.43.178:41536] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxLGtAU9CprTB4b3JBHQAAApc"]
[Wed Apr 22 10:23:47.492103 2026] [:error] [pid 23041:tid 23067] [client 51.77.43.178:37856] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxM0TXx_lUa7xwAb5E5AAAARc"]
[Wed Apr 22 10:23:53.164575 2026] [:error] [pid 31755:tid 31787] [client 51.77.43.178:44218] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxOQz2mYMkg3X8q1vUxAAAAhg"]
[Wed Apr 22 10:23:58.530847 2026] [:error] [pid 31755:tid 31778] [client 51.77.43.178:60102] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxPgz2mYMkg3X8q1vU-AAAAg8"]
[Wed Apr 22 10:24:08.829982 2026] [:error] [pid 23041:tid 23050] [client 51.77.43.178:56594] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxSETXx_lUa7xwAb5FAgAAAQY"]
[Wed Apr 22 10:24:13.548262 2026] [:error] [pid 31755:tid 31765] [client 51.77.43.178:56596] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aegxTQz2mYMkg3X8q1vVPgAAAgI"]
[Wed Apr 22 11:31:50.479341 2026] [proxy_fcgi:error] [pid 31756:tid 31798] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.499549 2026] [proxy_fcgi:error] [pid 31756:tid 31797] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.518593 2026] [proxy_fcgi:error] [pid 31756:tid 31813] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.542130 2026] [proxy_fcgi:error] [pid 31756:tid 31816] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.562970 2026] [proxy_fcgi:error] [pid 31756:tid 31810] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.583020 2026] [proxy_fcgi:error] [pid 31756:tid 31812] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.602808 2026] [proxy_fcgi:error] [pid 31756:tid 31790] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.645745 2026] [proxy_fcgi:error] [pid 31756:tid 31793] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.664347 2026] [proxy_fcgi:error] [pid 31756:tid 31796] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.706953 2026] [proxy_fcgi:error] [pid 31756:tid 31815] [client 20.211.98.221:23289] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 11:31:50.723457 2026] [:error] [pid 31756:tid 31803] [client 20.211.98.221:23289] [client 20.211.98.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aehBJt_WbkXbHaEfhd0W-wAAAks"]
[Wed Apr 22 11:31:50.790023 2026] [:error] [pid 31949:tid 31960] [client 20.211.98.221:18307] [client 20.211.98.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aehBJn2WtGZh5JfbMUdkpwAAAwg"]
[Wed Apr 22 11:31:50.852847 2026] [:error] [pid 31756:tid 31802] [client 20.211.98.221:23766] [client 20.211.98.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aehBJt_WbkXbHaEfhd0W_QAAAko"]
[Wed Apr 22 11:31:50.915300 2026] [:error] [pid 31949:tid 31961] [client 20.211.98.221:18366] [client 20.211.98.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "aehBJn2WtGZh5JfbMUdkqAAAAwk"]
[Wed Apr 22 12:55:35.406581 2026] [:error] [pid 21682:tid 21744] [client 121.229.185.160:55694] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aehUx5lXWQZUlmPHS3pqkwAAAFU"]
[Wed Apr 22 14:33:04.171452 2026] [proxy_fcgi:error] [pid 6252:tid 6320] [client 66.249.79.6:65092] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 14:53:34.686773 2026] [:error] [pid 9085:tid 9090] [client 54.37.86.223:49480] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aehwbt-_-or9vQnlWnqNuwAAAUM"]
[Wed Apr 22 14:53:36.816455 2026] [:error] [pid 9085:tid 9091] [client 54.37.86.223:45188] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aehwcN-_-or9vQnlWnqNvwAAAUQ"]
[Wed Apr 22 14:53:39.519541 2026] [:error] [pid 6344:tid 6364] [client 54.37.86.223:49490] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aehwc0DOTF-pkQnDeUmAogAAAA8"]
[Wed Apr 22 14:53:41.811355 2026] [:error] [pid 6250:tid 6264] [client 54.37.86.223:59772] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aehwdQ-iZeQkqmQVfj60NQAAAEo"]
[Wed Apr 22 14:53:44.576621 2026] [:error] [pid 9085:tid 9098] [client 54.37.86.223:44366] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aehweN-_-or9vQnlWnqNzgAAAUs"]
[Wed Apr 22 14:53:47.237614 2026] [:error] [pid 6344:tid 6357] [client 54.37.86.223:44376] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aehwe0DOTF-pkQnDeUmArQAAAAg"]
[Wed Apr 22 14:53:49.999903 2026] [:error] [pid 9085:tid 9111] [client 54.37.86.223:44384] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aehwfd-_-or9vQnlWnqN3wAAAVg"]
[Wed Apr 22 17:01:15.595056 2026] [:error] [pid 6251:tid 6297] [client 43.167.245.18:47388] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeiOWysFAzbyObL-SQ5PbwAAAIw"]
[Wed Apr 22 17:17:15.861572 2026] [:error] [pid 6344:tid 6366] [client 94.72.131.142:61504] [client 94.72.131.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeiSG0DOTF-pkQnDeUmpDgAAABE"]
[Wed Apr 22 17:17:17.544915 2026] [:error] [pid 6250:tid 6262] [client 94.72.131.142:65023] [client 94.72.131.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeiSHQ-iZeQkqmQVfj7UggAAAEg"]
[Wed Apr 22 17:17:19.497717 2026] [:error] [pid 9085:tid 9111] [client 94.72.131.142:64002] [client 94.72.131.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeiSH9-_-or9vQnlWnrb5QAAAVg"]
[Wed Apr 22 17:17:22.471868 2026] [:error] [pid 6344:tid 6373] [client 94.72.131.142:64622] [client 94.72.131.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeiSIkDOTF-pkQnDeUmpIgAAABg"]
[Wed Apr 22 17:17:26.277440 2026] [:error] [pid 6251:tid 6292] [client 94.72.131.142:63656] [client 94.72.131.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeiSJisFAzbyObL-SQ5SUgAAAIc"]
[Wed Apr 22 18:02:33.737006 2026] [:error] [pid 9085:tid 9099] [client 43.130.154.56:47712] [client 43.130.154.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeicud-_-or9vQnlWnr0YAAAAUw"]
[Wed Apr 22 19:25:57.940780 2026] [:error] [pid 9085:tid 9089] [client 192.227.231.190:60896] [client 192.227.231.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeiwRd-_-or9vQnlWno25AAAAUI"], referer: https://www.bing.com/
[Wed Apr 22 20:33:20.620485 2026] [:error] [pid 6250:tid 6278] [client 51.68.235.38:36890] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aejAEA-iZeQkqmQVfj4JbAAAAFg"]
[Wed Apr 22 20:33:22.573331 2026] [:error] [pid 23776:tid 23786] [client 51.68.235.38:56788] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aejAErRExf-1pAbSeJvnZQAAAYg"]
[Wed Apr 22 20:33:24.571485 2026] [:error] [pid 6344:tid 6353] [client 51.68.235.38:40014] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aejAFEDOTF-pkQnDeUnqZQAAAAQ"]
[Wed Apr 22 21:06:12.581738 2026] [:error] [pid 9085:tid 9111] [client 160.30.179.124:39042] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aejHxN-_-or9vQnlWnp0awAAAVg"]
[Wed Apr 22 22:29:16.596600 2026] [:error] [pid 23776:tid 23787] [client 135.181.213.219:33754] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aejbPLRExf-1pAbSeJsbOgAAAYk"]
[Wed Apr 22 22:29:19.065735 2026] [:error] [pid 6384:tid 6390] [client 135.181.213.219:33766] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aejbPz58M3t15ICeWHV8OwAAAMM"]
[Wed Apr 22 22:29:21.517891 2026] [:error] [pid 9085:tid 9107] [client 135.181.213.219:58590] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aejbQd-_-or9vQnlWnq_bQAAAVQ"]
[Wed Apr 22 22:29:24.113032 2026] [:error] [pid 6252:tid 6333] [client 135.181.213.219:58594] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aejbROtGYuiYb1nWBpRh6wAAARU"]
[Wed Apr 22 22:29:26.425464 2026] [:error] [pid 6384:tid 6391] [client 135.181.213.219:58608] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aejbRj58M3t15ICeWHV8SQAAAMQ"]
[Wed Apr 22 22:29:29.020176 2026] [:error] [pid 9085:tid 9104] [client 135.181.213.219:58612] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aejbSd-_-or9vQnlWnq_fAAAAVE"]
[Wed Apr 22 22:43:16.782966 2026] [:error] [pid 6251:tid 6287] [client 185.213.174.125:4164] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "aejehCsFAzbyObL-SQ6RnwAAAII"]
[Wed Apr 22 22:43:17.407331 2026] [:error] [pid 9085:tid 9095] [client 185.213.174.125:4224] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/api/.env"] [unique_id "aejehd-_-or9vQnlWnrGsQAAAUg"]
[Wed Apr 22 22:43:17.408640 2026] [:error] [pid 6251:tid 6305] [client 185.213.174.125:4238] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/backend/.env"] [unique_id "aejehSsFAzbyObL-SQ6RoAAAAJQ"]
[Wed Apr 22 22:43:17.434075 2026] [:error] [pid 6250:tid 6266] [client 185.213.174.125:4246] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/laravel/.env"] [unique_id "aejehQ-iZeQkqmQVfj4ongAAAEw"]
[Wed Apr 22 22:43:17.435065 2026] [:error] [pid 9085:tid 9089] [client 185.213.174.125:4200] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.production"] [unique_id "aejehd-_-or9vQnlWnrGsgAAAUI"]
[Wed Apr 22 22:43:17.609594 2026] [:error] [pid 6344:tid 6373] [client 185.213.174.125:4180] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.local"] [unique_id "aejehUDOTF-pkQnDeUkSEQAAABg"]
[Wed Apr 22 22:43:17.711848 2026] [:error] [pid 23776:tid 23793] [client 185.213.174.125:4186] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.bak"] [unique_id "aejehbRExf-1pAbSeJsgFwAAAY8"]
[Wed Apr 22 22:43:17.718023 2026] [:error] [pid 6344:tid 6363] [client 185.213.174.125:4212] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env"] [unique_id "aejehUDOTF-pkQnDeUkSEwAAAA4"]
[Wed Apr 22 22:43:17.746196 2026] [:error] [pid 6250:tid 6276] [client 185.213.174.125:4308] [client 185.213.174.125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.backup"] [unique_id "aejehQ-iZeQkqmQVfj4ooQAAAFY"]
[Wed Apr 22 22:53:15.373064 2026] [:error] [pid 6250:tid 6270] [client 45.150.174.91:56420] [client 45.150.174.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.150.174.91, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "aejg2w-iZeQkqmQVfj4qFAAAAFA"]
[Wed Apr 22 22:53:15.389066 2026] [proxy_fcgi:error] [pid 6250:tid 6270] [client 45.150.174.91:56420] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 00:24:06.841572 2026] [:error] [pid 9085:tid 9097] [client 135.181.213.219:43242] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2Jt-_-or9vQnlWnr-cQAAAUo"]
[Thu Apr 23 00:24:11.237554 2026] [:error] [pid 23776:tid 23794] [client 135.181.213.219:43130] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2K7RExf-1pAbSeJtApgAAAZA"]
[Thu Apr 23 00:24:15.276446 2026] [:error] [pid 6384:tid 6400] [client 51.75.128.89:41366] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aej2Lz58M3t15ICeWHWszQAAAM0"]
[Thu Apr 23 00:24:17.616457 2026] [:error] [pid 23776:tid 23792] [client 51.75.128.89:43348] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aej2MbRExf-1pAbSeJtAuQAAAY4"]
[Thu Apr 23 00:24:19.408109 2026] [:error] [pid 6384:tid 6398] [client 135.181.213.219:8508] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2Mz58M3t15ICeWHWs6AAAAMs"]
[Thu Apr 23 00:24:19.898156 2026] [:error] [pid 6344:tid 6360] [client 51.75.128.89:43362] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aej2M0DOTF-pkQnDeUkpBQAAAAs"]
[Thu Apr 23 00:24:21.896104 2026] [:error] [pid 6252:tid 6330] [client 51.75.128.89:43370] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aej2NetGYuiYb1nWBpR0WQAAARI"]
[Thu Apr 23 00:24:23.300613 2026] [:error] [pid 6252:tid 6334] [client 135.181.213.219:10874] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2N-tGYuiYb1nWBpR0WgAAARY"]
[Thu Apr 23 00:24:24.238319 2026] [:error] [pid 6384:tid 6393] [client 51.75.128.89:43376] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aej2OD58M3t15ICeWHWs8AAAAMY"]
[Thu Apr 23 00:24:26.480225 2026] [:error] [pid 9085:tid 9094] [client 51.75.128.89:40012] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aej2Ot-_-or9vQnlWnr-gQAAAUc"]
[Thu Apr 23 00:24:28.507682 2026] [:error] [pid 6384:tid 6388] [client 51.75.128.89:40028] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aej2PD58M3t15ICeWHWs_wAAAME"]
[Thu Apr 23 00:24:31.058689 2026] [:error] [pid 23776:tid 23792] [client 51.75.128.89:40034] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aej2P7RExf-1pAbSeJtAzQAAAY4"]
[Thu Apr 23 00:24:33.659625 2026] [:error] [pid 6384:tid 6405] [client 51.75.128.89:40036] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aej2QT58M3t15ICeWHWtDQAAANI"]
[Thu Apr 23 00:24:35.719600 2026] [:error] [pid 9085:tid 9104] [client 51.75.128.89:40044] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aej2Q9-_-or9vQnlWnr-twAAAVE"]
[Thu Apr 23 00:24:37.727545 2026] [:error] [pid 23776:tid 23794] [client 51.75.128.89:47374] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aej2RbRExf-1pAbSeJtA3QAAAZA"]
[Thu Apr 23 00:24:39.851310 2026] [:error] [pid 9085:tid 9111] [client 51.75.128.89:47390] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aej2R9-_-or9vQnlWnr-zwAAAVg"]
[Thu Apr 23 00:24:41.901488 2026] [:error] [pid 9085:tid 9107] [client 51.75.128.89:47406] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aej2Sd-_-or9vQnlWnr-4wAAAVQ"]
[Thu Apr 23 00:24:44.387916 2026] [:error] [pid 6384:tid 6408] [client 51.75.128.89:47422] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aej2TD58M3t15ICeWHWtKgAAANU"]
[Thu Apr 23 00:24:46.487867 2026] [:error] [pid 9085:tid 9103] [client 51.75.128.89:50478] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aej2Tt-_-or9vQnlWnr_AgAAAVA"]
[Thu Apr 23 00:24:48.447329 2026] [:error] [pid 9085:tid 9109] [client 51.75.128.89:50484] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aej2UN-_-or9vQnlWnr_EQAAAVY"]
[Thu Apr 23 00:24:50.538752 2026] [:error] [pid 23776:tid 23788] [client 51.75.128.89:50486] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "aej2UrRExf-1pAbSeJtA_QAAAYo"]
[Thu Apr 23 00:24:52.725172 2026] [:error] [pid 23776:tid 23799] [client 51.75.128.89:50492] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "aej2VLRExf-1pAbSeJtBAQAAAZU"]
[Thu Apr 23 00:24:54.861665 2026] [:error] [pid 9085:tid 9109] [client 51.75.128.89:50500] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aej2Vt-_-or9vQnlWnr_PAAAAVY"]
[Thu Apr 23 00:24:56.779031 2026] [:error] [pid 6344:tid 6350] [client 51.75.128.89:38166] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aej2WEDOTF-pkQnDeUkpJQAAAAE"]
[Thu Apr 23 00:24:58.582982 2026] [:error] [pid 6252:tid 6329] [client 51.75.128.89:38178] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aej2WutGYuiYb1nWBpR0bgAAARE"]
[Thu Apr 23 00:25:01.199777 2026] [:error] [pid 6384:tid 6405] [client 51.75.128.89:54312] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2XT58M3t15ICeWHWtVgAAANI"]
[Thu Apr 23 00:25:05.606032 2026] [:error] [pid 6344:tid 6365] [client 51.75.128.89:54322] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2YUDOTF-pkQnDeUkpMAAAABA"]
[Thu Apr 23 00:25:08.721007 2026] [:error] [pid 6250:tid 6275] [client 51.75.128.89:33974] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aej2ZA-iZeQkqmQVfj47OgAAAFU"]
[Thu Apr 23 00:25:10.722925 2026] [:error] [pid 6344:tid 6356] [client 51.75.128.89:33980] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aej2ZkDOTF-pkQnDeUkpTAAAAAc"]
[Thu Apr 23 00:25:34.753388 2026] [:error] [pid 9085:tid 9096] [client 51.75.128.89:33990] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aej2ft-_-or9vQnlWnoAbgAAAUk"]
[Thu Apr 23 00:25:37.074186 2026] [:error] [pid 6250:tid 6270] [client 51.75.128.89:41684] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aej2gQ-iZeQkqmQVfj47jgAAAFA"]
[Thu Apr 23 00:25:39.238752 2026] [:error] [pid 6252:tid 6328] [client 51.75.128.89:41700] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aej2g-tGYuiYb1nWBpR0wAAAARA"]
[Thu Apr 23 00:25:41.368971 2026] [:error] [pid 6384:tid 6400] [client 51.75.128.89:41716] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aej2hT58M3t15ICeWHWuQwAAAM0"]
[Thu Apr 23 00:25:43.612072 2026] [:error] [pid 9085:tid 9110] [client 51.75.128.89:41724] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aej2h9-_-or9vQnlWnoAoAAAAVc"]
[Thu Apr 23 00:25:46.381584 2026] [:error] [pid 9085:tid 9102] [client 51.75.128.89:53676] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aej2it-_-or9vQnlWnoAvwAAAU8"]
[Thu Apr 23 00:25:49.067490 2026] [:error] [pid 6384:tid 6406] [client 51.75.128.89:53686] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aej2jT58M3t15ICeWHWugQAAANM"]
[Thu Apr 23 00:25:51.117856 2026] [:error] [pid 23776:tid 23788] [client 51.75.128.89:53692] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aej2j7RExf-1pAbSeJtCAAAAAYo"]
[Thu Apr 23 00:25:53.348456 2026] [:error] [pid 6251:tid 6305] [client 51.75.128.89:53696] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aej2kSsFAzbyObL-SQ6gAgAAAJQ"]
[Thu Apr 23 00:25:55.268117 2026] [:error] [pid 23776:tid 23798] [client 51.75.128.89:53702] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aej2k7RExf-1pAbSeJtCCAAAAZQ"]
[Thu Apr 23 00:25:57.395258 2026] [:error] [pid 6252:tid 6317] [client 51.75.128.89:46942] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aej2letGYuiYb1nWBpR08gAAAQU"]
[Thu Apr 23 00:25:59.406561 2026] [:error] [pid 9085:tid 9098] [client 51.75.128.89:46946] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aej2l9-_-or9vQnlWnoA-gAAAUs"]
[Thu Apr 23 00:26:01.428245 2026] [:error] [pid 23776:tid 23793] [client 51.75.128.89:46958] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aej2mbRExf-1pAbSeJtCEgAAAY8"]
[Thu Apr 23 00:26:03.370780 2026] [:error] [pid 9085:tid 9106] [client 51.75.128.89:46966] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aej2m9-_-or9vQnlWnoBBgAAAVM"]
[Thu Apr 23 00:26:05.457572 2026] [:error] [pid 6344:tid 6370] [client 51.75.128.89:46970] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aej2nUDOTF-pkQnDeUkp5QAAABU"]
[Thu Apr 23 00:26:07.407622 2026] [:error] [pid 6344:tid 6357] [client 51.75.128.89:34654] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aej2n0DOTF-pkQnDeUkp7wAAAAg"]
[Thu Apr 23 00:26:09.518334 2026] [:error] [pid 6384:tid 6407] [client 51.75.128.89:34662] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aej2oT58M3t15ICeWHWu2AAAANQ"]
[Thu Apr 23 00:26:11.642321 2026] [:error] [pid 6344:tid 6364] [client 51.75.128.89:34678] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aej2o0DOTF-pkQnDeUkp8wAAAA8"]
[Thu Apr 23 00:26:14.536852 2026] [:error] [pid 6250:tid 6269] [client 51.75.128.89:34692] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2pg-iZeQkqmQVfj476AAAAE8"]
[Thu Apr 23 00:26:18.350215 2026] [:error] [pid 6344:tid 6354] [client 51.75.128.89:54156] [client 51.75.128.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aej2qkDOTF-pkQnDeUkqCQAAAAU"]
[Thu Apr 23 01:00:23.461471 2026] [:error] [pid 9085:tid 9092] [client 185.198.240.146:57439] [client 185.198.240.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aej-p9-_-or9vQnlWnoVeQAAAUU"]
[Thu Apr 23 01:02:20.766743 2026] [:error] [pid 6344:tid 6363] [client 43.130.57.76:58508] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aej_HEDOTF-pkQnDeUkz6wAAAA4"]
[Thu Apr 23 01:45:39.518920 2026] [:error] [pid 6344:tid 6358] [client 147.135.213.38:43076] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aekJQ0DOTF-pkQnDeUk9tQAAAAk"]
[Thu Apr 23 01:45:41.378134 2026] [:error] [pid 9085:tid 9088] [client 147.135.213.38:43150] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aekJRd-_-or9vQnlWnou1wAAAUE"]
[Thu Apr 23 01:45:43.275773 2026] [:error] [pid 6252:tid 6331] [client 147.135.213.38:48230] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aekJR-tGYuiYb1nWBpSCkwAAARM"]
[Thu Apr 23 01:45:45.817711 2026] [:error] [pid 6251:tid 6291] [client 147.135.213.38:43158] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aekJSSsFAzbyObL-SQ6qvwAAAIY"]
[Thu Apr 23 01:45:47.935807 2026] [:error] [pid 9085:tid 9108] [client 147.135.213.38:47366] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aekJS9-_-or9vQnlWnou3wAAAVU"]
[Thu Apr 23 01:45:50.368938 2026] [:error] [pid 9085:tid 9104] [client 147.135.213.38:55668] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aekJTt-_-or9vQnlWnou7gAAAVE"]
[Thu Apr 23 01:45:53.080066 2026] [:error] [pid 6252:tid 6319] [client 147.135.213.38:47368] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekJUetGYuiYb1nWBpSCngAAAQc"]
[Thu Apr 23 01:45:56.736034 2026] [:error] [pid 6384:tid 6404] [client 147.135.213.38:47382] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekJVD58M3t15ICeWHXPSwAAANE"]
[Thu Apr 23 02:30:45.907767 2026] [:error] [pid 6250:tid 6255] [client 117.33.163.216:53504] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aekT1Q-iZeQkqmQVfj5S4AAAAEE"]
[Thu Apr 23 02:36:57.676786 2026] [:error] [pid 6384:tid 6403] [client 185.42.222.58:8418] [client 185.42.222.58] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aekVST58M3t15ICeWHXnVAAAANA"]
[Thu Apr 23 02:57:29.650036 2026] [:error] [pid 9085:tid 9092] [client 67.144.16.170:42873] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aekaGd-_-or9vQnlWnpYyQAAAUU"]
[Thu Apr 23 02:57:30.531631 2026] [:error] [pid 6250:tid 6274] [client 67.144.16.170:43146] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aekaGg-iZeQkqmQVfj5WDAAAAFQ"]
[Thu Apr 23 02:57:31.420557 2026] [:error] [pid 6250:tid 6273] [client 67.144.16.170:43163] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aekaGw-iZeQkqmQVfj5WEAAAAFM"]
[Thu Apr 23 02:57:34.086794 2026] [:error] [pid 9085:tid 9103] [client 67.144.16.170:43194] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aekaHt-_-or9vQnlWnpY0QAAAVA"]
[Thu Apr 23 02:57:34.966716 2026] [:error] [pid 23776:tid 23779] [client 67.144.16.170:43201] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aekaHrRExf-1pAbSeJtzcAAAAYE"]
[Thu Apr 23 02:57:37.439749 2026] [:error] [pid 6344:tid 6351] [client 67.144.16.170:43233] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aekaIUDOTF-pkQnDeUlPsAAAAAI"]
[Thu Apr 23 02:57:38.320472 2026] [:error] [pid 9085:tid 9091] [client 67.144.16.170:43244] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aekaIt-_-or9vQnlWnpY2QAAAUQ"]
[Thu Apr 23 02:57:40.882132 2026] [:error] [pid 6384:tid 6388] [client 67.144.16.170:43274] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aekaJD58M3t15ICeWHXstAAAAME"]
[Thu Apr 23 02:57:41.761081 2026] [:error] [pid 6384:tid 6387] [client 67.144.16.170:43283] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aekaJT58M3t15ICeWHXstQAAAMA"]
[Thu Apr 23 02:57:44.419980 2026] [:error] [pid 23776:tid 23791] [client 67.144.16.170:43329] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aekaKLRExf-1pAbSeJtzlQAAAY0"]
[Thu Apr 23 02:57:45.302902 2026] [:error] [pid 6384:tid 6392] [client 67.144.16.170:43352] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aekaKT58M3t15ICeWHXsuAAAAMU"]
[Thu Apr 23 02:57:47.749656 2026] [:error] [pid 6251:tid 6293] [client 67.144.16.170:43376] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aekaKysFAzbyObL-SQ6zxwAAAIg"]
[Thu Apr 23 02:57:48.634129 2026] [:error] [pid 6384:tid 6397] [client 67.144.16.170:43390] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aekaLD58M3t15ICeWHXswgAAAMo"]
[Thu Apr 23 02:57:51.107895 2026] [:error] [pid 6384:tid 6410] [client 67.144.16.170:43429] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekaLz58M3t15ICeWHXsxgAAANc"]
[Thu Apr 23 02:57:51.545593 2026] [:error] [pid 6384:tid 6399] [client 67.144.16.170:43443] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekaLz58M3t15ICeWHXsyQAAAMw"]
[Thu Apr 23 02:57:55.308295 2026] [:error] [pid 6384:tid 6392] [client 67.144.16.170:43490] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekaMz58M3t15ICeWHXs2QAAAMU"]
[Thu Apr 23 02:57:55.745464 2026] [:error] [pid 6384:tid 6396] [client 67.144.16.170:43503] [client 67.144.16.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aekaMz58M3t15ICeWHXs2gAAAMk"]
[Thu Apr 23 05:59:09.179319 2026] [:error] [pid 25635:tid 25654] [client 155.248.183.67:62307] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aelErcRxv6UsgRGKB3KbFwAAAQ8"]
[Thu Apr 23 05:59:10.645313 2026] [:error] [pid 43083:tid 43093] [client 155.248.183.67:64567] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aelErjC5hrvNXosL83KLjAAAAMg"]
[Thu Apr 23 05:59:12.112035 2026] [:error] [pid 43083:tid 43105] [client 155.248.183.67:53084] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aelEsDC5hrvNXosL83KLkwAAANQ"]
[Thu Apr 23 05:59:12.339537 2026] [:error] [pid 42971:tid 42987] [client 155.248.183.67:62679] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aelEsDEP2_5RswrH8bF7sAAAAAE"]
[Thu Apr 23 07:22:24.755346 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:25.068347 2026] [proxy_fcgi:error] [pid 43083:tid 43108] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:25.376333 2026] [proxy_fcgi:error] [pid 43083:tid 43101] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:25.719340 2026] [proxy_fcgi:error] [pid 43083:tid 43086] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:26.066309 2026] [proxy_fcgi:error] [pid 43083:tid 43088] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:26.425327 2026] [proxy_fcgi:error] [pid 43083:tid 43108] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:26.758327 2026] [proxy_fcgi:error] [pid 43083:tid 43089] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:27.102700 2026] [proxy_fcgi:error] [pid 43083:tid 43104] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:27.782307 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:28.183305 2026] [proxy_fcgi:error] [pid 43083:tid 43104] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:28.544319 2026] [proxy_fcgi:error] [pid 43083:tid 43094] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:28.902320 2026] [proxy_fcgi:error] [pid 43083:tid 43105] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:29.334316 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:29.923310 2026] [proxy_fcgi:error] [pid 43083:tid 43092] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:30.242512 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:30.579932 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:31.223309 2026] [proxy_fcgi:error] [pid 43083:tid 43087] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:31.539202 2026] [proxy_fcgi:error] [pid 43083:tid 43102] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:34.367297 2026] [proxy_fcgi:error] [pid 43083:tid 43087] [client 89.251.0.127:27865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:36.377133 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.127:27865] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelYPDC5hrvNXosL83K_5gAAANU"]
[Thu Apr 23 07:22:38.182624 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.117:33909] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelYPjC5hrvNXosL83K__gAAAM0"]
[Thu Apr 23 07:22:40.073918 2026] [proxy_fcgi:error] [pid 65000:tid 65053] [client 89.251.0.137:20277] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:41.154070 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.137:20277] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "aelYQb6vRb9j6psK2ZaExAAAAhQ"]
[Thu Apr 23 07:22:42.157313 2026] [proxy_fcgi:error] [pid 64998:tid 65008] [client 89.251.0.116:43449] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:42.492634 2026] [proxy_fcgi:error] [pid 64998:tid 65002] [client 89.251.0.116:43449] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:42.804540 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.116:43449] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "aelYQoV5EysYcTLjmwjpdwAAAc0"]
[Thu Apr 23 07:22:44.798316 2026] [proxy_fcgi:error] [pid 64998:tid 65003] [client 89.251.0.124:33635] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:46.371486 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.124:33635] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelYRoV5EysYcTLjmwjptAAAAc0"]
[Thu Apr 23 07:22:47.443734 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.145:59253] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelYR4V5EysYcTLjmwjpwwAAAdM"]
[Thu Apr 23 07:22:48.039483 2026] [:error] [pid 42971:tid 42987] [client 89.251.0.120:48261] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelYSDEP2_5RswrH8bGfFgAAAAE"]
[Thu Apr 23 07:22:49.728797 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.134:65453] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelYSYV5EysYcTLjmwjp2gAAAcA"]
[Thu Apr 23 07:22:50.343116 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.132:59115] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelYSr6vRb9j6psK2ZaFTAAAAgs"]
[Thu Apr 23 07:22:50.942595 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.117:54075] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelYSjEP2_5RswrH8bGfRwAAABA"]
[Thu Apr 23 07:22:51.855622 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.147:36911] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelYS8OAb-3sOknsk4cV3gAAAEQ"]
[Thu Apr 23 07:22:52.569635 2026] [proxy_fcgi:error] [pid 64998:tid 65008] [client 89.251.0.120:42411] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:53.262534 2026] [:error] [pid 64998:tid 65004] [client 89.251.0.120:42411] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "aelYTYV5EysYcTLjmwjqJgAAAcI"]
[Thu Apr 23 07:22:53.872314 2026] [proxy_fcgi:error] [pid 59700:tid 59710] [client 89.251.0.126:46957] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:54.176315 2026] [proxy_fcgi:error] [pid 59700:tid 59703] [client 89.251.0.126:46957] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:54.484779 2026] [:error] [pid 59700:tid 59720] [client 89.251.0.126:46957] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelYTpXyGZJFeAIDWtlQKgAAAVI"]
[Thu Apr 23 07:22:55.482852 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.131:21929] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aelYT5XyGZJFeAIDWtlQQAAAAUI"]
[Thu Apr 23 07:22:56.521134 2026] [proxy_fcgi:error] [pid 25635:tid 25657] [client 89.251.0.150:45915] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:56.819491 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.150:45915] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aelYUMRxv6UsgRGKB3LZjQAAARg"]
[Thu Apr 23 07:22:57.481694 2026] [proxy_fcgi:error] [pid 64967:tid 64970] [client 89.251.0.139:29075] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:58.444626 2026] [proxy_fcgi:error] [pid 64967:tid 64985] [client 89.251.0.139:29075] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:22:59.431773 2026] [:error] [pid 64967:tid 64987] [client 89.251.0.139:29075] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aelYU4AV4GfOOdX8QzoJaAAAAZI"]
[Thu Apr 23 07:23:00.337329 2026] [proxy_fcgi:error] [pid 65000:tid 65043] [client 89.251.0.115:31277] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:00.648379 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.115:31277] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aelYVL6vRb9j6psK2ZaGLgAAAgw"]
[Thu Apr 23 07:23:01.381322 2026] [proxy_fcgi:error] [pid 64967:tid 64984] [client 89.251.0.115:35691] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:02.031548 2026] [:error] [pid 64967:tid 64989] [client 89.251.0.115:35691] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "aelYVYAV4GfOOdX8QzoJhgAAAZQ"]
[Thu Apr 23 07:23:02.706347 2026] [proxy_fcgi:error] [pid 64967:tid 64993] [client 89.251.0.128:51543] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:03.009096 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.128:51543] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "aelYV4AV4GfOOdX8QzoJjAAAAY4"]
[Thu Apr 23 07:23:04.050311 2026] [proxy_fcgi:error] [pid 64967:tid 64986] [client 89.251.0.132:40263] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:04.421848 2026] [:error] [pid 64967:tid 64984] [client 89.251.0.132:40263] [client 89.251.0.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "aelYWIAV4GfOOdX8QzoJlwAAAY8"]
[Thu Apr 23 07:23:05.234520 2026] [proxy_fcgi:error] [pid 65000:tid 65030] [client 89.251.0.146:44313] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:05.886101 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.146:44313] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aelYWb6vRb9j6psK2ZaGqwAAAgc"]
[Thu Apr 23 07:23:06.786192 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.140:29229] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aelYWsOAb-3sOknsk4cWRAAAAE4"]
[Thu Apr 23 07:23:07.717719 2026] [:error] [pid 42972:tid 43038] [client 89.251.0.143:35801] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "aelYW8OAb-3sOknsk4cWSgAAAFY"]
[Thu Apr 23 07:23:08.357168 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.142:20119] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aelYXDEP2_5RswrH8bGfqQAAAAk"]
[Thu Apr 23 07:23:08.976706 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.131:23751] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "aelYXDC5hrvNXosL83LAsgAAAMw"]
[Thu Apr 23 07:23:10.299948 2026] [proxy_fcgi:error] [pid 65000:tid 65041] [client 89.251.0.121:22283] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:10.590661 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.121:22283] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "aelYXr6vRb9j6psK2ZaHVQAAAhg"]
[Thu Apr 23 07:23:11.175729 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.126:60219] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "aelYX26I0QqmmmLTHE3UTwAAAJU"]
[Thu Apr 23 07:23:12.504867 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.129:39063] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "aelYYIAV4GfOOdX8QzoJugAAAYM"]
[Thu Apr 23 07:23:13.706016 2026] [proxy_fcgi:error] [pid 43083:tid 43090] [client 89.251.0.131:30825] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:14.023829 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.131:30825] [client 89.251.0.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/admin.php"] [unique_id "aelYYjC5hrvNXosL83LA0gAAANA"]
[Thu Apr 23 07:23:14.651845 2026] [proxy_fcgi:error] [pid 65000:tid 65040] [client 89.251.0.120:36095] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:15.023322 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 89.251.0.120:36095] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:15.418373 2026] [proxy_fcgi:error] [pid 65000:tid 65041] [client 89.251.0.120:36095] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:16.383300 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.120:36095] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "aelYZL6vRb9j6psK2ZaH1wAAAgw"]
[Thu Apr 23 07:23:18.006779 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.126:48117] [client 89.251.0.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.126, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aelYZoV5EysYcTLjmwjrKQAAAcA"]
[Thu Apr 23 07:23:18.321161 2026] [proxy_fcgi:error] [pid 64998:tid 65010] [client 89.251.0.126:48117] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:19.326164 2026] [proxy_fcgi:error] [pid 64998:tid 65021] [client 89.251.0.126:48117] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:20.434731 2026] [proxy_fcgi:error] [pid 64998:tid 65009] [client 89.251.0.126:48117] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:21.213562 2026] [proxy_fcgi:error] [pid 64998:tid 65020] [client 89.251.0.126:48117] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:22.756631 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.126:48117] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aelYaoV5EysYcTLjmwjrZwAAAc0"]
[Thu Apr 23 07:23:23.745849 2026] [proxy_fcgi:error] [pid 43083:tid 43104] [client 89.251.0.126:51121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:24.050745 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.126:51121] [client 89.251.0.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.126, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aelYbDC5hrvNXosL83LBWgAAAMo"]
[Thu Apr 23 07:23:24.733213 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.126:51121] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "aelYbDC5hrvNXosL83LBbAAAAMk"]
[Thu Apr 23 07:23:26.874306 2026] [proxy_fcgi:error] [pid 64967:tid 64990] [client 89.251.0.151:65433] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:27.921298 2026] [proxy_fcgi:error] [pid 64967:tid 64985] [client 89.251.0.151:65433] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:28.603734 2026] [proxy_fcgi:error] [pid 64967:tid 64971] [client 89.251.0.151:65433] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:29.218580 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.151:65433] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aelYcYAV4GfOOdX8QzoKQwAAAYk"]
[Thu Apr 23 07:23:30.134707 2026] [proxy_fcgi:error] [pid 65000:tid 65054] [client 89.251.0.124:42527] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:31.362319 2026] [proxy_fcgi:error] [pid 65000:tid 65030] [client 89.251.0.124:42527] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:32.038334 2026] [proxy_fcgi:error] [pid 65000:tid 65037] [client 89.251.0.124:42527] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:32.702326 2026] [proxy_fcgi:error] [pid 65000:tid 65037] [client 89.251.0.124:42527] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:33.022354 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.124:42527] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aelYdb6vRb9j6psK2ZaJYAAAAgs"]
[Thu Apr 23 07:23:33.696323 2026] [proxy_fcgi:error] [pid 42971:tid 42987] [client 89.251.0.126:47005] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:34.047298 2026] [proxy_fcgi:error] [pid 42971:tid 42988] [client 89.251.0.126:47005] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:34.356444 2026] [:error] [pid 42971:tid 42993] [client 89.251.0.126:47005] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aelYdjEP2_5RswrH8bGgNAAAAAc"]
[Thu Apr 23 07:23:35.283570 2026] [proxy_fcgi:error] [pid 64967:tid 64991] [client 89.251.0.147:38397] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:35.930571 2026] [:error] [pid 64967:tid 64984] [client 89.251.0.147:38397] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "aelYd4AV4GfOOdX8QzoKaAAAAY8"]
[Thu Apr 23 07:23:36.296004 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.147:38397] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aelYeIAV4GfOOdX8QzoKawAAAZE"]
[Thu Apr 23 07:23:40.292467 2026] [proxy_fcgi:error] [pid 65000:tid 65047] [client 89.251.0.141:54025] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:40.985307 2026] [proxy_fcgi:error] [pid 65000:tid 65042] [client 89.251.0.141:54025] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:41.652303 2026] [proxy_fcgi:error] [pid 65000:tid 65041] [client 89.251.0.141:54025] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:42.353863 2026] [proxy_fcgi:error] [pid 65000:tid 65032] [client 89.251.0.141:54025] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:43.040673 2026] [proxy_fcgi:error] [pid 65000:tid 65051] [client 89.251.0.141:54025] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:43.394858 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.141:54025] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aelYf76vRb9j6psK2ZaKrQAAAgo"]
[Thu Apr 23 07:23:44.102462 2026] [proxy_fcgi:error] [pid 59700:tid 59710] [client 89.251.0.136:63895] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:45.589412 2026] [:error] [pid 59700:tid 59706] [client 89.251.0.136:63895] [client 89.251.0.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.136, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aelYgZXyGZJFeAIDWtlRyQAAAUQ"]
[Thu Apr 23 07:23:45.958800 2026] [proxy_fcgi:error] [pid 59700:tid 59709] [client 89.251.0.136:63895] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:46.292308 2026] [proxy_fcgi:error] [pid 59700:tid 59704] [client 89.251.0.136:63895] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:46.656076 2026] [proxy_fcgi:error] [pid 59700:tid 59711] [client 89.251.0.136:63895] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:47.022313 2026] [:error] [pid 59700:tid 59715] [client 89.251.0.136:63895] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "aelYg5XyGZJFeAIDWtlR1QAAAU0"]
[Thu Apr 23 07:23:47.644620 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.143:57905] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:47.957511 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.143:57905] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/infi.php"] [unique_id "aelYgzC5hrvNXosL83LCDAAAANc"]
[Thu Apr 23 07:23:48.891590 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.147:34597] [client 89.251.0.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "aelYhDEP2_5RswrH8bGgcQAAABA"]
[Thu Apr 23 07:23:49.565290 2026] [proxy_fcgi:error] [pid 42972:tid 43025] [client 89.251.0.117:23685] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:50.372652 2026] [:error] [pid 42972:tid 43026] [client 89.251.0.117:23685] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "aelYhsOAb-3sOknsk4cX_AAAAEo"]
[Thu Apr 23 07:23:51.280311 2026] [proxy_fcgi:error] [pid 65000:tid 65046] [client 89.251.0.148:40985] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:51.584303 2026] [proxy_fcgi:error] [pid 65000:tid 65037] [client 89.251.0.148:40985] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:51.875433 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.148:40985] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "aelYh76vRb9j6psK2ZaLrQAAAgc"]
[Thu Apr 23 07:23:52.479121 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.126:26983] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "aelYiMOAb-3sOknsk4cYDAAAAE4"]
[Thu Apr 23 07:23:53.171304 2026] [proxy_fcgi:error] [pid 65000:tid 65039] [client 89.251.0.135:28253] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:53.506300 2026] [proxy_fcgi:error] [pid 65000:tid 65056] [client 89.251.0.135:28253] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:54.801526 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.135:28253] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aelYir6vRb9j6psK2ZaMCAAAAhI"]
[Thu Apr 23 07:23:55.875923 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.119:46175] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "aelYi4V5EysYcTLjmwjswAAAAcM"]
[Thu Apr 23 07:23:56.579311 2026] [proxy_fcgi:error] [pid 64967:tid 64992] [client 89.251.0.132:51567] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:57.518867 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.132:51567] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit.php"] [unique_id "aelYjYAV4GfOOdX8QzoK-QAAAZA"]
[Thu Apr 23 07:23:58.147724 2026] [proxy_fcgi:error] [pid 42973:tid 43059] [client 89.251.0.129:51881] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:23:59.723718 2026] [proxy_fcgi:error] [pid 42973:tid 43064] [client 89.251.0.129:51881] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:00.027578 2026] [:error] [pid 42973:tid 43052] [client 89.251.0.129:51881] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aelYkG6I0QqmmmLTHE3VigAAAIk"]
[Thu Apr 23 07:24:00.701170 2026] [proxy_fcgi:error] [pid 59700:tid 59711] [client 89.251.0.131:24865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:01.500075 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.131:24865] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/click.php"] [unique_id "aelYkZXyGZJFeAIDWtlSUgAAAUM"]
[Thu Apr 23 07:24:02.087396 2026] [proxy_fcgi:error] [pid 42973:tid 43060] [client 89.251.0.133:48273] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:03.128322 2026] [:error] [pid 42973:tid 43047] [client 89.251.0.133:48273] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aelYk26I0QqmmmLTHE3VmwAAAIQ"]
[Thu Apr 23 07:24:04.057303 2026] [proxy_fcgi:error] [pid 42973:tid 43063] [client 89.251.0.138:30827] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:04.696310 2026] [proxy_fcgi:error] [pid 42973:tid 43067] [client 89.251.0.138:30827] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:05.014290 2026] [proxy_fcgi:error] [pid 42973:tid 43053] [client 89.251.0.138:30827] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:05.653947 2026] [proxy_fcgi:error] [pid 42973:tid 43062] [client 89.251.0.138:30827] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:05.951390 2026] [:error] [pid 42973:tid 43057] [client 89.251.0.138:30827] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aelYlW6I0QqmmmLTHE3VuwAAAI4"]
[Thu Apr 23 07:24:06.593747 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.145:50369] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/xl2023.php"] [unique_id "aelYljC5hrvNXosL83LCygAAANQ"]
[Thu Apr 23 07:24:07.214912 2026] [:error] [pid 42971:tid 42992] [client 89.251.0.140:56331] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aelYlzEP2_5RswrH8bGg-wAAAAY"]
[Thu Apr 23 07:24:07.913794 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.125:28189] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aelYlzEP2_5RswrH8bGhAwAAAAk"]
[Thu Apr 23 07:24:09.564319 2026] [proxy_fcgi:error] [pid 64998:tid 65002] [client 89.251.0.150:38953] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:09.904466 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.150:38953] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aelYmYV5EysYcTLjmwjt5AAAAc8"]
[Thu Apr 23 07:24:10.525062 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.146:21679] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "aelYmjEP2_5RswrH8bGhEwAAAAU"]
[Thu Apr 23 07:24:11.108693 2026] [proxy_fcgi:error] [pid 65000:tid 65049] [client 89.251.0.143:26865] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:11.680988 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.143:26865] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "aelYm76vRb9j6psK2ZaNuQAAAhg"]
[Thu Apr 23 07:24:12.322907 2026] [:error] [pid 65000:tid 65054] [client 89.251.0.129:53027] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "aelYnL6vRb9j6psK2ZaNxwAAAhU"]
[Thu Apr 23 07:24:12.927811 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.116:33597] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aelYnL6vRb9j6psK2ZaN2gAAAgQ"]
[Thu Apr 23 07:24:14.008881 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.127:57385] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "aelYnb6vRb9j6psK2ZaN7gAAAgk"]
[Thu Apr 23 07:24:14.936530 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.126:58411] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aelYnjC5hrvNXosL83LC5gAAANA"]
[Thu Apr 23 07:24:16.252723 2026] [:error] [pid 64967:tid 64992] [client 89.251.0.137:32605] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "aelYoIAV4GfOOdX8QzoLsAAAAZc"]
[Thu Apr 23 07:24:16.883880 2026] [proxy_fcgi:error] [pid 42971:tid 43004] [client 89.251.0.123:21949] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:17.923335 2026] [proxy_fcgi:error] [pid 42971:tid 42997] [client 89.251.0.123:21949] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:18.225346 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.123:21949] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aelYojEP2_5RswrH8bGhPAAAABQ"]
[Thu Apr 23 07:24:19.737206 2026] [proxy_fcgi:error] [pid 65000:tid 65042] [client 89.251.0.151:25927] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:20.082090 2026] [proxy_fcgi:error] [pid 65000:tid 65031] [client 89.251.0.151:25927] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:21.410701 2026] [proxy_fcgi:error] [pid 65000:tid 65048] [client 89.251.0.151:25927] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:21.727180 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.151:25927] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "aelYpb6vRb9j6psK2ZaOxAAAAg4"]
[Thu Apr 23 07:24:22.336337 2026] [proxy_fcgi:error] [pid 65000:tid 65048] [client 89.251.0.121:43635] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:23.284291 2026] [:error] [pid 65000:tid 65040] [client 89.251.0.121:43635] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aelYp76vRb9j6psK2ZaO2gAAAgc"]
[Thu Apr 23 07:24:23.948978 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.120:64489] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aelYp5XyGZJFeAIDWtlS9AAAAUg"]
[Thu Apr 23 07:24:25.931940 2026] [:error] [pid 25635:tid 25650] [client 89.251.0.134:61767] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aelYqcRxv6UsgRGKB3LdYgAAAQs"]
[Thu Apr 23 07:24:26.823831 2026] [:error] [pid 42973:tid 43049] [client 89.251.0.120:41723] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blog/wp-content/about.php"] [unique_id "aelYqm6I0QqmmmLTHE3WMAAAAIY"]
[Thu Apr 23 07:24:27.884296 2026] [proxy_fcgi:error] [pid 42973:tid 43054] [client 89.251.0.124:62593] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:28.247985 2026] [proxy_fcgi:error] [pid 42973:tid 43045] [client 89.251.0.124:62593] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:29.097297 2026] [proxy_fcgi:error] [pid 42973:tid 43046] [client 89.251.0.124:62593] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:29.444314 2026] [proxy_fcgi:error] [pid 42973:tid 43063] [client 89.251.0.124:62593] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:31.238508 2026] [:error] [pid 42973:tid 43048] [client 89.251.0.124:62593] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "aelYr26I0QqmmmLTHE3WXQAAAIU"]
[Thu Apr 23 07:24:31.936028 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.115:64065] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aelYr8Rxv6UsgRGKB3LdnQAAAQY"]
[Thu Apr 23 07:24:32.581686 2026] [:error] [pid 59700:tid 59725] [client 89.251.0.139:50051] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aelYsJXyGZJFeAIDWtlTMgAAAVc"]
[Thu Apr 23 07:24:33.193752 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.138:33397] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aelYsb6vRb9j6psK2ZaPawAAAg8"]
[Thu Apr 23 07:24:34.069753 2026] [:error] [pid 43083:tid 43091] [client 89.251.0.150:47773] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aelYsjC5hrvNXosL83LD0gAAAMY"]
[Thu Apr 23 07:24:34.739317 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.120:32813] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aelYsr6vRb9j6psK2ZaPiAAAAgY"]
[Thu Apr 23 07:24:35.679904 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.151:37355] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "aelYs76vRb9j6psK2ZaPmwAAAgM"]
[Thu Apr 23 07:24:36.362226 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.137:58995] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aelYtL6vRb9j6psK2ZaPrAAAAgw"]
[Thu Apr 23 07:24:36.946671 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.125:56195] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aelYtL6vRb9j6psK2ZaPwQAAAg0"]
[Thu Apr 23 07:24:37.556169 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.120:32889] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aelYtb6vRb9j6psK2ZaP1gAAAgY"]
[Thu Apr 23 07:24:38.812405 2026] [:error] [pid 64967:tid 64969] [client 89.251.0.115:25259] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aelYtoAV4GfOOdX8QzoNRwAAAYA"]
[Thu Apr 23 07:24:39.739054 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.126:41427] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "aelYt76vRb9j6psK2ZaQHAAAAhQ"]
[Thu Apr 23 07:24:40.473358 2026] [proxy_fcgi:error] [pid 64998:tid 65022] [client 89.251.0.142:47989] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:41.133189 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.142:47989] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aelYuYV5EysYcTLjmwjvegAAAdY"]
[Thu Apr 23 07:24:42.404336 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.131:25857] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "aelYuoV5EysYcTLjmwjvjQAAAdM"]
[Thu Apr 23 07:24:43.156317 2026] [proxy_fcgi:error] [pid 64967:tid 64977] [client 89.251.0.114:39645] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:43.869357 2026] [proxy_fcgi:error] [pid 64967:tid 64974] [client 89.251.0.114:39645] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:44.170156 2026] [:error] [pid 64967:tid 64984] [client 89.251.0.114:39645] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aelYvIAV4GfOOdX8QzoNiQAAAY8"]
[Thu Apr 23 07:24:45.603303 2026] [proxy_fcgi:error] [pid 64998:tid 65004] [client 89.251.0.137:23513] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:45.916297 2026] [proxy_fcgi:error] [pid 64998:tid 65024] [client 89.251.0.137:23513] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:46.244860 2026] [proxy_fcgi:error] [pid 64998:tid 65019] [client 89.251.0.137:23513] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:46.558366 2026] [:error] [pid 64998:tid 65002] [client 89.251.0.137:23513] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "aelYvoV5EysYcTLjmwjvugAAAcA"]
[Thu Apr 23 07:24:47.723856 2026] [proxy_fcgi:error] [pid 64967:tid 64987] [client 89.251.0.124:53905] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:48.076295 2026] [:error] [pid 64967:tid 64969] [client 89.251.0.124:53905] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "aelYwIAV4GfOOdX8QzoNpwAAAYA"]
[Thu Apr 23 07:24:49.463655 2026] [proxy_fcgi:error] [pid 43083:tid 43100] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:49.777575 2026] [proxy_fcgi:error] [pid 43083:tid 43101] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:50.151296 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:50.839554 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:51.716299 2026] [proxy_fcgi:error] [pid 43083:tid 43100] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:52.127462 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:52.458301 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:52.786045 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:53.745457 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.143:24233] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:54.456448 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.143:24233] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aelYxjC5hrvNXosL83LEmAAAAMc"]
[Thu Apr 23 07:24:55.096089 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.141:53715] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aelYx5XyGZJFeAIDWtlT1wAAAUM"]
[Thu Apr 23 07:24:55.784342 2026] [proxy_fcgi:error] [pid 43083:tid 43088] [client 89.251.0.136:25283] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:56.110367 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.136:25283] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aelYyDC5hrvNXosL83LErQAAANg"]
[Thu Apr 23 07:24:57.034333 2026] [proxy_fcgi:error] [pid 64967:tid 64969] [client 89.251.0.145:42731] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:24:57.358417 2026] [:error] [pid 64967:tid 64982] [client 89.251.0.145:42731] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aelYyYAV4GfOOdX8QzoN9QAAAY0"]
[Thu Apr 23 07:24:57.928430 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.151:21789] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aelYyb6vRb9j6psK2ZaR6QAAAgI"]
[Thu Apr 23 07:24:59.962540 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.146:23187] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aelYy76vRb9j6psK2ZaSFQAAAhg"]
[Thu Apr 23 07:25:01.530774 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.119:65383] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "aelYzcOAb-3sOknsk4ca9gAAAEs"]
[Thu Apr 23 07:25:03.636312 2026] [proxy_fcgi:error] [pid 65000:tid 65047] [client 89.251.0.115:25417] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:04.473296 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.115:25417] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aelY0L6vRb9j6psK2ZaSVAAAAgw"]
[Thu Apr 23 07:25:05.540302 2026] [proxy_fcgi:error] [pid 43083:tid 43092] [client 89.251.0.138:36721] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:06.253949 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.138:36721] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "aelY0jC5hrvNXosL83LFEQAAANU"]
[Thu Apr 23 07:25:06.875006 2026] [:error] [pid 42972:tid 43033] [client 89.251.0.116:46917] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugins.php"] [unique_id "aelY0sOAb-3sOknsk4cbLAAAAFE"]
[Thu Apr 23 07:25:07.859558 2026] [proxy_fcgi:error] [pid 64967:tid 64975] [client 89.251.0.129:61547] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:08.199641 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.129:61547] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "aelY1IAV4GfOOdX8QzoOZgAAAZE"]
[Thu Apr 23 07:25:08.826852 2026] [:error] [pid 64967:tid 64975] [client 89.251.0.134:34813] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aelY1IAV4GfOOdX8QzoObwAAAYY"]
[Thu Apr 23 07:25:10.321335 2026] [proxy_fcgi:error] [pid 65000:tid 65029] [client 89.251.0.132:26871] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:10.686076 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 89.251.0.132:26871] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:11.481316 2026] [proxy_fcgi:error] [pid 65000:tid 65047] [client 89.251.0.132:26871] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:12.152341 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.132:26871] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/atomlib.php"] [unique_id "aelY2L6vRb9j6psK2ZaS_gAAAhc"]
[Thu Apr 23 07:25:12.766194 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.138:28827] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aelY2L6vRb9j6psK2ZaTBQAAAgg"]
[Thu Apr 23 07:25:13.437315 2026] [proxy_fcgi:error] [pid 65000:tid 65044] [client 89.251.0.138:52209] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:13.791301 2026] [proxy_fcgi:error] [pid 65000:tid 65047] [client 89.251.0.138:52209] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:14.436314 2026] [proxy_fcgi:error] [pid 65000:tid 65029] [client 89.251.0.138:52209] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:14.768381 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.138:52209] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "aelY2r6vRb9j6psK2ZaTJAAAAgM"]
[Thu Apr 23 07:25:15.688441 2026] [:error] [pid 42972:tid 43038] [client 89.251.0.134:49223] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aelY28OAb-3sOknsk4cb8gAAAFY"]
[Thu Apr 23 07:25:16.399340 2026] [:error] [pid 25635:tid 25646] [client 89.251.0.143:20587] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aelY3MRxv6UsgRGKB3Le5AAAAQc"]
[Thu Apr 23 07:25:18.441304 2026] [proxy_fcgi:error] [pid 65000:tid 65054] [client 89.251.0.143:40987] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:18.739613 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.143:40987] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aelY3r6vRb9j6psK2ZaTdQAAAg4"]
[Thu Apr 23 07:25:19.892378 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.131:65273] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aelY38OAb-3sOknsk4ccFwAAAEc"]
[Thu Apr 23 07:25:20.490617 2026] [:error] [pid 64967:tid 64988] [client 89.251.0.128:51701] [client 89.251.0.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jp.php"] [unique_id "aelY4IAV4GfOOdX8QzoPBgAAAZM"]
[Thu Apr 23 07:25:21.054290 2026] [proxy_fcgi:error] [pid 43083:tid 43085] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:21.444329 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:22.111470 2026] [proxy_fcgi:error] [pid 43083:tid 43089] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:23.518140 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.147:58793] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/js/wp-login.php"] [unique_id "aelY4zC5hrvNXosL83LF7gAAANI"]
[Thu Apr 23 07:25:24.148279 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.147:58793] File does not exist: /home/switchcreative/public_html/worm.PhP
[Thu Apr 23 07:25:24.524965 2026] [proxy_fcgi:error] [pid 43083:tid 43097] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:24.909529 2026] [proxy_fcgi:error] [pid 43083:tid 43099] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:25.228309 2026] [proxy_fcgi:error] [pid 43083:tid 43086] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:25.592690 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.147:58793] [client 89.251.0.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.147, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aelY5TC5hrvNXosL83LGEAAAAMM"]
[Thu Apr 23 07:25:25.918691 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:26.653342 2026] [proxy_fcgi:error] [pid 43083:tid 43087] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:26.983313 2026] [proxy_fcgi:error] [pid 43083:tid 43103] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:27.613954 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:28.253671 2026] [proxy_fcgi:error] [pid 43083:tid 43106] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:29.358676 2026] [proxy_fcgi:error] [pid 43083:tid 43100] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:31.836072 2026] [proxy_fcgi:error] [pid 43083:tid 43103] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:32.148302 2026] [proxy_fcgi:error] [pid 43083:tid 43091] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:33.166331 2026] [proxy_fcgi:error] [pid 43083:tid 43090] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:33.805324 2026] [proxy_fcgi:error] [pid 43083:tid 43087] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:34.171630 2026] [proxy_fcgi:error] [pid 43083:tid 43101] [client 89.251.0.147:58793] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:34.546292 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.147:58793] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/about.php"] [unique_id "aelY7jC5hrvNXosL83LGVwAAANg"]
[Thu Apr 23 07:25:35.562298 2026] [proxy_fcgi:error] [pid 42972:tid 43024] [client 89.251.0.131:49557] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:35.891326 2026] [proxy_fcgi:error] [pid 42972:tid 43020] [client 89.251.0.131:49557] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:36.223709 2026] [:error] [pid 42972:tid 43034] [client 89.251.0.131:49557] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aelY8MOAb-3sOknsk4ccmgAAAFI"]
[Thu Apr 23 07:25:37.168631 2026] [proxy_fcgi:error] [pid 59700:tid 59722] [client 89.251.0.150:21975] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:37.501050 2026] [:error] [pid 59700:tid 59723] [client 89.251.0.150:21975] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aelY8ZXyGZJFeAIDWtlVlAAAAVU"]
[Thu Apr 23 07:25:39.032297 2026] [proxy_fcgi:error] [pid 42971:tid 42994] [client 89.251.0.143:59753] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:39.702376 2026] [proxy_fcgi:error] [pid 42971:tid 43010] [client 89.251.0.143:59753] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:39.981283 2026] [proxy_fcgi:error] [pid 42971:tid 42987] [client 89.251.0.143:59753] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:40.311617 2026] [proxy_fcgi:error] [pid 42971:tid 43003] [client 89.251.0.143:59753] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:40.609323 2026] [proxy_fcgi:error] [pid 42971:tid 43009] [client 89.251.0.143:59753] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:41.445640 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.143:59753] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aelY9TEP2_5RswrH8bGk_wAAABI"]
[Thu Apr 23 07:25:42.078591 2026] [proxy_fcgi:error] [pid 42972:tid 43017] [client 89.251.0.114:54405] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:42.390299 2026] [proxy_fcgi:error] [pid 42972:tid 43019] [client 89.251.0.114:54405] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:42.821691 2026] [:error] [pid 42972:tid 43033] [client 89.251.0.114:54405] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aelY9sOAb-3sOknsk4cc1QAAAFE"]
[Thu Apr 23 07:25:43.823599 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.140:29883] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aelY98OAb-3sOknsk4cc3wAAAEc"]
[Thu Apr 23 07:25:44.718312 2026] [proxy_fcgi:error] [pid 64998:tid 65011] [client 89.251.0.132:32085] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:45.091302 2026] [proxy_fcgi:error] [pid 64998:tid 65005] [client 89.251.0.132:32085] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:45.720331 2026] [proxy_fcgi:error] [pid 64998:tid 65008] [client 89.251.0.132:32085] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:46.040387 2026] [proxy_fcgi:error] [pid 64998:tid 65018] [client 89.251.0.132:32085] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:47.539867 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.132:32085] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aelY-4V5EysYcTLjmwjy2QAAAcM"]
[Thu Apr 23 07:25:48.172829 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.128:49237] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aelY_DC5hrvNXosL83LG7wAAANA"]
[Thu Apr 23 07:25:50.560299 2026] [proxy_fcgi:error] [pid 25635:tid 25657] [client 89.251.0.127:49265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:51.306576 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.127:49265] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aelY_8Rxv6UsgRGKB3Lf5wAAARE"]
[Thu Apr 23 07:25:52.309562 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.132:30463] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "aelZAMOAb-3sOknsk4cdLgAAAE4"]
[Thu Apr 23 07:25:53.230286 2026] [proxy_fcgi:error] [pid 42971:tid 42996] [client 89.251.0.119:57977] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:53.618289 2026] [proxy_fcgi:error] [pid 42971:tid 43010] [client 89.251.0.119:57977] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:53.928887 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.119:57977] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aelZATEP2_5RswrH8bGlvwAAAAQ"]
[Thu Apr 23 07:25:54.867398 2026] [proxy_fcgi:error] [pid 42972:tid 43036] [client 89.251.0.129:31853] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:55.205660 2026] [proxy_fcgi:error] [pid 42972:tid 43031] [client 89.251.0.129:31853] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:55.889309 2026] [proxy_fcgi:error] [pid 42972:tid 43023] [client 89.251.0.129:31853] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:56.252097 2026] [:error] [pid 42972:tid 43035] [client 89.251.0.129:31853] [client 89.251.0.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/glex.php"] [unique_id "aelZBMOAb-3sOknsk4cdcwAAAFM"]
[Thu Apr 23 07:25:57.561870 2026] [:error] [pid 64967:tid 64981] [client 89.251.0.135:53729] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aelZBYAV4GfOOdX8QzoQSQAAAYw"]
[Thu Apr 23 07:25:58.263319 2026] [proxy_fcgi:error] [pid 59700:tid 59724] [client 89.251.0.128:21575] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:25:59.534300 2026] [:error] [pid 59700:tid 59709] [client 89.251.0.128:21575] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aelZB5XyGZJFeAIDWtlWPgAAAUc"]
[Thu Apr 23 07:26:01.216351 2026] [proxy_fcgi:error] [pid 25635:tid 25644] [client 89.251.0.120:33717] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:02.313301 2026] [proxy_fcgi:error] [pid 25635:tid 25649] [client 89.251.0.120:33717] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:02.639329 2026] [proxy_fcgi:error] [pid 25635:tid 25643] [client 89.251.0.120:33717] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:02.943202 2026] [:error] [pid 25635:tid 25656] [client 89.251.0.120:33717] [client 89.251.0.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/1.php"] [unique_id "aelZCsRxv6UsgRGKB3LgIQAAARE"]
[Thu Apr 23 07:26:03.829650 2026] [:error] [pid 42973:tid 43048] [client 89.251.0.145:29813] [client 89.251.0.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.145, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aelZC26I0QqmmmLTHE3Y5wAAAIU"]
[Thu Apr 23 07:26:04.511443 2026] [proxy_fcgi:error] [pid 42973:tid 43052] [client 89.251.0.145:29813] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:05.158307 2026] [proxy_fcgi:error] [pid 42973:tid 43066] [client 89.251.0.145:29813] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:05.468553 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.145:29813] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aelZDW6I0QqmmmLTHE3Y_gAAAJY"]
[Thu Apr 23 07:26:06.123531 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 89.251.0.135:49091] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:06.456610 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.135:49091] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aelZDr6vRb9j6psK2ZaViAAAAhY"]
[Thu Apr 23 07:26:08.760583 2026] [proxy_fcgi:error] [pid 42971:tid 42991] [client 89.251.0.136:54847] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:09.903441 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.136:54847] [client 89.251.0.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/error.php"] [unique_id "aelZETEP2_5RswrH8bGmTQAAAA8"]
[Thu Apr 23 07:26:10.576155 2026] [proxy_fcgi:error] [pid 43083:tid 43098] [client 89.251.0.129:57237] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:11.711464 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.129:57237] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aelZEzC5hrvNXosL83LHyQAAANg"]
[Thu Apr 23 07:26:12.702315 2026] [proxy_fcgi:error] [pid 65000:tid 65041] [client 89.251.0.120:21587] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:13.011309 2026] [proxy_fcgi:error] [pid 65000:tid 65057] [client 89.251.0.120:21587] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:13.307569 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.120:21587] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aelZFb6vRb9j6psK2ZaV2QAAAhc"]
[Thu Apr 23 07:26:13.946911 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.127:50119] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aelZFTEP2_5RswrH8bGmfwAAAAk"]
[Thu Apr 23 07:26:14.530614 2026] [proxy_fcgi:error] [pid 59700:tid 59715] [client 89.251.0.148:44301] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:14.863928 2026] [proxy_fcgi:error] [pid 59700:tid 59711] [client 89.251.0.148:44301] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:15.584712 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.148:44301] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aelZF5XyGZJFeAIDWtlXGAAAAVY"]
[Thu Apr 23 07:26:16.305286 2026] [proxy_fcgi:error] [pid 59700:tid 59707] [client 89.251.0.117:54453] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:16.960305 2026] [proxy_fcgi:error] [pid 59700:tid 59709] [client 89.251.0.117:54453] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:17.299088 2026] [:error] [pid 59700:tid 59710] [client 89.251.0.117:54453] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aelZGZXyGZJFeAIDWtlXRgAAAUg"]
[Thu Apr 23 07:26:18.172034 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.151:29957] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/db.php"] [unique_id "aelZGpXyGZJFeAIDWtlXUAAAAVQ"]
[Thu Apr 23 07:26:18.774743 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.146:37651] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aelZGjC5hrvNXosL83LIDAAAAMw"]
[Thu Apr 23 07:26:19.388459 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.135:31719] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aelZG76vRb9j6psK2ZaWIwAAAgE"]
[Thu Apr 23 07:26:20.692675 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.134:53439] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aelZHDEP2_5RswrH8bGm5gAAABA"]
[Thu Apr 23 07:26:21.326747 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.124:53629] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aelZHb6vRb9j6psK2ZaWRAAAAgU"]
[Thu Apr 23 07:26:22.005651 2026] [:error] [pid 64998:tid 65025] [client 89.251.0.129:35383] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aelZHoV5EysYcTLjmwjz-wAAAdc"]
[Thu Apr 23 07:26:23.339014 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.147:29701] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aelZH4V5EysYcTLjmwj0FAAAAdE"]
[Thu Apr 23 07:26:23.982837 2026] [:error] [pid 64998:tid 65005] [client 89.251.0.119:24471] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aelZH4V5EysYcTLjmwj0GQAAAcM"]
[Thu Apr 23 07:26:24.759131 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.145:36419] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aelZIJXyGZJFeAIDWtlXqAAAAUA"]
[Thu Apr 23 07:26:25.386513 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.140:44615] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aelZIYV5EysYcTLjmwj0KQAAAcE"]
[Thu Apr 23 07:26:26.024077 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.120:52189] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/options.php"] [unique_id "aelZIoAV4GfOOdX8QzoRCgAAAZg"]
[Thu Apr 23 07:26:26.554619 2026] [proxy_fcgi:error] [pid 64967:tid 64991] [client 89.251.0.132:55567] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:27.483383 2026] [:error] [pid 64967:tid 64970] [client 89.251.0.132:55567] [client 89.251.0.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.132, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aelZI4AV4GfOOdX8QzoRMQAAAYE"]
[Thu Apr 23 07:26:28.971995 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.132:55567] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aelZJIAV4GfOOdX8QzoRVwAAAZg"]
[Thu Apr 23 07:26:30.399560 2026] [proxy_fcgi:error] [pid 42971:tid 42986] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:30.724636 2026] [proxy_fcgi:error] [pid 42971:tid 43010] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:32.086303 2026] [proxy_fcgi:error] [pid 42971:tid 43009] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:32.369325 2026] [proxy_fcgi:error] [pid 42971:tid 42987] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:33.637308 2026] [proxy_fcgi:error] [pid 42971:tid 43006] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:33.936297 2026] [proxy_fcgi:error] [pid 42971:tid 42995] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:34.281309 2026] [proxy_fcgi:error] [pid 42971:tid 43009] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:35.044322 2026] [proxy_fcgi:error] [pid 42971:tid 42995] [client 89.251.0.117:59249] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:35.377309 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.117:59249] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aelZKzEP2_5RswrH8bGoFAAAAAg"]
[Thu Apr 23 07:26:36.117736 2026] [:error] [pid 64998:tid 65015] [client 89.251.0.144:53999] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aelZLIV5EysYcTLjmwj0YwAAAc0"]
[Thu Apr 23 07:26:36.755581 2026] [:error] [pid 59700:tid 59725] [client 89.251.0.126:20073] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aelZLJXyGZJFeAIDWtlYJAAAAVc"]
[Thu Apr 23 07:26:37.750300 2026] [proxy_fcgi:error] [pid 42973:tid 43049] [client 89.251.0.132:40311] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:38.040647 2026] [proxy_fcgi:error] [pid 42973:tid 43052] [client 89.251.0.132:40311] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:38.688309 2026] [proxy_fcgi:error] [pid 42973:tid 43048] [client 89.251.0.132:40311] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:39.849675 2026] [:error] [pid 42973:tid 43054] [client 89.251.0.132:40311] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aelZL26I0QqmmmLTHE3Z7gAAAIs"]
[Thu Apr 23 07:26:40.586005 2026] [:error] [pid 64967:tid 64978] [client 89.251.0.137:29353] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aelZMIAV4GfOOdX8QzoRvgAAAYk"]
[Thu Apr 23 07:26:41.856039 2026] [:error] [pid 64998:tid 65026] [client 89.251.0.125:29259] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aelZMYV5EysYcTLjmwj0fgAAAdg"]
[Thu Apr 23 07:26:43.629069 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.123:55329] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aelZMzEP2_5RswrH8bGoegAAAAQ"]
[Thu Apr 23 07:26:44.819472 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.121:60367] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aelZNDC5hrvNXosL83LItgAAANE"]
[Thu Apr 23 07:26:45.490641 2026] [proxy_fcgi:error] [pid 43083:tid 43085] [client 89.251.0.144:44951] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:46.151900 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.144:44951] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aelZNjC5hrvNXosL83LI0wAAANI"]
[Thu Apr 23 07:26:47.387337 2026] [proxy_fcgi:error] [pid 42973:tid 43044] [client 89.251.0.113:60329] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:48.049114 2026] [proxy_fcgi:error] [pid 42973:tid 43062] [client 89.251.0.113:60329] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:50.137881 2026] [:error] [pid 42973:tid 43049] [client 89.251.0.113:60329] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "aelZOm6I0QqmmmLTHE3aHwAAAIY"]
[Thu Apr 23 07:26:50.848319 2026] [proxy_fcgi:error] [pid 42971:tid 43001] [client 89.251.0.150:61575] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:51.136627 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.150:61575] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/about.php"] [unique_id "aelZOzEP2_5RswrH8bGo5gAAABI"]
[Thu Apr 23 07:26:53.365426 2026] [proxy_fcgi:error] [pid 64998:tid 65014] [client 89.251.0.129:31981] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:54.898316 2026] [proxy_fcgi:error] [pid 64998:tid 65007] [client 89.251.0.129:31981] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:55.241314 2026] [:error] [pid 64998:tid 65022] [client 89.251.0.129:31981] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-sup.php"] [unique_id "aelZP4V5EysYcTLjmwj1YgAAAdQ"]
[Thu Apr 23 07:26:56.656492 2026] [proxy_fcgi:error] [pid 42971:tid 42988] [client 89.251.0.141:35171] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:56.945379 2026] [:error] [pid 42971:tid 43009] [client 89.251.0.141:35171] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aelZQDEP2_5RswrH8bGpRgAAABc"]
[Thu Apr 23 07:26:58.024670 2026] [proxy_fcgi:error] [pid 43083:tid 43088] [client 89.251.0.138:28581] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:26:59.018907 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.138:28581] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aelZQzC5hrvNXosL83LJUwAAANg"]
[Thu Apr 23 07:27:01.221541 2026] [:error] [pid 25635:tid 25652] [client 89.251.0.120:62493] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aelZRcRxv6UsgRGKB3LhUQAAAQ0"]
[Thu Apr 23 07:27:01.857290 2026] [proxy_fcgi:error] [pid 64967:tid 64993] [client 89.251.0.129:60313] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:02.246606 2026] [proxy_fcgi:error] [pid 64967:tid 64992] [client 89.251.0.129:60313] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:02.611535 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.129:60313] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aelZRoAV4GfOOdX8QzoSTgAAAZA"]
[Thu Apr 23 07:27:03.290144 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.141:39587] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aelZRzC5hrvNXosL83LJoQAAAM8"]
[Thu Apr 23 07:27:04.910307 2026] [proxy_fcgi:error] [pid 42971:tid 42991] [client 89.251.0.119:20535] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:05.550369 2026] [:error] [pid 42971:tid 43004] [client 89.251.0.119:20535] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aelZSTEP2_5RswrH8bGphAAAABI"]
[Thu Apr 23 07:27:06.184307 2026] [proxy_fcgi:error] [pid 43083:tid 43090] [client 89.251.0.145:50977] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:07.996584 2026] [proxy_fcgi:error] [pid 43083:tid 43096] [client 89.251.0.145:50977] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:08.392725 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.145:50977] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aelZTDC5hrvNXosL83LKAwAAAMI"]
[Thu Apr 23 07:27:09.013312 2026] [proxy_fcgi:error] [pid 43083:tid 43109] [client 89.251.0.124:29451] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:09.627299 2026] [proxy_fcgi:error] [pid 43083:tid 43096] [client 89.251.0.124:29451] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:10.232124 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.124:29451] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZTjC5hrvNXosL83LKIQAAAME"]
[Thu Apr 23 07:27:10.903362 2026] [:error] [pid 42972:tid 43038] [client 89.251.0.151:43161] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aelZTsOAb-3sOknsk4cfvwAAAFY"]
[Thu Apr 23 07:27:11.862809 2026] [:error] [pid 42971:tid 42996] [client 89.251.0.134:32853] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aelZTzEP2_5RswrH8bGpuwAAAAo"]
[Thu Apr 23 07:27:13.280954 2026] [:error] [pid 64967:tid 64973] [client 89.251.0.140:57825] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/install.php"] [unique_id "aelZUYAV4GfOOdX8QzoSrAAAAYQ"]
[Thu Apr 23 07:27:13.904408 2026] [:error] [pid 42973:tid 43050] [client 89.251.0.139:24807] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aelZUW6I0QqmmmLTHE3aqgAAAIc"]
[Thu Apr 23 07:27:14.885382 2026] [proxy_fcgi:error] [pid 43083:tid 43096] [client 89.251.0.126:58371] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:16.464069 2026] [:error] [pid 43083:tid 43096] [client 89.251.0.126:58371] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/category-double.php"] [unique_id "aelZVDC5hrvNXosL83LKegAAAMs"]
[Thu Apr 23 07:27:17.810518 2026] [:error] [pid 43083:tid 43089] [client 89.251.0.129:51943] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/db.php"] [unique_id "aelZVTC5hrvNXosL83LKiwAAAMQ"]
[Thu Apr 23 07:27:18.423875 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.146:42241] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/security.php"] [unique_id "aelZVoAV4GfOOdX8QzoS9gAAAY4"]
[Thu Apr 23 07:27:19.401644 2026] [proxy_fcgi:error] [pid 42971:tid 43010] [client 89.251.0.127:55995] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:19.701334 2026] [:error] [pid 42971:tid 42988] [client 89.251.0.127:55995] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aelZVzEP2_5RswrH8bGqDwAAAAI"]
[Thu Apr 23 07:27:20.733665 2026] [:error] [pid 64967:tid 64980] [client 89.251.0.150:64351] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aelZWIAV4GfOOdX8QzoTCwAAAYs"]
[Thu Apr 23 07:27:23.005282 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.147:46577] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aelZW76vRb9j6psK2ZaYlAAAAhY"]
[Thu Apr 23 07:27:24.080295 2026] [proxy_fcgi:error] [pid 65000:tid 65031] [client 89.251.0.141:31527] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:24.448743 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.141:31527] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aelZXL6vRb9j6psK2ZaYswAAAg4"]
[Thu Apr 23 07:27:26.891947 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.113:22607] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aelZXjC5hrvNXosL83LK2QAAAMg"]
[Thu Apr 23 07:27:27.795311 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.141:52649] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/as.php"] [unique_id "aelZX4AV4GfOOdX8QzoTTwAAAZY"]
[Thu Apr 23 07:27:28.672254 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.148:54961] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aelZYIAV4GfOOdX8QzoTVgAAAZg"]
[Thu Apr 23 07:27:29.353547 2026] [:error] [pid 64967:tid 64977] [client 89.251.0.137:65223] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/install.php"] [unique_id "aelZYYAV4GfOOdX8QzoTXQAAAYg"]
[Thu Apr 23 07:27:29.971453 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.137:61165] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/db.php"] [unique_id "aelZYTEP2_5RswrH8bGqagAAABA"]
[Thu Apr 23 07:27:31.438301 2026] [proxy_fcgi:error] [pid 65000:tid 65045] [client 89.251.0.115:48773] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:32.926080 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.115:48773] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aelZZL6vRb9j6psK2ZaZLgAAAhg"]
[Thu Apr 23 07:27:34.635048 2026] [:error] [pid 59700:tid 59723] [client 89.251.0.144:25127] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rk2.php"] [unique_id "aelZZpXyGZJFeAIDWtlZvAAAAVU"]
[Thu Apr 23 07:27:35.646105 2026] [proxy_fcgi:error] [pid 42972:tid 43024] [client 89.251.0.151:33915] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:36.099408 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.151:33915] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/past.php"] [unique_id "aelZaMOAb-3sOknsk4chBwAAAEU"]
[Thu Apr 23 07:27:37.538582 2026] [:error] [pid 43083:tid 43096] [client 89.251.0.138:22273] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit-tags.php"] [unique_id "aelZaTC5hrvNXosL83LLVQAAAMs"]
[Thu Apr 23 07:27:38.327304 2026] [proxy_fcgi:error] [pid 64998:tid 65026] [client 89.251.0.137:33287] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:40.367817 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.137:33287] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aelZbIV5EysYcTLjmwj3IgAAAc4"]
[Thu Apr 23 07:27:41.345298 2026] [:error] [pid 42971:tid 42986] [client 89.251.0.133:40091] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aelZbTEP2_5RswrH8bGq8wAAAAA"]
[Thu Apr 23 07:27:42.410866 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.119:47667] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aelZbsRxv6UsgRGKB3LiLQAAARg"]
[Thu Apr 23 07:27:43.294298 2026] [proxy_fcgi:error] [pid 65000:tid 65046] [client 89.251.0.121:50107] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:43.691436 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.121:50107] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aelZb76vRb9j6psK2ZaZpAAAAgE"]
[Thu Apr 23 07:27:45.333303 2026] [proxy_fcgi:error] [pid 64967:tid 64976] [client 89.251.0.114:49929] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:45.965536 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.114:49929] [client 89.251.0.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/tflow/install.php"] [unique_id "aelZcYAV4GfOOdX8QzoT4QAAAZY"]
[Thu Apr 23 07:27:47.671105 2026] [:error] [pid 25635:tid 25661] [client 89.251.0.145:52871] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aelZc8Rxv6UsgRGKB3LiWAAAARY"]
[Thu Apr 23 07:27:48.477858 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.141:34253] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aelZdMOAb-3sOknsk4chgwAAAE4"]
[Thu Apr 23 07:27:50.117497 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.138:55935] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aelZdr6vRb9j6psK2ZaaFAAAAgA"]
[Thu Apr 23 07:27:50.789651 2026] [:error] [pid 59700:tid 59716] [client 89.251.0.141:41521] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aelZdpXyGZJFeAIDWtlaRwAAAU4"]
[Thu Apr 23 07:27:55.860298 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.123:32989] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aelZezC5hrvNXosL83LMKQAAAM4"]
[Thu Apr 23 07:27:56.492446 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.113:58933] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ms-file.php"] [unique_id "aelZfDC5hrvNXosL83LMOQAAANY"]
[Thu Apr 23 07:27:57.353218 2026] [:error] [pid 42971:tid 42996] [client 89.251.0.121:20193] [client 89.251.0.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.121, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aelZfTEP2_5RswrH8bGrVwAAAAo"]
[Thu Apr 23 07:27:57.362651 2026] [proxy_fcgi:error] [pid 42971:tid 42996] [client 89.251.0.121:20193] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:58.161562 2026] [:error] [pid 42971:tid 42988] [client 89.251.0.121:20193] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/av.php"] [unique_id "aelZfjEP2_5RswrH8bGrWAAAAAI"]
[Thu Apr 23 07:27:59.362915 2026] [proxy_fcgi:error] [pid 65000:tid 65051] [client 89.251.0.127:36853] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:27:59.733054 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.127:36853] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aelZf76vRb9j6psK2ZaarAAAAgg"]
[Thu Apr 23 07:28:00.447015 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.137:22893] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/network.php"] [unique_id "aelZgJXyGZJFeAIDWtlalwAAAVE"]
[Thu Apr 23 07:28:01.167298 2026] [proxy_fcgi:error] [pid 43083:tid 43096] [client 89.251.0.120:22755] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:03.338123 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.120:22755] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aelZgzC5hrvNXosL83LMtAAAANU"]
[Thu Apr 23 07:28:04.046145 2026] [:error] [pid 64967:tid 64971] [client 89.251.0.113:35649] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/item.php"] [unique_id "aelZhIAV4GfOOdX8QzoUPwAAAYI"]
[Thu Apr 23 07:28:05.851652 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.124:49227] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aelZhW6I0QqmmmLTHE3bpgAAAJU"]
[Thu Apr 23 07:28:07.460611 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.138:32279] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/install.php"] [unique_id "aelZh4V5EysYcTLjmwj3_wAAAcU"]
[Thu Apr 23 07:28:08.088959 2026] [proxy_fcgi:error] [pid 43083:tid 43088] [client 89.251.0.116:41887] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:08.376292 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.116:41887] [client 89.251.0.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.116, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aelZiDC5hrvNXosL83LM6gAAANE"]
[Thu Apr 23 07:28:08.701286 2026] [proxy_fcgi:error] [pid 43083:tid 43095] [client 89.251.0.116:41887] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:09.091261 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.116:41887] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aelZiTC5hrvNXosL83LM-gAAAMw"]
[Thu Apr 23 07:28:10.655788 2026] [:error] [pid 64998:tid 65006] [client 89.251.0.140:55665] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aelZioV5EysYcTLjmwj4LwAAAcQ"]
[Thu Apr 23 07:28:11.411902 2026] [proxy_fcgi:error] [pid 65000:tid 65049] [client 89.251.0.128:46653] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:11.817262 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.128:46653] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aelZi76vRb9j6psK2ZabRAAAAgA"]
[Thu Apr 23 07:28:12.519805 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.142:45211] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aelZjDEP2_5RswrH8bGroAAAAAU"]
[Thu Apr 23 07:28:13.156334 2026] [proxy_fcgi:error] [pid 42973:tid 43061] [client 89.251.0.114:31901] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:14.090989 2026] [:error] [pid 42973:tid 43049] [client 89.251.0.114:31901] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aelZjm6I0QqmmmLTHE3b3wAAAIY"]
[Thu Apr 23 07:28:15.370445 2026] [:error] [pid 64967:tid 64985] [client 89.251.0.147:52677] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "aelZj4AV4GfOOdX8QzoUtAAAAZA"]
[Thu Apr 23 07:28:15.950319 2026] [proxy_fcgi:error] [pid 42971:tid 42990] [client 89.251.0.131:34941] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:16.707362 2026] [proxy_fcgi:error] [pid 42971:tid 43008] [client 89.251.0.131:34941] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:17.322464 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.131:34941] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aelZkTEP2_5RswrH8bGr5wAAABY"]
[Thu Apr 23 07:28:17.907245 2026] [:error] [pid 64967:tid 64992] [client 89.251.0.138:61065] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/bypass.php"] [unique_id "aelZkYAV4GfOOdX8QzoUzgAAAZc"]
[Thu Apr 23 07:28:18.815124 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.144:65287] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/count.php"] [unique_id "aelZkr6vRb9j6psK2ZabrQAAAgg"]
[Thu Apr 23 07:28:19.405311 2026] [proxy_fcgi:error] [pid 64998:tid 65006] [client 89.251.0.123:31459] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:21.835913 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.123:31459] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aelZlYV5EysYcTLjmwj4lAAAAc8"]
[Thu Apr 23 07:28:23.196187 2026] [:error] [pid 43083:tid 43093] [client 89.251.0.126:57239] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "switchcreative.net"] [uri "/images/stories/themes.php"] [unique_id "aelZlzC5hrvNXosL83LNygAAAMg"]
[Thu Apr 23 07:28:23.483979 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.126:57239] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aelZlzC5hrvNXosL83LN0gAAANQ"]
[Thu Apr 23 07:28:24.684398 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.124:60127] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aelZmL6vRb9j6psK2ZacGwAAAgo"]
[Thu Apr 23 07:28:25.330625 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.121:35921] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/vars-soap.php"] [unique_id "aelZmYAV4GfOOdX8QzoVGgAAAZg"]
[Thu Apr 23 07:28:26.622634 2026] [proxy_fcgi:error] [pid 25635:tid 25640] [client 89.251.0.114:38245] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:28.431204 2026] [:error] [pid 25635:tid 25648] [client 89.251.0.114:38245] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aelZnMRxv6UsgRGKB3LjLQAAAQk"]
[Thu Apr 23 07:28:29.694432 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.114:42395] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aelZnb6vRb9j6psK2ZacVQAAAhc"]
[Thu Apr 23 07:28:31.998794 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.114:56583] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aelZnzEP2_5RswrH8bGsSQAAABA"]
[Thu Apr 23 07:28:33.249305 2026] [proxy_fcgi:error] [pid 65000:tid 65057] [client 89.251.0.115:45369] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:34.560288 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 89.251.0.115:45369] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:34.862381 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.115:45369] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aelZor6vRb9j6psK2ZacjAAAAgU"]
[Thu Apr 23 07:28:35.475073 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.133:27069] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/colour.php"] [unique_id "aelZozEP2_5RswrH8bGsVwAAAAU"]
[Thu Apr 23 07:28:36.195800 2026] [proxy_fcgi:error] [pid 64967:tid 64987] [client 89.251.0.151:48091] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:36.519350 2026] [:error] [pid 64967:tid 64991] [client 89.251.0.151:48091] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aelZpIAV4GfOOdX8QzoVgQAAAZY"]
[Thu Apr 23 07:28:37.163548 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.116:27877] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/include.php"] [unique_id "aelZpb6vRb9j6psK2ZackQAAAg0"]
[Thu Apr 23 07:28:38.605545 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.125:64177] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aelZpjC5hrvNXosL83LOhwAAAMk"]
[Thu Apr 23 07:28:40.479420 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.123:37079] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aelZqL6vRb9j6psK2Zac0gAAAgw"]
[Thu Apr 23 07:28:41.176816 2026] [:error] [pid 64998:tid 65009] [client 89.251.0.125:39249] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about5.php"] [unique_id "aelZqYV5EysYcTLjmwj5WgAAAcc"]
[Thu Apr 23 07:28:43.288152 2026] [proxy_fcgi:error] [pid 42973:tid 43058] [client 89.251.0.143:20907] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:43.644308 2026] [:error] [pid 42973:tid 43055] [client 89.251.0.143:20907] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/db.php"] [unique_id "aelZq26I0QqmmmLTHE3cdQAAAIw"]
[Thu Apr 23 07:28:45.868881 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.140:65025] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aelZrb6vRb9j6psK2ZadGwAAAg0"]
[Thu Apr 23 07:28:46.622301 2026] [proxy_fcgi:error] [pid 42972:tid 43018] [client 89.251.0.138:50077] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:47.696278 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.138:50077] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aelZr8OAb-3sOknsk4ciyAAAAEg"]
[Thu Apr 23 07:28:48.410587 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.145:33363] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aelZsL6vRb9j6psK2ZadMAAAAgs"]
[Thu Apr 23 07:28:49.166019 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.116:53121] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aelZscOAb-3sOknsk4ci4AAAAEQ"]
[Thu Apr 23 07:28:49.887760 2026] [proxy_fcgi:error] [pid 42972:tid 43022] [client 89.251.0.125:63329] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:50.758565 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.125:63329] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aelZssOAb-3sOknsk4cjBAAAAE0"]
[Thu Apr 23 07:28:51.414320 2026] [proxy_fcgi:error] [pid 64998:tid 65020] [client 89.251.0.131:52663] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:28:52.114909 2026] [:error] [pid 64998:tid 65004] [client 89.251.0.131:52663] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aelZtIV5EysYcTLjmwj57gAAAcI"]
[Thu Apr 23 07:28:53.397000 2026] [:error] [pid 25635:tid 25654] [client 89.251.0.147:43129] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aelZtcRxv6UsgRGKB3LjpQAAAQ8"]
[Thu Apr 23 07:28:54.319071 2026] [:error] [pid 64998:tid 65014] [client 89.251.0.114:52169] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/about.php"] [unique_id "aelZtoV5EysYcTLjmwj6BgAAAcw"]
[Thu Apr 23 07:28:54.951347 2026] [:error] [pid 59700:tid 59717] [client 89.251.0.123:64007] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/simi.php"] [unique_id "aelZtpXyGZJFeAIDWtlcYQAAAU8"]
[Thu Apr 23 07:28:56.297284 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.133:63413] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aelZuIAV4GfOOdX8QzoV9QAAAZE"]
[Thu Apr 23 07:28:57.928557 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.114:49173] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aelZuYV5EysYcTLjmwj6JwAAAcg"]
[Thu Apr 23 07:28:58.556891 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.119:44317] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aelZupXyGZJFeAIDWtlciAAAAVY"]
[Thu Apr 23 07:28:59.224535 2026] [:error] [pid 59700:tid 59720] [client 89.251.0.125:61179] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aelZu5XyGZJFeAIDWtlcjwAAAVI"]
[Thu Apr 23 07:29:00.533750 2026] [:error] [pid 64998:tid 65014] [client 89.251.0.135:20587] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aelZvIV5EysYcTLjmwj6UAAAAcw"]
[Thu Apr 23 07:29:02.356565 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.140:23493] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aelZvoV5EysYcTLjmwj6ZQAAAdM"]
[Thu Apr 23 07:29:03.223958 2026] [:error] [pid 42971:tid 42999] [client 89.251.0.150:21625] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aelZvzEP2_5RswrH8bGtTQAAAA0"]
[Thu Apr 23 07:29:04.315972 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.120:52563] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aelZwL6vRb9j6psK2Zad1gAAAgw"]
[Thu Apr 23 07:29:05.548576 2026] [proxy_fcgi:error] [pid 64998:tid 65016] [client 89.251.0.136:42239] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:07.232515 2026] [:error] [pid 64998:tid 65003] [client 89.251.0.136:42239] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugin.php"] [unique_id "aelZw4V5EysYcTLjmwj6qAAAAcE"]
[Thu Apr 23 07:29:08.931836 2026] [:error] [pid 64967:tid 64969] [client 89.251.0.129:57307] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aelZxIAV4GfOOdX8QzoWLwAAAYA"]
[Thu Apr 23 07:29:10.043315 2026] [proxy_fcgi:error] [pid 42972:tid 43032] [client 89.251.0.145:31409] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:10.406993 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.145:31409] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aelZxsOAb-3sOknsk4cjhwAAAEI"]
[Thu Apr 23 07:29:12.529897 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.119:25681] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aelZyL6vRb9j6psK2ZaeCAAAAhQ"]
[Thu Apr 23 07:29:13.465307 2026] [proxy_fcgi:error] [pid 64998:tid 65005] [client 89.251.0.134:31905] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:13.796566 2026] [:error] [pid 64998:tid 65019] [client 89.251.0.134:31905] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aelZyYV5EysYcTLjmwj63QAAAdE"]
[Thu Apr 23 07:29:14.525316 2026] [proxy_fcgi:error] [pid 65000:tid 65031] [client 89.251.0.113:28669] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:15.178850 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.113:28669] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aelZy76vRb9j6psK2ZaeLAAAAhI"]
[Thu Apr 23 07:29:15.833611 2026] [proxy_fcgi:error] [pid 43083:tid 43102] [client 89.251.0.128:48193] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:16.279760 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.128:48193] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aelZzDC5hrvNXosL83LQAAAAANQ"]
[Thu Apr 23 07:29:17.331016 2026] [:error] [pid 64967:tid 64992] [client 89.251.0.119:61747] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aelZzYAV4GfOOdX8QzoWVwAAAZc"]
[Thu Apr 23 07:29:19.027283 2026] [proxy_fcgi:error] [pid 42973:tid 43067] [client 89.251.0.151:59891] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:19.337605 2026] [:error] [pid 42973:tid 43062] [client 89.251.0.151:59891] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aelZz26I0QqmmmLTHE3dSwAAAJM"]
[Thu Apr 23 07:29:20.887331 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.148:37127] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aelZ0DC5hrvNXosL83LQLgAAANc"]
[Thu Apr 23 07:29:21.515298 2026] [proxy_fcgi:error] [pid 64967:tid 64987] [client 89.251.0.119:53153] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:21.888665 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.119:53153] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aelZ0YAV4GfOOdX8QzoWdgAAAZE"]
[Thu Apr 23 07:29:22.613365 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.132:42307] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aelZ0sOAb-3sOknsk4ckFAAAAEA"]
[Thu Apr 23 07:29:23.210308 2026] [proxy_fcgi:error] [pid 59700:tid 59708] [client 89.251.0.121:30907] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:23.844542 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.121:30907] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aelZ05XyGZJFeAIDWtldaAAAAUA"]
[Thu Apr 23 07:29:24.499046 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.114:51199] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aelZ1IV5EysYcTLjmwj7FwAAAcU"]
[Thu Apr 23 07:29:27.182398 2026] [:error] [pid 64998:tid 65004] [client 89.251.0.131:50723] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-2019.php"] [unique_id "aelZ14V5EysYcTLjmwj7UQAAAcI"]
[Thu Apr 23 07:29:27.778089 2026] [:error] [pid 43083:tid 43096] [client 89.251.0.123:34359] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aelZ1zC5hrvNXosL83LQggAAAMs"]
[Thu Apr 23 07:29:28.827035 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.115:25633] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/log.php"] [unique_id "aelZ2L6vRb9j6psK2ZaeogAAAgA"]
[Thu Apr 23 07:29:29.444136 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.134:43019] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aelZ2ZXyGZJFeAIDWtldiwAAAVE"]
[Thu Apr 23 07:29:30.134577 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.135:59195] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aelZ2sOAb-3sOknsk4ckSQAAAEQ"]
[Thu Apr 23 07:29:30.903651 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.113:61015] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/aw.php"] [unique_id "aelZ2jC5hrvNXosL83LQuAAAAMI"]
[Thu Apr 23 07:29:33.869136 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.148:51677] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/db.php"] [unique_id "aelZ3TC5hrvNXosL83LQ1wAAAMI"]
[Thu Apr 23 07:29:34.523586 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.119:32665] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/install.php"] [unique_id "aelZ3r6vRb9j6psK2ZaexgAAAg8"]
[Thu Apr 23 07:29:35.482353 2026] [proxy_fcgi:error] [pid 65000:tid 65057] [client 89.251.0.142:57861] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:35.869571 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.142:57861] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aelZ376vRb9j6psK2Zae8wAAAgg"]
[Thu Apr 23 07:29:36.585993 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.126:45651] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aelZ4DC5hrvNXosL83LRBgAAAMo"]
[Thu Apr 23 07:29:38.005254 2026] [:error] [pid 43083:tid 43100] [client 89.251.0.144:32021] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/template-less.php"] [unique_id "aelZ4jC5hrvNXosL83LRRQAAAM8"]
[Thu Apr 23 07:29:38.730691 2026] [:error] [pid 43083:tid 43094] [client 89.251.0.125:43857] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aelZ4jC5hrvNXosL83LRawAAAMk"]
[Thu Apr 23 07:29:41.692618 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.146:46097] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/min.php"] [unique_id "aelZ5b6vRb9j6psK2ZafDwAAAhY"]
[Thu Apr 23 07:29:42.394648 2026] [:error] [pid 64998:tid 65023] [client 89.251.0.136:33367] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aelZ5oV5EysYcTLjmwj7-QAAAdU"]
[Thu Apr 23 07:29:43.533378 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.132:60929] [client 89.251.0.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/uploads.php"] [unique_id "aelZ54V5EysYcTLjmwj8DgAAAcg"]
[Thu Apr 23 07:29:44.440865 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.142:40639] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/file.php"] [unique_id "aelZ6DC5hrvNXosL83LRqgAAANg"]
[Thu Apr 23 07:29:45.385606 2026] [:error] [pid 59700:tid 59712] [client 89.251.0.131:26959] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aelZ6ZXyGZJFeAIDWtlecgAAAUo"]
[Thu Apr 23 07:29:46.563370 2026] [:error] [pid 43083:tid 43088] [client 89.251.0.133:43389] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/load.php"] [unique_id "aelZ6jC5hrvNXosL83LRugAAAMM"]
[Thu Apr 23 07:29:47.273174 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.113:61951] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aelZ64V5EysYcTLjmwj8QwAAAcU"]
[Thu Apr 23 07:29:47.873563 2026] [:error] [pid 59700:tid 59712] [client 89.251.0.137:44221] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aelZ65XyGZJFeAIDWtlemgAAAUo"]
[Thu Apr 23 07:29:48.538627 2026] [proxy_fcgi:error] [pid 64998:tid 65003] [client 89.251.0.142:62177] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:49.492719 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.142:62177] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aelZ7YV5EysYcTLjmwj8aAAAAdY"]
[Thu Apr 23 07:29:50.231550 2026] [proxy_fcgi:error] [pid 43083:tid 43086] [client 89.251.0.144:29555] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:50.542712 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.144:29555] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aelZ7jC5hrvNXosL83LSAQAAAMw"]
[Thu Apr 23 07:29:51.536596 2026] [proxy_fcgi:error] [pid 42972:tid 43032] [client 89.251.0.139:28005] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:51.827645 2026] [:error] [pid 42972:tid 43030] [client 89.251.0.139:28005] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aelZ78OAb-3sOknsk4ckzgAAAE4"]
[Thu Apr 23 07:29:52.628350 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.116:49579] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aelZ8L6vRb9j6psK2ZafngAAAgI"]
[Thu Apr 23 07:29:53.249826 2026] [:error] [pid 64998:tid 65020] [client 89.251.0.140:30143] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aelZ8YV5EysYcTLjmwj8nAAAAdI"]
[Thu Apr 23 07:29:55.264303 2026] [proxy_fcgi:error] [pid 43083:tid 43097] [client 89.251.0.141:39417] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:56.782882 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.141:39417] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/system.php"] [unique_id "aelZ9DC5hrvNXosL83LScAAAANE"]
[Thu Apr 23 07:29:57.742209 2026] [:error] [pid 42972:tid 43034] [client 89.251.0.126:24845] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aelZ9cOAb-3sOknsk4ck-gAAAFI"]
[Thu Apr 23 07:29:58.661311 2026] [proxy_fcgi:error] [pid 59700:tid 59703] [client 89.251.0.147:41729] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 07:29:59.290831 2026] [:error] [pid 59700:tid 59721] [client 89.251.0.147:41729] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aelZ95XyGZJFeAIDWtlfAAAAAVM"]
[Thu Apr 23 07:29:59.918740 2026] [:error] [pid 42972:tid 43018] [client 89.251.0.141:21751] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aelZ98OAb-3sOknsk4clKAAAAEI"]
[Thu Apr 23 07:30:00.730115 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.128:64607] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aelZ-DEP2_5RswrH8bGvsQAAAA4"]
[Thu Apr 23 07:30:03.139574 2026] [:error] [pid 64998:tid 65024] [client 89.251.0.125:24771] [client 89.251.0.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aelZ-4V5EysYcTLjmwj8zQAAAdY"]
[Thu Apr 23 07:30:06.688690 2026] [:error] [pid 25635:tid 25650] [client 89.251.0.148:22563] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ms-pie.php"] [unique_id "aelZ_sRxv6UsgRGKB3LlRwAAAQs"]
[Thu Apr 23 07:30:09.331441 2026] [:error] [pid 64967:tid 64992] [client 89.251.0.131:29289] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/index.php"] [unique_id "aelaAYAV4GfOOdX8QzoXOQAAAZc"]
[Thu Apr 23 07:30:10.867909 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.114:59723] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/nav-menu.php"] [unique_id "aelaAm6I0QqmmmLTHE3eCQAAAJU"]
[Thu Apr 23 07:30:11.562626 2026] [:error] [pid 64967:tid 64975] [client 89.251.0.114:42223] [client 89.251.0.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aelaA4AV4GfOOdX8QzoXRQAAAYY"]
[Thu Apr 23 07:30:16.330368 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.140:21933] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aelaCJXyGZJFeAIDWtlfbgAAAUE"]
[Thu Apr 23 07:30:17.148856 2026] [:error] [pid 42972:tid 43036] [client 89.251.0.147:23651] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aelaCcOAb-3sOknsk4clvQAAAFQ"]
[Thu Apr 23 07:30:17.807278 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.136:25331] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aelaCb6vRb9j6psK2ZagcgAAAgw"]
[Thu Apr 23 07:30:18.837697 2026] [:error] [pid 65000:tid 65045] [client 89.251.0.113:56515] [client 89.251.0.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.113, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aelaCr6vRb9j6psK2ZagqgAAAgw"]
[Thu Apr 23 07:30:19.489287 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.113:56515] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aelaC76vRb9j6psK2Zag3wAAAhA"]
[Thu Apr 23 07:30:20.207453 2026] [:error] [pid 42971:tid 42986] [client 89.251.0.140:65405] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aelaDDEP2_5RswrH8bGwNwAAAAA"]
[Thu Apr 23 07:30:20.920720 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.147:64383] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aelaDJXyGZJFeAIDWtlffwAAAUU"]
[Thu Apr 23 07:30:23.734945 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.128:40213] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aelaD5XyGZJFeAIDWtlfpAAAAUM"]
[Thu Apr 23 07:30:27.111653 2026] [:error] [pid 42973:tid 43066] [client 89.251.0.134:64833] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aelaE26I0QqmmmLTHE3eMQAAAJc"]
[Thu Apr 23 07:30:28.506568 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.115:33429] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aelaFJXyGZJFeAIDWtlf8gAAAUU"]
[Thu Apr 23 07:30:38.913143 2026] [:error] [pid 43083:tid 43097] [client 89.251.0.121:25211] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aelaHjC5hrvNXosL83LTtQAAAMw"]
[Thu Apr 23 07:30:39.600803 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.142:29687] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aelaH76vRb9j6psK2Zah7QAAAg8"]
[Thu Apr 23 07:30:42.612772 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.145:56927] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aelaIoV5EysYcTLjmwj-LAAAAc4"]
[Thu Apr 23 07:30:43.266799 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.141:46051] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aelaIzC5hrvNXosL83LTvQAAANQ"]
[Thu Apr 23 07:30:45.164598 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.148:40053] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aelaJcOAb-3sOknsk4cmXwAAAEQ"]
[Thu Apr 23 07:30:45.752867 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.128:50067] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aelaJb6vRb9j6psK2ZaiLAAAAg4"]
[Thu Apr 23 07:30:48.838113 2026] [:error] [pid 64998:tid 65012] [client 89.251.0.115:28177] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aelaKIV5EysYcTLjmwj-TwAAAco"]
[Thu Apr 23 07:30:51.100684 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.150:26511] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aelaK76vRb9j6psK2ZaigQAAAgM"]
[Thu Apr 23 07:30:51.750658 2026] [:error] [pid 65000:tid 65057] [client 89.251.0.141:62953] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aelaK76vRb9j6psK2ZaikgAAAhg"]
[Thu Apr 23 07:31:00.625799 2026] [autoindex:error] [pid 43083:tid 43091] [client 89.251.0.143:34439] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:31:33.901662 2026] [autoindex:error] [pid 43083:tid 43105] [client 89.251.0.143:34439] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 08:00:49.333929 2026] [:error] [pid 42971:tid 43004] [client 43.153.96.233:48864] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aelhMTEP2_5RswrH8bG-kwAAABI"]
[Thu Apr 23 08:08:38.291872 2026] [:error] [pid 64998:tid 65005] [client 51.68.234.121:59088] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aeljBoV5EysYcTLjmwgweQAAAcM"]
[Thu Apr 23 08:08:40.613413 2026] [:error] [pid 42973:tid 43047] [client 51.68.234.121:43874] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aeljCG6I0QqmmmLTHE3jPgAAAIQ"]
[Thu Apr 23 08:08:43.367545 2026] [:error] [pid 64998:tid 65003] [client 51.68.234.121:43600] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aeljC4V5EysYcTLjmwgwhgAAAcE"]
[Thu Apr 23 08:08:45.279480 2026] [:error] [pid 65000:tid 65046] [client 51.68.234.121:53248] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aeljDb6vRb9j6psK2ZbLWAAAAg0"]
[Thu Apr 23 08:08:47.877660 2026] [:error] [pid 25635:tid 25648] [client 51.68.234.121:47734] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aeljD8Rxv6UsgRGKB3Lr_QAAAQk"]
[Thu Apr 23 08:08:50.341774 2026] [:error] [pid 42973:tid 43048] [client 51.68.234.121:47744] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aeljEm6I0QqmmmLTHE3jQQAAAIU"]
[Thu Apr 23 08:08:52.979669 2026] [:error] [pid 64998:tid 65004] [client 51.68.234.121:47746] [client 51.68.234.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aeljFIV5EysYcTLjmwgwmAAAAcI"]
[Thu Apr 23 08:24:17.449160 2026] [:error] [pid 64998:tid 65019] [client 3.65.40.162:64289] [client 3.65.40.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aelmsYV5EysYcTLjmwg4BwAAAdE"]
[Thu Apr 23 09:28:38.007100 2026] [:error] [pid 43083:tid 43088] [client 49.51.132.100:59652] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ael1xjC5hrvNXosL83IEaAAAAMM"]
[Thu Apr 23 12:13:16.331310 2026] [:error] [pid 42973:tid 43058] [client 182.252.67.97:8806] [client 182.252.67.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.252.67.97, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aemcXG6I0QqmmmLTHE09rQAAAI8"]
[Thu Apr 23 12:13:16.347203 2026] [proxy_fcgi:error] [pid 42973:tid 43058] [client 182.252.67.97:8806] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 14:22:17.892491 2026] [:error] [pid 42973:tid 43043] [client 93.158.213.26:54642] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aem6mW6I0QqmmmLTHE2JggAAAIA"]
[Thu Apr 23 14:22:20.340174 2026] [:error] [pid 43083:tid 43107] [client 93.158.213.26:48948] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aem6nDC5hrvNXosL83JFXQAAANY"]
[Thu Apr 23 14:22:22.268451 2026] [:error] [pid 42973:tid 43066] [client 93.158.213.26:48952] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aem6nm6I0QqmmmLTHE2JigAAAJc"]
[Thu Apr 23 14:22:24.581466 2026] [:error] [pid 64967:tid 64990] [client 93.158.213.26:59260] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aem6oIAV4GfOOdX8QzpNvgAAAZU"]
[Thu Apr 23 14:22:26.936582 2026] [:error] [pid 64967:tid 64977] [client 93.158.213.26:59268] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aem6ooAV4GfOOdX8QzpNvwAAAYg"]
[Thu Apr 23 14:22:29.006922 2026] [:error] [pid 42973:tid 43060] [client 93.158.213.26:59274] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aem6pW6I0QqmmmLTHE2JmQAAAJE"]
[Thu Apr 23 14:22:31.041176 2026] [:error] [pid 42971:tid 42997] [client 93.158.213.26:59278] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aem6pzEP2_5RswrH8bH_5gAAAAs"]
[Thu Apr 23 14:22:33.225458 2026] [:error] [pid 42972:tid 43039] [client 93.158.213.26:51456] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aem6qcOAb-3sOknsk4edjgAAAFc"]
[Thu Apr 23 15:16:26.548788 2026] [:error] [pid 42972:tid 43038] [client 43.128.104.75:48274] [client 43.128.104.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aenHSsOAb-3sOknsk4et8AAAAFY"]
[Thu Apr 23 15:19:54.731120 2026] [:error] [pid 42971:tid 42993] [client 123.187.240.242:34580] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aenIGjEP2_5RswrH8bEGCwAAAAc"]
[Thu Apr 23 16:21:40.622660 2026] [:error] [pid 46953:tid 46968] [client 54.36.179.84:38790] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aenWlEnlpdHh-P6wKboHfgAAAkw"]
[Thu Apr 23 16:21:44.434042 2026] [:error] [pid 42973:tid 43050] [client 54.36.179.84:38794] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aenWmG6I0QqmmmLTHE3IHwAAAIc"]
[Thu Apr 23 16:21:49.279668 2026] [:error] [pid 42972:tid 43019] [client 54.36.179.84:51076] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aenWncOAb-3sOknsk4fNlQAAAEM"]
[Thu Apr 23 16:21:54.005482 2026] [:error] [pid 42972:tid 43016] [client 54.36.179.84:51090] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aenWosOAb-3sOknsk4fNqwAAAEA"]
[Thu Apr 23 16:21:59.091982 2026] [:error] [pid 64967:tid 64979] [client 54.36.179.84:37812] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aenWp4AV4GfOOdX8QzpYtAAAAYo"]
[Thu Apr 23 16:22:02.384012 2026] [:error] [pid 43083:tid 43090] [client 54.36.179.84:37824] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aenWqjC5hrvNXosL83JTBAAAAMU"]
[Thu Apr 23 17:03:14.720843 2026] [:error] [pid 46953:tid 46971] [client 46.31.79.28:48170] [client 46.31.79.28] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aengUknlpdHh-P6wKboOHwAAAk8"]
[Thu Apr 23 17:40:36.189251 2026] [autoindex:error] [pid 64998:tid 65019] [client 62.171.154.215:60164] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 23 19:05:12.471681 2026] [:error] [pid 64967:tid 64975] [client 51.68.32.135:55864] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aen86IAV4GfOOdX8QzpoHwAAAYY"]
[Thu Apr 23 19:05:14.329952 2026] [:error] [pid 65000:tid 65046] [client 51.68.32.135:49988] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aen86r6vRb9j6psK2ZYf5wAAAg0"]
[Thu Apr 23 19:05:16.316897 2026] [:error] [pid 42972:tid 43020] [client 51.68.32.135:35636] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aen87MOAb-3sOknsk4cFIQAAAEQ"]
[Thu Apr 23 19:05:18.078006 2026] [:error] [pid 65000:tid 65052] [client 51.68.32.135:35642] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aen87r6vRb9j6psK2ZYf_gAAAhM"]
[Thu Apr 23 19:05:20.024804 2026] [:error] [pid 65000:tid 65032] [client 51.68.32.135:35658] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aen88L6vRb9j6psK2ZYgJgAAAgM"]
[Thu Apr 23 19:05:22.117120 2026] [:error] [pid 59700:tid 59717] [client 51.68.32.135:35670] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aen88pXyGZJFeAIDWtkLUgAAAU8"]
[Thu Apr 23 19:05:24.103837 2026] [:error] [pid 42972:tid 43019] [client 51.68.32.135:35674] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aen89MOAb-3sOknsk4cFKQAAAEM"]
[Thu Apr 23 19:05:26.022719 2026] [:error] [pid 42972:tid 43024] [client 51.68.32.135:39218] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aen89sOAb-3sOknsk4cFLQAAAEg"]
[Thu Apr 23 19:05:27.942998 2026] [:error] [pid 65000:tid 65031] [client 51.68.32.135:39222] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aen8976vRb9j6psK2ZYgNwAAAgI"]
[Thu Apr 23 19:05:29.900551 2026] [:error] [pid 46953:tid 46961] [client 51.68.32.135:39226] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aen8-UnlpdHh-P6wKbogswAAAkU"]
[Thu Apr 23 19:05:31.968636 2026] [:error] [pid 42971:tid 42989] [client 51.68.32.135:39236] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aen8-zEP2_5RswrH8bEbkAAAAAM"]
[Thu Apr 23 19:05:34.032460 2026] [:error] [pid 65000:tid 65037] [client 51.68.32.135:39244] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aen8_r6vRb9j6psK2ZYgQQAAAgQ"]
[Thu Apr 23 19:05:35.946081 2026] [:error] [pid 64998:tid 65019] [client 51.68.32.135:52812] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aen8_4V5EysYcTLjmwg0wQAAAdE"]
[Thu Apr 23 19:05:37.868194 2026] [:error] [pid 59700:tid 59719] [client 51.68.32.135:52822] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aen9AZXyGZJFeAIDWtkLaAAAAVE"]
[Thu Apr 23 19:05:39.784870 2026] [:error] [pid 64967:tid 64993] [client 51.68.32.135:52832] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aen9A4AV4GfOOdX8QzpoNAAAAZg"]
[Thu Apr 23 19:05:41.683107 2026] [:error] [pid 64967:tid 64969] [client 51.68.32.135:52846] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aen9BYAV4GfOOdX8QzpoNgAAAYA"]
[Thu Apr 23 19:05:43.577018 2026] [:error] [pid 42972:tid 43032] [client 51.68.32.135:52854] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aen9B8OAb-3sOknsk4cFQgAAAFA"]
[Thu Apr 23 19:05:45.477000 2026] [:error] [pid 64967:tid 64970] [client 51.68.32.135:48428] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aen9CYAV4GfOOdX8QzpoOQAAAYE"]
[Thu Apr 23 19:05:47.508936 2026] [:error] [pid 65000:tid 65055] [client 51.68.32.135:48438] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aen9C76vRb9j6psK2ZYgfAAAAhY"]
[Thu Apr 23 19:05:49.397830 2026] [:error] [pid 65000:tid 65055] [client 51.68.32.135:48440] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aen9Db6vRb9j6psK2ZYgigAAAhY"]
[Thu Apr 23 19:05:51.429033 2026] [:error] [pid 65000:tid 65049] [client 51.68.32.135:48448] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aen9D76vRb9j6psK2ZYglgAAAhA"]
[Thu Apr 23 19:05:53.457686 2026] [:error] [pid 65000:tid 65052] [client 51.68.32.135:48464] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aen9Eb6vRb9j6psK2ZYgpQAAAhM"]
[Thu Apr 23 19:05:55.490995 2026] [:error] [pid 64998:tid 65009] [client 51.68.32.135:46814] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aen9E4V5EysYcTLjmwg03QAAAcc"]
[Thu Apr 23 19:05:57.521597 2026] [:error] [pid 42973:tid 43062] [client 51.68.32.135:46830] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aen9FW6I0QqmmmLTHE30UgAAAJM"]
[Thu Apr 23 19:05:59.527183 2026] [:error] [pid 43083:tid 43092] [client 51.68.32.135:46838] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aen9FzC5hrvNXosL83JlTgAAAMc"]
[Thu Apr 23 19:06:01.420437 2026] [:error] [pid 42972:tid 43025] [client 51.68.32.135:46840] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aen9GcOAb-3sOknsk4cFWAAAAEk"]
[Thu Apr 23 19:06:03.370474 2026] [:error] [pid 59700:tid 59711] [client 51.68.32.135:60392] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aen9G5XyGZJFeAIDWtkLhAAAAUk"]
[Thu Apr 23 19:06:07.495335 2026] [:error] [pid 64998:tid 65007] [client 51.68.32.135:46468] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aen9H4V5EysYcTLjmwg0_QAAAcU"]
[Thu Apr 23 19:06:09.814629 2026] [:error] [pid 42972:tid 43016] [client 51.68.32.135:39596] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aen9IcOAb-3sOknsk4cFbAAAAEA"]
[Thu Apr 23 19:06:30.799873 2026] [:error] [pid 65000:tid 65040] [client 51.68.32.135:44026] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aen9Nr6vRb9j6psK2ZYhEAAAAgc"]
[Thu Apr 23 19:06:32.742758 2026] [:error] [pid 42972:tid 43035] [client 51.68.32.135:44634] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aen9OMOAb-3sOknsk4cFigAAAFM"]
[Thu Apr 23 19:06:34.745142 2026] [:error] [pid 42973:tid 43054] [client 51.68.32.135:44646] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aen9Om6I0QqmmmLTHE30ewAAAIs"]
[Thu Apr 23 19:06:36.764910 2026] [:error] [pid 65000:tid 65053] [client 51.68.32.135:37302] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aen9PL6vRb9j6psK2ZYhGQAAAhQ"]
[Thu Apr 23 19:06:38.785762 2026] [:error] [pid 64998:tid 65008] [client 51.68.32.135:37316] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aen9PoV5EysYcTLjmwg1HwAAAcY"]
[Thu Apr 23 19:06:40.789990 2026] [:error] [pid 43083:tid 43088] [client 51.68.32.135:37318] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aen9QDC5hrvNXosL83JlawAAAMM"]
[Thu Apr 23 19:06:42.825875 2026] [:error] [pid 43083:tid 43085] [client 51.68.32.135:37326] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aen9QjC5hrvNXosL83JldAAAAMA"]
[Thu Apr 23 19:06:44.683139 2026] [:error] [pid 42973:tid 43049] [client 51.68.32.135:37342] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aen9RG6I0QqmmmLTHE30iQAAAIY"]
[Thu Apr 23 19:06:46.715431 2026] [:error] [pid 42972:tid 43026] [client 51.68.32.135:34792] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aen9RsOAb-3sOknsk4cFnAAAAEo"]
[Thu Apr 23 19:06:48.714756 2026] [:error] [pid 42973:tid 43047] [client 51.68.32.135:34804] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aen9SG6I0QqmmmLTHE30ogAAAIQ"]
[Thu Apr 23 19:06:50.728336 2026] [:error] [pid 42972:tid 43019] [client 51.68.32.135:34816] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aen9SsOAb-3sOknsk4cFugAAAEM"]
[Thu Apr 23 19:06:52.740288 2026] [:error] [pid 43083:tid 43098] [client 51.68.32.135:34832] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aen9TDC5hrvNXosL83JleQAAAM0"]
[Thu Apr 23 19:06:54.597660 2026] [:error] [pid 42972:tid 43028] [client 51.68.32.135:34834] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aen9TsOAb-3sOknsk4cFxwAAAEw"]
[Thu Apr 23 19:06:56.596928 2026] [:error] [pid 43083:tid 43109] [client 51.68.32.135:36982] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aen9UDC5hrvNXosL83JlfAAAANg"]
[Thu Apr 23 19:06:58.613505 2026] [:error] [pid 65000:tid 65050] [client 51.68.32.135:36986] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aen9Ur6vRb9j6psK2ZYhWAAAAhE"]
[Thu Apr 23 19:07:00.618169 2026] [:error] [pid 46953:tid 46972] [client 51.68.32.135:37002] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aen9VEnlpdHh-P6wKbog7gAAAlA"]
[Thu Apr 23 19:07:02.636471 2026] [:error] [pid 42973:tid 43061] [client 51.68.32.135:37008] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aen9Vm6I0QqmmmLTHE30tAAAAJI"]
[Thu Apr 23 19:07:04.629060 2026] [:error] [pid 43083:tid 43092] [client 51.68.32.135:37016] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aen9WDC5hrvNXosL83JlgwAAAMc"]
[Thu Apr 23 19:07:06.648433 2026] [:error] [pid 64998:tid 65008] [client 51.68.32.135:40130] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aen9WoV5EysYcTLjmwg1TgAAAcY"]
[Thu Apr 23 19:07:08.645325 2026] [:error] [pid 64998:tid 65019] [client 51.68.32.135:40132] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aen9XIV5EysYcTLjmwg1aAAAAdE"]
[Thu Apr 23 19:07:10.644661 2026] [:error] [pid 43083:tid 43098] [client 51.68.32.135:40142] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aen9XjC5hrvNXosL83JlhgAAAM0"]
[Thu Apr 23 19:07:12.502734 2026] [:error] [pid 64998:tid 65007] [client 51.68.32.135:40156] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aen9YIV5EysYcTLjmwg1cQAAAcU"]
[Thu Apr 23 19:07:14.513084 2026] [:error] [pid 64998:tid 65010] [client 51.68.32.135:40170] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aen9YoV5EysYcTLjmwg1dAAAAcg"]
[Thu Apr 23 19:07:16.523861 2026] [:error] [pid 42972:tid 43027] [client 51.68.32.135:43828] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aen9ZMOAb-3sOknsk4cF1QAAAEs"]
[Thu Apr 23 19:07:18.520590 2026] [:error] [pid 43083:tid 43085] [client 51.68.32.135:43838] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aen9ZjC5hrvNXosL83JliAAAAMA"]
[Thu Apr 23 19:07:20.525144 2026] [:error] [pid 42972:tid 43039] [client 51.68.32.135:43844] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aen9aMOAb-3sOknsk4cF3wAAAFc"]
[Thu Apr 23 19:07:22.527284 2026] [:error] [pid 64998:tid 65018] [client 51.68.32.135:43860] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aen9aoV5EysYcTLjmwg1hAAAAdA"]
[Thu Apr 23 19:07:24.530446 2026] [:error] [pid 65000:tid 65049] [client 51.68.32.135:43862] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aen9bL6vRb9j6psK2ZYhdQAAAhA"]
[Thu Apr 23 19:07:26.536527 2026] [:error] [pid 59700:tid 59708] [client 51.68.32.135:50158] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aen9bpXyGZJFeAIDWtkMGwAAAUY"]
[Thu Apr 23 19:07:28.530433 2026] [:error] [pid 64998:tid 65018] [client 51.68.32.135:50172] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aen9cIV5EysYcTLjmwg1lAAAAdA"]
[Thu Apr 23 19:07:49.095076 2026] [:error] [pid 42973:tid 43048] [client 51.68.32.135:50182] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aen9hW6I0QqmmmLTHE30-gAAAIU"]
[Thu Apr 23 19:07:51.049509 2026] [:error] [pid 64967:tid 64976] [client 51.68.32.135:37350] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aen9h4AV4GfOOdX8QzpoeAAAAYc"]
[Thu Apr 23 19:07:53.049651 2026] [:error] [pid 64998:tid 65015] [client 51.68.32.135:37360] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aen9iYV5EysYcTLjmwg1qQAAAc0"]
[Thu Apr 23 19:07:55.052956 2026] [:error] [pid 65000:tid 65045] [client 51.68.32.135:37376] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aen9i76vRb9j6psK2ZYhqAAAAgw"]
[Thu Apr 23 19:07:57.051981 2026] [:error] [pid 65000:tid 65042] [client 51.68.32.135:35474] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aen9jb6vRb9j6psK2ZYhsgAAAgk"]
[Thu Apr 23 19:07:59.063636 2026] [:error] [pid 43083:tid 43090] [client 51.68.32.135:35486] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aen9jzC5hrvNXosL83JlpQAAAMU"]
[Thu Apr 23 19:08:01.063565 2026] [:error] [pid 65000:tid 65055] [client 51.68.32.135:35488] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aen9kb6vRb9j6psK2ZYhxAAAAhY"]
[Thu Apr 23 19:08:03.073046 2026] [:error] [pid 64998:tid 65019] [client 51.68.32.135:35500] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aen9k4V5EysYcTLjmwg1sQAAAdE"]
[Thu Apr 23 19:08:05.069874 2026] [:error] [pid 64967:tid 64984] [client 51.68.32.135:35502] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aen9lYAV4GfOOdX8QzpoeQAAAY8"]
[Thu Apr 23 19:08:07.079934 2026] [:error] [pid 25635:tid 25651] [client 51.68.32.135:48698] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aen9l8Rxv6UsgRGKB3IoyQAAAQw"]
[Thu Apr 23 19:08:09.081583 2026] [:error] [pid 65000:tid 65045] [client 51.68.32.135:48714] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aen9mb6vRb9j6psK2ZYhzQAAAgw"]
[Thu Apr 23 19:08:11.085941 2026] [:error] [pid 42971:tid 43000] [client 51.68.32.135:48720] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aen9mzEP2_5RswrH8bEbzAAAAA4"]
[Thu Apr 23 19:08:13.088073 2026] [:error] [pid 65000:tid 65041] [client 51.68.32.135:48736] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aen9nb6vRb9j6psK2ZYh0QAAAgg"]
[Thu Apr 23 19:08:15.098143 2026] [:error] [pid 64998:tid 65004] [client 51.68.32.135:48750] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aen9n4V5EysYcTLjmwg1vgAAAcI"]
[Thu Apr 23 19:08:17.094973 2026] [:error] [pid 25635:tid 25660] [client 51.68.32.135:39480] [client 51.68.32.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aen9ocRxv6UsgRGKB3IozwAAARU"]
[Thu Apr 23 19:14:21.503686 2026] [:error] [pid 42972:tid 43024] [client 180.153.236.102:24375] [client 180.153.236.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aen_DcOAb-3sOknsk4cIkgAAAEg"], referer: http://switchcreative.net/
[Thu Apr 23 19:39:28.232699 2026] [:error] [pid 25635:tid 25661] [client 51.77.218.191:59062] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeoE8MRxv6UsgRGKB3IruQAAARY"]
[Thu Apr 23 19:39:30.044129 2026] [:error] [pid 42972:tid 43038] [client 51.77.218.191:37854] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeoE8sOAb-3sOknsk4cRVQAAAFY"]
[Thu Apr 23 19:40:16.712741 2026] [:error] [pid 46953:tid 46966] [client 51.77.218.191:52022] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aeoFIEnlpdHh-P6wKbomowAAAko"]
[Thu Apr 23 19:40:18.655424 2026] [:error] [pid 64998:tid 65004] [client 51.77.218.191:52038] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeoFIoV5EysYcTLjmwhDEwAAAcI"]
[Thu Apr 23 19:40:22.761211 2026] [:error] [pid 42973:tid 43066] [client 51.77.218.191:39854] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aeoFJm6I0QqmmmLTHE3-TAAAAJc"]
[Thu Apr 23 19:40:24.738908 2026] [:error] [pid 65000:tid 65039] [client 51.77.218.191:42630] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aeoFKL6vRb9j6psK2ZY2igAAAgY"]
[Thu Apr 23 19:40:47.446587 2026] [:error] [pid 65000:tid 65032] [client 51.77.218.191:32862] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "aeoFP76vRb9j6psK2ZY2_QAAAgM"]
[Thu Apr 23 19:40:49.389448 2026] [:error] [pid 59700:tid 59706] [client 51.77.218.191:32866] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeoFQZXyGZJFeAIDWtkS7AAAAUQ"]
[Thu Apr 23 19:40:51.412040 2026] [:error] [pid 25635:tid 25656] [client 51.77.218.191:57504] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeoFQ8Rxv6UsgRGKB3Ir2QAAARE"]
[Thu Apr 23 19:40:53.414029 2026] [:error] [pid 42972:tid 43032] [client 51.77.218.191:57516] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeoFRcOAb-3sOknsk4cRygAAAFA"]
[Thu Apr 23 19:40:55.417435 2026] [:error] [pid 46953:tid 46957] [client 51.77.218.191:57520] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aeoFR0nlpdHh-P6wKbomwQAAAkE"]
[Thu Apr 23 19:40:57.296798 2026] [:error] [pid 42973:tid 43060] [client 51.77.218.191:57524] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeoFSW6I0QqmmmLTHE3-fAAAAJE"]
[Thu Apr 23 19:40:59.303939 2026] [:error] [pid 64998:tid 65017] [client 51.77.218.191:57526] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aeoFS4V5EysYcTLjmwhDRQAAAc8"]
[Thu Apr 23 19:41:01.362754 2026] [:error] [pid 65000:tid 65038] [client 51.77.218.191:55644] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeoFTb6vRb9j6psK2ZY3OAAAAgU"]
[Thu Apr 23 19:41:03.197095 2026] [:error] [pid 64998:tid 65018] [client 51.77.218.191:55646] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeoFT4V5EysYcTLjmwhDYAAAAdA"]
[Thu Apr 23 19:41:05.224882 2026] [:error] [pid 64998:tid 65002] [client 51.77.218.191:55662] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aeoFUYV5EysYcTLjmwhDbQAAAcA"]
[Thu Apr 23 19:41:07.240325 2026] [:error] [pid 59700:tid 59705] [client 51.77.218.191:55668] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeoFU5XyGZJFeAIDWtkTFAAAAUM"]
[Thu Apr 23 19:41:09.258132 2026] [:error] [pid 42973:tid 43063] [client 51.77.218.191:55672] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aeoFVW6I0QqmmmLTHE3-hgAAAJQ"]
[Thu Apr 23 19:41:11.182347 2026] [:error] [pid 64998:tid 65008] [client 51.77.218.191:34720] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeoFV4V5EysYcTLjmwhDiAAAAcY"]
[Thu Apr 23 19:41:13.171867 2026] [:error] [pid 59700:tid 59710] [client 51.77.218.191:34732] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeoFWZXyGZJFeAIDWtkTIgAAAUg"]
[Thu Apr 23 19:41:15.118401 2026] [:error] [pid 42973:tid 43051] [client 51.77.218.191:34748] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aeoFW26I0QqmmmLTHE3-lAAAAIg"]
[Thu Apr 23 20:56:37.246207 2026] [:error] [pid 42972:tid 43023] [client 145.239.195.38:55762] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeoXBcOAb-3sOknsk4cwkgAAAEc"]
[Thu Apr 23 20:56:37.353494 2026] [:error] [pid 42972:tid 43031] [client 145.239.195.38:55764] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeoXBcOAb-3sOknsk4cwkwAAAE8"]
[Thu Apr 23 20:56:37.396952 2026] [:error] [pid 42973:tid 43055] [client 145.239.195.38:55776] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "aeoXBW6I0QqmmmLTHE0Q_AAAAIw"]
[Thu Apr 23 20:56:39.167599 2026] [:error] [pid 64998:tid 65002] [client 145.239.195.38:53758] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeoXB4V5EysYcTLjmwhsPwAAAcA"]
[Thu Apr 23 20:56:39.189658 2026] [:error] [pid 65000:tid 65047] [client 145.239.195.38:53762] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeoXB76vRb9j6psK2ZZwZQAAAg4"]
[Thu Apr 23 20:56:39.286078 2026] [:error] [pid 64998:tid 65013] [client 145.239.195.38:53766] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aeoXB4V5EysYcTLjmwhsQAAAAcs"]
[Thu Apr 23 20:56:40.575383 2026] [:error] [pid 43083:tid 43091] [client 145.239.195.38:35914] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXCDC5hrvNXosL83J0PQAAAMY"]
[Thu Apr 23 20:56:40.720486 2026] [:error] [pid 65000:tid 65041] [client 145.239.195.38:35918] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXCL6vRb9j6psK2ZZwbwAAAgg"]
[Thu Apr 23 20:56:40.909992 2026] [:error] [pid 42972:tid 43016] [client 145.239.195.38:35928] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXCMOAb-3sOknsk4cwnAAAAEA"]
[Thu Apr 23 20:56:44.766792 2026] [:error] [pid 65000:tid 65029] [client 145.239.195.38:40622] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXDL6vRb9j6psK2ZZwhwAAAgA"]
[Thu Apr 23 20:56:44.932137 2026] [:error] [pid 42973:tid 43064] [client 145.239.195.38:40634] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXDG6I0QqmmmLTHE0Q_wAAAJU"]
[Thu Apr 23 20:56:45.053346 2026] [:error] [pid 42972:tid 43024] [client 145.239.195.38:40636] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXDcOAb-3sOknsk4cwpwAAAEg"]
[Thu Apr 23 20:56:47.199314 2026] [:error] [pid 59700:tid 59723] [client 145.239.195.38:56892] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeoXD5XyGZJFeAIDWtkjAAAAAVU"]
[Thu Apr 23 20:56:47.273095 2026] [:error] [pid 42973:tid 43065] [client 145.239.195.38:56898] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeoXD26I0QqmmmLTHE0RAgAAAJY"]
[Thu Apr 23 20:56:47.399591 2026] [:error] [pid 65000:tid 65043] [client 145.239.195.38:56902] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aeoXD76vRb9j6psK2ZZwjwAAAgo"]
[Thu Apr 23 20:56:49.717465 2026] [:error] [pid 59700:tid 59721] [client 145.239.195.38:56916] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeoXEZXyGZJFeAIDWtkjAgAAAVM"]
[Thu Apr 23 20:56:49.733197 2026] [:error] [pid 59700:tid 59722] [client 145.239.195.38:56924] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeoXEZXyGZJFeAIDWtkjAwAAAVQ"]
[Thu Apr 23 20:56:49.917340 2026] [:error] [pid 65000:tid 65032] [client 145.239.195.38:56940] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aeoXEb6vRb9j6psK2ZZwpAAAAgM"]
[Thu Apr 23 20:56:51.629246 2026] [:error] [pid 65000:tid 65044] [client 145.239.195.38:56956] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeoXE76vRb9j6psK2ZZwrgAAAgs"]
[Thu Apr 23 20:56:51.725607 2026] [:error] [pid 46953:tid 46962] [client 145.239.195.38:56960] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeoXE0nlpdHh-P6wKbozwwAAAkY"]
[Thu Apr 23 20:56:51.788329 2026] [:error] [pid 43083:tid 43105] [client 145.239.195.38:56976] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeoXEzC5hrvNXosL83J0RQAAANQ"]
[Thu Apr 23 20:56:56.437996 2026] [:error] [pid 42973:tid 43045] [client 145.239.195.38:41928] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeoXGG6I0QqmmmLTHE0RGAAAAII"]
[Thu Apr 23 20:56:56.633290 2026] [:error] [pid 64998:tid 65025] [client 145.239.195.38:41938] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeoXGIV5EysYcTLjmwhsYwAAAdc"]
[Thu Apr 23 20:56:56.641760 2026] [:error] [pid 64998:tid 65018] [client 145.239.195.38:41948] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aeoXGIV5EysYcTLjmwhsZAAAAdA"]
[Thu Apr 23 20:56:59.461272 2026] [:error] [pid 42973:tid 43046] [client 145.239.195.38:41958] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeoXG26I0QqmmmLTHE0RQQAAAIM"]
[Thu Apr 23 20:56:59.550511 2026] [:error] [pid 64998:tid 65014] [client 145.239.195.38:41962] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeoXG4V5EysYcTLjmwhsaAAAAcw"]
[Thu Apr 23 20:56:59.611446 2026] [:error] [pid 64998:tid 65011] [client 145.239.195.38:41976] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aeoXG4V5EysYcTLjmwhsagAAAck"]
[Thu Apr 23 20:57:01.979655 2026] [:error] [pid 64998:tid 65004] [client 145.239.195.38:41992] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeoXHYV5EysYcTLjmwhscwAAAcI"]
[Thu Apr 23 20:57:02.074416 2026] [:error] [pid 59700:tid 59711] [client 145.239.195.38:42008] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeoXHpXyGZJFeAIDWtkjGAAAAUk"]
[Thu Apr 23 20:57:02.148221 2026] [:error] [pid 59700:tid 59714] [client 145.239.195.38:42018] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aeoXHpXyGZJFeAIDWtkjGQAAAUw"]
[Thu Apr 23 20:57:05.765742 2026] [:error] [pid 42971:tid 43006] [client 145.239.195.38:41652] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeoXITEP2_5RswrH8bEm8gAAABQ"]
[Thu Apr 23 20:57:05.878798 2026] [:error] [pid 65000:tid 65030] [client 145.239.195.38:41666] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeoXIb6vRb9j6psK2ZZw_gAAAgE"]
[Thu Apr 23 20:57:06.074839 2026] [:error] [pid 64998:tid 65011] [client 145.239.195.38:41682] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aeoXIoV5EysYcTLjmwhsdgAAAck"]
[Thu Apr 23 20:57:07.955023 2026] [:error] [pid 65000:tid 65039] [client 145.239.195.38:41688] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeoXI76vRb9j6psK2ZZxAwAAAgY"]
[Thu Apr 23 20:57:08.289109 2026] [:error] [pid 65000:tid 65042] [client 145.239.195.38:41690] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeoXJL6vRb9j6psK2ZZxBQAAAgk"]
[Thu Apr 23 20:57:08.608208 2026] [:error] [pid 65000:tid 65043] [client 145.239.195.38:41702] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aeoXJL6vRb9j6psK2ZZxCAAAAgo"]
[Thu Apr 23 20:57:12.201775 2026] [:error] [pid 64998:tid 65017] [client 145.239.195.38:41714] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXKIV5EysYcTLjmwhsfQAAAc8"]
[Thu Apr 23 20:57:12.753102 2026] [:error] [pid 59700:tid 59711] [client 145.239.195.38:41716] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXKJXyGZJFeAIDWtkjKQAAAUk"]
[Thu Apr 23 20:57:12.820774 2026] [:error] [pid 42973:tid 43045] [client 145.239.195.38:41726] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXKG6I0QqmmmLTHE0RYQAAAII"]
[Thu Apr 23 20:57:16.001899 2026] [:error] [pid 64998:tid 65008] [client 145.239.195.38:46178] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXLIV5EysYcTLjmwhsgwAAAcY"]
[Thu Apr 23 20:57:16.389083 2026] [:error] [pid 43083:tid 43087] [client 145.239.195.38:46180] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXLDC5hrvNXosL83J0TgAAAMI"]
[Thu Apr 23 20:57:16.620776 2026] [:error] [pid 42973:tid 43063] [client 145.239.195.38:46184] [client 145.239.195.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeoXLG6I0QqmmmLTHE0RawAAAJQ"]
[Thu Apr 23 21:44:57.077961 2026] [proxy_fcgi:error] [pid 64998:tid 65004] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:44:57.346582 2026] [proxy_fcgi:error] [pid 64998:tid 65002] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:44:57.662091 2026] [proxy_fcgi:error] [pid 64998:tid 65025] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:44:57.908527 2026] [proxy_fcgi:error] [pid 64998:tid 65017] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:44:58.219513 2026] [proxy_fcgi:error] [pid 64998:tid 65006] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:44:58.575687 2026] [proxy_fcgi:error] [pid 64998:tid 65016] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:45:00.977207 2026] [proxy_fcgi:error] [pid 64998:tid 65014] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:45:01.236550 2026] [proxy_fcgi:error] [pid 64998:tid 65026] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:45:01.479739 2026] [proxy_fcgi:error] [pid 64998:tid 65004] [client 72.146.32.54:3767] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:45:02.030879 2026] [:error] [pid 64998:tid 65011] [client 72.146.32.54:3767] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aeoiXoV5EysYcTLjmwiITwAAAck"]
[Thu Apr 23 21:45:03.093343 2026] [:error] [pid 65000:tid 65056] [client 72.146.32.54:33730] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aeoiX76vRb9j6psK2ZaYIAAAAhc"]
[Thu Apr 23 21:45:03.858390 2026] [:error] [pid 64998:tid 65022] [client 72.146.32.54:38095] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aeoiX4V5EysYcTLjmwiIUwAAAdQ"]
[Thu Apr 23 21:45:04.947713 2026] [:error] [pid 64998:tid 65013] [client 72.146.32.54:3680] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aeoiYIV5EysYcTLjmwiIWAAAAcs"]
[Thu Apr 23 21:45:05.794947 2026] [:error] [pid 42972:tid 43030] [client 72.146.32.54:33741] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "aeoiYcOAb-3sOknsk4dE-wAAAE4"]
[Thu Apr 23 21:45:06.843593 2026] [:error] [pid 42973:tid 43048] [client 72.146.32.54:60983] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "aeoiYm6I0QqmmmLTHE0iEQAAAIU"]
[Thu Apr 23 21:45:11.572422 2026] [:error] [pid 65000:tid 65040] [client 72.146.32.54:33732] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "aeoiZ76vRb9j6psK2ZaYIwAAAgc"]
[Thu Apr 23 21:45:12.723051 2026] [:error] [pid 42972:tid 43033] [client 72.146.32.54:46703] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "aeoiaMOAb-3sOknsk4dFCAAAAFE"]
[Thu Apr 23 21:46:49.709049 2026] [proxy_fcgi:error] [pid 42972:tid 43030] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:49.952891 2026] [proxy_fcgi:error] [pid 42972:tid 43032] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:50.246157 2026] [proxy_fcgi:error] [pid 42972:tid 43018] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:53.064181 2026] [proxy_fcgi:error] [pid 42972:tid 43036] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:53.314316 2026] [proxy_fcgi:error] [pid 42972:tid 43024] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:53.617438 2026] [proxy_fcgi:error] [pid 42972:tid 43023] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:53.860197 2026] [proxy_fcgi:error] [pid 42972:tid 43034] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:54.192363 2026] [proxy_fcgi:error] [pid 42972:tid 43039] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:54.520953 2026] [proxy_fcgi:error] [pid 42972:tid 43031] [client 72.146.32.54:30860] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:46:54.790854 2026] [:error] [pid 42972:tid 43017] [client 72.146.32.54:30860] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aeoizsOAb-3sOknsk4dFtQAAAEE"]
[Thu Apr 23 21:46:55.560518 2026] [:error] [pid 42972:tid 43032] [client 72.146.32.54:28870] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aeoiz8OAb-3sOknsk4dFuAAAAFA"]
[Thu Apr 23 21:46:56.267156 2026] [:error] [pid 64998:tid 65022] [client 72.146.32.54:40473] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aeoi0IV5EysYcTLjmwiJfgAAAdQ"]
[Thu Apr 23 21:46:56.967481 2026] [:error] [pid 42972:tid 43020] [client 72.146.32.54:61275] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aeoi0MOAb-3sOknsk4dFwAAAAEQ"]
[Thu Apr 23 21:46:57.650677 2026] [:error] [pid 46953:tid 46978] [client 72.146.32.54:41176] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aeoi0UnlpdHh-P6wKbo8zwAAAlU"]
[Thu Apr 23 21:46:58.514552 2026] [:error] [pid 64998:tid 65012] [client 72.146.32.54:27609] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aeoi0oV5EysYcTLjmwiJhQAAAco"]
[Thu Apr 23 21:46:59.484989 2026] [:error] [pid 42971:tid 43004] [client 72.146.32.54:48529] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aeoi0zEP2_5RswrH8bEtrwAAABI"]
[Thu Apr 23 21:47:00.128377 2026] [:error] [pid 42971:tid 43008] [client 72.146.32.54:3536] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aeoi1DEP2_5RswrH8bEtsAAAABY"]
[Thu Apr 23 21:47:02.303103 2026] [:error] [pid 65000:tid 65044] [client 72.146.32.54:45065] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeoi1r6vRb9j6psK2ZaZIgAAAgs"]
[Thu Apr 23 21:47:03.483011 2026] [:error] [pid 65000:tid 65037] [client 72.146.32.54:60866] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeoi176vRb9j6psK2ZaZJQAAAgQ"]
[Thu Apr 23 21:47:04.150074 2026] [:error] [pid 42973:tid 43066] [client 72.146.32.54:54541] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeoi2G6I0QqmmmLTHE0isgAAAJc"]
[Thu Apr 23 21:47:06.176563 2026] [:error] [pid 42973:tid 43064] [client 72.146.32.54:28634] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Xx.php"] [unique_id "aeoi2m6I0QqmmmLTHE0iuAAAAJU"]
[Thu Apr 23 21:47:07.302013 2026] [:error] [pid 64998:tid 65025] [client 72.146.32.54:3840] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeoi24V5EysYcTLjmwiJlgAAAdc"]
[Thu Apr 23 21:47:08.552203 2026] [:error] [pid 42972:tid 43033] [client 72.146.32.54:54547] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeoi3MOAb-3sOknsk4dFzAAAAFE"]
[Thu Apr 23 21:47:10.122099 2026] [:error] [pid 46953:tid 46981] [client 72.146.32.54:40990] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeoi3knlpdHh-P6wKbo84QAAAlg"]
[Thu Apr 23 21:47:11.089515 2026] [:error] [pid 65000:tid 65029] [client 72.146.32.54:54539] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmini.php"] [unique_id "aeoi376vRb9j6psK2ZaZKgAAAgA"]
[Thu Apr 23 21:47:12.412614 2026] [:error] [pid 59700:tid 59720] [client 72.146.32.54:3577] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeoi4JXyGZJFeAIDWtkuSwAAAVI"]
[Thu Apr 23 21:47:13.470986 2026] [:error] [pid 64998:tid 65010] [client 72.146.32.54:32881] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeoi4YV5EysYcTLjmwiJogAAAcg"]
[Thu Apr 23 21:47:14.268008 2026] [:error] [pid 65000:tid 65032] [client 72.146.32.54:52122] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeoi4r6vRb9j6psK2ZaZLgAAAgM"]
[Thu Apr 23 21:47:15.799488 2026] [:error] [pid 25635:tid 25642] [client 72.146.32.54:48255] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aeoi48Rxv6UsgRGKB3I10gAAAQM"]
[Thu Apr 23 21:47:19.726870 2026] [:error] [pid 42973:tid 43051] [client 72.146.32.54:58378] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeoi526I0QqmmmLTHE0i0wAAAIg"]
[Thu Apr 23 21:47:21.155269 2026] [:error] [pid 64967:tid 64973] [client 72.146.32.54:60895] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeoi6YAV4GfOOdX8Qzp3kgAAAYQ"]
[Thu Apr 23 21:47:21.920645 2026] [:error] [pid 65000:tid 65056] [client 72.146.32.54:58372] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeoi6b6vRb9j6psK2ZaZRgAAAhc"]
[Thu Apr 23 21:47:23.212815 2026] [:error] [pid 43083:tid 43089] [client 72.146.32.54:41428] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "aeoi6zC5hrvNXosL83J8UAAAAMQ"]
[Thu Apr 23 21:47:24.545353 2026] [:error] [pid 65000:tid 65040] [client 72.146.32.54:55334] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeoi7L6vRb9j6psK2ZaZTgAAAgc"]
[Thu Apr 23 21:47:27.581154 2026] [:error] [pid 42973:tid 43066] [client 72.146.32.54:3966] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeoi726I0QqmmmLTHE0i3AAAAJc"]
[Thu Apr 23 21:47:30.038614 2026] [:error] [pid 42971:tid 43007] [client 72.146.32.54:59328] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeoi8jEP2_5RswrH8bEtuQAAABU"]
[Thu Apr 23 21:47:31.691976 2026] [:error] [pid 64998:tid 65014] [client 72.146.32.54:35597] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aeoi84V5EysYcTLjmwiJwQAAAcw"]
[Thu Apr 23 21:47:34.314503 2026] [:error] [pid 25635:tid 25639] [client 72.146.32.54:50346] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeoi9sRxv6UsgRGKB3I15wAAAQA"]
[Thu Apr 23 21:47:35.887727 2026] [:error] [pid 65000:tid 65053] [client 72.146.32.54:35629] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeoi976vRb9j6psK2ZaZawAAAhQ"]
[Thu Apr 23 21:47:37.937996 2026] [:error] [pid 42973:tid 43050] [client 72.146.32.54:32835] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeoi-W6I0QqmmmLTHE0i5AAAAIc"]
[Thu Apr 23 21:47:39.106138 2026] [:error] [pid 42972:tid 43016] [client 72.146.32.54:33186] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "aeoi-8OAb-3sOknsk4dF_wAAAEA"]
[Thu Apr 23 21:47:40.778593 2026] [:error] [pid 64998:tid 65003] [client 72.146.32.54:4068] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeoi_IV5EysYcTLjmwiJ0wAAAcE"]
[Thu Apr 23 21:47:42.160018 2026] [:error] [pid 42972:tid 43030] [client 72.146.32.54:60884] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeoi_sOAb-3sOknsk4dGCAAAAE4"]
[Thu Apr 23 21:47:44.627207 2026] [:error] [pid 64998:tid 65017] [client 72.146.32.54:3254] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeojAIV5EysYcTLjmwiJ3gAAAc8"]
[Thu Apr 23 21:47:45.838705 2026] [:error] [pid 46953:tid 46976] [client 72.146.32.54:3270] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "aeojAUnlpdHh-P6wKbo9JwAAAlQ"]
[Thu Apr 23 21:47:50.567958 2026] [:error] [pid 65000:tid 65045] [client 72.146.32.54:28416] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeojBr6vRb9j6psK2ZaZgAAAAgw"]
[Thu Apr 23 21:47:51.875463 2026] [:error] [pid 46953:tid 46976] [client 72.146.32.54:37479] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeojB0nlpdHh-P6wKbo9NwAAAlQ"]
[Thu Apr 23 21:47:53.602881 2026] [:error] [pid 65000:tid 65057] [client 72.146.32.54:45477] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "aeojCb6vRb9j6psK2ZaZhAAAAhg"]
[Thu Apr 23 21:47:54.426475 2026] [proxy_fcgi:error] [pid 65000:tid 65029] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:54.770351 2026] [proxy_fcgi:error] [pid 65000:tid 65050] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:55.045244 2026] [proxy_fcgi:error] [pid 65000:tid 65055] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:55.344684 2026] [proxy_fcgi:error] [pid 65000:tid 65049] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:55.696823 2026] [proxy_fcgi:error] [pid 65000:tid 65044] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:56.087871 2026] [proxy_fcgi:error] [pid 65000:tid 65039] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:56.608439 2026] [proxy_fcgi:error] [pid 65000:tid 65055] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:57.163456 2026] [proxy_fcgi:error] [pid 65000:tid 65030] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:57.526111 2026] [proxy_fcgi:error] [pid 65000:tid 65032] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:58.213315 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:58.499941 2026] [proxy_fcgi:error] [pid 65000:tid 65053] [client 72.146.32.54:32392] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:47:58.786544 2026] [:error] [pid 65000:tid 65051] [client 72.146.32.54:32392] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeojDr6vRb9j6psK2ZaZsgAAAhI"]
[Thu Apr 23 21:48:00.671586 2026] [:error] [pid 43083:tid 43099] [client 72.146.32.54:3107] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeojEDC5hrvNXosL83J8YQAAAM4"]
[Thu Apr 23 21:48:01.898532 2026] [:error] [pid 59700:tid 59725] [client 72.146.32.54:47425] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeojEZXyGZJFeAIDWtkujAAAAVc"]
[Thu Apr 23 21:48:03.490686 2026] [:error] [pid 42972:tid 43028] [client 72.146.32.54:39890] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aeojE8OAb-3sOknsk4dGJgAAAEw"]
[Thu Apr 23 21:48:04.431729 2026] [:error] [pid 42972:tid 43031] [client 72.146.32.54:28668] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeojFMOAb-3sOknsk4dGKQAAAE8"]
[Thu Apr 23 21:48:06.232401 2026] [:error] [pid 64967:tid 64969] [client 72.146.32.54:49968] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeojFoAV4GfOOdX8Qzp3nQAAAYA"]
[Thu Apr 23 21:48:07.783526 2026] [:error] [pid 65000:tid 65046] [client 72.146.32.54:3286] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeojF76vRb9j6psK2ZaZxAAAAg0"]
[Thu Apr 23 21:48:10.564115 2026] [:error] [pid 46953:tid 46959] [client 72.146.32.54:49927] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aeojGknlpdHh-P6wKbo9YQAAAkM"]
[Thu Apr 23 21:48:11.424272 2026] [:error] [pid 46953:tid 46974] [client 72.146.32.54:39878] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeojG0nlpdHh-P6wKbo9ZgAAAlI"]
[Thu Apr 23 21:48:12.013261 2026] [:error] [pid 64967:tid 64984] [client 72.146.32.54:47448] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeojHIAV4GfOOdX8Qzp3nwAAAY8"]
[Thu Apr 23 21:48:12.689317 2026] [:error] [pid 46953:tid 46958] [client 72.146.32.54:61989] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeojHEnlpdHh-P6wKbo9awAAAkI"]
[Thu Apr 23 21:48:13.573750 2026] [:error] [pid 65000:tid 65030] [client 72.146.32.54:39143] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aeojHb6vRb9j6psK2ZaZzQAAAgE"]
[Thu Apr 23 21:48:14.410119 2026] [:error] [pid 64998:tid 65008] [client 72.146.32.54:47485] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeojHoV5EysYcTLjmwiKDgAAAcY"]
[Thu Apr 23 21:48:15.288256 2026] [:error] [pid 64998:tid 65004] [client 72.146.32.54:31209] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeojH4V5EysYcTLjmwiKFAAAAcI"]
[Thu Apr 23 21:48:16.220610 2026] [:error] [pid 64967:tid 64983] [client 72.146.32.54:56055] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeojIIAV4GfOOdX8Qzp3oAAAAY4"]
[Thu Apr 23 21:48:17.026450 2026] [:error] [pid 65000:tid 65052] [client 72.146.32.54:48917] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aeojIb6vRb9j6psK2ZaZ0QAAAhM"]
[Thu Apr 23 21:48:17.983396 2026] [:error] [pid 64998:tid 65022] [client 72.146.32.54:48616] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeojIYV5EysYcTLjmwiKGgAAAdQ"]
[Thu Apr 23 21:48:18.878274 2026] [:error] [pid 64998:tid 65009] [client 72.146.32.54:31225] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeojIoV5EysYcTLjmwiKHQAAAcc"]
[Thu Apr 23 21:48:19.621565 2026] [:error] [pid 64998:tid 65015] [client 72.146.32.54:48951] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeojI4V5EysYcTLjmwiKIQAAAc0"]
[Thu Apr 23 21:48:20.269962 2026] [:error] [pid 64998:tid 65016] [client 72.146.32.54:27915] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aeojJIV5EysYcTLjmwiKKAAAAc4"]
[Thu Apr 23 21:48:20.981947 2026] [:error] [pid 64967:tid 64988] [client 72.146.32.54:27961] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeojJIAV4GfOOdX8Qzp3owAAAZM"]
[Thu Apr 23 21:48:21.822010 2026] [:error] [pid 42972:tid 43031] [client 72.146.32.54:44770] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeojJcOAb-3sOknsk4dGNwAAAE8"]
[Thu Apr 23 21:48:22.593510 2026] [:error] [pid 64998:tid 65015] [client 72.146.32.54:49543] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeojJoV5EysYcTLjmwiKMAAAAc0"]
[Thu Apr 23 21:48:23.662674 2026] [:error] [pid 42973:tid 43054] [client 72.146.32.54:56027] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "aeojJ26I0QqmmmLTHE0jCwAAAIs"]
[Thu Apr 23 21:48:24.530754 2026] [:error] [pid 42972:tid 43029] [client 72.146.32.54:44748] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeojKMOAb-3sOknsk4dGOwAAAE0"]
[Thu Apr 23 21:48:25.349486 2026] [:error] [pid 46953:tid 46981] [client 72.146.32.54:53552] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeojKUnlpdHh-P6wKbo9eQAAAlg"]
[Thu Apr 23 21:48:26.162479 2026] [:error] [pid 65000:tid 65048] [client 72.146.32.54:39480] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeojKr6vRb9j6psK2ZaZ3wAAAg8"]
[Thu Apr 23 21:48:26.973507 2026] [:error] [pid 59700:tid 59710] [client 72.146.32.54:49932] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "aeojKpXyGZJFeAIDWtkurAAAAUg"]
[Thu Apr 23 21:48:27.661421 2026] [:error] [pid 65000:tid 65056] [client 72.146.32.54:34458] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeojK76vRb9j6psK2ZaZ5AAAAhc"]
[Thu Apr 23 21:48:28.600664 2026] [:error] [pid 65000:tid 65047] [client 72.146.32.54:27952] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeojLL6vRb9j6psK2ZaZ6AAAAg4"]
[Thu Apr 23 21:48:29.393731 2026] [:error] [pid 65000:tid 65055] [client 72.146.32.54:35924] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeojLb6vRb9j6psK2ZaZ7AAAAhY"]
[Thu Apr 23 21:48:30.494092 2026] [:error] [pid 42973:tid 43045] [client 72.146.32.54:53521] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "aeojLm6I0QqmmmLTHE0jEAAAAII"]
[Thu Apr 23 21:48:31.606150 2026] [:error] [pid 42973:tid 43053] [client 72.146.32.54:41507] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeojL26I0QqmmmLTHE0jEgAAAIo"]
[Thu Apr 23 21:48:32.595858 2026] [:error] [pid 65000:tid 65029] [client 72.146.32.54:53714] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeojML6vRb9j6psK2ZaZ8gAAAgA"]
[Thu Apr 23 21:48:33.501485 2026] [:error] [pid 65000:tid 65032] [client 72.146.32.54:39435] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeojMb6vRb9j6psK2ZaZ9gAAAgM"]
[Thu Apr 23 21:48:34.392109 2026] [:error] [pid 65000:tid 65038] [client 72.146.32.54:57346] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "aeojMr6vRb9j6psK2ZaZ-AAAAgU"]
[Thu Apr 23 21:48:35.150825 2026] [:error] [pid 59700:tid 59714] [client 72.146.32.54:59866] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeojM5XyGZJFeAIDWtkuwQAAAUw"]
[Thu Apr 23 21:48:36.393042 2026] [:error] [pid 59700:tid 59708] [client 72.146.32.54:59872] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeojNJXyGZJFeAIDWtkuxAAAAUY"]
[Thu Apr 23 21:48:37.314812 2026] [:error] [pid 43083:tid 43101] [client 72.146.32.54:44784] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeojNTC5hrvNXosL83J8jgAAANA"]
[Thu Apr 23 21:48:38.331688 2026] [:error] [pid 43083:tid 43090] [client 72.146.32.54:43999] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "aeojNjC5hrvNXosL83J8kQAAAMU"]
[Thu Apr 23 21:48:39.331922 2026] [:error] [pid 42972:tid 43027] [client 72.146.32.54:44028] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeojN8OAb-3sOknsk4dGSgAAAEs"]
[Thu Apr 23 21:48:40.541038 2026] [:error] [pid 25635:tid 25651] [client 72.146.32.54:39469] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeojOMRxv6UsgRGKB3I2GQAAAQw"]
[Thu Apr 23 21:48:41.517336 2026] [:error] [pid 42972:tid 43035] [client 72.146.32.54:44768] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeojOcOAb-3sOknsk4dGTgAAAFM"]
[Thu Apr 23 21:48:42.144287 2026] [:error] [pid 64998:tid 65019] [client 72.146.32.54:39133] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "aeojOoV5EysYcTLjmwiKWwAAAdE"]
[Thu Apr 23 21:48:43.127711 2026] [:error] [pid 64998:tid 65011] [client 72.146.32.54:35910] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeojO4V5EysYcTLjmwiKYAAAAck"]
[Thu Apr 23 21:48:44.000762 2026] [:error] [pid 42972:tid 43031] [client 72.146.32.54:41475] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeojO8OAb-3sOknsk4dGUQAAAE8"]
[Thu Apr 23 21:48:45.087830 2026] [:error] [pid 42973:tid 43064] [client 72.146.32.54:44012] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeojPW6I0QqmmmLTHE0jHQAAAJU"]
[Thu Apr 23 21:48:56.406518 2026] [:error] [pid 42973:tid 43047] [client 72.146.32.54:4016] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "aeojSG6I0QqmmmLTHE0jLAAAAIQ"]
[Thu Apr 23 21:48:58.975505 2026] [proxy_fcgi:error] [pid 42971:tid 42993] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:48:59.218668 2026] [proxy_fcgi:error] [pid 42971:tid 43001] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:04.156508 2026] [proxy_fcgi:error] [pid 42971:tid 42986] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:04.399204 2026] [proxy_fcgi:error] [pid 42971:tid 42992] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:04.646167 2026] [proxy_fcgi:error] [pid 42971:tid 42995] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:04.889960 2026] [proxy_fcgi:error] [pid 42971:tid 43009] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:05.144312 2026] [proxy_fcgi:error] [pid 42971:tid 42998] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:05.388157 2026] [proxy_fcgi:error] [pid 42971:tid 42988] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:05.659570 2026] [proxy_fcgi:error] [pid 42971:tid 43008] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:05.902086 2026] [proxy_fcgi:error] [pid 42971:tid 43004] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:06.146045 2026] [proxy_fcgi:error] [pid 42971:tid 43002] [client 72.146.32.54:28703] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:49:06.384726 2026] [:error] [pid 42971:tid 42987] [client 72.146.32.54:28703] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byrgo.php"] [unique_id "aeojUjEP2_5RswrH8bEt7wAAAAE"]
[Thu Apr 23 21:50:44.186012 2026] [proxy_fcgi:error] [pid 42973:tid 43051] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:44.464184 2026] [proxy_fcgi:error] [pid 42973:tid 43062] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:44.806284 2026] [proxy_fcgi:error] [pid 42973:tid 43060] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:45.193664 2026] [proxy_fcgi:error] [pid 42973:tid 43064] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:45.664157 2026] [proxy_fcgi:error] [pid 42973:tid 43044] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:46.396086 2026] [proxy_fcgi:error] [pid 42973:tid 43063] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:46.669834 2026] [proxy_fcgi:error] [pid 42973:tid 43048] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:47.040854 2026] [proxy_fcgi:error] [pid 42973:tid 43056] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:47.324302 2026] [proxy_fcgi:error] [pid 42973:tid 43046] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:47.686753 2026] [proxy_fcgi:error] [pid 42973:tid 43061] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:48.281649 2026] [proxy_fcgi:error] [pid 42973:tid 43059] [client 72.146.32.54:60121] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:50:48.754465 2026] [:error] [pid 42973:tid 43043] [client 72.146.32.54:60121] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeojuG6I0QqmmmLTHE0jtgAAAIA"]
[Thu Apr 23 21:50:50.638011 2026] [:error] [pid 65000:tid 65038] [client 72.146.32.54:52911] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeojur6vRb9j6psK2Zab1AAAAgU"]
[Thu Apr 23 21:50:51.893489 2026] [:error] [pid 42973:tid 43047] [client 72.146.32.54:52559] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeoju26I0QqmmmLTHE0juwAAAIQ"]
[Thu Apr 23 21:50:53.243596 2026] [:error] [pid 42972:tid 43031] [client 72.146.32.54:44698] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "aeojvcOAb-3sOknsk4dH-gAAAE8"]
[Thu Apr 23 21:50:54.360858 2026] [:error] [pid 59700:tid 59720] [client 72.146.32.54:44672] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeojvpXyGZJFeAIDWtkvaQAAAVI"]
[Thu Apr 23 21:50:55.398869 2026] [:error] [pid 65000:tid 65055] [client 72.146.32.54:29282] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeojv76vRb9j6psK2Zab3gAAAhY"]
[Thu Apr 23 21:50:56.455563 2026] [:error] [pid 42973:tid 43056] [client 72.146.32.54:46300] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeojwG6I0QqmmmLTHE0jvwAAAI0"]
[Thu Apr 23 21:50:57.666650 2026] [:error] [pid 59700:tid 59703] [client 72.146.32.54:29278] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aeojwZXyGZJFeAIDWtkvbQAAAUE"]
[Thu Apr 23 21:50:58.454294 2026] [:error] [pid 42973:tid 43065] [client 72.146.32.54:46691] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeojwm6I0QqmmmLTHE0jwwAAAJY"]
[Thu Apr 23 21:50:59.341657 2026] [:error] [pid 42973:tid 43064] [client 72.146.32.54:62076] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeojw26I0QqmmmLTHE0jyAAAAJU"]
[Thu Apr 23 21:51:00.223318 2026] [:error] [pid 42973:tid 43056] [client 72.146.32.54:39964] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeojxG6I0QqmmmLTHE0jzQAAAI0"]
[Thu Apr 23 21:51:01.092312 2026] [:error] [pid 64967:tid 64969] [client 72.146.32.54:34256] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aeojxYAV4GfOOdX8Qzp4NgAAAYA"]
[Thu Apr 23 21:51:02.135858 2026] [:error] [pid 43083:tid 43088] [client 72.146.32.54:36273] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeojxjC5hrvNXosL83J9KwAAAMM"]
[Thu Apr 23 21:51:03.836342 2026] [:error] [pid 65000:tid 65049] [client 72.146.32.54:39984] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeojx76vRb9j6psK2Zab-QAAAhA"]
[Thu Apr 23 21:51:04.802469 2026] [:error] [pid 43083:tid 43097] [client 72.146.32.54:33472] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeojyDC5hrvNXosL83J9LAAAAMw"]
[Thu Apr 23 21:51:05.624540 2026] [:error] [pid 42973:tid 43065] [client 72.146.32.54:37558] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aeojyW6I0QqmmmLTHE0j0gAAAJY"]
[Thu Apr 23 21:51:06.683775 2026] [:error] [pid 59700:tid 59702] [client 72.146.32.54:54848] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeojypXyGZJFeAIDWtkvcQAAAUA"]
[Thu Apr 23 21:51:07.684302 2026] [:error] [pid 59700:tid 59724] [client 72.146.32.54:56975] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeojy5XyGZJFeAIDWtkvcgAAAVY"]
[Thu Apr 23 21:51:09.383333 2026] [:error] [pid 65000:tid 65030] [client 72.146.32.54:37542] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeojzb6vRb9j6psK2ZacCAAAAgE"]
[Thu Apr 23 21:51:10.227879 2026] [:error] [pid 42973:tid 43044] [client 72.146.32.54:48146] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aeojzm6I0QqmmmLTHE0j1gAAAIE"]
[Thu Apr 23 21:51:11.102625 2026] [:error] [pid 43083:tid 43106] [client 72.146.32.54:34242] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeojzzC5hrvNXosL83J9MgAAANU"]
[Thu Apr 23 21:51:12.128004 2026] [:error] [pid 46953:tid 46970] [client 72.146.32.54:48155] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeoj0EnlpdHh-P6wKbo9wQAAAk4"]
[Thu Apr 23 21:51:12.774940 2026] [:error] [pid 65000:tid 65044] [client 72.146.32.54:48180] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeoj0L6vRb9j6psK2ZacDwAAAgs"]
[Thu Apr 23 21:51:13.513163 2026] [:error] [pid 59700:tid 59706] [client 72.146.32.54:27686] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aeoj0ZXyGZJFeAIDWtkveQAAAUQ"]
[Thu Apr 23 21:51:14.528308 2026] [:error] [pid 42972:tid 43019] [client 72.146.32.54:56962] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeoj0sOAb-3sOknsk4dIBQAAAEM"]
[Thu Apr 23 21:51:15.316910 2026] [:error] [pid 42972:tid 43029] [client 72.146.32.54:39965] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeoj08OAb-3sOknsk4dICgAAAE0"]
[Thu Apr 23 21:51:16.386419 2026] [:error] [pid 42971:tid 42991] [client 72.146.32.54:47062] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeoj1DEP2_5RswrH8bEuDQAAAAU"]
[Thu Apr 23 21:51:18.315171 2026] [:error] [pid 42971:tid 42992] [client 72.146.32.54:30907] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aeoj1jEP2_5RswrH8bEuEAAAAAY"]
[Thu Apr 23 21:51:19.403755 2026] [:error] [pid 59700:tid 59709] [client 72.146.32.54:34252] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeoj15XyGZJFeAIDWtkvewAAAUc"]
[Thu Apr 23 21:51:23.799967 2026] [:error] [pid 42973:tid 43056] [client 72.146.32.54:39945] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeoj226I0QqmmmLTHE0j5AAAAI0"]
[Thu Apr 23 21:51:24.902049 2026] [:error] [pid 65000:tid 65057] [client 72.146.32.54:26890] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeoj3L6vRb9j6psK2ZacHQAAAhg"]
[Thu Apr 23 21:51:25.636554 2026] [:error] [pid 25635:tid 25643] [client 72.146.32.54:56998] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aeoj3cRxv6UsgRGKB3I2QwAAAQQ"]
[Thu Apr 23 21:51:26.802631 2026] [:error] [pid 65000:tid 65053] [client 72.146.32.54:54878] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeoj3r6vRb9j6psK2ZacJQAAAhQ"]
[Thu Apr 23 21:51:27.523565 2026] [:error] [pid 42973:tid 43065] [client 72.146.32.54:30880] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeoj326I0QqmmmLTHE0j5wAAAJY"]
[Thu Apr 23 21:51:28.292163 2026] [:error] [pid 64967:tid 64980] [client 72.146.32.54:31644] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeoj4IAV4GfOOdX8Qzp4TQAAAYs"]
[Thu Apr 23 21:51:29.335108 2026] [:error] [pid 42973:tid 43062] [client 72.146.32.54:37526] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aeoj4W6I0QqmmmLTHE0j7gAAAJM"]
[Thu Apr 23 21:51:30.454686 2026] [:error] [pid 64998:tid 65018] [client 72.146.32.54:31625] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeoj4oV5EysYcTLjmwiMEwAAAdA"]
[Thu Apr 23 21:51:31.649847 2026] [:error] [pid 65000:tid 65030] [client 72.146.32.54:47402] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeoj476vRb9j6psK2ZacLgAAAgE"]
[Thu Apr 23 21:51:33.385915 2026] [:error] [pid 42973:tid 43046] [client 72.146.32.54:50032] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeoj5W6I0QqmmmLTHE0j8gAAAIM"]
[Thu Apr 23 21:51:34.426052 2026] [:error] [pid 64998:tid 65017] [client 72.146.32.54:42687] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "aeoj5oV5EysYcTLjmwiMGAAAAc8"]
[Thu Apr 23 21:51:35.280150 2026] [:error] [pid 65000:tid 65051] [client 72.146.32.54:48191] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeoj576vRb9j6psK2ZacQgAAAhI"]
[Thu Apr 23 21:51:35.943912 2026] [:error] [pid 64998:tid 65026] [client 72.146.32.54:28802] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeoj54V5EysYcTLjmwiMHQAAAdg"]
[Thu Apr 23 21:51:36.797897 2026] [:error] [pid 65000:tid 65056] [client 72.146.32.54:34651] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeoj6L6vRb9j6psK2ZacTQAAAhc"]
[Thu Apr 23 21:51:37.948720 2026] [:error] [pid 65000:tid 65048] [client 72.146.32.54:36237] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "aeoj6b6vRb9j6psK2ZacVAAAAg8"]
[Thu Apr 23 21:51:39.051566 2026] [:error] [pid 46953:tid 46979] [client 72.146.32.54:27686] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeoj60nlpdHh-P6wKbo90QAAAlY"]
[Thu Apr 23 21:51:40.068951 2026] [:error] [pid 42972:tid 43039] [client 72.146.32.54:26881] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeoj7MOAb-3sOknsk4dIGAAAAFc"]
[Thu Apr 23 21:51:41.131559 2026] [:error] [pid 42972:tid 43037] [client 72.146.32.54:27669] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeoj7cOAb-3sOknsk4dIHQAAAFU"]
[Thu Apr 23 21:51:42.483884 2026] [:error] [pid 65000:tid 65046] [client 72.146.32.54:62070] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "aeoj7r6vRb9j6psK2ZacZgAAAg0"]
[Thu Apr 23 21:51:43.561446 2026] [:error] [pid 65000:tid 65040] [client 72.146.32.54:26893] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeoj776vRb9j6psK2ZacbQAAAgc"]
[Thu Apr 23 21:51:44.271543 2026] [:error] [pid 42972:tid 43028] [client 72.146.32.54:48980] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeoj8MOAb-3sOknsk4dIJQAAAEw"]
[Thu Apr 23 21:51:46.265888 2026] [:error] [pid 25635:tid 25663] [client 72.146.32.54:57328] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeoj8sRxv6UsgRGKB3I2RQAAARg"]
[Thu Apr 23 21:51:46.930931 2026] [:error] [pid 43083:tid 43101] [client 72.146.32.54:38119] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aeoj8jC5hrvNXosL83J9PQAAANA"]
[Thu Apr 23 21:51:47.754459 2026] [:error] [pid 46953:tid 46962] [client 72.146.32.54:36284] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeoj80nlpdHh-P6wKbo90wAAAkY"]
[Thu Apr 23 21:51:48.914744 2026] [proxy_fcgi:error] [pid 25635:tid 25650] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:50.322941 2026] [proxy_fcgi:error] [pid 25635:tid 25649] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:50.598515 2026] [proxy_fcgi:error] [pid 25635:tid 25654] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:51.457620 2026] [proxy_fcgi:error] [pid 25635:tid 25655] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:51.731479 2026] [proxy_fcgi:error] [pid 25635:tid 25657] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:52.750534 2026] [proxy_fcgi:error] [pid 25635:tid 25656] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:53.130213 2026] [proxy_fcgi:error] [pid 25635:tid 25641] [client 72.146.32.54:30614] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:51:53.462940 2026] [:error] [pid 25635:tid 25660] [client 72.146.32.54:30614] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeoj-cRxv6UsgRGKB3I2VwAAARU"]
[Thu Apr 23 21:51:54.543462 2026] [:error] [pid 65000:tid 65057] [client 72.146.32.54:47034] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeoj-r6vRb9j6psK2ZacfwAAAhg"]
[Thu Apr 23 21:51:55.719635 2026] [:error] [pid 64998:tid 65021] [client 72.146.32.54:44718] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeoj-4V5EysYcTLjmwiMKwAAAdM"]
[Thu Apr 23 21:51:56.419687 2026] [:error] [pid 43083:tid 43108] [client 72.146.32.54:52879] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aeoj_DC5hrvNXosL83J9QQAAANc"]
[Thu Apr 23 21:51:58.041880 2026] [:error] [pid 42972:tid 43039] [client 72.146.32.54:52603] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeoj_sOAb-3sOknsk4dIPgAAAFc"]
[Thu Apr 23 21:51:59.349746 2026] [:error] [pid 42973:tid 43055] [client 72.146.32.54:30435] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeoj_26I0QqmmmLTHE0j_QAAAIw"]
[Thu Apr 23 21:52:00.278331 2026] [:error] [pid 65000:tid 65045] [client 72.146.32.54:53779] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeokAL6vRb9j6psK2ZaclAAAAgw"]
[Thu Apr 23 21:52:01.165171 2026] [:error] [pid 42973:tid 43044] [client 72.146.32.54:31733] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aeokAW6I0QqmmmLTHE0j_gAAAIE"]
[Thu Apr 23 21:52:02.506705 2026] [:error] [pid 64998:tid 65025] [client 72.146.32.54:27866] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeokAoV5EysYcTLjmwiMMwAAAdc"]
[Thu Apr 23 21:52:04.176076 2026] [:error] [pid 42972:tid 43018] [client 72.146.32.54:60101] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeokBMOAb-3sOknsk4dIRAAAAEI"]
[Thu Apr 23 21:52:05.420801 2026] [:error] [pid 64998:tid 65015] [client 72.146.32.54:40196] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeokBYV5EysYcTLjmwiMPAAAAc0"]
[Thu Apr 23 21:52:07.521092 2026] [:error] [pid 64998:tid 65003] [client 72.146.32.54:46223] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aeokB4V5EysYcTLjmwiMQQAAAcE"]
[Thu Apr 23 21:52:09.027497 2026] [:error] [pid 59700:tid 59710] [client 72.146.32.54:40447] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeokCZXyGZJFeAIDWtkvhAAAAUg"]
[Thu Apr 23 21:52:10.217828 2026] [:error] [pid 59700:tid 59712] [client 72.146.32.54:42577] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeokCpXyGZJFeAIDWtkvhwAAAUo"]
[Thu Apr 23 21:52:11.166405 2026] [:error] [pid 65000:tid 65029] [client 72.146.32.54:26546] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeokC76vRb9j6psK2ZacowAAAgA"]
[Thu Apr 23 21:52:12.217593 2026] [:error] [pid 64998:tid 65012] [client 72.146.32.54:39400] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "aeokDIV5EysYcTLjmwiMSAAAAco"]
[Thu Apr 23 21:52:13.199658 2026] [:error] [pid 65000:tid 65054] [client 72.146.32.54:30031] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeokDb6vRb9j6psK2ZacrwAAAhU"]
[Thu Apr 23 21:52:13.941489 2026] [:error] [pid 65000:tid 65053] [client 72.146.32.54:44364] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeokDb6vRb9j6psK2ZactAAAAhQ"]
[Thu Apr 23 21:52:14.809119 2026] [:error] [pid 42972:tid 43021] [client 72.146.32.54:26510] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeokDsOAb-3sOknsk4dISAAAAEU"]
[Thu Apr 23 21:52:16.290298 2026] [:error] [pid 65000:tid 65032] [client 72.146.32.54:54190] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "aeokEL6vRb9j6psK2ZacuwAAAgM"]
[Thu Apr 23 21:52:17.797991 2026] [:error] [pid 65000:tid 65052] [client 72.146.32.54:54197] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeokEb6vRb9j6psK2ZacygAAAhM"]
[Thu Apr 23 21:52:19.332764 2026] [:error] [pid 64998:tid 65025] [client 72.146.32.54:45530] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeokE4V5EysYcTLjmwiMSwAAAdc"]
[Thu Apr 23 21:52:20.098840 2026] [:error] [pid 59700:tid 59716] [client 72.146.32.54:60214] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeokFJXyGZJFeAIDWtkvjgAAAU4"]
[Thu Apr 23 21:52:21.475100 2026] [:error] [pid 42973:tid 43052] [client 72.146.32.54:36218] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeokFW6I0QqmmmLTHE0kAwAAAIk"]
[Thu Apr 23 21:52:22.958933 2026] [:error] [pid 59700:tid 59710] [client 72.146.32.54:42869] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeokFpXyGZJFeAIDWtkvkAAAAUg"]
[Thu Apr 23 21:52:25.361971 2026] [:error] [pid 46953:tid 46962] [client 72.146.32.54:38194] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeokGUnlpdHh-P6wKbo9-AAAAkY"]
[Thu Apr 23 21:52:27.773576 2026] [:error] [pid 59700:tid 59713] [client 72.146.32.54:60221] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeokG5XyGZJFeAIDWtkvlgAAAUs"]
[Thu Apr 23 21:52:28.720543 2026] [:error] [pid 42971:tid 43000] [client 72.146.32.54:42178] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we.php"] [unique_id "aeokHDEP2_5RswrH8bEuJQAAAA4"]
[Thu Apr 23 21:52:29.703965 2026] [:error] [pid 46953:tid 46967] [client 72.146.32.54:34958] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeokHUnlpdHh-P6wKbo9-QAAAks"]
[Thu Apr 23 21:52:30.562187 2026] [:error] [pid 46953:tid 46964] [client 72.146.32.54:38753] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeokHknlpdHh-P6wKbo9-wAAAkg"]
[Thu Apr 23 21:52:32.745951 2026] [:error] [pid 64998:tid 65023] [client 72.146.32.54:60208] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeokIIV5EysYcTLjmwiMWQAAAdU"]
[Thu Apr 23 21:52:34.074994 2026] [:error] [pid 64998:tid 65015] [client 72.146.32.54:30051] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "aeokIoV5EysYcTLjmwiMXgAAAc0"]
[Thu Apr 23 21:52:35.980917 2026] [:error] [pid 64998:tid 65019] [client 72.146.32.54:56928] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeokI4V5EysYcTLjmwiMZAAAAdE"]
[Thu Apr 23 21:52:49.605062 2026] [:error] [pid 64998:tid 65009] [client 72.146.32.54:33688] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "aeokMYV5EysYcTLjmwiMdQAAAcc"]
[Thu Apr 23 21:54:46.320340 2026] [proxy_fcgi:error] [pid 64998:tid 65024] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:47.300870 2026] [proxy_fcgi:error] [pid 64998:tid 65022] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:47.899331 2026] [proxy_fcgi:error] [pid 64998:tid 65013] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:48.645885 2026] [proxy_fcgi:error] [pid 64998:tid 65010] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:49.055737 2026] [proxy_fcgi:error] [pid 64998:tid 65020] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:49.400432 2026] [proxy_fcgi:error] [pid 64998:tid 65015] [client 72.146.32.54:59964] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:54:49.771988 2026] [:error] [pid 64998:tid 65025] [client 72.146.32.54:59964] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aeokqYV5EysYcTLjmwiNfwAAAdc"]
[Thu Apr 23 21:55:25.047687 2026] [:error] [pid 64967:tid 64982] [client 72.146.32.54:32210] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aeokzYAV4GfOOdX8Qzp44QAAAY0"]
[Thu Apr 23 21:56:54.332477 2026] [proxy_fcgi:error] [pid 64998:tid 65025] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:55.246726 2026] [proxy_fcgi:error] [pid 64998:tid 65011] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:55.503454 2026] [proxy_fcgi:error] [pid 64998:tid 65008] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:55.885585 2026] [proxy_fcgi:error] [pid 64998:tid 65015] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:56.241503 2026] [proxy_fcgi:error] [pid 64998:tid 65017] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:56.484016 2026] [proxy_fcgi:error] [pid 64998:tid 65005] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:56.817349 2026] [proxy_fcgi:error] [pid 64998:tid 65019] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:57.064287 2026] [proxy_fcgi:error] [pid 64998:tid 65007] [client 72.146.32.54:49921] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 21:56:59.143174 2026] [:error] [pid 64998:tid 65012] [client 72.146.32.54:49921] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeolK4V5EysYcTLjmwiORwAAAco"]
[Thu Apr 23 21:57:00.327526 2026] [:error] [pid 65000:tid 65056] [client 72.146.32.54:59365] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeolLL6vRb9j6psK2ZafuwAAAhc"]
[Thu Apr 23 21:57:01.209442 2026] [:error] [pid 64998:tid 65017] [client 72.146.32.54:43545] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeolLYV5EysYcTLjmwiOSgAAAc8"]
[Thu Apr 23 21:57:02.028391 2026] [:error] [pid 64998:tid 65026] [client 72.146.32.54:41223] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aeolLoV5EysYcTLjmwiOTAAAAdg"]
[Thu Apr 23 21:57:02.904898 2026] [:error] [pid 42973:tid 43044] [client 72.146.32.54:52130] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeolLm6I0QqmmmLTHE0lYgAAAIE"]
[Thu Apr 23 21:57:03.991464 2026] [:error] [pid 43083:tid 43100] [client 72.146.32.54:32887] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeolLzC5hrvNXosL83J9xAAAAM8"]
[Thu Apr 23 21:57:07.049529 2026] [:error] [pid 59700:tid 59718] [client 72.146.32.54:3080] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeolM5XyGZJFeAIDWtkw0gAAAVA"]
[Thu Apr 23 21:57:10.957250 2026] [:error] [pid 42973:tid 43051] [client 72.146.32.54:47450] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "aeolNm6I0QqmmmLTHE0lawAAAIg"]
[Thu Apr 23 21:57:12.328053 2026] [:error] [pid 42973:tid 43055] [client 72.146.32.54:39894] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeolOG6I0QqmmmLTHE0lcQAAAIw"]
[Thu Apr 23 21:57:14.126001 2026] [:error] [pid 64998:tid 65014] [client 72.146.32.54:3310] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeolOoV5EysYcTLjmwiOYgAAAcw"]
[Thu Apr 23 21:57:15.247145 2026] [:error] [pid 43083:tid 43090] [client 72.146.32.54:60485] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeolOzC5hrvNXosL83J9yQAAAMU"]
[Thu Apr 23 21:57:16.170204 2026] [:error] [pid 46953:tid 46973] [client 72.146.32.54:29601] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aeolPEnlpdHh-P6wKbo-oAAAAlE"]
[Thu Apr 23 21:57:17.019920 2026] [:error] [pid 42972:tid 43028] [client 72.146.32.54:37456] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeolPcOAb-3sOknsk4dKBQAAAEw"]
[Thu Apr 23 21:57:17.969325 2026] [:error] [pid 59700:tid 59726] [client 72.146.32.54:60510] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeolPZXyGZJFeAIDWtkw3QAAAVg"]
[Thu Apr 23 21:57:19.041477 2026] [:error] [pid 59700:tid 59711] [client 72.146.32.54:60497] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeolP5XyGZJFeAIDWtkw4AAAAUk"]
[Thu Apr 23 21:57:20.358847 2026] [:error] [pid 46953:tid 46957] [client 72.146.32.54:62719] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aeolQEnlpdHh-P6wKbo-pAAAAkE"]
[Thu Apr 23 21:57:21.514686 2026] [:error] [pid 65000:tid 65054] [client 72.146.32.54:41216] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeolQb6vRb9j6psK2Zaf8gAAAhU"]
[Thu Apr 23 21:57:22.820972 2026] [:error] [pid 64998:tid 65009] [client 72.146.32.54:62617] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeolQoV5EysYcTLjmwiOewAAAcc"]
[Thu Apr 23 21:57:24.286913 2026] [:error] [pid 42971:tid 42993] [client 72.146.32.54:29583] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeolRDEP2_5RswrH8bEu1AAAAAc"]
[Thu Apr 23 21:57:24.954086 2026] [:error] [pid 46953:tid 46963] [client 72.146.32.54:59376] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aeolREnlpdHh-P6wKbo-pgAAAkc"]
[Thu Apr 23 21:57:25.741156 2026] [:error] [pid 65000:tid 65057] [client 72.146.32.54:40727] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeolRb6vRb9j6psK2ZagAgAAAhg"]
[Thu Apr 23 21:57:26.892886 2026] [:error] [pid 42972:tid 43030] [client 72.146.32.54:31988] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeolRsOAb-3sOknsk4dKDgAAAE4"]
[Thu Apr 23 21:57:27.851454 2026] [:error] [pid 42973:tid 43057] [client 72.146.32.54:28430] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeolR26I0QqmmmLTHE0lfQAAAI4"]
[Thu Apr 23 21:57:28.665913 2026] [:error] [pid 46953:tid 46970] [client 72.146.32.54:45084] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g.php"] [unique_id "aeolSEnlpdHh-P6wKbo-qwAAAk4"]
[Thu Apr 23 21:57:29.577195 2026] [:error] [pid 65000:tid 65053] [client 72.146.32.54:35960] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeolSb6vRb9j6psK2ZagGgAAAhQ"]
[Thu Apr 23 21:57:30.473524 2026] [:error] [pid 64998:tid 65020] [client 72.146.32.54:29595] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeolSoV5EysYcTLjmwiOigAAAdI"]
[Thu Apr 23 21:57:31.286633 2026] [:error] [pid 42972:tid 43017] [client 72.146.32.54:26106] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeolS8OAb-3sOknsk4dKGgAAAEE"]
[Thu Apr 23 21:57:32.311202 2026] [:error] [pid 59700:tid 59712] [client 72.146.32.54:41211] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aeolTJXyGZJFeAIDWtkw6QAAAUo"]
[Thu Apr 23 21:57:33.017270 2026] [:error] [pid 64998:tid 65004] [client 72.146.32.54:62594] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeolTYV5EysYcTLjmwiOmAAAAcI"]
[Thu Apr 23 21:57:33.917767 2026] [:error] [pid 43083:tid 43087] [client 72.146.32.54:28427] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeolTTC5hrvNXosL83J9zwAAAMI"]
[Thu Apr 23 21:57:34.828613 2026] [:error] [pid 46953:tid 46972] [client 72.146.32.54:28431] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeolTknlpdHh-P6wKbo-rQAAAlA"]
[Thu Apr 23 21:57:35.644680 2026] [:error] [pid 42973:tid 43049] [client 72.146.32.54:29589] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aeolT26I0QqmmmLTHE0liAAAAIY"]
[Thu Apr 23 21:57:36.657683 2026] [:error] [pid 64998:tid 65020] [client 72.146.32.54:28466] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeolUIV5EysYcTLjmwiOpAAAAdI"]
[Thu Apr 23 21:57:37.833157 2026] [:error] [pid 59700:tid 59709] [client 72.146.32.54:29617] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeolUZXyGZJFeAIDWtkw8AAAAUc"]
[Thu Apr 23 21:57:38.621295 2026] [:error] [pid 65000:tid 65037] [client 72.146.32.54:38777] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeolUr6vRb9j6psK2ZagMwAAAgQ"]
[Thu Apr 23 21:57:39.507702 2026] [:error] [pid 64998:tid 65015] [client 72.146.32.54:29630] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ew.php"] [unique_id "aeolU4V5EysYcTLjmwiOqAAAAc0"]
[Thu Apr 23 21:57:40.286369 2026] [:error] [pid 42973:tid 43054] [client 72.146.32.54:41188] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeolVG6I0QqmmmLTHE0liwAAAIs"]
[Thu Apr 23 21:57:41.122795 2026] [:error] [pid 42973:tid 43062] [client 72.146.32.54:49658] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeolVW6I0QqmmmLTHE0ljwAAAJM"]
[Thu Apr 23 21:57:42.016438 2026] [:error] [pid 59700:tid 59713] [client 72.146.32.54:3098] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeolVpXyGZJFeAIDWtkw9QAAAUs"]
[Thu Apr 23 21:57:42.732610 2026] [:error] [pid 42973:tid 43064] [client 72.146.32.54:59363] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file21.php"] [unique_id "aeolVm6I0QqmmmLTHE0llQAAAJU"]
[Thu Apr 23 21:57:43.772701 2026] [:error] [pid 42971:tid 42997] [client 72.146.32.54:46703] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeolVzEP2_5RswrH8bEu3AAAAAs"]
[Thu Apr 23 21:57:44.605642 2026] [:error] [pid 42973:tid 43051] [client 72.146.32.54:26088] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeolWG6I0QqmmmLTHE0llgAAAIg"]
[Thu Apr 23 21:57:46.365697 2026] [:error] [pid 64998:tid 65024] [client 72.146.32.54:56040] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeolWoV5EysYcTLjmwiOvAAAAdY"]
[Thu Apr 23 21:57:47.027476 2026] [:error] [pid 64998:tid 65023] [client 72.146.32.54:31143] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "aeolW4V5EysYcTLjmwiOwQAAAdU"]
[Thu Apr 23 21:57:47.835993 2026] [:error] [pid 64998:tid 65011] [client 72.146.32.54:38762] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeolW4V5EysYcTLjmwiOxgAAAck"]
[Thu Apr 23 21:57:48.649863 2026] [:error] [pid 64998:tid 65013] [client 72.146.32.54:51202] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeolXIV5EysYcTLjmwiOygAAAcs"]
[Thu Apr 23 21:57:49.327702 2026] [:error] [pid 65000:tid 65051] [client 72.146.32.54:39138] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeolXb6vRb9j6psK2ZagRAAAAhI"]
[Thu Apr 23 21:57:50.305803 2026] [:error] [pid 42971:tid 42991] [client 72.146.32.54:30679] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "aeolXjEP2_5RswrH8bEu3gAAAAU"]
[Thu Apr 23 21:57:51.000676 2026] [:error] [pid 64998:tid 65020] [client 72.146.32.54:59415] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeolXoV5EysYcTLjmwiOzgAAAdI"]
[Thu Apr 23 21:57:52.393705 2026] [:error] [pid 42972:tid 43037] [client 72.146.32.54:55297] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeolYMOAb-3sOknsk4dKMAAAAFU"]
[Thu Apr 23 21:57:53.836433 2026] [:error] [pid 64998:tid 65021] [client 72.146.32.54:56049] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeolYYV5EysYcTLjmwiO0wAAAdM"]
[Thu Apr 23 21:57:55.163983 2026] [:error] [pid 65000:tid 65055] [client 72.146.32.54:49303] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "aeolY76vRb9j6psK2ZagWgAAAhY"]
[Thu Apr 23 21:57:56.056172 2026] [:error] [pid 42972:tid 43038] [client 72.146.32.54:3238] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeolZMOAb-3sOknsk4dKNgAAAFY"]
[Thu Apr 23 21:57:56.892106 2026] [:error] [pid 65000:tid 65042] [client 72.146.32.54:45080] [client 72.146.32.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeolZL6vRb9j6psK2ZagZgAAAgk"]
[Thu Apr 23 21:57:58.419996 2026] [proxy_fcgi:error] [pid 65000:tid 65042] [client 72.146.32.54:49618] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 22:02:59.279619 2026] [:error] [pid 65000:tid 65054] [client 43.157.67.70:52538] [client 43.157.67.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeomk76vRb9j6psK2ZajoAAAAhU"]
[Thu Apr 23 22:20:12.000203 2026] [:error] [pid 42972:tid 43031] [client 81.167.26.57:8615] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeoqm8OAb-3sOknsk4dSegAAAE8"]
[Thu Apr 23 22:20:14.595871 2026] [:error] [pid 25635:tid 25641] [client 81.167.26.57:63583] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeoqnsRxv6UsgRGKB3I4vgAAAQI"]
[Thu Apr 23 22:20:17.177935 2026] [:error] [pid 64998:tid 65026] [client 81.167.26.57:48688] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aeoqoYV5EysYcTLjmwiaCQAAAdg"]
[Thu Apr 23 22:20:19.814925 2026] [:error] [pid 42973:tid 43053] [client 81.167.26.57:60122] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeoqo26I0QqmmmLTHE0rCAAAAIo"]
[Thu Apr 23 22:20:22.260011 2026] [:error] [pid 42973:tid 43045] [client 81.167.26.57:29890] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeoqpm6I0QqmmmLTHE0rDwAAAII"]
[Thu Apr 23 22:20:24.886950 2026] [:error] [pid 64998:tid 65012] [client 81.167.26.57:59945] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeoqqIV5EysYcTLjmwiaGwAAAco"]
[Thu Apr 23 22:20:27.524042 2026] [:error] [pid 64998:tid 65019] [client 81.167.26.57:6212] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeoqq4V5EysYcTLjmwiaKQAAAdE"]
[Thu Apr 23 22:20:30.170807 2026] [:error] [pid 65000:tid 65050] [client 81.167.26.57:54581] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeoqrr6vRb9j6psK2Zaw1wAAAhE"]
[Thu Apr 23 22:20:35.857849 2026] [:error] [pid 42973:tid 43066] [client 81.167.26.57:35019] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeoqs26I0QqmmmLTHE0rHgAAAJc"]
[Thu Apr 23 22:20:38.344813 2026] [:error] [pid 46953:tid 46972] [client 81.167.26.57:61009] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aeoqtknlpdHh-P6wKbpDnQAAAlA"]
[Thu Apr 23 22:20:40.968317 2026] [:error] [pid 25635:tid 25647] [client 81.167.26.57:6065] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aeoquMRxv6UsgRGKB3I4xQAAAQg"]
[Thu Apr 23 22:20:43.431355 2026] [:error] [pid 42971:tid 43007] [client 81.167.26.57:57937] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aeoquzEP2_5RswrH8bExrQAAABU"]
[Thu Apr 23 22:20:46.020092 2026] [:error] [pid 42972:tid 43024] [client 81.167.26.57:65201] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeoqvsOAb-3sOknsk4dSrwAAAEg"]
[Thu Apr 23 22:20:48.617143 2026] [:error] [pid 59700:tid 59710] [client 81.167.26.57:20280] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "aeoqwJXyGZJFeAIDWtk1HAAAAUg"]
[Thu Apr 23 22:20:51.204690 2026] [:error] [pid 59700:tid 59723] [client 81.167.26.57:13493] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeoqw5XyGZJFeAIDWtk1HgAAAVU"]
[Thu Apr 23 22:20:53.811314 2026] [:error] [pid 64998:tid 65003] [client 81.167.26.57:49936] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeoqxYV5EysYcTLjmwiaogAAAcE"]
[Thu Apr 23 22:20:56.417315 2026] [:error] [pid 59700:tid 59709] [client 81.167.26.57:59078] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeoqyJXyGZJFeAIDWtk1IgAAAUc"]
[Thu Apr 23 22:20:59.083178 2026] [:error] [pid 25635:tid 25663] [client 81.167.26.57:15066] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeoqy8Rxv6UsgRGKB3I41wAAARg"]
[Thu Apr 23 22:21:01.653343 2026] [:error] [pid 42971:tid 42988] [client 81.167.26.57:39487] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeoqzTEP2_5RswrH8bExvgAAAAI"]
[Thu Apr 23 22:21:04.240481 2026] [:error] [pid 59700:tid 59718] [client 81.167.26.57:18123] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeoq0JXyGZJFeAIDWtk1MgAAAVA"]
[Thu Apr 23 22:21:06.844908 2026] [:error] [pid 42973:tid 43048] [client 81.167.26.57:28630] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeoq0m6I0QqmmmLTHE0rVAAAAIU"]
[Thu Apr 23 22:21:09.496130 2026] [:error] [pid 42973:tid 43045] [client 81.167.26.57:14911] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeoq1W6I0QqmmmLTHE0rXAAAAII"]
[Thu Apr 23 22:21:32.821743 2026] [:error] [pid 59700:tid 59704] [client 81.167.26.57:60961] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeoq7JXyGZJFeAIDWtk1RQAAAUI"]
[Thu Apr 23 22:21:34.351141 2026] [:error] [pid 42971:tid 43010] [client 81.167.26.57:46025] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeoq7jEP2_5RswrH8bEx9gAAABg"]
[Thu Apr 23 22:21:36.911756 2026] [:error] [pid 42973:tid 43048] [client 81.167.26.57:1165] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeoq8G6I0QqmmmLTHE0rgQAAAIU"]
[Thu Apr 23 22:21:39.511244 2026] [:error] [pid 65000:tid 65046] [client 81.167.26.57:41775] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeoq876vRb9j6psK2ZaxvAAAAg0"]
[Thu Apr 23 22:21:42.077869 2026] [:error] [pid 42973:tid 43047] [client 81.167.26.57:27137] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeoq9m6I0QqmmmLTHE0rhwAAAIQ"]
[Thu Apr 23 22:21:44.082093 2026] [:error] [pid 65000:tid 65041] [client 81.167.26.57:19328] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeoq-L6vRb9j6psK2ZaxyQAAAgg"]
[Thu Apr 23 22:21:47.894326 2026] [:error] [pid 43083:tid 43091] [client 81.167.26.57:39522] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeoq-zC5hrvNXosL83KCZgAAAMY"]
[Thu Apr 23 22:21:50.452168 2026] [:error] [pid 64998:tid 65006] [client 81.167.26.57:6014] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeoq_oV5EysYcTLjmwia3gAAAcQ"]
[Thu Apr 23 22:21:53.049190 2026] [:error] [pid 42971:tid 42992] [client 81.167.26.57:11808] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeorATEP2_5RswrH8bEyEQAAAAY"]
[Thu Apr 23 22:21:55.655063 2026] [:error] [pid 64998:tid 65008] [client 81.167.26.57:1901] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeorA4V5EysYcTLjmwia8QAAAcY"]
[Thu Apr 23 22:21:58.232513 2026] [:error] [pid 64998:tid 65014] [client 81.167.26.57:57855] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeorBoV5EysYcTLjmwibBAAAAcw"]
[Thu Apr 23 22:22:00.267768 2026] [:error] [pid 64998:tid 65023] [client 81.167.26.57:62232] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeorCIV5EysYcTLjmwibDwAAAdU"]
[Thu Apr 23 22:22:02.229842 2026] [:error] [pid 42973:tid 43054] [client 81.167.26.57:3782] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeorCm6I0QqmmmLTHE0rngAAAIs"]
[Thu Apr 23 22:22:04.212439 2026] [:error] [pid 64998:tid 65020] [client 81.167.26.57:64249] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeorDIV5EysYcTLjmwibEwAAAdI"]
[Thu Apr 23 22:22:06.192116 2026] [:error] [pid 59700:tid 59713] [client 81.167.26.57:24340] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeorDpXyGZJFeAIDWtk1agAAAUs"]
[Thu Apr 23 22:22:08.626099 2026] [:error] [pid 65000:tid 65053] [client 81.167.26.57:54778] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeorEL6vRb9j6psK2Zax6gAAAhQ"]
[Thu Apr 23 22:22:11.381058 2026] [:error] [pid 64967:tid 64978] [client 81.167.26.57:38325] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeorE4AV4GfOOdX8Qzp8GgAAAYk"]
[Thu Apr 23 22:22:14.098154 2026] [:error] [pid 43083:tid 43090] [client 81.167.26.57:60857] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeorFjC5hrvNXosL83KChQAAAMU"]
[Thu Apr 23 22:22:16.114406 2026] [:error] [pid 42972:tid 43031] [client 81.167.26.57:9842] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeorGMOAb-3sOknsk4dTjwAAAE8"]
[Thu Apr 23 23:19:47.093314 2026] [:error] [pid 42972:tid 43035] [client 43.166.240.231:34448] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeo4k8OAb-3sOknsk4dm2AAAAFM"]
[Thu Apr 23 23:44:40.565593 2026] [proxy_fcgi:error] [pid 65000:tid 65037] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:40.728824 2026] [proxy_fcgi:error] [pid 65000:tid 65049] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:40.889447 2026] [proxy_fcgi:error] [pid 65000:tid 65052] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:41.049431 2026] [proxy_fcgi:error] [pid 65000:tid 65045] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:41.210786 2026] [proxy_fcgi:error] [pid 65000:tid 65051] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:41.373265 2026] [proxy_fcgi:error] [pid 65000:tid 65043] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:43.080595 2026] [proxy_fcgi:error] [pid 65000:tid 65057] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:43.242467 2026] [proxy_fcgi:error] [pid 65000:tid 65040] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:43.571231 2026] [proxy_fcgi:error] [pid 65000:tid 65031] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:43.741297 2026] [proxy_fcgi:error] [pid 65000:tid 65030] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:43.903306 2026] [proxy_fcgi:error] [pid 65000:tid 65054] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.062861 2026] [proxy_fcgi:error] [pid 65000:tid 65044] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.222041 2026] [proxy_fcgi:error] [pid 65000:tid 65031] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.390814 2026] [proxy_fcgi:error] [pid 65000:tid 65037] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.560300 2026] [proxy_fcgi:error] [pid 65000:tid 65029] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.726310 2026] [proxy_fcgi:error] [pid 65000:tid 65051] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:44.888655 2026] [proxy_fcgi:error] [pid 65000:tid 65045] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:45.049947 2026] [proxy_fcgi:error] [pid 65000:tid 65056] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:46.333876 2026] [proxy_fcgi:error] [pid 65000:tid 65054] [client 173.239.218.65:59265] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 23:44:47.300181 2026] [:error] [pid 65000:tid 65044] [client 173.239.218.65:59265] [client 173.239.218.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeo-b76vRb9j6psK2ZbqKQAAAgs"]
[Thu Apr 23 23:45:00.856298 2026] [autoindex:error] [pid 64998:tid 65016] [client 173.239.218.63:44167] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:45:14.923470 2026] [autoindex:error] [pid 64998:tid 65006] [client 173.239.218.63:44167] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 00:05:56.336359 2026] [:error] [pid 65000:tid 65051] [client 95.217.109.26:41390] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aepDZL6vRb9j6psK2ZYLgAAAAhI"]
[Fri Apr 24 00:06:08.387498 2026] [:error] [pid 42973:tid 43053] [client 95.217.109.26:54084] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aepDcG6I0QqmmmLTHE1YewAAAIo"]
[Fri Apr 24 00:06:12.342865 2026] [:error] [pid 59700:tid 59708] [client 95.217.109.26:54090] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aepDdJXyGZJFeAIDWtlWnQAAAUY"]
[Fri Apr 24 02:01:01.348343 2026] [:error] [pid 64998:tid 65007] [client 51.75.128.94:49948] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aepeXYV5EysYcTLjmwg5XQAAAcU"]
[Fri Apr 24 02:01:03.368978 2026] [:error] [pid 59700:tid 59716] [client 51.75.128.94:57918] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aepeX5XyGZJFeAIDWtl5dAAAAU4"]
[Fri Apr 24 02:01:05.957319 2026] [:error] [pid 42972:tid 43040] [client 51.75.128.94:60652] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aepeYcOAb-3sOknsk4fHaQAAAFg"]
[Fri Apr 24 02:01:07.984836 2026] [:error] [pid 43083:tid 43096] [client 51.75.128.94:46330] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aepeYzC5hrvNXosL83Kv4wAAAMs"]
[Fri Apr 24 02:01:10.364158 2026] [:error] [pid 42973:tid 43058] [client 51.75.128.94:43278] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aepeZm6I0QqmmmLTHE2G5gAAAI8"]
[Fri Apr 24 02:01:12.764791 2026] [:error] [pid 65000:tid 65029] [client 51.75.128.94:43288] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aepeaL6vRb9j6psK2ZaDgAAAAgA"]
[Fri Apr 24 02:01:15.301740 2026] [:error] [pid 59700:tid 59710] [client 51.75.128.94:43294] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aepea5XyGZJFeAIDWtl5fQAAAUg"]
[Fri Apr 24 02:26:00.161295 2026] [proxy_fcgi:error] [pid 64998:tid 65016] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:00.403336 2026] [proxy_fcgi:error] [pid 64998:tid 65010] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:00.643190 2026] [proxy_fcgi:error] [pid 64998:tid 65006] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:00.882357 2026] [proxy_fcgi:error] [pid 64998:tid 65002] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:01.122408 2026] [proxy_fcgi:error] [pid 64998:tid 65003] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:01.362547 2026] [proxy_fcgi:error] [pid 64998:tid 65011] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 02:26:01.604071 2026] [proxy_fcgi:error] [pid 64998:tid 65024] [client 51.11.246.40:1962] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 04:13:34.261830 2026] [:error] [pid 19102:tid 19165] [client 81.85.77.17:52130] [client 81.85.77.17] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aep9bgDSgrbLEZbkqD6RrQAAAIE"]
[Fri Apr 24 04:13:36.505352 2026] [:error] [pid 19102:tid 19171] [client 81.85.77.17:52130] [client 81.85.77.17] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aep9cADSgrbLEZbkqD6RrwAAAIc"]
[Fri Apr 24 05:04:09.964379 2026] [:error] [pid 19100:tid 19123] [client 182.44.8.254:38944] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeqJSbF_hzQs4Cqbiff4mQAAAA0"]
[Fri Apr 24 06:22:09.499503 2026] [:error] [pid 52129:tid 52141] [client 51.77.43.178:45494] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeqbkeKCZKf8_u2LKiBuhQAAAQg"]
[Fri Apr 24 06:22:11.177321 2026] [:error] [pid 19200:tid 19208] [client 51.77.43.178:53928] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeqbkzQ--M3-tsKAnhGmDAAAAMA"]
[Fri Apr 24 06:22:13.228071 2026] [:error] [pid 19200:tid 19216] [client 51.77.43.178:59296] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeqblTQ--M3-tsKAnhGmFwAAAMg"]
[Fri Apr 24 06:22:13.519519 2026] [:error] [pid 19200:tid 19211] [client 51.77.43.178:53940] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeqblTQ--M3-tsKAnhGmGgAAAMM"]
[Fri Apr 24 06:22:15.873320 2026] [:error] [pid 19101:tid 19143] [client 51.77.43.178:59300] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeqbl2AHj9bEvrTgbO3UDQAAAEY"]
[Fri Apr 24 06:22:16.316626 2026] [:error] [pid 52129:tid 52153] [client 51.77.43.178:59308] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeqbmOKCZKf8_u2LKiBuogAAARQ"]
[Fri Apr 24 06:22:18.823607 2026] [:error] [pid 19102:tid 19171] [client 51.77.43.178:35326] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeqbmgDSgrbLEZbkqD7LswAAAIc"]
[Fri Apr 24 06:22:19.845524 2026] [:error] [pid 19102:tid 19178] [client 51.77.43.178:53854] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeqbmwDSgrbLEZbkqD7LtgAAAI4"]
[Fri Apr 24 06:22:21.939472 2026] [:error] [pid 19100:tid 19111] [client 51.77.43.178:35338] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeqbnbF_hzQs4CqbifcPEwAAAAI"]
[Fri Apr 24 06:22:23.953253 2026] [:error] [pid 52129:tid 52145] [client 51.77.43.178:53870] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeqbn-KCZKf8_u2LKiBuzQAAAQw"]
[Fri Apr 24 06:22:25.413350 2026] [:error] [pid 19200:tid 19223] [client 51.77.43.178:53876] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqboTQ--M3-tsKAnhGmSwAAAM8"]
[Fri Apr 24 06:22:27.332021 2026] [:error] [pid 19102:tid 19178] [client 51.77.43.178:35346] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeqbowDSgrbLEZbkqD7L4gAAAI4"]
[Fri Apr 24 06:22:27.653285 2026] [:error] [pid 19102:tid 19166] [client 51.77.43.178:38802] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqbowDSgrbLEZbkqD7L5wAAAII"]
[Fri Apr 24 06:22:29.742800 2026] [:error] [pid 19102:tid 19181] [client 51.77.43.178:38808] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqbpQDSgrbLEZbkqD7L8QAAAJE"]
[Fri Apr 24 06:22:30.876291 2026] [:error] [pid 19101:tid 19138] [client 51.77.43.178:53178] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqbpmAHj9bEvrTgbO3UGQAAAEE"]
[Fri Apr 24 06:22:32.080624 2026] [:error] [pid 52129:tid 52136] [client 51.77.43.178:38810] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqbqOKCZKf8_u2LKiBu8AAAAQM"]
[Fri Apr 24 06:22:34.596782 2026] [:error] [pid 52129:tid 52139] [client 51.77.43.178:38816] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqbquKCZKf8_u2LKiBu-wAAAQY"]
[Fri Apr 24 06:22:36.087501 2026] [:error] [pid 52129:tid 52149] [client 51.77.43.178:38818] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqbrOKCZKf8_u2LKiBvAgAAARA"]
[Fri Apr 24 06:22:37.527942 2026] [:error] [pid 19200:tid 19229] [client 51.77.43.178:59052] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqbrTQ--M3-tsKAnhGmeQAAANU"]
[Fri Apr 24 06:22:39.823031 2026] [:error] [pid 52129:tid 52144] [client 51.77.43.178:59066] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqbr-KCZKf8_u2LKiBvHgAAAQs"]
[Fri Apr 24 06:22:44.275138 2026] [:error] [pid 19102:tid 19167] [client 51.77.43.178:59072] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqbtADSgrbLEZbkqD7MRQAAAIM"]
[Fri Apr 24 06:23:52.794715 2026] [:error] [pid 52129:tid 52145] [client 51.77.43.178:44584] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqb-OKCZKf8_u2LKiBwgAAAAQw"]
[Fri Apr 24 06:23:54.881822 2026] [:error] [pid 19101:tid 19158] [client 51.77.43.178:33860] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqb-mAHj9bEvrTgbO3UqwAAAFU"]
[Fri Apr 24 06:23:56.992125 2026] [:error] [pid 52129:tid 52136] [client 51.77.43.178:45928] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqb_OKCZKf8_u2LKiBwmgAAAQM"]
[Fri Apr 24 06:23:58.966100 2026] [:error] [pid 19102:tid 19177] [client 51.77.43.178:49004] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqb_gDSgrbLEZbkqD7NBwAAAI0"]
[Fri Apr 24 06:24:03.022455 2026] [:error] [pid 19102:tid 19179] [client 51.77.43.178:49012] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqcAwDSgrbLEZbkqD7NDAAAAI8"]
[Fri Apr 24 06:28:27.500181 2026] [:error] [pid 52129:tid 52157] [client 51.77.43.178:60724] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqdC-KCZKf8_u2LKiBzuwAAARg"]
[Fri Apr 24 06:28:31.651010 2026] [:error] [pid 19101:tid 19153] [client 51.77.43.178:44134] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqdD2AHj9bEvrTgbO3WggAAAFA"]
[Fri Apr 24 06:28:34.235153 2026] [:error] [pid 19200:tid 19232] [client 51.77.43.178:44142] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqdEjQ--M3-tsKAnhGq7AAAANg"]
[Fri Apr 24 06:28:37.555179 2026] [:error] [pid 19101:tid 19141] [client 51.77.43.178:35978] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqdFWAHj9bEvrTgbO3WiAAAAEQ"]
[Fri Apr 24 06:28:41.819009 2026] [:error] [pid 19200:tid 19222] [client 51.77.43.178:35988] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqdGTQ--M3-tsKAnhGq-gAAAM4"]
[Fri Apr 24 06:32:07.913838 2026] [:error] [pid 19102:tid 19168] [client 51.77.43.178:51046] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqd5wDSgrbLEZbkqD7QYwAAAIQ"]
[Fri Apr 24 06:32:10.978165 2026] [:error] [pid 19102:tid 19180] [client 51.77.43.178:40266] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqd6gDSgrbLEZbkqD7QaAAAAJA"]
[Fri Apr 24 06:32:12.251492 2026] [:error] [pid 19100:tid 19126] [client 51.77.43.178:40278] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqd7LF_hzQs4CqbifcR2gAAABA"]
[Fri Apr 24 06:32:16.608224 2026] [:error] [pid 52129:tid 52137] [client 51.77.43.178:40282] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqd8OKCZKf8_u2LKiB2UgAAAQQ"]
[Fri Apr 24 06:36:13.879742 2026] [:error] [pid 52129:tid 52152] [client 51.77.43.178:35644] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeqe3eKCZKf8_u2LKiB4xwAAARM"]
[Fri Apr 24 06:36:14.003426 2026] [:error] [pid 19102:tid 19184] [client 51.77.43.178:33136] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "aeqe3gDSgrbLEZbkqD7SMwAAAJQ"]
[Fri Apr 24 06:36:15.778671 2026] [:error] [pid 52129:tid 52157] [client 51.77.43.178:33132] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeqe3-KCZKf8_u2LKiB4zwAAARg"]
[Fri Apr 24 06:36:16.628335 2026] [:error] [pid 19102:tid 19185] [client 51.77.43.178:35648] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "aeqe4ADSgrbLEZbkqD7SOQAAAJU"]
[Fri Apr 24 06:36:17.944146 2026] [:error] [pid 52129:tid 52135] [client 51.77.43.178:39116] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeqe4eKCZKf8_u2LKiB42gAAAQI"]
[Fri Apr 24 06:36:18.752996 2026] [:error] [pid 52129:tid 52155] [client 51.77.43.178:39128] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "aeqe4uKCZKf8_u2LKiB43QAAARY"]
[Fri Apr 24 06:36:21.133753 2026] [:error] [pid 19100:tid 19134] [client 51.77.43.178:48694] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeqe5bF_hzQs4CqbifcSowAAABg"]
[Fri Apr 24 06:36:21.471526 2026] [:error] [pid 19101:tid 19159] [client 51.77.43.178:39154] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "aeqe5WAHj9bEvrTgbO3YaQAAAFY"]
[Fri Apr 24 06:36:23.196355 2026] [:error] [pid 19101:tid 19139] [client 51.77.43.178:39166] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeqe52AHj9bEvrTgbO3YagAAAEI"]
[Fri Apr 24 06:36:26.072720 2026] [:error] [pid 19200:tid 19218] [client 51.77.43.178:48700] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aeqe6jQ--M3-tsKAnhGuHwAAAMo"]
[Fri Apr 24 06:36:26.423332 2026] [:error] [pid 52129:tid 52155] [client 51.77.43.178:48716] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqe6uKCZKf8_u2LKiB47wAAARY"]
[Fri Apr 24 06:36:28.514508 2026] [:error] [pid 52129:tid 52144] [client 51.77.43.178:36966] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "aeqe7OKCZKf8_u2LKiB49QAAAQs"]
[Fri Apr 24 06:36:29.158301 2026] [:error] [pid 52129:tid 52149] [client 51.77.43.178:36972] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqe7eKCZKf8_u2LKiB4-AAAARA"]
[Fri Apr 24 06:36:31.564084 2026] [:error] [pid 19200:tid 19231] [client 51.77.43.178:36978] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqe7zQ--M3-tsKAnhGuJgAAANc"]
[Fri Apr 24 06:36:31.788534 2026] [:error] [pid 19102:tid 19169] [client 51.77.43.178:58194] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeqe7wDSgrbLEZbkqD7SXwAAAIU"]
[Fri Apr 24 06:36:32.795989 2026] [:error] [pid 52129:tid 52144] [client 51.77.43.178:36988] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqe8OKCZKf8_u2LKiB5BgAAAQs"]
[Fri Apr 24 06:36:34.719043 2026] [:error] [pid 19200:tid 19227] [client 51.77.43.178:36992] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeqe8jQ--M3-tsKAnhGuLQAAANM"]
[Fri Apr 24 06:36:36.785696 2026] [:error] [pid 19200:tid 19226] [client 51.77.43.178:37002] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeqe9DQ--M3-tsKAnhGuLwAAANI"]
[Fri Apr 24 06:36:37.197797 2026] [:error] [pid 19200:tid 19214] [client 51.77.43.178:37012] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqe9TQ--M3-tsKAnhGuMAAAAMY"]
[Fri Apr 24 06:36:38.159899 2026] [:error] [pid 19200:tid 19220] [client 51.77.43.178:50558] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqe9jQ--M3-tsKAnhGuMQAAAMw"]
[Fri Apr 24 06:36:42.793531 2026] [:error] [pid 19100:tid 19118] [client 51.77.43.178:50566] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeqe-rF_hzQs4CqbifcSvAAAAAg"]
[Fri Apr 24 06:37:41.642702 2026] [:error] [pid 19100:tid 19122] [client 170.106.180.246:48986] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeqfNbF_hzQs4CqbifcTBAAAAAw"]
[Fri Apr 24 08:15:44.040681 2026] [:error] [pid 52129:tid 52153] [client 49.51.183.220:49552] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeq2MOKCZKf8_u2LKiABfgAAARQ"]
[Fri Apr 24 09:37:11.374309 2026] [proxy_fcgi:error] [pid 19101:tid 19137] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:11.655794 2026] [proxy_fcgi:error] [pid 19101:tid 19160] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:11.899875 2026] [proxy_fcgi:error] [pid 19101:tid 19140] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:12.149423 2026] [proxy_fcgi:error] [pid 19101:tid 19141] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:12.390657 2026] [proxy_fcgi:error] [pid 19101:tid 19161] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:12.648391 2026] [proxy_fcgi:error] [pid 19101:tid 19146] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:12.889724 2026] [proxy_fcgi:error] [pid 19101:tid 19152] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:13.132114 2026] [proxy_fcgi:error] [pid 19101:tid 19144] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:13.380291 2026] [proxy_fcgi:error] [pid 19101:tid 19143] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:13.626295 2026] [proxy_fcgi:error] [pid 19101:tid 19149] [client 172.161.55.226:8418] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:37:13.910214 2026] [:error] [pid 19101:tid 19150] [client 172.161.55.226:8418] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aerJSWAHj9bEvrTgbO03EgAAAE0"]
[Fri Apr 24 09:37:14.759040 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:54504] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aerJSjQ--M3-tsKAnhFE0AAAAMo"]
[Fri Apr 24 09:37:15.448251 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:8402] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aerJSzQ--M3-tsKAnhFE1wAAAME"]
[Fri Apr 24 09:37:16.080300 2026] [:error] [pid 19100:tid 19133] [client 172.161.55.226:54732] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aerJTLF_hzQs4Cqbifdo5wAAABc"]
[Fri Apr 24 09:37:16.770755 2026] [:error] [pid 19101:tid 19146] [client 172.161.55.226:40719] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aerJTGAHj9bEvrTgbO03FQAAAEk"]
[Fri Apr 24 09:37:17.423058 2026] [:error] [pid 52129:tid 52136] [client 172.161.55.226:40706] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aerJTeKCZKf8_u2LKiBK0QAAAQM"]
[Fri Apr 24 09:37:17.991374 2026] [:error] [pid 19101:tid 19153] [client 172.161.55.226:51650] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aerJTWAHj9bEvrTgbO03GgAAAFA"]
[Fri Apr 24 09:37:18.548701 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:54755] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aerJTuKCZKf8_u2LKiBK1AAAAQA"]
[Fri Apr 24 09:37:19.269906 2026] [:error] [pid 52129:tid 52144] [client 172.161.55.226:54527] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aerJT-KCZKf8_u2LKiBK2QAAAQs"]
[Fri Apr 24 09:37:19.872865 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:8394] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aerJT-KCZKf8_u2LKiBK3AAAARI"]
[Fri Apr 24 09:37:20.667135 2026] [:error] [pid 19100:tid 19129] [client 172.161.55.226:40739] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aerJULF_hzQs4Cqbifdo8AAAABM"]
[Fri Apr 24 09:37:21.221290 2026] [:error] [pid 19200:tid 19221] [client 172.161.55.226:8433] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aerJUTQ--M3-tsKAnhFE4QAAAM0"]
[Fri Apr 24 09:37:22.616933 2026] [:error] [pid 19100:tid 19124] [client 172.161.55.226:8349] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aerJUrF_hzQs4Cqbifdo9gAAAA4"]
[Fri Apr 24 09:37:23.255937 2026] [:error] [pid 19101:tid 19161] [client 172.161.55.226:51207] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aerJU2AHj9bEvrTgbO03HAAAAFg"]
[Fri Apr 24 09:37:24.080355 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:51678] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aerJVOKCZKf8_u2LKiBK7AAAAQc"]
[Fri Apr 24 09:37:25.600046 2026] [:error] [pid 19200:tid 19213] [client 172.161.55.226:8325] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aerJVTQ--M3-tsKAnhFE6wAAAMU"]
[Fri Apr 24 09:37:26.349509 2026] [:error] [pid 19200:tid 19215] [client 172.161.55.226:42020] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aerJVjQ--M3-tsKAnhFE7QAAAMc"]
[Fri Apr 24 09:37:27.069941 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:51898] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aerJV-KCZKf8_u2LKiBLAgAAAQY"]
[Fri Apr 24 09:37:27.825849 2026] [:error] [pid 52129:tid 52149] [client 172.161.55.226:44046] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aerJV-KCZKf8_u2LKiBLCAAAARA"]
[Fri Apr 24 09:37:28.520268 2026] [:error] [pid 19200:tid 19224] [client 172.161.55.226:51211] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aerJWDQ--M3-tsKAnhFE9gAAANA"]
[Fri Apr 24 09:37:29.297700 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:8417] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aerJWTQ--M3-tsKAnhFE-QAAANM"]
[Fri Apr 24 09:37:29.818572 2026] [:error] [pid 19100:tid 19111] [client 172.161.55.226:51241] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aerJWbF_hzQs4Cqbifdo-AAAAAI"]
[Fri Apr 24 09:37:30.340499 2026] [:error] [pid 19102:tid 19183] [client 172.161.55.226:63665] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aerJWgDSgrbLEZbkqD5HgAAAAJM"]
[Fri Apr 24 09:37:31.069011 2026] [:error] [pid 19101:tid 19153] [client 172.161.55.226:51787] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aerJW2AHj9bEvrTgbO03JwAAAFA"]
[Fri Apr 24 09:37:31.631152 2026] [:error] [pid 19102:tid 19168] [client 172.161.55.226:41368] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "aerJWwDSgrbLEZbkqD5HhwAAAIQ"]
[Fri Apr 24 09:37:32.457626 2026] [:error] [pid 19200:tid 19216] [client 172.161.55.226:47693] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "aerJXDQ--M3-tsKAnhFE_wAAAMg"]
[Fri Apr 24 09:37:33.036597 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:54519] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "aerJXQDSgrbLEZbkqD5HiwAAAIE"]
[Fri Apr 24 09:37:33.841209 2026] [:error] [pid 19101:tid 19154] [client 172.161.55.226:44091] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "aerJXWAHj9bEvrTgbO03LAAAAFE"]
[Fri Apr 24 09:37:34.381107 2026] [:error] [pid 19102:tid 19188] [client 172.161.55.226:8446] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aerJXgDSgrbLEZbkqD5HjwAAAJg"]
[Fri Apr 24 09:37:34.954190 2026] [:error] [pid 52129:tid 52148] [client 172.161.55.226:8322] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aerJXuKCZKf8_u2LKiBLEwAAAQ8"]
[Fri Apr 24 09:37:35.657321 2026] [:error] [pid 19101:tid 19158] [client 172.161.55.226:51221] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aerJX2AHj9bEvrTgbO03MgAAAFU"]
[Fri Apr 24 09:37:36.169052 2026] [:error] [pid 52129:tid 52152] [client 172.161.55.226:41353] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aerJYOKCZKf8_u2LKiBLGAAAARM"]
[Fri Apr 24 09:37:36.856183 2026] [:error] [pid 19101:tid 19145] [client 172.161.55.226:51779] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "aerJYGAHj9bEvrTgbO03MwAAAEg"]
[Fri Apr 24 09:37:37.571811 2026] [:error] [pid 19200:tid 19217] [client 172.161.55.226:8406] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "aerJYTQ--M3-tsKAnhFFDAAAAMk"]
[Fri Apr 24 09:37:38.582347 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:47688] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "aerJYjQ--M3-tsKAnhFFDgAAAMI"]
[Fri Apr 24 09:37:39.360905 2026] [:error] [pid 19102:tid 19177] [client 172.161.55.226:56416] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "aerJYwDSgrbLEZbkqD5HmwAAAI0"]
[Fri Apr 24 09:37:40.035582 2026] [:error] [pid 19200:tid 19223] [client 172.161.55.226:41350] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aerJZDQ--M3-tsKAnhFFEQAAAM8"]
[Fri Apr 24 09:37:40.691957 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:51802] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aerJZDQ--M3-tsKAnhFFEwAAANM"]
[Fri Apr 24 09:37:41.452747 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:51201] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aerJZTQ--M3-tsKAnhFFGQAAAMo"]
[Fri Apr 24 09:37:42.202581 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:54465] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "aerJZuKCZKf8_u2LKiBLJQAAAQc"]
[Fri Apr 24 09:37:42.872622 2026] [:error] [pid 52129:tid 52145] [client 172.161.55.226:51251] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aerJZuKCZKf8_u2LKiBLKAAAAQw"]
[Fri Apr 24 09:37:43.591633 2026] [:error] [pid 19102:tid 19166] [client 172.161.55.226:55225] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aerJZwDSgrbLEZbkqD5HpwAAAII"]
[Fri Apr 24 09:37:44.176888 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:47714] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aerJaDQ--M3-tsKAnhFFHgAAAMI"]
[Fri Apr 24 09:37:44.856060 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:56396] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aerJaADSgrbLEZbkqD5HrQAAAIE"]
[Fri Apr 24 09:37:45.448096 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:57172] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aerJaeKCZKf8_u2LKiBLMQAAAQc"]
[Fri Apr 24 09:37:45.956410 2026] [:error] [pid 19100:tid 19120] [client 172.161.55.226:41318] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aerJabF_hzQs4Cqbifdo_AAAAAo"]
[Fri Apr 24 09:37:46.566105 2026] [:error] [pid 19200:tid 19231] [client 172.161.55.226:49139] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aerJajQ--M3-tsKAnhFFKAAAANc"]
[Fri Apr 24 09:37:47.367069 2026] [:error] [pid 19200:tid 19214] [client 172.161.55.226:57153] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aerJazQ--M3-tsKAnhFFLwAAAMY"]
[Fri Apr 24 09:37:48.306837 2026] [:error] [pid 19200:tid 19231] [client 172.161.55.226:46580] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "aerJbDQ--M3-tsKAnhFFMwAAANc"]
[Fri Apr 24 09:37:48.985914 2026] [:error] [pid 19200:tid 19213] [client 172.161.55.226:51590] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "aerJbDQ--M3-tsKAnhFFNgAAAMU"]
[Fri Apr 24 09:37:49.502869 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:9147] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "aerJbeKCZKf8_u2LKiBLPgAAARI"]
[Fri Apr 24 09:37:50.126964 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:49122] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "aerJbjQ--M3-tsKAnhFFOgAAANU"]
[Fri Apr 24 09:37:51.111570 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:55190] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "aerJbzQ--M3-tsKAnhFFPAAAAME"]
[Fri Apr 24 09:37:51.692998 2026] [:error] [pid 19102:tid 19185] [client 172.161.55.226:9097] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "aerJbwDSgrbLEZbkqD5HuwAAAJU"]
[Fri Apr 24 09:37:52.511737 2026] [:error] [pid 19200:tid 19211] [client 172.161.55.226:43160] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "aerJcDQ--M3-tsKAnhFFQwAAAMM"]
[Fri Apr 24 09:37:53.045432 2026] [:error] [pid 19200:tid 19225] [client 172.161.55.226:60007] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "aerJcTQ--M3-tsKAnhFFRAAAANE"]
[Fri Apr 24 09:37:53.810396 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:9134] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aerJcTQ--M3-tsKAnhFFRgAAANU"]
[Fri Apr 24 09:37:54.498388 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:60008] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aerJcjQ--M3-tsKAnhFFSwAAAME"]
[Fri Apr 24 09:37:55.253846 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:50399] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aerJc-KCZKf8_u2LKiBLWgAAAQc"]
[Fri Apr 24 09:37:56.170482 2026] [:error] [pid 52129:tid 52156] [client 172.161.55.226:55144] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "aerJdOKCZKf8_u2LKiBLYAAAARc"]
[Fri Apr 24 09:37:56.683785 2026] [:error] [pid 19200:tid 19225] [client 172.161.55.226:55119] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aerJdDQ--M3-tsKAnhFFTAAAANE"]
[Fri Apr 24 09:37:57.780415 2026] [:error] [pid 19102:tid 19184] [client 172.161.55.226:56451] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aerJdQDSgrbLEZbkqD5HxwAAAJQ"]
[Fri Apr 24 09:37:58.964526 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:46948] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aerJduKCZKf8_u2LKiBLbgAAARI"]
[Fri Apr 24 09:38:00.394953 2026] [:error] [pid 52129:tid 52154] [client 172.161.55.226:39627] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aerJeOKCZKf8_u2LKiBLdAAAARU"]
[Fri Apr 24 09:38:01.115530 2026] [:error] [pid 19200:tid 19230] [client 172.161.55.226:63696] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aerJeTQ--M3-tsKAnhFFWAAAANY"]
[Fri Apr 24 09:38:01.774050 2026] [:error] [pid 19100:tid 19129] [client 172.161.55.226:46959] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aerJebF_hzQs4CqbifdpBwAAABM"]
[Fri Apr 24 09:38:02.264140 2026] [:error] [pid 19102:tid 19182] [client 172.161.55.226:47804] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aerJegDSgrbLEZbkqD5HzQAAAJI"]
[Fri Apr 24 09:38:03.075818 2026] [:error] [pid 19100:tid 19118] [client 172.161.55.226:55939] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aerJe7F_hzQs4CqbifdpCwAAAAg"]
[Fri Apr 24 09:38:03.704875 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:63683] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aerJe-KCZKf8_u2LKiBLgAAAAQY"]
[Fri Apr 24 09:38:04.273928 2026] [:error] [pid 19100:tid 19124] [client 172.161.55.226:45598] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aerJfLF_hzQs4CqbifdpDgAAAA4"]
[Fri Apr 24 09:38:04.939881 2026] [:error] [pid 19100:tid 19126] [client 172.161.55.226:62922] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aerJfLF_hzQs4CqbifdpEgAAABA"]
[Fri Apr 24 09:38:05.693512 2026] [:error] [pid 19200:tid 19224] [client 172.161.55.226:45568] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aerJfTQ--M3-tsKAnhFFZAAAANA"]
[Fri Apr 24 09:38:06.495751 2026] [:error] [pid 19200:tid 19217] [client 172.161.55.226:50391] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aerJfjQ--M3-tsKAnhFFaQAAAMk"]
[Fri Apr 24 09:38:07.282998 2026] [:error] [pid 19200:tid 19208] [client 172.161.55.226:8473] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aerJfzQ--M3-tsKAnhFFbgAAAMA"]
[Fri Apr 24 09:38:07.987324 2026] [:error] [pid 19100:tid 19116] [client 172.161.55.226:63705] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aerJf7F_hzQs4CqbifdpGgAAAAc"]
[Fri Apr 24 09:38:08.524911 2026] [:error] [pid 19102:tid 19166] [client 172.161.55.226:49562] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aerJgADSgrbLEZbkqD5H0gAAAII"]
[Fri Apr 24 09:38:09.242785 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:54970] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aerJgTQ--M3-tsKAnhFFewAAANM"]
[Fri Apr 24 09:38:10.098655 2026] [:error] [pid 19101:tid 19153] [client 172.161.55.226:53356] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aerJgmAHj9bEvrTgbO03QgAAAFA"]
[Fri Apr 24 09:38:10.762881 2026] [:error] [pid 19100:tid 19109] [client 172.161.55.226:47001] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aerJgrF_hzQs4CqbifdpGwAAAAA"]
[Fri Apr 24 09:38:11.512523 2026] [:error] [pid 52129:tid 52144] [client 172.161.55.226:56835] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aerJg-KCZKf8_u2LKiBLiAAAAQs"]
[Fri Apr 24 09:38:12.157001 2026] [:error] [pid 19200:tid 19214] [client 172.161.55.226:44649] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "aerJhDQ--M3-tsKAnhFFmAAAAMY"]
[Fri Apr 24 09:38:13.049814 2026] [proxy_fcgi:error] [pid 19101:tid 19146] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:13.289735 2026] [proxy_fcgi:error] [pid 19101:tid 19158] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:13.536564 2026] [proxy_fcgi:error] [pid 19101:tid 19147] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:13.776557 2026] [proxy_fcgi:error] [pid 19101:tid 19152] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:14.046287 2026] [proxy_fcgi:error] [pid 19101:tid 19157] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:14.286138 2026] [proxy_fcgi:error] [pid 19101:tid 19144] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:14.536580 2026] [proxy_fcgi:error] [pid 19101:tid 19149] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:14.774624 2026] [proxy_fcgi:error] [pid 19101:tid 19143] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:15.011802 2026] [proxy_fcgi:error] [pid 19101:tid 19139] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:15.251826 2026] [proxy_fcgi:error] [pid 19101:tid 19150] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:15.490608 2026] [proxy_fcgi:error] [pid 19101:tid 19155] [client 172.161.55.226:47776] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:38:15.726982 2026] [:error] [pid 19101:tid 19156] [client 172.161.55.226:47776] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aerJh2AHj9bEvrTgbO03VgAAAFM"]
[Fri Apr 24 09:38:16.238580 2026] [:error] [pid 19200:tid 19225] [client 172.161.55.226:47785] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aerJiDQ--M3-tsKAnhFFmgAAANE"]
[Fri Apr 24 09:38:16.855181 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:44618] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aerJiDQ--M3-tsKAnhFFnwAAANU"]
[Fri Apr 24 09:38:17.597692 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:47764] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aerJiTQ--M3-tsKAnhFFoQAAAMI"]
[Fri Apr 24 09:38:18.276788 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:55980] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aerJijQ--M3-tsKAnhFFqAAAAMo"]
[Fri Apr 24 09:38:18.947506 2026] [:error] [pid 19101:tid 19151] [client 172.161.55.226:57929] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aerJimAHj9bEvrTgbO03VwAAAE4"]
[Fri Apr 24 09:38:19.560839 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:53320] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aerJi-KCZKf8_u2LKiBLsAAAAQQ"]
[Fri Apr 24 09:38:20.168995 2026] [:error] [pid 19101:tid 19144] [client 172.161.55.226:62582] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aerJjGAHj9bEvrTgbO03WgAAAEc"]
[Fri Apr 24 09:38:20.922098 2026] [:error] [pid 52129:tid 52153] [client 172.161.55.226:53350] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aerJjOKCZKf8_u2LKiBLtgAAARQ"]
[Fri Apr 24 09:38:22.022486 2026] [:error] [pid 19200:tid 19219] [client 172.161.55.226:53327] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aerJjjQ--M3-tsKAnhFFsgAAAMs"]
[Fri Apr 24 09:38:23.342957 2026] [:error] [pid 19102:tid 19170] [client 172.161.55.226:50433] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aerJjwDSgrbLEZbkqD5H4gAAAIY"]
[Fri Apr 24 09:38:24.153101 2026] [:error] [pid 19101:tid 19138] [client 172.161.55.226:44653] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aerJkGAHj9bEvrTgbO03YgAAAEE"]
[Fri Apr 24 09:38:24.787833 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:46630] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aerJkOKCZKf8_u2LKiBLvQAAARI"]
[Fri Apr 24 09:38:25.383734 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:9057] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aerJkTQ--M3-tsKAnhFFuQAAANM"]
[Fri Apr 24 09:38:25.963016 2026] [:error] [pid 19101:tid 19146] [client 172.161.55.226:50460] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aerJkWAHj9bEvrTgbO03aQAAAEk"]
[Fri Apr 24 09:38:26.595062 2026] [:error] [pid 19200:tid 19215] [client 172.161.55.226:43127] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aerJkjQ--M3-tsKAnhFFvQAAAMc"]
[Fri Apr 24 09:38:27.379374 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:61968] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aerJk-KCZKf8_u2LKiBLxgAAAQA"]
[Fri Apr 24 09:38:28.330496 2026] [:error] [pid 19200:tid 19226] [client 172.161.55.226:57921] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aerJlDQ--M3-tsKAnhFFxQAAANI"]
[Fri Apr 24 09:38:29.173558 2026] [:error] [pid 19100:tid 19132] [client 172.161.55.226:43117] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aerJlbF_hzQs4CqbifdpLQAAABY"]
[Fri Apr 24 09:38:29.751331 2026] [:error] [pid 19101:tid 19145] [client 172.161.55.226:42363] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aerJlWAHj9bEvrTgbO03cgAAAEg"]
[Fri Apr 24 09:38:30.502097 2026] [:error] [pid 19101:tid 19139] [client 172.161.55.226:42316] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aerJlmAHj9bEvrTgbO03eAAAAEI"]
[Fri Apr 24 09:38:31.026347 2026] [:error] [pid 19102:tid 19186] [client 172.161.55.226:58359] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aerJlwDSgrbLEZbkqD5H5QAAAJY"]
[Fri Apr 24 09:38:31.546323 2026] [:error] [pid 19102:tid 19176] [client 172.161.55.226:46613] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aerJlwDSgrbLEZbkqD5H5wAAAIw"]
[Fri Apr 24 09:38:32.200708 2026] [:error] [pid 52129:tid 52148] [client 172.161.55.226:48607] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aerJmOKCZKf8_u2LKiBLyQAAAQ8"]
[Fri Apr 24 09:38:32.804208 2026] [:error] [pid 19100:tid 19121] [client 172.161.55.226:53575] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aerJmLF_hzQs4CqbifdpMAAAAAs"]
[Fri Apr 24 09:38:33.370649 2026] [:error] [pid 19102:tid 19175] [client 172.161.55.226:53570] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aerJmQDSgrbLEZbkqD5H6gAAAIs"]
[Fri Apr 24 09:38:33.949560 2026] [:error] [pid 19102:tid 19182] [client 172.161.55.226:43135] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aerJmQDSgrbLEZbkqD5H7QAAAJI"]
[Fri Apr 24 09:38:34.611758 2026] [:error] [pid 52129:tid 52153] [client 172.161.55.226:45191] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aerJmuKCZKf8_u2LKiBLywAAARQ"]
[Fri Apr 24 09:38:35.250112 2026] [:error] [pid 52129:tid 52141] [client 172.161.55.226:46599] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "aerJm-KCZKf8_u2LKiBL0gAAAQg"]
[Fri Apr 24 09:38:35.760459 2026] [:error] [pid 52129:tid 52145] [client 172.161.55.226:42307] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "aerJm-KCZKf8_u2LKiBL1QAAAQw"]
[Fri Apr 24 09:38:36.463945 2026] [:error] [pid 19100:tid 19133] [client 172.161.55.226:42358] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "aerJnLF_hzQs4CqbifdpOAAAABc"]
[Fri Apr 24 09:38:37.084527 2026] [:error] [pid 52129:tid 52153] [client 172.161.55.226:45212] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "aerJneKCZKf8_u2LKiBL3AAAARQ"]
[Fri Apr 24 09:38:37.626025 2026] [:error] [pid 19102:tid 19181] [client 172.161.55.226:52675] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "aerJnQDSgrbLEZbkqD5H8wAAAJE"]
[Fri Apr 24 09:38:38.272447 2026] [:error] [pid 19100:tid 19132] [client 172.161.55.226:42320] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "aerJnrF_hzQs4CqbifdpOgAAABY"]
[Fri Apr 24 09:38:38.777607 2026] [:error] [pid 19100:tid 19125] [client 172.161.55.226:40168] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "aerJnrF_hzQs4CqbifdpPAAAAA8"]
[Fri Apr 24 09:38:39.353725 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:41592] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "aerJnzQ--M3-tsKAnhFF2AAAAMo"]
[Fri Apr 24 09:38:39.847194 2026] [:error] [pid 19100:tid 19115] [client 172.161.55.226:52692] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "aerJn7F_hzQs4CqbifdpPQAAAAY"]
[Fri Apr 24 09:38:40.347495 2026] [:error] [pid 19101:tid 19142] [client 172.161.55.226:46607] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "aerJoGAHj9bEvrTgbO03fgAAAEU"]
[Fri Apr 24 09:38:40.999340 2026] [:error] [pid 52129:tid 52153] [client 172.161.55.226:45201] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "aerJoOKCZKf8_u2LKiBL4wAAARQ"]
[Fri Apr 24 09:38:41.682546 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:40162] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "aerJoTQ--M3-tsKAnhFF2wAAANU"]
[Fri Apr 24 09:38:42.311536 2026] [:error] [pid 19101:tid 19145] [client 172.161.55.226:45211] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "aerJomAHj9bEvrTgbO03ggAAAEg"]
[Fri Apr 24 09:38:43.128313 2026] [:error] [pid 19102:tid 19176] [client 172.161.55.226:62001] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "aerJowDSgrbLEZbkqD5H_wAAAIw"]
[Fri Apr 24 09:38:43.878270 2026] [:error] [pid 19101:tid 19141] [client 172.161.55.226:51948] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "aerJo2AHj9bEvrTgbO03hwAAAEQ"]
[Fri Apr 24 09:38:44.641504 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:51928] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "aerJpOKCZKf8_u2LKiBL6QAAAQA"]
[Fri Apr 24 09:38:45.254574 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:42340] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "aerJpeKCZKf8_u2LKiBL7gAAAQU"]
[Fri Apr 24 09:38:46.368451 2026] [:error] [pid 19200:tid 19220] [client 172.161.55.226:61959] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "aerJpjQ--M3-tsKAnhFF4AAAAMw"]
[Fri Apr 24 09:38:46.922528 2026] [:error] [pid 19100:tid 19130] [client 172.161.55.226:52630] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "aerJprF_hzQs4CqbifdpQQAAABQ"]
[Fri Apr 24 09:38:47.476282 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:52637] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "aerJp-KCZKf8_u2LKiBL9AAAAQY"]
[Fri Apr 24 09:38:48.413505 2026] [:error] [pid 19101:tid 19159] [client 172.161.55.226:43086] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aerJqGAHj9bEvrTgbO03jAAAAFY"]
[Fri Apr 24 09:38:49.019573 2026] [:error] [pid 52129:tid 52134] [client 172.161.55.226:41540] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aerJqeKCZKf8_u2LKiBL_QAAAQE"]
[Fri Apr 24 09:38:49.556470 2026] [:error] [pid 19101:tid 19140] [client 172.161.55.226:61674] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aerJqWAHj9bEvrTgbO03jgAAAEM"]
[Fri Apr 24 09:38:50.183744 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:46637] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "aerJquKCZKf8_u2LKiBMAAAAAQY"]
[Fri Apr 24 09:38:50.850032 2026] [:error] [pid 19200:tid 19230] [client 172.161.55.226:61676] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "aerJqjQ--M3-tsKAnhFF7gAAANY"]
[Fri Apr 24 09:38:51.471282 2026] [:error] [pid 52129:tid 52145] [client 172.161.55.226:42362] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "aerJq-KCZKf8_u2LKiBMBgAAAQw"]
[Fri Apr 24 09:38:52.147853 2026] [:error] [pid 19101:tid 19137] [client 172.161.55.226:40175] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "aerJrGAHj9bEvrTgbO03kAAAAEA"]
[Fri Apr 24 09:38:53.112123 2026] [:error] [pid 52129:tid 52152] [client 172.161.55.226:45207] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "aerJreKCZKf8_u2LKiBMCwAAARM"]
[Fri Apr 24 09:38:53.935747 2026] [:error] [pid 19200:tid 19215] [client 172.161.55.226:40135] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerJrTQ--M3-tsKAnhFF8QAAAMc"]
[Fri Apr 24 09:38:54.786848 2026] [:error] [pid 19200:tid 19223] [client 172.161.55.226:45208] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerJrjQ--M3-tsKAnhFF9gAAAM8"]
[Fri Apr 24 09:38:55.645317 2026] [:error] [pid 19200:tid 19226] [client 172.161.55.226:46145] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerJrzQ--M3-tsKAnhFF9wAAANI"]
[Fri Apr 24 09:38:56.606328 2026] [:error] [pid 19200:tid 19216] [client 172.161.55.226:41579] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerJsDQ--M3-tsKAnhFF-gAAAMg"]
[Fri Apr 24 09:38:57.378368 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:52634] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "aerJseKCZKf8_u2LKiBMFgAAAQo"]
[Fri Apr 24 09:38:58.199456 2026] [:error] [pid 52129:tid 52136] [client 172.161.55.226:53098] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "aerJsuKCZKf8_u2LKiBMGgAAAQM"]
[Fri Apr 24 09:38:59.134220 2026] [:error] [pid 19100:tid 19118] [client 172.161.55.226:62885] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "aerJs7F_hzQs4CqbifdpVwAAAAg"]
[Fri Apr 24 09:39:00.034885 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:62854] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "aerJtOKCZKf8_u2LKiBMJAAAAQI"]
[Fri Apr 24 09:39:00.808323 2026] [:error] [pid 52129:tid 52136] [client 172.161.55.226:50076] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "aerJtOKCZKf8_u2LKiBMKwAAAQM"]
[Fri Apr 24 09:39:01.381558 2026] [:error] [pid 19102:tid 19173] [client 172.161.55.226:52693] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "aerJtQDSgrbLEZbkqD5IDQAAAIk"]
[Fri Apr 24 09:39:02.506002 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:45184] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "aerJtuKCZKf8_u2LKiBMMwAAARI"]
[Fri Apr 24 09:39:03.109873 2026] [:error] [pid 52129:tid 52136] [client 172.161.55.226:39328] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "aerJt-KCZKf8_u2LKiBMNQAAAQM"]
[Fri Apr 24 09:39:03.793575 2026] [:error] [pid 52129:tid 52157] [client 172.161.55.226:9214] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aerJt-KCZKf8_u2LKiBMNgAAARg"]
[Fri Apr 24 09:39:04.271952 2026] [:error] [pid 19200:tid 19208] [client 172.161.55.226:9157] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aerJuDQ--M3-tsKAnhFGAAAAAMA"]
[Fri Apr 24 09:39:04.920702 2026] [:error] [pid 19102:tid 19179] [client 172.161.55.226:52716] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aerJuADSgrbLEZbkqD5IDgAAAI8"]
[Fri Apr 24 09:39:05.542054 2026] [:error] [pid 52129:tid 52152] [client 172.161.55.226:55535] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aerJueKCZKf8_u2LKiBMPQAAARM"]
[Fri Apr 24 09:39:06.134686 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:50073] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "aerJuuKCZKf8_u2LKiBMQAAAAQo"]
[Fri Apr 24 09:39:06.726563 2026] [:error] [pid 52129:tid 52148] [client 172.161.55.226:52612] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "aerJuuKCZKf8_u2LKiBMQgAAAQ8"]
[Fri Apr 24 09:39:07.687359 2026] [:error] [pid 19101:tid 19146] [client 172.161.55.226:52671] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "aerJu2AHj9bEvrTgbO03nwAAAEk"]
[Fri Apr 24 09:39:08.582698 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:50059] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "aerJvDQ--M3-tsKAnhFGBQAAANM"]
[Fri Apr 24 09:39:09.479795 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:55547] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aerJvTQ--M3-tsKAnhFGBwAAANU"]
[Fri Apr 24 09:39:10.049112 2026] [:error] [pid 52129:tid 52157] [client 172.161.55.226:46159] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aerJvuKCZKf8_u2LKiBMQwAAARg"]
[Fri Apr 24 09:39:10.787869 2026] [:error] [pid 19101:tid 19154] [client 172.161.55.226:52636] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aerJvmAHj9bEvrTgbO03owAAAFE"]
[Fri Apr 24 09:39:11.643140 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:46156] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aerJv-KCZKf8_u2LKiBMRwAAAQI"]
[Fri Apr 24 09:39:12.881233 2026] [:error] [pid 19100:tid 19118] [client 172.161.55.226:52908] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aerJwLF_hzQs4CqbifdpawAAAAg"]
[Fri Apr 24 09:39:13.757157 2026] [:error] [pid 19100:tid 19115] [client 172.161.55.226:50065] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aerJwbF_hzQs4CqbifdpbgAAAAY"]
[Fri Apr 24 09:39:14.614528 2026] [:error] [pid 19100:tid 19116] [client 172.161.55.226:51282] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aerJwrF_hzQs4CqbifdpcQAAAAc"]
[Fri Apr 24 09:39:15.531653 2026] [proxy_fcgi:error] [pid 19100:tid 19124] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:15.808641 2026] [proxy_fcgi:error] [pid 19100:tid 19132] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:16.086298 2026] [proxy_fcgi:error] [pid 19100:tid 19119] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:16.370673 2026] [proxy_fcgi:error] [pid 19100:tid 19127] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:16.689136 2026] [proxy_fcgi:error] [pid 19100:tid 19130] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:16.967993 2026] [proxy_fcgi:error] [pid 19100:tid 19118] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:17.249653 2026] [proxy_fcgi:error] [pid 19100:tid 19125] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:17.528858 2026] [proxy_fcgi:error] [pid 19100:tid 19121] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:17.894230 2026] [proxy_fcgi:error] [pid 19100:tid 19122] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:18.205825 2026] [proxy_fcgi:error] [pid 19100:tid 19114] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:18.483119 2026] [proxy_fcgi:error] [pid 19100:tid 19128] [client 172.161.55.226:51281] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:39:18.767733 2026] [:error] [pid 19100:tid 19126] [client 172.161.55.226:51281] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aerJxrF_hzQs4CqbifdphAAAABA"]
[Fri Apr 24 09:39:19.691369 2026] [:error] [pid 19100:tid 19127] [client 172.161.55.226:46193] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aerJx7F_hzQs4CqbifdphwAAABE"]
[Fri Apr 24 09:39:20.562780 2026] [:error] [pid 52129:tid 52147] [client 172.161.55.226:62896] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aerJyOKCZKf8_u2LKiBMTQAAAQ4"]
[Fri Apr 24 09:39:21.309546 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:39308] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "aerJyeKCZKf8_u2LKiBMTwAAAQc"]
[Fri Apr 24 09:39:22.434908 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:9172] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aerJyuKCZKf8_u2LKiBMUgAAAQU"]
[Fri Apr 24 09:39:23.359055 2026] [:error] [pid 52129:tid 52157] [client 172.161.55.226:53066] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aerJy-KCZKf8_u2LKiBMWQAAARg"]
[Fri Apr 24 09:39:24.501576 2026] [:error] [pid 19200:tid 19224] [client 172.161.55.226:50071] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aerJzDQ--M3-tsKAnhFGGAAAANA"]
[Fri Apr 24 09:39:25.578862 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:51306] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aerJzeKCZKf8_u2LKiBMXAAAAQc"]
[Fri Apr 24 09:39:26.398427 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:39320] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aerJzuKCZKf8_u2LKiBMXwAAAQU"]
[Fri Apr 24 09:39:27.268755 2026] [:error] [pid 19101:tid 19145] [client 172.161.55.226:9161] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aerJz2AHj9bEvrTgbO03sgAAAEg"]
[Fri Apr 24 09:39:29.007332 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:62859] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aerJ0eKCZKf8_u2LKiBMZwAAAQc"]
[Fri Apr 24 09:39:29.976433 2026] [:error] [pid 19102:tid 19164] [client 172.161.55.226:50072] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aerJ0QDSgrbLEZbkqD5IMwAAAIA"]
[Fri Apr 24 09:39:30.927202 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:9166] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zhw.php"] [unique_id "aerJ0uKCZKf8_u2LKiBMaQAAAQQ"]
[Fri Apr 24 09:39:31.578403 2026] [:error] [pid 19101:tid 19155] [client 172.161.55.226:62884] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zhw.php"] [unique_id "aerJ02AHj9bEvrTgbO03twAAAFI"]
[Fri Apr 24 09:39:32.844478 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:62881] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zhw.php"] [unique_id "aerJ1ADSgrbLEZbkqD5INwAAAIE"]
[Fri Apr 24 09:39:33.551948 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:9171] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zhw.php"] [unique_id "aerJ1eKCZKf8_u2LKiBMawAAAQA"]
[Fri Apr 24 09:39:34.473940 2026] [:error] [pid 19100:tid 19114] [client 172.161.55.226:62906] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aerJ1rF_hzQs4CqbifdplAAAAAU"]
[Fri Apr 24 09:39:35.470837 2026] [:error] [pid 19100:tid 19113] [client 172.161.55.226:53682] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aerJ17F_hzQs4CqbifdplwAAAAQ"]
[Fri Apr 24 09:39:36.247351 2026] [:error] [pid 52129:tid 52149] [client 172.161.55.226:53084] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aerJ2OKCZKf8_u2LKiBMbQAAARA"]
[Fri Apr 24 09:39:36.787935 2026] [:error] [pid 52129:tid 52154] [client 172.161.55.226:51307] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aerJ2OKCZKf8_u2LKiBMbgAAARU"]
[Fri Apr 24 09:39:37.657012 2026] [:error] [pid 19200:tid 19208] [client 172.161.55.226:44730] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aerJ2TQ--M3-tsKAnhFGMQAAAMA"]
[Fri Apr 24 09:39:38.280430 2026] [:error] [pid 19102:tid 19170] [client 172.161.55.226:40655] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aerJ2gDSgrbLEZbkqD5IOwAAAIY"]
[Fri Apr 24 09:39:39.137153 2026] [:error] [pid 19102:tid 19178] [client 172.161.55.226:53647] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aerJ2wDSgrbLEZbkqD5IPQAAAI4"]
[Fri Apr 24 09:39:39.890461 2026] [:error] [pid 52129:tid 52156] [client 172.161.55.226:39334] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aerJ2-KCZKf8_u2LKiBMcwAAARc"]
[Fri Apr 24 09:39:40.562670 2026] [:error] [pid 52129:tid 52142] [client 172.161.55.226:53660] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aerJ3OKCZKf8_u2LKiBMdwAAAQk"]
[Fri Apr 24 09:39:41.672720 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:53632] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aerJ3TQ--M3-tsKAnhFGOQAAAME"]
[Fri Apr 24 09:39:42.515409 2026] [:error] [pid 19100:tid 19111] [client 172.161.55.226:9178] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aerJ3rF_hzQs4CqbifdpnwAAAAI"]
[Fri Apr 24 09:39:43.672423 2026] [:error] [pid 19200:tid 19212] [client 172.161.55.226:53078] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aerJ3zQ--M3-tsKAnhFGPAAAAMQ"]
[Fri Apr 24 09:39:45.163713 2026] [:error] [pid 19102:tid 19171] [client 172.161.55.226:44729] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "aerJ4QDSgrbLEZbkqD5ITQAAAIc"]
[Fri Apr 24 09:39:46.258064 2026] [:error] [pid 19102:tid 19167] [client 172.161.55.226:50105] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "aerJ4gDSgrbLEZbkqD5IUAAAAIM"]
[Fri Apr 24 09:39:47.380662 2026] [:error] [pid 19101:tid 19160] [client 172.161.55.226:50083] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "aerJ42AHj9bEvrTgbO03ugAAAFc"]
[Fri Apr 24 09:39:48.144784 2026] [:error] [pid 19102:tid 19184] [client 172.161.55.226:43504] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "aerJ5ADSgrbLEZbkqD5IWgAAAJQ"]
[Fri Apr 24 09:39:49.066400 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:52925] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aerJ5eKCZKf8_u2LKiBMggAAARI"]
[Fri Apr 24 09:39:50.421330 2026] [:error] [pid 19100:tid 19126] [client 172.161.55.226:49182] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aerJ5rF_hzQs4CqbifdpqQAAABA"]
[Fri Apr 24 09:39:51.577048 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:40699] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aerJ5-KCZKf8_u2LKiBMjwAAAQQ"]
[Fri Apr 24 09:39:52.828432 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:43510] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "aerJ6OKCZKf8_u2LKiBMmAAAAQA"]
[Fri Apr 24 09:39:53.811384 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:58766] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "aerJ6TQ--M3-tsKAnhFGUQAAAMo"]
[Fri Apr 24 09:39:54.469343 2026] [:error] [pid 19101:tid 19157] [client 172.161.55.226:50082] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "aerJ6mAHj9bEvrTgbO03wQAAAFQ"]
[Fri Apr 24 09:39:55.436786 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:41547] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "aerJ6-KCZKf8_u2LKiBMuwAAAQA"]
[Fri Apr 24 09:39:56.367447 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:43497] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "aerJ7OKCZKf8_u2LKiBM0AAAARI"]
[Fri Apr 24 09:39:57.251970 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:51275] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "aerJ7TQ--M3-tsKAnhFGaAAAAMI"]
[Fri Apr 24 09:39:58.136162 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:9211] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "aerJ7uKCZKf8_u2LKiBM3wAAAQI"]
[Fri Apr 24 09:39:59.103688 2026] [:error] [pid 19100:tid 19125] [client 172.161.55.226:51277] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "aerJ77F_hzQs4CqbifdpwAAAAA8"]
[Fri Apr 24 09:39:59.962367 2026] [:error] [pid 52129:tid 52147] [client 172.161.55.226:53095] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "aerJ7-KCZKf8_u2LKiBM6QAAAQ4"]
[Fri Apr 24 09:40:00.724629 2026] [:error] [pid 19200:tid 19225] [client 172.161.55.226:50058] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "aerJ8DQ--M3-tsKAnhFGcAAAANE"]
[Fri Apr 24 09:40:01.310806 2026] [:error] [pid 52129:tid 52141] [client 172.161.55.226:52870] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "aerJ8eKCZKf8_u2LKiBM8wAAAQg"]
[Fri Apr 24 09:40:03.157436 2026] [:error] [pid 19102:tid 19173] [client 172.161.55.226:55494] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "aerJ8wDSgrbLEZbkqD5IegAAAIk"]
[Fri Apr 24 09:40:04.112718 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:8717] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "aerJ9DQ--M3-tsKAnhFGfgAAAMo"]
[Fri Apr 24 09:40:04.844102 2026] [:error] [pid 19100:tid 19124] [client 172.161.55.226:43505] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "aerJ9LF_hzQs4CqbifdpxgAAAA4"]
[Fri Apr 24 09:40:05.568025 2026] [:error] [pid 19101:tid 19160] [client 172.161.55.226:55492] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "aerJ9WAHj9bEvrTgbO031QAAAFc"]
[Fri Apr 24 09:40:06.435409 2026] [:error] [pid 19101:tid 19153] [client 172.161.55.226:51294] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "aerJ9mAHj9bEvrTgbO032QAAAFA"]
[Fri Apr 24 09:40:07.018671 2026] [:error] [pid 52129:tid 52149] [client 172.161.55.226:50104] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "aerJ9-KCZKf8_u2LKiBM-QAAARA"]
[Fri Apr 24 09:40:07.759903 2026] [:error] [pid 19100:tid 19132] [client 172.161.55.226:8785] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "aerJ97F_hzQs4CqbifdpygAAABY"]
[Fri Apr 24 09:40:08.403321 2026] [:error] [pid 19101:tid 19148] [client 172.161.55.226:51309] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "aerJ-GAHj9bEvrTgbO033gAAAEs"]
[Fri Apr 24 09:40:08.920945 2026] [:error] [pid 19100:tid 19125] [client 172.161.55.226:49152] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "aerJ-LF_hzQs4CqbifdpzQAAAA8"]
[Fri Apr 24 09:40:09.521026 2026] [:error] [pid 19100:tid 19114] [client 172.161.55.226:52915] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "aerJ-bF_hzQs4Cqbifdp0AAAAAU"]
[Fri Apr 24 09:40:10.291010 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:8788] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "aerJ-uKCZKf8_u2LKiBNAQAAAQo"]
[Fri Apr 24 09:40:10.996107 2026] [:error] [pid 19100:tid 19126] [client 172.161.55.226:8772] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "aerJ-rF_hzQs4Cqbifdp0wAAABA"]
[Fri Apr 24 09:40:11.822561 2026] [:error] [pid 19200:tid 19226] [client 172.161.55.226:53694] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "aerJ-zQ--M3-tsKAnhFGgwAAANI"]
[Fri Apr 24 09:40:12.390117 2026] [:error] [pid 19101:tid 19156] [client 172.161.55.226:52912] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "aerJ_GAHj9bEvrTgbO035QAAAFM"]
[Fri Apr 24 09:40:13.069294 2026] [:error] [pid 52129:tid 52155] [client 172.161.55.226:51285] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "aerJ_eKCZKf8_u2LKiBNCAAAARY"]
[Fri Apr 24 09:40:14.185752 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:59096] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "aerJ_uKCZKf8_u2LKiBNDAAAAQc"]
[Fri Apr 24 09:40:15.088354 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:43478] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "aerJ_-KCZKf8_u2LKiBNDwAAAQY"]
[Fri Apr 24 09:40:15.853115 2026] [:error] [pid 19100:tid 19123] [client 172.161.55.226:58807] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "aerJ_7F_hzQs4Cqbifdp2wAAAA0"]
[Fri Apr 24 09:40:16.553734 2026] [:error] [pid 19102:tid 19183] [client 172.161.55.226:44733] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "aerKAADSgrbLEZbkqD5IkgAAAJM"]
[Fri Apr 24 09:40:17.157528 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:58778] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "aerKAeKCZKf8_u2LKiBNGwAAAQo"]
[Fri Apr 24 09:40:17.722031 2026] [:error] [pid 52129:tid 52153] [client 172.161.55.226:53666] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "aerKAeKCZKf8_u2LKiBNHgAAARQ"]
[Fri Apr 24 09:40:18.425456 2026] [proxy_fcgi:error] [pid 52129:tid 52141] [client 172.161.55.226:8928] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:18.732788 2026] [proxy_fcgi:error] [pid 52129:tid 52149] [client 172.161.55.226:8928] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:19.110045 2026] [proxy_fcgi:error] [pid 52129:tid 52154] [client 172.161.55.226:8928] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:19.355350 2026] [:error] [pid 52129:tid 52144] [client 172.161.55.226:8928] [client 172.161.55.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aerKA-KCZKf8_u2LKiBNKAAAAQs"]
[Fri Apr 24 09:40:20.435825 2026] [proxy_fcgi:error] [pid 19102:tid 19173] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:20.757747 2026] [proxy_fcgi:error] [pid 19102:tid 19184] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:20.997018 2026] [proxy_fcgi:error] [pid 19102:tid 19166] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:21.434877 2026] [proxy_fcgi:error] [pid 19102:tid 19183] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:21.673493 2026] [proxy_fcgi:error] [pid 19102:tid 19170] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:21.912571 2026] [proxy_fcgi:error] [pid 19102:tid 19167] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:22.346272 2026] [proxy_fcgi:error] [pid 19102:tid 19164] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:22.606501 2026] [proxy_fcgi:error] [pid 19102:tid 19178] [client 172.161.55.226:43456] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:40:22.841423 2026] [:error] [pid 19102:tid 19182] [client 172.161.55.226:43456] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "aerKBgDSgrbLEZbkqD5IpgAAAJI"]
[Fri Apr 24 09:40:23.511457 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:8766] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "aerKB-KCZKf8_u2LKiBNNAAAAQc"]
[Fri Apr 24 09:40:24.384641 2026] [:error] [pid 19101:tid 19152] [client 172.161.55.226:59110] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "aerKCGAHj9bEvrTgbO04BAAAAE8"]
[Fri Apr 24 09:40:25.070095 2026] [:error] [pid 52129:tid 52147] [client 172.161.55.226:8730] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "aerKCeKCZKf8_u2LKiBNOgAAAQ4"]
[Fri Apr 24 09:40:26.193443 2026] [:error] [pid 19102:tid 19178] [client 172.161.55.226:8817] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aerKCgDSgrbLEZbkqD5IsQAAAI4"]
[Fri Apr 24 09:40:28.041763 2026] [:error] [pid 19101:tid 19139] [client 172.161.55.226:8802] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aerKDGAHj9bEvrTgbO04CgAAAEI"]
[Fri Apr 24 09:40:28.853929 2026] [:error] [pid 19101:tid 19146] [client 172.161.55.226:59100] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aerKDGAHj9bEvrTgbO04DAAAAEk"]
[Fri Apr 24 09:40:29.498528 2026] [:error] [pid 19100:tid 19128] [client 172.161.55.226:46232] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aerKDbF_hzQs4Cqbifdp5gAAABI"]
[Fri Apr 24 09:40:30.288539 2026] [:error] [pid 19102:tid 19180] [client 172.161.55.226:8814] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "aerKDgDSgrbLEZbkqD5IwAAAAJA"]
[Fri Apr 24 09:40:31.151951 2026] [:error] [pid 19200:tid 19227] [client 172.161.55.226:53165] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "aerKDzQ--M3-tsKAnhFGjQAAANM"]
[Fri Apr 24 09:40:32.025775 2026] [:error] [pid 52129:tid 52142] [client 172.161.55.226:45558] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "aerKEOKCZKf8_u2LKiBNUAAAAQk"]
[Fri Apr 24 09:40:33.123415 2026] [:error] [pid 52129:tid 52147] [client 172.161.55.226:45530] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "aerKEeKCZKf8_u2LKiBNWAAAAQ4"]
[Fri Apr 24 09:40:34.565339 2026] [:error] [pid 52129:tid 52150] [client 172.161.55.226:39286] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "aerKEuKCZKf8_u2LKiBNYgAAARE"]
[Fri Apr 24 09:40:35.293682 2026] [:error] [pid 19100:tid 19134] [client 172.161.55.226:46254] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "aerKE7F_hzQs4Cqbifdp8AAAABg"]
[Fri Apr 24 09:40:36.352686 2026] [:error] [pid 19100:tid 19130] [client 172.161.55.226:57611] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "aerKFLF_hzQs4Cqbifdp9QAAABQ"]
[Fri Apr 24 09:40:37.748730 2026] [:error] [pid 19101:tid 19156] [client 172.161.55.226:53682] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "aerKFWAHj9bEvrTgbO04FAAAAFM"]
[Fri Apr 24 09:40:38.634834 2026] [:error] [pid 19100:tid 19111] [client 172.161.55.226:57651] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "aerKFrF_hzQs4Cqbifdp-gAAAAI"]
[Fri Apr 24 09:40:40.176155 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:39236] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "aerKGADSgrbLEZbkqD5I0wAAAIE"]
[Fri Apr 24 09:40:41.256746 2026] [:error] [pid 19102:tid 19167] [client 172.161.55.226:8953] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "aerKGQDSgrbLEZbkqD5I2AAAAIM"]
[Fri Apr 24 09:40:42.229576 2026] [:error] [pid 19102:tid 19171] [client 172.161.55.226:58372] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "aerKGgDSgrbLEZbkqD5I3gAAAIc"]
[Fri Apr 24 09:40:42.846772 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:61578] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "aerKGuKCZKf8_u2LKiBNcgAAAQU"]
[Fri Apr 24 09:40:43.843960 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:55494] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "aerKG-KCZKf8_u2LKiBNeAAAARI"]
[Fri Apr 24 09:40:44.605968 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:39251] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "aerKHDQ--M3-tsKAnhFGmwAAAMo"]
[Fri Apr 24 09:40:45.469866 2026] [:error] [pid 19200:tid 19225] [client 172.161.55.226:46260] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "aerKHTQ--M3-tsKAnhFGogAAANE"]
[Fri Apr 24 09:40:46.494822 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:58390] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "aerKHgDSgrbLEZbkqD5I6wAAAIE"]
[Fri Apr 24 09:40:47.390712 2026] [:error] [pid 19200:tid 19228] [client 172.161.55.226:53394] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "aerKHzQ--M3-tsKAnhFGswAAANQ"]
[Fri Apr 24 09:40:48.261925 2026] [:error] [pid 52129:tid 52151] [client 172.161.55.226:39697] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "aerKIOKCZKf8_u2LKiBNgAAAARI"]
[Fri Apr 24 09:40:49.229539 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:39232] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "aerKITQ--M3-tsKAnhFGugAAAMI"]
[Fri Apr 24 09:40:50.191692 2026] [:error] [pid 19102:tid 19167] [client 172.161.55.226:39285] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aerKIgDSgrbLEZbkqD5I8AAAAIM"]
[Fri Apr 24 09:40:51.620981 2026] [:error] [pid 19200:tid 19228] [client 172.161.55.226:53149] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aerKIzQ--M3-tsKAnhFGwgAAANQ"]
[Fri Apr 24 09:40:52.278824 2026] [:error] [pid 52129:tid 52157] [client 172.161.55.226:45191] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aerKJOKCZKf8_u2LKiBNiQAAARg"]
[Fri Apr 24 09:40:53.358502 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:61582] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "aerKJeKCZKf8_u2LKiBNkAAAAQQ"]
[Fri Apr 24 09:40:54.200136 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:47370] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aerKJuKCZKf8_u2LKiBNlgAAAQc"]
[Fri Apr 24 09:40:55.143743 2026] [:error] [pid 19100:tid 19121] [client 172.161.55.226:55586] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aerKJ7F_hzQs4CqbifdqCwAAAAs"]
[Fri Apr 24 09:40:56.081950 2026] [:error] [pid 19101:tid 19145] [client 172.161.55.226:61617] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aerKKGAHj9bEvrTgbO04JwAAAEg"]
[Fri Apr 24 09:40:56.853903 2026] [:error] [pid 19100:tid 19123] [client 172.161.55.226:8614] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aerKKLF_hzQs4CqbifdqDwAAAA0"]
[Fri Apr 24 09:40:58.084307 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:61586] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aerKKuKCZKf8_u2LKiBNnQAAAQc"]
[Fri Apr 24 09:40:59.162566 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:55912] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aerKK-KCZKf8_u2LKiBNpQAAAQU"]
[Fri Apr 24 09:41:00.439404 2026] [:error] [pid 52129:tid 52134] [client 172.161.55.226:48164] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aerKLOKCZKf8_u2LKiBNrgAAAQE"]
[Fri Apr 24 09:41:01.490200 2026] [:error] [pid 19200:tid 19212] [client 172.161.55.226:50017] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aerKLTQ--M3-tsKAnhFG1AAAAMQ"]
[Fri Apr 24 09:41:02.144688 2026] [:error] [pid 19102:tid 19180] [client 172.161.55.226:52983] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aerKLgDSgrbLEZbkqD5I-wAAAJA"]
[Fri Apr 24 09:41:03.070149 2026] [:error] [pid 19200:tid 19231] [client 172.161.55.226:57259] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aerKLzQ--M3-tsKAnhFG2gAAANc"]
[Fri Apr 24 09:41:04.067518 2026] [:error] [pid 19200:tid 19228] [client 172.161.55.226:59546] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aerKMDQ--M3-tsKAnhFG4gAAANQ"]
[Fri Apr 24 09:41:05.145931 2026] [:error] [pid 19102:tid 19185] [client 172.161.55.226:57227] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aerKMQDSgrbLEZbkqD5JGQAAAJU"]
[Fri Apr 24 09:41:05.854685 2026] [:error] [pid 19102:tid 19178] [client 172.161.55.226:8311] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aerKMQDSgrbLEZbkqD5JJgAAAI4"]
[Fri Apr 24 09:41:06.852098 2026] [:error] [pid 52129:tid 52133] [client 172.161.55.226:57540] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aerKMuKCZKf8_u2LKiBN5gAAAQA"]
[Fri Apr 24 09:41:07.791839 2026] [:error] [pid 52129:tid 52152] [client 172.161.55.226:53041] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aerKM-KCZKf8_u2LKiBN7QAAARM"]
[Fri Apr 24 09:41:08.651383 2026] [:error] [pid 19101:tid 19140] [client 172.161.55.226:53030] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aerKNGAHj9bEvrTgbO04XQAAAEM"]
[Fri Apr 24 09:41:09.798954 2026] [:error] [pid 19101:tid 19144] [client 172.161.55.226:48171] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aerKNWAHj9bEvrTgbO04YQAAAEc"]
[Fri Apr 24 09:41:11.020741 2026] [:error] [pid 19101:tid 19150] [client 172.161.55.226:8533] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aerKN2AHj9bEvrTgbO04ZwAAAE0"]
[Fri Apr 24 09:41:11.850255 2026] [:error] [pid 19200:tid 19228] [client 172.161.55.226:57265] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aerKNzQ--M3-tsKAnhFG_AAAANQ"]
[Fri Apr 24 09:41:12.885571 2026] [:error] [pid 19101:tid 19157] [client 172.161.55.226:57243] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aerKOGAHj9bEvrTgbO04bAAAAFQ"]
[Fri Apr 24 09:41:13.597576 2026] [:error] [pid 19100:tid 19130] [client 172.161.55.226:50071] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aerKObF_hzQs4CqbifdqHgAAABQ"]
[Fri Apr 24 09:41:15.058717 2026] [:error] [pid 19200:tid 19219] [client 172.161.55.226:49797] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aerKOzQ--M3-tsKAnhFHDQAAAMs"]
[Fri Apr 24 09:41:16.293923 2026] [:error] [pid 19200:tid 19215] [client 172.161.55.226:49847] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aerKPDQ--M3-tsKAnhFHEAAAAMc"]
[Fri Apr 24 09:41:16.997439 2026] [:error] [pid 19200:tid 19230] [client 172.161.55.226:49818] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aerKPDQ--M3-tsKAnhFHGgAAANY"]
[Fri Apr 24 09:41:17.602711 2026] [:error] [pid 19102:tid 19169] [client 172.161.55.226:59544] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdxadmin.php"] [unique_id "aerKPQDSgrbLEZbkqD5JQAAAAIU"]
[Fri Apr 24 09:41:18.272163 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:8553] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdxadmin.php"] [unique_id "aerKPuKCZKf8_u2LKiBOMgAAAQI"]
[Fri Apr 24 09:41:19.012457 2026] [:error] [pid 19200:tid 19228] [client 172.161.55.226:57249] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdxadmin.php"] [unique_id "aerKPzQ--M3-tsKAnhFHKwAAANQ"]
[Fri Apr 24 09:41:19.820865 2026] [:error] [pid 19200:tid 19229] [client 172.161.55.226:52164] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cdxadmin.php"] [unique_id "aerKPzQ--M3-tsKAnhFHLwAAANU"]
[Fri Apr 24 09:41:20.457046 2026] [:error] [pid 19102:tid 19182] [client 172.161.55.226:43562] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dfre.php"] [unique_id "aerKQADSgrbLEZbkqD5JTAAAAJI"]
[Fri Apr 24 09:41:21.029578 2026] [:error] [pid 19200:tid 19221] [client 172.161.55.226:49806] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dfre.php"] [unique_id "aerKQTQ--M3-tsKAnhFHMAAAAM0"]
[Fri Apr 24 09:41:21.666089 2026] [:error] [pid 19200:tid 19214] [client 172.161.55.226:50041] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dfre.php"] [unique_id "aerKQTQ--M3-tsKAnhFHMgAAAMY"]
[Fri Apr 24 09:41:22.370184 2026] [proxy_fcgi:error] [pid 52129:tid 52143] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:22.611002 2026] [proxy_fcgi:error] [pid 52129:tid 52145] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:22.851994 2026] [proxy_fcgi:error] [pid 52129:tid 52138] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:23.091120 2026] [proxy_fcgi:error] [pid 52129:tid 52150] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:23.330685 2026] [proxy_fcgi:error] [pid 52129:tid 52143] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:23.580703 2026] [proxy_fcgi:error] [pid 52129:tid 52155] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:23.828612 2026] [proxy_fcgi:error] [pid 52129:tid 52137] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:24.070409 2026] [proxy_fcgi:error] [pid 52129:tid 52148] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:24.310846 2026] [proxy_fcgi:error] [pid 52129:tid 52153] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:24.560405 2026] [proxy_fcgi:error] [pid 52129:tid 52140] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:24.808578 2026] [proxy_fcgi:error] [pid 52129:tid 52156] [client 172.161.55.226:8546] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 09:41:25.047535 2026] [:error] [pid 52129:tid 52149] [client 172.161.55.226:8546] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aerKReKCZKf8_u2LKiBO-wAAARA"]
[Fri Apr 24 09:41:26.109431 2026] [:error] [pid 52129:tid 52146] [client 172.161.55.226:8518] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aerKRuKCZKf8_u2LKiBPAQAAAQ0"]
[Fri Apr 24 09:41:27.051651 2026] [:error] [pid 19100:tid 19112] [client 172.161.55.226:50000] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aerKR7F_hzQs4CqbifdqYwAAAAM"]
[Fri Apr 24 09:41:28.350882 2026] [:error] [pid 19100:tid 19126] [client 172.161.55.226:52208] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aerKSLF_hzQs4CqbifdqZQAAABA"]
[Fri Apr 24 09:41:29.228770 2026] [:error] [pid 52129:tid 52140] [client 172.161.55.226:46637] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aerKSeKCZKf8_u2LKiBPDAAAAQc"]
[Fri Apr 24 09:41:30.668638 2026] [:error] [pid 19200:tid 19214] [client 172.161.55.226:57562] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aerKSjQ--M3-tsKAnhFHPQAAAMY"]
[Fri Apr 24 09:41:31.793873 2026] [:error] [pid 19102:tid 19184] [client 172.161.55.226:54841] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aerKSwDSgrbLEZbkqD5JVAAAAJQ"]
[Fri Apr 24 09:41:32.491150 2026] [:error] [pid 19100:tid 19131] [client 172.161.55.226:52268] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aerKTLF_hzQs4CqbifdqagAAABU"]
[Fri Apr 24 09:41:33.083796 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:58035] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aerKTTQ--M3-tsKAnhFHSQAAAME"]
[Fri Apr 24 09:41:33.779610 2026] [:error] [pid 52129:tid 52147] [client 172.161.55.226:8985] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aerKTeKCZKf8_u2LKiBPFAAAAQ4"]
[Fri Apr 24 09:41:34.256659 2026] [:error] [pid 19100:tid 19122] [client 172.161.55.226:42386] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aerKTrF_hzQs4CqbifdqawAAAAw"]
[Fri Apr 24 09:41:34.845393 2026] [:error] [pid 19101:tid 19143] [client 172.161.55.226:45175] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aerKTmAHj9bEvrTgbO04mwAAAEY"]
[Fri Apr 24 09:41:35.400572 2026] [:error] [pid 52129:tid 52154] [client 172.161.55.226:52181] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aerKT-KCZKf8_u2LKiBPHAAAARU"]
[Fri Apr 24 09:41:36.188016 2026] [:error] [pid 19102:tid 19165] [client 172.161.55.226:8961] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aerKUADSgrbLEZbkqD5JXAAAAIE"]
[Fri Apr 24 09:41:37.160962 2026] [:error] [pid 19102:tid 19164] [client 172.161.55.226:48111] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aerKUQDSgrbLEZbkqD5JYgAAAIA"]
[Fri Apr 24 09:41:38.270086 2026] [:error] [pid 19102:tid 19176] [client 172.161.55.226:45174] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aerKUgDSgrbLEZbkqD5JZwAAAIw"]
[Fri Apr 24 09:41:39.164199 2026] [:error] [pid 19102:tid 19181] [client 172.161.55.226:8976] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aerKUwDSgrbLEZbkqD5JaAAAAJE"]
[Fri Apr 24 09:41:39.783193 2026] [:error] [pid 19100:tid 19116] [client 172.161.55.226:59484] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aerKU7F_hzQs4CqbifdqcgAAAAc"]
[Fri Apr 24 09:41:40.440863 2026] [:error] [pid 19100:tid 19124] [client 172.161.55.226:54001] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aerKVLF_hzQs4CqbifdqdQAAAA4"]
[Fri Apr 24 09:41:41.036180 2026] [:error] [pid 19101:tid 19140] [client 172.161.55.226:8980] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aerKVWAHj9bEvrTgbO04pwAAAEM"]
[Fri Apr 24 09:41:41.687287 2026] [:error] [pid 19102:tid 19186] [client 172.161.55.226:52270] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "aerKVQDSgrbLEZbkqD5JagAAAJY"]
[Fri Apr 24 09:41:42.321139 2026] [:error] [pid 19102:tid 19164] [client 172.161.55.226:48127] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "aerKVgDSgrbLEZbkqD5JbgAAAIA"]
[Fri Apr 24 09:41:42.852187 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:45151] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "aerKVuKCZKf8_u2LKiBPNgAAAQo"]
[Fri Apr 24 09:41:43.406037 2026] [:error] [pid 19100:tid 19118] [client 172.161.55.226:45137] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "aerKV7F_hzQs4CqbifdqdgAAAAg"]
[Fri Apr 24 09:41:44.165278 2026] [:error] [pid 19101:tid 19142] [client 172.161.55.226:52185] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aerKWGAHj9bEvrTgbO04qgAAAEU"]
[Fri Apr 24 09:41:44.851659 2026] [:error] [pid 52129:tid 52139] [client 172.161.55.226:48110] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aerKWOKCZKf8_u2LKiBPOgAAAQY"]
[Fri Apr 24 09:41:45.466418 2026] [:error] [pid 52129:tid 52142] [client 172.161.55.226:52266] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aerKWeKCZKf8_u2LKiBPPQAAAQk"]
[Fri Apr 24 09:41:46.352495 2026] [:error] [pid 19100:tid 19115] [client 172.161.55.226:43521] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "aerKWrF_hzQs4CqbifdqfQAAAAY"]
[Fri Apr 24 09:41:46.852809 2026] [:error] [pid 19100:tid 19118] [client 172.161.55.226:48081] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "aerKWrF_hzQs4CqbifdqhQAAAAg"]
[Fri Apr 24 09:41:47.370925 2026] [:error] [pid 19100:tid 19125] [client 172.161.55.226:59518] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "aerKW7F_hzQs4CqbifdqjAAAAA8"]
[Fri Apr 24 09:41:48.143100 2026] [:error] [pid 52129:tid 52146] [client 172.161.55.226:53981] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "aerKXOKCZKf8_u2LKiBPQgAAAQ0"]
[Fri Apr 24 09:41:48.655423 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:52226] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "aerKXOKCZKf8_u2LKiBPRAAAAQU"]
[Fri Apr 24 09:41:49.258420 2026] [:error] [pid 52129:tid 52155] [client 172.161.55.226:45182] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "aerKXeKCZKf8_u2LKiBPSAAAARY"]
[Fri Apr 24 09:41:49.817142 2026] [:error] [pid 52129:tid 52135] [client 172.161.55.226:49734] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "aerKXeKCZKf8_u2LKiBPSwAAAQI"]
[Fri Apr 24 09:41:50.448579 2026] [:error] [pid 52129:tid 52154] [client 172.161.55.226:52108] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "aerKXuKCZKf8_u2LKiBPTQAAARU"]
[Fri Apr 24 09:41:51.082753 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:54808] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "aerKX-KCZKf8_u2LKiBPUwAAAQQ"]
[Fri Apr 24 09:41:52.055415 2026] [:error] [pid 52129:tid 52143] [client 172.161.55.226:59479] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "aerKYOKCZKf8_u2LKiBPVwAAAQo"]
[Fri Apr 24 09:41:52.771627 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:52105] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "aerKYOKCZKf8_u2LKiBPXAAAAQU"]
[Fri Apr 24 09:41:53.771576 2026] [:error] [pid 52129:tid 52146] [client 172.161.55.226:62498] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "aerKYeKCZKf8_u2LKiBPZQAAAQ0"]
[Fri Apr 24 09:41:54.426470 2026] [:error] [pid 52129:tid 52142] [client 172.161.55.226:48117] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "aerKYuKCZKf8_u2LKiBPaQAAAQk"]
[Fri Apr 24 09:41:55.063793 2026] [:error] [pid 19100:tid 19119] [client 172.161.55.226:50624] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "aerKY7F_hzQs4CqbifdqlAAAAAk"]
[Fri Apr 24 09:41:55.652425 2026] [:error] [pid 52129:tid 52137] [client 172.161.55.226:48089] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "aerKY-KCZKf8_u2LKiBPcAAAAQQ"]
[Fri Apr 24 09:41:56.478396 2026] [:error] [pid 19200:tid 19223] [client 172.161.55.226:59148] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "aerKZDQ--M3-tsKAnhFHXQAAAM8"]
[Fri Apr 24 09:41:57.326086 2026] [:error] [pid 52129:tid 52148] [client 172.161.55.226:52104] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "aerKZeKCZKf8_u2LKiBPfAAAAQ8"]
[Fri Apr 24 09:41:58.148752 2026] [:error] [pid 19100:tid 19133] [client 172.161.55.226:45129] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aerKZrF_hzQs4CqbifdqmQAAABc"]
[Fri Apr 24 09:41:58.846946 2026] [:error] [pid 52129:tid 52145] [client 172.161.55.226:50638] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aerKZuKCZKf8_u2LKiBPggAAAQw"]
[Fri Apr 24 09:41:59.628707 2026] [:error] [pid 19102:tid 19168] [client 172.161.55.226:56822] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aerKZwDSgrbLEZbkqD5JfQAAAIQ"]
[Fri Apr 24 09:42:00.653035 2026] [:error] [pid 19101:tid 19140] [client 172.161.55.226:62471] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "aerKaGAHj9bEvrTgbO04vAAAAEM"]
[Fri Apr 24 09:42:01.494325 2026] [:error] [pid 19102:tid 19179] [client 172.161.55.226:52097] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "aerKaQDSgrbLEZbkqD5JgwAAAI8"]
[Fri Apr 24 09:42:02.240464 2026] [:error] [pid 19102:tid 19186] [client 172.161.55.226:52138] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "aerKagDSgrbLEZbkqD5JhgAAAJY"]
[Fri Apr 24 09:42:03.441552 2026] [:error] [pid 19102:tid 19187] [client 172.161.55.226:59197] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "aerKawDSgrbLEZbkqD5JiQAAAJc"]
[Fri Apr 24 09:42:04.192998 2026] [:error] [pid 19101:tid 19156] [client 172.161.55.226:52141] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "aerKbGAHj9bEvrTgbO04wQAAAFM"]
[Fri Apr 24 09:42:04.810903 2026] [:error] [pid 19101:tid 19155] [client 172.161.55.226:50911] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "aerKbGAHj9bEvrTgbO04wwAAAFI"]
[Fri Apr 24 09:42:05.502706 2026] [:error] [pid 19102:tid 19172] [client 172.161.55.226:56807] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "aerKbQDSgrbLEZbkqD5JjAAAAIg"]
[Fri Apr 24 09:42:06.189331 2026] [:error] [pid 19100:tid 19132] [client 172.161.55.226:51601] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "aerKbrF_hzQs4CqbifdqogAAABY"]
[Fri Apr 24 09:42:06.689627 2026] [:error] [pid 19200:tid 19222] [client 172.161.55.226:63679] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "aerKbjQ--M3-tsKAnhFHZwAAAM4"]
[Fri Apr 24 09:42:07.342464 2026] [:error] [pid 19101:tid 19143] [client 172.161.55.226:62477] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "aerKb2AHj9bEvrTgbO04yQAAAEY"]
[Fri Apr 24 09:42:08.023991 2026] [:error] [pid 19101:tid 19137] [client 172.161.55.226:8235] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "aerKcGAHj9bEvrTgbO04zAAAAEA"]
[Fri Apr 24 09:42:08.833777 2026] [:error] [pid 19101:tid 19156] [client 172.161.55.226:56826] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "aerKcGAHj9bEvrTgbO040AAAAFM"]
[Fri Apr 24 09:42:09.658642 2026] [:error] [pid 19200:tid 19219] [client 172.161.55.226:56794] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "aerKcTQ--M3-tsKAnhFHbAAAAMs"]
[Fri Apr 24 09:42:10.552526 2026] [:error] [pid 19102:tid 19178] [client 172.161.55.226:46586] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "aerKcgDSgrbLEZbkqD5JjwAAAI4"]
[Fri Apr 24 09:42:11.428325 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:63655] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "aerKczQ--M3-tsKAnhFHcQAAAMI"]
[Fri Apr 24 09:42:12.494763 2026] [:error] [pid 19200:tid 19216] [client 172.161.55.226:51589] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "aerKdDQ--M3-tsKAnhFHdQAAAMg"]
[Fri Apr 24 09:42:13.156659 2026] [:error] [pid 52129:tid 52136] [client 172.161.55.226:55175] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "aerKdeKCZKf8_u2LKiBPmQAAAQM"]
[Fri Apr 24 09:42:13.771737 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:54745] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aerKdTQ--M3-tsKAnhFHfAAAAME"]
[Fri Apr 24 09:42:14.669829 2026] [:error] [pid 19200:tid 19231] [client 172.161.55.226:41298] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aerKdjQ--M3-tsKAnhFHfgAAANc"]
[Fri Apr 24 09:42:15.243508 2026] [:error] [pid 52129:tid 52155] [client 172.161.55.226:46558] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aerKd-KCZKf8_u2LKiBPmwAAARY"]
[Fri Apr 24 09:42:16.064997 2026] [:error] [pid 19100:tid 19109] [client 172.161.55.226:62050] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aerKeLF_hzQs4CqbifdqrAAAAAA"]
[Fri Apr 24 09:42:16.615019 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:56400] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aerKeDQ--M3-tsKAnhFHgQAAAMo"]
[Fri Apr 24 09:42:17.257125 2026] [:error] [pid 19200:tid 19209] [client 172.161.55.226:54743] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aerKeTQ--M3-tsKAnhFHggAAAME"]
[Fri Apr 24 09:42:17.909460 2026] [:error] [pid 19200:tid 19210] [client 172.161.55.226:56412] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aerKeTQ--M3-tsKAnhFHhQAAAMI"]
[Fri Apr 24 09:42:18.445699 2026] [:error] [pid 52129:tid 52152] [client 172.161.55.226:43994] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aerKeuKCZKf8_u2LKiBPngAAARM"]
[Fri Apr 24 09:42:19.491909 2026] [:error] [pid 19200:tid 19218] [client 172.161.55.226:56436] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerKezQ--M3-tsKAnhFHhwAAAMo"]
[Fri Apr 24 09:42:20.334664 2026] [:error] [pid 52129:tid 52145] [client 172.161.55.226:55146] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerKfOKCZKf8_u2LKiBPqgAAAQw"]
[Fri Apr 24 09:42:21.463669 2026] [:error] [pid 52129:tid 52148] [client 172.161.55.226:51853] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerKfeKCZKf8_u2LKiBPtgAAAQ8"]
[Fri Apr 24 09:42:22.241564 2026] [:error] [pid 52129:tid 52138] [client 172.161.55.226:40236] [client 172.161.55.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aerKfuKCZKf8_u2LKiBPugAAAQU"]
[Fri Apr 24 10:32:04.363090 2026] [:error] [pid 17719:tid 17743] [client 194.26.192.182:59408] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerWJMTZ9gzEyL1BkPrHBgAAAJA"]
[Fri Apr 24 10:32:04.867570 2026] [:error] [pid 17719:tid 17749] [client 194.26.192.182:59499] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerWJMTZ9gzEyL1BkPrHHQAAAJY"]
[Fri Apr 24 10:32:05.367810 2026] [:error] [pid 17720:tid 17767] [client 194.26.192.182:59634] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerWJehlUs6BS3Ng7_WoLwAAAM0"]
[Fri Apr 24 10:32:05.877293 2026] [:error] [pid 17808:tid 17816] [client 194.26.192.182:59905] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerWJearbOEFI8qshvI8KgAAAEY"]
[Fri Apr 24 10:32:06.383767 2026] [:error] [pid 17719:tid 17736] [client 194.26.192.182:60201] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerWJsTZ9gzEyL1BkPrHUgAAAIk"]
[Fri Apr 24 11:10:27.593035 2026] [:error] [pid 17721:tid 17785] [client 185.198.240.121:44307] [client 185.198.240.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aerfI-FXXkLeyDnfk_-GBAAAAAQ"]
[Fri Apr 24 11:18:22.457391 2026] [:error] [pid 17719:tid 17733] [client 84.239.37.16:57199] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerg_sTZ9gzEyL1BkPrWDAAAAIY"]
[Fri Apr 24 11:18:23.445199 2026] [:error] [pid 17720:tid 17772] [client 84.239.37.16:28192] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerg_-hlUs6BS3Ng7_W-PwAAANI"]
[Fri Apr 24 11:18:23.934317 2026] [:error] [pid 17720:tid 17765] [client 84.239.37.16:25058] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerg_-hlUs6BS3Ng7_W-QAAAAMs"]
[Fri Apr 24 11:18:24.402072 2026] [:error] [pid 17719:tid 17741] [client 84.239.37.16:24468] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhAMTZ9gzEyL1BkPrWEgAAAI4"]
[Fri Apr 24 11:18:25.540059 2026] [:error] [pid 17719:tid 17735] [client 185.220.101.28:25234] [client 185.220.101.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhAcTZ9gzEyL1BkPrWGQAAAIg"]
[Fri Apr 24 11:18:26.613640 2026] [:error] [pid 17719:tid 17741] [client 84.239.37.16:64872] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerhAsTZ9gzEyL1BkPrWHgAAAI4"]
[Fri Apr 24 11:18:27.599144 2026] [:error] [pid 17719:tid 17734] [client 84.239.37.16:27009] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhA8TZ9gzEyL1BkPrWJAAAAIc"]
[Fri Apr 24 11:18:28.208654 2026] [:error] [pid 17721:tid 17805] [client 84.239.37.16:11203] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerhBOFXXkLeyDnfk_-H9gAAABg"]
[Fri Apr 24 11:18:28.449320 2026] [:error] [pid 17720:tid 17775] [client 84.239.37.16:25058] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhBOhlUs6BS3Ng7_W-RgAAANU"]
[Fri Apr 24 11:18:28.927577 2026] [:error] [pid 17720:tid 17763] [client 84.239.37.16:24818] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerhBOhlUs6BS3Ng7_W-RwAAAMk"]
[Fri Apr 24 11:18:30.266624 2026] [:error] [pid 17721:tid 17782] [client 84.239.37.16:11203] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhBuFXXkLeyDnfk_-H-QAAAAE"]
[Fri Apr 24 11:18:31.351828 2026] [:error] [pid 17808:tid 17824] [client 84.239.37.16:3502] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerhB-arbOEFI8qshvJLWgAAAE4"]
[Fri Apr 24 11:18:32.291836 2026] [:error] [pid 17720:tid 17759] [client 84.239.37.16:37820] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhCOhlUs6BS3Ng7_W-TgAAAMU"]
[Fri Apr 24 11:18:32.559741 2026] [:error] [pid 17720:tid 17758] [client 84.239.37.16:24818] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerhCOhlUs6BS3Ng7_W-UAAAAMQ"]
[Fri Apr 24 11:18:33.057014 2026] [:error] [pid 17720:tid 17762] [client 84.239.37.16:13784] [client 84.239.37.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aerhCehlUs6BS3Ng7_W-UgAAAMg"]
[Fri Apr 24 11:28:59.546532 2026] [:error] [pid 17808:tid 17834] [client 147.135.212.202:49968] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aerje-arbOEFI8qshvJQBwAAAFg"]
[Fri Apr 24 11:29:01.982076 2026] [:error] [pid 17720:tid 17760] [client 147.135.212.202:51534] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aerjfehlUs6BS3Ng7_XBDwAAAMY"]
[Fri Apr 24 11:29:04.476471 2026] [:error] [pid 17719:tid 17749] [client 147.135.212.202:51548] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aerjgMTZ9gzEyL1BkPrb0gAAAJY"]
[Fri Apr 24 11:29:07.173755 2026] [:error] [pid 17719:tid 17743] [client 147.135.212.202:39486] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aerjg8TZ9gzEyL1BkPrb2gAAAJA"]
[Fri Apr 24 11:29:09.642045 2026] [:error] [pid 17720:tid 17775] [client 147.135.212.202:39494] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aerjhehlUs6BS3Ng7_XBFgAAANU"]
[Fri Apr 24 11:29:11.472962 2026] [:error] [pid 17720:tid 17775] [client 147.135.212.202:39494] [client 147.135.212.202] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "57.141.14.110_bb694759cd2c22a01c1316c1c32e166b75850636"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aerjhehlUs6BS3Ng7_XBFgAAANU"]
[Fri Apr 24 11:29:12.235728 2026] [:error] [pid 17808:tid 17826] [client 147.135.212.202:39508] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aerjiOarbOEFI8qshvJQGQAAAFA"]
[Fri Apr 24 11:29:14.646319 2026] [:error] [pid 17808:tid 17832] [client 147.135.212.202:39520] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aerjiuarbOEFI8qshvJQHQAAAFY"]
[Fri Apr 24 11:29:17.048139 2026] [:error] [pid 22114:tid 22119] [client 147.135.212.202:53480] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aerjjYAuWGz3WlMQjod8HQAAAQI"]
[Fri Apr 24 11:29:19.453829 2026] [:error] [pid 17808:tid 17819] [client 147.135.212.202:53490] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aerjj-arbOEFI8qshvJQJwAAAEk"]
[Fri Apr 24 11:29:21.855609 2026] [:error] [pid 17719:tid 17732] [client 147.135.212.202:53496] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aerjkcTZ9gzEyL1BkPrb6wAAAIU"]
[Fri Apr 24 11:29:24.151912 2026] [:error] [pid 17721:tid 17788] [client 147.135.212.202:53506] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aerjlOFXXkLeyDnfk_-L7gAAAAc"]
[Fri Apr 24 11:29:26.748977 2026] [:error] [pid 17719:tid 17741] [client 147.135.212.202:32828] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aerjlsTZ9gzEyL1BkPrb8gAAAI4"]
[Fri Apr 24 11:29:29.213658 2026] [:error] [pid 17719:tid 17735] [client 147.135.212.202:32840] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aerjmcTZ9gzEyL1BkPrb9wAAAIg"]
[Fri Apr 24 11:29:31.764858 2026] [:error] [pid 17719:tid 17736] [client 147.135.212.202:32848] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aerjm8TZ9gzEyL1BkPrb_QAAAIk"]
[Fri Apr 24 11:29:34.306747 2026] [:error] [pid 17719:tid 17733] [client 147.135.212.202:32850] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aerjnsTZ9gzEyL1BkPrb_wAAAIY"]
[Fri Apr 24 11:29:36.806900 2026] [:error] [pid 22114:tid 22130] [client 147.135.212.202:56192] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aerjoIAuWGz3WlMQjod8MAAAAQ0"]
[Fri Apr 24 11:29:39.180936 2026] [:error] [pid 17721:tid 17795] [client 147.135.212.202:56198] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aerjo-FXXkLeyDnfk_-MAgAAAA4"]
[Fri Apr 24 11:29:41.587567 2026] [:error] [pid 22114:tid 22123] [client 147.135.212.202:56208] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aerjpYAuWGz3WlMQjod8OAAAAQY"]
[Fri Apr 24 11:29:44.080890 2026] [:error] [pid 17719:tid 17735] [client 147.135.212.202:56218] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aerjqMTZ9gzEyL1BkPrcFAAAAIg"]
[Fri Apr 24 11:29:47.219726 2026] [:error] [pid 17721:tid 17791] [client 147.135.212.202:46236] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerjq-FXXkLeyDnfk_-MBQAAAAo"]
[Fri Apr 24 11:29:50.831399 2026] [:error] [pid 17720:tid 17758] [client 147.135.212.202:46238] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aerjruhlUs6BS3Ng7_XBMwAAAMQ"]
[Fri Apr 24 11:31:43.784378 2026] [:error] [pid 17808:tid 17811] [client 121.229.185.160:47002] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aerkH-arbOEFI8qshvJQ8gAAAEE"]
[Fri Apr 24 12:46:02.249251 2026] [:error] [pid 22114:tid 22121] [client 149.22.83.21:52522] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aer1ioAuWGz3WlMQjoeWJAAAAQQ"]
[Fri Apr 24 12:46:04.556111 2026] [:error] [pid 17808:tid 17810] [client 149.22.83.21:52538] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aer1jOarbOEFI8qshvKAPAAAAEA"]
[Fri Apr 24 12:46:06.925986 2026] [:error] [pid 17721:tid 17797] [client 149.22.83.21:51540] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aer1juFXXkLeyDnfk_-wtQAAABA"]
[Fri Apr 24 12:46:09.264782 2026] [:error] [pid 17719:tid 17731] [client 149.22.83.21:51542] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aer1kcTZ9gzEyL1BkPoctAAAAIQ"]
[Fri Apr 24 12:46:11.438476 2026] [:error] [pid 17719:tid 17739] [client 149.22.83.21:51544] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aer1k8TZ9gzEyL1BkPocyQAAAIw"]
[Fri Apr 24 12:46:13.793377 2026] [:error] [pid 17719:tid 17727] [client 149.22.83.21:51556] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aer1lcTZ9gzEyL1BkPoc0QAAAIA"]
[Fri Apr 24 12:46:15.905857 2026] [:error] [pid 22114:tid 22132] [client 149.22.83.21:49492] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aer1l4AuWGz3WlMQjoeWKQAAAQ8"]
[Fri Apr 24 12:46:18.061960 2026] [:error] [pid 17719:tid 17732] [client 149.22.83.21:49500] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aer1msTZ9gzEyL1BkPoc3gAAAIU"]
[Fri Apr 24 12:46:20.342694 2026] [:error] [pid 17719:tid 17747] [client 149.22.83.21:49504] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aer1nMTZ9gzEyL1BkPoc4wAAAJQ"]
[Fri Apr 24 12:46:22.568988 2026] [:error] [pid 17719:tid 17743] [client 149.22.83.21:49520] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aer1nsTZ9gzEyL1BkPoc5wAAAJA"]
[Fri Apr 24 12:46:24.749092 2026] [:error] [pid 17720:tid 17767] [client 149.22.83.21:49534] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aer1oOhlUs6BS3Ng7_XfRwAAAM0"]
[Fri Apr 24 12:46:26.899418 2026] [:error] [pid 22114:tid 22130] [client 149.22.83.21:42722] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aer1ooAuWGz3WlMQjoeWMwAAAQ0"]
[Fri Apr 24 12:46:29.414555 2026] [:error] [pid 17720:tid 17756] [client 149.22.83.21:42724] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aer1pehlUs6BS3Ng7_XfSwAAAMI"]
[Fri Apr 24 12:46:31.592974 2026] [:error] [pid 17721:tid 17788] [client 149.22.83.21:42730] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aer1p-FXXkLeyDnfk_-wxQAAAAc"]
[Fri Apr 24 12:46:33.650745 2026] [:error] [pid 17720:tid 17757] [client 149.22.83.21:42746] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aer1qehlUs6BS3Ng7_XfTQAAAMM"]
[Fri Apr 24 12:46:36.640718 2026] [:error] [pid 17721:tid 17783] [client 149.22.83.21:59958] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aer1rOFXXkLeyDnfk_-wzQAAAAI"]
[Fri Apr 24 12:46:38.775383 2026] [:error] [pid 17721:tid 17786] [client 149.22.83.21:54382] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aer1ruFXXkLeyDnfk_-w0QAAAAU"]
[Fri Apr 24 12:46:40.868643 2026] [:error] [pid 17720:tid 17777] [client 149.22.83.21:54406] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aer1sOhlUs6BS3Ng7_XfWwAAANc"]
[Fri Apr 24 12:46:43.375274 2026] [:error] [pid 17721:tid 17799] [client 149.22.83.21:54418] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aer1s-FXXkLeyDnfk_-w1AAAABI"]
[Fri Apr 24 12:46:45.533607 2026] [:error] [pid 17808:tid 17813] [client 149.22.83.21:46712] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aer1tearbOEFI8qshvKApgAAAEM"]
[Fri Apr 24 12:46:47.830800 2026] [:error] [pid 17720:tid 17755] [client 149.22.83.21:46714] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aer1t-hlUs6BS3Ng7_XfaAAAAME"]
[Fri Apr 24 12:46:49.877997 2026] [:error] [pid 17719:tid 17734] [client 149.22.83.21:46718] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aer1ucTZ9gzEyL1BkPodBQAAAIc"]
[Fri Apr 24 12:46:52.073708 2026] [:error] [pid 17719:tid 17748] [client 149.22.83.21:46720] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aer1vMTZ9gzEyL1BkPodCgAAAJU"]
[Fri Apr 24 12:46:54.608049 2026] [:error] [pid 17719:tid 17732] [client 149.22.83.21:46726] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aer1vsTZ9gzEyL1BkPodEQAAAIU"]
[Fri Apr 24 12:46:56.843289 2026] [:error] [pid 17719:tid 17749] [client 149.22.83.21:60524] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aer1wMTZ9gzEyL1BkPodHAAAAJY"]
[Fri Apr 24 12:46:59.077036 2026] [:error] [pid 17719:tid 17748] [client 149.22.83.21:60526] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aer1w8TZ9gzEyL1BkPodKAAAAJU"]
[Fri Apr 24 12:47:22.998813 2026] [:error] [pid 17719:tid 17742] [client 149.22.83.21:60538] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aer12sTZ9gzEyL1BkPodbAAAAI8"]
[Fri Apr 24 12:47:25.206763 2026] [:error] [pid 17721:tid 17790] [client 149.22.83.21:35532] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aer13eFXXkLeyDnfk_-xEgAAAAk"]
[Fri Apr 24 12:47:27.464401 2026] [:error] [pid 17720:tid 17764] [client 149.22.83.21:38414] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aer13-hlUs6BS3Ng7_XffgAAAMo"]
[Fri Apr 24 12:47:28.970728 2026] [:error] [pid 17720:tid 17769] [client 149.22.83.21:38428] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aer14OhlUs6BS3Ng7_XffwAAAM8"]
[Fri Apr 24 12:47:32.840778 2026] [:error] [pid 17719:tid 17730] [client 149.22.83.21:38434] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aer15MTZ9gzEyL1BkPodgQAAAIM"]
[Fri Apr 24 13:27:00.363927 2026] [:error] [pid 17721:tid 17793] [client 38.242.238.115:43134] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aer_JOFXXkLeyDnfk_-9-gAAAAw"]
[Fri Apr 24 13:27:04.337071 2026] [:error] [pid 17721:tid 17796] [client 38.242.238.115:57806] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aer_KOFXXkLeyDnfk_-9_wAAAA8"]
[Fri Apr 24 13:27:14.450486 2026] [:error] [pid 22114:tid 22135] [client 38.242.238.115:32928] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aer_MoAuWGz3WlMQjoed1gAAARI"]
[Fri Apr 24 13:27:25.210411 2026] [:error] [pid 17719:tid 17741] [client 38.242.238.115:35604] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aer_PcTZ9gzEyL1BkPo1xAAAAI4"]
[Fri Apr 24 13:27:33.257805 2026] [:error] [pid 17719:tid 17733] [client 38.242.238.115:40610] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aer_RcTZ9gzEyL1BkPo11gAAAIY"]
[Fri Apr 24 13:27:38.339016 2026] [:error] [pid 17719:tid 17741] [client 38.242.238.115:36250] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aer_SsTZ9gzEyL1BkPo13AAAAI4"]
[Fri Apr 24 13:27:43.240181 2026] [:error] [pid 17719:tid 17750] [client 38.242.238.115:60210] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aer_T8TZ9gzEyL1BkPo14QAAAJc"]
[Fri Apr 24 13:27:47.872716 2026] [:error] [pid 17719:tid 17735] [client 38.242.238.115:51708] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aer_U8TZ9gzEyL1BkPo15QAAAIg"]
[Fri Apr 24 13:28:59.710781 2026] [:error] [pid 17719:tid 17735] [client 38.242.238.115:54544] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aer_m8TZ9gzEyL1BkPo2vQAAAIg"]
[Fri Apr 24 13:29:04.894032 2026] [:error] [pid 17719:tid 17738] [client 38.242.238.115:59796] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "aer_oMTZ9gzEyL1BkPo2yAAAAIs"]
[Fri Apr 24 13:29:09.539567 2026] [:error] [pid 17720:tid 17755] [client 38.242.238.115:59802] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aer_pehlUs6BS3Ng7_XpHwAAAME"]
[Fri Apr 24 13:29:13.732637 2026] [:error] [pid 17721:tid 17805] [client 38.242.238.115:44446] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aer_qeFXXkLeyDnfk_--vAAAABg"]
[Fri Apr 24 13:29:23.029022 2026] [:error] [pid 17719:tid 17733] [client 38.242.238.115:44458] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aer_s8TZ9gzEyL1BkPo25wAAAIY"]
[Fri Apr 24 13:29:28.257277 2026] [:error] [pid 17808:tid 17821] [client 38.242.238.115:43244] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aer_uOarbOEFI8qshvKRmAAAAEs"]
[Fri Apr 24 13:29:33.807048 2026] [:error] [pid 17808:tid 17813] [client 38.242.238.115:33512] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aer_vearbOEFI8qshvKRoQAAAEM"]
[Fri Apr 24 13:29:37.359913 2026] [:error] [pid 17808:tid 17827] [client 38.242.238.115:33526] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aer_wearbOEFI8qshvKRqwAAAFE"]
[Fri Apr 24 13:29:40.935714 2026] [:error] [pid 17719:tid 17734] [client 38.242.238.115:33534] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aer_xMTZ9gzEyL1BkPo3RAAAAIc"]
[Fri Apr 24 13:29:45.526934 2026] [:error] [pid 17808:tid 17831] [client 38.242.238.115:55570] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aer_yearbOEFI8qshvKRtAAAAFU"]
[Fri Apr 24 13:29:48.896060 2026] [:error] [pid 17719:tid 17742] [client 38.242.238.115:55586] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aer_zMTZ9gzEyL1BkPo3UgAAAI8"]
[Fri Apr 24 13:29:53.438173 2026] [:error] [pid 17719:tid 17736] [client 38.242.238.115:37316] [client 38.242.238.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aer_0cTZ9gzEyL1BkPo3VwAAAIk"]
[Fri Apr 24 16:22:31.800505 2026] [:error] [pid 14531:tid 14550] [client 195.178.110.241:41820] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "aesoR3fLU2gw-6KR-GZ25QAAAVE"]
[Fri Apr 24 17:04:49.424422 2026] [:error] [pid 17719:tid 17745] [client 43.130.15.147:48502] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aesyMcTZ9gzEyL1BkPp6_AAAAJI"]
[Fri Apr 24 17:52:43.311349 2026] [:error] [pid 17720:tid 17773] [client 20.240.248.51:40022] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aes9a-hlUs6BS3Ng7_VX3AAAANM"]
[Fri Apr 24 17:52:45.863358 2026] [:error] [pid 17721:tid 17793] [client 20.240.248.51:38125] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aes9beFXXkLeyDnfk_8SggAAAAw"]
[Fri Apr 24 17:52:49.992984 2026] [proxy_fcgi:error] [pid 17720:tid 17770] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:50.313272 2026] [proxy_fcgi:error] [pid 17720:tid 17762] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:50.585522 2026] [proxy_fcgi:error] [pid 17720:tid 17772] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:50.893391 2026] [proxy_fcgi:error] [pid 17720:tid 17771] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:51.260846 2026] [proxy_fcgi:error] [pid 17720:tid 17768] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:51.596549 2026] [proxy_fcgi:error] [pid 17720:tid 17778] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:51.920409 2026] [proxy_fcgi:error] [pid 17720:tid 17767] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:52.193537 2026] [proxy_fcgi:error] [pid 17720:tid 17777] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:52.659966 2026] [proxy_fcgi:error] [pid 17720:tid 17772] [client 20.240.248.51:46191] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:52:52.994968 2026] [:error] [pid 17720:tid 17761] [client 20.240.248.51:46191] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "aes9dOhlUs6BS3Ng7_VYBwAAAMc"]
[Fri Apr 24 17:52:57.413611 2026] [:error] [pid 17720:tid 17778] [client 20.240.248.51:59579] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "aes9eehlUs6BS3Ng7_VYFwAAANg"]
[Fri Apr 24 17:52:58.726045 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:63705] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "aes9euhlUs6BS3Ng7_VYHwAAAME"]
[Fri Apr 24 17:53:01.291993 2026] [:error] [pid 17808:tid 17812] [client 20.240.248.51:47175] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "aes9fearbOEFI8qshvL5MQAAAEI"]
[Fri Apr 24 17:53:08.854896 2026] [:error] [pid 17719:tid 17748] [client 20.240.248.51:46084] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aes9hMTZ9gzEyL1BkPqGDAAAAJU"]
[Fri Apr 24 17:53:10.195107 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:32193] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aes9huhlUs6BS3Ng7_VYMAAAAME"]
[Fri Apr 24 17:53:12.385116 2026] [:error] [pid 14531:tid 14554] [client 20.240.248.51:44840] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aes9iHfLU2gw-6KR-GaX1wAAAVU"]
[Fri Apr 24 17:53:13.177783 2026] [:error] [pid 14531:tid 14557] [client 20.240.248.51:65040] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "aes9iXfLU2gw-6KR-GaX2wAAAVg"]
[Fri Apr 24 17:53:14.441725 2026] [:error] [pid 22114:tid 22118] [client 20.240.248.51:63949] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aes9ioAuWGz3WlMQjofQZwAAAQE"]
[Fri Apr 24 17:53:21.544203 2026] [:error] [pid 17808:tid 17822] [client 20.240.248.51:53693] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aes9kearbOEFI8qshvL5QQAAAEw"]
[Fri Apr 24 17:53:25.030007 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:60829] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "aes9lehlUs6BS3Ng7_VYXgAAAME"]
[Fri Apr 24 17:53:29.664306 2026] [:error] [pid 17721:tid 17782] [client 20.240.248.51:52749] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aes9meFXXkLeyDnfk_8SqAAAAAE"]
[Fri Apr 24 17:53:31.586702 2026] [:error] [pid 22114:tid 22128] [client 20.240.248.51:37434] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aes9m4AuWGz3WlMQjofQcwAAAQs"]
[Fri Apr 24 17:53:34.806840 2026] [:error] [pid 17721:tid 17789] [client 20.240.248.51:61079] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aes9nuFXXkLeyDnfk_8SrAAAAAg"]
[Fri Apr 24 17:53:37.589314 2026] [:error] [pid 22114:tid 22141] [client 20.240.248.51:57933] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "aes9oYAuWGz3WlMQjofQfAAAARg"]
[Fri Apr 24 17:53:39.278637 2026] [:error] [pid 17720:tid 17776] [client 20.240.248.51:31741] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aes9o-hlUs6BS3Ng7_VYgQAAANY"]
[Fri Apr 24 17:53:40.773843 2026] [:error] [pid 17720:tid 17774] [client 20.240.248.51:64909] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aes9pOhlUs6BS3Ng7_VYiAAAANQ"]
[Fri Apr 24 17:53:41.489604 2026] [:error] [pid 17808:tid 17812] [client 20.240.248.51:57982] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aes9pearbOEFI8qshvL5XAAAAEI"]
[Fri Apr 24 17:53:42.653433 2026] [:error] [pid 17720:tid 17762] [client 20.240.248.51:52757] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "aes9puhlUs6BS3Ng7_VYiwAAAMg"]
[Fri Apr 24 17:53:43.391460 2026] [:error] [pid 17719:tid 17728] [client 20.240.248.51:53983] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aes9p8TZ9gzEyL1BkPqGMAAAAIE"]
[Fri Apr 24 17:53:46.950383 2026] [:error] [pid 14531:tid 14543] [client 20.240.248.51:64935] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aes9qnfLU2gw-6KR-GaYFQAAAUo"]
[Fri Apr 24 17:53:48.024901 2026] [:error] [pid 22114:tid 22125] [client 20.240.248.51:54769] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aes9rIAuWGz3WlMQjofQhQAAAQg"]
[Fri Apr 24 17:53:50.345939 2026] [:error] [pid 17719:tid 17734] [client 20.240.248.51:56571] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "aes9rsTZ9gzEyL1BkPqGPwAAAIc"]
[Fri Apr 24 17:53:51.261666 2026] [:error] [pid 22114:tid 22133] [client 20.240.248.51:40673] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aes9r4AuWGz3WlMQjofQigAAARA"]
[Fri Apr 24 17:53:52.404440 2026] [proxy_fcgi:error] [pid 17808:tid 17829] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:52.944697 2026] [proxy_fcgi:error] [pid 17808:tid 17815] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:53.256673 2026] [proxy_fcgi:error] [pid 17808:tid 17834] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:53.586611 2026] [proxy_fcgi:error] [pid 17808:tid 17818] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:53.972423 2026] [proxy_fcgi:error] [pid 17808:tid 17817] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:54.511851 2026] [proxy_fcgi:error] [pid 17808:tid 17821] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:54.960084 2026] [proxy_fcgi:error] [pid 17808:tid 17833] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:55.298882 2026] [proxy_fcgi:error] [pid 17808:tid 17813] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:55.590289 2026] [proxy_fcgi:error] [pid 17808:tid 17825] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:55.919245 2026] [proxy_fcgi:error] [pid 17808:tid 17824] [client 20.240.248.51:56778] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:53:56.209271 2026] [:error] [pid 17808:tid 17812] [client 20.240.248.51:56778] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aes9tOarbOEFI8qshvL5eAAAAEI"]
[Fri Apr 24 17:53:57.393285 2026] [:error] [pid 17721:tid 17797] [client 20.240.248.51:61101] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aes9teFXXkLeyDnfk_8SwQAAABA"]
[Fri Apr 24 17:53:59.070610 2026] [:error] [pid 22114:tid 22120] [client 20.240.248.51:50595] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aes9t4AuWGz3WlMQjofQkwAAAQM"]
[Fri Apr 24 17:54:02.013907 2026] [:error] [pid 17720:tid 17774] [client 20.240.248.51:57975] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "aes9uuhlUs6BS3Ng7_VYmAAAANQ"]
[Fri Apr 24 17:54:10.004464 2026] [:error] [pid 17720:tid 17756] [client 20.240.248.51:49522] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aes9wuhlUs6BS3Ng7_VYrQAAAMI"]
[Fri Apr 24 17:54:11.398644 2026] [:error] [pid 22114:tid 22125] [client 20.240.248.51:54419] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aes9w4AuWGz3WlMQjofQnAAAAQg"]
[Fri Apr 24 17:54:13.009876 2026] [:error] [pid 22114:tid 22129] [client 20.240.248.51:60443] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aes9xYAuWGz3WlMQjofQnwAAAQw"]
[Fri Apr 24 17:54:14.494221 2026] [:error] [pid 17721:tid 17801] [client 20.240.248.51:60008] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "aes9xuFXXkLeyDnfk_8S2QAAABQ"]
[Fri Apr 24 17:54:16.339664 2026] [:error] [pid 17719:tid 17746] [client 20.240.248.51:58888] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aes9yMTZ9gzEyL1BkPqGUAAAAJM"]
[Fri Apr 24 17:54:17.382501 2026] [:error] [pid 22114:tid 22117] [client 20.240.248.51:58937] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aes9yYAuWGz3WlMQjofQogAAAQA"]
[Fri Apr 24 17:54:18.396858 2026] [:error] [pid 17808:tid 17820] [client 20.240.248.51:58213] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aes9yuarbOEFI8qshvL5lwAAAEo"]
[Fri Apr 24 17:54:22.496276 2026] [:error] [pid 22114:tid 22129] [client 20.240.248.51:44275] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "aes9zoAuWGz3WlMQjofQqAAAAQw"]
[Fri Apr 24 17:54:23.538580 2026] [:error] [pid 17721:tid 17793] [client 20.240.248.51:58899] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aes9z-FXXkLeyDnfk_8S4QAAAAw"]
[Fri Apr 24 17:54:24.581414 2026] [:error] [pid 22114:tid 22141] [client 20.240.248.51:56777] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aes90IAuWGz3WlMQjofQrAAAARg"]
[Fri Apr 24 17:54:25.944662 2026] [:error] [pid 22114:tid 22132] [client 20.240.248.51:30800] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aes90YAuWGz3WlMQjofQrwAAAQ8"]
[Fri Apr 24 17:54:27.577554 2026] [:error] [pid 17720:tid 17773] [client 20.240.248.51:36096] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "aes90-hlUs6BS3Ng7_VYuQAAANM"]
[Fri Apr 24 17:54:29.557610 2026] [:error] [pid 22114:tid 22121] [client 20.240.248.51:30841] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aes91YAuWGz3WlMQjofQtQAAAQQ"]
[Fri Apr 24 17:54:31.905558 2026] [:error] [pid 17720:tid 17776] [client 20.240.248.51:30819] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aes91-hlUs6BS3Ng7_VYwwAAANY"]
[Fri Apr 24 17:54:33.289996 2026] [:error] [pid 17808:tid 17819] [client 20.240.248.51:60029] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aes92earbOEFI8qshvL5tQAAAEk"]
[Fri Apr 24 17:54:40.049449 2026] [:error] [pid 22114:tid 22118] [client 20.240.248.51:44265] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "aes94IAuWGz3WlMQjofQuQAAAQE"]
[Fri Apr 24 17:54:41.628010 2026] [:error] [pid 22114:tid 22124] [client 20.240.248.51:4751] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "aes94YAuWGz3WlMQjofQugAAAQc"]
[Fri Apr 24 17:54:43.776146 2026] [:error] [pid 17719:tid 17737] [client 20.240.248.51:49123] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "aes948TZ9gzEyL1BkPqGbAAAAIo"]
[Fri Apr 24 17:54:46.309208 2026] [:error] [pid 17808:tid 17825] [client 20.240.248.51:54370] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "aes95uarbOEFI8qshvL5zwAAAE8"]
[Fri Apr 24 17:54:47.669985 2026] [:error] [pid 17720:tid 17772] [client 20.240.248.51:51568] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "aes95-hlUs6BS3Ng7_VY3QAAANI"]
[Fri Apr 24 17:54:56.913045 2026] [proxy_fcgi:error] [pid 17721:tid 17800] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:57.200376 2026] [proxy_fcgi:error] [pid 17721:tid 17783] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:57.486892 2026] [proxy_fcgi:error] [pid 17721:tid 17787] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:58.013816 2026] [proxy_fcgi:error] [pid 17721:tid 17795] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:58.317715 2026] [proxy_fcgi:error] [pid 17721:tid 17784] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:58.635082 2026] [proxy_fcgi:error] [pid 17721:tid 17799] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:58.980158 2026] [proxy_fcgi:error] [pid 17721:tid 17781] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:59.305765 2026] [proxy_fcgi:error] [pid 17721:tid 17786] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:59.637035 2026] [proxy_fcgi:error] [pid 17721:tid 17804] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:54:59.927709 2026] [proxy_fcgi:error] [pid 17721:tid 17790] [client 20.240.248.51:35668] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:55:00.221890 2026] [:error] [pid 17721:tid 17803] [client 20.240.248.51:35668] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aes99OFXXkLeyDnfk_8TCQAAABY"]
[Fri Apr 24 17:55:01.269732 2026] [:error] [pid 17720:tid 17773] [client 20.240.248.51:55696] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aes99ehlUs6BS3Ng7_VY_gAAANM"]
[Fri Apr 24 17:55:02.436013 2026] [:error] [pid 17808:tid 17834] [client 20.240.248.51:51547] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aes99uarbOEFI8qshvL53AAAAFg"]
[Fri Apr 24 17:55:04.111892 2026] [:error] [pid 17719:tid 17729] [client 20.240.248.51:40605] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "aes9-MTZ9gzEyL1BkPqGcwAAAII"]
[Fri Apr 24 17:55:10.486534 2026] [:error] [pid 14531:tid 14544] [client 20.240.248.51:28247] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aes9_nfLU2gw-6KR-GaYUQAAAUs"]
[Fri Apr 24 17:55:11.559101 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:64758] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aes9_-hlUs6BS3Ng7_VZNQAAAME"]
[Fri Apr 24 17:55:13.034342 2026] [:error] [pid 17720:tid 17778] [client 20.240.248.51:62522] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aes-AehlUs6BS3Ng7_VZPQAAANg"]
[Fri Apr 24 17:55:18.040766 2026] [:error] [pid 17720:tid 17777] [client 20.240.248.51:56105] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w.php"] [unique_id "aes-BuhlUs6BS3Ng7_VZXQAAANc"]
[Fri Apr 24 17:55:19.775128 2026] [:error] [pid 17721:tid 17785] [client 20.240.248.51:57712] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aes-B-FXXkLeyDnfk_8TIQAAAAQ"]
[Fri Apr 24 17:55:20.672931 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:57868] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aes-COhlUs6BS3Ng7_VZbQAAAME"]
[Fri Apr 24 17:55:23.788594 2026] [:error] [pid 22114:tid 22117] [client 20.240.248.51:4551] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aes-C4AuWGz3WlMQjofQ0AAAAQA"]
[Fri Apr 24 17:55:24.461275 2026] [:error] [pid 22114:tid 22130] [client 20.240.248.51:57898] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "aes-DIAuWGz3WlMQjofQ0QAAAQ0"]
[Fri Apr 24 17:55:26.280151 2026] [:error] [pid 17720:tid 17756] [client 20.240.248.51:50954] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aes-DuhlUs6BS3Ng7_VZdwAAAMI"]
[Fri Apr 24 17:55:28.022999 2026] [:error] [pid 14531:tid 14537] [client 20.240.248.51:65311] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aes-EHfLU2gw-6KR-GaYaAAAAUQ"]
[Fri Apr 24 17:55:34.252138 2026] [:error] [pid 17719:tid 17727] [client 20.240.248.51:55197] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aes-FsTZ9gzEyL1BkPqGfwAAAIA"]
[Fri Apr 24 17:55:36.459842 2026] [:error] [pid 14531:tid 14541] [client 20.240.248.51:62018] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "aes-GHfLU2gw-6KR-GaYcwAAAUg"]
[Fri Apr 24 17:55:40.613507 2026] [:error] [pid 17719:tid 17728] [client 20.240.248.51:52343] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aes-HMTZ9gzEyL1BkPqGhAAAAIE"]
[Fri Apr 24 17:55:41.584709 2026] [:error] [pid 17719:tid 17727] [client 20.240.248.51:63133] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aes-HcTZ9gzEyL1BkPqGhwAAAIA"]
[Fri Apr 24 17:55:47.006984 2026] [:error] [pid 17719:tid 17740] [client 20.240.248.51:63924] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aes-I8TZ9gzEyL1BkPqGjQAAAI0"]
[Fri Apr 24 17:55:48.377182 2026] [:error] [pid 17720:tid 17763] [client 20.240.248.51:64505] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "aes-JOhlUs6BS3Ng7_VZhgAAAMk"]
[Fri Apr 24 17:55:49.092186 2026] [:error] [pid 17720:tid 17765] [client 20.240.248.51:55642] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aes-JehlUs6BS3Ng7_VZjAAAAMs"]
[Fri Apr 24 17:55:50.558931 2026] [:error] [pid 22114:tid 22140] [client 20.240.248.51:33253] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aes-JoAuWGz3WlMQjofQ2QAAARc"]
[Fri Apr 24 17:55:52.192077 2026] [:error] [pid 17720:tid 17756] [client 20.240.248.51:63904] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aes-KOhlUs6BS3Ng7_VZkgAAAMI"]
[Fri Apr 24 17:55:54.843404 2026] [:error] [pid 17808:tid 17829] [client 20.240.248.51:57411] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "aes-KuarbOEFI8qshvL6PAAAAFM"]
[Fri Apr 24 17:55:57.750663 2026] [:error] [pid 14531:tid 14544] [client 20.240.248.51:33231] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aes-LXfLU2gw-6KR-GaYggAAAUs"]
[Fri Apr 24 17:55:58.544758 2026] [:error] [pid 17808:tid 17823] [client 20.240.248.51:36832] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "aes-LuarbOEFI8qshvL6QgAAAE0"]
[Fri Apr 24 17:56:01.003882 2026] [proxy_fcgi:error] [pid 17808:tid 17827] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:01.323265 2026] [proxy_fcgi:error] [pid 17808:tid 17834] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:01.673506 2026] [proxy_fcgi:error] [pid 17808:tid 17821] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:01.944453 2026] [proxy_fcgi:error] [pid 17808:tid 17819] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:02.309020 2026] [proxy_fcgi:error] [pid 17808:tid 17829] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:02.677492 2026] [proxy_fcgi:error] [pid 17808:tid 17820] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:03.022773 2026] [proxy_fcgi:error] [pid 17808:tid 17830] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:03.329069 2026] [proxy_fcgi:error] [pid 17808:tid 17811] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:03.628903 2026] [proxy_fcgi:error] [pid 17808:tid 17825] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:03.901689 2026] [proxy_fcgi:error] [pid 17808:tid 17810] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:04.171474 2026] [proxy_fcgi:error] [pid 17808:tid 17824] [client 20.240.248.51:36788] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:56:04.447697 2026] [:error] [pid 17808:tid 17821] [client 20.240.248.51:36788] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aes-NOarbOEFI8qshvL6WwAAAEs"]
[Fri Apr 24 17:56:05.596515 2026] [:error] [pid 17808:tid 17813] [client 20.240.248.51:36790] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aes-NearbOEFI8qshvL6YgAAAEM"]
[Fri Apr 24 17:56:07.951215 2026] [:error] [pid 14531:tid 14549] [client 20.240.248.51:43215] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aes-N3fLU2gw-6KR-GaYiwAAAVA"]
[Fri Apr 24 17:56:10.799721 2026] [:error] [pid 17719:tid 17740] [client 20.240.248.51:41592] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "aes-OsTZ9gzEyL1BkPqGmgAAAI0"]
[Fri Apr 24 17:56:18.375136 2026] [:error] [pid 17721:tid 17790] [client 20.240.248.51:61374] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "aes-QuFXXkLeyDnfk_8TTAAAAAk"]
[Fri Apr 24 17:56:42.930751 2026] [:error] [pid 17720:tid 17765] [client 20.240.248.51:42719] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aes-WuhlUs6BS3Ng7_VZ-gAAAMs"]
[Fri Apr 24 17:56:44.738491 2026] [:error] [pid 17720:tid 17755] [client 20.240.248.51:4156] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "aes-XOhlUs6BS3Ng7_VaAAAAAME"]
[Fri Apr 24 17:56:48.019907 2026] [:error] [pid 17719:tid 17741] [client 20.240.248.51:4612] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aes-YMTZ9gzEyL1BkPqGtgAAAI4"]
[Fri Apr 24 17:56:59.843075 2026] [:error] [pid 17720:tid 17766] [client 20.240.248.51:63638] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aes-a-hlUs6BS3Ng7_VaEgAAAMw"]
[Fri Apr 24 17:57:02.139667 2026] [:error] [pid 17720:tid 17778] [client 20.240.248.51:29294] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "aes-buhlUs6BS3Ng7_VaGgAAANg"]
[Fri Apr 24 17:57:05.777399 2026] [proxy_fcgi:error] [pid 17719:tid 17746] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:06.065843 2026] [proxy_fcgi:error] [pid 17719:tid 17748] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:06.354672 2026] [proxy_fcgi:error] [pid 17719:tid 17734] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:06.642937 2026] [proxy_fcgi:error] [pid 17719:tid 17730] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:06.943025 2026] [proxy_fcgi:error] [pid 17719:tid 17729] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:07.233363 2026] [proxy_fcgi:error] [pid 17719:tid 17733] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:07.521643 2026] [proxy_fcgi:error] [pid 17719:tid 17751] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:07.814689 2026] [proxy_fcgi:error] [pid 17719:tid 17743] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:08.103889 2026] [proxy_fcgi:error] [pid 17719:tid 17732] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:08.393856 2026] [proxy_fcgi:error] [pid 17719:tid 17737] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:08.694212 2026] [proxy_fcgi:error] [pid 17719:tid 17745] [client 20.240.248.51:60309] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:57:08.979299 2026] [:error] [pid 17719:tid 17731] [client 20.240.248.51:60309] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aes-dMTZ9gzEyL1BkPqG1wAAAIQ"]
[Fri Apr 24 17:57:09.867995 2026] [:error] [pid 17719:tid 17750] [client 20.240.248.51:64165] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aes-dcTZ9gzEyL1BkPqG2AAAAJc"]
[Fri Apr 24 17:57:11.232141 2026] [:error] [pid 17721:tid 17786] [client 20.240.248.51:64973] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aes-d-FXXkLeyDnfk_8TeAAAAAU"]
[Fri Apr 24 17:57:12.119525 2026] [:error] [pid 17719:tid 17736] [client 20.240.248.51:5088] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bbny.php"] [unique_id "aes-eMTZ9gzEyL1BkPqG3AAAAIk"]
[Fri Apr 24 17:57:14.185301 2026] [:error] [pid 17720:tid 17776] [client 20.240.248.51:33895] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aes-euhlUs6BS3Ng7_VaPAAAANY"]
[Fri Apr 24 17:57:16.767690 2026] [:error] [pid 17720:tid 17764] [client 20.240.248.51:33862] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aes-fOhlUs6BS3Ng7_VaRwAAAMo"]
[Fri Apr 24 17:57:19.788643 2026] [:error] [pid 14531:tid 14547] [client 20.240.248.51:46703] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aes-f3fLU2gw-6KR-GaYxgAAAU4"]
[Fri Apr 24 17:57:21.875513 2026] [:error] [pid 17808:tid 17827] [client 20.240.248.51:65003] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ggb.php"] [unique_id "aes-gearbOEFI8qshvL6ugAAAFE"]
[Fri Apr 24 17:57:24.612535 2026] [:error] [pid 22114:tid 22121] [client 20.240.248.51:28790] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zhw.php"] [unique_id "aes-hIAuWGz3WlMQjofQ-AAAAQQ"]
[Fri Apr 24 17:57:39.219889 2026] [:error] [pid 17721:tid 17791] [client 20.240.248.51:57382] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aes-k-FXXkLeyDnfk_8TkQAAAAo"]
[Fri Apr 24 17:57:41.708465 2026] [:error] [pid 17808:tid 17827] [client 20.240.248.51:38654] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aes-learbOEFI8qshvL6zQAAAFE"]
[Fri Apr 24 17:57:43.692689 2026] [:error] [pid 17808:tid 17815] [client 20.240.248.51:28204] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aes-l-arbOEFI8qshvL60AAAAEU"]
[Fri Apr 24 17:57:46.028022 2026] [:error] [pid 17808:tid 17825] [client 20.240.248.51:41997] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "aes-muarbOEFI8qshvL61wAAAE8"]
[Fri Apr 24 17:57:48.363730 2026] [:error] [pid 17719:tid 17732] [client 20.240.248.51:59718] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aes-nMTZ9gzEyL1BkPqG_AAAAIU"]
[Fri Apr 24 17:57:49.778848 2026] [:error] [pid 17808:tid 17823] [client 20.240.248.51:28185] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aes-nearbOEFI8qshvL62gAAAE0"]
[Fri Apr 24 17:57:51.941692 2026] [:error] [pid 17721:tid 17794] [client 20.240.248.51:59761] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aes-n-FXXkLeyDnfk_8TnwAAAA0"]
[Fri Apr 24 17:57:54.430495 2026] [:error] [pid 14531:tid 14551] [client 20.240.248.51:63407] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "aes-onfLU2gw-6KR-GaZJwAAAVI"]
[Fri Apr 24 17:57:56.557305 2026] [:error] [pid 17808:tid 17830] [client 20.240.248.51:58565] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aes-pOarbOEFI8qshvL66wAAAFQ"]
[Fri Apr 24 17:57:58.963525 2026] [:error] [pid 14531:tid 14552] [client 20.240.248.51:32722] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aes-pnfLU2gw-6KR-GaZRQAAAVM"]
[Fri Apr 24 17:58:01.287056 2026] [:error] [pid 17720:tid 17774] [client 20.240.248.51:63421] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aes-qehlUs6BS3Ng7_VacwAAANQ"]
[Fri Apr 24 17:58:02.472194 2026] [:error] [pid 17808:tid 17831] [client 20.240.248.51:60501] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lov.php"] [unique_id "aes-quarbOEFI8qshvL68QAAAFU"]
[Fri Apr 24 17:58:03.539737 2026] [:error] [pid 17720:tid 17760] [client 20.240.248.51:63370] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "aes-q-hlUs6BS3Ng7_VaeQAAAMY"]
[Fri Apr 24 17:58:12.352944 2026] [proxy_fcgi:error] [pid 17720:tid 17759] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:12.620876 2026] [proxy_fcgi:error] [pid 17720:tid 17768] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:12.930071 2026] [proxy_fcgi:error] [pid 17720:tid 17773] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:13.295604 2026] [proxy_fcgi:error] [pid 17720:tid 17767] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:13.567073 2026] [proxy_fcgi:error] [pid 17720:tid 17775] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:13.912439 2026] [proxy_fcgi:error] [pid 17720:tid 17762] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:14.262039 2026] [proxy_fcgi:error] [pid 17720:tid 17777] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:14.645496 2026] [proxy_fcgi:error] [pid 17720:tid 17765] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:14.916071 2026] [proxy_fcgi:error] [pid 17720:tid 17755] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:15.256169 2026] [proxy_fcgi:error] [pid 17720:tid 17772] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:15.524190 2026] [proxy_fcgi:error] [pid 17720:tid 17776] [client 20.240.248.51:59306] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:58:15.790935 2026] [:error] [pid 17720:tid 17763] [client 20.240.248.51:59306] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "aes-t-hlUs6BS3Ng7_VaqAAAAMk"]
[Fri Apr 24 17:58:17.071374 2026] [:error] [pid 14531:tid 14553] [client 20.240.248.51:32227] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "aes-uXfLU2gw-6KR-GaZbQAAAVQ"]
[Fri Apr 24 17:58:18.635520 2026] [:error] [pid 22114:tid 22118] [client 20.240.248.51:47678] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "aes-uoAuWGz3WlMQjofRHQAAAQE"]
[Fri Apr 24 17:58:20.102732 2026] [:error] [pid 14531:tid 14535] [client 20.240.248.51:34349] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "aes-vHfLU2gw-6KR-GaZcgAAAUI"]
[Fri Apr 24 17:58:21.935278 2026] [:error] [pid 17719:tid 17734] [client 20.240.248.51:32200] [client 20.240.248.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "aes-vcTZ9gzEyL1BkPqHEgAAAIc"]
[Fri Apr 24 17:58:23.483659 2026] [:error] [pid 14531:tid 14534] [client 20.240.248.51:53649] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "aes-v3fLU2gw-6KR-GaZdgAAAUE"]
[Fri Apr 24 17:58:24.424708 2026] [:error] [pid 17720:tid 17773] [client 20.240.248.51:47674] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "aes-wOhlUs6BS3Ng7_VargAAANM"]
[Fri Apr 24 17:58:26.009669 2026] [:error] [pid 22114:tid 22119] [client 20.240.248.51:60830] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "aes-woAuWGz3WlMQjofRIQAAAQI"]
[Fri Apr 24 17:58:27.936536 2026] [:error] [pid 14531:tid 14544] [client 20.240.248.51:29755] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "aes-w3fLU2gw-6KR-GaZgQAAAUs"]
[Fri Apr 24 17:58:29.374132 2026] [:error] [pid 17720:tid 17774] [client 20.240.248.51:34326] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "aes-xehlUs6BS3Ng7_VatQAAANQ"]
[Fri Apr 24 17:58:31.676716 2026] [:error] [pid 17808:tid 17822] [client 20.240.248.51:47623] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "aes-x-arbOEFI8qshvL7CAAAAEw"]
[Fri Apr 24 17:58:37.781836 2026] [:error] [pid 17719:tid 17747] [client 34.58.239.158:52531] [client 34.58.239.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aes-zcTZ9gzEyL1BkPqHPgAAAJQ"]
[Fri Apr 24 17:58:55.103608 2026] [:error] [pid 4177:tid 4194] [client 20.240.248.51:48216] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "aes-332asKnvdrSe0x6nBgAAAYk"]
[Fri Apr 24 17:59:01.544124 2026] [:error] [pid 22114:tid 22137] [client 20.240.248.51:63939] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "aes-5YAuWGz3WlMQjofRjQAAARQ"]
[Fri Apr 24 17:59:02.901899 2026] [:error] [pid 17721:tid 17802] [client 20.240.248.51:48247] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "aes-5uFXXkLeyDnfk_8UAwAAABU"]
[Fri Apr 24 17:59:04.022051 2026] [:error] [pid 17720:tid 17774] [client 20.240.248.51:56765] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "aes-6OhlUs6BS3Ng7_VbEgAAANQ"]
[Fri Apr 24 17:59:05.052960 2026] [:error] [pid 17719:tid 17739] [client 20.240.248.51:32154] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "aes-6cTZ9gzEyL1BkPqHXAAAAIw"]
[Fri Apr 24 17:59:06.418387 2026] [:error] [pid 17720:tid 17778] [client 20.240.248.51:48219] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "aes-6uhlUs6BS3Ng7_VbFQAAANg"]
[Fri Apr 24 17:59:10.398643 2026] [:error] [pid 14531:tid 14551] [client 20.240.248.51:4798] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aes-7nfLU2gw-6KR-GaZqQAAAVI"]
[Fri Apr 24 17:59:11.467375 2026] [:error] [pid 4177:tid 4198] [client 20.240.248.51:56762] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aes-732asKnvdrSe0x6nNgAAAY0"]
[Fri Apr 24 17:59:12.752764 2026] [:error] [pid 17808:tid 17817] [client 20.240.248.51:54772] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aes-8OarbOEFI8qshvL7fwAAAEc"]
[Fri Apr 24 17:59:13.707246 2026] [:error] [pid 17721:tid 17781] [client 20.240.248.51:63723] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "aes-8eFXXkLeyDnfk_8UBQAAAAA"]
[Fri Apr 24 17:59:14.909907 2026] [:error] [pid 17720:tid 17764] [client 20.240.248.51:40018] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tramuibs.php"] [unique_id "aes-8uhlUs6BS3Ng7_VbMQAAAMo"]
[Fri Apr 24 17:59:15.849853 2026] [proxy_fcgi:error] [pid 17808:tid 17824] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:16.125597 2026] [proxy_fcgi:error] [pid 17808:tid 17810] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:16.449881 2026] [proxy_fcgi:error] [pid 17808:tid 17812] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:16.774429 2026] [proxy_fcgi:error] [pid 17808:tid 17813] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:17.118780 2026] [proxy_fcgi:error] [pid 17808:tid 17815] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:17.427723 2026] [proxy_fcgi:error] [pid 17808:tid 17816] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:17.974738 2026] [proxy_fcgi:error] [pid 17808:tid 17814] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:18.322482 2026] [proxy_fcgi:error] [pid 17808:tid 17817] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:18.712174 2026] [proxy_fcgi:error] [pid 17808:tid 17819] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:19.058491 2026] [proxy_fcgi:error] [pid 17808:tid 17825] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:19.381883 2026] [proxy_fcgi:error] [pid 17808:tid 17811] [client 20.240.248.51:57628] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 17:59:19.724492 2026] [:error] [pid 17808:tid 17822] [client 20.240.248.51:57628] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aes-9-arbOEFI8qshvL7kgAAAEw"]
[Fri Apr 24 17:59:20.758337 2026] [:error] [pid 4177:tid 4192] [client 20.240.248.51:55360] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aes--H2asKnvdrSe0x6nOgAAAYc"]
[Fri Apr 24 17:59:23.674784 2026] [:error] [pid 17721:tid 17787] [client 20.240.248.51:64219] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aes---FXXkLeyDnfk_8UCwAAAAY"]
[Fri Apr 24 17:59:25.237683 2026] [:error] [pid 4177:tid 4207] [client 20.240.248.51:64225] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cro.php"] [unique_id "aes-_X2asKnvdrSe0x6nRQAAAZY"]
[Fri Apr 24 17:59:27.372918 2026] [:error] [pid 17720:tid 17776] [client 20.240.248.51:4861] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aes-_-hlUs6BS3Ng7_VbNQAAANY"]
[Fri Apr 24 17:59:28.452622 2026] [:error] [pid 4177:tid 4204] [client 20.240.248.51:40576] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aes_AH2asKnvdrSe0x6nTgAAAZM"]
[Fri Apr 24 17:59:29.716245 2026] [:error] [pid 17808:tid 17811] [client 20.240.248.51:49051] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aes_AearbOEFI8qshvL7mQAAAEE"]
[Fri Apr 24 17:59:30.557031 2026] [:error] [pid 17720:tid 17756] [client 20.240.248.51:49059] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wwx.php"] [unique_id "aes_AuhlUs6BS3Ng7_VbOAAAAMI"]
[Fri Apr 24 17:59:34.692046 2026] [:error] [pid 14531:tid 14539] [client 20.240.248.51:40670] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aes_BnfLU2gw-6KR-GaZwQAAAUY"]
[Fri Apr 24 17:59:38.090360 2026] [:error] [pid 17719:tid 17745] [client 20.240.248.51:49045] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aes_CsTZ9gzEyL1BkPqHewAAAJI"]
[Fri Apr 24 17:59:40.138547 2026] [:error] [pid 17720:tid 17761] [client 20.240.248.51:63455] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aes_DOhlUs6BS3Ng7_VbRAAAAMc"]
[Fri Apr 24 17:59:43.260911 2026] [:error] [pid 22114:tid 22127] [client 20.240.248.51:36138] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/trx24.php"] [unique_id "aes_D4AuWGz3WlMQjofRpwAAAQo"]
[Fri Apr 24 17:59:51.097488 2026] [:error] [pid 22114:tid 22127] [client 20.240.248.51:61427] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aes_F4AuWGz3WlMQjofRswAAAQo"]
[Fri Apr 24 17:59:52.080148 2026] [:error] [pid 17721:tid 17787] [client 20.240.248.51:4185] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aes_GOFXXkLeyDnfk_8UHAAAAAY"]
[Fri Apr 24 17:59:55.302456 2026] [:error] [pid 14531:tid 14555] [client 20.240.248.51:62537] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aes_G3fLU2gw-6KR-GaZ1wAAAVY"]
[Fri Apr 24 17:59:56.590049 2026] [:error] [pid 17719:tid 17740] [client 20.240.248.51:42667] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/blox.php"] [unique_id "aes_HMTZ9gzEyL1BkPqHgQAAAI0"]
[Fri Apr 24 17:59:59.201251 2026] [:error] [pid 17720:tid 17757] [client 20.240.248.51:42664] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aes_H-hlUs6BS3Ng7_VbWAAAAMM"]
[Fri Apr 24 18:00:00.261925 2026] [:error] [pid 4177:tid 4202] [client 20.240.248.51:56023] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aes_IH2asKnvdrSe0x6nbwAAAZE"]
[Fri Apr 24 18:00:01.995625 2026] [:error] [pid 17808:tid 17830] [client 20.240.248.51:60459] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aes_IearbOEFI8qshvL7rAAAAFQ"]
[Fri Apr 24 18:00:03.384670 2026] [:error] [pid 4177:tid 4191] [client 20.240.248.51:60472] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/berax.php"] [unique_id "aes_I32asKnvdrSe0x6ndwAAAYY"]
[Fri Apr 24 18:00:06.302613 2026] [:error] [pid 4177:tid 4186] [client 20.240.248.51:44839] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aes_Jn2asKnvdrSe0x6negAAAYE"]
[Fri Apr 24 18:00:09.498728 2026] [:error] [pid 4177:tid 4187] [client 20.240.248.51:64756] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aes_KX2asKnvdrSe0x6njwAAAYI"]
[Fri Apr 24 18:00:14.534426 2026] [:error] [pid 17720:tid 17757] [client 20.240.248.51:58212] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aes_LuhlUs6BS3Ng7_VbnAAAAMM"]
[Fri Apr 24 18:00:15.669819 2026] [:error] [pid 17808:tid 17812] [client 20.240.248.51:60022] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkxzo.php"] [unique_id "aes_L-arbOEFI8qshvL7tQAAAEI"]
[Fri Apr 24 18:00:22.627169 2026] [proxy_fcgi:error] [pid 14531:tid 14548] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:22.960383 2026] [proxy_fcgi:error] [pid 14531:tid 14552] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:23.351363 2026] [proxy_fcgi:error] [pid 14531:tid 14553] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:23.684075 2026] [proxy_fcgi:error] [pid 14531:tid 14537] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:23.952862 2026] [proxy_fcgi:error] [pid 14531:tid 14546] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:24.297949 2026] [proxy_fcgi:error] [pid 14531:tid 14541] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:24.752782 2026] [proxy_fcgi:error] [pid 14531:tid 14540] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:25.044705 2026] [proxy_fcgi:error] [pid 14531:tid 14545] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:25.312726 2026] [proxy_fcgi:error] [pid 14531:tid 14550] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:25.633952 2026] [proxy_fcgi:error] [pid 14531:tid 14549] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:26.018689 2026] [proxy_fcgi:error] [pid 14531:tid 14547] [client 20.240.248.51:53207] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:00:26.284350 2026] [:error] [pid 14531:tid 14533] [client 20.240.248.51:53207] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "aes_OnfLU2gw-6KR-GaZ_wAAAUA"]
[Fri Apr 24 18:00:28.746930 2026] [:error] [pid 4177:tid 4201] [client 20.240.248.51:51568] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "aes_PH2asKnvdrSe0x6nyQAAAZA"]
[Fri Apr 24 18:00:30.669440 2026] [:error] [pid 22114:tid 22121] [client 20.240.248.51:56052] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "aes_PoAuWGz3WlMQjofRxQAAAQQ"]
[Fri Apr 24 18:00:32.555596 2026] [:error] [pid 17808:tid 17817] [client 20.240.248.51:55148] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "aes_QOarbOEFI8qshvL7xQAAAEc"]
[Fri Apr 24 18:00:33.692968 2026] [:error] [pid 17719:tid 17731] [client 20.240.248.51:39452] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aes_QcTZ9gzEyL1BkPqHkgAAAIQ"]
[Fri Apr 24 18:00:35.367781 2026] [:error] [pid 4177:tid 4201] [client 20.240.248.51:56798] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aes_Q32asKnvdrSe0x6n0QAAAZA"]
[Fri Apr 24 18:00:36.902084 2026] [:error] [pid 17721:tid 17795] [client 20.240.248.51:39468] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aes_ROFXXkLeyDnfk_8UOQAAAA4"]
[Fri Apr 24 18:00:37.891058 2026] [:error] [pid 17720:tid 17756] [client 20.240.248.51:4264] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "aes_RehlUs6BS3Ng7_VbswAAAMI"]
[Fri Apr 24 18:00:41.351092 2026] [:error] [pid 17720:tid 17770] [client 20.240.248.51:57899] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aes_SehlUs6BS3Ng7_VbvgAAANA"]
[Fri Apr 24 18:00:44.123974 2026] [:error] [pid 17720:tid 17758] [client 20.240.248.51:48668] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aes_TOhlUs6BS3Ng7_VbyAAAAMQ"]
[Fri Apr 24 18:00:45.273845 2026] [:error] [pid 14531:tid 14533] [client 20.240.248.51:56806] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aes_TXfLU2gw-6KR-GaaCQAAAUA"]
[Fri Apr 24 18:00:46.117770 2026] [:error] [pid 4177:tid 4204] [client 20.240.248.51:48675] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "aes_Tn2asKnvdrSe0x6n3AAAAZM"]
[Fri Apr 24 18:00:48.986975 2026] [:error] [pid 17720:tid 17754] [client 20.240.248.51:4228] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aes_UOhlUs6BS3Ng7_VbzgAAAMA"]
[Fri Apr 24 18:00:50.234409 2026] [:error] [pid 4177:tid 4201] [client 20.240.248.51:50588] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aes_Un2asKnvdrSe0x6n7AAAAZA"]
[Fri Apr 24 18:00:52.147277 2026] [:error] [pid 17720:tid 17765] [client 20.240.248.51:48678] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aes_VOhlUs6BS3Ng7_Vb0gAAAMs"]
[Fri Apr 24 18:00:53.607377 2026] [:error] [pid 4177:tid 4209] [client 20.240.248.51:35620] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "aes_VX2asKnvdrSe0x6n-AAAAZg"]
[Fri Apr 24 18:00:55.071979 2026] [:error] [pid 4177:tid 4185] [client 20.240.248.51:35065] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aes_V32asKnvdrSe0x6n-wAAAYA"]
[Fri Apr 24 18:00:57.148391 2026] [:error] [pid 4177:tid 4193] [client 20.240.248.51:35071] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aes_WX2asKnvdrSe0x6oBQAAAYg"]
[Fri Apr 24 18:00:58.341560 2026] [:error] [pid 4177:tid 4185] [client 20.240.248.51:44246] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aes_Wn2asKnvdrSe0x6oCQAAAYA"]
[Fri Apr 24 18:00:59.268105 2026] [:error] [pid 4177:tid 4206] [client 20.240.248.51:56785] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "aes_W32asKnvdrSe0x6oDAAAAZU"]
[Fri Apr 24 18:01:00.501354 2026] [:error] [pid 4177:tid 4195] [client 20.240.248.51:54450] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aes_XH2asKnvdrSe0x6oDwAAAYo"]
[Fri Apr 24 18:01:06.979180 2026] [:error] [pid 4177:tid 4192] [client 20.240.248.51:45516] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aes_Yn2asKnvdrSe0x6oGgAAAYc"]
[Fri Apr 24 18:01:11.824178 2026] [:error] [pid 17719:tid 17745] [client 20.240.248.51:44249] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "aes_Z8TZ9gzEyL1BkPqHngAAAJI"]
[Fri Apr 24 18:01:25.792663 2026] [:error] [pid 17721:tid 17786] [client 20.240.248.51:45528] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "aes_deFXXkLeyDnfk_8UWgAAAAU"]
[Fri Apr 24 18:01:27.269640 2026] [proxy_fcgi:error] [pid 17721:tid 17792] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:27.536416 2026] [proxy_fcgi:error] [pid 17721:tid 17785] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:27.801143 2026] [proxy_fcgi:error] [pid 17721:tid 17790] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:28.067927 2026] [proxy_fcgi:error] [pid 17721:tid 17782] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:28.334060 2026] [proxy_fcgi:error] [pid 17721:tid 17789] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:28.632447 2026] [proxy_fcgi:error] [pid 17721:tid 17798] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:28.911397 2026] [proxy_fcgi:error] [pid 17721:tid 17795] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:29.198488 2026] [proxy_fcgi:error] [pid 17721:tid 17796] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:29.466043 2026] [proxy_fcgi:error] [pid 17721:tid 17801] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:29.749107 2026] [proxy_fcgi:error] [pid 17721:tid 17793] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:30.042725 2026] [proxy_fcgi:error] [pid 17721:tid 17788] [client 20.240.248.51:50075] AH01071: Got error 'Primary script unknown'
[Fri Apr 24 18:01:30.306751 2026] [:error] [pid 17721:tid 17787] [client 20.240.248.51:50075] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aes_euFXXkLeyDnfk_8UcgAAAAY"]
[Fri Apr 24 18:01:32.438978 2026] [:error] [pid 4177:tid 4201] [client 20.240.248.51:28275] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aes_fH2asKnvdrSe0x6oQQAAAZA"]
[Fri Apr 24 18:01:33.690906 2026] [:error] [pid 17720:tid 17770] [client 20.240.248.51:37473] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aes_fehlUs6BS3Ng7_VcFQAAANA"]
[Fri Apr 24 18:01:35.442751 2026] [:error] [pid 4177:tid 4196] [client 20.240.248.51:34963] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/485.php"] [unique_id "aes_f32asKnvdrSe0x6oRQAAAYs"]
[Fri Apr 24 18:01:36.629368 2026] [:error] [pid 4177:tid 4204] [client 20.240.248.51:50986] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aes_gH2asKnvdrSe0x6oSgAAAZM"]
[Fri Apr 24 18:01:38.810105 2026] [:error] [pid 4177:tid 4209] [client 20.240.248.51:28683] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aes_gn2asKnvdrSe0x6oTQAAAZg"]
[Fri Apr 24 18:01:39.942721 2026] [:error] [pid 4177:tid 4197] [client 20.240.248.51:59835] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aes_g32asKnvdrSe0x6oUQAAAYw"]
[Fri Apr 24 18:01:41.538419 2026] [:error] [pid 4177:tid 4199] [client 20.240.248.51:64948] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "aes_hX2asKnvdrSe0x6oWQAAAY4"]
[Fri Apr 24 18:01:42.596518 2026] [:error] [pid 17720:tid 17764] [client 20.240.248.51:51509] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aes_huhlUs6BS3Ng7_VcHgAAAMo"]
[Fri Apr 24 18:01:43.684523 2026] [:error] [pid 17721:tid 17784] [client 20.240.248.51:34947] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aes_h-FXXkLeyDnfk_8UeQAAAAM"]
[Fri Apr 24 18:01:44.774579 2026] [:error] [pid 4177:tid 4202] [client 20.240.248.51:34965] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aes_iH2asKnvdrSe0x6obwAAAZE"]
[Fri Apr 24 18:01:46.590295 2026] [:error] [pid 17720:tid 17757] [client 20.240.248.51:37486] [client 20.240.248.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "aes_iuhlUs6BS3Ng7_VcJAAAAMM"]
[Fri Apr 24 18:30:15.199299 2026] [:error] [pid 17808:tid 17827] [client 212.227.21.19:39568] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aetGN-arbOEFI8qshvIGrgAAAFE"]
[Fri Apr 24 18:30:17.630537 2026] [:error] [pid 4177:tid 4202] [client 212.227.21.19:22850] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aetGOX2asKnvdrSe0x65GAAAAZE"]
[Fri Apr 24 18:30:20.177951 2026] [:error] [pid 17721:tid 17785] [client 212.227.21.19:23234] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aetGPOFXXkLeyDnfk_8bCQAAAAQ"]
[Fri Apr 24 18:30:22.695480 2026] [:error] [pid 17721:tid 17804] [client 212.227.21.19:23246] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aetGPuFXXkLeyDnfk_8bDQAAABc"]
[Fri Apr 24 18:30:25.199432 2026] [:error] [pid 4177:tid 4186] [client 212.227.21.19:23248] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aetGQX2asKnvdrSe0x65VwAAAYE"]
[Fri Apr 24 18:30:27.711278 2026] [:error] [pid 4177:tid 4202] [client 212.227.21.19:23256] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aetGQ32asKnvdrSe0x65ZAAAAZE"]
[Fri Apr 24 18:30:30.255205 2026] [:error] [pid 22114:tid 22130] [client 212.227.21.19:61788] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aetGRoAuWGz3WlMQjofV8wAAAQ0"]
[Fri Apr 24 18:30:32.287688 2026] [:error] [pid 4177:tid 4202] [client 212.227.21.19:31544] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aetGSH2asKnvdrSe0x65bgAAAZE"]
[Fri Apr 24 18:30:34.701945 2026] [:error] [pid 4177:tid 4188] [client 212.227.21.19:61802] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aetGSn2asKnvdrSe0x65fQAAAYM"]
[Fri Apr 24 18:30:37.219542 2026] [:error] [pid 17808:tid 17815] [client 212.227.21.19:61806] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aetGTearbOEFI8qshvIGxgAAAEU"]
[Fri Apr 24 18:30:39.248006 2026] [:error] [pid 17720:tid 17775] [client 212.227.21.19:26966] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aetGT-hlUs6BS3Ng7_VotwAAANU"]
[Fri Apr 24 18:30:41.641541 2026] [:error] [pid 4177:tid 4195] [client 212.227.21.19:57470] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aetGUX2asKnvdrSe0x65mgAAAYo"]
[Fri Apr 24 18:30:43.632818 2026] [:error] [pid 4177:tid 4191] [client 212.227.21.19:26968] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aetGU32asKnvdrSe0x65pwAAAYY"]
[Fri Apr 24 18:30:46.155409 2026] [:error] [pid 17719:tid 17747] [client 212.227.21.19:57480] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aetGVsTZ9gzEyL1BkPqMjgAAAJQ"]
[Fri Apr 24 18:30:48.508137 2026] [:error] [pid 17721:tid 17781] [client 212.227.21.19:24318] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aetGWOFXXkLeyDnfk_8bLwAAAAA"]
[Fri Apr 24 18:30:50.989953 2026] [:error] [pid 17720:tid 17767] [client 212.227.21.19:24330] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aetGWuhlUs6BS3Ng7_VozAAAAM0"]
[Fri Apr 24 18:30:53.548598 2026] [:error] [pid 17808:tid 17824] [client 212.227.21.19:24346] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aetGXearbOEFI8qshvIG4QAAAE4"]
[Fri Apr 24 18:30:55.541533 2026] [:error] [pid 17720:tid 17765] [client 212.227.21.19:37736] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aetGX-hlUs6BS3Ng7_Vo1QAAAMs"]
[Fri Apr 24 18:30:57.943377 2026] [:error] [pid 4177:tid 4191] [client 212.227.21.19:24356] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aetGYX2asKnvdrSe0x65uQAAAYY"]
[Fri Apr 24 18:30:59.950642 2026] [:error] [pid 14531:tid 14543] [client 212.227.21.19:59930] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aetGY3fLU2gw-6KR-GaicgAAAUo"]
[Fri Apr 24 18:31:02.592718 2026] [:error] [pid 14531:tid 14552] [client 212.227.21.19:6168] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aetGZnfLU2gw-6KR-GaidgAAAVM"]
[Fri Apr 24 18:31:05.095471 2026] [:error] [pid 22114:tid 22137] [client 212.227.21.19:6170] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aetGaYAuWGz3WlMQjofWCQAAARQ"]
[Fri Apr 24 18:31:07.598711 2026] [:error] [pid 17720:tid 17762] [client 212.227.21.19:6180] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aetGa-hlUs6BS3Ng7_Vo8gAAAMg"]
[Fri Apr 24 18:31:09.944372 2026] [:error] [pid 14531:tid 14555] [client 212.227.21.19:14192] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aetGbXfLU2gw-6KR-GaigwAAAVY"]
[Fri Apr 24 18:31:12.449990 2026] [:error] [pid 4177:tid 4190] [client 212.227.21.19:14194] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aetGcH2asKnvdrSe0x657gAAAYU"]
[Fri Apr 24 19:02:08.406744 2026] [:error] [pid 17720:tid 17777] [client 62.84.185.69:29550] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aetNsOhlUs6BS3Ng7_V4jgAAANc"]
[Fri Apr 24 19:02:11.000398 2026] [:error] [pid 14531:tid 14557] [client 62.84.185.69:29556] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aetNsnfLU2gw-6KR-GataAAAAVg"]
[Fri Apr 24 19:02:12.771716 2026] [:error] [pid 17720:tid 17775] [client 62.84.185.69:1684] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aetNtOhlUs6BS3Ng7_V4pwAAANU"]
[Fri Apr 24 19:02:16.509473 2026] [:error] [pid 17808:tid 17826] [client 62.84.185.69:6256] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aetNuOarbOEFI8qshvIULAAAAFA"]
[Fri Apr 24 20:10:06.823629 2026] [:error] [pid 17719:tid 17746] [client 195.178.110.18:54578] [client 195.178.110.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "aetdnsTZ9gzEyL1BkPqj-gAAAJM"]
[Fri Apr 24 20:52:49.233232 2026] [:error] [pid 14531:tid 14542] [client 195.201.199.99:38830] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aetnoXfLU2gw-6KR-GbJPwAAAUk"]
[Fri Apr 24 20:52:51.374659 2026] [:error] [pid 17721:tid 17801] [client 195.201.199.99:40462] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aetno-FXXkLeyDnfk_88nwAAABQ"]
[Fri Apr 24 20:52:54.120348 2026] [:error] [pid 17720:tid 17755] [client 195.201.199.99:38854] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aetnpuhlUs6BS3Ng7_WmagAAAME"]
[Fri Apr 24 20:52:56.351909 2026] [:error] [pid 17808:tid 17825] [client 195.201.199.99:41302] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aetnqOarbOEFI8qshvI41AAAAE8"]
[Fri Apr 24 20:52:58.948551 2026] [:error] [pid 22114:tid 22132] [client 195.201.199.99:39712] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aetnqoAuWGz3WlMQjofsBwAAAQ8"]
[Fri Apr 24 20:53:01.495252 2026] [:error] [pid 17720:tid 17773] [client 195.201.199.99:40160] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aetnrehlUs6BS3Ng7_WmcQAAANM"]
[Fri Apr 24 20:53:04.149885 2026] [:error] [pid 4177:tid 4208] [client 195.201.199.99:40618] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aetnsH2asKnvdrSe0x4QrAAAAZc"]
[Fri Apr 24 23:32:42.558143 2026] [:error] [pid 4177:tid 4199] [client 43.159.148.221:34286] [client 43.159.148.221] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeuNGn2asKnvdrSe0x5eaQAAAY4"]
[Fri Apr 24 23:44:55.539711 2026] [:error] [pid 17808:tid 17834] [client 45.85.147.218:35062] [client 45.85.147.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aeuP9-arbOEFI8qshvJ69wAAAFg"]
[Fri Apr 24 23:44:57.572116 2026] [:error] [pid 17808:tid 17815] [client 45.85.147.218:57530] [client 45.85.147.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeuP-earbOEFI8qshvJ6_gAAAEU"]
[Fri Apr 24 23:44:59.850344 2026] [:error] [pid 17720:tid 17755] [client 45.85.147.218:57562] [client 45.85.147.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeuP--hlUs6BS3Ng7_XvvgAAAME"]
[Fri Apr 24 23:45:02.667490 2026] [:error] [pid 17720:tid 17764] [client 45.85.147.218:57564] [client 45.85.147.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeuP_uhlUs6BS3Ng7_XvwwAAAMo"]
[Fri Apr 24 23:45:06.711455 2026] [:error] [pid 17721:tid 17791] [client 45.85.147.218:57576] [client 45.85.147.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aeuQAuFXXkLeyDnfk_9p-AAAAAo"]
[Sat Apr 25 01:16:12.763337 2026] [:error] [pid 14989:tid 15001] [client 43.153.96.233:50576] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeulXHhRYjsAsZTO4EOVhgAAAAo"]
[Sat Apr 25 01:50:45.785026 2026] [:error] [pid 14989:tid 15002] [client 155.248.183.67:50543] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeutdXhRYjsAsZTO4EOpnAAAAAs"]
[Sat Apr 25 01:50:47.272883 2026] [:error] [pid 42852:tid 42875] [client 155.248.183.67:50598] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeutdzMEwxhhak_EhMKglAAAAlQ"]
[Sat Apr 25 01:50:48.738667 2026] [:error] [pid 42791:tid 42805] [client 155.248.183.67:57840] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeuteLKmN9doraCEWKX2ngAAAco"]
[Sat Apr 25 01:50:48.967726 2026] [:error] [pid 42755:tid 42773] [client 155.248.183.67:59533] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeuteNH7__k0j6aa600LrQAAAJA"]
[Sat Apr 25 01:50:50.196759 2026] [:error] [pid 14989:tid 14995] [client 155.248.183.67:62769] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeutenhRYjsAsZTO4EOpuQAAAAQ"]
[Sat Apr 25 01:50:51.439694 2026] [:error] [pid 14989:tid 15007] [client 155.248.183.67:58357] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "aeute3hRYjsAsZTO4EOpwwAAABA"]
[Sat Apr 25 01:50:51.669762 2026] [:error] [pid 42792:tid 42824] [client 155.248.183.67:62834] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeute9Ni9qR4GtafpfHjNwAAAgI"]
[Sat Apr 25 01:50:52.898209 2026] [:error] [pid 42791:tid 42803] [client 155.248.183.67:56380] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutfLKmN9doraCEWKX2owAAAcg"]
[Sat Apr 25 01:50:54.126901 2026] [:error] [pid 14989:tid 15014] [client 155.248.183.67:63950] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutfnhRYjsAsZTO4EOp1QAAABc"]
[Sat Apr 25 01:50:54.354986 2026] [:error] [pid 42852:tid 42864] [client 155.248.183.67:54583] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutfjMEwxhhak_EhMKgsQAAAkk"]
[Sat Apr 25 01:50:55.583295 2026] [:error] [pid 42755:tid 42768] [client 155.248.183.67:51539] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutf9H7__k0j6aa600LsQAAAIs"]
[Sat Apr 25 01:50:56.811608 2026] [:error] [pid 42791:tid 42818] [client 155.248.183.67:54732] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutgLKmN9doraCEWKX2pwAAAdc"]
[Sat Apr 25 02:03:25.796165 2026] [:error] [pid 42852:tid 42870] [client 221.229.106.25:55568] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aeuwbTMEwxhhak_EhMKm2wAAAk8"]
[Sat Apr 25 02:03:46.353079 2026] [proxy_fcgi:error] [pid 42852:tid 42870] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:46.595846 2026] [proxy_fcgi:error] [pid 42852:tid 42855] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:46.866786 2026] [proxy_fcgi:error] [pid 42852:tid 42879] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:47.106880 2026] [proxy_fcgi:error] [pid 42852:tid 42858] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:47.346986 2026] [proxy_fcgi:error] [pid 42852:tid 42868] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:47.592527 2026] [proxy_fcgi:error] [pid 42852:tid 42878] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:47.859994 2026] [proxy_fcgi:error] [pid 42852:tid 42874] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:48.103917 2026] [proxy_fcgi:error] [pid 42852:tid 42866] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:48.345874 2026] [proxy_fcgi:error] [pid 42852:tid 42856] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:48.597884 2026] [proxy_fcgi:error] [pid 42852:tid 42871] [client 20.250.14.166:37128] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:03:48.844961 2026] [:error] [pid 42852:tid 42867] [client 20.250.14.166:37128] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pinfo.php"] [unique_id "aeuwhDMEwxhhak_EhMKnEAAAAkw"]
[Sat Apr 25 02:03:49.321175 2026] [:error] [pid 14989:tid 15011] [client 20.250.14.166:44912] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pinfo.php"] [unique_id "aeuwhXhRYjsAsZTO4EOxaQAAABQ"]
[Sat Apr 25 02:03:49.835102 2026] [:error] [pid 42755:tid 42762] [client 20.250.14.166:41037] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pinfo.php"] [unique_id "aeuwhdH7__k0j6aa600O7wAAAIU"]
[Sat Apr 25 02:03:50.322182 2026] [:error] [pid 42852:tid 42857] [client 20.250.14.166:46094] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pinfo.php"] [unique_id "aeuwhjMEwxhhak_EhMKnEwAAAkI"]
[Sat Apr 25 02:03:50.794650 2026] [:error] [pid 14989:tid 14998] [client 20.250.14.166:37133] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/litespeed.php"] [unique_id "aeuwhnhRYjsAsZTO4EOxbgAAAAc"]
[Sat Apr 25 02:03:51.311025 2026] [:error] [pid 14989:tid 14995] [client 20.250.14.166:37170] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/litespeed.php"] [unique_id "aeuwh3hRYjsAsZTO4EOxcQAAAAQ"]
[Sat Apr 25 02:03:51.797714 2026] [:error] [pid 14989:tid 15003] [client 20.250.14.166:38868] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/litespeed.php"] [unique_id "aeuwh3hRYjsAsZTO4EOxdAAAAAw"]
[Sat Apr 25 02:03:52.283066 2026] [:error] [pid 14989:tid 14991] [client 20.250.14.166:44897] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/litespeed.php"] [unique_id "aeuwiHhRYjsAsZTO4EOxdgAAAAA"]
[Sat Apr 25 02:03:52.786482 2026] [:error] [pid 42852:tid 42877] [client 20.250.14.166:41061] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environments.php"] [unique_id "aeuwiDMEwxhhak_EhMKnFAAAAlY"]
[Sat Apr 25 02:03:53.292878 2026] [:error] [pid 42791:tid 42817] [client 20.250.14.166:2965] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environments.php"] [unique_id "aeuwibKmN9doraCEWKX6WgAAAdY"]
[Sat Apr 25 02:03:53.766731 2026] [:error] [pid 42852:tid 42863] [client 20.250.14.166:44936] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environments.php"] [unique_id "aeuwiTMEwxhhak_EhMKnFgAAAkg"]
[Sat Apr 25 02:03:54.278619 2026] [:error] [pid 42852:tid 42879] [client 20.250.14.166:37178] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environments.php"] [unique_id "aeuwijMEwxhhak_EhMKnFwAAAlg"]
[Sat Apr 25 02:03:54.772739 2026] [:error] [pid 42791:tid 42795] [client 20.250.14.166:46140] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/raf.php"] [unique_id "aeuwirKmN9doraCEWKX6XQAAAcA"]
[Sat Apr 25 02:03:55.267125 2026] [:error] [pid 42755:tid 42770] [client 20.250.14.166:38890] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/raf.php"] [unique_id "aeuwi9H7__k0j6aa600O8AAAAI0"]
[Sat Apr 25 02:03:55.753064 2026] [:error] [pid 14989:tid 14992] [client 20.250.14.166:44475] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/raf.php"] [unique_id "aeuwi3hRYjsAsZTO4EOxfQAAAAE"]
[Sat Apr 25 02:03:56.231843 2026] [:error] [pid 42852:tid 42873] [client 20.250.14.166:41086] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/raf.php"] [unique_id "aeuwjDMEwxhhak_EhMKnHQAAAlI"]
[Sat Apr 25 02:03:56.741253 2026] [:error] [pid 14989:tid 15012] [client 20.250.14.166:37155] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeuwjHhRYjsAsZTO4EOxgAAAABU"]
[Sat Apr 25 02:03:57.316888 2026] [:error] [pid 14989:tid 15010] [client 20.250.14.166:44967] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeuwjXhRYjsAsZTO4EOxgQAAABM"]
[Sat Apr 25 02:03:57.835626 2026] [:error] [pid 14989:tid 14991] [client 20.250.14.166:41066] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeuwjXhRYjsAsZTO4EOxgwAAAAA"]
[Sat Apr 25 02:03:58.307794 2026] [:error] [pid 42792:tid 42839] [client 20.250.14.166:41724] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "aeuwjtNi9qR4GtafpfHnhQAAAhE"]
[Sat Apr 25 02:03:58.892835 2026] [:error] [pid 14989:tid 14993] [client 20.250.14.166:37170] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/infos.php"] [unique_id "aeuwjnhRYjsAsZTO4EOxiAAAAAI"]
[Sat Apr 25 02:03:59.371860 2026] [:error] [pid 42791:tid 42816] [client 20.250.14.166:41084] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/infos.php"] [unique_id "aeuwj7KmN9doraCEWKX6ZQAAAdU"]
[Sat Apr 25 02:03:59.876534 2026] [:error] [pid 42755:tid 42763] [client 20.250.14.166:2558] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/infos.php"] [unique_id "aeuwj9H7__k0j6aa600O8QAAAIY"]
[Sat Apr 25 02:04:00.367634 2026] [:error] [pid 42791:tid 42809] [client 20.250.14.166:44969] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/infos.php"] [unique_id "aeuwkLKmN9doraCEWKX6ZwAAAc4"]
[Sat Apr 25 02:04:00.845874 2026] [:error] [pid 42792:tid 42842] [client 20.250.14.166:44889] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aws.php"] [unique_id "aeuwkNNi9qR4GtafpfHniAAAAhQ"]
[Sat Apr 25 02:04:01.394068 2026] [:error] [pid 14989:tid 15002] [client 20.250.14.166:47433] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aws.php"] [unique_id "aeuwkXhRYjsAsZTO4EOxjAAAAAs"]
[Sat Apr 25 02:04:01.880438 2026] [:error] [pid 14989:tid 14994] [client 20.250.14.166:44893] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aws.php"] [unique_id "aeuwkXhRYjsAsZTO4EOxjwAAAAM"]
[Sat Apr 25 02:04:02.355556 2026] [:error] [pid 42792:tid 42843] [client 20.250.14.166:2546] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aws.php"] [unique_id "aeuwktNi9qR4GtafpfHnjQAAAhU"]
[Sat Apr 25 02:04:02.836427 2026] [:error] [pid 42792:tid 42840] [client 20.250.14.166:44960] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/embed.php"] [unique_id "aeuwktNi9qR4GtafpfHnjwAAAhI"]
[Sat Apr 25 02:04:03.321433 2026] [:error] [pid 42755:tid 42757] [client 20.250.14.166:44921] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/embed.php"] [unique_id "aeuwk9H7__k0j6aa600O9AAAAIA"]
[Sat Apr 25 02:04:03.912317 2026] [:error] [pid 14989:tid 14996] [client 20.250.14.166:38876] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/embed.php"] [unique_id "aeuwk3hRYjsAsZTO4EOxlAAAAAU"]
[Sat Apr 25 02:04:04.415998 2026] [:error] [pid 14989:tid 15009] [client 20.250.14.166:2537] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/embed.php"] [unique_id "aeuwlHhRYjsAsZTO4EOxlQAAABI"]
[Sat Apr 25 02:04:04.957787 2026] [:error] [pid 14989:tid 14994] [client 20.250.14.166:2955] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/stat.php"] [unique_id "aeuwlHhRYjsAsZTO4EOxmQAAAAM"]
[Sat Apr 25 02:04:05.429319 2026] [:error] [pid 14989:tid 15011] [client 20.250.14.166:2966] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/stat.php"] [unique_id "aeuwlXhRYjsAsZTO4EOxmgAAABQ"]
[Sat Apr 25 02:04:05.904742 2026] [:error] [pid 14989:tid 15000] [client 20.250.14.166:44470] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/stat.php"] [unique_id "aeuwlXhRYjsAsZTO4EOxngAAAAk"]
[Sat Apr 25 02:04:06.382327 2026] [:error] [pid 42852:tid 42858] [client 20.250.14.166:46114] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/stat.php"] [unique_id "aeuwljMEwxhhak_EhMKnNQAAAkM"]
[Sat Apr 25 02:04:06.863920 2026] [:error] [pid 14989:tid 15013] [client 20.250.14.166:37150] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/setup.php"] [unique_id "aeuwlnhRYjsAsZTO4EOxoQAAABY"]
[Sat Apr 25 02:04:07.337032 2026] [:error] [pid 42852:tid 42865] [client 20.250.14.166:2970] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/setup.php"] [unique_id "aeuwlzMEwxhhak_EhMKnOwAAAko"]
[Sat Apr 25 02:04:07.812748 2026] [:error] [pid 42852:tid 42857] [client 20.250.14.166:37160] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/setup.php"] [unique_id "aeuwlzMEwxhhak_EhMKnPAAAAkI"]
[Sat Apr 25 02:04:08.307398 2026] [:error] [pid 14989:tid 15005] [client 20.250.14.166:47429] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/setup.php"] [unique_id "aeuwmHhRYjsAsZTO4EOxqAAAAA4"]
[Sat Apr 25 02:04:08.800728 2026] [:error] [pid 42791:tid 42810] [client 20.250.14.166:3004] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/development.php"] [unique_id "aeuwmLKmN9doraCEWKX6agAAAc8"]
[Sat Apr 25 02:04:09.273700 2026] [:error] [pid 42852:tid 42868] [client 20.250.14.166:2581] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/development.php"] [unique_id "aeuwmTMEwxhhak_EhMKnRAAAAk0"]
[Sat Apr 25 02:04:09.745283 2026] [:error] [pid 14989:tid 14993] [client 20.250.14.166:44950] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/development.php"] [unique_id "aeuwmXhRYjsAsZTO4EOxrAAAAAI"]
[Sat Apr 25 02:04:10.219545 2026] [:error] [pid 14989:tid 14998] [client 20.250.14.166:44929] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/development.php"] [unique_id "aeuwmnhRYjsAsZTO4EOxrQAAAAc"]
[Sat Apr 25 02:04:10.692166 2026] [:error] [pid 14989:tid 15002] [client 20.250.14.166:46125] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environment.php"] [unique_id "aeuwmnhRYjsAsZTO4EOxsQAAAAs"]
[Sat Apr 25 02:04:11.169671 2026] [:error] [pid 42852:tid 42856] [client 20.250.14.166:44466] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environment.php"] [unique_id "aeuwmzMEwxhhak_EhMKnSgAAAkE"]
[Sat Apr 25 02:04:11.645940 2026] [:error] [pid 42852:tid 42860] [client 20.250.14.166:44443] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environment.php"] [unique_id "aeuwmzMEwxhhak_EhMKnTQAAAkU"]
[Sat Apr 25 02:04:12.120450 2026] [:error] [pid 14989:tid 15014] [client 20.250.14.166:41064] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/environment.php"] [unique_id "aeuwnHhRYjsAsZTO4EOxuAAAABc"]
[Sat Apr 25 02:04:12.593457 2026] [:error] [pid 42791:tid 42811] [client 20.250.14.166:2506] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db_config.php"] [unique_id "aeuwnLKmN9doraCEWKX6awAAAdA"]
[Sat Apr 25 02:04:13.064983 2026] [:error] [pid 42791:tid 42816] [client 20.250.14.166:44988] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db_config.php"] [unique_id "aeuwnbKmN9doraCEWKX6bgAAAdU"]
[Sat Apr 25 02:04:13.539659 2026] [:error] [pid 42852:tid 42877] [client 20.250.14.166:44448] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db_config.php"] [unique_id "aeuwnTMEwxhhak_EhMKnTgAAAlY"]
[Sat Apr 25 02:04:14.015729 2026] [:error] [pid 42792:tid 42843] [client 20.250.14.166:2529] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db_config.php"] [unique_id "aeuwntNi9qR4GtafpfHnpQAAAhU"]
[Sat Apr 25 02:04:14.491130 2026] [:error] [pid 42852:tid 42855] [client 20.250.14.166:44944] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Get_Site_Info.php"] [unique_id "aeuwnjMEwxhhak_EhMKnVQAAAkA"]
[Sat Apr 25 02:04:14.983750 2026] [:error] [pid 42792:tid 42841] [client 20.250.14.166:46116] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Get_Site_Info.php"] [unique_id "aeuwntNi9qR4GtafpfHnpgAAAhM"]
[Sat Apr 25 02:04:15.460066 2026] [:error] [pid 42755:tid 42760] [client 20.250.14.166:38881] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Get_Site_Info.php"] [unique_id "aeuwn9H7__k0j6aa600O-wAAAIM"]
[Sat Apr 25 02:04:15.931061 2026] [:error] [pid 42792:tid 42826] [client 20.250.14.166:2497] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Get_Site_Info.php"] [unique_id "aeuwn9Ni9qR4GtafpfHnqgAAAgQ"]
[Sat Apr 25 02:04:16.425664 2026] [:error] [pid 42755:tid 42757] [client 20.250.14.166:37126] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/deploy.php"] [unique_id "aeuwoNH7__k0j6aa600PAQAAAIA"]
[Sat Apr 25 02:04:16.905439 2026] [:error] [pid 42755:tid 42774] [client 20.250.14.166:47461] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/deploy.php"] [unique_id "aeuwoNH7__k0j6aa600PAwAAAJE"]
[Sat Apr 25 02:04:17.387086 2026] [:error] [pid 42755:tid 42759] [client 20.250.14.166:2619] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/deploy.php"] [unique_id "aeuwodH7__k0j6aa600PBQAAAII"]
[Sat Apr 25 02:04:17.858749 2026] [:error] [pid 42755:tid 42781] [client 20.250.14.166:38902] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/deploy.php"] [unique_id "aeuwodH7__k0j6aa600PBgAAAJg"]
[Sat Apr 25 02:04:18.341327 2026] [:error] [pid 42792:tid 42839] [client 20.250.14.166:2505] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apis.php"] [unique_id "aeuwotNi9qR4GtafpfHnrwAAAhE"]
[Sat Apr 25 02:04:18.813904 2026] [:error] [pid 42792:tid 42844] [client 20.250.14.166:46108] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apis.php"] [unique_id "aeuwotNi9qR4GtafpfHnsQAAAhY"]
[Sat Apr 25 02:04:19.291233 2026] [:error] [pid 42792:tid 42842] [client 20.250.14.166:2620] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apis.php"] [unique_id "aeuwo9Ni9qR4GtafpfHnswAAAhQ"]
[Sat Apr 25 02:04:19.763626 2026] [:error] [pid 42852:tid 42863] [client 20.250.14.166:2498] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apis.php"] [unique_id "aeuwozMEwxhhak_EhMKnWgAAAkg"]
[Sat Apr 25 02:04:20.237189 2026] [:error] [pid 42792:tid 42845] [client 20.250.14.166:46138] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asdf.php"] [unique_id "aeuwpNNi9qR4GtafpfHntQAAAhc"]
[Sat Apr 25 02:04:20.740592 2026] [:error] [pid 42792:tid 42823] [client 20.250.14.166:44419] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asdf.php"] [unique_id "aeuwpNNi9qR4GtafpfHntgAAAgE"]
[Sat Apr 25 02:04:21.244119 2026] [:error] [pid 42755:tid 42763] [client 20.250.14.166:44888] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asdf.php"] [unique_id "aeuwpdH7__k0j6aa600PDgAAAIY"]
[Sat Apr 25 02:04:21.747639 2026] [:error] [pid 42755:tid 42778] [client 20.250.14.166:46128] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asdf.php"] [unique_id "aeuwpdH7__k0j6aa600PEAAAAJU"]
[Sat Apr 25 02:04:22.221466 2026] [:error] [pid 42755:tid 42757] [client 20.250.14.166:37804] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1100.php"] [unique_id "aeuwptH7__k0j6aa600PEQAAAIA"]
[Sat Apr 25 02:04:22.697674 2026] [:error] [pid 14989:tid 15003] [client 20.250.14.166:2578] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1100.php"] [unique_id "aeuwpnhRYjsAsZTO4EOxzQAAAAw"]
[Sat Apr 25 02:04:23.175327 2026] [:error] [pid 14989:tid 15015] [client 20.250.14.166:44871] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1100.php"] [unique_id "aeuwp3hRYjsAsZTO4EOx0AAAABg"]
[Sat Apr 25 02:04:23.650421 2026] [:error] [pid 14989:tid 15002] [client 20.250.14.166:2551] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1100.php"] [unique_id "aeuwp3hRYjsAsZTO4EOx0wAAAAs"]
[Sat Apr 25 02:04:24.127557 2026] [:error] [pid 14989:tid 15013] [client 20.250.14.166:38863] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/._info.php"] [unique_id "aeuwqHhRYjsAsZTO4EOx1wAAABY"]
[Sat Apr 25 02:04:24.601060 2026] [:error] [pid 14989:tid 15009] [client 20.250.14.166:2993] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/._info.php"] [unique_id "aeuwqHhRYjsAsZTO4EOx2AAAABI"]
[Sat Apr 25 02:04:25.079177 2026] [:error] [pid 42792:tid 42844] [client 20.250.14.166:44880] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/._info.php"] [unique_id "aeuwqdNi9qR4GtafpfHnwAAAAhY"]
[Sat Apr 25 02:04:25.555159 2026] [:error] [pid 42792:tid 42843] [client 20.250.14.166:44979] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/._info.php"] [unique_id "aeuwqdNi9qR4GtafpfHnwgAAAhU"]
[Sat Apr 25 02:04:26.028109 2026] [:error] [pid 42852:tid 42861] [client 20.250.14.166:44885] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_flag.php"] [unique_id "aeuwqjMEwxhhak_EhMKnYAAAAkY"]
[Sat Apr 25 02:04:26.501225 2026] [:error] [pid 14989:tid 15013] [client 20.250.14.166:41031] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_flag.php"] [unique_id "aeuwqnhRYjsAsZTO4EOx4gAAABY"]
[Sat Apr 25 02:04:26.996542 2026] [:error] [pid 42755:tid 42763] [client 20.250.14.166:3001] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_flag.php"] [unique_id "aeuwqtH7__k0j6aa600PGAAAAIY"]
[Sat Apr 25 02:04:27.475254 2026] [:error] [pid 42755:tid 42778] [client 20.250.14.166:37176] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_flag.php"] [unique_id "aeuwq9H7__k0j6aa600PGwAAAJU"]
[Sat Apr 25 02:04:27.952550 2026] [:error] [pid 42755:tid 42765] [client 20.250.14.166:2516] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_info4.php"] [unique_id "aeuwq9H7__k0j6aa600PHQAAAIg"]
[Sat Apr 25 02:04:28.456623 2026] [:error] [pid 42852:tid 42871] [client 20.250.14.166:46083] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_info4.php"] [unique_id "aeuwrDMEwxhhak_EhMKnZAAAAlA"]
[Sat Apr 25 02:04:28.928440 2026] [:error] [pid 42852:tid 42870] [client 20.250.14.166:46091] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_info4.php"] [unique_id "aeuwrDMEwxhhak_EhMKnaAAAAk8"]
[Sat Apr 25 02:04:29.405858 2026] [:error] [pid 14989:tid 15001] [client 20.250.14.166:2592] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_info4.php"] [unique_id "aeuwrXhRYjsAsZTO4EOx6gAAAAo"]
[Sat Apr 25 02:04:29.879590 2026] [:error] [pid 42791:tid 42807] [client 20.250.14.166:44447] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_phpinfo2.php"] [unique_id "aeuwrbKmN9doraCEWKX6cgAAAcw"]
[Sat Apr 25 02:04:30.359684 2026] [:error] [pid 42792:tid 42843] [client 20.250.14.166:41070] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_phpinfo2.php"] [unique_id "aeuwrtNi9qR4GtafpfHnzwAAAhU"]
[Sat Apr 25 02:04:30.831743 2026] [:error] [pid 42791:tid 42795] [client 20.250.14.166:41085] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_phpinfo2.php"] [unique_id "aeuwrrKmN9doraCEWKX6cwAAAcA"]
[Sat Apr 25 02:04:31.308766 2026] [:error] [pid 42852:tid 42873] [client 20.250.14.166:45591] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test_phpinfo2.php"] [unique_id "aeuwrzMEwxhhak_EhMKnawAAAlI"]
[Sat Apr 25 02:04:31.780222 2026] [:error] [pid 42792:tid 42833] [client 20.250.14.166:44446] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HsFPDcD.php"] [unique_id "aeuwr9Ni9qR4GtafpfHn0AAAAgs"]
[Sat Apr 25 02:04:32.253296 2026] [:error] [pid 42852:tid 42867] [client 20.250.14.166:2561] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HsFPDcD.php"] [unique_id "aeuwsDMEwxhhak_EhMKnbgAAAkw"]
[Sat Apr 25 02:04:32.765313 2026] [:error] [pid 42755:tid 42767] [client 20.250.14.166:2552] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HsFPDcD.php"] [unique_id "aeuwsNH7__k0j6aa600PIAAAAIo"]
[Sat Apr 25 02:04:33.278294 2026] [:error] [pid 42755:tid 42775] [client 20.250.14.166:44458] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/HsFPDcD.php"] [unique_id "aeuwsdH7__k0j6aa600PIgAAAJI"]
[Sat Apr 25 02:04:33.749663 2026] [:error] [pid 14989:tid 14997] [client 20.250.14.166:2539] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.inc.php"] [unique_id "aeuwsXhRYjsAsZTO4EOx-gAAAAY"]
[Sat Apr 25 02:04:34.229761 2026] [:error] [pid 42852:tid 42859] [client 20.250.14.166:46093] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.inc.php"] [unique_id "aeuwsjMEwxhhak_EhMKncgAAAkQ"]
[Sat Apr 25 02:04:34.705264 2026] [:error] [pid 14989:tid 15013] [client 20.250.14.166:41040] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.inc.php"] [unique_id "aeuwsnhRYjsAsZTO4EOx-wAAABY"]
[Sat Apr 25 02:04:35.177048 2026] [:error] [pid 42852:tid 42856] [client 20.250.14.166:47427] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/config.inc.php"] [unique_id "aeuwszMEwxhhak_EhMKndAAAAkE"]
[Sat Apr 25 02:04:35.651498 2026] [:error] [pid 42792:tid 42827] [client 20.250.14.166:46124] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpversion.php"] [unique_id "aeuws9Ni9qR4GtafpfHn0wAAAgU"]
[Sat Apr 25 02:04:36.123977 2026] [:error] [pid 42792:tid 42843] [client 20.250.14.166:45570] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpversion.php"] [unique_id "aeuwtNNi9qR4GtafpfHn1AAAAhU"]
[Sat Apr 25 02:04:36.619968 2026] [:error] [pid 42852:tid 42867] [client 20.250.14.166:41028] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpversion.php"] [unique_id "aeuwtDMEwxhhak_EhMKnegAAAkw"]
[Sat Apr 25 02:04:37.093172 2026] [:error] [pid 42755:tid 42763] [client 20.250.14.166:38900] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpversion.php"] [unique_id "aeuwtdH7__k0j6aa600PJAAAAIY"]
[Sat Apr 25 02:04:37.565094 2026] [:error] [pid 42792:tid 42846] [client 20.250.14.166:38848] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asus.php"] [unique_id "aeuwtdNi9qR4GtafpfHn1gAAAhg"]
[Sat Apr 25 02:04:38.038875 2026] [:error] [pid 42792:tid 42833] [client 20.250.14.166:47447] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asus.php"] [unique_id "aeuwttNi9qR4GtafpfHn1wAAAgs"]
[Sat Apr 25 02:04:38.542315 2026] [:error] [pid 42792:tid 42832] [client 20.250.14.166:2564] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asus.php"] [unique_id "aeuwttNi9qR4GtafpfHn2AAAAgo"]
[Sat Apr 25 02:04:39.048195 2026] [:error] [pid 42852:tid 42874] [client 20.250.14.166:2614] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asus.php"] [unique_id "aeuwtzMEwxhhak_EhMKnfwAAAlM"]
[Sat Apr 25 02:04:39.521704 2026] [:error] [pid 42792:tid 42841] [client 20.250.14.166:2603] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_version.php"] [unique_id "aeuwt9Ni9qR4GtafpfHn2QAAAhM"]
[Sat Apr 25 02:04:39.992978 2026] [:error] [pid 42755:tid 42774] [client 20.250.14.166:38856] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_version.php"] [unique_id "aeuwt9H7__k0j6aa600PJwAAAJE"]
[Sat Apr 25 02:04:40.467068 2026] [:error] [pid 42755:tid 42760] [client 20.250.14.166:37787] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_version.php"] [unique_id "aeuwuNH7__k0j6aa600PKAAAAIM"]
[Sat Apr 25 02:04:40.997839 2026] [:error] [pid 42755:tid 42781] [client 20.250.14.166:46134] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php_version.php"] [unique_id "aeuwuNH7__k0j6aa600PKQAAAJg"]
[Sat Apr 25 02:04:41.479555 2026] [:error] [pid 42852:tid 42858] [client 20.250.14.166:46087] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abouts.php"] [unique_id "aeuwuTMEwxhhak_EhMKnhAAAAkM"]
[Sat Apr 25 02:04:41.958265 2026] [:error] [pid 42792:tid 42829] [client 20.250.14.166:2978] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abouts.php"] [unique_id "aeuwudNi9qR4GtafpfHn2wAAAgc"]
[Sat Apr 25 02:04:42.434570 2026] [:error] [pid 42792:tid 42837] [client 20.250.14.166:44913] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abouts.php"] [unique_id "aeuwutNi9qR4GtafpfHn3QAAAg8"]
[Sat Apr 25 02:04:42.910511 2026] [:error] [pid 42755:tid 42767] [client 20.250.14.166:44956] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abouts.php"] [unique_id "aeuwutH7__k0j6aa600PLQAAAIo"]
[Sat Apr 25 02:04:43.401419 2026] [:error] [pid 42852:tid 42876] [client 20.250.14.166:45573] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profmanage.php"] [unique_id "aeuwuzMEwxhhak_EhMKnhwAAAlU"]
[Sat Apr 25 02:04:43.875965 2026] [:error] [pid 42755:tid 42762] [client 20.250.14.166:53577] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profmanage.php"] [unique_id "aeuwu9H7__k0j6aa600PLwAAAIU"]
[Sat Apr 25 02:04:44.358158 2026] [:error] [pid 42852:tid 42870] [client 20.250.14.166:44987] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profmanage.php"] [unique_id "aeuwvDMEwxhhak_EhMKniAAAAk8"]
[Sat Apr 25 02:04:44.831613 2026] [:error] [pid 42755:tid 42773] [client 20.250.14.166:41041] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profmanage.php"] [unique_id "aeuwvNH7__k0j6aa600PMgAAAJA"]
[Sat Apr 25 02:04:45.307030 2026] [:error] [pid 42755:tid 42777] [client 20.250.14.166:39948] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makecvs.php"] [unique_id "aeuwvdH7__k0j6aa600PNQAAAJQ"]
[Sat Apr 25 02:04:45.784279 2026] [:error] [pid 42791:tid 42798] [client 20.250.14.166:2998] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makecvs.php"] [unique_id "aeuwvbKmN9doraCEWKX6jAAAAcM"]
[Sat Apr 25 02:04:46.258181 2026] [:error] [pid 42792:tid 42827] [client 20.250.14.166:2952] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makecvs.php"] [unique_id "aeuwvtNi9qR4GtafpfHn4wAAAgU"]
[Sat Apr 25 02:04:46.746512 2026] [:error] [pid 42791:tid 42815] [client 20.250.14.166:38895] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makecvs.php"] [unique_id "aeuwvrKmN9doraCEWKX6jgAAAdQ"]
[Sat Apr 25 02:04:47.219820 2026] [:error] [pid 42852:tid 42861] [client 20.250.14.166:2572] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpreleaseinfo.php"] [unique_id "aeuwvzMEwxhhak_EhMKniQAAAkY"]
[Sat Apr 25 02:04:47.723589 2026] [:error] [pid 14989:tid 15001] [client 20.250.14.166:44455] [client 20.250.14.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpreleaseinfo.php"] [unique_id "aeuwv3hRYjsAsZTO4EOyDAAAAAo"]
[Sat Apr 25 02:04:48.236028 2026] [proxy_fcgi:error] [pid 14989:tid 15014] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:04:48.474890 2026] [proxy_fcgi:error] [pid 14989:tid 15007] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:04:48.713797 2026] [proxy_fcgi:error] [pid 14989:tid 14995] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:04:48.952278 2026] [proxy_fcgi:error] [pid 14989:tid 14999] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:04:49.194442 2026] [proxy_fcgi:error] [pid 14989:tid 15012] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 02:04:49.436103 2026] [proxy_fcgi:error] [pid 14989:tid 15010] [client 20.250.14.166:44426] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 04:52:49.030988 2026] [:error] [pid 46083:tid 46105] [client 51.75.119.75:54304] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "aevYITxw_Zq74vWdjmkIMwAAARI"]
[Sat Apr 25 04:52:51.469312 2026] [:error] [pid 44321:tid 44405] [client 51.75.119.75:51892] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aevYI41b5lV-asWa_Y4UDwAAAJY"]
[Sat Apr 25 04:52:53.823029 2026] [:error] [pid 44321:tid 44394] [client 51.75.119.75:51900] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aevYJY1b5lV-asWa_Y4UEgAAAIs"]
[Sat Apr 25 04:52:56.263370 2026] [:error] [pid 46083:tid 46111] [client 51.75.119.75:34400] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aevYKDxw_Zq74vWdjmkITQAAARc"]
[Sat Apr 25 04:52:58.533668 2026] [:error] [pid 44425:tid 44446] [client 51.75.119.75:34412] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aevYKiUl-VlItvY2tR_nCwAAANM"]
[Sat Apr 25 04:53:01.091309 2026] [:error] [pid 44321:tid 44400] [client 51.75.119.75:34420] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aevYLY1b5lV-asWa_Y4UJgAAAJE"]
[Sat Apr 25 04:53:03.535110 2026] [:error] [pid 44425:tid 44449] [client 51.75.119.75:34434] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aevYLyUl-VlItvY2tR_nGAAAANY"]
[Sat Apr 25 04:53:05.934393 2026] [:error] [pid 44320:tid 44380] [client 51.75.119.75:42154] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aevYMTmFqSpku_dij8hjHgAAAFg"]
[Sat Apr 25 04:53:08.511608 2026] [:error] [pid 44319:tid 44346] [client 51.75.119.75:42168] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aevYNMzJPAVLUb2pWtJB_wAAABE"]
[Sat Apr 25 04:53:10.992977 2026] [:error] [pid 44319:tid 44348] [client 51.75.119.75:42182] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aevYNszJPAVLUb2pWtJCCwAAABM"]
[Sat Apr 25 04:53:13.335637 2026] [:error] [pid 44425:tid 44442] [client 51.75.119.75:42188] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aevYOSUl-VlItvY2tR_nLwAAAM8"]
[Sat Apr 25 04:53:15.873985 2026] [:error] [pid 46083:tid 46091] [client 51.75.119.75:51144] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aevYOzxw_Zq74vWdjmkIdAAAAQQ"]
[Sat Apr 25 04:53:18.413008 2026] [:error] [pid 44321:tid 44400] [client 51.75.119.75:51154] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aevYPo1b5lV-asWa_Y4UPAAAAJE"]
[Sat Apr 25 04:53:20.910091 2026] [:error] [pid 46083:tid 46107] [client 51.75.119.75:51158] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aevYQDxw_Zq74vWdjmkIhwAAARM"]
[Sat Apr 25 04:53:23.397700 2026] [:error] [pid 44425:tid 44430] [client 51.75.119.75:51160] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aevYQyUl-VlItvY2tR_nUgAAAMM"]
[Sat Apr 25 04:53:25.926543 2026] [:error] [pid 44425:tid 44448] [client 51.75.119.75:56922] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "aevYRSUl-VlItvY2tR_nZQAAANU"]
[Sat Apr 25 04:53:28.397935 2026] [:error] [pid 44319:tid 44337] [client 51.75.119.75:56936] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aevYSMzJPAVLUb2pWtJCSgAAAAg"]
[Sat Apr 25 04:53:30.703139 2026] [:error] [pid 46083:tid 46095] [client 51.75.119.75:56938] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aevYSjxw_Zq74vWdjmkIuAAAAQg"]
[Sat Apr 25 04:53:33.277998 2026] [:error] [pid 46083:tid 46107] [client 51.75.119.75:56954] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aevYTTxw_Zq74vWdjmkIyAAAARM"]
[Sat Apr 25 04:53:36.082312 2026] [:error] [pid 46083:tid 46107] [client 51.75.119.75:57542] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aevYUDxw_Zq74vWdjmkI3gAAARM"]
[Sat Apr 25 04:53:39.905924 2026] [:error] [pid 44425:tid 44436] [client 51.75.119.75:57556] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aevYUyUl-VlItvY2tR_njQAAAMk"]
[Sat Apr 25 06:14:09.162354 2026] [:error] [pid 44319:tid 44334] [client 51.75.119.168:59740] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "aevrMczJPAVLUb2pWtJRhAAAAAU"]
[Sat Apr 25 06:14:11.193432 2026] [:error] [pid 46083:tid 46100] [client 51.75.119.168:51810] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aevrMzxw_Zq74vWdjmkwgwAAAQ0"]
[Sat Apr 25 06:14:12.981982 2026] [:error] [pid 46083:tid 46093] [client 51.75.119.168:51820] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aevrNDxw_Zq74vWdjmkwiwAAAQY"]
[Sat Apr 25 06:14:14.797341 2026] [:error] [pid 44320:tid 44368] [client 51.75.119.168:51834] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aevrNjmFqSpku_dij8hziQAAAEw"]
[Sat Apr 25 06:14:16.711659 2026] [:error] [pid 46083:tid 46110] [client 51.75.119.168:51848] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aevrODxw_Zq74vWdjmkwkgAAARY"]
[Sat Apr 25 06:14:18.657189 2026] [:error] [pid 44319:tid 44333] [client 51.75.119.168:49364] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aevrOszJPAVLUb2pWtJRjQAAAAQ"]
[Sat Apr 25 06:14:20.692484 2026] [:error] [pid 44319:tid 44338] [client 51.75.119.168:49372] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aevrPMzJPAVLUb2pWtJRmAAAAAk"]
[Sat Apr 25 06:14:22.579362 2026] [:error] [pid 44321:tid 44406] [client 51.75.119.168:49376] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aevrPo1b5lV-asWa_Y4o_wAAAJc"]
[Sat Apr 25 06:14:24.512342 2026] [:error] [pid 44321:tid 44402] [client 51.75.119.168:49386] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aevrQI1b5lV-asWa_Y4pBQAAAJM"]
[Sat Apr 25 06:14:26.412217 2026] [:error] [pid 44321:tid 44401] [client 51.75.119.168:49400] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aevrQo1b5lV-asWa_Y4pBgAAAJI"]
[Sat Apr 25 06:14:28.331649 2026] [:error] [pid 44321:tid 44406] [client 51.75.119.168:51106] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aevrRI1b5lV-asWa_Y4pCQAAAJc"]
[Sat Apr 25 06:14:30.212390 2026] [:error] [pid 46083:tid 46103] [client 51.75.119.168:51116] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aevrRjxw_Zq74vWdjmkwpwAAARA"]
[Sat Apr 25 06:14:32.139806 2026] [:error] [pid 44321:tid 44391] [client 51.75.119.168:51122] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aevrSI1b5lV-asWa_Y4pDgAAAIg"]
[Sat Apr 25 06:14:33.937954 2026] [:error] [pid 44425:tid 44427] [client 51.75.119.168:51126] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aevrSSUl-VlItvY2tR8G9wAAAMA"]
[Sat Apr 25 06:14:35.870999 2026] [:error] [pid 46083:tid 46110] [client 51.75.119.168:51130] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aevrSzxw_Zq74vWdjmkwtAAAARY"]
[Sat Apr 25 06:14:38.211895 2026] [:error] [pid 46083:tid 46099] [client 51.75.119.168:42706] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aevrTjxw_Zq74vWdjmkwvQAAAQw"]
[Sat Apr 25 06:14:40.274282 2026] [:error] [pid 46083:tid 46089] [client 51.75.119.168:38208] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aevrUDxw_Zq74vWdjmkwwwAAAQI"]
[Sat Apr 25 06:14:42.204853 2026] [:error] [pid 46083:tid 46095] [client 51.75.119.168:38216] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aevrUjxw_Zq74vWdjmkwzQAAAQg"]
[Sat Apr 25 06:14:43.969800 2026] [:error] [pid 46083:tid 46092] [client 51.75.119.168:38224] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aevrUzxw_Zq74vWdjmkw0QAAAQU"]
[Sat Apr 25 06:14:45.871163 2026] [:error] [pid 44319:tid 44336] [client 51.75.119.168:38226] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aevrVczJPAVLUb2pWtJRsAAAAAc"]
[Sat Apr 25 06:14:47.810879 2026] [:error] [pid 46083:tid 46098] [client 51.75.119.168:37296] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aevrVzxw_Zq74vWdjmkw2wAAAQs"]
[Sat Apr 25 06:14:49.713045 2026] [:error] [pid 44321:tid 44404] [client 51.75.119.168:37298] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aevrWY1b5lV-asWa_Y4pHgAAAJU"]
[Sat Apr 25 06:14:51.645567 2026] [:error] [pid 44321:tid 44390] [client 51.75.119.168:37312] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aevrW41b5lV-asWa_Y4pKQAAAIc"]
[Sat Apr 25 06:14:53.511040 2026] [:error] [pid 44425:tid 44435] [client 51.75.119.168:37322] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aevrXSUl-VlItvY2tR8HBAAAAMg"]
[Sat Apr 25 06:14:55.529299 2026] [:error] [pid 44319:tid 44330] [client 51.75.119.168:37326] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aevrX8zJPAVLUb2pWtJRuQAAAAE"]
[Sat Apr 25 06:14:57.549100 2026] [:error] [pid 44425:tid 44427] [client 51.75.119.168:37334] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aevrYSUl-VlItvY2tR8HFAAAAMA"]
[Sat Apr 25 06:14:59.572678 2026] [:error] [pid 44425:tid 44430] [client 51.75.119.168:57404] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aevrYyUl-VlItvY2tR8HGAAAAMM"]
[Sat Apr 25 06:15:01.578238 2026] [:error] [pid 44425:tid 44429] [client 51.75.119.168:57418] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aevrZSUl-VlItvY2tR8HHwAAAMI"]
[Sat Apr 25 06:15:03.434885 2026] [:error] [pid 44425:tid 44438] [client 51.75.119.168:57432] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aevrZyUl-VlItvY2tR8HIgAAAMs"]
[Sat Apr 25 06:15:05.162871 2026] [:error] [pid 46083:tid 46112] [client 51.75.119.168:57434] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aevraTxw_Zq74vWdjmkw5QAAARg"]
[Sat Apr 25 06:15:27.098784 2026] [:error] [pid 44425:tid 44451] [client 51.75.119.168:36152] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/168%20slot.aspx"] [unique_id "aevrfyUl-VlItvY2tR8HQQAAANg"]
[Sat Apr 25 06:15:29.078313 2026] [:error] [pid 46083:tid 46102] [client 51.75.119.168:47426] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/24th%20slot.aspx"] [unique_id "aevrgTxw_Zq74vWdjmkxHgAAAQ8"]
[Sat Apr 25 06:15:31.091130 2026] [:error] [pid 46083:tid 46105] [client 51.75.119.168:47432] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aevrgzxw_Zq74vWdjmkxJgAAARI"]
[Sat Apr 25 06:15:33.113938 2026] [:error] [pid 44425:tid 44446] [client 51.75.119.168:47448] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aevrhSUl-VlItvY2tR8HRgAAANM"]
[Sat Apr 25 06:15:35.166699 2026] [:error] [pid 46083:tid 46111] [client 51.75.119.168:47462] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aevrhzxw_Zq74vWdjmkxMwAAARc"]
[Sat Apr 25 06:15:37.203707 2026] [:error] [pid 44320:tid 44371] [client 51.75.119.168:47464] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aevriTmFqSpku_dij8hz1QAAAE8"]
[Sat Apr 25 06:15:39.208039 2026] [:error] [pid 46083:tid 46109] [client 51.75.119.168:35664] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aevrizxw_Zq74vWdjmkxQgAAARU"]
[Sat Apr 25 06:15:41.204147 2026] [:error] [pid 44425:tid 44441] [client 51.75.119.168:35672] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aevrjSUl-VlItvY2tR8HSgAAAM4"]
[Sat Apr 25 06:15:43.204829 2026] [:error] [pid 44319:tid 44351] [client 51.75.119.168:35684] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aevrj8zJPAVLUb2pWtJR5wAAABY"]
[Sat Apr 25 06:15:45.210742 2026] [:error] [pid 44320:tid 44369] [client 51.75.119.168:35694] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aevrkTmFqSpku_dij8hz7gAAAE0"]
[Sat Apr 25 06:15:47.211692 2026] [:error] [pid 44425:tid 44438] [client 51.75.119.168:35702] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aevrkyUl-VlItvY2tR8HWAAAAMs"]
[Sat Apr 25 06:15:49.213874 2026] [:error] [pid 44321:tid 44396] [client 51.75.119.168:34534] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aevrlY1b5lV-asWa_Y4pVgAAAI0"]
[Sat Apr 25 06:15:51.202701 2026] [:error] [pid 44425:tid 44441] [client 51.75.119.168:34546] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aevrlyUl-VlItvY2tR8HYgAAAM4"]
[Sat Apr 25 06:15:53.193090 2026] [:error] [pid 44320:tid 44378] [client 51.75.119.168:34554] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aevrmTmFqSpku_dij8h0AAAAAFY"]
[Sat Apr 25 06:15:55.188245 2026] [:error] [pid 46083:tid 46112] [client 51.75.119.168:34558] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aevrmzxw_Zq74vWdjmkxUAAAARg"]
[Sat Apr 25 06:15:57.182500 2026] [:error] [pid 46083:tid 46109] [client 51.75.119.168:34562] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aevrnTxw_Zq74vWdjmkxWgAAARU"]
[Sat Apr 25 06:15:59.021830 2026] [:error] [pid 44319:tid 44345] [client 51.75.119.168:42878] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aevrn8zJPAVLUb2pWtJSBQAAABA"]
[Sat Apr 25 06:16:01.012932 2026] [:error] [pid 46083:tid 46104] [client 51.75.119.168:42884] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aevroTxw_Zq74vWdjmkxZAAAARE"]
[Sat Apr 25 06:16:03.009741 2026] [:error] [pid 46083:tid 46101] [client 51.75.119.168:42890] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aevrozxw_Zq74vWdjmkxiQAAAQ4"]
[Sat Apr 25 06:16:05.002988 2026] [:error] [pid 44425:tid 44442] [client 51.75.119.168:42902] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aevrpSUl-VlItvY2tR8HgQAAAM8"]
[Sat Apr 25 06:16:06.999579 2026] [:error] [pid 44425:tid 44444] [client 51.75.119.168:42912] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aevrpiUl-VlItvY2tR8HjAAAANE"]
[Sat Apr 25 06:16:08.992439 2026] [:error] [pid 44319:tid 44353] [client 51.75.119.168:42104] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aevrqMzJPAVLUb2pWtJSCgAAABg"]
[Sat Apr 25 06:16:10.830305 2026] [:error] [pid 44319:tid 44336] [client 51.75.119.168:42110] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aevrqszJPAVLUb2pWtJSDQAAAAc"]
[Sat Apr 25 06:16:12.821410 2026] [:error] [pid 46083:tid 46099] [client 51.75.119.168:42124] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aevrrDxw_Zq74vWdjmkxyQAAAQw"]
[Sat Apr 25 06:16:14.826139 2026] [:error] [pid 44321:tid 44392] [client 51.75.119.168:42130] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aevrro1b5lV-asWa_Y4pagAAAIk"]
[Sat Apr 25 06:16:16.830888 2026] [:error] [pid 46083:tid 46092] [client 51.75.119.168:42140] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aevrsDxw_Zq74vWdjmkx2gAAAQU"]
[Sat Apr 25 06:16:18.827495 2026] [:error] [pid 46083:tid 46108] [client 51.75.119.168:48830] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "aevrsjxw_Zq74vWdjmkx4gAAARQ"]
[Sat Apr 25 06:16:20.845550 2026] [:error] [pid 44320:tid 44378] [client 51.75.119.168:48838] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aevrtDmFqSpku_dij8h0IAAAAFY"]
[Sat Apr 25 06:16:22.845783 2026] [:error] [pid 44321:tid 44383] [client 51.75.119.168:48840] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aevrto1b5lV-asWa_Y4peQAAAIA"]
[Sat Apr 25 06:16:24.852747 2026] [:error] [pid 44425:tid 44443] [client 51.75.119.168:48854] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aevruCUl-VlItvY2tR8HmwAAANA"]
[Sat Apr 25 06:16:45.000016 2026] [:error] [pid 44425:tid 44432] [client 51.75.119.168:48856] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aevrzCUl-VlItvY2tR8H5wAAAMU"]
[Sat Apr 25 06:16:46.935797 2026] [:error] [pid 46083:tid 46108] [client 51.75.119.168:60114] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aevrzjxw_Zq74vWdjmkyIQAAARQ"]
[Sat Apr 25 06:16:48.936856 2026] [:error] [pid 44425:tid 44440] [client 51.75.119.168:55924] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aevr0CUl-VlItvY2tR8ICQAAAM0"]
[Sat Apr 25 06:16:50.927855 2026] [:error] [pid 46083:tid 46096] [client 51.75.119.168:55934] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aevr0jxw_Zq74vWdjmkyLQAAAQk"]
[Sat Apr 25 06:16:52.921279 2026] [:error] [pid 46083:tid 46095] [client 51.75.119.168:55946] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aevr1Dxw_Zq74vWdjmkyMgAAAQg"]
[Sat Apr 25 06:16:54.909411 2026] [:error] [pid 46083:tid 46087] [client 51.75.119.168:55960] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aevr1jxw_Zq74vWdjmkyPgAAAQA"]
[Sat Apr 25 06:16:56.904741 2026] [:error] [pid 44425:tid 44437] [client 51.75.119.168:55968] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aevr2CUl-VlItvY2tR8IFgAAAMo"]
[Sat Apr 25 06:16:58.891911 2026] [:error] [pid 46083:tid 46100] [client 51.75.119.168:56402] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aevr2jxw_Zq74vWdjmkySAAAAQ0"]
[Sat Apr 25 06:17:00.877048 2026] [:error] [pid 46083:tid 46109] [client 51.75.119.168:56418] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aevr3Dxw_Zq74vWdjmkySwAAARU"]
[Sat Apr 25 06:17:02.708595 2026] [:error] [pid 44425:tid 44450] [client 51.75.119.168:56430] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aevr3iUl-VlItvY2tR8IJQAAANc"]
[Sat Apr 25 06:17:04.712550 2026] [:error] [pid 46083:tid 46092] [client 51.75.119.168:56438] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aevr4Dxw_Zq74vWdjmkyWQAAAQU"]
[Sat Apr 25 06:17:06.701758 2026] [:error] [pid 44321:tid 44383] [client 51.75.119.168:56450] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aevr4o1b5lV-asWa_Y4qAAAAAIA"]
[Sat Apr 25 06:17:08.683587 2026] [:error] [pid 44319:tid 44333] [client 51.75.119.168:49036] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aevr5MzJPAVLUb2pWtJSRwAAAAQ"]
[Sat Apr 25 06:17:10.674106 2026] [:error] [pid 44321:tid 44386] [client 51.75.119.168:49052] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aevr5o1b5lV-asWa_Y4qBgAAAIM"]
[Sat Apr 25 06:17:12.506347 2026] [:error] [pid 44425:tid 44440] [client 51.75.119.168:49068] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aevr6CUl-VlItvY2tR8IMgAAAM0"]
[Sat Apr 25 06:17:14.494573 2026] [:error] [pid 44319:tid 44346] [client 51.75.119.168:49080] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aevr6szJPAVLUb2pWtJSTgAAABE"]
[Sat Apr 25 06:17:16.480106 2026] [:error] [pid 44321:tid 44403] [client 51.75.119.168:49096] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aevr7I1b5lV-asWa_Y4qDQAAAJQ"]
[Sat Apr 25 06:17:18.324563 2026] [:error] [pid 44319:tid 44343] [client 51.75.119.168:51438] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aevr7szJPAVLUb2pWtJSUwAAAA4"]
[Sat Apr 25 06:17:20.309858 2026] [:error] [pid 44425:tid 44427] [client 51.75.119.168:51454] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aevr8CUl-VlItvY2tR8IQAAAAMA"]
[Sat Apr 25 06:17:22.312970 2026] [:error] [pid 46083:tid 46097] [client 51.75.119.168:51470] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "aevr8jxw_Zq74vWdjmkyZwAAAQo"]
[Sat Apr 25 06:17:24.296890 2026] [:error] [pid 44319:tid 44340] [client 51.75.119.168:51486] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aevr9MzJPAVLUb2pWtJSYAAAAAs"]
[Sat Apr 25 06:17:26.442526 2026] [:error] [pid 44319:tid 44329] [client 51.75.119.168:51494] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aevr9szJPAVLUb2pWtJSZQAAAAA"]
[Sat Apr 25 06:17:28.431202 2026] [:error] [pid 44321:tid 44396] [client 51.75.119.168:40578] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aevr-I1b5lV-asWa_Y4qFwAAAI0"]
[Sat Apr 25 06:17:30.421751 2026] [:error] [pid 44320:tid 44365] [client 51.75.119.168:40588] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aevr-jmFqSpku_dij8h0awAAAEk"]
[Sat Apr 25 06:17:32.405089 2026] [:error] [pid 44425:tid 44430] [client 51.75.119.168:40602] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aevr_CUl-VlItvY2tR8IUgAAAMM"]
[Sat Apr 25 06:17:34.241782 2026] [:error] [pid 46083:tid 46096] [client 51.75.119.168:40604] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aevr_jxw_Zq74vWdjmkyewAAAQk"]
[Sat Apr 25 06:17:36.233722 2026] [:error] [pid 44319:tid 44329] [client 51.75.119.168:40620] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aevsAMzJPAVLUb2pWtJSbwAAAAA"]
[Sat Apr 25 06:17:38.231163 2026] [:error] [pid 44320:tid 44379] [client 51.75.119.168:56644] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aevsAjmFqSpku_dij8h0dAAAAFc"]
[Sat Apr 25 06:17:40.214365 2026] [:error] [pid 44320:tid 44378] [client 51.75.119.168:56656] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "aevsBDmFqSpku_dij8h0eAAAAFY"]
[Sat Apr 25 06:17:42.197466 2026] [:error] [pid 44320:tid 44361] [client 51.75.119.168:56662] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aevsBjmFqSpku_dij8h0fAAAAEU"]
[Sat Apr 25 08:17:00.040009 2026] [:error] [pid 44320:tid 44358] [client 122.51.236.174:45214] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aewH_DmFqSpku_dij8iJ_wAAAEI"]
[Sat Apr 25 08:50:47.544788 2026] [:error] [pid 44319:tid 44348] [client 45.131.195.99:58021] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "aewP58zJPAVLUb2pWtJrvgAAABM"]
[Sat Apr 25 10:05:02.577078 2026] [:error] [pid 44320:tid 44374] [client 147.135.214.103:51360] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aewhTjmFqSpku_dij8icqQAAAFI"]
[Sat Apr 25 10:05:04.173562 2026] [:error] [pid 44320:tid 44359] [client 147.135.214.103:38416] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aewhUDmFqSpku_dij8icqwAAAEM"]
[Sat Apr 25 10:05:06.002810 2026] [:error] [pid 44320:tid 44376] [client 147.135.214.103:55486] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aewhUjmFqSpku_dij8icrwAAAFQ"]
[Sat Apr 25 10:05:07.974029 2026] [:error] [pid 44425:tid 44446] [client 147.135.214.103:55488] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aewhUyUl-VlItvY2tR9RLAAAANM"]
[Sat Apr 25 10:05:10.523399 2026] [:error] [pid 44425:tid 44429] [client 147.135.214.103:47384] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aewhViUl-VlItvY2tR9RMAAAAMI"]
[Sat Apr 25 10:05:12.415115 2026] [:error] [pid 44320:tid 44363] [client 147.135.214.103:55490] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aewhWDmFqSpku_dij8icuQAAAEc"]
[Sat Apr 25 10:05:14.467020 2026] [:error] [pid 46083:tid 46096] [client 147.135.214.103:45602] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aewhWjxw_Zq74vWdjmmXgAAAAQk"]
[Sat Apr 25 10:05:16.845830 2026] [:error] [pid 44425:tid 44433] [client 147.135.214.103:46092] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "aewhXCUl-VlItvY2tR9RNAAAAMY"]
[Sat Apr 25 10:05:18.731721 2026] [:error] [pid 44320:tid 44372] [client 147.135.214.103:45616] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aewhXjmFqSpku_dij8iczAAAAFA"]
[Sat Apr 25 10:05:21.260607 2026] [:error] [pid 46083:tid 46105] [client 147.135.214.103:46106] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "aewhYTxw_Zq74vWdjmmXiAAAARI"]
[Sat Apr 25 10:05:23.273483 2026] [:error] [pid 44321:tid 44405] [client 147.135.214.103:33702] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "aewhY41b5lV-asWa_Y5d5wAAAJY"]
[Sat Apr 25 10:05:25.145839 2026] [:error] [pid 44321:tid 44385] [client 147.135.214.103:33716] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aewhZY1b5lV-asWa_Y5d6gAAAII"]
[Sat Apr 25 10:05:27.163594 2026] [:error] [pid 46083:tid 46093] [client 147.135.214.103:33732] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "aewhZzxw_Zq74vWdjmmXnQAAAQY"]
[Sat Apr 25 10:05:29.187318 2026] [:error] [pid 44321:tid 44383] [client 147.135.214.103:33742] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "aewhaY1b5lV-asWa_Y5d7wAAAIA"]
[Sat Apr 25 10:05:31.053774 2026] [:error] [pid 44425:tid 44430] [client 147.135.214.103:33752] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aewhayUl-VlItvY2tR9ROwAAAMM"]
[Sat Apr 25 10:05:33.078207 2026] [:error] [pid 44321:tid 44395] [client 147.135.214.103:33762] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "aewhbY1b5lV-asWa_Y5d9gAAAIw"]
[Sat Apr 25 10:05:36.255025 2026] [:error] [pid 46083:tid 46105] [client 147.135.214.103:40640] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aewhcDxw_Zq74vWdjmmXpwAAARI"]
[Sat Apr 25 10:05:40.075598 2026] [:error] [pid 44425:tid 44441] [client 147.135.214.103:40656] [client 147.135.214.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aewhdCUl-VlItvY2tR9RUwAAAM4"]
[Sat Apr 25 12:57:48.998250 2026] [proxy_fcgi:error] [pid 46083:tid 46111] [client 145.239.10.137:59584] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/upload.php
[Sat Apr 25 14:22:32.874501 2026] [:error] [pid 44320:tid 44366] [client 185.132.178.150:56957] [client 185.132.178.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.132.178.150, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "aexdqDmFqSpku_dij8jHeAAAAEo"]
[Sat Apr 25 14:22:33.165955 2026] [proxy_fcgi:error] [pid 44320:tid 44366] [client 185.132.178.150:56957] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 15:10:41.901782 2026] [:error] [pid 44320:tid 44366] [client 217.182.194.16:52862] [client 217.182.194.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aexo8TmFqSpku_dij8jUrQAAAEo"]
[Sat Apr 25 15:10:43.772797 2026] [:error] [pid 44425:tid 44445] [client 217.182.194.16:58724] [client 217.182.194.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aexo8yUl-VlItvY2tR-YFwAAANI"]
[Sat Apr 25 15:10:45.610611 2026] [:error] [pid 44319:tid 44339] [client 217.182.194.16:58732] [client 217.182.194.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aexo9czJPAVLUb2pWtKknQAAAAo"]
[Sat Apr 25 15:10:47.703088 2026] [:error] [pid 44425:tid 44429] [client 217.182.194.16:58746] [client 217.182.194.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aexo9yUl-VlItvY2tR-YGwAAAMI"]
[Sat Apr 25 15:10:51.478741 2026] [:error] [pid 44321:tid 44407] [client 217.182.194.16:33646] [client 217.182.194.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aexo-41b5lV-asWa_Y6vqwAAAJg"]
[Sat Apr 25 17:09:50.631006 2026] [:error] [pid 62630:tid 62693] [client 109.248.33.41:4519] [client 109.248.33.41] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=image/gif"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aeyE3nCJIizbz7HiRHS9jwAAAEs"]
[Sat Apr 25 18:18:07.244565 2026] [:error] [pid 16108:tid 16190] [client 65.108.125.120:46170] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aeyU34bPF4HSQDj6WrlWigAAANg"]
[Sat Apr 25 18:18:09.600581 2026] [:error] [pid 16107:tid 16150] [client 65.108.125.120:8980] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aeyU4dIfF7Hy3tw0sYRdiAAAAI0"]
[Sat Apr 25 18:18:12.173925 2026] [:error] [pid 16108:tid 16165] [client 65.108.125.120:8988] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aeyU5IbPF4HSQDj6WrlWogAAAME"]
[Sat Apr 25 18:18:14.561316 2026] [:error] [pid 16108:tid 16176] [client 65.108.125.120:8990] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aeyU5obPF4HSQDj6WrlWvAAAAMo"]
[Sat Apr 25 18:18:16.915450 2026] [:error] [pid 16195:tid 16221] [client 65.108.125.120:8996] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aeyU6DVPLvrpvXaNQOkDawAAABc"]
[Sat Apr 25 18:18:19.345932 2026] [:error] [pid 16108:tid 16185] [client 65.108.125.120:61678] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aeyU64bPF4HSQDj6WrlWzQAAANM"]
[Sat Apr 25 18:18:21.879670 2026] [:error] [pid 16195:tid 16201] [client 65.108.125.120:61690] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aeyU7TVPLvrpvXaNQOkDhgAAAAM"]
[Sat Apr 25 18:18:24.518214 2026] [:error] [pid 16106:tid 16121] [client 65.108.125.120:61704] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aeyU8CGjdEsrWF7e-7MVOgAAAEs"]
[Sat Apr 25 18:18:27.125389 2026] [:error] [pid 16107:tid 16160] [client 65.108.125.120:61718] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aeyU89IfF7Hy3tw0sYRdtAAAAJc"]
[Sat Apr 25 18:18:29.612438 2026] [:error] [pid 16108:tid 16176] [client 65.108.125.120:63368] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aeyU9YbPF4HSQDj6WrlXAQAAAMo"]
[Sat Apr 25 18:18:32.165601 2026] [:error] [pid 16108:tid 16184] [client 65.108.125.120:63412] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aeyU-IbPF4HSQDj6WrlXCgAAANI"]
[Sat Apr 25 18:18:34.626438 2026] [:error] [pid 16195:tid 16200] [client 65.108.125.120:63436] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aeyU-jVPLvrpvXaNQOkDwAAAAAI"]
[Sat Apr 25 18:18:37.133852 2026] [:error] [pid 16108:tid 16182] [client 65.108.125.120:63454] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aeyU_YbPF4HSQDj6WrlXLQAAANA"]
[Sat Apr 25 18:18:39.648487 2026] [:error] [pid 16195:tid 16219] [client 65.108.125.120:58390] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "aeyU_zVPLvrpvXaNQOkEBwAAABU"]
[Sat Apr 25 18:18:42.332319 2026] [:error] [pid 16195:tid 16200] [client 65.108.125.120:58412] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aeyVAjVPLvrpvXaNQOkEGgAAAAI"]
[Sat Apr 25 18:18:45.013536 2026] [:error] [pid 16107:tid 16142] [client 65.108.125.120:58432] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aeyVBdIfF7Hy3tw0sYReAgAAAIU"]
[Sat Apr 25 18:18:47.507078 2026] [:error] [pid 16107:tid 16160] [client 65.108.125.120:58446] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aeyVB9IfF7Hy3tw0sYReFwAAAJc"]
[Sat Apr 25 18:18:50.042274 2026] [:error] [pid 16195:tid 16202] [client 65.108.125.120:25580] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aeyVCjVPLvrpvXaNQOkEOQAAAAQ"]
[Sat Apr 25 18:18:52.572534 2026] [:error] [pid 16195:tid 16201] [client 65.108.125.120:25596] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aeyVDDVPLvrpvXaNQOkERAAAAAM"]
[Sat Apr 25 18:18:54.953170 2026] [:error] [pid 16195:tid 16208] [client 65.108.125.120:25606] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aeyVDjVPLvrpvXaNQOkEWAAAAAo"]
[Sat Apr 25 18:18:57.361906 2026] [:error] [pid 16195:tid 16205] [client 65.108.125.120:25622] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aeyVETVPLvrpvXaNQOkEbwAAAAc"]
[Sat Apr 25 18:18:59.896651 2026] [:error] [pid 16108:tid 16190] [client 65.108.125.120:19920] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aeyVE4bPF4HSQDj6WrlXjgAAANg"]
[Sat Apr 25 18:19:02.547061 2026] [:error] [pid 16107:tid 16151] [client 65.108.125.120:19926] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aeyVFtIfF7Hy3tw0sYReTgAAAI4"]
[Sat Apr 25 18:19:28.633496 2026] [:error] [pid 16107:tid 16140] [client 65.108.125.120:33682] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeyVMNIfF7Hy3tw0sYRergAAAIM"]
[Sat Apr 25 18:19:31.185108 2026] [:error] [pid 16107:tid 16156] [client 65.108.125.120:60060] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aeyVM9IfF7Hy3tw0sYRewQAAAJM"]
[Sat Apr 25 18:19:33.525755 2026] [:error] [pid 16195:tid 16207] [client 65.108.125.120:60074] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aeyVNTVPLvrpvXaNQOkFCwAAAAk"]
[Sat Apr 25 18:19:35.913044 2026] [:error] [pid 16107:tid 16137] [client 65.108.125.120:60080] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aeyVN9IfF7Hy3tw0sYRezAAAAIA"]
[Sat Apr 25 18:19:38.415848 2026] [:error] [pid 16108:tid 16165] [client 65.108.125.120:2532] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aeyVOobPF4HSQDj6WrlX-gAAAME"]
[Sat Apr 25 18:19:40.492156 2026] [:error] [pid 16107:tid 16154] [client 65.108.125.120:56210] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeyVPNIfF7Hy3tw0sYRe1QAAAJE"]
[Sat Apr 25 18:19:42.926248 2026] [:error] [pid 16108:tid 16184] [client 65.108.125.120:2536] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aeyVPobPF4HSQDj6WrlYCwAAANI"]
[Sat Apr 25 18:19:45.466302 2026] [:error] [pid 16108:tid 16180] [client 65.108.125.120:2538] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aeyVQYbPF4HSQDj6WrlYFwAAAM4"]
[Sat Apr 25 18:19:48.024620 2026] [:error] [pid 16195:tid 16218] [client 65.108.125.120:2552] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aeyVRDVPLvrpvXaNQOkFSgAAABQ"]
[Sat Apr 25 18:19:50.533572 2026] [:error] [pid 16106:tid 16111] [client 65.108.125.120:48944] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aeyVRiGjdEsrWF7e-7MV7AAAAEE"]
[Sat Apr 25 18:19:53.028161 2026] [:error] [pid 16195:tid 16205] [client 65.108.125.120:48952] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aeyVSTVPLvrpvXaNQOkFcwAAAAc"]
[Sat Apr 25 18:19:54.872357 2026] [:error] [pid 16107:tid 16144] [client 65.108.125.120:32608] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aeyVStIfF7Hy3tw0sYRfBwAAAIc"]
[Sat Apr 25 18:19:56.750689 2026] [:error] [pid 16107:tid 16138] [client 65.108.125.120:32620] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aeyVTNIfF7Hy3tw0sYRfDQAAAIE"]
[Sat Apr 25 18:20:00.488274 2026] [:error] [pid 16195:tid 16217] [client 65.108.125.120:8790] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "aeyVUDVPLvrpvXaNQOkFkwAAABM"]
[Sat Apr 25 18:20:02.524963 2026] [:error] [pid 16195:tid 16220] [client 65.108.125.120:8802] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "aeyVUjVPLvrpvXaNQOkFpwAAABY"]
[Sat Apr 25 18:20:05.151579 2026] [:error] [pid 16108:tid 16164] [client 65.108.125.120:31710] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aeyVVYbPF4HSQDj6WrlYQwAAAMA"]
[Sat Apr 25 18:20:07.130334 2026] [:error] [pid 16195:tid 16222] [client 65.108.125.120:8810] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aeyVVzVPLvrpvXaNQOkFtQAAABg"]
[Sat Apr 25 18:20:09.667611 2026] [:error] [pid 16107:tid 16154] [client 65.108.125.120:50932] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aeyVWdIfF7Hy3tw0sYRfNQAAAJE"]
[Sat Apr 25 18:20:11.651590 2026] [:error] [pid 16106:tid 16132] [client 65.108.125.120:29786] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aeyVWyGjdEsrWF7e-7MWEAAAAFY"]
[Sat Apr 25 21:49:49.952382 2026] [proxy_fcgi:error] [pid 59985:tid 60000] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:50.294097 2026] [proxy_fcgi:error] [pid 59985:tid 59999] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:50.595006 2026] [proxy_fcgi:error] [pid 59985:tid 59994] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:50.864159 2026] [proxy_fcgi:error] [pid 59985:tid 59989] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:51.432109 2026] [proxy_fcgi:error] [pid 59985:tid 60006] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:51.825045 2026] [proxy_fcgi:error] [pid 59985:tid 59990] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:52.094521 2026] [proxy_fcgi:error] [pid 59985:tid 60010] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:52.389196 2026] [proxy_fcgi:error] [pid 59985:tid 59991] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:52.706396 2026] [proxy_fcgi:error] [pid 59985:tid 60011] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:53.315807 2026] [proxy_fcgi:error] [pid 59985:tid 60003] [client 20.91.188.120:12450] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:49:53.725448 2026] [:error] [pid 59985:tid 59993] [client 20.91.188.120:12450] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "aezGgQF_zDvEhKvyTH650QAAAAY"]
[Sat Apr 25 21:49:55.227367 2026] [:error] [pid 3212:tid 3228] [client 20.91.188.120:19816] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "aezGg_g-28TY8_YLtUdAfwAAAQ4"]
[Sat Apr 25 21:49:56.925342 2026] [:error] [pid 59897:tid 59947] [client 20.91.188.120:5570] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "aezGhPBrrkdzpEbmK4eLxAAAAJQ"]
[Sat Apr 25 21:49:58.175378 2026] [:error] [pid 3212:tid 3237] [client 20.91.188.120:5583] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "aezGhvg-28TY8_YLtUdAgAAAARc"]
[Sat Apr 25 21:50:00.175111 2026] [:error] [pid 59896:tid 59906] [client 20.91.188.120:8683] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "aezGiLLLzhtkd-OXUgD8QgAAAEY"]
[Sat Apr 25 21:50:01.020079 2026] [:error] [pid 59896:tid 59907] [client 20.91.188.120:12451] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "aezGibLLzhtkd-OXUgD8RAAAAEc"]
[Sat Apr 25 21:50:02.157912 2026] [:error] [pid 59896:tid 59913] [client 20.91.188.120:29590] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "aezGirLLzhtkd-OXUgD8SAAAAE0"]
[Sat Apr 25 21:50:05.143054 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:8936] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "aezGjbLLzhtkd-OXUgD8TgAAAFg"]
[Sat Apr 25 21:50:10.561710 2026] [:error] [pid 59897:tid 59940] [client 20.91.188.120:5719] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "aezGkvBrrkdzpEbmK4eLzgAAAI0"]
[Sat Apr 25 21:50:16.006478 2026] [:error] [pid 59897:tid 59929] [client 20.91.188.120:54103] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "aezGmPBrrkdzpEbmK4eL0wAAAII"]
[Sat Apr 25 21:50:18.966069 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:12431] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "aezGmvg-28TY8_YLtUdApAAAAQs"]
[Sat Apr 25 21:50:22.416564 2026] [:error] [pid 3212:tid 3237] [client 20.91.188.120:8653] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "aezGnvg-28TY8_YLtUdArAAAARc"]
[Sat Apr 25 21:50:23.633007 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:29609] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "aezGn_g-28TY8_YLtUdAsQAAAQs"]
[Sat Apr 25 21:50:24.895512 2026] [:error] [pid 3212:tid 3234] [client 20.91.188.120:7256] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "aezGoPg-28TY8_YLtUdAtgAAARQ"]
[Sat Apr 25 21:50:39.344287 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:8903] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "aezGr_g-28TY8_YLtUdA1QAAARg"]
[Sat Apr 25 21:50:40.748693 2026] [:error] [pid 3212:tid 3217] [client 20.91.188.120:34256] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "aezGsPg-28TY8_YLtUdA3QAAAQM"]
[Sat Apr 25 21:50:42.504383 2026] [:error] [pid 59985:tid 60011] [client 20.91.188.120:21823] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "aezGsgF_zDvEhKvyTH66BQAAABg"]
[Sat Apr 25 21:50:43.417614 2026] [:error] [pid 59896:tid 59920] [client 20.91.188.120:5711] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "aezGs7LLzhtkd-OXUgD8bgAAAFQ"]
[Sat Apr 25 21:50:44.987229 2026] [:error] [pid 3212:tid 3217] [client 20.91.188.120:12458] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "aezGtPg-28TY8_YLtUdA5wAAAQM"]
[Sat Apr 25 21:50:47.241618 2026] [:error] [pid 59896:tid 59912] [client 20.91.188.120:54080] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "aezGt7LLzhtkd-OXUgD8cgAAAEw"]
[Sat Apr 25 21:50:48.279014 2026] [:error] [pid 59897:tid 59930] [client 20.91.188.120:19815] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "aezGuPBrrkdzpEbmK4eL-AAAAIM"]
[Sat Apr 25 21:50:49.330229 2026] [:error] [pid 59896:tid 59901] [client 20.91.188.120:34945] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "aezGubLLzhtkd-OXUgD8eQAAAEE"]
[Sat Apr 25 21:50:50.759057 2026] [:error] [pid 59898:tid 59975] [client 20.91.188.120:29615] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aezGuh-4vImxb0kbdzexCQAAANU"]
[Sat Apr 25 21:50:51.873141 2026] [:error] [pid 59896:tid 59916] [client 20.91.188.120:59201] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "aezGu7LLzhtkd-OXUgD8fQAAAFA"]
[Sat Apr 25 21:50:55.857736 2026] [proxy_fcgi:error] [pid 59898:tid 59972] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:56.311079 2026] [proxy_fcgi:error] [pid 59898:tid 59974] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:56.699007 2026] [proxy_fcgi:error] [pid 59898:tid 59959] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:57.052720 2026] [proxy_fcgi:error] [pid 59898:tid 59969] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:57.324308 2026] [proxy_fcgi:error] [pid 59898:tid 59968] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:57.641725 2026] [proxy_fcgi:error] [pid 59898:tid 59965] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:57.909619 2026] [proxy_fcgi:error] [pid 59898:tid 59964] [client 20.91.188.120:52851] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:50:58.465860 2026] [:error] [pid 59898:tid 59971] [client 20.91.188.120:52851] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezGwh-4vImxb0kbdzexGgAAANE"]
[Sat Apr 25 21:50:59.375491 2026] [:error] [pid 59985:tid 59998] [client 20.91.188.120:54108] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezGwwF_zDvEhKvyTH66EwAAAAs"]
[Sat Apr 25 21:51:01.758213 2026] [:error] [pid 59897:tid 59941] [client 20.91.188.120:8702] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezGxfBrrkdzpEbmK4eMCQAAAI4"]
[Sat Apr 25 21:51:05.433776 2026] [:error] [pid 59985:tid 60010] [client 20.91.188.120:8934] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezGyQF_zDvEhKvyTH66FgAAABc"]
[Sat Apr 25 21:51:06.768512 2026] [:error] [pid 3212:tid 3214] [client 20.91.188.120:54131] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "aezGyvg-28TY8_YLtUdA-QAAAQA"]
[Sat Apr 25 21:51:07.762317 2026] [:error] [pid 59985:tid 60003] [client 20.91.188.120:8696] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "aezGywF_zDvEhKvyTH66GAAAABA"]
[Sat Apr 25 21:51:08.664639 2026] [:error] [pid 59985:tid 59988] [client 20.91.188.120:59241] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "aezGzAF_zDvEhKvyTH66HAAAAAE"]
[Sat Apr 25 21:51:09.928650 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:20424] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "aezGzbLLzhtkd-OXUgD8lwAAAFg"]
[Sat Apr 25 21:51:11.247258 2026] [:error] [pid 59896:tid 59922] [client 20.91.188.120:20391] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "aezGz7LLzhtkd-OXUgD8nAAAAFY"]
[Sat Apr 25 21:51:11.917001 2026] [:error] [pid 3212:tid 3220] [client 20.91.188.120:52815] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "aezGz_g-28TY8_YLtUdA-gAAAQY"]
[Sat Apr 25 21:51:14.263332 2026] [:error] [pid 3212:tid 3216] [client 20.91.188.120:48848] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "aezG0vg-28TY8_YLtUdBAAAAAQI"]
[Sat Apr 25 21:51:15.519654 2026] [:error] [pid 3212:tid 3222] [client 20.91.188.120:20363] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "aezG0_g-28TY8_YLtUdBAwAAAQg"]
[Sat Apr 25 21:51:16.506462 2026] [:error] [pid 3212:tid 3217] [client 20.91.188.120:19811] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aezG1Pg-28TY8_YLtUdBBQAAAQM"]
[Sat Apr 25 21:51:17.430919 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:52809] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aezG1bLLzhtkd-OXUgD8sAAAAFg"]
[Sat Apr 25 21:51:18.280066 2026] [:error] [pid 59896:tid 59905] [client 20.91.188.120:8903] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aezG1rLLzhtkd-OXUgD8sgAAAEU"]
[Sat Apr 25 21:51:19.184629 2026] [:error] [pid 3212:tid 3221] [client 20.91.188.120:16523] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aezG1_g-28TY8_YLtUdBDAAAAQc"]
[Sat Apr 25 21:51:20.009828 2026] [:error] [pid 59897:tid 59951] [client 20.91.188.120:16527] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "aezG2PBrrkdzpEbmK4eMEQAAAJg"]
[Sat Apr 25 21:51:21.142398 2026] [:error] [pid 59896:tid 59921] [client 20.91.188.120:29764] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "aezG2bLLzhtkd-OXUgD8tQAAAFU"]
[Sat Apr 25 21:51:22.510141 2026] [:error] [pid 59897:tid 59930] [client 20.91.188.120:5734] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "aezG2vBrrkdzpEbmK4eMFQAAAIM"]
[Sat Apr 25 21:51:23.641289 2026] [:error] [pid 59896:tid 59910] [client 20.91.188.120:48876] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "aezG27LLzhtkd-OXUgD8vAAAAEo"]
[Sat Apr 25 21:51:25.173015 2026] [:error] [pid 3212:tid 3233] [client 20.91.188.120:52850] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "aezG3fg-28TY8_YLtUdBEgAAARM"]
[Sat Apr 25 21:51:26.477983 2026] [:error] [pid 3212:tid 3229] [client 20.91.188.120:20375] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "aezG3vg-28TY8_YLtUdBEwAAAQ8"]
[Sat Apr 25 21:51:27.505284 2026] [:error] [pid 3212:tid 3237] [client 20.91.188.120:41012] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "aezG3_g-28TY8_YLtUdBFAAAARc"]
[Sat Apr 25 21:51:28.473816 2026] [:error] [pid 59898:tid 59960] [client 20.91.188.120:16572] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "aezG4B-4vImxb0kbdzexLwAAAMY"]
[Sat Apr 25 21:51:29.596096 2026] [:error] [pid 59896:tid 59903] [client 20.91.188.120:34952] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "aezG4bLLzhtkd-OXUgD8wgAAAEM"]
[Sat Apr 25 21:51:30.682493 2026] [:error] [pid 3212:tid 3220] [client 20.91.188.120:12115] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "aezG4vg-28TY8_YLtUdBGwAAAQY"]
[Sat Apr 25 21:51:33.015669 2026] [:error] [pid 59897:tid 59934] [client 20.91.188.120:12112] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "aezG5fBrrkdzpEbmK4eMIgAAAIc"]
[Sat Apr 25 21:51:34.483161 2026] [:error] [pid 59898:tid 59957] [client 20.91.188.120:34957] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "aezG5h-4vImxb0kbdzexNAAAAMM"]
[Sat Apr 25 21:51:35.729312 2026] [:error] [pid 59896:tid 59909] [client 20.91.188.120:40981] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aezG57LLzhtkd-OXUgD8zQAAAEk"]
[Sat Apr 25 21:51:39.170962 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:34289] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aezG67LLzhtkd-OXUgD82AAAAFg"]
[Sat Apr 25 21:51:42.688905 2026] [:error] [pid 59896:tid 59901] [client 20.91.188.120:20411] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aezG7rLLzhtkd-OXUgD83gAAAEE"]
[Sat Apr 25 21:51:49.095327 2026] [:error] [pid 59896:tid 59908] [client 20.91.188.120:20408] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "aezG9bLLzhtkd-OXUgD86AAAAEg"]
[Sat Apr 25 21:51:50.639747 2026] [:error] [pid 59897:tid 59945] [client 20.91.188.120:40962] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aezG9vBrrkdzpEbmK4eMMQAAAJI"]
[Sat Apr 25 21:51:51.757679 2026] [:error] [pid 3212:tid 3214] [client 20.91.188.120:12424] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aezG9_g-28TY8_YLtUdBNQAAAQA"]
[Sat Apr 25 21:51:52.764112 2026] [:error] [pid 3212:tid 3234] [client 20.91.188.120:12421] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aezG-Pg-28TY8_YLtUdBNgAAARQ"]
[Sat Apr 25 21:51:53.756624 2026] [:error] [pid 59985:tid 60002] [client 20.91.188.120:12140] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "aezG-QF_zDvEhKvyTH66OAAAAA8"]
[Sat Apr 25 21:51:54.865615 2026] [:error] [pid 3212:tid 3219] [client 20.91.188.120:8252] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aezG-vg-28TY8_YLtUdBPAAAAQU"]
[Sat Apr 25 21:51:56.613022 2026] [:error] [pid 59896:tid 59915] [client 20.91.188.120:40989] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "aezG_LLLzhtkd-OXUgD88AAAAE8"]
[Sat Apr 25 21:51:58.025525 2026] [proxy_fcgi:error] [pid 59896:tid 59918] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:51:58.742498 2026] [proxy_fcgi:error] [pid 59896:tid 59919] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:51:59.074630 2026] [proxy_fcgi:error] [pid 59896:tid 59902] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:00.731339 2026] [proxy_fcgi:error] [pid 59896:tid 59923] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:01.051665 2026] [proxy_fcgi:error] [pid 59896:tid 59905] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:01.318304 2026] [proxy_fcgi:error] [pid 59896:tid 59900] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:01.588901 2026] [proxy_fcgi:error] [pid 59896:tid 59909] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:01.856446 2026] [proxy_fcgi:error] [pid 59896:tid 59906] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:02.213890 2026] [proxy_fcgi:error] [pid 59896:tid 59915] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:02.567841 2026] [proxy_fcgi:error] [pid 59896:tid 59917] [client 20.91.188.120:19813] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:52:02.916668 2026] [:error] [pid 59896:tid 59918] [client 20.91.188.120:19813] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aezHArLLzhtkd-OXUgD9CQAAAFI"]
[Sat Apr 25 21:52:04.644364 2026] [:error] [pid 59898:tid 59967] [client 20.91.188.120:52820] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aezHBB-4vImxb0kbdzexRQAAAM0"]
[Sat Apr 25 21:52:05.848383 2026] [:error] [pid 59985:tid 59996] [client 20.91.188.120:45776] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aezHBQF_zDvEhKvyTH66QQAAAAk"]
[Sat Apr 25 21:52:08.879366 2026] [:error] [pid 3212:tid 3219] [client 20.91.188.120:48894] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "aezHCPg-28TY8_YLtUdBVQAAAQU"]
[Sat Apr 25 21:52:10.560427 2026] [:error] [pid 3212:tid 3222] [client 20.91.188.120:8214] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aezHCvg-28TY8_YLtUdBWgAAAQg"]
[Sat Apr 25 21:52:15.999927 2026] [:error] [pid 59985:tid 60002] [client 20.91.188.120:20402] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aezHDwF_zDvEhKvyTH66SQAAAA8"]
[Sat Apr 25 21:52:16.980571 2026] [:error] [pid 59897:tid 59934] [client 20.91.188.120:34948] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aezHEPBrrkdzpEbmK4eMPwAAAIc"]
[Sat Apr 25 21:52:19.316168 2026] [:error] [pid 3212:tid 3218] [client 20.91.188.120:34954] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "aezHE_g-28TY8_YLtUdBbAAAAQQ"]
[Sat Apr 25 21:52:20.796403 2026] [:error] [pid 59896:tid 59904] [client 20.91.188.120:20396] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aezHFLLLzhtkd-OXUgD9HAAAAEQ"]
[Sat Apr 25 21:52:22.390625 2026] [:error] [pid 59898:tid 59954] [client 20.91.188.120:32047] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aezHFh-4vImxb0kbdzexSQAAAMA"]
[Sat Apr 25 21:52:23.628942 2026] [:error] [pid 59897:tid 59946] [client 20.91.188.120:8922] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aezHF_BrrkdzpEbmK4eMRQAAAJM"]
[Sat Apr 25 21:52:25.378049 2026] [:error] [pid 59896:tid 59915] [client 20.91.188.120:20398] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "aezHGbLLzhtkd-OXUgD9KQAAAE8"]
[Sat Apr 25 21:52:26.178547 2026] [:error] [pid 3212:tid 3216] [client 20.91.188.120:34966] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aezHGvg-28TY8_YLtUdBeAAAAQI"]
[Sat Apr 25 21:52:27.097925 2026] [:error] [pid 3212:tid 3235] [client 20.91.188.120:12119] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aezHG_g-28TY8_YLtUdBfwAAARU"]
[Sat Apr 25 21:52:28.234487 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:40977] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aezHHPg-28TY8_YLtUdBhwAAARg"]
[Sat Apr 25 21:52:29.797989 2026] [:error] [pid 59898:tid 59970] [client 20.91.188.120:40984] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "aezHHR-4vImxb0kbdzexTwAAANA"]
[Sat Apr 25 21:52:31.044496 2026] [:error] [pid 3212:tid 3221] [client 20.91.188.120:52849] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aezHH_g-28TY8_YLtUdBkQAAAQc"]
[Sat Apr 25 21:52:32.326654 2026] [:error] [pid 59897:tid 59937] [client 20.91.188.120:45787] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aezHIPBrrkdzpEbmK4eMRwAAAIo"]
[Sat Apr 25 21:52:33.984777 2026] [:error] [pid 59898:tid 59973] [client 20.91.188.120:54099] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aezHIR-4vImxb0kbdzexUgAAANM"]
[Sat Apr 25 21:52:35.106547 2026] [:error] [pid 3212:tid 3222] [client 20.91.188.120:32052] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "aezHI_g-28TY8_YLtUdBnQAAAQg"]
[Sat Apr 25 21:52:36.294029 2026] [:error] [pid 59896:tid 59906] [client 20.91.188.120:34280] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aezHJLLLzhtkd-OXUgD9SwAAAEY"]
[Sat Apr 25 21:52:37.514896 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:48782] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aezHJfg-28TY8_YLtUdBpAAAARg"]
[Sat Apr 25 21:52:39.843965 2026] [:error] [pid 59985:tid 60001] [client 20.91.188.120:34264] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aezHJwF_zDvEhKvyTH66XgAAAA4"]
[Sat Apr 25 21:52:41.730418 2026] [:error] [pid 59897:tid 59934] [client 20.91.188.120:32028] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "aezHKfBrrkdzpEbmK4eMTgAAAIc"]
[Sat Apr 25 21:52:44.443442 2026] [:error] [pid 59898:tid 59975] [client 20.91.188.120:39689] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aezHLB-4vImxb0kbdzexWwAAANU"]
[Sat Apr 25 21:52:47.998921 2026] [:error] [pid 3212:tid 3219] [client 20.91.188.120:8676] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aezHL_g-28TY8_YLtUdBrwAAAQU"]
[Sat Apr 25 21:52:51.103728 2026] [:error] [pid 3212:tid 3234] [client 20.91.188.120:47593] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aezHM_g-28TY8_YLtUdBtgAAARQ"]
[Sat Apr 25 21:52:52.394507 2026] [:error] [pid 59897:tid 59937] [client 20.91.188.120:45813] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "aezHNPBrrkdzpEbmK4eMVAAAAIo"]
[Sat Apr 25 21:52:53.610055 2026] [:error] [pid 59985:tid 60010] [client 20.91.188.120:12152] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aezHNQF_zDvEhKvyTH66fgAAABc"]
[Sat Apr 25 21:52:54.708835 2026] [:error] [pid 59985:tid 60000] [client 20.91.188.120:34253] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aezHNgF_zDvEhKvyTH66ggAAAA0"]
[Sat Apr 25 21:52:56.627073 2026] [:error] [pid 59896:tid 59901] [client 20.91.188.120:54635] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aezHOLLLzhtkd-OXUgD9VgAAAEE"]
[Sat Apr 25 21:52:59.041989 2026] [:error] [pid 59896:tid 59905] [client 20.91.188.120:34293] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "aezHO7LLzhtkd-OXUgD9WwAAAEU"]
[Sat Apr 25 21:53:00.007918 2026] [:error] [pid 59898:tid 59966] [client 20.91.188.120:52835] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aezHPB-4vImxb0kbdzexZAAAAMw"]
[Sat Apr 25 21:53:01.586599 2026] [:error] [pid 59897:tid 59936] [client 20.91.188.120:52852] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "aezHPfBrrkdzpEbmK4eMXgAAAIk"]
[Sat Apr 25 21:53:03.228726 2026] [proxy_fcgi:error] [pid 59897:tid 59931] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:03.554827 2026] [proxy_fcgi:error] [pid 59897:tid 59941] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:03.823073 2026] [proxy_fcgi:error] [pid 59897:tid 59928] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:04.191640 2026] [proxy_fcgi:error] [pid 59897:tid 59938] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:04.459214 2026] [proxy_fcgi:error] [pid 59897:tid 59935] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:04.726569 2026] [proxy_fcgi:error] [pid 59897:tid 59937] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:06.841586 2026] [proxy_fcgi:error] [pid 59897:tid 59936] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:07.111164 2026] [proxy_fcgi:error] [pid 59897:tid 59931] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:07.378849 2026] [proxy_fcgi:error] [pid 59897:tid 59930] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:07.683400 2026] [proxy_fcgi:error] [pid 59897:tid 59941] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:07.995656 2026] [proxy_fcgi:error] [pid 59897:tid 59940] [client 20.91.188.120:32041] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:53:08.274459 2026] [:error] [pid 59897:tid 59932] [client 20.91.188.120:32041] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aezHRPBrrkdzpEbmK4eMcwAAAIU"]
[Sat Apr 25 21:53:19.862197 2026] [:error] [pid 59897:tid 59936] [client 20.91.188.120:49655] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aezHT_BrrkdzpEbmK4eMgAAAAIk"]
[Sat Apr 25 21:53:23.340147 2026] [:error] [pid 59985:tid 59988] [client 20.91.188.120:12122] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "aezHUwF_zDvEhKvyTH66oQAAAAE"]
[Sat Apr 25 21:53:25.105280 2026] [:error] [pid 59896:tid 59910] [client 20.91.188.120:9106] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aezHVbLLzhtkd-OXUgD9agAAAEo"]
[Sat Apr 25 21:53:27.721658 2026] [:error] [pid 59896:tid 59918] [client 20.91.188.120:39155] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aezHV7LLzhtkd-OXUgD9awAAAFI"]
[Sat Apr 25 21:53:28.545979 2026] [:error] [pid 59897:tid 59948] [client 20.91.188.120:53571] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aezHWPBrrkdzpEbmK4eMhgAAAJU"]
[Sat Apr 25 21:53:30.184055 2026] [:error] [pid 59897:tid 59944] [client 20.91.188.120:39218] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "aezHWvBrrkdzpEbmK4eMiQAAAJE"]
[Sat Apr 25 21:53:35.106449 2026] [:error] [pid 59897:tid 59936] [client 20.91.188.120:30409] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aezHX_BrrkdzpEbmK4eMjQAAAIk"]
[Sat Apr 25 21:53:38.162669 2026] [:error] [pid 3212:tid 3237] [client 20.91.188.120:39122] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aezHYvg-28TY8_YLtUdB9QAAARc"]
[Sat Apr 25 21:53:40.687816 2026] [:error] [pid 59896:tid 59917] [client 20.91.188.120:59937] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aezHZLLLzhtkd-OXUgD9eQAAAFE"]
[Sat Apr 25 21:53:42.015887 2026] [:error] [pid 59896:tid 59910] [client 20.91.188.120:53489] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "aezHZrLLzhtkd-OXUgD9fgAAAEo"]
[Sat Apr 25 21:53:43.938502 2026] [:error] [pid 59897:tid 59927] [client 20.91.188.120:30463] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aezHZ_BrrkdzpEbmK4eMkwAAAIA"]
[Sat Apr 25 21:53:47.390988 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:49391] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aezHa_g-28TY8_YLtUdCBQAAARg"]
[Sat Apr 25 21:53:48.284455 2026] [:error] [pid 59898:tid 59965] [client 20.91.188.120:36014] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "aezHbB-4vImxb0kbdzexkAAAAMs"]
[Sat Apr 25 21:54:01.159763 2026] [:error] [pid 59896:tid 59906] [client 20.91.188.120:46952] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aezHebLLzhtkd-OXUgD9qQAAAEY"]
[Sat Apr 25 21:54:03.880791 2026] [:error] [pid 3212:tid 3223] [client 20.91.188.120:30428] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aezHe_g-28TY8_YLtUdCSwAAAQk"]
[Sat Apr 25 21:54:05.256904 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:46632] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aezHffg-28TY8_YLtUdCUQAAAQs"]
[Sat Apr 25 21:54:06.449509 2026] [:error] [pid 59896:tid 59915] [client 20.91.188.120:34199] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwpg.php"] [unique_id "aezHfrLLzhtkd-OXUgD9rAAAAE8"]
[Sat Apr 25 21:54:09.153812 2026] [proxy_fcgi:error] [pid 59896:tid 59913] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:09.506639 2026] [proxy_fcgi:error] [pid 59896:tid 59918] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:09.913827 2026] [proxy_fcgi:error] [pid 59896:tid 59910] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:10.355781 2026] [proxy_fcgi:error] [pid 59896:tid 59906] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:10.678848 2026] [proxy_fcgi:error] [pid 59896:tid 59902] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:11.018696 2026] [proxy_fcgi:error] [pid 59896:tid 59920] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:11.306281 2026] [proxy_fcgi:error] [pid 59896:tid 59917] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:11.688034 2026] [proxy_fcgi:error] [pid 59896:tid 59919] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:12.106265 2026] [proxy_fcgi:error] [pid 59896:tid 59911] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:12.393470 2026] [proxy_fcgi:error] [pid 59896:tid 59921] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:12.777060 2026] [proxy_fcgi:error] [pid 59896:tid 59908] [client 20.91.188.120:56133] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:54:13.189251 2026] [:error] [pid 59896:tid 59909] [client 20.91.188.120:56133] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aezHhbLLzhtkd-OXUgD9wgAAAEk"]
[Sat Apr 25 21:54:14.109022 2026] [:error] [pid 3212:tid 3236] [client 20.91.188.120:60744] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aezHhvg-28TY8_YLtUdCWgAAARY"]
[Sat Apr 25 21:54:16.084892 2026] [:error] [pid 3212:tid 3228] [client 20.91.188.120:46969] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aezHiPg-28TY8_YLtUdCZwAAAQ4"]
[Sat Apr 25 21:54:18.325682 2026] [:error] [pid 3212:tid 3218] [client 20.91.188.120:21982] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "aezHivg-28TY8_YLtUdCcwAAAQQ"]
[Sat Apr 25 21:54:19.197484 2026] [:error] [pid 59897:tid 59938] [client 20.91.188.120:46953] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aezHi_BrrkdzpEbmK4eMrgAAAIs"]
[Sat Apr 25 21:54:21.675456 2026] [:error] [pid 59985:tid 59990] [client 20.91.188.120:12643] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aezHjQF_zDvEhKvyTH668gAAAAM"]
[Sat Apr 25 21:54:24.109744 2026] [:error] [pid 3212:tid 3215] [client 20.91.188.120:60754] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aezHkPg-28TY8_YLtUdChQAAAQE"]
[Sat Apr 25 21:54:25.495549 2026] [:error] [pid 59896:tid 59923] [client 20.91.188.120:16586] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "aezHkbLLzhtkd-OXUgD97AAAAFc"]
[Sat Apr 25 21:54:26.328366 2026] [:error] [pid 59896:tid 59916] [client 20.91.188.120:56135] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aezHkrLLzhtkd-OXUgD98gAAAFA"]
[Sat Apr 25 21:54:27.003192 2026] [:error] [pid 3212:tid 3223] [client 20.91.188.120:5819] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aezHk_g-28TY8_YLtUdCiAAAAQk"]
[Sat Apr 25 21:54:30.203289 2026] [:error] [pid 59985:tid 59990] [client 20.91.188.120:46919] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aezHlgF_zDvEhKvyTH66_QAAAAM"]
[Sat Apr 25 21:54:31.478357 2026] [:error] [pid 59985:tid 60002] [client 20.91.188.120:17164] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "aezHlwF_zDvEhKvyTH66_gAAAA8"]
[Sat Apr 25 21:54:33.170786 2026] [:error] [pid 59985:tid 59987] [client 20.91.188.120:59907] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aezHmQF_zDvEhKvyTH67AQAAAAA"]
[Sat Apr 25 21:54:34.713825 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:46925] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aezHmrLLzhtkd-OXUgD9_wAAAFg"]
[Sat Apr 25 21:54:36.071542 2026] [:error] [pid 59898:tid 59977] [client 20.91.188.120:41559] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aezHnB-4vImxb0kbdzex1wAAANc"]
[Sat Apr 25 21:54:37.135198 2026] [:error] [pid 59898:tid 59975] [client 20.91.188.120:34221] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "aezHnR-4vImxb0kbdzex2AAAANU"]
[Sat Apr 25 21:54:38.213518 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:12612] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHnvg-28TY8_YLtUdClgAAAQs"]
[Sat Apr 25 21:54:39.766887 2026] [:error] [pid 3212:tid 3221] [client 20.91.188.120:5765] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHn_g-28TY8_YLtUdCmQAAAQc"]
[Sat Apr 25 21:54:44.202960 2026] [:error] [pid 59985:tid 59996] [client 20.91.188.120:52740] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHpAF_zDvEhKvyTH67BQAAAAk"]
[Sat Apr 25 21:54:45.876363 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:46615] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHpbLLzhtkd-OXUgD-EQAAAFg"]
[Sat Apr 25 21:54:48.335042 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:59169] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aezHqPg-28TY8_YLtUdCpQAAARg"]
[Sat Apr 25 21:54:49.040429 2026] [:error] [pid 3212:tid 3234] [client 20.91.188.120:12635] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aezHqfg-28TY8_YLtUdCqwAAARQ"]
[Sat Apr 25 21:54:49.722433 2026] [:error] [pid 3212:tid 3229] [client 20.91.188.120:46940] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aezHqfg-28TY8_YLtUdCrQAAAQ8"]
[Sat Apr 25 21:54:51.242717 2026] [:error] [pid 59897:tid 59937] [client 20.91.188.120:42810] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/66.php"] [unique_id "aezHq_BrrkdzpEbmK4eM0wAAAIo"]
[Sat Apr 25 21:54:53.598659 2026] [:error] [pid 59896:tid 59900] [client 20.91.188.120:56172] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aezHrbLLzhtkd-OXUgD-FAAAAEA"]
[Sat Apr 25 21:54:54.594031 2026] [:error] [pid 59898:tid 59968] [client 20.91.188.120:42765] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aezHrh-4vImxb0kbdzex5QAAAM4"]
[Sat Apr 25 21:54:57.479116 2026] [:error] [pid 59985:tid 60002] [client 20.91.188.120:42756] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aezHsQF_zDvEhKvyTH67CwAAAA8"]
[Sat Apr 25 21:54:59.445653 2026] [:error] [pid 59897:tid 59930] [client 20.91.188.120:17171] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "aezHs_BrrkdzpEbmK4eM4AAAAIM"]
[Sat Apr 25 21:55:00.881301 2026] [:error] [pid 59897:tid 59929] [client 20.91.188.120:17176] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aezHtPBrrkdzpEbmK4eM6wAAAII"]
[Sat Apr 25 21:55:08.407832 2026] [:error] [pid 3212:tid 3229] [client 20.91.188.120:42800] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aezHvPg-28TY8_YLtUdCyAAAAQ8"]
[Sat Apr 25 21:55:10.195182 2026] [:error] [pid 3212:tid 3229] [client 20.91.188.120:14857] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aezHvvg-28TY8_YLtUdC0wAAAQ8"]
[Sat Apr 25 21:55:11.890204 2026] [:error] [pid 3212:tid 3214] [client 20.91.188.120:12643] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ol.php"] [unique_id "aezHv_g-28TY8_YLtUdC2gAAAQA"]
[Sat Apr 25 21:55:15.049338 2026] [proxy_fcgi:error] [pid 59897:tid 59930] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:15.331347 2026] [proxy_fcgi:error] [pid 59897:tid 59944] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:15.596856 2026] [proxy_fcgi:error] [pid 59897:tid 59947] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:15.867138 2026] [proxy_fcgi:error] [pid 59897:tid 59932] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:16.528995 2026] [proxy_fcgi:error] [pid 59897:tid 59935] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:16.826383 2026] [proxy_fcgi:error] [pid 59897:tid 59950] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:17.370243 2026] [proxy_fcgi:error] [pid 59897:tid 59943] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:17.647702 2026] [proxy_fcgi:error] [pid 59897:tid 59948] [client 20.91.188.120:56188] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:55:18.306604 2026] [:error] [pid 59897:tid 59931] [client 20.91.188.120:56188] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHxvBrrkdzpEbmK4eNBgAAAIQ"]
[Sat Apr 25 21:55:20.001506 2026] [:error] [pid 3212:tid 3214] [client 20.91.188.120:60725] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHyPg-28TY8_YLtUdC-wAAAQA"]
[Sat Apr 25 21:55:21.051034 2026] [:error] [pid 59897:tid 59945] [client 20.91.188.120:46598] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHyfBrrkdzpEbmK4eNCQAAAJI"]
[Sat Apr 25 21:55:25.764488 2026] [:error] [pid 59897:tid 59940] [client 20.91.188.120:49345] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "aezHzfBrrkdzpEbmK4eNEwAAAI0"]
[Sat Apr 25 21:55:30.404010 2026] [:error] [pid 59896:tid 59909] [client 20.91.188.120:56132] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aezH0rLLzhtkd-OXUgD-JQAAAEk"]
[Sat Apr 25 21:55:56.555990 2026] [:error] [pid 3212:tid 3235] [client 20.91.188.120:14876] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aezH7Pg-28TY8_YLtUdDVAAAARU"]
[Sat Apr 25 21:55:57.434467 2026] [:error] [pid 59897:tid 59932] [client 20.91.188.120:46651] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aezH7fBrrkdzpEbmK4eNJQAAAIU"]
[Sat Apr 25 21:55:58.241228 2026] [:error] [pid 59897:tid 59948] [client 20.91.188.120:10425] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "aezH7vBrrkdzpEbmK4eNLAAAAJU"]
[Sat Apr 25 21:56:00.587067 2026] [:error] [pid 59985:tid 60011] [client 20.91.188.120:46640] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aezH8AF_zDvEhKvyTH67MgAAABg"]
[Sat Apr 25 21:56:02.357861 2026] [:error] [pid 59898:tid 59959] [client 20.91.188.120:16577] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aezH8h-4vImxb0kbdzeyFgAAAMU"]
[Sat Apr 25 21:56:03.037172 2026] [:error] [pid 59898:tid 59967] [client 20.91.188.120:10384] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aezH8x-4vImxb0kbdzeyFwAAAM0"]
[Sat Apr 25 21:56:04.061354 2026] [:error] [pid 3212:tid 3226] [client 20.91.188.120:15267] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "aezH9Pg-28TY8_YLtUdDWQAAAQw"]
[Sat Apr 25 21:56:04.866171 2026] [:error] [pid 59896:tid 59911] [client 20.91.188.120:5773] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aezH9LLLzhtkd-OXUgD-OQAAAEs"]
[Sat Apr 25 21:56:06.295846 2026] [:error] [pid 59896:tid 59907] [client 20.91.188.120:56152] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aezH9rLLzhtkd-OXUgD-PwAAAEc"]
[Sat Apr 25 21:56:07.155417 2026] [:error] [pid 59898:tid 59954] [client 20.91.188.120:27248] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aezH9x-4vImxb0kbdzeyGQAAAMA"]
[Sat Apr 25 21:56:08.050753 2026] [:error] [pid 3212:tid 3223] [client 20.91.188.120:15235] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "aezH-Pg-28TY8_YLtUdDaQAAAQk"]
[Sat Apr 25 21:56:10.339213 2026] [:error] [pid 3212:tid 3234] [client 20.91.188.120:27243] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aezH-vg-28TY8_YLtUdDewAAARQ"]
[Sat Apr 25 21:56:14.989672 2026] [:error] [pid 3212:tid 3229] [client 20.91.188.120:16625] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aezH_vg-28TY8_YLtUdDiQAAAQ8"]
[Sat Apr 25 21:56:15.691288 2026] [:error] [pid 3212:tid 3222] [client 20.91.188.120:46627] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aezH__g-28TY8_YLtUdDjwAAAQg"]
[Sat Apr 25 21:56:16.589980 2026] [:error] [pid 3212:tid 3217] [client 20.91.188.120:37565] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "aezIAPg-28TY8_YLtUdDkgAAAQM"]
[Sat Apr 25 21:56:17.704174 2026] [proxy_fcgi:error] [pid 59896:tid 59921] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:17.972322 2026] [proxy_fcgi:error] [pid 59896:tid 59917] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:18.532445 2026] [proxy_fcgi:error] [pid 59896:tid 59918] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:18.839009 2026] [proxy_fcgi:error] [pid 59896:tid 59908] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:19.618928 2026] [proxy_fcgi:error] [pid 59896:tid 59924] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:20.456827 2026] [proxy_fcgi:error] [pid 59896:tid 59921] [client 20.91.188.120:5806] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:56:21.170461 2026] [:error] [pid 59896:tid 59918] [client 20.91.188.120:5806] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aezIBbLLzhtkd-OXUgD-bgAAAFI"]
[Sat Apr 25 21:56:23.546242 2026] [:error] [pid 3212:tid 3219] [client 20.91.188.120:5809] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aezIB_g-28TY8_YLtUdDogAAAQU"]
[Sat Apr 25 21:56:26.730428 2026] [:error] [pid 3212:tid 3235] [client 20.91.188.120:5162] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aezICvg-28TY8_YLtUdDrQAAARU"]
[Sat Apr 25 21:56:29.418487 2026] [:error] [pid 59985:tid 59991] [client 20.91.188.120:37532] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "aezIDQF_zDvEhKvyTH67VQAAAAQ"]
[Sat Apr 25 21:56:30.926304 2026] [:error] [pid 59985:tid 60000] [client 20.91.188.120:14896] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezIDgF_zDvEhKvyTH67WgAAAA0"]
[Sat Apr 25 21:56:32.544911 2026] [:error] [pid 59897:tid 59951] [client 20.91.188.120:15263] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezIEPBrrkdzpEbmK4eNRAAAAJg"]
[Sat Apr 25 21:56:48.094976 2026] [:error] [pid 59896:tid 59913] [client 20.91.188.120:46641] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aezIILLLzhtkd-OXUgD-lQAAAE0"]
[Sat Apr 25 21:56:54.387319 2026] [:error] [pid 3212:tid 3218] [client 20.91.188.120:60753] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aezIJvg-28TY8_YLtUdD7wAAAQQ"]
[Sat Apr 25 21:56:55.208793 2026] [:error] [pid 59897:tid 59939] [client 20.91.188.120:5768] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aezIJ_BrrkdzpEbmK4eNTwAAAIw"]
[Sat Apr 25 21:56:58.525550 2026] [:error] [pid 59985:tid 59996] [client 20.91.188.120:60690] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "aezIKgF_zDvEhKvyTH67iAAAAAk"]
[Sat Apr 25 21:56:59.445065 2026] [:error] [pid 59898:tid 59957] [client 20.91.188.120:15245] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aezIKx-4vImxb0kbdzeyUQAAAMM"]
[Sat Apr 25 21:57:02.060325 2026] [:error] [pid 59898:tid 59961] [client 20.91.188.120:60781] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aezILh-4vImxb0kbdzeyWAAAAMc"]
[Sat Apr 25 21:57:03.846159 2026] [:error] [pid 59985:tid 59990] [client 20.91.188.120:37526] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aezILwF_zDvEhKvyTH67mgAAAAM"]
[Sat Apr 25 21:57:05.839139 2026] [:error] [pid 59985:tid 59994] [client 20.91.188.120:14865] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "aezIMQF_zDvEhKvyTH67nQAAAAc"]
[Sat Apr 25 21:57:06.758326 2026] [:error] [pid 3212:tid 3236] [client 20.91.188.120:14886] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aezIMvg-28TY8_YLtUdD8gAAARY"]
[Sat Apr 25 21:57:08.386935 2026] [:error] [pid 59896:tid 59900] [client 20.91.188.120:27233] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aezINLLLzhtkd-OXUgD-zAAAAEA"]
[Sat Apr 25 21:57:12.449106 2026] [:error] [pid 3212:tid 3236] [client 20.91.188.120:16639] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aezIOPg-28TY8_YLtUdEBwAAARY"]
[Sat Apr 25 21:57:15.160919 2026] [:error] [pid 59898:tid 59972] [client 20.91.188.120:46309] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "aezIOx-4vImxb0kbdzeyZAAAANI"]
[Sat Apr 25 21:57:16.598951 2026] [:error] [pid 3212:tid 3227] [client 20.91.188.120:37519] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/update/f35.php"] [unique_id "aezIPPg-28TY8_YLtUdEDwAAAQ0"]
[Sat Apr 25 21:57:20.844216 2026] [:error] [pid 59896:tid 59919] [client 20.91.188.120:15294] [client 20.91.188.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aezIQLLLzhtkd-OXUgD--wAAAFM"]
[Sat Apr 25 21:57:21.804307 2026] [proxy_fcgi:error] [pid 59985:tid 60011] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:22.784243 2026] [proxy_fcgi:error] [pid 59985:tid 59994] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:23.173653 2026] [proxy_fcgi:error] [pid 59985:tid 59996] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:23.513493 2026] [proxy_fcgi:error] [pid 59985:tid 59989] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:23.782589 2026] [proxy_fcgi:error] [pid 59985:tid 59993] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:24.053015 2026] [proxy_fcgi:error] [pid 59985:tid 60006] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:25.696550 2026] [proxy_fcgi:error] [pid 59985:tid 60001] [client 20.91.188.120:15249] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:57:26.532308 2026] [:error] [pid 59985:tid 59987] [client 20.91.188.120:15249] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aezIRgF_zDvEhKvyTH67xgAAAAA"]
[Sat Apr 25 21:57:31.914663 2026] [:error] [pid 59896:tid 59911] [client 20.91.188.120:39062] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aezIS7LLzhtkd-OXUgD_IQAAAEs"]
[Sat Apr 25 21:57:34.500275 2026] [:error] [pid 59897:tid 59937] [client 20.91.188.120:8895] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aezITvBrrkdzpEbmK4eNhAAAAIo"]
[Sat Apr 25 21:57:35.372098 2026] [:error] [pid 59897:tid 59941] [client 20.91.188.120:51600] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "aezIT_BrrkdzpEbmK4eNiQAAAI4"]
[Sat Apr 25 21:57:36.500721 2026] [:error] [pid 59896:tid 59924] [client 20.91.188.120:5172] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aezIULLLzhtkd-OXUgD_JwAAAFg"]
[Sat Apr 25 21:57:37.267655 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:32719] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aezIUfg-28TY8_YLtUdERgAAARg"]
[Sat Apr 25 21:57:37.892338 2026] [:error] [pid 59898:tid 59972] [client 20.91.188.120:5156] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aezIUR-4vImxb0kbdzeycQAAANI"]
[Sat Apr 25 21:57:40.589606 2026] [:error] [pid 59985:tid 60008] [client 20.91.188.120:11116] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "aezIVAF_zDvEhKvyTH673wAAABU"]
[Sat Apr 25 21:57:42.341466 2026] [:error] [pid 3212:tid 3217] [client 20.91.188.120:32709] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aezIVvg-28TY8_YLtUdEXgAAAQM"]
[Sat Apr 25 21:57:43.139688 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:15253] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aezIV_g-28TY8_YLtUdEYQAAARg"]
[Sat Apr 25 21:57:44.421289 2026] [:error] [pid 59896:tid 59903] [client 20.91.188.120:14859] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aezIWLLLzhtkd-OXUgD_QQAAAEM"]
[Sat Apr 25 21:57:45.577442 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:51589] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "aezIWfg-28TY8_YLtUdEaAAAAQs"]
[Sat Apr 25 21:57:46.267334 2026] [:error] [pid 3212:tid 3228] [client 20.91.188.120:37529] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aezIWvg-28TY8_YLtUdEawAAAQ4"]
[Sat Apr 25 21:57:47.198355 2026] [:error] [pid 59985:tid 60003] [client 20.91.188.120:51646] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aezIWwF_zDvEhKvyTH675AAAABA"]
[Sat Apr 25 21:57:48.219129 2026] [:error] [pid 59896:tid 59921] [client 20.91.188.120:10422] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aezIXLLLzhtkd-OXUgD_TQAAAFU"]
[Sat Apr 25 21:57:49.157275 2026] [:error] [pid 3212:tid 3222] [client 20.91.188.120:15274] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "aezIXfg-28TY8_YLtUdEcwAAAQg"]
[Sat Apr 25 21:57:50.821936 2026] [:error] [pid 59896:tid 59913] [client 20.91.188.120:32751] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aezIXrLLzhtkd-OXUgD_UgAAAE0"]
[Sat Apr 25 21:57:52.094792 2026] [:error] [pid 3212:tid 3214] [client 20.91.188.120:56137] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aezIYPg-28TY8_YLtUdEfAAAAQA"]
[Sat Apr 25 21:57:52.731456 2026] [:error] [pid 3212:tid 3238] [client 20.91.188.120:11100] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aezIYPg-28TY8_YLtUdEfwAAARg"]
[Sat Apr 25 21:57:54.064828 2026] [:error] [pid 59898:tid 59969] [client 20.91.188.120:37563] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "aezIYh-4vImxb0kbdzeyegAAAM8"]
[Sat Apr 25 21:57:54.799328 2026] [:error] [pid 3212:tid 3224] [client 20.91.188.120:14884] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aezIYvg-28TY8_YLtUdEhwAAAQo"]
[Sat Apr 25 21:57:55.658753 2026] [:error] [pid 3212:tid 3225] [client 20.91.188.120:39096] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aezIY_g-28TY8_YLtUdEiwAAAQs"]
[Sat Apr 25 21:58:07.925355 2026] [:error] [pid 59985:tid 60003] [client 20.91.188.120:51598] [client 20.91.188.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aezIbwF_zDvEhKvyTH68FgAAABA"]
[Sat Apr 25 21:58:33.112650 2026] [proxy_fcgi:error] [pid 59896:tid 59917] [client 20.91.188.120:10414] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:58:33.378861 2026] [proxy_fcgi:error] [pid 59896:tid 59914] [client 20.91.188.120:10414] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:58:33.645412 2026] [proxy_fcgi:error] [pid 59896:tid 59912] [client 20.91.188.120:10414] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:58:34.001005 2026] [proxy_fcgi:error] [pid 59896:tid 59911] [client 20.91.188.120:10414] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:58:34.534458 2026] [proxy_fcgi:error] [pid 59896:tid 59902] [client 20.91.188.120:10414] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 21:58:50.213266 2026] [:error] [pid 59897:tid 59933] [client 110.166.71.39:39585] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aezImvBrrkdzpEbmK4eN3QAAAIY"]
[Sat Apr 25 23:31:27.385936 2026] [:error] [pid 59896:tid 59904] [client 157.173.127.72:47346] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aezeT7LLzhtkd-OXUgAlLwAAAEQ"]
[Sat Apr 25 23:31:30.228363 2026] [:error] [pid 3212:tid 3233] [client 157.173.127.72:28370] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aezeUvg-28TY8_YLtUd5MgAAARM"]
[Sat Apr 25 23:31:34.087529 2026] [:error] [pid 59896:tid 59919] [client 157.173.127.72:28374] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aezeVrLLzhtkd-OXUgAlNgAAAFM"]
[Sat Apr 25 23:31:36.953451 2026] [:error] [pid 59898:tid 59956] [client 157.173.127.72:28380] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aezeWB-4vImxb0kbdzfEjAAAAMI"]
[Sat Apr 25 23:31:39.799762 2026] [:error] [pid 59896:tid 59907] [client 157.173.127.72:32224] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aezeW7LLzhtkd-OXUgAlTwAAAEc"]
[Sat Apr 25 23:31:42.959061 2026] [:error] [pid 59896:tid 59916] [client 157.173.127.72:32230] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aezeXrLLzhtkd-OXUgAlWwAAAFA"]
[Sat Apr 25 23:31:48.276059 2026] [:error] [pid 3212:tid 3218] [client 157.173.127.72:32246] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aezeZPg-28TY8_YLtUd5oQAAAQQ"]
[Sat Apr 25 23:31:50.965188 2026] [:error] [pid 59896:tid 59921] [client 157.173.127.72:6728] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aezeZrLLzhtkd-OXUgAlaAAAAFU"]
[Sat Apr 25 23:31:54.294759 2026] [:error] [pid 3212:tid 3233] [client 157.173.127.72:6742] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aezeavg-28TY8_YLtUd50QAAARM"]
[Sat Apr 25 23:31:57.579530 2026] [:error] [pid 59897:tid 59935] [client 157.173.127.72:6752] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aezebfBrrkdzpEbmK4eiRQAAAIg"]
[Sat Apr 25 23:32:03.827687 2026] [:error] [pid 59985:tid 59990] [client 157.173.127.72:20526] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aezecwF_zDvEhKvyTH7XvQAAAAM"]
[Sat Apr 25 23:32:06.960026 2026] [:error] [pid 3212:tid 3220] [client 157.173.127.72:20540] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aezedvg-28TY8_YLtUd6JAAAAQY"]
[Sat Apr 25 23:32:11.391749 2026] [:error] [pid 3212:tid 3233] [client 157.173.127.72:27100] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aezee_g-28TY8_YLtUd6MwAAARM"]
[Sat Apr 25 23:32:15.156376 2026] [:error] [pid 59896:tid 59920] [client 157.173.127.72:27114] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "aezef7LLzhtkd-OXUgAlsAAAAFQ"]
[Sat Apr 25 23:32:18.585461 2026] [:error] [pid 59897:tid 59928] [client 157.173.127.72:2730] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aezegvBrrkdzpEbmK4eiZQAAAIE"]
[Sat Apr 25 23:32:22.424670 2026] [:error] [pid 59985:tid 60002] [client 157.173.127.72:2746] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aezehgF_zDvEhKvyTH7X7QAAAA8"]
[Sat Apr 25 23:33:13.934629 2026] [:error] [pid 59897:tid 59927] [client 157.173.127.72:61672] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "aezeufBrrkdzpEbmK4eiogAAAIA"]
[Sat Apr 25 23:33:16.734001 2026] [:error] [pid 59897:tid 59939] [client 157.173.127.72:61682] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "aezevPBrrkdzpEbmK4eipQAAAIw"]
[Sat Apr 25 23:33:21.289611 2026] [:error] [pid 59897:tid 59927] [client 157.173.127.72:15384] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aezewfBrrkdzpEbmK4eirAAAAIA"]
[Sat Apr 25 23:33:26.063937 2026] [:error] [pid 59896:tid 59916] [client 157.173.127.72:15400] [client 157.173.127.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aezexrLLzhtkd-OXUgAmhAAAAFA"]
[Sun Apr 26 00:11:41.403057 2026] [:error] [pid 59896:tid 59918] [client 116.240.149.7:63888] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aeznvbLLzhtkd-OXUgA1LQAAAFI"]
[Sun Apr 26 00:11:56.325155 2026] [:error] [pid 59985:tid 59995] [client 116.240.149.7:59488] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aeznzAF_zDvEhKvyTH7kggAAAAg"]
[Sun Apr 26 00:12:09.987700 2026] [:error] [pid 3212:tid 3233] [client 116.240.149.7:60131] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aezn2fg-28TY8_YLtUePsAAAARM"]
[Sun Apr 26 00:12:20.578016 2026] [:error] [pid 59897:tid 59948] [client 116.240.149.7:61078] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aezn5PBrrkdzpEbmK4ethAAAAJU"]
[Sun Apr 26 00:15:04.110644 2026] [:error] [pid 59985:tid 60002] [client 116.240.149.7:60401] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aezoiAF_zDvEhKvyTH7lRgAAAA8"]
[Sun Apr 26 00:15:19.487608 2026] [:error] [pid 3212:tid 3229] [client 116.240.149.7:59193] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aezol_g-28TY8_YLtUeQ2AAAAQ8"]
[Sun Apr 26 00:15:31.232705 2026] [:error] [pid 3212:tid 3232] [client 116.240.149.7:61661] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aezoo_g-28TY8_YLtUeQ5wAAARI"]
[Sun Apr 26 00:15:46.484919 2026] [:error] [pid 59896:tid 59912] [client 116.240.149.7:62362] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aezosrLLzhtkd-OXUgA2OQAAAEw"]
[Sun Apr 26 00:38:21.964515 2026] [proxy_fcgi:error] [pid 3212:tid 3218] [client 13.74.146.113:12495] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 00:38:22.238973 2026] [proxy_fcgi:error] [pid 3212:tid 3220] [client 13.74.146.113:12495] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 01:19:40.547734 2026] [:error] [pid 59898:tid 59970] [client 51.75.119.112:57980] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aez3rB-4vImxb0kbdzfatAAAANA"]
[Sun Apr 26 01:19:42.457496 2026] [:error] [pid 59896:tid 59905] [client 51.75.119.112:38830] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aez3rrLLzhtkd-OXUgBPEgAAAEU"]
[Sun Apr 26 01:19:44.399135 2026] [:error] [pid 3212:tid 3223] [client 51.75.119.112:38832] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aez3sPg-28TY8_YLtUe2_gAAAQk"]
[Sun Apr 26 01:19:47.039635 2026] [:error] [pid 59898:tid 59955] [client 51.75.119.112:34594] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aez3sx-4vImxb0kbdzfatwAAAME"]
[Sun Apr 26 01:19:49.059509 2026] [:error] [pid 3212:tid 3237] [client 51.75.119.112:38842] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aez3tfg-28TY8_YLtUe3CwAAARc"]
[Sun Apr 26 01:19:51.663037 2026] [:error] [pid 59985:tid 60004] [client 51.75.119.112:34600] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aez3twF_zDvEhKvyTH76GQAAABE"]
[Sun Apr 26 01:19:53.679931 2026] [:error] [pid 59897:tid 59935] [client 51.75.119.112:48970] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "aez3ufBrrkdzpEbmK4e9qQAAAIg"]
[Sun Apr 26 01:19:56.230935 2026] [:error] [pid 59897:tid 59948] [client 51.75.119.112:35222] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aez3vPBrrkdzpEbmK4e9rgAAAJU"]
[Sun Apr 26 01:19:58.662819 2026] [:error] [pid 59897:tid 59938] [client 51.75.119.112:35226] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aez3vvBrrkdzpEbmK4e9tAAAAIs"]
[Sun Apr 26 01:20:00.644512 2026] [:error] [pid 59898:tid 59977] [client 51.75.119.112:48976] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aez3wB-4vImxb0kbdzfaxQAAANc"]
[Sun Apr 26 01:20:02.954265 2026] [:error] [pid 59898:tid 59969] [client 51.75.119.112:54746] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aez3wh-4vImxb0kbdzfazgAAAM8"]
[Sun Apr 26 01:20:04.832057 2026] [:error] [pid 3212:tid 3235] [client 51.75.119.112:54758] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aez3xPg-28TY8_YLtUe3IAAAARU"]
[Sun Apr 26 01:20:06.771634 2026] [:error] [pid 59897:tid 59939] [client 51.75.119.112:54766] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aez3xvBrrkdzpEbmK4e9xgAAAIw"]
[Sun Apr 26 01:20:09.347570 2026] [:error] [pid 59897:tid 59941] [client 51.75.119.112:54118] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "aez3yfBrrkdzpEbmK4e9ywAAAI4"]
[Sun Apr 26 01:20:11.811664 2026] [:error] [pid 59897:tid 59936] [client 51.75.119.112:54062] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "aez3y_BrrkdzpEbmK4e9zwAAAIk"]
[Sun Apr 26 01:20:14.352186 2026] [:error] [pid 3212:tid 3234] [client 51.75.119.112:56666] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aez3zvg-28TY8_YLtUe3PQAAARQ"]
[Sun Apr 26 01:20:18.327592 2026] [:error] [pid 3212:tid 3222] [client 51.75.119.112:56676] [client 51.75.119.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "aez30vg-28TY8_YLtUe3TgAAAQg"]
[Sun Apr 26 04:34:50.169061 2026] [:error] [pid 8385:tid 8430] [client 51.75.118.97:37540] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ae0lajOy7_J84Wx3-oxOagAAAEY"]
[Sun Apr 26 04:34:52.349797 2026] [:error] [pid 8385:tid 8436] [client 51.75.118.97:60774] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ae0lbDOy7_J84Wx3-oxObAAAAEw"]
[Sun Apr 26 04:34:54.808239 2026] [:error] [pid 8383:tid 8415] [client 51.75.118.97:43106] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ae0lbtFa2S3EsATMdWOuWQAAABI"]
[Sun Apr 26 04:34:57.084096 2026] [:error] [pid 10315:tid 10339] [client 51.75.118.97:43118] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ae0lcaJIw2vjkleLIaByFQAAARY"]
[Sun Apr 26 04:34:59.095249 2026] [:error] [pid 10315:tid 10340] [client 51.75.118.97:43134] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ae0lc6JIw2vjkleLIaByGQAAARc"]
[Sun Apr 26 04:35:01.988920 2026] [:error] [pid 8491:tid 8500] [client 51.75.118.97:42470] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae0ldSq7I7e6CJooQM13rAAAAME"]
[Sun Apr 26 04:35:04.035656 2026] [:error] [pid 41906:tid 41909] [client 51.75.118.97:43146] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae0leD3-0A3lxw9OXoDe6gAAAYE"]
[Sun Apr 26 04:35:06.648419 2026] [:error] [pid 31273:tid 31356] [client 51.75.118.97:56250] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae0levhcNJEGrATcuEemlAAAAVE"]
[Sun Apr 26 04:35:08.562381 2026] [:error] [pid 31273:tid 31345] [client 51.75.118.97:48554] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae0lfPhcNJEGrATcuEemmgAAAUc"]
[Sun Apr 26 04:35:10.584638 2026] [:error] [pid 8383:tid 8399] [client 51.75.118.97:48570] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae0lftFa2S3EsATMdWOuagAAAAI"]
[Sun Apr 26 04:35:13.106560 2026] [:error] [pid 31273:tid 31341] [client 51.75.118.97:56254] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae0lgfhcNJEGrATcuEemqwAAAUQ"]
[Sun Apr 26 04:35:15.781482 2026] [:error] [pid 8385:tid 8446] [client 51.75.118.97:38054] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae0lgzOy7_J84Wx3-oxOcQAAAFY"]
[Sun Apr 26 04:35:18.488323 2026] [:error] [pid 10315:tid 10332] [client 51.75.118.97:38068] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae0lhqJIw2vjkleLIaByTgAAAQ8"]
[Sun Apr 26 04:35:21.155417 2026] [:error] [pid 10315:tid 10328] [client 51.75.118.97:38080] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae0liaJIw2vjkleLIaByXQAAAQs"]
[Sun Apr 26 04:35:24.165374 2026] [:error] [pid 8491:tid 8518] [client 51.75.118.97:38096] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae0ljCq7I7e6CJooQM13xAAAANM"]
[Sun Apr 26 04:35:26.853282 2026] [:error] [pid 41906:tid 41908] [client 51.75.118.97:56726] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae0ljj3-0A3lxw9OXoDfPgAAAYA"]
[Sun Apr 26 04:35:29.270141 2026] [:error] [pid 8383:tid 8410] [client 51.75.118.97:45498] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ae0lkdFa2S3EsATMdWOueAAAAA0"]
[Sun Apr 26 04:35:31.543699 2026] [:error] [pid 41906:tid 41911] [client 51.75.118.97:56734] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ae0lkz3-0A3lxw9OXoDfVAAAAYM"]
[Sun Apr 26 04:35:34.098986 2026] [:error] [pid 41906:tid 41928] [client 51.75.118.97:56744] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae0llj3-0A3lxw9OXoDfWgAAAZQ"]
[Sun Apr 26 04:35:36.112429 2026] [:error] [pid 8385:tid 8446] [client 51.75.118.97:56720] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ae0lmDOy7_J84Wx3-oxOoAAAAFY"]
[Sun Apr 26 04:35:38.608790 2026] [:error] [pid 8491:tid 8500] [client 51.75.118.97:36850] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ae0lmiq7I7e6CJooQM131wAAAME"]
[Sun Apr 26 04:35:40.611272 2026] [:error] [pid 8491:tid 8512] [client 51.75.118.97:56730] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ae0lnCq7I7e6CJooQM132wAAAM0"]
[Sun Apr 26 04:35:43.048606 2026] [:error] [pid 8383:tid 8403] [client 51.75.118.97:36862] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ae0ln9Fa2S3EsATMdWOukQAAAAY"]
[Sun Apr 26 04:35:45.841432 2026] [:error] [pid 41906:tid 41927] [client 51.75.118.97:37708] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ae0loT3-0A3lxw9OXoDfZwAAAZM"]
[Sun Apr 26 04:36:08.316678 2026] [:error] [pid 41906:tid 41916] [client 51.75.118.97:37724] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ae0luD3-0A3lxw9OXoDfsAAAAYg"]
[Sun Apr 26 04:36:10.538404 2026] [:error] [pid 31273:tid 31361] [client 51.75.118.97:52778] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae0luvhcNJEGrATcuEenMAAAAVY"]
[Sun Apr 26 04:36:14.445284 2026] [:error] [pid 8383:tid 8411] [client 51.75.118.97:44362] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae0lvtFa2S3EsATMdWOutAAAAA4"]
[Sun Apr 26 05:18:05.611179 2026] [:error] [pid 31273:tid 31358] [client 60.188.57.0:54673] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae0vjfhcNJEGrATcuEez9QAAAVM"]
[Sun Apr 26 05:24:45.843277 2026] [proxy_fcgi:error] [pid 8383:tid 8420] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:46.161264 2026] [proxy_fcgi:error] [pid 8383:tid 8415] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:46.435024 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:46.685036 2026] [proxy_fcgi:error] [pid 8383:tid 8412] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:46.976422 2026] [proxy_fcgi:error] [pid 8383:tid 8410] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:47.311263 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:47.608614 2026] [proxy_fcgi:error] [pid 8383:tid 8408] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:47.874069 2026] [proxy_fcgi:error] [pid 8383:tid 8418] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:48.383345 2026] [proxy_fcgi:error] [pid 8383:tid 8407] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:48.663909 2026] [proxy_fcgi:error] [pid 8383:tid 8402] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:48.926089 2026] [proxy_fcgi:error] [pid 8383:tid 8416] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:49.178968 2026] [proxy_fcgi:error] [pid 8383:tid 8413] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:49.449320 2026] [proxy_fcgi:error] [pid 8383:tid 8400] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:49.742933 2026] [proxy_fcgi:error] [pid 8383:tid 8398] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:50.040632 2026] [proxy_fcgi:error] [pid 8383:tid 8414] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:50.298151 2026] [proxy_fcgi:error] [pid 8383:tid 8420] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:50.547325 2026] [proxy_fcgi:error] [pid 8383:tid 8409] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:50.809354 2026] [proxy_fcgi:error] [pid 8383:tid 8397] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:53.199102 2026] [proxy_fcgi:error] [pid 8383:tid 8419] [client 212.30.37.147:62975] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:24:54.857384 2026] [:error] [pid 8383:tid 8416] [client 212.30.37.147:62975] [client 212.30.37.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ae0xJtFa2S3EsATMdWO2GQAAABM"]
[Sun Apr 26 05:24:57.884848 2026] [:error] [pid 31273:tid 31349] [client 212.30.37.153:25321] [client 212.30.37.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ae0xKfhcNJEGrATcuEe14QAAAUo"]
[Sun Apr 26 05:24:59.656614 2026] [proxy_fcgi:error] [pid 31273:tid 31346] [client 212.30.37.123:34851] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:00.456656 2026] [:error] [pid 31273:tid 31360] [client 212.30.37.123:34851] [client 212.30.37.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "ae0xLPhcNJEGrATcuEe16AAAAVU"]
[Sun Apr 26 05:25:01.419090 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 212.30.37.139:38535] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:01.799457 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 212.30.37.139:38535] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:03.169990 2026] [:error] [pid 8383:tid 8419] [client 212.30.37.139:38535] [client 212.30.37.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "ae0xL9Fa2S3EsATMdWO2JwAAABY"]
[Sun Apr 26 05:25:04.320757 2026] [proxy_fcgi:error] [pid 41906:tid 41914] [client 212.30.37.115:50593] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:07.019071 2026] [:error] [pid 41906:tid 41910] [client 212.30.37.115:50593] [client 212.30.37.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ae0xMz3-0A3lxw9OXoD2mgAAAYI"]
[Sun Apr 26 05:25:08.407393 2026] [:error] [pid 8390:tid 8462] [client 212.30.37.161:30793] [client 212.30.37.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ae0xNIGPtFK_i9p5yxQIGAAAAIs"]
[Sun Apr 26 05:25:09.448762 2026] [:error] [pid 10315:tid 10334] [client 212.30.37.162:21389] [client 212.30.37.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ae0xNaJIw2vjkleLIaCEdQAAARE"]
[Sun Apr 26 05:25:10.493007 2026] [:error] [pid 10315:tid 10335] [client 212.30.37.165:40759] [client 212.30.37.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ae0xNqJIw2vjkleLIaCEfgAAARI"]
[Sun Apr 26 05:25:11.507468 2026] [:error] [pid 8383:tid 8419] [client 212.30.37.137:48699] [client 212.30.37.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ae0xN9Fa2S3EsATMdWO2LwAAABY"]
[Sun Apr 26 05:25:12.584545 2026] [:error] [pid 41906:tid 41923] [client 212.30.37.131:50153] [client 212.30.37.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ae0xOD3-0A3lxw9OXoD2oAAAAY8"]
[Sun Apr 26 05:25:13.911274 2026] [:error] [pid 8385:tid 8426] [client 212.30.37.135:32037] [client 212.30.37.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ae0xOTOy7_J84Wx3-oxWwQAAAEI"]
[Sun Apr 26 05:25:14.529811 2026] [proxy_fcgi:error] [pid 8385:tid 8429] [client 212.30.37.127:28167] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:15.057325 2026] [:error] [pid 8385:tid 8427] [client 212.30.37.127:28167] [client 212.30.37.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "ae0xOzOy7_J84Wx3-oxWyAAAAEM"]
[Sun Apr 26 05:25:15.762007 2026] [proxy_fcgi:error] [pid 8390:tid 8467] [client 212.30.37.162:21785] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:16.032346 2026] [proxy_fcgi:error] [pid 8390:tid 8458] [client 212.30.37.162:21785] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:16.299803 2026] [:error] [pid 8390:tid 8464] [client 212.30.37.162:21785] [client 212.30.37.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ae0xPIGPtFK_i9p5yxQIHwAAAI0"]
[Sun Apr 26 05:25:17.139176 2026] [:error] [pid 10315:tid 10333] [client 212.30.37.116:35763] [client 212.30.37.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ae0xPaJIw2vjkleLIaCEpgAAARA"]
[Sun Apr 26 05:25:17.742059 2026] [proxy_fcgi:error] [pid 10315:tid 10326] [client 212.30.37.141:42333] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:18.150043 2026] [:error] [pid 10315:tid 10321] [client 212.30.37.141:42333] [client 212.30.37.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ae0xPqJIw2vjkleLIaCEsgAAAQQ"]
[Sun Apr 26 05:25:18.685416 2026] [proxy_fcgi:error] [pid 8491:tid 8523] [client 212.30.37.144:33907] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:19.562031 2026] [proxy_fcgi:error] [pid 8491:tid 8506] [client 212.30.37.144:33907] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:20.415848 2026] [:error] [pid 8491:tid 8509] [client 212.30.37.144:33907] [client 212.30.37.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ae0xQCq7I7e6CJooQM2DwAAAAMo"]
[Sun Apr 26 05:25:21.073963 2026] [proxy_fcgi:error] [pid 10315:tid 10328] [client 212.30.37.153:52709] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:21.352414 2026] [:error] [pid 10315:tid 10319] [client 212.30.37.153:52709] [client 212.30.37.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ae0xQaJIw2vjkleLIaCEyAAAAQI"]
[Sun Apr 26 05:25:21.945351 2026] [proxy_fcgi:error] [pid 31273:tid 31360] [client 212.30.37.149:48341] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:22.470476 2026] [:error] [pid 31273:tid 31349] [client 212.30.37.149:48341] [client 212.30.37.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "ae0xQvhcNJEGrATcuEe2DgAAAUo"]
[Sun Apr 26 05:25:24.424489 2026] [proxy_fcgi:error] [pid 8385:tid 8438] [client 212.30.37.143:35089] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:24.738583 2026] [:error] [pid 8385:tid 8441] [client 212.30.37.143:35089] [client 212.30.37.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "ae0xRDOy7_J84Wx3-oxWzAAAAFE"]
[Sun Apr 26 05:25:25.553946 2026] [proxy_fcgi:error] [pid 31273:tid 31355] [client 212.30.37.159:53285] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:25.872322 2026] [proxy_fcgi:error] [pid 31273:tid 31350] [client 212.30.37.159:53285] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:26.474639 2026] [:error] [pid 31273:tid 31344] [client 212.30.37.159:53285] [client 212.30.37.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ae0xRvhcNJEGrATcuEe2HwAAAUY"]
[Sun Apr 26 05:25:27.540653 2026] [:error] [pid 31273:tid 31349] [client 212.30.37.158:46951] [client 212.30.37.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ae0xR_hcNJEGrATcuEe2IwAAAUo"]
[Sun Apr 26 05:25:28.674399 2026] [:error] [pid 10315:tid 10335] [client 212.30.37.121:53949] [client 212.30.37.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "ae0xSKJIw2vjkleLIaCE6wAAARI"]
[Sun Apr 26 05:25:29.292010 2026] [:error] [pid 8390:tid 8462] [client 212.30.37.145:46819] [client 212.30.37.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ae0xSYGPtFK_i9p5yxQIIwAAAIs"]
[Sun Apr 26 05:25:29.960423 2026] [:error] [pid 8390:tid 8470] [client 212.30.37.162:27989] [client 212.30.37.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "ae0xSYGPtFK_i9p5yxQIJQAAAJM"]
[Sun Apr 26 05:25:31.028757 2026] [proxy_fcgi:error] [pid 8390:tid 8464] [client 212.30.37.162:56583] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:31.338003 2026] [:error] [pid 8390:tid 8456] [client 212.30.37.162:56583] [client 212.30.37.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "ae0xS4GPtFK_i9p5yxQILAAAAIU"]
[Sun Apr 26 05:25:31.851655 2026] [:error] [pid 31273:tid 31341] [client 212.30.37.158:29899] [client 212.30.37.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "ae0xS_hcNJEGrATcuEe2KQAAAUQ"]
[Sun Apr 26 05:25:32.357904 2026] [:error] [pid 8491:tid 8516] [client 212.30.37.166:21625] [client 212.30.37.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae0xTCq7I7e6CJooQM2DyAAAANE"]
[Sun Apr 26 05:25:33.448021 2026] [proxy_fcgi:error] [pid 8491:tid 8523] [client 212.30.37.145:44797] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:33.716683 2026] [proxy_fcgi:error] [pid 8491:tid 8510] [client 212.30.37.145:44797] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:33.971167 2026] [proxy_fcgi:error] [pid 8491:tid 8503] [client 212.30.37.145:44797] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:34.244220 2026] [proxy_fcgi:error] [pid 8491:tid 8504] [client 212.30.37.145:44797] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:35.005784 2026] [:error] [pid 8491:tid 8507] [client 212.30.37.145:44797] [client 212.30.37.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "ae0xTyq7I7e6CJooQM2D1gAAAMg"]
[Sun Apr 26 05:25:36.900506 2026] [:error] [pid 8383:tid 8411] [client 212.30.37.8:28409] [client 212.30.37.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.37.8, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ae0xUNFa2S3EsATMdWO2PAAAAA4"]
[Sun Apr 26 05:25:37.195947 2026] [proxy_fcgi:error] [pid 8383:tid 8421] [client 212.30.37.8:28409] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:37.733876 2026] [proxy_fcgi:error] [pid 8383:tid 8412] [client 212.30.37.8:28409] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:38.635153 2026] [proxy_fcgi:error] [pid 8383:tid 8418] [client 212.30.37.8:28409] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:38.904428 2026] [proxy_fcgi:error] [pid 8383:tid 8399] [client 212.30.37.8:28409] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:40.408141 2026] [:error] [pid 8383:tid 8400] [client 212.30.37.8:28409] [client 212.30.37.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ae0xVNFa2S3EsATMdWO2SAAAAAM"]
[Sun Apr 26 05:25:42.808608 2026] [proxy_fcgi:error] [pid 8491:tid 8504] [client 212.30.37.166:50229] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 05:25:43.099475 2026] [:error] [pid 8491:tid 8511] [client 212.30.37.166:50229] [client 212.30.37.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.37.166, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ae0xVyq7I7e6CJooQM2D4wAAAMw"]
[Sun Apr 26 05:25:43.691310 2026] [:error] [pid 8491:tid 8508] [client 212.30.37.166:50229] [client 212.30.37.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "ae0xVyq7I7e6CJooQM2D5wAAAMk"]
[Sun Apr 26 05:26:00.999799 2026] [autoindex:error] [pid 41906:tid 41910] [client 212.30.37.166:54207] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 05:26:24.816748 2026] [autoindex:error] [pid 41906:tid 41909] [client 212.30.37.166:54207] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 06:47:04.880431 2026] [proxy_fcgi:error] [pid 41906:tid 41912] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:05.117916 2026] [proxy_fcgi:error] [pid 41906:tid 41921] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:05.453695 2026] [proxy_fcgi:error] [pid 41906:tid 41932] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:05.690419 2026] [proxy_fcgi:error] [pid 41906:tid 41908] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:05.948601 2026] [proxy_fcgi:error] [pid 41906:tid 41909] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:06.266203 2026] [proxy_fcgi:error] [pid 41906:tid 41928] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:06.504596 2026] [proxy_fcgi:error] [pid 41906:tid 41920] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:06.742564 2026] [proxy_fcgi:error] [pid 41906:tid 41925] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:06.980185 2026] [proxy_fcgi:error] [pid 41906:tid 41924] [client 4.232.187.202:12133] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:47:07.505673 2026] [:error] [pid 41906:tid 41910] [client 4.232.187.202:12133] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1Eaz3-0A3lxw9OXoAypwAAAYI"]
[Sun Apr 26 06:47:08.742545 2026] [:error] [pid 8390:tid 8472] [client 4.232.187.202:8872] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1EbIGPtFK_i9p5yxQivQAAAJU"]
[Sun Apr 26 06:47:09.764123 2026] [:error] [pid 41906:tid 41929] [client 4.232.187.202:8865] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1EbT3-0A3lxw9OXoAyqgAAAZU"]
[Sun Apr 26 06:47:10.652749 2026] [:error] [pid 41906:tid 41931] [client 4.232.187.202:8870] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1Ebj3-0A3lxw9OXoAyrQAAAZc"]
[Sun Apr 26 06:47:11.376053 2026] [:error] [pid 8385:tid 8432] [client 4.232.187.202:1566] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1EbzOy7_J84Wx3-oxsOAAAAEg"]
[Sun Apr 26 06:47:12.012448 2026] [:error] [pid 8390:tid 8474] [client 4.232.187.202:18812] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1EcIGPtFK_i9p5yxQiwAAAAJc"]
[Sun Apr 26 06:47:12.496452 2026] [:error] [pid 8390:tid 8471] [client 4.232.187.202:1848] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1EcIGPtFK_i9p5yxQiwQAAAJQ"]
[Sun Apr 26 06:47:13.159439 2026] [:error] [pid 8383:tid 8402] [client 4.232.187.202:8885] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1EcdFa2S3EsATMdWPIlgAAAAU"]
[Sun Apr 26 06:47:13.903995 2026] [:error] [pid 8390:tid 8469] [client 4.232.187.202:12105] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "ae1EcYGPtFK_i9p5yxQiwgAAAJI"]
[Sun Apr 26 06:47:14.522692 2026] [:error] [pid 8390:tid 8465] [client 4.232.187.202:40127] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "ae1EcoGPtFK_i9p5yxQiwwAAAI4"]
[Sun Apr 26 06:47:14.992884 2026] [:error] [pid 10315:tid 10341] [client 4.232.187.202:18785] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "ae1EcqJIw2vjkleLIaC8dAAAARg"]
[Sun Apr 26 06:47:15.522319 2026] [:error] [pid 10315:tid 10336] [client 4.232.187.202:60426] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "ae1Ec6JIw2vjkleLIaC8dQAAARM"]
[Sun Apr 26 06:47:16.025562 2026] [:error] [pid 41906:tid 41910] [client 4.232.187.202:10706] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.admin.php"] [unique_id "ae1EdD3-0A3lxw9OXoAysgAAAYI"]
[Sun Apr 26 06:47:16.754560 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:1828] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.admin.php"] [unique_id "ae1EdKJIw2vjkleLIaC8eAAAARA"]
[Sun Apr 26 06:47:17.585990 2026] [:error] [pid 41906:tid 41927] [client 4.232.187.202:1368] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.admin.php"] [unique_id "ae1EdT3-0A3lxw9OXoAytAAAAZM"]
[Sun Apr 26 06:47:18.082897 2026] [:error] [pid 10315:tid 10331] [client 4.232.187.202:40110] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.admin.php"] [unique_id "ae1EdqJIw2vjkleLIaC8ewAAAQ4"]
[Sun Apr 26 06:47:19.251384 2026] [:error] [pid 10315:tid 10335] [client 4.232.187.202:1546] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sw.php"] [unique_id "ae1Ed6JIw2vjkleLIaC8fQAAARI"]
[Sun Apr 26 06:47:20.149954 2026] [:error] [pid 10315:tid 10340] [client 4.232.187.202:18780] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sw.php"] [unique_id "ae1EeKJIw2vjkleLIaC8gAAAARc"]
[Sun Apr 26 06:47:20.664444 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:1581] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sw.php"] [unique_id "ae1EeKJIw2vjkleLIaC8ggAAARA"]
[Sun Apr 26 06:47:21.581112 2026] [:error] [pid 10315:tid 10334] [client 4.232.187.202:43473] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sw.php"] [unique_id "ae1EeaJIw2vjkleLIaC8hwAAARE"]
[Sun Apr 26 06:47:22.213729 2026] [:error] [pid 8390:tid 8473] [client 4.232.187.202:8893] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vuln.php"] [unique_id "ae1EeoGPtFK_i9p5yxQixgAAAJY"]
[Sun Apr 26 06:47:23.424198 2026] [:error] [pid 8491:tid 8507] [client 4.232.187.202:1793] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vuln.php"] [unique_id "ae1Eeyq7I7e6CJooQM2h0wAAAMg"]
[Sun Apr 26 06:47:24.027477 2026] [:error] [pid 8491:tid 8523] [client 4.232.187.202:8403] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vuln.php"] [unique_id "ae1EfCq7I7e6CJooQM2h1AAAANc"]
[Sun Apr 26 06:47:25.190909 2026] [:error] [pid 41906:tid 41917] [client 4.232.187.202:1379] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vuln.php"] [unique_id "ae1EfT3-0A3lxw9OXoAyuAAAAYk"]
[Sun Apr 26 06:47:26.365537 2026] [:error] [pid 10315:tid 10324] [client 4.232.187.202:1499] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "ae1EfqJIw2vjkleLIaC8jgAAAQc"]
[Sun Apr 26 06:47:27.076442 2026] [:error] [pid 8385:tid 8446] [client 4.232.187.202:18792] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "ae1EfzOy7_J84Wx3-oxsPQAAAFY"]
[Sun Apr 26 06:47:27.858369 2026] [:error] [pid 8383:tid 8419] [client 4.232.187.202:43512] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "ae1Ef9Fa2S3EsATMdWPImQAAABY"]
[Sun Apr 26 06:47:28.665505 2026] [:error] [pid 31273:tid 31362] [client 4.232.187.202:18788] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "ae1EgPhcNJEGrATcuEfb-AAAAVc"]
[Sun Apr 26 06:47:29.932150 2026] [:error] [pid 41906:tid 41930] [client 4.232.187.202:40119] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sxdfrt.php"] [unique_id "ae1EgT3-0A3lxw9OXoAywAAAAZY"]
[Sun Apr 26 06:47:31.399163 2026] [:error] [pid 31273:tid 31357] [client 4.232.187.202:43516] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sxdfrt.php"] [unique_id "ae1Eg_hcNJEGrATcuEfb_AAAAVI"]
[Sun Apr 26 06:47:33.192581 2026] [:error] [pid 41906:tid 41923] [client 4.232.187.202:40098] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sxdfrt.php"] [unique_id "ae1EhT3-0A3lxw9OXoAyxAAAAY8"]
[Sun Apr 26 06:47:33.946729 2026] [:error] [pid 41906:tid 41919] [client 4.232.187.202:1503] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sxdfrt.php"] [unique_id "ae1EhT3-0A3lxw9OXoAyxgAAAYs"]
[Sun Apr 26 06:47:35.313500 2026] [:error] [pid 10315:tid 10325] [client 4.232.187.202:36111] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1Eh6JIw2vjkleLIaC8lAAAAQg"]
[Sun Apr 26 06:47:36.789018 2026] [:error] [pid 31273:tid 31341] [client 4.232.187.202:1837] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1EiPhcNJEGrATcuEfcBQAAAUQ"]
[Sun Apr 26 06:47:38.783673 2026] [:error] [pid 10315:tid 10331] [client 4.232.187.202:1549] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1EiqJIw2vjkleLIaC8nAAAAQ4"]
[Sun Apr 26 06:47:41.465787 2026] [:error] [pid 31273:tid 31357] [client 4.232.187.202:18809] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "ae1EjfhcNJEGrATcuEfcDQAAAVI"]
[Sun Apr 26 06:47:42.847607 2026] [:error] [pid 8390:tid 8466] [client 4.232.187.202:40064] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1EjoGPtFK_i9p5yxQi0wAAAI8"]
[Sun Apr 26 06:47:43.986445 2026] [:error] [pid 41906:tid 41927] [client 4.232.187.202:18769] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1Ejz3-0A3lxw9OXoAy2wAAAZM"]
[Sun Apr 26 06:47:45.011023 2026] [:error] [pid 31273:tid 31356] [client 4.232.187.202:8867] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1EkfhcNJEGrATcuEfcEQAAAVE"]
[Sun Apr 26 06:47:46.698809 2026] [:error] [pid 10315:tid 10319] [client 4.232.187.202:60462] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ae1EkqJIw2vjkleLIaC8swAAAQI"]
[Sun Apr 26 06:47:48.367680 2026] [:error] [pid 10315:tid 10335] [client 4.232.187.202:1540] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "ae1ElKJIw2vjkleLIaC8ugAAARI"]
[Sun Apr 26 06:47:50.421114 2026] [:error] [pid 8385:tid 8427] [client 4.232.187.202:8406] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "ae1EljOy7_J84Wx3-oxsQAAAAEM"]
[Sun Apr 26 06:47:51.073308 2026] [:error] [pid 41906:tid 41911] [client 4.232.187.202:8436] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "ae1Elz3-0A3lxw9OXoAy4wAAAYM"]
[Sun Apr 26 06:47:52.253069 2026] [:error] [pid 8390:tid 8456] [client 4.232.187.202:18775] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "ae1EmIGPtFK_i9p5yxQi4QAAAIU"]
[Sun Apr 26 06:47:53.068721 2026] [:error] [pid 8390:tid 8466] [client 4.232.187.202:8409] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1EmYGPtFK_i9p5yxQi5gAAAI8"]
[Sun Apr 26 06:47:53.694303 2026] [:error] [pid 8385:tid 8438] [client 4.232.187.202:63575] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1EmTOy7_J84Wx3-oxsQQAAAE4"]
[Sun Apr 26 06:47:54.507623 2026] [:error] [pid 8491:tid 8501] [client 4.232.187.202:1376] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1Emiq7I7e6CJooQM2h2wAAAMI"]
[Sun Apr 26 06:47:55.705328 2026] [:error] [pid 8390:tid 8461] [client 4.232.187.202:18806] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1Em4GPtFK_i9p5yxQi7AAAAIo"]
[Sun Apr 26 06:47:57.111427 2026] [:error] [pid 8383:tid 8417] [client 4.232.187.202:43486] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1EndFa2S3EsATMdWPIngAAABQ"]
[Sun Apr 26 06:47:58.621379 2026] [:error] [pid 8390:tid 8455] [client 4.232.187.202:1559] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1EnoGPtFK_i9p5yxQi8wAAAIQ"]
[Sun Apr 26 06:47:59.606274 2026] [:error] [pid 8491:tid 8503] [client 4.232.187.202:12122] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1Enyq7I7e6CJooQM2h6AAAAMQ"]
[Sun Apr 26 06:48:01.428930 2026] [:error] [pid 8491:tid 8511] [client 4.232.187.202:1382] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1EoSq7I7e6CJooQM2h8AAAAMw"]
[Sun Apr 26 06:48:02.435058 2026] [:error] [pid 41906:tid 41910] [client 4.232.187.202:60431] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1Eoj3-0A3lxw9OXoAy9QAAAYI"]
[Sun Apr 26 06:48:03.367307 2026] [:error] [pid 10315:tid 10338] [client 4.232.187.202:1476] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1Eo6JIw2vjkleLIaC8xQAAARU"]
[Sun Apr 26 06:48:04.657612 2026] [:error] [pid 41906:tid 41926] [client 4.232.187.202:1399] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1EpD3-0A3lxw9OXoAy-AAAAZI"]
[Sun Apr 26 06:48:06.636833 2026] [:error] [pid 10315:tid 10330] [client 4.232.187.202:1554] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1EpqJIw2vjkleLIaC8ywAAAQ0"]
[Sun Apr 26 06:48:07.825412 2026] [proxy_fcgi:error] [pid 31273:tid 31347] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:08.137896 2026] [proxy_fcgi:error] [pid 31273:tid 31351] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:08.562876 2026] [proxy_fcgi:error] [pid 31273:tid 31339] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:08.937871 2026] [proxy_fcgi:error] [pid 31273:tid 31336] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:09.174676 2026] [proxy_fcgi:error] [pid 31273:tid 31356] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:09.569849 2026] [proxy_fcgi:error] [pid 31273:tid 31344] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:09.994008 2026] [proxy_fcgi:error] [pid 31273:tid 31358] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:10.471856 2026] [proxy_fcgi:error] [pid 31273:tid 31337] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:10.721835 2026] [proxy_fcgi:error] [pid 31273:tid 31346] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:11.045860 2026] [proxy_fcgi:error] [pid 31273:tid 31341] [client 4.232.187.202:60479] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:48:11.280863 2026] [:error] [pid 31273:tid 31354] [client 4.232.187.202:60479] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "ae1Eq_hcNJEGrATcuEfcLAAAAU8"]
[Sun Apr 26 06:48:18.219341 2026] [:error] [pid 10315:tid 10317] [client 4.232.187.202:36136] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "ae1EsqJIw2vjkleLIaC81AAAAQA"]
[Sun Apr 26 06:48:22.147059 2026] [:error] [pid 8390:tid 8466] [client 4.232.187.202:12128] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "ae1EtoGPtFK_i9p5yxQjCQAAAI8"]
[Sun Apr 26 06:48:24.943203 2026] [:error] [pid 31273:tid 31336] [client 4.232.187.202:1538] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "ae1EuPhcNJEGrATcuEfcUAAAAUE"]
[Sun Apr 26 06:48:26.605386 2026] [:error] [pid 10315:tid 10326] [client 4.232.187.202:9062] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ae1EuqJIw2vjkleLIaC82gAAAQk"]
[Sun Apr 26 06:48:30.208077 2026] [:error] [pid 31273:tid 31346] [client 4.232.187.202:18765] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ae1EvvhcNJEGrATcuEfcZgAAAUg"]
[Sun Apr 26 06:48:31.654487 2026] [:error] [pid 8385:tid 8431] [client 4.232.187.202:1509] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ae1EvzOy7_J84Wx3-oxsbQAAAEc"]
[Sun Apr 26 06:48:32.354083 2026] [:error] [pid 8491:tid 8505] [client 4.232.187.202:8845] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ae1EwCq7I7e6CJooQM2iGQAAAMY"]
[Sun Apr 26 06:48:33.265409 2026] [:error] [pid 10315:tid 10332] [client 4.232.187.202:12126] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "ae1EwaJIw2vjkleLIaC86wAAAQ8"]
[Sun Apr 26 06:48:34.158145 2026] [:error] [pid 10315:tid 10322] [client 4.232.187.202:1842] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "ae1EwqJIw2vjkleLIaC89QAAAQU"]
[Sun Apr 26 06:48:35.314547 2026] [:error] [pid 8383:tid 8413] [client 4.232.187.202:1398] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "ae1Ew9Fa2S3EsATMdWPJGAAAABA"]
[Sun Apr 26 06:48:36.029507 2026] [:error] [pid 10315:tid 10341] [client 4.232.187.202:8887] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "ae1ExKJIw2vjkleLIaC9EAAAARg"]
[Sun Apr 26 06:48:37.891507 2026] [:error] [pid 8390:tid 8453] [client 4.232.187.202:14909] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "ae1ExYGPtFK_i9p5yxQjHAAAAII"]
[Sun Apr 26 06:48:38.875761 2026] [:error] [pid 8491:tid 8508] [client 4.232.187.202:60452] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "ae1Exiq7I7e6CJooQM2iIAAAAMk"]
[Sun Apr 26 06:48:40.587798 2026] [:error] [pid 8491:tid 8517] [client 4.232.187.202:1364] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "ae1EyCq7I7e6CJooQM2iKQAAANI"]
[Sun Apr 26 06:48:41.880285 2026] [:error] [pid 41906:tid 41926] [client 4.232.187.202:8398] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "ae1EyT3-0A3lxw9OXoAzPgAAAZI"]
[Sun Apr 26 06:48:42.809863 2026] [:error] [pid 8390:tid 8452] [client 4.232.187.202:8414] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ae1EyoGPtFK_i9p5yxQjIwAAAIE"]
[Sun Apr 26 06:48:43.741446 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:43466] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ae1Ey6JIw2vjkleLIaC9TwAAARA"]
[Sun Apr 26 06:48:44.561188 2026] [:error] [pid 41906:tid 41924] [client 4.232.187.202:1349] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ae1EzD3-0A3lxw9OXoAzQwAAAZA"]
[Sun Apr 26 06:48:45.376979 2026] [:error] [pid 41906:tid 41932] [client 4.232.187.202:12114] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "ae1EzT3-0A3lxw9OXoAzRgAAAZg"]
[Sun Apr 26 06:48:46.018281 2026] [:error] [pid 8390:tid 8469] [client 4.232.187.202:1834] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1EzoGPtFK_i9p5yxQjJQAAAJI"]
[Sun Apr 26 06:48:46.699852 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:1495] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1EzqJIw2vjkleLIaC9XgAAARA"]
[Sun Apr 26 06:48:47.231759 2026] [:error] [pid 8491:tid 8521] [client 4.232.187.202:43477] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1Ezyq7I7e6CJooQM2iOgAAANY"]
[Sun Apr 26 06:48:47.923944 2026] [:error] [pid 10315:tid 10321] [client 4.232.187.202:1383] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1Ez6JIw2vjkleLIaC9ZAAAAQQ"]
[Sun Apr 26 06:48:48.782742 2026] [:error] [pid 8383:tid 8404] [client 4.232.187.202:40111] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1E0NFa2S3EsATMdWPJHQAAAAc"]
[Sun Apr 26 06:48:49.398079 2026] [:error] [pid 31273:tid 31356] [client 4.232.187.202:36135] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1E0fhcNJEGrATcuEfcdQAAAVE"]
[Sun Apr 26 06:48:50.622004 2026] [:error] [pid 8383:tid 8410] [client 4.232.187.202:1815] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1E0tFa2S3EsATMdWPJHgAAAA0"]
[Sun Apr 26 06:48:51.764433 2026] [:error] [pid 10315:tid 10326] [client 4.232.187.202:12159] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1E06JIw2vjkleLIaC9ZgAAAQk"]
[Sun Apr 26 06:48:52.528759 2026] [:error] [pid 41906:tid 41917] [client 4.232.187.202:63579] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1E1D3-0A3lxw9OXoAzVAAAAYk"]
[Sun Apr 26 06:48:53.494918 2026] [:error] [pid 41906:tid 41911] [client 4.232.187.202:43509] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1E1T3-0A3lxw9OXoAzWgAAAYM"]
[Sun Apr 26 06:48:54.796900 2026] [:error] [pid 31273:tid 31344] [client 4.232.187.202:1810] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1E1vhcNJEGrATcuEfcfQAAAUY"]
[Sun Apr 26 06:48:56.250131 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:18758] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1E2KJIw2vjkleLIaC9aAAAARA"]
[Sun Apr 26 06:48:58.301404 2026] [:error] [pid 8385:tid 8444] [client 4.232.187.202:12122] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1E2jOy7_J84Wx3-oxsggAAAFQ"]
[Sun Apr 26 06:49:00.185447 2026] [:error] [pid 10315:tid 10340] [client 4.232.187.202:12096] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1E3KJIw2vjkleLIaC9dAAAARc"]
[Sun Apr 26 06:49:01.770948 2026] [:error] [pid 8383:tid 8420] [client 4.232.187.202:14849] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1E3dFa2S3EsATMdWPJJQAAABc"]
[Sun Apr 26 06:49:02.823818 2026] [:error] [pid 41906:tid 41925] [client 4.232.187.202:36142] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1E3j3-0A3lxw9OXoAzXwAAAZE"]
[Sun Apr 26 06:49:03.973534 2026] [:error] [pid 8383:tid 8415] [client 4.232.187.202:36096] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1E39Fa2S3EsATMdWPJJwAAABI"]
[Sun Apr 26 06:49:06.497392 2026] [:error] [pid 31273:tid 31358] [client 4.232.187.202:33028] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1E4vhcNJEGrATcuEfcggAAAVM"]
[Sun Apr 26 06:49:07.859558 2026] [:error] [pid 41906:tid 41917] [client 4.232.187.202:1497] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1E4z3-0A3lxw9OXoAzYgAAAYk"]
[Sun Apr 26 06:49:09.533054 2026] [:error] [pid 31273:tid 31341] [client 4.232.187.202:1799] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1E5fhcNJEGrATcuEfcgwAAAUQ"]
[Sun Apr 26 06:49:11.615870 2026] [proxy_fcgi:error] [pid 10315:tid 10326] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:12.210172 2026] [proxy_fcgi:error] [pid 10315:tid 10337] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:13.266383 2026] [proxy_fcgi:error] [pid 10315:tid 10331] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:13.642877 2026] [proxy_fcgi:error] [pid 10315:tid 10336] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:13.884661 2026] [proxy_fcgi:error] [pid 10315:tid 10321] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:14.125399 2026] [proxy_fcgi:error] [pid 10315:tid 10339] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:14.664500 2026] [proxy_fcgi:error] [pid 10315:tid 10335] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:16.155951 2026] [proxy_fcgi:error] [pid 10315:tid 10336] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:16.397410 2026] [proxy_fcgi:error] [pid 10315:tid 10319] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:16.862431 2026] [proxy_fcgi:error] [pid 10315:tid 10336] [client 4.232.187.202:14864] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:49:17.791143 2026] [:error] [pid 10315:tid 10335] [client 4.232.187.202:14864] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "ae1E7aJIw2vjkleLIaC9tQAAARI"]
[Sun Apr 26 06:49:19.540857 2026] [:error] [pid 8385:tid 8436] [client 4.232.187.202:8844] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "ae1E7zOy7_J84Wx3-oxskwAAAEw"]
[Sun Apr 26 06:49:21.389223 2026] [:error] [pid 8491:tid 8512] [client 4.232.187.202:1823] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "ae1E8Sq7I7e6CJooQM2imgAAAM0"]
[Sun Apr 26 06:49:25.470659 2026] [:error] [pid 8385:tid 8445] [client 4.232.187.202:1483] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3.php"] [unique_id "ae1E9TOy7_J84Wx3-oxsugAAAFU"]
[Sun Apr 26 06:49:26.817316 2026] [:error] [pid 10315:tid 10326] [client 4.232.187.202:43481] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1E9qJIw2vjkleLIaC90AAAAQk"]
[Sun Apr 26 06:49:27.991838 2026] [:error] [pid 10315:tid 10326] [client 4.232.187.202:60448] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1E96JIw2vjkleLIaC90wAAAQk"]
[Sun Apr 26 06:49:29.781850 2026] [:error] [pid 13098:tid 13104] [client 4.232.187.202:40113] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1E-RxXbKcYxP_yQK0AzgAAAcA"]
[Sun Apr 26 06:49:31.964190 2026] [:error] [pid 8383:tid 8416] [client 4.232.187.202:40089] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1E-9Fa2S3EsATMdWPJaAAAABM"]
[Sun Apr 26 06:49:32.932639 2026] [:error] [pid 13196:tid 13224] [client 4.232.187.202:1163] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1E_MqUeXPgssvUw6CKKwAAApQ"]
[Sun Apr 26 06:49:34.347370 2026] [:error] [pid 13199:tid 13269] [client 4.232.187.202:14902] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1E_lr9Yx23chshh9aDXAAAA0Q"]
[Sun Apr 26 06:49:35.276792 2026] [:error] [pid 13199:tid 13284] [client 4.232.187.202:14902] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1E_1r9Yx23chshh9aDYQAAA0w"]
[Sun Apr 26 06:49:36.345998 2026] [:error] [pid 13315:tid 13346] [client 4.232.187.202:1202] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1FAA2NnZnCaSNNhH3ACwAAA8I"]
[Sun Apr 26 06:49:37.632677 2026] [:error] [pid 13315:tid 13349] [client 4.232.187.202:60420] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1FAQ2NnZnCaSNNhH3AEQAAA8U"]
[Sun Apr 26 06:49:40.397331 2026] [:error] [pid 13315:tid 13361] [client 4.232.187.202:8873] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1FBA2NnZnCaSNNhH3AHwAAA9E"]
[Sun Apr 26 06:49:41.917052 2026] [:error] [pid 13199:tid 13274] [client 4.232.187.202:60468] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1FBVr9Yx23chshh9aDZQAAA0c"]
[Sun Apr 26 06:49:42.837181 2026] [:error] [pid 13315:tid 13367] [client 4.232.187.202:10718] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1FBg2NnZnCaSNNhH3AKwAAA9c"]
[Sun Apr 26 06:49:44.517883 2026] [:error] [pid 13196:tid 13223] [client 4.232.187.202:14864] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ae1FCMqUeXPgssvUw6CKLwAAApM"]
[Sun Apr 26 06:49:45.662967 2026] [:error] [pid 13315:tid 13364] [client 4.232.187.202:8864] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ae1FCQ2NnZnCaSNNhH3AMwAAA9Q"]
[Sun Apr 26 06:49:46.545860 2026] [:error] [pid 13315:tid 13352] [client 4.232.187.202:18790] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ae1FCg2NnZnCaSNNhH3AOQAAA8g"]
[Sun Apr 26 06:49:47.948474 2026] [:error] [pid 8383:tid 8419] [client 4.232.187.202:32597] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ae1FC9Fa2S3EsATMdWPJeQAAABY"]
[Sun Apr 26 06:49:50.587866 2026] [:error] [pid 8383:tid 8418] [client 4.232.187.202:14911] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ae1FDtFa2S3EsATMdWPJhwAAABU"]
[Sun Apr 26 06:49:52.893166 2026] [:error] [pid 13197:tid 13254] [client 4.232.187.202:32618] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ae1FEN3kktFKdSxTrBuMegAAAtY"]
[Sun Apr 26 06:49:56.252607 2026] [:error] [pid 41906:tid 41925] [client 4.232.187.202:7870] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ae1FFD3-0A3lxw9OXoAznwAAAZE"]
[Sun Apr 26 06:49:58.558184 2026] [:error] [pid 13315:tid 13358] [client 4.232.187.202:44606] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/10.php"] [unique_id "ae1FFg2NnZnCaSNNhH3AdQAAA84"]
[Sun Apr 26 06:50:01.867031 2026] [:error] [pid 8383:tid 8415] [client 4.232.187.202:31134] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae1FGdFa2S3EsATMdWPJmAAAABI"]
[Sun Apr 26 06:50:04.194581 2026] [:error] [pid 13197:tid 13249] [client 4.232.187.202:18031] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae1FHN3kktFKdSxTrBuMjwAAAtE"]
[Sun Apr 26 06:50:06.902789 2026] [:error] [pid 13315:tid 13361] [client 4.232.187.202:1914] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae1FHg2NnZnCaSNNhH3AhgAAA9E"]
[Sun Apr 26 06:50:08.027013 2026] [:error] [pid 13315:tid 13363] [client 4.232.187.202:17643] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae1FIA2NnZnCaSNNhH3AmQAAA9M"]
[Sun Apr 26 06:50:09.239705 2026] [:error] [pid 13315:tid 13346] [client 4.232.187.202:20648] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "ae1FIQ2NnZnCaSNNhH3ApgAAA8I"]
[Sun Apr 26 06:50:10.338285 2026] [:error] [pid 13197:tid 13256] [client 4.232.187.202:35087] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "ae1FIt3kktFKdSxTrBuMlAAAAtg"]
[Sun Apr 26 06:50:11.757786 2026] [:error] [pid 13197:tid 13249] [client 4.232.187.202:34097] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "ae1FI93kktFKdSxTrBuMmwAAAtE"]
[Sun Apr 26 06:50:12.610972 2026] [:error] [pid 13315:tid 13357] [client 4.232.187.202:7247] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "ae1FJA2NnZnCaSNNhH3AsgAAA80"]
[Sun Apr 26 06:50:13.641332 2026] [:error] [pid 10315:tid 10321] [client 4.232.187.202:9877] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ae1FJaJIw2vjkleLIaC93QAAAQQ"]
[Sun Apr 26 06:50:14.426176 2026] [:error] [pid 10315:tid 10324] [client 4.232.187.202:38084] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ae1FJqJIw2vjkleLIaC93wAAAQc"]
[Sun Apr 26 06:50:15.293223 2026] [:error] [pid 10315:tid 10339] [client 4.232.187.202:8300] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35_S.php"] [unique_id "ae1FJ6JIw2vjkleLIaC94gAAARY"]
[Sun Apr 26 06:50:16.143497 2026] [proxy_fcgi:error] [pid 10315:tid 10334] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:16.490435 2026] [proxy_fcgi:error] [pid 10315:tid 10335] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:16.741421 2026] [proxy_fcgi:error] [pid 10315:tid 10332] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:17.146262 2026] [proxy_fcgi:error] [pid 10315:tid 10328] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:17.430803 2026] [proxy_fcgi:error] [pid 10315:tid 10337] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:17.723919 2026] [proxy_fcgi:error] [pid 10315:tid 10317] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:18.099668 2026] [proxy_fcgi:error] [pid 10315:tid 10341] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:18.370953 2026] [proxy_fcgi:error] [pid 10315:tid 10330] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:18.615737 2026] [proxy_fcgi:error] [pid 10315:tid 10336] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:18.852552 2026] [proxy_fcgi:error] [pid 10315:tid 10326] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:19.162160 2026] [proxy_fcgi:error] [pid 10315:tid 10338] [client 4.232.187.202:7295] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:50:19.396777 2026] [:error] [pid 10315:tid 10331] [client 4.232.187.202:7295] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "ae1FK6JIw2vjkleLIaC98gAAAQ4"]
[Sun Apr 26 06:50:20.345959 2026] [:error] [pid 13315:tid 13346] [client 4.232.187.202:7276] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "ae1FLA2NnZnCaSNNhH3AwwAAA8I"]
[Sun Apr 26 06:50:21.790661 2026] [:error] [pid 13137:tid 13162] [client 4.232.187.202:7265] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "ae1FLd0RB4J0o4h5neHfeQAAAhU"]
[Sun Apr 26 06:50:22.670623 2026] [:error] [pid 13315:tid 13363] [client 4.232.187.202:1815] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "ae1FLg2NnZnCaSNNhH3AxwAAA9M"]
[Sun Apr 26 06:50:23.274768 2026] [:error] [pid 10315:tid 10333] [client 4.232.187.202:11125] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1FL6JIw2vjkleLIaC99gAAARA"]
[Sun Apr 26 06:50:24.290585 2026] [:error] [pid 8383:tid 8411] [client 4.232.187.202:53871] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1FMNFa2S3EsATMdWPJrAAAAA4"]
[Sun Apr 26 06:50:25.316689 2026] [:error] [pid 13137:tid 13148] [client 4.232.187.202:42558] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1FMd0RB4J0o4h5neHfewAAAgg"]
[Sun Apr 26 06:50:28.407815 2026] [:error] [pid 8390:tid 8458] [client 4.232.187.202:42536] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1FNIGPtFK_i9p5yxQjhgAAAIc"]
[Sun Apr 26 06:50:31.029953 2026] [:error] [pid 10315:tid 10336] [client 4.232.187.202:17540] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1FN6JIw2vjkleLIaC-AwAAARM"]
[Sun Apr 26 06:50:36.681975 2026] [:error] [pid 13315:tid 13367] [client 4.232.187.202:10638] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1FPA2NnZnCaSNNhH3A2AAAA9c"]
[Sun Apr 26 06:50:50.377381 2026] [:error] [pid 13137:tid 13141] [client 4.232.187.202:42548] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1FSt0RB4J0o4h5neHfhgAAAgE"]
[Sun Apr 26 06:50:56.736708 2026] [:error] [pid 13137:tid 13155] [client 4.232.187.202:1419] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1FUN0RB4J0o4h5neHfkAAAAg4"]
[Sun Apr 26 06:50:59.756222 2026] [:error] [pid 13315:tid 13364] [client 4.232.187.202:12989] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1FUw2NnZnCaSNNhH3A7QAAA9Q"]
[Sun Apr 26 06:51:04.879669 2026] [:error] [pid 13197:tid 13253] [client 4.232.187.202:11278] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1FWN3kktFKdSxTrBuMuAAAAtU"]
[Sun Apr 26 06:51:06.363025 2026] [:error] [pid 13197:tid 13231] [client 4.232.187.202:10003] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1FWt3kktFKdSxTrBuMugAAAsA"]
[Sun Apr 26 06:51:07.374501 2026] [:error] [pid 8385:tid 8437] [client 4.232.187.202:9995] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ae1FWzOy7_J84Wx3-oxsyAAAAE0"]
[Sun Apr 26 06:51:08.647102 2026] [:error] [pid 8385:tid 8434] [client 4.232.187.202:14946] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ae1FXDOy7_J84Wx3-oxsygAAAEo"]
[Sun Apr 26 06:51:10.226666 2026] [:error] [pid 8385:tid 8435] [client 4.232.187.202:54728] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ae1FXjOy7_J84Wx3-oxsywAAAEs"]
[Sun Apr 26 06:51:11.264495 2026] [:error] [pid 8385:tid 8448] [client 4.232.187.202:9996] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "ae1FXzOy7_J84Wx3-oxszgAAAFg"]
[Sun Apr 26 06:51:11.997731 2026] [:error] [pid 13137:tid 13157] [client 4.232.187.202:54752] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1FX90RB4J0o4h5neHfrQAAAhA"]
[Sun Apr 26 06:51:12.724205 2026] [:error] [pid 8383:tid 8404] [client 4.232.187.202:10649] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1FYNFa2S3EsATMdWPJvgAAAAc"]
[Sun Apr 26 06:51:13.546177 2026] [:error] [pid 13197:tid 13240] [client 4.232.187.202:10656] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1FYd3kktFKdSxTrBuMvQAAAsk"]
[Sun Apr 26 06:51:14.592201 2026] [:error] [pid 10315:tid 10318] [client 4.232.187.202:15684] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1FYqJIw2vjkleLIaC-DAAAAQE"]
[Sun Apr 26 06:51:15.668518 2026] [:error] [pid 13196:tid 13214] [client 4.232.187.202:15720] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1FY8qUeXPgssvUw6CKfwAAAoo"]
[Sun Apr 26 06:51:16.468600 2026] [:error] [pid 41906:tid 41929] [client 4.232.187.202:20311] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1FZD3-0A3lxw9OXoAzxQAAAZU"]
[Sun Apr 26 06:51:17.265347 2026] [:error] [pid 8383:tid 8405] [client 4.232.187.202:9989] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1FZdFa2S3EsATMdWPJxAAAAAg"]
[Sun Apr 26 06:51:17.944205 2026] [:error] [pid 13315:tid 13363] [client 4.232.187.202:34132] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1FZQ2NnZnCaSNNhH3BAwAAA9M"]
[Sun Apr 26 06:51:18.595124 2026] [:error] [pid 8390:tid 8451] [client 4.232.187.202:1648] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ae1FZoGPtFK_i9p5yxQjmQAAAIA"]
[Sun Apr 26 06:51:19.342407 2026] [proxy_fcgi:error] [pid 8383:tid 8416] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:19.651393 2026] [proxy_fcgi:error] [pid 8383:tid 8413] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:19.888677 2026] [proxy_fcgi:error] [pid 8383:tid 8415] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:20.124296 2026] [proxy_fcgi:error] [pid 8383:tid 8420] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:20.464012 2026] [proxy_fcgi:error] [pid 8383:tid 8399] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:20.968653 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:21.228698 2026] [proxy_fcgi:error] [pid 8383:tid 8411] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:21.497021 2026] [proxy_fcgi:error] [pid 8383:tid 8419] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:21.734131 2026] [proxy_fcgi:error] [pid 8383:tid 8407] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:21.976226 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 4.232.187.202:11272] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:51:22.211049 2026] [:error] [pid 8383:tid 8404] [client 4.232.187.202:11272] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ae1FatFa2S3EsATMdWPJ0gAAAAc"]
[Sun Apr 26 06:51:23.214388 2026] [:error] [pid 13137:tid 13155] [client 4.232.187.202:1789] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ae1Fa90RB4J0o4h5neHfwQAAAg4"]
[Sun Apr 26 06:51:24.341314 2026] [:error] [pid 8385:tid 8445] [client 4.232.187.202:1647] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ae1FbDOy7_J84Wx3-oxs0gAAAFU"]
[Sun Apr 26 06:51:28.969969 2026] [:error] [pid 13197:tid 13251] [client 4.232.187.202:1663] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ae1FcN3kktFKdSxTrBuMxgAAAtM"]
[Sun Apr 26 06:51:34.384777 2026] [:error] [pid 13315:tid 13351] [client 4.232.187.202:64115] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ae1Fdg2NnZnCaSNNhH3BEQAAA8c"]
[Sun Apr 26 06:51:37.741869 2026] [:error] [pid 13196:tid 13206] [client 4.232.187.202:17230] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ae1FecqUeXPgssvUw6CKjwAAAoI"]
[Sun Apr 26 06:51:43.704023 2026] [:error] [pid 41906:tid 41922] [client 4.232.187.202:11090] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ae1Ffz3-0A3lxw9OXoAz1gAAAY4"]
[Sun Apr 26 06:51:45.731649 2026] [:error] [pid 41906:tid 41915] [client 4.232.187.202:19165] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1FgT3-0A3lxw9OXoAz2QAAAYc"]
[Sun Apr 26 06:51:47.916922 2026] [:error] [pid 8390:tid 8472] [client 4.232.187.202:11112] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1Fg4GPtFK_i9p5yxQjowAAAJU"]
[Sun Apr 26 06:51:49.168485 2026] [:error] [pid 10315:tid 10329] [client 4.232.187.202:14936] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1FhaJIw2vjkleLIaC-GwAAAQw"]
[Sun Apr 26 06:51:50.143763 2026] [:error] [pid 8390:tid 8458] [client 4.232.187.202:1436] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1FhoGPtFK_i9p5yxQjpQAAAIc"]
[Sun Apr 26 06:51:50.960354 2026] [:error] [pid 8390:tid 8457] [client 4.232.187.202:1465] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1FhoGPtFK_i9p5yxQjpwAAAIY"]
[Sun Apr 26 06:51:51.661770 2026] [:error] [pid 13137:tid 13145] [client 4.232.187.202:8311] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1Fh90RB4J0o4h5neHfyAAAAgU"]
[Sun Apr 26 06:51:52.855717 2026] [:error] [pid 13196:tid 13213] [client 4.232.187.202:1462] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1FiMqUeXPgssvUw6CKogAAAok"]
[Sun Apr 26 06:51:54.885941 2026] [:error] [pid 13197:tid 13245] [client 4.232.187.202:1434] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1Fit3kktFKdSxTrBuM4AAAAs0"]
[Sun Apr 26 06:51:56.549115 2026] [:error] [pid 13137:tid 13140] [client 4.232.187.202:17577] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ae1FjN0RB4J0o4h5neHfzgAAAgA"]
[Sun Apr 26 06:51:57.952378 2026] [:error] [pid 13197:tid 13253] [client 4.232.187.202:17229] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ae1Fjd3kktFKdSxTrBuM5AAAAtU"]
[Sun Apr 26 06:52:02.169103 2026] [:error] [pid 8383:tid 8417] [client 4.232.187.202:1469] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ae1FktFa2S3EsATMdWPJ5AAAABQ"]
[Sun Apr 26 06:52:03.799756 2026] [:error] [pid 13197:tid 13254] [client 4.232.187.202:10033] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ae1Fk93kktFKdSxTrBuM8AAAAtY"]
[Sun Apr 26 06:52:05.094765 2026] [:error] [pid 13315:tid 13350] [client 4.232.187.202:17542] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1FlQ2NnZnCaSNNhH3BLgAAA8Y"]
[Sun Apr 26 06:52:06.466322 2026] [:error] [pid 8385:tid 8434] [client 4.232.187.202:8293] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1FljOy7_J84Wx3-oxs5wAAAEo"]
[Sun Apr 26 06:52:07.716591 2026] [:error] [pid 13137:tid 13141] [client 4.232.187.202:1457] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1Fl90RB4J0o4h5neHf1wAAAgE"]
[Sun Apr 26 06:52:08.598600 2026] [:error] [pid 13315:tid 13357] [client 4.232.187.202:19183] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1FmA2NnZnCaSNNhH3BLwAAA80"]
[Sun Apr 26 06:52:09.600881 2026] [:error] [pid 41906:tid 41928] [client 4.232.187.202:16038] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1FmT3-0A3lxw9OXoAz7QAAAZQ"]
[Sun Apr 26 06:52:10.423159 2026] [:error] [pid 8383:tid 8400] [client 4.232.187.202:42549] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1FmtFa2S3EsATMdWPJ7gAAAAM"]
[Sun Apr 26 06:52:11.500287 2026] [:error] [pid 13196:tid 13205] [client 4.232.187.202:53851] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1Fm8qUeXPgssvUw6CKswAAAoE"]
[Sun Apr 26 06:52:12.470547 2026] [:error] [pid 13196:tid 13204] [client 4.232.187.202:42527] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1FnMqUeXPgssvUw6CKtAAAAoA"]
[Sun Apr 26 06:52:13.417640 2026] [:error] [pid 8383:tid 8401] [client 4.232.187.202:14931] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1FndFa2S3EsATMdWPJ8AAAAAQ"]
[Sun Apr 26 06:52:13.984358 2026] [:error] [pid 8383:tid 8398] [client 4.232.187.202:18326] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1FndFa2S3EsATMdWPJ9gAAAAE"]
[Sun Apr 26 06:52:15.088653 2026] [:error] [pid 13197:tid 13249] [client 4.232.187.202:17264] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1Fn93kktFKdSxTrBuNBQAAAtE"]
[Sun Apr 26 06:52:16.150722 2026] [:error] [pid 13197:tid 13251] [client 4.232.187.202:11091] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1FoN3kktFKdSxTrBuNBgAAAtM"]
[Sun Apr 26 06:52:17.777925 2026] [:error] [pid 13137:tid 13158] [client 4.232.187.202:53826] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1Fod0RB4J0o4h5neHf2wAAAhE"]
[Sun Apr 26 06:52:18.836069 2026] [:error] [pid 13196:tid 13227] [client 4.232.187.202:11087] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1FosqUeXPgssvUw6CKuwAAApc"]
[Sun Apr 26 06:52:20.666334 2026] [:error] [pid 13196:tid 13216] [client 4.232.187.202:42503] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1FpMqUeXPgssvUw6CKvwAAAow"]
[Sun Apr 26 06:52:22.838012 2026] [proxy_fcgi:error] [pid 13197:tid 13241] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:23.853715 2026] [proxy_fcgi:error] [pid 13197:tid 13236] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:24.092822 2026] [proxy_fcgi:error] [pid 13197:tid 13255] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:24.344105 2026] [proxy_fcgi:error] [pid 13197:tid 13237] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:24.582822 2026] [proxy_fcgi:error] [pid 13197:tid 13244] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:26.075535 2026] [proxy_fcgi:error] [pid 13197:tid 13242] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:26.391140 2026] [proxy_fcgi:error] [pid 13197:tid 13248] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:26.994752 2026] [proxy_fcgi:error] [pid 13197:tid 13233] [client 4.232.187.202:53854] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:52:27.305984 2026] [:error] [pid 13197:tid 13238] [client 4.232.187.202:53854] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1Fq93kktFKdSxTrBuNHQAAAsc"]
[Sun Apr 26 06:52:29.254740 2026] [:error] [pid 13197:tid 13232] [client 4.232.187.202:16020] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1Frd3kktFKdSxTrBuNJAAAAsE"]
[Sun Apr 26 06:52:34.407131 2026] [:error] [pid 13196:tid 13207] [client 4.232.187.202:48927] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1FssqUeXPgssvUw6CK3AAAAoM"]
[Sun Apr 26 06:52:37.805304 2026] [:error] [pid 8491:tid 8523] [client 4.232.187.202:7943] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1FtSq7I7e6CJooQM2jcQAAANc"]
[Sun Apr 26 06:52:39.867615 2026] [:error] [pid 13315:tid 13362] [client 4.232.187.202:36096] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1Ftw2NnZnCaSNNhH3BdgAAA9I"]
[Sun Apr 26 06:52:40.998105 2026] [:error] [pid 13315:tid 13350] [client 4.232.187.202:7427] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1FuA2NnZnCaSNNhH3BeAAAA8Y"]
[Sun Apr 26 06:52:42.087284 2026] [:error] [pid 13197:tid 13237] [client 4.232.187.202:46111] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1Fut3kktFKdSxTrBuNLAAAAsY"]
[Sun Apr 26 06:52:42.841685 2026] [:error] [pid 13197:tid 13235] [client 4.232.187.202:44658] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1Fut3kktFKdSxTrBuNLgAAAsQ"]
[Sun Apr 26 06:52:43.917434 2026] [:error] [pid 13137:tid 13141] [client 4.232.187.202:47237] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1Fu90RB4J0o4h5neHf7QAAAgE"]
[Sun Apr 26 06:52:44.780354 2026] [:error] [pid 13197:tid 13253] [client 4.232.187.202:7476] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1FvN3kktFKdSxTrBuNLwAAAtU"]
[Sun Apr 26 06:52:46.987499 2026] [:error] [pid 13315:tid 13348] [client 4.232.187.202:8919] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1Fvg2NnZnCaSNNhH3BgQAAA8Q"]
[Sun Apr 26 06:52:49.137500 2026] [:error] [pid 13137:tid 13142] [client 4.232.187.202:1887] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1Fwd0RB4J0o4h5neHf7wAAAgI"]
[Sun Apr 26 06:52:51.097216 2026] [:error] [pid 13315:tid 13364] [client 4.232.187.202:1713] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1Fww2NnZnCaSNNhH3BhAAAA9Q"]
[Sun Apr 26 06:52:54.520583 2026] [:error] [pid 8491:tid 8510] [client 4.232.187.202:47295] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1Fxiq7I7e6CJooQM2jjwAAAMs"]
[Sun Apr 26 06:52:56.119286 2026] [:error] [pid 8385:tid 8443] [client 4.232.187.202:48460] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1FyDOy7_J84Wx3-oxs-gAAAFM"]
[Sun Apr 26 06:53:03.173742 2026] [:error] [pid 8491:tid 8513] [client 4.232.187.202:17608] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1Fzyq7I7e6CJooQM2jmQAAAM4"]
[Sun Apr 26 06:53:07.214696 2026] [:error] [pid 13315:tid 13362] [client 4.232.187.202:7477] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1F0w2NnZnCaSNNhH3BqAAAA9I"]
[Sun Apr 26 06:53:10.593745 2026] [:error] [pid 13315:tid 13358] [client 4.232.187.202:13012] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1F1g2NnZnCaSNNhH3BsAAAA84"]
[Sun Apr 26 06:53:13.679579 2026] [:error] [pid 8383:tid 8419] [client 4.232.187.202:1717] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1F2dFa2S3EsATMdWPKCwAAABY"]
[Sun Apr 26 06:53:14.834283 2026] [:error] [pid 13196:tid 13216] [client 4.232.187.202:47270] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1F2sqUeXPgssvUw6CK5AAAAow"]
[Sun Apr 26 06:53:17.592156 2026] [:error] [pid 8390:tid 8456] [client 4.232.187.202:34639] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "ae1F3YGPtFK_i9p5yxQj3AAAAIU"]
[Sun Apr 26 06:53:19.666431 2026] [:error] [pid 13315:tid 13350] [client 4.232.187.202:12572] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "ae1F3w2NnZnCaSNNhH3BuAAAA8Y"]
[Sun Apr 26 06:53:20.585816 2026] [:error] [pid 8383:tid 8402] [client 4.232.187.202:1893] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "ae1F4NFa2S3EsATMdWPKGQAAAAU"]
[Sun Apr 26 06:53:22.422000 2026] [:error] [pid 13137:tid 13162] [client 4.232.187.202:34662] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "ae1F4t0RB4J0o4h5neHf_wAAAhU"]
[Sun Apr 26 06:53:23.477517 2026] [:error] [pid 13315:tid 13345] [client 4.232.187.202:36608] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ae1F4w2NnZnCaSNNhH3BwAAAA8E"]
[Sun Apr 26 06:53:25.116893 2026] [:error] [pid 10315:tid 10341] [client 4.232.187.202:18026] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ae1F5aJIw2vjkleLIaC-MQAAARg"]
[Sun Apr 26 06:53:25.845948 2026] [:error] [pid 13137:tid 13145] [client 4.232.187.202:13043] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ae1F5d0RB4J0o4h5neHgAAAAAgU"]
[Sun Apr 26 06:53:27.492470 2026] [proxy_fcgi:error] [pid 13137:tid 13148] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:28.933686 2026] [proxy_fcgi:error] [pid 13137:tid 13151] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:29.511622 2026] [proxy_fcgi:error] [pid 13137:tid 13141] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:31.041978 2026] [proxy_fcgi:error] [pid 13137:tid 13141] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:31.383662 2026] [proxy_fcgi:error] [pid 13137:tid 13142] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:31.737547 2026] [proxy_fcgi:error] [pid 13137:tid 13145] [client 4.232.187.202:48466] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:32.206369 2026] [:error] [pid 13137:tid 13157] [client 4.232.187.202:48466] [client 4.232.187.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ae1F7N0RB4J0o4h5neHgGAAAAhA"]
[Sun Apr 26 06:53:33.858908 2026] [proxy_fcgi:error] [pid 8383:tid 8421] [client 4.232.187.202:12552] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:53:34.494919 2026] [:error] [pid 8383:tid 8400] [client 4.232.187.202:12552] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1F7tFa2S3EsATMdWPKLAAAAAM"]
[Sun Apr 26 06:53:35.220246 2026] [:error] [pid 8491:tid 8512] [client 4.232.187.202:16810] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1F7yq7I7e6CJooQM2jqwAAAM0"]
[Sun Apr 26 06:53:36.468496 2026] [:error] [pid 10315:tid 10321] [client 4.232.187.202:59562] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1F8KJIw2vjkleLIaC-NwAAAQQ"]
[Sun Apr 26 06:53:37.059848 2026] [:error] [pid 13197:tid 13256] [client 4.232.187.202:34668] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1F8d3kktFKdSxTrBuNZwAAAtg"]
[Sun Apr 26 06:53:38.420686 2026] [:error] [pid 8383:tid 8403] [client 4.232.187.202:36630] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1F8tFa2S3EsATMdWPKMgAAAAY"]
[Sun Apr 26 06:53:39.629933 2026] [:error] [pid 8383:tid 8420] [client 4.232.187.202:32059] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1F89Fa2S3EsATMdWPKNwAAABc"]
[Sun Apr 26 06:53:40.464716 2026] [:error] [pid 13197:tid 13250] [client 4.232.187.202:59556] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1F9N3kktFKdSxTrBuNaQAAAtI"]
[Sun Apr 26 06:53:42.189637 2026] [:error] [pid 13315:tid 13344] [client 4.232.187.202:43080] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1F9g2NnZnCaSNNhH3B3QAAA8A"]
[Sun Apr 26 06:53:43.953927 2026] [:error] [pid 8390:tid 8465] [client 4.232.187.202:8941] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "ae1F94GPtFK_i9p5yxQj7gAAAI4"]
[Sun Apr 26 06:53:44.791223 2026] [:error] [pid 13315:tid 13360] [client 4.232.187.202:59524] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "ae1F-A2NnZnCaSNNhH3B5AAAA9A"]
[Sun Apr 26 06:53:45.806100 2026] [:error] [pid 13315:tid 13353] [client 4.232.187.202:1678] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "ae1F-Q2NnZnCaSNNhH3B5QAAA8k"]
[Sun Apr 26 06:53:46.747561 2026] [:error] [pid 13137:tid 13142] [client 4.232.187.202:8906] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev.php"] [unique_id "ae1F-t0RB4J0o4h5neHgIgAAAgI"]
[Sun Apr 26 06:53:47.851715 2026] [:error] [pid 13197:tid 13232] [client 4.232.187.202:59579] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1F-93kktFKdSxTrBuNbwAAAsE"]
[Sun Apr 26 06:53:48.773050 2026] [:error] [pid 13137:tid 13153] [client 4.232.187.202:48502] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1F_N0RB4J0o4h5neHgJwAAAgw"]
[Sun Apr 26 06:53:50.820107 2026] [:error] [pid 13315:tid 13365] [client 4.232.187.202:32060] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1F_g2NnZnCaSNNhH3B6gAAA9U"]
[Sun Apr 26 06:53:52.642925 2026] [:error] [pid 13197:tid 13245] [client 4.232.187.202:35178] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1GAN3kktFKdSxTrBuNdAAAAs0"]
[Sun Apr 26 06:53:53.586823 2026] [:error] [pid 13137:tid 13151] [client 4.232.187.202:59525] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1GAd0RB4J0o4h5neHgKQAAAgo"]
[Sun Apr 26 06:53:54.736040 2026] [:error] [pid 13137:tid 13161] [client 4.232.187.202:39109] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1GAt0RB4J0o4h5neHgLwAAAhQ"]
[Sun Apr 26 06:53:55.438131 2026] [:error] [pid 41906:tid 41931] [client 4.232.187.202:16794] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1GAz3-0A3lxw9OXoA0CQAAAZc"]
[Sun Apr 26 06:53:56.371924 2026] [:error] [pid 8390:tid 8475] [client 4.232.187.202:20273] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1GBIGPtFK_i9p5yxQj8QAAAJg"]
[Sun Apr 26 06:53:57.622838 2026] [:error] [pid 13315:tid 13360] [client 4.232.187.202:39161] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1GBQ2NnZnCaSNNhH3B7wAAA9A"]
[Sun Apr 26 06:54:00.235453 2026] [:error] [pid 13315:tid 13350] [client 4.232.187.202:48456] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1GCA2NnZnCaSNNhH3B8gAAA8Y"]
[Sun Apr 26 06:54:01.765623 2026] [:error] [pid 8383:tid 8413] [client 4.232.187.202:48496] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1GCdFa2S3EsATMdWPKSwAAABA"]
[Sun Apr 26 06:54:03.013184 2026] [:error] [pid 13315:tid 13353] [client 4.232.187.202:32019] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1GCw2NnZnCaSNNhH3CBQAAA8k"]
[Sun Apr 26 06:54:04.714495 2026] [:error] [pid 13197:tid 13249] [client 4.232.187.202:36170] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1GDN3kktFKdSxTrBuNfwAAAtE"]
[Sun Apr 26 06:54:07.237954 2026] [:error] [pid 8491:tid 8507] [client 4.232.187.202:36627] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1GDyq7I7e6CJooQM2jvQAAAMg"]
[Sun Apr 26 06:54:08.391478 2026] [:error] [pid 13315:tid 13367] [client 4.232.187.202:16814] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1GEA2NnZnCaSNNhH3CJAAAA9c"]
[Sun Apr 26 06:54:10.118431 2026] [:error] [pid 13315:tid 13359] [client 4.232.187.202:48497] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1GEg2NnZnCaSNNhH3CKAAAA88"]
[Sun Apr 26 06:54:11.408114 2026] [:error] [pid 13197:tid 13245] [client 4.232.187.202:35161] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1GE93kktFKdSxTrBuNgwAAAs0"]
[Sun Apr 26 06:54:12.491008 2026] [:error] [pid 41906:tid 41922] [client 4.232.187.202:36640] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1GFD3-0A3lxw9OXoA0EwAAAY4"]
[Sun Apr 26 06:54:13.999755 2026] [:error] [pid 13197:tid 13255] [client 4.232.187.202:20226] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1GFd3kktFKdSxTrBuNjwAAAtc"]
[Sun Apr 26 06:54:15.262167 2026] [:error] [pid 13315:tid 13357] [client 4.232.187.202:16772] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1GFw2NnZnCaSNNhH3CMQAAA80"]
[Sun Apr 26 06:54:16.474098 2026] [:error] [pid 8390:tid 8453] [client 4.232.187.202:36195] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1GGIGPtFK_i9p5yxQkBwAAAII"]
[Sun Apr 26 06:54:17.830701 2026] [:error] [pid 13197:tid 13256] [client 4.232.187.202:7350] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1GGd3kktFKdSxTrBuNnAAAAtg"]
[Sun Apr 26 06:54:19.411666 2026] [:error] [pid 8390:tid 8464] [client 4.232.187.202:19497] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1GG4GPtFK_i9p5yxQkCwAAAI0"]
[Sun Apr 26 06:54:20.709000 2026] [:error] [pid 13315:tid 13350] [client 4.232.187.202:19490] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ae1GHA2NnZnCaSNNhH3CPgAAA8Y"]
[Sun Apr 26 06:54:21.630397 2026] [:error] [pid 13197:tid 13237] [client 4.232.187.202:39114] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ae1GHd3kktFKdSxTrBuNpAAAAsY"]
[Sun Apr 26 06:54:22.487143 2026] [:error] [pid 10315:tid 10336] [client 4.232.187.202:16816] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ae1GHqJIw2vjkleLIaC-QwAAARM"]
[Sun Apr 26 06:54:23.494287 2026] [:error] [pid 41906:tid 41929] [client 4.232.187.202:48459] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ae1GHz3-0A3lxw9OXoA0GAAAAZU"]
[Sun Apr 26 06:54:24.823986 2026] [:error] [pid 10315:tid 10338] [client 4.232.187.202:36178] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axx.php"] [unique_id "ae1GIKJIw2vjkleLIaC-RQAAARU"]
[Sun Apr 26 06:54:25.674727 2026] [:error] [pid 10315:tid 10331] [client 4.232.187.202:39130] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ae1GIaJIw2vjkleLIaC-RwAAAQ4"]
[Sun Apr 26 06:54:26.986154 2026] [:error] [pid 8383:tid 8419] [client 4.232.187.202:48451] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ae1GItFa2S3EsATMdWPKWAAAABY"]
[Sun Apr 26 06:54:27.883154 2026] [:error] [pid 8385:tid 8440] [client 4.232.187.202:48451] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ae1GIzOy7_J84Wx3-oxtPAAAAFA"]
[Sun Apr 26 06:54:29.559093 2026] [:error] [pid 8383:tid 8410] [client 4.232.187.202:59581] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfashell.php"] [unique_id "ae1GJdFa2S3EsATMdWPKYQAAAA0"]
[Sun Apr 26 06:54:30.532191 2026] [:error] [pid 8383:tid 8398] [client 4.232.187.202:35189] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ae1GJtFa2S3EsATMdWPKZQAAAAE"]
[Sun Apr 26 06:54:31.208194 2026] [:error] [pid 8385:tid 8434] [client 4.232.187.202:43093] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ae1GJzOy7_J84Wx3-oxtSwAAAEo"]
[Sun Apr 26 06:54:31.931913 2026] [:error] [pid 8383:tid 8414] [client 4.232.187.202:59537] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ae1GJ9Fa2S3EsATMdWPKaQAAABE"]
[Sun Apr 26 06:54:32.874012 2026] [:error] [pid 13137:tid 13154] [client 4.232.187.202:59553] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "ae1GKN0RB4J0o4h5neHgTQAAAg0"]
[Sun Apr 26 06:54:34.364345 2026] [proxy_fcgi:error] [pid 13137:tid 13149] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:34.606934 2026] [proxy_fcgi:error] [pid 13137:tid 13144] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:34.844162 2026] [proxy_fcgi:error] [pid 13137:tid 13162] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:35.429701 2026] [proxy_fcgi:error] [pid 13137:tid 13158] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:35.676755 2026] [proxy_fcgi:error] [pid 13137:tid 13163] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:35.913486 2026] [proxy_fcgi:error] [pid 13137:tid 13160] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:36.255193 2026] [proxy_fcgi:error] [pid 13137:tid 13142] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:36.491676 2026] [proxy_fcgi:error] [pid 13137:tid 13152] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:36.768389 2026] [proxy_fcgi:error] [pid 13137:tid 13153] [client 4.232.187.202:8922] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 06:54:37.325487 2026] [:error] [pid 13137:tid 13146] [client 4.232.187.202:8922] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1GLd0RB4J0o4h5neHgYAAAAgY"]
[Sun Apr 26 06:54:38.593729 2026] [:error] [pid 13197:tid 13247] [client 4.232.187.202:48498] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1GLt3kktFKdSxTrBuNsQAAAs8"]
[Sun Apr 26 06:54:39.970944 2026] [:error] [pid 13137:tid 13151] [client 4.232.187.202:59572] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1GL90RB4J0o4h5neHgYwAAAgo"]
[Sun Apr 26 06:54:41.096758 2026] [:error] [pid 41906:tid 41924] [client 4.232.187.202:36610] [client 4.232.187.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1GMT3-0A3lxw9OXoA0IQAAAZA"]
[Sun Apr 26 07:16:19.320088 2026] [proxy_fcgi:error] [pid 16474:tid 16480] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:19.563469 2026] [proxy_fcgi:error] [pid 16474:tid 16489] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:19.806692 2026] [proxy_fcgi:error] [pid 16474:tid 16490] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:20.050317 2026] [proxy_fcgi:error] [pid 16474:tid 16487] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:20.294040 2026] [proxy_fcgi:error] [pid 16474:tid 16482] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:20.555658 2026] [proxy_fcgi:error] [pid 16474:tid 16484] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:20.799536 2026] [proxy_fcgi:error] [pid 16474:tid 16491] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:21.045076 2026] [proxy_fcgi:error] [pid 16474:tid 16504] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:21.289672 2026] [proxy_fcgi:error] [pid 16474:tid 16492] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:21.538713 2026] [proxy_fcgi:error] [pid 16474:tid 16495] [client 158.158.52.225:14933] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:16:21.796065 2026] [:error] [pid 16474:tid 16479] [client 158.158.52.225:14933] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "ae1LRYkP5tTlMCX8D3qi6AAAAcA"]
[Sun Apr 26 07:16:23.479532 2026] [:error] [pid 16574:tid 16627] [client 158.158.52.225:34877] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "ae1LR35MsX8wRQr99nb6DwAAA1A"]
[Sun Apr 26 07:16:25.111656 2026] [:error] [pid 16574:tid 16643] [client 158.158.52.225:58117] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "ae1LSX5MsX8wRQr99nb6EgAAA1g"]
[Sun Apr 26 07:16:26.472376 2026] [:error] [pid 16574:tid 16608] [client 158.158.52.225:1109] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "ae1LSn5MsX8wRQr99nb6HAAAA0Q"]
[Sun Apr 26 07:16:27.974152 2026] [:error] [pid 16573:tid 16596] [client 158.158.52.225:38461] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "ae1LSwXNFaYgl_cuEbjszQAAAxM"]
[Sun Apr 26 07:16:29.331416 2026] [:error] [pid 16573:tid 16584] [client 158.158.52.225:63199] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "ae1LTQXNFaYgl_cuEbjs0gAAAwc"]
[Sun Apr 26 07:16:30.893199 2026] [:error] [pid 16515:tid 16521] [client 158.158.52.225:31786] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "ae1LTltDrUmgHSvpuLzG3gAAAkM"]
[Sun Apr 26 07:16:34.274829 2026] [:error] [pid 8491:tid 8504] [client 158.158.52.225:31819] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "ae1LUiq7I7e6CJooQM2oawAAAMU"]
[Sun Apr 26 07:16:35.486000 2026] [:error] [pid 16573:tid 16584] [client 158.158.52.225:33143] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "ae1LUwXNFaYgl_cuEbjs4gAAAwc"]
[Sun Apr 26 07:16:36.694717 2026] [:error] [pid 16573:tid 16594] [client 158.158.52.225:16874] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "ae1LVAXNFaYgl_cuEbjs6AAAAxE"]
[Sun Apr 26 07:16:39.201731 2026] [:error] [pid 16573:tid 16580] [client 158.158.52.225:1057] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "ae1LVwXNFaYgl_cuEbjs9AAAAwM"]
[Sun Apr 26 07:16:40.375611 2026] [:error] [pid 16515:tid 16540] [client 158.158.52.225:20095] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "ae1LWFtDrUmgHSvpuLzG7AAAAlY"]
[Sun Apr 26 07:16:42.363683 2026] [:error] [pid 8491:tid 8509] [client 158.158.52.225:39332] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ae1LWiq7I7e6CJooQM2oeQAAAMo"]
[Sun Apr 26 07:16:43.142918 2026] [:error] [pid 16574:tid 16629] [client 158.158.52.225:63155] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ae1LW35MsX8wRQr99nb6PwAAA1E"]
[Sun Apr 26 07:16:44.995210 2026] [:error] [pid 16515:tid 16527] [client 158.158.52.225:33974] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ae1LXFtDrUmgHSvpuLzG8wAAAkk"]
[Sun Apr 26 07:16:46.570130 2026] [:error] [pid 8385:tid 8432] [client 158.158.52.225:1923] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "ae1LXjOy7_J84Wx3-oxw_QAAAEg"]
[Sun Apr 26 07:16:48.526537 2026] [:error] [pid 16573:tid 16597] [client 158.158.52.225:39359] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "ae1LYAXNFaYgl_cuEbjtBAAAAxQ"]
[Sun Apr 26 07:16:50.677056 2026] [:error] [pid 16574:tid 16623] [client 158.158.52.225:1076] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "ae1LYn5MsX8wRQr99nb6TwAAA04"]
[Sun Apr 26 07:16:59.481510 2026] [:error] [pid 16574:tid 16637] [client 158.158.52.225:7549] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "ae1La35MsX8wRQr99nb6aQAAA1U"]
[Sun Apr 26 07:17:01.826150 2026] [:error] [pid 16573:tid 16599] [client 158.158.52.225:43262] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pucci.php"] [unique_id "ae1LbQXNFaYgl_cuEbjtGwAAAxY"]
[Sun Apr 26 07:17:02.864103 2026] [:error] [pid 16573:tid 16589] [client 158.158.52.225:32452] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1LbgXNFaYgl_cuEbjtIQAAAww"]
[Sun Apr 26 07:17:03.949155 2026] [:error] [pid 13137:tid 13165] [client 158.158.52.225:63207] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1Lb90RB4J0o4h5neHjFAAAAhg"]
[Sun Apr 26 07:17:05.266937 2026] [:error] [pid 16515:tid 16527] [client 158.158.52.225:16889] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1LcVtDrUmgHSvpuLzHBgAAAkk"]
[Sun Apr 26 07:17:07.756094 2026] [:error] [pid 8491:tid 8520] [client 158.158.52.225:43272] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/details/"] [unique_id "ae1Lcyq7I7e6CJooQM2oggAAANU"]
[Sun Apr 26 07:17:09.805175 2026] [:error] [pid 8385:tid 8429] [client 158.158.52.225:52399] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1LdTOy7_J84Wx3-oxxBQAAAEU"]
[Sun Apr 26 07:17:11.087609 2026] [:error] [pid 16573:tid 16585] [client 158.158.52.225:12934] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1LdwXNFaYgl_cuEbjtLwAAAwg"]
[Sun Apr 26 07:17:13.112300 2026] [:error] [pid 13137:tid 13141] [client 158.158.52.225:37491] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1Led0RB4J0o4h5neHjFwAAAgE"]
[Sun Apr 26 07:17:14.407633 2026] [:error] [pid 8491:tid 8509] [client 158.158.52.225:42908] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.dj/index.php"] [unique_id "ae1Leiq7I7e6CJooQM2ohAAAAMo"]
[Sun Apr 26 07:17:16.861972 2026] [:error] [pid 16574:tid 16611] [client 158.158.52.225:58114] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1LfH5MsX8wRQr99nb6fAAAA0c"]
[Sun Apr 26 07:17:17.846332 2026] [:error] [pid 16574:tid 16607] [client 158.158.52.225:40375] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1LfX5MsX8wRQr99nb6hQAAA0M"]
[Sun Apr 26 07:17:18.492768 2026] [:error] [pid 16574:tid 16635] [client 158.158.52.225:12962] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1Lfn5MsX8wRQr99nb6igAAA1Q"]
[Sun Apr 26 07:17:19.399884 2026] [:error] [pid 16574:tid 16611] [client 158.158.52.225:1534] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/audio/"] [unique_id "ae1Lf35MsX8wRQr99nb6kQAAA0c"]
[Sun Apr 26 07:17:20.349807 2026] [:error] [pid 16573:tid 16590] [client 158.158.52.225:49359] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "ae1LgAXNFaYgl_cuEbjtOgAAAw0"]
[Sun Apr 26 07:17:22.764077 2026] [proxy_fcgi:error] [pid 8491:tid 8512] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:23.007044 2026] [proxy_fcgi:error] [pid 8491:tid 8517] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:23.250610 2026] [proxy_fcgi:error] [pid 8491:tid 8518] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:23.494775 2026] [proxy_fcgi:error] [pid 8491:tid 8505] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:23.756892 2026] [proxy_fcgi:error] [pid 8491:tid 8511] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:24.000797 2026] [proxy_fcgi:error] [pid 8491:tid 8524] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:24.394030 2026] [proxy_fcgi:error] [pid 8491:tid 8501] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:25.125459 2026] [proxy_fcgi:error] [pid 8491:tid 8520] [client 158.158.52.225:8211] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:17:25.367591 2026] [:error] [pid 8491:tid 8519] [client 158.158.52.225:8211] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1LhSq7I7e6CJooQM2olgAAANQ"]
[Sun Apr 26 07:17:26.861449 2026] [:error] [pid 13197:tid 13242] [client 158.158.52.225:46133] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1Lht3kktFKdSxTrBuSXAAAAss"]
[Sun Apr 26 07:17:28.507273 2026] [:error] [pid 8390:tid 8466] [client 158.158.52.225:65339] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1LiIGPtFK_i9p5yxQnugAAAI8"]
[Sun Apr 26 07:17:30.772032 2026] [:error] [pid 16515:tid 16535] [client 158.158.52.225:7739] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "ae1LiltDrUmgHSvpuLzHLQAAAlE"]
[Sun Apr 26 07:17:31.968766 2026] [:error] [pid 16573:tid 16588] [client 158.158.52.225:45467] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1LiwXNFaYgl_cuEbjtbQAAAws"]
[Sun Apr 26 07:17:34.266060 2026] [:error] [pid 16574:tid 16629] [client 158.158.52.225:54308] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1Ljn5MsX8wRQr99nb6pwAAA1E"]
[Sun Apr 26 07:17:35.758523 2026] [:error] [pid 16574:tid 16614] [client 158.158.52.225:33599] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1Lj35MsX8wRQr99nb6rgAAA0o"]
[Sun Apr 26 07:17:38.515224 2026] [:error] [pid 16515:tid 16541] [client 158.158.52.225:48755] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "ae1LkltDrUmgHSvpuLzHSwAAAlc"]
[Sun Apr 26 07:17:41.088803 2026] [:error] [pid 8491:tid 8517] [client 158.158.52.225:14217] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1LlSq7I7e6CJooQM2ooQAAANI"]
[Sun Apr 26 07:17:44.548532 2026] [:error] [pid 8491:tid 8524] [client 158.158.52.225:43543] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1LmCq7I7e6CJooQM2opAAAANg"]
[Sun Apr 26 07:17:50.050755 2026] [:error] [pid 16574:tid 16619] [client 158.158.52.225:27189] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ref.php"] [unique_id "ae1Lnn5MsX8wRQr99nb60QAAA0w"]
[Sun Apr 26 07:17:56.103253 2026] [:error] [pid 16573:tid 16582] [client 158.158.52.225:8304] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "ae1LpAXNFaYgl_cuEbjtlAAAAwU"]
[Sun Apr 26 07:17:58.064439 2026] [:error] [pid 16573:tid 16589] [client 158.158.52.225:42988] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "ae1LpgXNFaYgl_cuEbjtogAAAww"]
[Sun Apr 26 07:17:59.179573 2026] [:error] [pid 16573:tid 16599] [client 158.158.52.225:1452] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "ae1LpwXNFaYgl_cuEbjtqgAAAxY"]
[Sun Apr 26 07:18:00.495353 2026] [:error] [pid 16515:tid 16538] [client 158.158.52.225:49887] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "ae1LqFtDrUmgHSvpuLzHYAAAAlQ"]
[Sun Apr 26 07:18:01.132217 2026] [:error] [pid 16515:tid 16520] [client 158.158.52.225:20089] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "ae1LqVtDrUmgHSvpuLzHYgAAAkI"]
[Sun Apr 26 07:18:03.029076 2026] [:error] [pid 16573:tid 16596] [client 158.158.52.225:9074] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "ae1LqwXNFaYgl_cuEbjtsAAAAxM"]
[Sun Apr 26 07:18:06.918960 2026] [:error] [pid 16573:tid 16595] [client 158.158.52.225:28720] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "ae1LrgXNFaYgl_cuEbjtswAAAxI"]
[Sun Apr 26 07:18:10.425941 2026] [:error] [pid 16515:tid 16521] [client 158.158.52.225:27186] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "ae1LsltDrUmgHSvpuLzHeAAAAkM"]
[Sun Apr 26 07:18:15.034299 2026] [:error] [pid 16573:tid 16587] [client 158.158.52.225:28042] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "ae1LtwXNFaYgl_cuEbjtxgAAAwo"]
[Sun Apr 26 07:18:18.587824 2026] [:error] [pid 16474:tid 16480] [client 158.158.52.225:10794] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "ae1LuokP5tTlMCX8D3qjNAAAAcE"]
[Sun Apr 26 07:18:21.958518 2026] [:error] [pid 16573:tid 16585] [client 158.158.52.225:8773] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "ae1LvQXNFaYgl_cuEbjtzQAAAwg"]
[Sun Apr 26 07:18:24.317849 2026] [:error] [pid 8491:tid 8523] [client 158.158.52.225:10755] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "ae1LwCq7I7e6CJooQM2o4AAAANc"]
[Sun Apr 26 07:18:25.526412 2026] [proxy_fcgi:error] [pid 16573:tid 16583] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:25.853426 2026] [proxy_fcgi:error] [pid 16573:tid 16591] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:26.359212 2026] [proxy_fcgi:error] [pid 16573:tid 16582] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:26.621645 2026] [proxy_fcgi:error] [pid 16573:tid 16589] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:26.882048 2026] [proxy_fcgi:error] [pid 16573:tid 16585] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:27.161148 2026] [proxy_fcgi:error] [pid 16573:tid 16596] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:27.503529 2026] [proxy_fcgi:error] [pid 16573:tid 16577] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:27.759034 2026] [proxy_fcgi:error] [pid 16573:tid 16590] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:28.001430 2026] [proxy_fcgi:error] [pid 16573:tid 16578] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:28.311787 2026] [proxy_fcgi:error] [pid 16573:tid 16587] [client 158.158.52.225:13690] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:18:28.551464 2026] [:error] [pid 16573:tid 16600] [client 158.158.52.225:13690] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1LxAXNFaYgl_cuEbjt6gAAAxc"]
[Sun Apr 26 07:18:30.740416 2026] [:error] [pid 16515:tid 16533] [client 158.158.52.225:53721] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1LxltDrUmgHSvpuLzHlAAAAk8"]
[Sun Apr 26 07:18:32.488913 2026] [:error] [pid 8383:tid 8411] [client 158.158.52.225:45536] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1LyNFa2S3EsATMdWPONQAAAA4"]
[Sun Apr 26 07:18:33.475097 2026] [:error] [pid 16573:tid 16585] [client 158.158.52.225:25620] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "ae1LyQXNFaYgl_cuEbjt8wAAAwg"]
[Sun Apr 26 07:18:34.418552 2026] [:error] [pid 16515:tid 16540] [client 158.158.52.225:7813] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1LyltDrUmgHSvpuLzHmgAAAlY"]
[Sun Apr 26 07:18:35.899079 2026] [:error] [pid 16573:tid 16590] [client 158.158.52.225:62444] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1LywXNFaYgl_cuEbjt9QAAAw0"]
[Sun Apr 26 07:18:40.740727 2026] [:error] [pid 16573:tid 16588] [client 158.158.52.225:37765] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1L0AXNFaYgl_cuEbjuEQAAAws"]
[Sun Apr 26 07:18:42.313664 2026] [:error] [pid 16474:tid 16489] [client 158.158.52.225:26989] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "ae1L0okP5tTlMCX8D3qjSgAAAco"]
[Sun Apr 26 07:18:44.504751 2026] [:error] [pid 16573:tid 16581] [client 158.158.52.225:10820] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1L1AXNFaYgl_cuEbjuFgAAAwQ"]
[Sun Apr 26 07:18:53.500299 2026] [:error] [pid 8383:tid 8420] [client 158.158.52.225:53010] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1L3dFa2S3EsATMdWPOPwAAABc"]
[Sun Apr 26 07:18:54.333360 2026] [:error] [pid 13137:tid 13148] [client 158.158.52.225:53053] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1L3t0RB4J0o4h5neHjOAAAAgg"]
[Sun Apr 26 07:18:55.433349 2026] [:error] [pid 16474:tid 16495] [client 158.158.52.225:26957] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "ae1L34kP5tTlMCX8D3qjUAAAAc8"]
[Sun Apr 26 07:18:57.510281 2026] [:error] [pid 16515:tid 16539] [client 158.158.52.225:42265] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1L4VtDrUmgHSvpuLzHvgAAAlU"]
[Sun Apr 26 07:19:02.140146 2026] [:error] [pid 16574:tid 16623] [client 158.158.52.225:48698] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "ae1L5n5MsX8wRQr99nb74wAAA04"]
[Sun Apr 26 07:19:17.847023 2026] [:error] [pid 16573:tid 16593] [client 158.158.52.225:44269] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1L9QXNFaYgl_cuEbjuaQAAAxA"]
[Sun Apr 26 07:19:20.152995 2026] [:error] [pid 16573:tid 16597] [client 158.158.52.225:37879] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1L-AXNFaYgl_cuEbjubgAAAxQ"]
[Sun Apr 26 07:19:21.784848 2026] [:error] [pid 13197:tid 13236] [client 158.158.52.225:25772] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1L-d3kktFKdSxTrBuSnQAAAsU"]
[Sun Apr 26 07:19:22.468832 2026] [:error] [pid 8390:tid 8471] [client 158.158.52.225:33065] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "ae1L-oGPtFK_i9p5yxQoRgAAAJQ"]
[Sun Apr 26 07:19:24.492553 2026] [:error] [pid 8491:tid 8507] [client 158.158.52.225:35688] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ae1L_Cq7I7e6CJooQM2o-AAAAMg"]
[Sun Apr 26 07:19:26.836496 2026] [:error] [pid 8491:tid 8500] [client 158.158.52.225:44196] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ae1L_iq7I7e6CJooQM2o-wAAAME"]
[Sun Apr 26 07:19:28.558374 2026] [proxy_fcgi:error] [pid 16515:tid 16542] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:28.818407 2026] [proxy_fcgi:error] [pid 16515:tid 16525] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:29.426713 2026] [proxy_fcgi:error] [pid 16515:tid 16531] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:29.687091 2026] [proxy_fcgi:error] [pid 16515:tid 16535] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:29.945344 2026] [proxy_fcgi:error] [pid 16515:tid 16530] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:30.400779 2026] [proxy_fcgi:error] [pid 16515:tid 16533] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:30.660890 2026] [proxy_fcgi:error] [pid 16515:tid 16518] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:30.944782 2026] [proxy_fcgi:error] [pid 16515:tid 16537] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:31.223936 2026] [proxy_fcgi:error] [pid 16515:tid 16523] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:31.483042 2026] [proxy_fcgi:error] [pid 16515:tid 16528] [client 158.158.52.225:49804] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:19:31.738340 2026] [:error] [pid 16515:tid 16521] [client 158.158.52.225:49804] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1MA1tDrUmgHSvpuLzH2wAAAkM"]
[Sun Apr 26 07:19:34.502035 2026] [:error] [pid 8491:tid 8518] [client 158.158.52.225:8558] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1MBiq7I7e6CJooQM2o_gAAANM"]
[Sun Apr 26 07:19:36.013484 2026] [:error] [pid 16573:tid 16594] [client 158.158.52.225:37864] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/4.php"] [unique_id "ae1MCAXNFaYgl_cuEbjuhgAAAxE"]
[Sun Apr 26 07:19:50.441049 2026] [:error] [pid 16474:tid 16487] [client 158.158.52.225:1662] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1MFokP5tTlMCX8D3qjbAAAAcg"]
[Sun Apr 26 07:19:53.896848 2026] [:error] [pid 16573:tid 16594] [client 158.158.52.225:8550] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1MGQXNFaYgl_cuEbjuzAAAAxE"]
[Sun Apr 26 07:19:56.333766 2026] [:error] [pid 8491:tid 8515] [client 158.158.52.225:20868] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1MHCq7I7e6CJooQM2pBAAAANA"]
[Sun Apr 26 07:20:00.833454 2026] [:error] [pid 16574:tid 16631] [client 158.158.52.225:35512] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/5.php"] [unique_id "ae1MIH5MsX8wRQr99nb8UgAAA1I"]
[Sun Apr 26 07:20:10.819607 2026] [:error] [pid 8385:tid 8438] [client 158.158.52.225:13606] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1MKjOy7_J84Wx3-oxxNQAAAE4"]
[Sun Apr 26 07:20:12.702793 2026] [:error] [pid 16474:tid 16489] [client 158.158.52.225:46185] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1MLIkP5tTlMCX8D3qjggAAAco"]
[Sun Apr 26 07:20:14.861578 2026] [:error] [pid 16474:tid 16490] [client 158.158.52.225:26323] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6.php"] [unique_id "ae1MLokP5tTlMCX8D3qjhQAAAcs"]
[Sun Apr 26 07:20:28.061704 2026] [:error] [pid 16574:tid 16614] [client 158.158.52.225:1795] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/9.php"] [unique_id "ae1MPH5MsX8wRQr99nb8ZQAAA0o"]
[Sun Apr 26 07:20:32.207528 2026] [proxy_fcgi:error] [pid 16573:tid 16601] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:32.755700 2026] [proxy_fcgi:error] [pid 16573:tid 16592] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:33.014871 2026] [proxy_fcgi:error] [pid 16573:tid 16583] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:33.273708 2026] [proxy_fcgi:error] [pid 16573:tid 16588] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:33.532856 2026] [proxy_fcgi:error] [pid 16573:tid 16586] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:33.793251 2026] [proxy_fcgi:error] [pid 16573:tid 16594] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:34.052350 2026] [proxy_fcgi:error] [pid 16573:tid 16580] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:34.311364 2026] [proxy_fcgi:error] [pid 16573:tid 16577] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:34.588899 2026] [proxy_fcgi:error] [pid 16573:tid 16582] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:34.847918 2026] [proxy_fcgi:error] [pid 16573:tid 16589] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:35.137833 2026] [proxy_fcgi:error] [pid 16573:tid 16599] [client 158.158.52.225:8328] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:20:35.398682 2026] [:error] [pid 16573:tid 16579] [client 158.158.52.225:8328] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1MQwXNFaYgl_cuEbjvAQAAAwI"]
[Sun Apr 26 07:20:37.433374 2026] [:error] [pid 16574:tid 16639] [client 158.158.52.225:33027] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1MRX5MsX8wRQr99nb8eQAAA1Y"]
[Sun Apr 26 07:20:38.659986 2026] [:error] [pid 16574:tid 16607] [client 158.158.52.225:29960] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1MRn5MsX8wRQr99nb8ewAAA0M"]
[Sun Apr 26 07:20:39.976888 2026] [:error] [pid 16574:tid 16633] [client 158.158.52.225:8920] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "ae1MR35MsX8wRQr99nb8fgAAA1M"]
[Sun Apr 26 07:20:41.482789 2026] [:error] [pid 16574:tid 16641] [client 158.158.52.225:8954] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1MSX5MsX8wRQr99nb8hQAAA1c"]
[Sun Apr 26 07:20:42.909730 2026] [:error] [pid 16574:tid 16606] [client 158.158.52.225:20611] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1MSn5MsX8wRQr99nb8iwAAA0I"]
[Sun Apr 26 07:20:44.590304 2026] [:error] [pid 8383:tid 8398] [client 158.158.52.225:44215] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1MTNFa2S3EsATMdWPOZQAAAAE"]
[Sun Apr 26 07:20:46.221970 2026] [:error] [pid 16515:tid 16530] [client 158.158.52.225:26331] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ae1MTltDrUmgHSvpuLzIBAAAAkw"]
[Sun Apr 26 07:20:49.297102 2026] [:error] [pid 16573:tid 16582] [client 158.158.52.225:8556] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1MUQXNFaYgl_cuEbjvBgAAAwU"]
[Sun Apr 26 07:20:50.526447 2026] [:error] [pid 16574:tid 16641] [client 158.158.52.225:8323] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1MUn5MsX8wRQr99nb8pAAAA1c"]
[Sun Apr 26 07:20:52.154173 2026] [:error] [pid 8390:tid 8469] [client 158.158.52.225:46764] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1MVIGPtFK_i9p5yxQoZwAAAJI"]
[Sun Apr 26 07:20:53.201860 2026] [:error] [pid 16515:tid 16526] [client 158.158.52.225:34200] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "ae1MVVtDrUmgHSvpuLzIBwAAAkg"]
[Sun Apr 26 07:20:56.749425 2026] [:error] [pid 16573:tid 16592] [client 158.158.52.225:7223] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1MWAXNFaYgl_cuEbjvDwAAAw8"]
[Sun Apr 26 07:20:59.061395 2026] [:error] [pid 16474:tid 16503] [client 158.158.52.225:33050] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1MW4kP5tTlMCX8D3qjrAAAAdc"]
[Sun Apr 26 07:21:02.114986 2026] [:error] [pid 16474:tid 16497] [client 158.158.52.225:13614] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1MXokP5tTlMCX8D3qjsgAAAdE"]
[Sun Apr 26 07:21:03.952427 2026] [:error] [pid 13137:tid 13149] [client 158.158.52.225:7231] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uuu.php"] [unique_id "ae1MX90RB4J0o4h5neHjTQAAAgk"]
[Sun Apr 26 07:21:06.650094 2026] [:error] [pid 16515:tid 16525] [client 158.158.52.225:8349] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1MYltDrUmgHSvpuLzIEQAAAkc"]
[Sun Apr 26 07:21:07.978600 2026] [:error] [pid 8390:tid 8454] [client 158.158.52.225:20620] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1MY4GPtFK_i9p5yxQocwAAAIM"]
[Sun Apr 26 07:21:08.676152 2026] [:error] [pid 13197:tid 13232] [client 158.158.52.225:35462] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1MZN3kktFKdSxTrBuSwgAAAsE"]
[Sun Apr 26 07:21:11.078476 2026] [:error] [pid 16515:tid 16519] [client 158.158.52.225:7179] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "ae1MZ1tDrUmgHSvpuLzIEgAAAkE"]
[Sun Apr 26 07:21:19.046372 2026] [:error] [pid 8390:tid 8474] [client 158.158.52.225:34217] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ae1Mb4GPtFK_i9p5yxQodwAAAJc"]
[Sun Apr 26 07:21:20.567866 2026] [:error] [pid 16573:tid 16585] [client 158.158.52.225:26318] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ae1McAXNFaYgl_cuEbjvFwAAAwg"]
[Sun Apr 26 07:21:21.891783 2026] [:error] [pid 16574:tid 16631] [client 158.158.52.225:7490] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ae1McX5MsX8wRQr99nb8ygAAA1I"]
[Sun Apr 26 07:21:23.060326 2026] [:error] [pid 8390:tid 8465] [client 158.158.52.225:1631] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "ae1Mc4GPtFK_i9p5yxQoeQAAAI4"]
[Sun Apr 26 07:21:25.036063 2026] [:error] [pid 13137:tid 13148] [client 158.158.52.225:7536] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ae1Mdd0RB4J0o4h5neHjUQAAAgg"]
[Sun Apr 26 07:21:26.156500 2026] [:error] [pid 8491:tid 8524] [client 158.158.52.225:17431] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ae1Mdiq7I7e6CJooQM2pRAAAANg"]
[Sun Apr 26 07:21:27.049944 2026] [:error] [pid 16474:tid 16484] [client 158.158.52.225:8879] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ae1Md4kP5tTlMCX8D3qjuwAAAcU"]
[Sun Apr 26 07:21:27.911877 2026] [:error] [pid 8383:tid 8404] [client 158.158.52.225:49887] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "ae1Md9Fa2S3EsATMdWPObwAAAAc"]
[Sun Apr 26 07:21:29.639674 2026] [:error] [pid 8383:tid 8420] [client 158.158.52.225:43248] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ae1MedFa2S3EsATMdWPOcwAAABc"]
[Sun Apr 26 07:21:31.486560 2026] [:error] [pid 16474:tid 16494] [client 158.158.52.225:27236] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ae1Me4kP5tTlMCX8D3qjxAAAAc4"]
[Sun Apr 26 07:21:32.991283 2026] [:error] [pid 16515:tid 16531] [client 158.158.52.225:62390] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a2.php"] [unique_id "ae1MfFtDrUmgHSvpuLzIVQAAAk0"]
[Sun Apr 26 07:21:39.898920 2026] [proxy_fcgi:error] [pid 16573:tid 16592] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:40.142738 2026] [proxy_fcgi:error] [pid 16573:tid 16594] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:40.385647 2026] [proxy_fcgi:error] [pid 16573:tid 16582] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:40.904935 2026] [proxy_fcgi:error] [pid 16573:tid 16587] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:41.147270 2026] [proxy_fcgi:error] [pid 16573:tid 16578] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:41.409222 2026] [proxy_fcgi:error] [pid 16573:tid 16579] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:41.652859 2026] [proxy_fcgi:error] [pid 16573:tid 16584] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:41.896750 2026] [proxy_fcgi:error] [pid 16573:tid 16593] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:42.142466 2026] [proxy_fcgi:error] [pid 16573:tid 16601] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:42.405763 2026] [proxy_fcgi:error] [pid 16573:tid 16597] [client 158.158.52.225:29373] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:21:42.644342 2026] [:error] [pid 16573:tid 16585] [client 158.158.52.225:29373] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1MhgXNFaYgl_cuEbjvRAAAAwg"]
[Sun Apr 26 07:21:45.592733 2026] [:error] [pid 13197:tid 13233] [client 158.158.52.225:1697] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1Mid3kktFKdSxTrBuS0gAAAsI"]
[Sun Apr 26 07:21:48.699866 2026] [:error] [pid 8491:tid 8506] [client 158.158.52.225:14914] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "ae1MjCq7I7e6CJooQM2pWAAAAMc"]
[Sun Apr 26 07:22:04.580583 2026] [:error] [pid 16574:tid 16637] [client 158.158.52.225:40409] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1MnH5MsX8wRQr99nb89AAAA1U"]
[Sun Apr 26 07:22:06.257714 2026] [:error] [pid 16573:tid 16596] [client 158.158.52.225:37503] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1MngXNFaYgl_cuEbjvowAAAxM"]
[Sun Apr 26 07:22:07.608036 2026] [:error] [pid 13137:tid 13159] [client 158.158.52.225:15581] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1Mn90RB4J0o4h5neHjWgAAAhI"]
[Sun Apr 26 07:22:09.303128 2026] [:error] [pid 13197:tid 13248] [client 158.158.52.225:1100] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "ae1Mod3kktFKdSxTrBuS5QAAAtA"]
[Sun Apr 26 07:22:11.842894 2026] [:error] [pid 16515:tid 16521] [client 158.158.52.225:1127] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1Mo1tDrUmgHSvpuLzIpQAAAkM"]
[Sun Apr 26 07:22:12.641709 2026] [:error] [pid 16574:tid 16619] [client 158.158.52.225:1757] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1MpH5MsX8wRQr99nb9AwAAA0w"]
[Sun Apr 26 07:22:13.829046 2026] [:error] [pid 16573:tid 16594] [client 158.158.52.225:18717] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1MpQXNFaYgl_cuEbjvuAAAAxE"]
[Sun Apr 26 07:22:14.525501 2026] [:error] [pid 16574:tid 16614] [client 158.158.52.225:48077] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae1Mpn5MsX8wRQr99nb9BgAAA0o"]
[Sun Apr 26 07:22:17.827338 2026] [:error] [pid 8491:tid 8507] [client 158.158.52.225:49353] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1MqSq7I7e6CJooQM2pZwAAAMg"]
[Sun Apr 26 07:22:19.835687 2026] [:error] [pid 8491:tid 8510] [client 158.158.52.225:55008] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1Mqyq7I7e6CJooQM2pagAAAMs"]
[Sun Apr 26 07:22:21.065057 2026] [:error] [pid 8491:tid 8520] [client 158.158.52.225:54993] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1MrSq7I7e6CJooQM2pcAAAANU"]
[Sun Apr 26 07:22:22.395156 2026] [:error] [pid 8491:tid 8499] [client 158.158.52.225:14253] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ae1Mriq7I7e6CJooQM2pcgAAAMA"]
[Sun Apr 26 07:22:24.378094 2026] [:error] [pid 16474:tid 16503] [client 158.158.52.225:33092] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1MsIkP5tTlMCX8D3qj4wAAAdc"]
[Sun Apr 26 07:22:31.309354 2026] [:error] [pid 16515:tid 16541] [client 158.158.52.225:19352] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1Mt1tDrUmgHSvpuLzItAAAAlc"]
[Sun Apr 26 07:22:34.576821 2026] [:error] [pid 16474:tid 16480] [client 158.158.52.225:45448] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1MuokP5tTlMCX8D3qkFwAAAcE"]
[Sun Apr 26 07:22:37.153397 2026] [:error] [pid 8390:tid 8452] [client 158.158.52.225:45440] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "ae1MvYGPtFK_i9p5yxQozgAAAIE"]
[Sun Apr 26 07:22:38.364274 2026] [:error] [pid 8491:tid 8520] [client 158.158.52.225:8060] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1Mviq7I7e6CJooQM2pqQAAANU"]
[Sun Apr 26 07:22:40.026512 2026] [:error] [pid 13137:tid 13147] [client 158.158.52.225:8035] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1MwN0RB4J0o4h5neHjmQAAAgc"]
[Sun Apr 26 07:22:40.967009 2026] [:error] [pid 13137:tid 13146] [client 158.158.52.225:8056] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "ae1MwN0RB4J0o4h5neHjmwAAAgY"]
[Sun Apr 26 07:22:44.099904 2026] [proxy_fcgi:error] [pid 22572:tid 22594] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:45.014656 2026] [proxy_fcgi:error] [pid 22572:tid 22591] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:45.296574 2026] [proxy_fcgi:error] [pid 22572:tid 22600] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:45.563283 2026] [proxy_fcgi:error] [pid 22572:tid 22584] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:45.824999 2026] [proxy_fcgi:error] [pid 22572:tid 22582] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:46.085093 2026] [proxy_fcgi:error] [pid 22572:tid 22580] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:46.530022 2026] [proxy_fcgi:error] [pid 22572:tid 22579] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:46.791701 2026] [proxy_fcgi:error] [pid 22572:tid 22581] [client 158.158.52.225:8418] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:22:47.774386 2026] [:error] [pid 22572:tid 22587] [client 158.158.52.225:8418] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1Mx9XOViWCFU-pZzBwtQAAAUk"]
[Sun Apr 26 07:22:52.467019 2026] [:error] [pid 22572:tid 22583] [client 158.158.52.225:62296] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1MzNXOViWCFU-pZzBwuwAAAUU"]
[Sun Apr 26 07:22:57.828506 2026] [:error] [pid 16515:tid 16518] [client 158.158.52.225:8808] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1M0VtDrUmgHSvpuLzI6gAAAkA"]
[Sun Apr 26 07:23:00.063441 2026] [:error] [pid 8390:tid 8451] [client 158.158.52.225:46790] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "ae1M1IGPtFK_i9p5yxQo3gAAAIA"]
[Sun Apr 26 07:23:01.473992 2026] [:error] [pid 8390:tid 8454] [client 158.158.52.225:31860] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1M1YGPtFK_i9p5yxQo4QAAAIM"]
[Sun Apr 26 07:23:02.597108 2026] [:error] [pid 8390:tid 8452] [client 158.158.52.225:25611] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1M1oGPtFK_i9p5yxQo4gAAAIE"]
[Sun Apr 26 07:23:04.396505 2026] [:error] [pid 22572:tid 22601] [client 158.158.52.225:7465] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1M2NXOViWCFU-pZzBwxQAAAVc"]
[Sun Apr 26 07:23:06.722057 2026] [:error] [pid 8383:tid 8397] [client 158.158.52.225:46797] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin1.php"] [unique_id "ae1M2tFa2S3EsATMdWPOtAAAAAA"]
[Sun Apr 26 07:23:08.480643 2026] [:error] [pid 13137:tid 13160] [client 158.158.52.225:21995] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1M3N0RB4J0o4h5neHjqQAAAhM"]
[Sun Apr 26 07:23:15.094756 2026] [:error] [pid 8390:tid 8460] [client 158.158.52.225:22703] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1M44GPtFK_i9p5yxQo-QAAAIk"]
[Sun Apr 26 07:23:16.558637 2026] [:error] [pid 22573:tid 22621] [client 158.158.52.225:47813] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1M5HB3EmQlD4yKUt8dCQAAAY4"]
[Sun Apr 26 07:23:18.307047 2026] [:error] [pid 22573:tid 22624] [client 158.158.52.225:22710] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "ae1M5nB3EmQlD4yKUt8dDgAAAZE"]
[Sun Apr 26 07:23:19.732188 2026] [:error] [pid 8390:tid 8468] [client 158.158.52.225:23920] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1M54GPtFK_i9p5yxQpAwAAAJE"]
[Sun Apr 26 07:23:25.377551 2026] [:error] [pid 22572:tid 22579] [client 158.158.52.225:8306] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1M7dXOViWCFU-pZzBw1AAAAUE"]
[Sun Apr 26 07:23:31.909856 2026] [:error] [pid 8385:tid 8425] [client 158.158.52.225:7636] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ae1M8zOy7_J84Wx3-oxxlgAAAEE"]
[Sun Apr 26 07:23:38.222809 2026] [:error] [pid 22572:tid 22578] [client 158.158.52.225:7632] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1M-tXOViWCFU-pZzBw2gAAAUA"]
[Sun Apr 26 07:23:41.613391 2026] [:error] [pid 16515:tid 16521] [client 158.158.52.225:10817] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1M_VtDrUmgHSvpuLzJBQAAAkM"]
[Sun Apr 26 07:23:45.716416 2026] [:error] [pid 22573:tid 22610] [client 158.158.52.225:24417] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "ae1NAXB3EmQlD4yKUt8dOwAAAYQ"]
[Sun Apr 26 07:23:49.110612 2026] [proxy_fcgi:error] [pid 8383:tid 8405] [client 158.158.52.225:28684] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:49.647435 2026] [proxy_fcgi:error] [pid 8383:tid 8402] [client 158.158.52.225:28684] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:50.174354 2026] [proxy_fcgi:error] [pid 8383:tid 8403] [client 158.158.52.225:28684] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:50.452375 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 158.158.52.225:28684] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:52.021507 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 158.158.52.225:28684] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:52.540680 2026] [:error] [pid 8383:tid 8413] [client 158.158.52.225:28684] [client 158.158.52.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ae1NCNFa2S3EsATMdWPO0AAAABA"]
[Sun Apr 26 07:23:53.929193 2026] [proxy_fcgi:error] [pid 8385:tid 8424] [client 158.158.52.225:24433] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:23:54.225313 2026] [:error] [pid 8385:tid 8435] [client 158.158.52.225:24433] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "ae1NCjOy7_J84Wx3-oxxuwAAAEs"]
[Sun Apr 26 07:23:55.013783 2026] [:error] [pid 22572:tid 22594] [client 158.158.52.225:36130] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "ae1NC9XOViWCFU-pZzBw7AAAAVA"]
[Sun Apr 26 07:23:56.275984 2026] [:error] [pid 16515:tid 16530] [client 158.158.52.225:47826] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "ae1NDFtDrUmgHSvpuLzJEQAAAkw"]
[Sun Apr 26 07:23:58.035074 2026] [:error] [pid 8385:tid 8445] [client 158.158.52.225:21908] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "ae1NDjOy7_J84Wx3-oxxwwAAAFU"]
[Sun Apr 26 07:23:59.658683 2026] [:error] [pid 16574:tid 16639] [client 158.158.52.225:9684] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1ND35MsX8wRQr99nb9gQAAA1Y"]
[Sun Apr 26 07:24:00.921876 2026] [:error] [pid 22572:tid 22582] [client 158.158.52.225:21912] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1NENXOViWCFU-pZzBw8wAAAUQ"]
[Sun Apr 26 07:24:02.415125 2026] [:error] [pid 22572:tid 22595] [client 158.158.52.225:20705] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1NEtXOViWCFU-pZzBw9gAAAVE"]
[Sun Apr 26 07:24:05.941951 2026] [:error] [pid 22572:tid 22596] [client 158.158.52.225:45531] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "ae1NFdXOViWCFU-pZzBw-wAAAVI"]
[Sun Apr 26 07:24:06.954516 2026] [:error] [pid 13137:tid 13165] [client 158.158.52.225:33765] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1NFt0RB4J0o4h5neHj-AAAAhg"]
[Sun Apr 26 07:24:07.795080 2026] [:error] [pid 8390:tid 8460] [client 158.158.52.225:1870] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1NF4GPtFK_i9p5yxQpYQAAAIk"]
[Sun Apr 26 07:24:10.541459 2026] [:error] [pid 16574:tid 16619] [client 158.158.52.225:23805] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1NGn5MsX8wRQr99nb9hAAAA0w"]
[Sun Apr 26 07:24:11.427736 2026] [:error] [pid 22573:tid 22612] [client 158.158.52.225:1915] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/k.php"] [unique_id "ae1NG3B3EmQlD4yKUt8dWQAAAYY"]
[Sun Apr 26 07:24:12.621582 2026] [:error] [pid 8385:tid 8436] [client 158.158.52.225:22652] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1NHDOy7_J84Wx3-oxx0AAAAEw"]
[Sun Apr 26 07:24:13.793216 2026] [:error] [pid 8491:tid 8512] [client 158.158.52.225:36164] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1NHSq7I7e6CJooQM2p0gAAAM0"]
[Sun Apr 26 07:24:15.797601 2026] [:error] [pid 22573:tid 22619] [client 158.158.52.225:28720] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1NH3B3EmQlD4yKUt8dYwAAAYw"]
[Sun Apr 26 07:24:17.298451 2026] [:error] [pid 13197:tid 13233] [client 158.158.52.225:33728] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ae1NId3kktFKdSxTrBuTQQAAAsI"]
[Sun Apr 26 07:24:19.206933 2026] [:error] [pid 8390:tid 8454] [client 158.158.52.225:44924] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1NI4GPtFK_i9p5yxQpbwAAAIM"]
[Sun Apr 26 07:24:22.873832 2026] [:error] [pid 22573:tid 22631] [client 158.158.52.225:20698] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1NJnB3EmQlD4yKUt8dawAAAZg"]
[Sun Apr 26 07:24:24.438657 2026] [:error] [pid 8390:tid 8459] [client 158.158.52.225:30580] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1NKIGPtFK_i9p5yxQpdQAAAIg"]
[Sun Apr 26 07:24:29.112125 2026] [:error] [pid 16515:tid 16538] [client 158.158.52.225:14893] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "ae1NLVtDrUmgHSvpuLzJIwAAAlQ"]
[Sun Apr 26 07:24:31.331295 2026] [:error] [pid 13137:tid 13147] [client 158.158.52.225:30572] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1NL90RB4J0o4h5neHj_wAAAgc"]
[Sun Apr 26 07:24:35.286682 2026] [:error] [pid 8385:tid 8431] [client 158.158.52.225:30536] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1NMzOy7_J84Wx3-oxx0wAAAEc"]
[Sun Apr 26 07:24:38.957206 2026] [:error] [pid 22572:tid 22581] [client 158.158.52.225:28041] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1NNtXOViWCFU-pZzBxFgAAAUM"]
[Sun Apr 26 07:24:42.766409 2026] [:error] [pid 22572:tid 22598] [client 158.158.52.225:11882] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gssdd.php"] [unique_id "ae1NOtXOViWCFU-pZzBxGgAAAVQ"]
[Sun Apr 26 07:24:44.021817 2026] [:error] [pid 8390:tid 8469] [client 158.158.52.225:8499] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1NPIGPtFK_i9p5yxQpjgAAAJI"]
[Sun Apr 26 07:24:45.983547 2026] [:error] [pid 8385:tid 8427] [client 158.158.52.225:39100] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1NPTOy7_J84Wx3-oxx1AAAAEM"]
[Sun Apr 26 07:24:47.932600 2026] [:error] [pid 13137:tid 13151] [client 158.158.52.225:7867] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1NP90RB4J0o4h5neHkBwAAAgo"]
[Sun Apr 26 07:24:49.401283 2026] [:error] [pid 22572:tid 22589] [client 158.158.52.225:14890] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "ae1NQdXOViWCFU-pZzBxIgAAAUs"]
[Sun Apr 26 07:24:50.464666 2026] [:error] [pid 8385:tid 8428] [client 158.158.52.225:8642] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1NQjOy7_J84Wx3-oxx1wAAAEQ"]
[Sun Apr 26 07:24:51.843876 2026] [:error] [pid 22572:tid 22601] [client 158.158.52.225:30549] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1NQ9XOViWCFU-pZzBxJQAAAVc"]
[Sun Apr 26 07:24:52.951990 2026] [:error] [pid 22572:tid 22590] [client 158.158.52.225:53038] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "ae1NRNXOViWCFU-pZzBxKAAAAUw"]
[Sun Apr 26 07:24:54.175385 2026] [proxy_fcgi:error] [pid 22573:tid 22607] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:54.825076 2026] [proxy_fcgi:error] [pid 22573:tid 22615] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:55.120839 2026] [proxy_fcgi:error] [pid 22573:tid 22620] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:55.387294 2026] [proxy_fcgi:error] [pid 22573:tid 22627] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:55.631328 2026] [proxy_fcgi:error] [pid 22573:tid 22606] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:56.198297 2026] [proxy_fcgi:error] [pid 22573:tid 22616] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:56.444187 2026] [proxy_fcgi:error] [pid 22573:tid 22613] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:56.751453 2026] [proxy_fcgi:error] [pid 22573:tid 22611] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:56.994129 2026] [proxy_fcgi:error] [pid 22573:tid 22607] [client 158.158.52.225:8643] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 07:24:57.254593 2026] [:error] [pid 22573:tid 22615] [client 158.158.52.225:8643] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ae1NSXB3EmQlD4yKUt8dygAAAYg"]
[Sun Apr 26 07:24:58.488013 2026] [:error] [pid 22573:tid 22627] [client 158.158.52.225:7853] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ae1NSnB3EmQlD4yKUt8dzAAAAZQ"]
[Sun Apr 26 07:25:00.228333 2026] [:error] [pid 22573:tid 22622] [client 158.158.52.225:53077] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ae1NTHB3EmQlD4yKUt8d0wAAAY8"]
[Sun Apr 26 07:25:01.238370 2026] [:error] [pid 8491:tid 8504] [client 158.158.52.225:58065] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file18.php"] [unique_id "ae1NTSq7I7e6CJooQM2p6gAAAMU"]
[Sun Apr 26 07:25:02.838449 2026] [:error] [pid 22573:tid 22607] [client 158.158.52.225:53039] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ae1NTnB3EmQlD4yKUt8d2AAAAYE"]
[Sun Apr 26 07:25:06.451909 2026] [:error] [pid 22573:tid 22612] [client 158.158.52.225:37777] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ae1NUnB3EmQlD4yKUt8d4AAAAYY"]
[Sun Apr 26 07:25:07.928131 2026] [:error] [pid 16574:tid 16619] [client 158.158.52.225:1188] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ae1NU35MsX8wRQr99nb9kAAAA0w"]
[Sun Apr 26 07:25:08.906331 2026] [:error] [pid 8390:tid 8453] [client 158.158.52.225:52995] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "ae1NVIGPtFK_i9p5yxQplQAAAII"]
[Sun Apr 26 07:25:12.032648 2026] [:error] [pid 8390:tid 8466] [client 158.158.52.225:37818] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ae1NWIGPtFK_i9p5yxQpmgAAAI8"]
[Sun Apr 26 07:25:13.441602 2026] [:error] [pid 13197:tid 13239] [client 158.158.52.225:39052] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ae1NWd3kktFKdSxTrBuTWgAAAsg"]
[Sun Apr 26 07:25:17.448849 2026] [:error] [pid 8385:tid 8425] [client 158.158.52.225:48697] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ae1NXTOy7_J84Wx3-oxx5gAAAEE"]
[Sun Apr 26 07:25:18.890701 2026] [:error] [pid 8385:tid 8429] [client 158.158.52.225:24989] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ae1NXjOy7_J84Wx3-oxx6AAAAEU"]
[Sun Apr 26 07:25:21.203359 2026] [:error] [pid 8491:tid 8503] [client 158.158.52.225:39112] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1NYSq7I7e6CJooQM2p7QAAAMQ"]
[Sun Apr 26 07:25:25.050282 2026] [:error] [pid 8390:tid 8457] [client 158.158.52.225:24963] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1NZYGPtFK_i9p5yxQpqAAAAIY"]
[Sun Apr 26 07:25:30.126546 2026] [:error] [pid 8491:tid 8518] [client 158.158.52.225:48647] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1Naiq7I7e6CJooQM2p9AAAANM"]
[Sun Apr 26 07:25:32.047536 2026] [:error] [pid 22572:tid 22597] [client 158.158.52.225:37887] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ae1NbNXOViWCFU-pZzBxPwAAAVM"]
[Sun Apr 26 08:34:34.554435 2026] [:error] [pid 22572:tid 22585] [client 147.135.213.153:33380] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae1dmtXOViWCFU-pZzCDggAAAUc"]
[Sun Apr 26 08:34:36.502920 2026] [:error] [pid 16515:tid 16540] [client 147.135.213.153:43192] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae1dnFtDrUmgHSvpuLzVWwAAAlY"]
[Sun Apr 26 08:34:38.497344 2026] [:error] [pid 8390:tid 8469] [client 147.135.213.153:43194] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae1dnoGPtFK_i9p5yxRDIAAAAJI"]
[Sun Apr 26 08:34:40.515389 2026] [:error] [pid 16515:tid 16537] [client 147.135.213.153:43206] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae1doFtDrUmgHSvpuLzVYQAAAlM"]
[Sun Apr 26 08:34:43.103497 2026] [:error] [pid 22572:tid 22587] [client 147.135.213.153:49940] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae1do9XOViWCFU-pZzCDhAAAAUk"]
[Sun Apr 26 08:34:46.845199 2026] [:error] [pid 8390:tid 8461] [client 147.135.213.153:49954] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae1dpoGPtFK_i9p5yxRDMgAAAIo"]
[Sun Apr 26 10:10:43.171595 2026] [:error] [pid 22573:tid 22625] [client 49.150.108.96:49709] [client 49.150.108.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.150.108.96, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ae10I3B3EmQlD4yKUt9XGAAAAZI"]
[Sun Apr 26 10:10:43.184546 2026] [proxy_fcgi:error] [pid 22573:tid 22625] [client 49.150.108.96:49709] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 10:55:45.809795 2026] [:error] [pid 8390:tid 8468] [client 162.62.213.187:54874] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae1-sYGPtFK_i9p5yxSZtQAAAJE"]
[Sun Apr 26 11:37:57.587334 2026] [:error] [pid 22572:tid 22593] [client 54.38.38.130:44888] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ae2IldXOViWCFU-pZzC8YAAAAU8"]
[Sun Apr 26 11:37:59.917048 2026] [:error] [pid 22573:tid 22612] [client 54.38.38.130:33514] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ae2Il3B3EmQlD4yKUt97hwAAAYY"]
[Sun Apr 26 11:38:01.774548 2026] [:error] [pid 13137:tid 13143] [client 54.38.38.130:50682] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae2Imd0RB4J0o4h5neEe0wAAAgM"]
[Sun Apr 26 11:38:04.362867 2026] [:error] [pid 22572:tid 22588] [client 54.38.38.130:33522] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae2InNXOViWCFU-pZzC8ZAAAAUo"]
[Sun Apr 26 11:38:06.535696 2026] [:error] [pid 16574:tid 16619] [client 54.38.38.130:50232] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae2Inn5MsX8wRQr99nYS1gAAA0w"]
[Sun Apr 26 11:38:08.944971 2026] [:error] [pid 8390:tid 8463] [client 54.38.38.130:39084] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae2IoIGPtFK_i9p5yxSogQAAAIw"]
[Sun Apr 26 11:38:13.101554 2026] [:error] [pid 8390:tid 8470] [client 54.38.38.130:39090] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ae2IpYGPtFK_i9p5yxSojAAAAJM"]
[Sun Apr 26 11:38:17.505633 2026] [:error] [pid 8390:tid 8470] [client 54.38.38.130:36166] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae2IqYGPtFK_i9p5yxSolAAAAJM"]
[Sun Apr 26 11:38:20.268081 2026] [:error] [pid 8390:tid 8457] [client 54.38.38.130:55638] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae2IrIGPtFK_i9p5yxSooQAAAIY"]
[Sun Apr 26 11:38:23.143141 2026] [:error] [pid 13137:tid 13156] [client 54.38.38.130:55640] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ae2Ir90RB4J0o4h5neEe5QAAAg8"]
[Sun Apr 26 11:38:26.411822 2026] [:error] [pid 8491:tid 8506] [client 54.38.38.130:58822] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ae2Isiq7I7e6CJooQM3MpQAAAMc"]
[Sun Apr 26 11:38:29.003294 2026] [:error] [pid 8390:tid 8454] [client 54.38.38.130:58824] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ae2ItYGPtFK_i9p5yxSoswAAAIM"]
[Sun Apr 26 11:38:31.474067 2026] [:error] [pid 13197:tid 13235] [client 54.38.38.130:58828] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ae2It93kktFKdSxTrBuu6AAAAsQ"]
[Sun Apr 26 11:38:34.039569 2026] [:error] [pid 8385:tid 8439] [client 54.38.38.130:58840] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ae2IujOy7_J84Wx3-oyYhgAAAE8"]
[Sun Apr 26 11:38:36.493038 2026] [:error] [pid 13137:tid 13146] [client 54.38.38.130:53626] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ae2IvN0RB4J0o4h5neEe6gAAAgY"]
[Sun Apr 26 11:38:39.114012 2026] [:error] [pid 22573:tid 22606] [client 54.38.38.130:53638] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ae2Iv3B3EmQlD4yKUt97qAAAAYA"]
[Sun Apr 26 11:38:41.498884 2026] [:error] [pid 8390:tid 8463] [client 54.38.38.130:53642] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ae2IwYGPtFK_i9p5yxSowQAAAIw"]
[Sun Apr 26 11:38:44.070267 2026] [:error] [pid 13197:tid 13239] [client 54.38.38.130:53646] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ae2IxN3kktFKdSxTrBuu7wAAAsg"]
[Sun Apr 26 11:38:48.990408 2026] [:error] [pid 8390:tid 8472] [client 54.38.38.130:46552] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ae2IyIGPtFK_i9p5yxSo2AAAAJU"]
[Sun Apr 26 11:38:51.392152 2026] [:error] [pid 8491:tid 8513] [client 54.38.38.130:46568] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ae2Iyyq7I7e6CJooQM3MsQAAAM4"]
[Sun Apr 26 11:38:53.863593 2026] [:error] [pid 8390:tid 8453] [client 54.38.38.130:46570] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae2IzYGPtFK_i9p5yxSo3AAAAII"]
[Sun Apr 26 11:40:46.256618 2026] [:error] [pid 8385:tid 8433] [client 54.38.38.130:48374] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae2JPjOy7_J84Wx3-oyY2AAAAEk"]
[Sun Apr 26 11:40:48.774529 2026] [:error] [pid 8385:tid 8443] [client 54.38.38.130:40710] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ae2JQDOy7_J84Wx3-oyY2QAAAFM"]
[Sun Apr 26 11:40:51.145733 2026] [:error] [pid 8390:tid 8459] [client 54.38.38.130:40720] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ae2JQ4GPtFK_i9p5yxSpgQAAAIg"]
[Sun Apr 26 11:40:53.563736 2026] [:error] [pid 22573:tid 22623] [client 54.38.38.130:40726] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ae2JRXB3EmQlD4yKUt98PgAAAZA"]
[Sun Apr 26 11:40:56.089468 2026] [:error] [pid 22573:tid 22620] [client 54.38.38.130:46726] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae2JSHB3EmQlD4yKUt98RQAAAY0"]
[Sun Apr 26 11:40:58.526293 2026] [:error] [pid 8390:tid 8460] [client 54.38.38.130:46740] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae2JSoGPtFK_i9p5yxSpiwAAAIk"]
[Sun Apr 26 11:41:00.439082 2026] [:error] [pid 8390:tid 8459] [client 54.38.38.130:57676] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae2JTIGPtFK_i9p5yxSpjAAAAIg"]
[Sun Apr 26 11:41:02.960621 2026] [:error] [pid 16515:tid 16520] [client 54.38.38.130:46744] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae2JTltDrUmgHSvpuLz5YwAAAkI"]
[Sun Apr 26 11:41:05.408357 2026] [:error] [pid 8491:tid 8499] [client 54.38.38.130:46758] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ae2JUSq7I7e6CJooQM3M6wAAAMA"]
[Sun Apr 26 11:41:07.518123 2026] [:error] [pid 16515:tid 16542] [client 54.38.38.130:53278] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae2JU1tDrUmgHSvpuLz5agAAAlg"]
[Sun Apr 26 11:41:10.415371 2026] [:error] [pid 8390:tid 8457] [client 54.38.38.130:45274] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae2JVoGPtFK_i9p5yxSpjwAAAIY"]
[Sun Apr 26 11:41:12.504033 2026] [:error] [pid 22572:tid 22591] [client 54.38.38.130:53282] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae2JWNXOViWCFU-pZzC95wAAAU0"]
[Sun Apr 26 11:41:14.961794 2026] [:error] [pid 8390:tid 8474] [client 54.38.38.130:45284] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae2JWoGPtFK_i9p5yxSpoQAAAJc"]
[Sun Apr 26 11:41:17.045520 2026] [:error] [pid 8390:tid 8463] [client 54.38.38.130:42738] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae2JXYGPtFK_i9p5yxSpowAAAIw"]
[Sun Apr 26 11:41:19.842875 2026] [:error] [pid 8390:tid 8463] [client 54.38.38.130:56178] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae2JX4GPtFK_i9p5yxSprQAAAIw"]
[Sun Apr 26 11:41:22.700534 2026] [:error] [pid 22572:tid 22592] [client 54.38.38.130:56182] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ae2JYtXOViWCFU-pZzC97AAAAU4"]
[Sun Apr 26 11:41:25.234041 2026] [:error] [pid 13137:tid 13165] [client 54.38.38.130:56196] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ae2JZd0RB4J0o4h5neEftAAAAhg"]
[Sun Apr 26 11:41:27.889543 2026] [:error] [pid 13197:tid 13255] [client 54.38.38.130:47422] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ae2JZ93kktFKdSxTrBuvLwAAAtc"]
[Sun Apr 26 11:41:29.970949 2026] [:error] [pid 22572:tid 22599] [client 54.38.38.130:34304] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ae2JadXOViWCFU-pZzC97gAAAVU"]
[Sun Apr 26 11:41:32.531721 2026] [:error] [pid 8390:tid 8457] [client 54.38.38.130:47424] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ae2JbIGPtFK_i9p5yxSpuAAAAIY"]
[Sun Apr 26 11:41:34.606696 2026] [:error] [pid 8390:tid 8472] [client 54.38.38.130:34308] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ae2JboGPtFK_i9p5yxSpvQAAAJU"]
[Sun Apr 26 11:41:37.958874 2026] [:error] [pid 8385:tid 8439] [client 54.38.38.130:45618] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ae2JcTOy7_J84Wx3-oyY8QAAAE8"]
[Sun Apr 26 11:41:40.615129 2026] [:error] [pid 8390:tid 8456] [client 54.38.38.130:45630] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ae2JdIGPtFK_i9p5yxSpxQAAAIU"]
[Sun Apr 26 11:41:43.144697 2026] [:error] [pid 22573:tid 22631] [client 54.38.38.130:45646] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ae2Jd3B3EmQlD4yKUt98UAAAAZg"]
[Sun Apr 26 11:42:07.612157 2026] [:error] [pid 13137:tid 13148] [client 54.38.38.130:42948] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "ae2Jj90RB4J0o4h5neEf5gAAAgg"]
[Sun Apr 26 11:42:09.651212 2026] [:error] [pid 22573:tid 22609] [client 54.38.38.130:50852] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ae2JkXB3EmQlD4yKUt98cAAAAYM"]
[Sun Apr 26 11:42:11.594554 2026] [:error] [pid 13137:tid 13147] [client 54.38.38.130:50862] [client 54.38.38.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ae2Jk90RB4J0o4h5neEf6AAAAgc"]
[Sun Apr 26 11:58:54.329116 2026] [:error] [pid 13137:tid 13140] [client 43.140.247.223:57068] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae2Nft0RB4J0o4h5neEivQAAAgA"]
[Sun Apr 26 12:10:16.814240 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.658707 2026] [proxy_fcgi:error] [pid 8383:tid 8402] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.676768 2026] [proxy_fcgi:error] [pid 8383:tid 8407] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.696361 2026] [proxy_fcgi:error] [pid 8383:tid 8400] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.715149 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.734718 2026] [proxy_fcgi:error] [pid 8383:tid 8418] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.754607 2026] [proxy_fcgi:error] [pid 8383:tid 8409] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.822396 2026] [proxy_fcgi:error] [pid 8383:tid 8408] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.841579 2026] [proxy_fcgi:error] [pid 8383:tid 8415] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.862355 2026] [proxy_fcgi:error] [pid 8383:tid 8406] [client 20.5.74.70:11259] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 12:10:17.878734 2026] [:error] [pid 8383:tid 8405] [client 20.5.74.70:11259] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae2QKdFa2S3EsATMdWPorwAAAAg"]
[Sun Apr 26 12:10:17.938673 2026] [:error] [pid 22572:tid 22581] [client 20.5.74.70:11218] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae2QKdXOViWCFU-pZzDFPAAAAUM"]
[Sun Apr 26 12:10:18.000520 2026] [:error] [pid 8491:tid 8503] [client 20.5.74.70:11260] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae2QKSq7I7e6CJooQM3QmAAAAMQ"]
[Sun Apr 26 12:10:18.099787 2026] [:error] [pid 8385:tid 8448] [client 20.5.74.70:9627] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae2QKjOy7_J84Wx3-oyb6wAAAFg"]
[Sun Apr 26 12:10:21.150635 2026] [:error] [pid 8383:tid 8405] [client 20.5.74.70:11259] [client 20.5.74.70] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "57.141.14.8_bb694759cd2c22a01c1316c1c32e166b75850636"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae2QKdFa2S3EsATMdWPorwAAAAg"]
[Sun Apr 26 14:00:58.290847 2026] [:error] [pid 22572:tid 22585] [client 180.153.236.157:49405] [client 180.153.236.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae2qGtXOViWCFU-pZzDeAAAAAUc"], referer: http://switchcreative.net/
[Sun Apr 26 15:43:30.268650 2026] [proxy_fcgi:error] [pid 8383:tid 8420] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:30.547139 2026] [proxy_fcgi:error] [pid 8383:tid 8405] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:30.829296 2026] [proxy_fcgi:error] [pid 8383:tid 8406] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:31.106492 2026] [proxy_fcgi:error] [pid 8383:tid 8402] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:31.428876 2026] [proxy_fcgi:error] [pid 8383:tid 8421] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:31.693073 2026] [proxy_fcgi:error] [pid 8383:tid 8410] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:31.962359 2026] [proxy_fcgi:error] [pid 8383:tid 8419] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:32.500748 2026] [proxy_fcgi:error] [pid 8383:tid 8412] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:32.786616 2026] [proxy_fcgi:error] [pid 8383:tid 8403] [client 20.100.200.187:34762] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:43:33.312279 2026] [:error] [pid 8383:tid 8421] [client 20.100.200.187:34762] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "ae3CJdFa2S3EsATMdWP3hwAAABg"]
[Sun Apr 26 15:43:34.831209 2026] [:error] [pid 22573:tid 22616] [client 20.100.200.187:35015] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "ae3CJnB3EmQlD4yKUt-9PQAAAYk"]
[Sun Apr 26 15:43:35.914445 2026] [:error] [pid 8390:tid 8471] [client 20.100.200.187:34854] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "ae3CJ4GPtFK_i9p5yxQCTQAAAJQ"]
[Sun Apr 26 15:43:38.028216 2026] [:error] [pid 8390:tid 8457] [client 20.100.200.187:35110] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "ae3CKoGPtFK_i9p5yxQCUQAAAIY"]
[Sun Apr 26 15:43:39.122630 2026] [:error] [pid 22573:tid 22622] [client 20.100.200.187:35074] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "ae3CK3B3EmQlD4yKUt-9RwAAAY8"]
[Sun Apr 26 15:43:40.575178 2026] [:error] [pid 22573:tid 22623] [client 20.100.200.187:35519] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "ae3CLHB3EmQlD4yKUt-9SgAAAZA"]
[Sun Apr 26 15:43:42.010533 2026] [:error] [pid 13137:tid 13148] [client 20.100.200.187:35445] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "ae3CLt0RB4J0o4h5neFKFgAAAgg"]
[Sun Apr 26 15:43:43.817842 2026] [:error] [pid 22572:tid 22598] [client 20.100.200.187:35393] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "ae3CL9XOViWCFU-pZzDyRAAAAVQ"]
[Sun Apr 26 15:43:50.970480 2026] [:error] [pid 22572:tid 22596] [client 20.100.200.187:35437] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "ae3CNtXOViWCFU-pZzDySwAAAVI"]
[Sun Apr 26 15:43:53.444339 2026] [:error] [pid 8390:tid 8452] [client 20.100.200.187:35087] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "ae3COYGPtFK_i9p5yxQCWQAAAIE"]
[Sun Apr 26 15:43:56.432987 2026] [:error] [pid 8383:tid 8411] [client 20.100.200.187:35026] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "ae3CPNFa2S3EsATMdWP3mgAAAA4"]
[Sun Apr 26 15:44:00.279650 2026] [:error] [pid 8390:tid 8453] [client 20.100.200.187:35038] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "ae3CQIGPtFK_i9p5yxQCXAAAAII"]
[Sun Apr 26 15:44:02.166125 2026] [:error] [pid 22573:tid 22628] [client 20.100.200.187:35010] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "ae3CQnB3EmQlD4yKUt-9UgAAAZU"]
[Sun Apr 26 15:44:04.655497 2026] [:error] [pid 8383:tid 8397] [client 20.100.200.187:35109] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "ae3CRNFa2S3EsATMdWP3nQAAAAA"]
[Sun Apr 26 15:44:06.576565 2026] [:error] [pid 13137:tid 13143] [client 20.100.200.187:35479] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "ae3CRt0RB4J0o4h5neFKIgAAAgM"]
[Sun Apr 26 15:44:10.934609 2026] [:error] [pid 8383:tid 8418] [client 20.100.200.187:35080] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "ae3CStFa2S3EsATMdWP3pgAAABU"]
[Sun Apr 26 15:44:12.932821 2026] [:error] [pid 8383:tid 8413] [client 20.100.200.187:35397] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "ae3CTNFa2S3EsATMdWP3rQAAABA"]
[Sun Apr 26 15:44:13.818139 2026] [:error] [pid 8383:tid 8415] [client 20.100.200.187:35098] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "ae3CTdFa2S3EsATMdWP3rwAAABI"]
[Sun Apr 26 15:44:17.028788 2026] [:error] [pid 8383:tid 8413] [client 20.100.200.187:35467] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "ae3CUdFa2S3EsATMdWP3tQAAABA"]
[Sun Apr 26 15:44:19.151132 2026] [:error] [pid 16574:tid 16616] [client 20.100.200.187:35483] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "ae3CU35MsX8wRQr99nYg_AAAA0s"]
[Sun Apr 26 15:44:21.782547 2026] [:error] [pid 8491:tid 8524] [client 20.100.200.187:35495] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "ae3CVSq7I7e6CJooQM3lhAAAANg"]
[Sun Apr 26 15:44:23.814194 2026] [:error] [pid 22573:tid 22631] [client 20.100.200.187:35421] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "ae3CV3B3EmQlD4yKUt-9YQAAAZg"]
[Sun Apr 26 15:44:24.908175 2026] [:error] [pid 8383:tid 8415] [client 20.100.200.187:35910] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "ae3CWNFa2S3EsATMdWP3xAAAABI"]
[Sun Apr 26 15:44:25.745998 2026] [:error] [pid 8390:tid 8461] [client 20.100.200.187:35499] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ae3CWYGPtFK_i9p5yxQCaQAAAIo"]
[Sun Apr 26 15:44:27.358327 2026] [:error] [pid 13137:tid 13161] [client 20.100.200.187:35927] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ae3CW90RB4J0o4h5neFKIwAAAhQ"]
[Sun Apr 26 15:44:28.942901 2026] [:error] [pid 22572:tid 22592] [client 20.100.200.187:35971] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ae3CXNXOViWCFU-pZzDyUQAAAU4"]
[Sun Apr 26 15:44:30.057166 2026] [:error] [pid 22573:tid 22613] [client 20.100.200.187:35935] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ae3CXnB3EmQlD4yKUt-9awAAAYc"]
[Sun Apr 26 15:44:33.307985 2026] [proxy_fcgi:error] [pid 8383:tid 8405] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:33.675056 2026] [proxy_fcgi:error] [pid 8383:tid 8403] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:33.963951 2026] [proxy_fcgi:error] [pid 8383:tid 8401] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:34.258279 2026] [proxy_fcgi:error] [pid 8383:tid 8407] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:34.546663 2026] [proxy_fcgi:error] [pid 8383:tid 8412] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:34.834716 2026] [proxy_fcgi:error] [pid 8383:tid 8417] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:35.137122 2026] [proxy_fcgi:error] [pid 8383:tid 8400] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:35.426553 2026] [proxy_fcgi:error] [pid 8383:tid 8406] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:35.717644 2026] [proxy_fcgi:error] [pid 8383:tid 8399] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:36.006684 2026] [proxy_fcgi:error] [pid 8383:tid 8415] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:36.296045 2026] [proxy_fcgi:error] [pid 8383:tid 8419] [client 20.100.200.187:35909] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:44:36.581159 2026] [:error] [pid 8383:tid 8405] [client 20.100.200.187:35909] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ae3CZNFa2S3EsATMdWP34gAAAAg"]
[Sun Apr 26 15:44:39.776893 2026] [:error] [pid 13137:tid 13149] [client 20.100.200.187:35922] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ae3CZ90RB4J0o4h5neFKJwAAAgk"]
[Sun Apr 26 15:44:41.345678 2026] [:error] [pid 13137:tid 13155] [client 20.100.200.187:35954] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ae3Cad0RB4J0o4h5neFKLAAAAg4"]
[Sun Apr 26 15:44:43.473154 2026] [:error] [pid 8390:tid 8459] [client 20.100.200.187:35986] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ae3Ca4GPtFK_i9p5yxQCbgAAAIg"]
[Sun Apr 26 15:44:46.079909 2026] [:error] [pid 16515:tid 16541] [client 20.100.200.187:35949] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ae3CbltDrUmgHSvpuLwcrQAAAlc"]
[Sun Apr 26 15:44:50.590073 2026] [:error] [pid 22573:tid 22624] [client 20.100.200.187:35047] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ae3CcnB3EmQlD4yKUt-9dAAAAZE"]
[Sun Apr 26 15:44:52.581495 2026] [:error] [pid 8383:tid 8409] [client 20.100.200.187:35906] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ae3CdNFa2S3EsATMdWP37gAAAAw"]
[Sun Apr 26 15:45:04.168074 2026] [:error] [pid 8383:tid 8414] [client 20.100.200.187:36289] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "ae3CgNFa2S3EsATMdWP4AAAAABE"]
[Sun Apr 26 15:45:13.745039 2026] [:error] [pid 13137:tid 13152] [client 20.100.200.187:36012] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "ae3Cid0RB4J0o4h5neFKMwAAAgs"]
[Sun Apr 26 15:45:17.682403 2026] [:error] [pid 8385:tid 8437] [client 20.100.200.187:35991] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "ae3CjTOy7_J84Wx3-oy0iAAAAE0"]
[Sun Apr 26 15:45:19.568333 2026] [:error] [pid 16515:tid 16530] [client 20.100.200.187:35958] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "ae3Cj1tDrUmgHSvpuLwctwAAAkw"]
[Sun Apr 26 15:45:21.230599 2026] [:error] [pid 8383:tid 8403] [client 20.100.200.187:36330] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "ae3CkdFa2S3EsATMdWP4FAAAAAY"]
[Sun Apr 26 15:45:21.970755 2026] [:error] [pid 22572:tid 22595] [client 20.100.200.187:36365] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "ae3CkdXOViWCFU-pZzDyZAAAAVE"]
[Sun Apr 26 15:45:23.081616 2026] [:error] [pid 22572:tid 22593] [client 20.100.200.187:36318] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ae3Ck9XOViWCFU-pZzDyZgAAAU8"]
[Sun Apr 26 15:45:23.857788 2026] [:error] [pid 22573:tid 22607] [client 20.100.200.187:35963] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ae3Ck3B3EmQlD4yKUt-9hAAAAYE"]
[Sun Apr 26 15:45:24.664742 2026] [:error] [pid 22573:tid 22618] [client 20.100.200.187:36411] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ae3ClHB3EmQlD4yKUt-9hgAAAYs"]
[Sun Apr 26 15:45:26.082181 2026] [:error] [pid 22572:tid 22598] [client 20.100.200.187:36376] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ae3CltXOViWCFU-pZzDyaAAAAVQ"]
[Sun Apr 26 15:45:27.228122 2026] [:error] [pid 8491:tid 8500] [client 20.100.200.187:36349] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae3Clyq7I7e6CJooQM3lkgAAAME"]
[Sun Apr 26 15:45:27.950177 2026] [:error] [pid 8383:tid 8400] [client 20.100.200.187:35933] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae3Cl9Fa2S3EsATMdWP4FgAAAAM"]
[Sun Apr 26 15:45:29.299546 2026] [:error] [pid 22572:tid 22602] [client 20.100.200.187:36027] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae3CmdXOViWCFU-pZzDybAAAAVg"]
[Sun Apr 26 15:45:32.080274 2026] [:error] [pid 8390:tid 8465] [client 20.100.200.187:36295] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "ae3CnIGPtFK_i9p5yxQCgwAAAI4"]
[Sun Apr 26 15:45:32.892057 2026] [:error] [pid 16515:tid 16527] [client 20.100.200.187:35396] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "ae3CnFtDrUmgHSvpuLwcvQAAAkk"]
[Sun Apr 26 15:45:34.203196 2026] [:error] [pid 8390:tid 8470] [client 20.100.200.187:36364] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "ae3CnoGPtFK_i9p5yxQCiAAAAJM"]
[Sun Apr 26 15:45:35.440795 2026] [:error] [pid 22573:tid 22619] [client 20.100.200.187:35924] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "ae3Cn3B3EmQlD4yKUt-9igAAAYw"]
[Sun Apr 26 15:45:36.409595 2026] [proxy_fcgi:error] [pid 8390:tid 8453] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:36.674199 2026] [proxy_fcgi:error] [pid 8390:tid 8467] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:36.938302 2026] [proxy_fcgi:error] [pid 8390:tid 8458] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:37.201679 2026] [proxy_fcgi:error] [pid 8390:tid 8471] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:37.480685 2026] [proxy_fcgi:error] [pid 8390:tid 8465] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:37.746586 2026] [proxy_fcgi:error] [pid 8390:tid 8457] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:38.017364 2026] [proxy_fcgi:error] [pid 8390:tid 8455] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:38.293884 2026] [proxy_fcgi:error] [pid 8390:tid 8452] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:38.570381 2026] [proxy_fcgi:error] [pid 8390:tid 8468] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:38.833826 2026] [proxy_fcgi:error] [pid 8390:tid 8451] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:39.103904 2026] [proxy_fcgi:error] [pid 8390:tid 8462] [client 20.100.200.187:36008] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:45:39.364028 2026] [:error] [pid 8390:tid 8463] [client 20.100.200.187:36008] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae3Co4GPtFK_i9p5yxQCnAAAAIw"]
[Sun Apr 26 15:45:42.291655 2026] [:error] [pid 8383:tid 8402] [client 20.100.200.187:36974] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae3CptFa2S3EsATMdWP4LgAAAAU"]
[Sun Apr 26 15:45:44.658764 2026] [:error] [pid 22572:tid 22582] [client 20.100.200.187:35970] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae3CqNXOViWCFU-pZzDycwAAAUQ"]
[Sun Apr 26 15:45:48.820857 2026] [:error] [pid 8383:tid 8417] [client 20.100.200.187:36374] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ae3CrNFa2S3EsATMdWP4fwAAABQ"]
[Sun Apr 26 15:45:50.771285 2026] [:error] [pid 16515:tid 16531] [client 20.100.200.187:36381] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ae3CrltDrUmgHSvpuLwcyAAAAk0"]
[Sun Apr 26 15:45:53.508509 2026] [:error] [pid 8385:tid 8435] [client 20.100.200.187:36396] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ae3CsTOy7_J84Wx3-oy0mQAAAEs"]
[Sun Apr 26 15:45:55.908932 2026] [:error] [pid 22573:tid 22607] [client 20.100.200.187:36310] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ae3Cs3B3EmQlD4yKUt-9lAAAAYE"]
[Sun Apr 26 15:45:57.753719 2026] [:error] [pid 8491:tid 8524] [client 20.100.200.187:36930] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bolt.php"] [unique_id "ae3CtSq7I7e6CJooQM3llQAAANg"]
[Sun Apr 26 15:45:58.675046 2026] [:error] [pid 8390:tid 8454] [client 20.100.200.187:37012] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "ae3CtoGPtFK_i9p5yxQCrwAAAIM"]
[Sun Apr 26 15:45:59.934663 2026] [:error] [pid 8390:tid 8472] [client 20.100.200.187:37051] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "ae3Ct4GPtFK_i9p5yxQCsQAAAJU"]
[Sun Apr 26 15:46:00.799593 2026] [:error] [pid 8390:tid 8452] [client 20.100.200.187:35978] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "ae3CuIGPtFK_i9p5yxQCsgAAAIE"]
[Sun Apr 26 15:46:03.391154 2026] [:error] [pid 8383:tid 8417] [client 20.100.200.187:37035] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/koiy.php"] [unique_id "ae3Cu9Fa2S3EsATMdWP4iAAAABQ"]
[Sun Apr 26 15:46:04.294372 2026] [:error] [pid 8383:tid 8399] [client 20.100.200.187:36987] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ae3CvNFa2S3EsATMdWP4igAAAAI"]
[Sun Apr 26 15:46:05.049493 2026] [:error] [pid 8383:tid 8400] [client 20.100.200.187:36976] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ae3CvdFa2S3EsATMdWP4jAAAAAM"]
[Sun Apr 26 15:46:08.228628 2026] [:error] [pid 8383:tid 8402] [client 20.100.200.187:36288] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ae3CwNFa2S3EsATMdWP4kwAAAAU"]
[Sun Apr 26 15:46:09.822779 2026] [:error] [pid 22572:tid 22597] [client 20.100.200.187:36387] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ae3CwdXOViWCFU-pZzDynAAAAVM"]
[Sun Apr 26 15:46:12.839028 2026] [:error] [pid 13197:tid 13253] [client 20.100.200.187:36980] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ae3CxN3kktFKdSxTrBvBMAAAAtU"]
[Sun Apr 26 15:46:14.671284 2026] [:error] [pid 8383:tid 8417] [client 20.100.200.187:36971] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ae3CxtFa2S3EsATMdWP4lgAAABQ"]
[Sun Apr 26 15:46:17.221632 2026] [:error] [pid 8491:tid 8504] [client 20.100.200.187:36938] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ae3CySq7I7e6CJooQM3lmAAAAMU"]
[Sun Apr 26 15:46:28.083142 2026] [:error] [pid 8390:tid 8463] [client 20.100.200.187:37802] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ae3C1IGPtFK_i9p5yxQC3AAAAIw"]
[Sun Apr 26 15:46:29.838736 2026] [:error] [pid 8390:tid 8474] [client 20.100.200.187:36979] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ae3C1YGPtFK_i9p5yxQC3wAAAJc"]
[Sun Apr 26 15:46:34.590675 2026] [:error] [pid 16574:tid 16605] [client 20.100.200.187:36375] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ae3C2n5MsX8wRQr99nYhFAAAA0E"]
[Sun Apr 26 15:46:36.298355 2026] [:error] [pid 8390:tid 8465] [client 20.100.200.187:36951] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa.php7"] [unique_id "ae3C3IGPtFK_i9p5yxQC5wAAAI4"]
[Sun Apr 26 15:46:38.054269 2026] [:error] [pid 16515:tid 16519] [client 20.100.200.187:37719] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a7.php"] [unique_id "ae3C3ltDrUmgHSvpuLwc1gAAAkE"]
[Sun Apr 26 15:46:39.212649 2026] [proxy_fcgi:error] [pid 8390:tid 8459] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:39.493806 2026] [proxy_fcgi:error] [pid 8390:tid 8466] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:39.762118 2026] [proxy_fcgi:error] [pid 8390:tid 8475] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:40.132612 2026] [proxy_fcgi:error] [pid 8390:tid 8460] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:40.397747 2026] [proxy_fcgi:error] [pid 8390:tid 8453] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:40.773798 2026] [proxy_fcgi:error] [pid 8390:tid 8463] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:41.038591 2026] [proxy_fcgi:error] [pid 8390:tid 8472] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:41.305800 2026] [proxy_fcgi:error] [pid 8390:tid 8454] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:41.616692 2026] [proxy_fcgi:error] [pid 8390:tid 8458] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:41.881466 2026] [proxy_fcgi:error] [pid 8390:tid 8452] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:42.219055 2026] [proxy_fcgi:error] [pid 8390:tid 8465] [client 20.100.200.187:36937] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:46:42.479030 2026] [:error] [pid 8390:tid 8471] [client 20.100.200.187:36937] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "ae3C4oGPtFK_i9p5yxQC-wAAAJQ"]
[Sun Apr 26 15:46:43.963597 2026] [:error] [pid 22573:tid 22606] [client 20.100.200.187:37727] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "ae3C43B3EmQlD4yKUt-9pgAAAYA"]
[Sun Apr 26 15:46:45.205945 2026] [:error] [pid 13137:tid 13142] [client 20.100.200.187:37033] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "ae3C5d0RB4J0o4h5neFKUwAAAgI"]
[Sun Apr 26 15:46:46.709462 2026] [:error] [pid 22572:tid 22589] [client 20.100.200.187:37785] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "ae3C5tXOViWCFU-pZzDyrAAAAUs"]
[Sun Apr 26 15:46:52.291983 2026] [:error] [pid 16574:tid 16612] [client 20.100.200.187:36984] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ae3C7H5MsX8wRQr99nYhGAAAA0g"]
[Sun Apr 26 15:46:58.751927 2026] [:error] [pid 22573:tid 22610] [client 20.100.200.187:37011] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ae3C8nB3EmQlD4yKUt-9tgAAAYQ"]
[Sun Apr 26 15:47:00.899039 2026] [:error] [pid 22573:tid 22629] [client 20.100.200.187:38364] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ae3C9HB3EmQlD4yKUt-9ugAAAZY"]
[Sun Apr 26 15:47:01.574463 2026] [:error] [pid 13137:tid 13158] [client 20.100.200.187:38450] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ae3C9d0RB4J0o4h5neFKWQAAAhE"]
[Sun Apr 26 15:47:03.502518 2026] [:error] [pid 22572:tid 22596] [client 20.100.200.187:37029] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ae3C99XOViWCFU-pZzDytQAAAVI"]
[Sun Apr 26 15:47:05.596451 2026] [:error] [pid 22573:tid 22627] [client 20.100.200.187:37742] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ae3C-XB3EmQlD4yKUt-9wwAAAZQ"]
[Sun Apr 26 15:47:07.732529 2026] [:error] [pid 8491:tid 8512] [client 20.100.200.187:37791] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ae3C-yq7I7e6CJooQM3lpwAAAM0"]
[Sun Apr 26 15:47:08.876498 2026] [:error] [pid 16515:tid 16532] [client 20.100.200.187:38346] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ae3C_FtDrUmgHSvpuLwc3QAAAk4"]
[Sun Apr 26 15:47:12.691895 2026] [:error] [pid 8390:tid 8458] [client 20.100.200.187:37816] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "ae3DAIGPtFK_i9p5yxQDCAAAAIc"]
[Sun Apr 26 15:47:14.143440 2026] [:error] [pid 8390:tid 8471] [client 20.100.200.187:38419] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "ae3DAoGPtFK_i9p5yxQDCQAAAJQ"]
[Sun Apr 26 15:47:15.995081 2026] [:error] [pid 8390:tid 8466] [client 20.100.200.187:36998] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "ae3DA4GPtFK_i9p5yxQDCwAAAI8"]
[Sun Apr 26 15:47:19.230478 2026] [:error] [pid 22572:tid 22578] [client 20.100.200.187:38445] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "ae3DB9XOViWCFU-pZzDyvwAAAUA"]
[Sun Apr 26 15:47:41.293898 2026] [:error] [pid 8385:tid 8434] [client 20.100.200.187:37779] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "ae3DHTOy7_J84Wx3-oy0pgAAAEo"]
[Sun Apr 26 15:47:42.976398 2026] [proxy_fcgi:error] [pid 16515:tid 16524] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:43.252828 2026] [proxy_fcgi:error] [pid 16515:tid 16521] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:44.211381 2026] [proxy_fcgi:error] [pid 16515:tid 16539] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:44.477025 2026] [proxy_fcgi:error] [pid 16515:tid 16522] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:44.758178 2026] [proxy_fcgi:error] [pid 16515:tid 16520] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:45.021330 2026] [proxy_fcgi:error] [pid 16515:tid 16538] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:45.285140 2026] [proxy_fcgi:error] [pid 16515:tid 16519] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:45.547425 2026] [proxy_fcgi:error] [pid 16515:tid 16527] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:45.810244 2026] [proxy_fcgi:error] [pid 16515:tid 16531] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:46.073374 2026] [proxy_fcgi:error] [pid 16515:tid 16529] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:46.358551 2026] [proxy_fcgi:error] [pid 16515:tid 16528] [client 20.100.200.187:38425] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:47:46.618065 2026] [:error] [pid 16515:tid 16523] [client 20.100.200.187:38425] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "ae3DIltDrUmgHSvpuLwc-QAAAkU"]
[Sun Apr 26 15:47:54.529506 2026] [:error] [pid 13137:tid 13145] [client 20.100.200.187:38350] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "ae3DKt0RB4J0o4h5neFKgAAAAgU"]
[Sun Apr 26 15:47:56.682099 2026] [:error] [pid 8491:tid 8500] [client 20.100.200.187:39159] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "ae3DLCq7I7e6CJooQM3lsgAAAME"]
[Sun Apr 26 15:47:57.745587 2026] [:error] [pid 16515:tid 16523] [client 20.100.200.187:38414] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "ae3DLVtDrUmgHSvpuLwc_QAAAkU"]
[Sun Apr 26 15:47:59.482144 2026] [:error] [pid 8383:tid 8400] [client 20.100.200.187:37771] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "ae3DL9Fa2S3EsATMdWP4sAAAAAM"]
[Sun Apr 26 15:48:02.153690 2026] [:error] [pid 8390:tid 8467] [client 20.100.200.187:38354] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "ae3DMoGPtFK_i9p5yxQDRwAAAJA"]
[Sun Apr 26 15:48:03.825273 2026] [:error] [pid 22573:tid 22618] [client 20.100.200.187:37806] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "ae3DM3B3EmQlD4yKUt-98wAAAYs"]
[Sun Apr 26 15:48:06.979034 2026] [:error] [pid 8491:tid 8511] [client 20.100.200.187:38448] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "ae3DNiq7I7e6CJooQM3lugAAAMw"]
[Sun Apr 26 15:48:08.615169 2026] [:error] [pid 16515:tid 16537] [client 20.100.200.187:39207] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "ae3DOFtDrUmgHSvpuLwdBgAAAlM"]
[Sun Apr 26 15:48:10.003020 2026] [:error] [pid 22573:tid 22612] [client 20.100.200.187:38339] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "ae3DOnB3EmQlD4yKUt--AAAAAYY"]
[Sun Apr 26 15:48:14.357636 2026] [:error] [pid 22573:tid 22617] [client 20.100.200.187:37793] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "ae3DPnB3EmQlD4yKUt--BgAAAYo"]
[Sun Apr 26 15:48:15.518158 2026] [:error] [pid 22573:tid 22625] [client 20.100.200.187:38407] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "ae3DP3B3EmQlD4yKUt--CgAAAZI"]
[Sun Apr 26 15:48:16.376175 2026] [:error] [pid 22572:tid 22595] [client 20.100.200.187:37766] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ae3DQNXOViWCFU-pZzDy5AAAAVE"]
[Sun Apr 26 15:48:17.529390 2026] [:error] [pid 22573:tid 22609] [client 20.100.200.187:38384] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ae3DQXB3EmQlD4yKUt--DgAAAYM"]
[Sun Apr 26 15:48:18.435468 2026] [:error] [pid 8390:tid 8458] [client 20.100.200.187:37799] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ae3DQoGPtFK_i9p5yxQDTwAAAIc"]
[Sun Apr 26 15:48:19.446308 2026] [:error] [pid 8390:tid 8471] [client 20.100.200.187:38439] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ae3DQ4GPtFK_i9p5yxQDUQAAAJQ"]
[Sun Apr 26 15:48:20.360042 2026] [:error] [pid 22572:tid 22586] [client 20.100.200.187:36316] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ae3DRNXOViWCFU-pZzDy7AAAAUg"]
[Sun Apr 26 15:48:23.084877 2026] [:error] [pid 16515:tid 16521] [client 20.100.200.187:39775] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ae3DR1tDrUmgHSvpuLwdDwAAAkM"]
[Sun Apr 26 15:48:24.134087 2026] [:error] [pid 13197:tid 13236] [client 20.100.200.187:39864] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ae3DSN3kktFKdSxTrBvBRgAAAsU"]
[Sun Apr 26 15:48:25.392727 2026] [:error] [pid 8390:tid 8473] [client 20.100.200.187:39769] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ae3DSYGPtFK_i9p5yxQDWQAAAJY"]
[Sun Apr 26 15:48:27.332926 2026] [:error] [pid 22573:tid 22627] [client 20.100.200.187:39773] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ae3DS3B3EmQlD4yKUt--FAAAAZQ"]
[Sun Apr 26 15:48:28.698578 2026] [:error] [pid 13197:tid 13237] [client 20.100.200.187:39832] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ae3DTN3kktFKdSxTrBvBSgAAAsY"]
[Sun Apr 26 15:48:30.657213 2026] [:error] [pid 16574:tid 16629] [client 20.100.200.187:35986] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ae3DTn5MsX8wRQr99nYhJQAAA1E"]
[Sun Apr 26 15:48:32.334671 2026] [:error] [pid 22572:tid 22595] [client 20.100.200.187:38438] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ae3DUNXOViWCFU-pZzDy7QAAAVE"]
[Sun Apr 26 15:48:34.246726 2026] [:error] [pid 8383:tid 8415] [client 20.100.200.187:38451] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "ae3DUtFa2S3EsATMdWP4ugAAABI"]
[Sun Apr 26 15:48:35.186713 2026] [:error] [pid 8491:tid 8520] [client 20.100.200.187:39788] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "ae3DUyq7I7e6CJooQM3lwAAAANU"]
[Sun Apr 26 15:48:36.406606 2026] [:error] [pid 8390:tid 8465] [client 20.100.200.187:38408] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "ae3DVIGPtFK_i9p5yxQDXQAAAI4"]
[Sun Apr 26 15:48:37.926085 2026] [:error] [pid 8390:tid 8468] [client 20.100.200.187:38453] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "ae3DVYGPtFK_i9p5yxQDYQAAAJE"]
[Sun Apr 26 15:48:39.573365 2026] [:error] [pid 8383:tid 8408] [client 20.100.200.187:39835] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "ae3DV9Fa2S3EsATMdWP4vwAAAAs"]
[Sun Apr 26 15:48:41.549555 2026] [:error] [pid 8385:tid 8441] [client 20.100.200.187:39122] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "ae3DWTOy7_J84Wx3-oy0tQAAAFE"]
[Sun Apr 26 15:48:42.248962 2026] [:error] [pid 22572:tid 22578] [client 20.100.200.187:36965] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "ae3DWtXOViWCFU-pZzDy7gAAAUA"]
[Sun Apr 26 15:48:43.390189 2026] [:error] [pid 16574:tid 16607] [client 20.100.200.187:38430] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "ae3DW35MsX8wRQr99nYhJwAAA0M"]
[Sun Apr 26 15:48:44.531657 2026] [:error] [pid 22572:tid 22588] [client 20.100.200.187:39187] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ae3DXNXOViWCFU-pZzDy8AAAAUo"]
[Sun Apr 26 15:48:45.766886 2026] [:error] [pid 22573:tid 22608] [client 20.100.200.187:39192] [client 20.100.200.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ae3DXXB3EmQlD4yKUt--HwAAAYI"]
[Sun Apr 26 15:48:47.728323 2026] [proxy_fcgi:error] [pid 22572:tid 22580] [client 20.100.200.187:39820] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:48:48.003011 2026] [proxy_fcgi:error] [pid 22572:tid 22579] [client 20.100.200.187:39820] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:48:48.373628 2026] [proxy_fcgi:error] [pid 22572:tid 22589] [client 20.100.200.187:39820] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 15:48:48.641281 2026] [proxy_fcgi:error] [pid 22572:tid 22586] [client 20.100.200.187:39820] AH01071: Got error 'Primary script unknown'
[Sun Apr 26 16:10:44.658837 2026] [:error] [pid 13197:tid 13233] [client 54.37.254.160:59980] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ae3IhN3kktFKdSxTrBvC_AAAAsI"]
[Sun Apr 26 16:10:47.349737 2026] [:error] [pid 8383:tid 8418] [client 54.37.254.160:37860] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ae3Ih9Fa2S3EsATMdWP-BgAAABU"]
[Sun Apr 26 16:10:50.106560 2026] [:error] [pid 16515:tid 16526] [client 54.37.254.160:48896] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ae3IiltDrUmgHSvpuLwfewAAAkg"]
[Sun Apr 26 16:10:52.530713 2026] [:error] [pid 16574:tid 16631] [client 54.37.254.160:48906] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ae3IjH5MsX8wRQr99nYiVAAAA1I"]
[Sun Apr 26 16:10:55.014025 2026] [:error] [pid 8385:tid 8424] [client 54.37.254.160:48914] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ae3IjzOy7_J84Wx3-oy28AAAAEA"]
[Sun Apr 26 16:10:58.315115 2026] [:error] [pid 22572:tid 22583] [client 54.37.254.160:57956] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ae3IktXOViWCFU-pZzD2mQAAAUU"]
[Sun Apr 26 16:11:00.853983 2026] [:error] [pid 22572:tid 22580] [client 54.37.254.160:57970] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ae3IlNXOViWCFU-pZzD2nAAAAUI"]
[Sun Apr 26 16:11:03.752862 2026] [:error] [pid 8491:tid 8516] [client 54.37.254.160:57974] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ae3Ilyq7I7e6CJooQM3nXQAAANE"]
[Sun Apr 26 16:11:06.073561 2026] [:error] [pid 16515:tid 16520] [client 54.37.254.160:57980] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ae3ImltDrUmgHSvpuLwfgQAAAkI"]
[Sun Apr 26 16:11:09.108831 2026] [:error] [pid 13197:tid 13234] [client 54.37.254.160:42318] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae3Ind3kktFKdSxTrBvDDgAAAsM"]
[Sun Apr 26 16:11:11.755164 2026] [:error] [pid 8383:tid 8409] [client 54.37.254.160:42332] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae3In9Fa2S3EsATMdWP-KAAAAAw"]
[Sun Apr 26 16:11:14.644431 2026] [:error] [pid 22573:tid 22611] [client 54.37.254.160:42348] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae3IonB3EmQlD4yKUt_B7QAAAYU"]
[Sun Apr 26 16:11:17.230092 2026] [:error] [pid 8385:tid 8431] [client 54.37.254.160:42350] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ae3IpTOy7_J84Wx3-oy29QAAAEc"]
[Sun Apr 26 16:11:19.699365 2026] [:error] [pid 8390:tid 8463] [client 54.37.254.160:49934] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ae3Ip4GPtFK_i9p5yxQIPgAAAIw"]
[Sun Apr 26 16:11:22.121571 2026] [:error] [pid 8390:tid 8454] [client 54.37.254.160:49950] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ae3IqoGPtFK_i9p5yxQIRQAAAIM"]
[Sun Apr 26 16:11:24.718987 2026] [:error] [pid 8491:tid 8510] [client 54.37.254.160:49962] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae3IrCq7I7e6CJooQM3nYgAAAMs"]
[Sun Apr 26 16:11:27.328014 2026] [:error] [pid 16574:tid 16633] [client 54.37.254.160:49968] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae3Ir35MsX8wRQr99nYiZgAAA1M"]
[Sun Apr 26 16:11:29.987587 2026] [:error] [pid 13137:tid 13163] [client 54.37.254.160:58690] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae3Isd0RB4J0o4h5neFMyQAAAhY"]
[Sun Apr 26 16:11:32.590502 2026] [:error] [pid 8390:tid 8459] [client 54.37.254.160:58694] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae3ItIGPtFK_i9p5yxQIVQAAAIg"]
[Sun Apr 26 16:11:34.446908 2026] [:error] [pid 13137:tid 13149] [client 54.37.254.160:34860] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae3Itt0RB4J0o4h5neFMzgAAAgk"]
[Sun Apr 26 16:11:38.468345 2026] [:error] [pid 8383:tid 8398] [client 54.37.254.160:59144] [client 54.37.254.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae3IutFa2S3EsATMdWP-PQAAAAE"]
[Sun Apr 26 16:48:49.466732 2026] [:error] [pid 16515:tid 16520] [client 145.239.65.226:33488] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ae3RcVtDrUmgHSvpuLwjugAAAkI"]
[Sun Apr 26 16:48:51.419144 2026] [:error] [pid 22572:tid 22586] [client 145.239.65.226:34182] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ae3Rc9XOViWCFU-pZzD8ygAAAUg"]
[Sun Apr 26 16:48:53.441922 2026] [:error] [pid 22572:tid 22583] [client 145.239.65.226:34196] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ae3RddXOViWCFU-pZzD8ywAAAUU"]
[Sun Apr 26 16:48:55.455086 2026] [:error] [pid 8390:tid 8453] [client 145.239.65.226:34212] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ae3Rd4GPtFK_i9p5yxQSAwAAAII"]
[Sun Apr 26 16:48:57.464717 2026] [:error] [pid 22572:tid 22600] [client 145.239.65.226:34222] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ae3RedXOViWCFU-pZzD80AAAAVY"]
[Sun Apr 26 16:48:59.457974 2026] [:error] [pid 22572:tid 22582] [client 145.239.65.226:34224] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ae3Re9XOViWCFU-pZzD80QAAAUQ"]
[Sun Apr 26 16:49:01.454069 2026] [:error] [pid 8383:tid 8399] [client 145.239.65.226:36782] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae3RfdFa2S3EsATMdWMNWAAAAAI"]
[Sun Apr 26 16:49:03.460018 2026] [:error] [pid 8383:tid 8421] [client 145.239.65.226:36788] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae3Rf9Fa2S3EsATMdWMNZQAAABg"]
[Sun Apr 26 16:49:05.307114 2026] [:error] [pid 22573:tid 22613] [client 145.239.65.226:36800] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae3RgXB3EmQlD4yKUt_KaAAAAYc"]
[Sun Apr 26 16:49:07.312023 2026] [:error] [pid 8390:tid 8458] [client 145.239.65.226:36806] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae3Rg4GPtFK_i9p5yxQSEgAAAIc"]
[Sun Apr 26 16:49:09.312730 2026] [:error] [pid 22572:tid 22581] [client 145.239.65.226:36812] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ae3RhdXOViWCFU-pZzD83gAAAUM"]
[Sun Apr 26 16:49:11.301335 2026] [:error] [pid 8390:tid 8458] [client 145.239.65.226:45116] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae3Rh4GPtFK_i9p5yxQSHAAAAIc"]
[Sun Apr 26 16:49:13.290309 2026] [:error] [pid 8390:tid 8463] [client 145.239.65.226:45128] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae3RiYGPtFK_i9p5yxQSIgAAAIw"]
[Sun Apr 26 16:49:15.295032 2026] [:error] [pid 22573:tid 22613] [client 145.239.65.226:45142] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae3Ri3B3EmQlD4yKUt_KbgAAAYc"]
[Sun Apr 26 16:49:17.281944 2026] [:error] [pid 8383:tid 8415] [client 145.239.65.226:45150] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ae3RjdFa2S3EsATMdWMNeQAAABI"]
[Sun Apr 26 16:49:19.127779 2026] [:error] [pid 16515:tid 16521] [client 145.239.65.226:45154] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ae3Rj1tDrUmgHSvpuLwjwgAAAkM"]
[Sun Apr 26 16:49:21.127380 2026] [:error] [pid 8383:tid 8400] [client 145.239.65.226:45158] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ae3RkdFa2S3EsATMdWMNfAAAAAM"]
[Sun Apr 26 16:49:23.278858 2026] [:error] [pid 13197:tid 13234] [client 145.239.65.226:54630] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae3Rk93kktFKdSxTrBvFaQAAAsM"]
[Sun Apr 26 16:49:25.277182 2026] [:error] [pid 22572:tid 22598] [client 145.239.65.226:54634] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae3RldXOViWCFU-pZzD87AAAAVQ"]
[Sun Apr 26 16:49:27.268089 2026] [:error] [pid 8383:tid 8408] [client 145.239.65.226:54642] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae3Rl9Fa2S3EsATMdWMNkQAAAAs"]
[Sun Apr 26 16:49:29.268935 2026] [:error] [pid 22572:tid 22590] [client 145.239.65.226:54646] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae3RmdXOViWCFU-pZzD87gAAAUw"]
[Sun Apr 26 16:49:31.264419 2026] [:error] [pid 13137:tid 13159] [client 145.239.65.226:56980] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae3Rm90RB4J0o4h5neFSRwAAAhI"]
[Sun Apr 26 16:49:33.262032 2026] [:error] [pid 8383:tid 8401] [client 145.239.65.226:56988] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae3RndFa2S3EsATMdWMNnAAAAAQ"]
[Sun Apr 26 16:49:35.257139 2026] [:error] [pid 8383:tid 8421] [client 145.239.65.226:57000] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ae3Rn9Fa2S3EsATMdWMNnQAAABg"]
[Sun Apr 26 16:49:37.262163 2026] [:error] [pid 22573:tid 22622] [client 145.239.65.226:57010] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae3RoXB3EmQlD4yKUt_KgwAAAY8"]
[Sun Apr 26 16:49:39.242402 2026] [:error] [pid 8383:tid 8415] [client 145.239.65.226:57018] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae3Ro9Fa2S3EsATMdWMNogAAABI"]
[Sun Apr 26 16:49:41.101313 2026] [:error] [pid 8385:tid 8434] [client 145.239.65.226:57024] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae3RpTOy7_J84Wx3-oy6NgAAAEo"]
[Sun Apr 26 16:49:43.105207 2026] [:error] [pid 8491:tid 8516] [client 145.239.65.226:53826] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae3Rpyq7I7e6CJooQM3qlAAAANE"]
[Sun Apr 26 16:49:45.102683 2026] [:error] [pid 8383:tid 8411] [client 145.239.65.226:53840] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae3RqdFa2S3EsATMdWMNpwAAAA4"]
[Sun Apr 26 16:50:07.877467 2026] [:error] [pid 8385:tid 8433] [client 145.239.65.226:53854] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ae3RvzOy7_J84Wx3-oy6UgAAAEk"]
[Sun Apr 26 16:50:09.648563 2026] [:error] [pid 13137:tid 13151] [client 145.239.65.226:60252] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae3Rwd0RB4J0o4h5neFSegAAAgo"]
[Sun Apr 26 16:50:11.671957 2026] [:error] [pid 22572:tid 22579] [client 145.239.65.226:49666] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae3Rw9XOViWCFU-pZzD8-wAAAUE"]
[Sun Apr 26 16:50:13.675051 2026] [:error] [pid 22573:tid 22608] [client 145.239.65.226:49668] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae3RxXB3EmQlD4yKUt_KlAAAAYI"]
[Sun Apr 26 16:50:15.675580 2026] [:error] [pid 8383:tid 8411] [client 145.239.65.226:49670] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae3Rx9Fa2S3EsATMdWMNxQAAAA4"]
[Sun Apr 26 16:50:17.664129 2026] [:error] [pid 22573:tid 22613] [client 145.239.65.226:49686] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae3RyXB3EmQlD4yKUt_KmQAAAYc"]
[Sun Apr 26 16:50:19.661442 2026] [:error] [pid 8385:tid 8444] [client 145.239.65.226:49702] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae3RyzOy7_J84Wx3-oy6VwAAAFQ"]
[Sun Apr 26 16:50:21.503702 2026] [:error] [pid 8383:tid 8416] [client 145.239.65.226:33146] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae3RzdFa2S3EsATMdWMN8QAAABM"]
[Sun Apr 26 16:50:23.492100 2026] [:error] [pid 8383:tid 8404] [client 145.239.65.226:33158] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae3Rz9Fa2S3EsATMdWMN-AAAAAc"]
[Sun Apr 26 16:50:25.481496 2026] [:error] [pid 16515:tid 16540] [client 145.239.65.226:33170] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae3R0VtDrUmgHSvpuLwjzwAAAlY"]
[Sun Apr 26 16:50:27.334979 2026] [:error] [pid 8383:tid 8399] [client 145.239.65.226:33172] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae3R09Fa2S3EsATMdWMOBQAAAAI"]
[Sun Apr 26 16:50:29.333179 2026] [:error] [pid 8383:tid 8412] [client 145.239.65.226:33188] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae3R1dFa2S3EsATMdWMOCgAAAA8"]
[Sun Apr 26 16:50:31.317721 2026] [:error] [pid 16515:tid 16542] [client 145.239.65.226:44566] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ae3R11tDrUmgHSvpuLwj1gAAAlg"]
[Sun Apr 26 16:50:33.298076 2026] [:error] [pid 22573:tid 22607] [client 145.239.65.226:44578] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae3R2XB3EmQlD4yKUt_KnQAAAYE"]
[Sun Apr 26 16:50:35.149131 2026] [:error] [pid 22572:tid 22597] [client 145.239.65.226:44592] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ae3R29XOViWCFU-pZzD9BQAAAVM"]
[Sun Apr 26 16:50:37.159821 2026] [:error] [pid 8385:tid 8436] [client 145.239.65.226:44608] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ae3R3TOy7_J84Wx3-oy6XAAAAEw"]
[Sun Apr 26 18:19:55.982861 2026] [:error] [pid 22573:tid 22609] [client 49.51.38.193:43224] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae3my3B3EmQlD4yKUt_iDAAAAYM"]
[Sun Apr 26 18:37:08.915504 2026] [:error] [pid 13137:tid 13162] [client 51.75.119.153:50006] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae3q1N0RB4J0o4h5neFj7QAAAhU"]
[Sun Apr 26 18:37:10.966520 2026] [:error] [pid 22573:tid 22615] [client 51.75.119.153:34504] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ae3q1nB3EmQlD4yKUt_lUwAAAYg"]
[Sun Apr 26 18:37:12.927609 2026] [:error] [pid 8491:tid 8516] [client 51.75.119.153:57278] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ae3q2Cq7I7e6CJooQM317wAAANE"]
[Sun Apr 26 18:37:15.416650 2026] [:error] [pid 22573:tid 22616] [client 51.75.119.153:33978] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae3q23B3EmQlD4yKUt_lWQAAAYk"]
[Sun Apr 26 18:37:17.230714 2026] [:error] [pid 22573:tid 22611] [client 51.75.119.153:57290] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae3q3XB3EmQlD4yKUt_lXgAAAYU"]
[Sun Apr 26 18:37:19.614122 2026] [:error] [pid 8390:tid 8457] [client 51.75.119.153:33982] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae3q34GPtFK_i9p5yxQ76AAAAIY"]
[Sun Apr 26 18:37:21.593675 2026] [:error] [pid 22572:tid 22587] [client 51.75.119.153:57292] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ae3q4dXOViWCFU-pZzATRQAAAUk"]
[Sun Apr 26 18:37:24.074715 2026] [:error] [pid 16574:tid 16631] [client 51.75.119.153:35882] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae3q5H5MsX8wRQr99nYutQAAA1I"]
[Sun Apr 26 18:37:26.400250 2026] [:error] [pid 13197:tid 13247] [client 51.75.119.153:35894] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae3q5t3kktFKdSxTrBvOogAAAs8"]
[Sun Apr 26 18:37:28.268464 2026] [:error] [pid 16574:tid 16613] [client 51.75.119.153:42482] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ae3q6H5MsX8wRQr99nYuugAAA0k"]
[Sun Apr 26 18:37:30.154822 2026] [:error] [pid 22573:tid 22612] [client 51.75.119.153:42484] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ae3q6nB3EmQlD4yKUt_lZgAAAYY"]
[Sun Apr 26 18:37:32.020205 2026] [:error] [pid 22573:tid 22607] [client 51.75.119.153:42488] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ae3q7HB3EmQlD4yKUt_laQAAAYE"]
[Sun Apr 26 18:37:34.034756 2026] [:error] [pid 8491:tid 8517] [client 51.75.119.153:54878] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae3q7iq7I7e6CJooQM318wAAANI"]
[Sun Apr 26 18:37:36.497845 2026] [:error] [pid 8383:tid 8399] [client 51.75.119.153:35110] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae3q8NFa2S3EsATMdWMyXwAAAAI"]
[Sun Apr 26 18:37:38.958484 2026] [:error] [pid 22572:tid 22598] [client 51.75.119.153:35114] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae3q8tXOViWCFU-pZzATWAAAAVQ"]
[Sun Apr 26 18:37:41.840701 2026] [:error] [pid 8390:tid 8453] [client 51.75.119.153:54892] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae3q9YGPtFK_i9p5yxQ76gAAAII"]
[Sun Apr 26 18:37:45.590429 2026] [:error] [pid 16574:tid 16621] [client 51.75.119.153:50948] [client 51.75.119.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae3q-X5MsX8wRQr99nYuvgAAA00"]
[Sun Apr 26 18:57:40.347391 2026] [:error] [pid 22573:tid 22607] [client 182.42.104.32:58924] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae3vpHB3EmQlD4yKUt_pdgAAAYE"]
[Sun Apr 26 19:46:18.530590 2026] [:error] [pid 22573:tid 22627] [client 43.156.204.134:52632] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae37CnB3EmQlD4yKUt_07wAAAZQ"]
[Sun Apr 26 21:45:54.953456 2026] [:error] [pid 13197:tid 13231] [client 54.37.252.59:35440] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ae4XEt3kktFKdSxTrBvergAAAsA"]
[Sun Apr 26 21:45:56.651613 2026] [:error] [pid 16515:tid 16528] [client 54.37.252.59:58032] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ae4XFFtDrUmgHSvpuLxNswAAAko"]
[Sun Apr 26 21:45:58.613736 2026] [:error] [pid 13197:tid 13237] [client 54.37.252.59:48712] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ae4XFt3kktFKdSxTrBvesAAAAsY"]
[Sun Apr 26 21:46:00.682791 2026] [:error] [pid 8383:tid 8421] [client 54.37.252.59:48718] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ae4XGNFa2S3EsATMdWNt2gAAABg"]
[Sun Apr 26 21:46:03.036991 2026] [:error] [pid 8383:tid 8397] [client 54.37.252.59:45620] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ae4XG9Fa2S3EsATMdWNt3gAAAAA"]
[Sun Apr 26 21:46:05.070534 2026] [:error] [pid 8383:tid 8419] [client 54.37.252.59:55166] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ae4XHdFa2S3EsATMdWNt4gAAABY"]
[Sun Apr 26 21:46:07.122946 2026] [:error] [pid 8390:tid 8455] [client 54.37.252.59:55168] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ae4XH4GPtFK_i9p5yxSIGgAAAIQ"]
[Sun Apr 26 21:46:09.475435 2026] [:error] [pid 13137:tid 13155] [client 54.37.252.59:36908] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae4XId0RB4J0o4h5neGEDAAAAg4"]
[Sun Apr 26 21:46:11.472161 2026] [:error] [pid 8383:tid 8418] [client 54.37.252.59:55176] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ae4XI9Fa2S3EsATMdWNt6QAAABU"]
[Sun Apr 26 21:46:13.873993 2026] [:error] [pid 22572:tid 22585] [client 54.37.252.59:36918] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ae4XJdXOViWCFU-pZzA6IQAAAUc"]
[Sun Apr 26 21:46:15.794389 2026] [:error] [pid 16515:tid 16521] [client 54.37.252.59:43396] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ae4XJ1tDrUmgHSvpuLxNvwAAAkM"]
[Sun Apr 26 21:46:17.849903 2026] [:error] [pid 8383:tid 8405] [client 54.37.252.59:43410] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ae4XKdFa2S3EsATMdWNt7QAAAAg"]
[Sun Apr 26 21:46:19.795075 2026] [:error] [pid 22573:tid 22617] [client 54.37.252.59:43414] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ae4XK3B3EmQlD4yKUt8QpAAAAYo"]
[Sun Apr 26 21:46:21.902285 2026] [:error] [pid 8383:tid 8397] [client 54.37.252.59:43418] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ae4XLdFa2S3EsATMdWNt7gAAAAA"]
[Sun Apr 26 21:46:23.979356 2026] [:error] [pid 22573:tid 22630] [client 54.37.252.59:43432] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ae4XL3B3EmQlD4yKUt8QqgAAAZc"]
[Sun Apr 26 21:46:26.023625 2026] [:error] [pid 16515:tid 16528] [client 54.37.252.59:49158] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ae4XMltDrUmgHSvpuLxNwgAAAko"]
[Sun Apr 26 21:46:28.191747 2026] [:error] [pid 22572:tid 22584] [client 54.37.252.59:49168] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae4XNNXOViWCFU-pZzA6JAAAAUY"]
[Sun Apr 26 21:46:31.901504 2026] [:error] [pid 22572:tid 22596] [client 54.37.252.59:49174] [client 54.37.252.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae4XN9XOViWCFU-pZzA6LQAAAVI"]
[Sun Apr 26 22:22:52.083541 2026] [:error] [pid 8390:tid 8468] [client 81.167.26.57:53941] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ae4fvIGPtFK_i9p5yxSV6QAAAJE"]
[Sun Apr 26 22:22:54.062070 2026] [:error] [pid 8385:tid 8424] [client 81.167.26.57:37396] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ae4fvjOy7_J84Wx3-ozfcQAAAEA"]
[Sun Apr 26 22:22:56.063819 2026] [:error] [pid 8390:tid 8452] [client 81.167.26.57:42052] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ae4fwIGPtFK_i9p5yxSV6wAAAIE"]
[Sun Apr 26 22:22:58.073563 2026] [:error] [pid 16574:tid 16606] [client 81.167.26.57:22576] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ae4fwn5MsX8wRQr99nY_EgAAA0I"]
[Sun Apr 26 22:23:00.051547 2026] [:error] [pid 8390:tid 8457] [client 81.167.26.57:60187] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ae4fxIGPtFK_i9p5yxSV7QAAAIY"]
[Sun Apr 26 22:23:02.603128 2026] [:error] [pid 8383:tid 8413] [client 81.167.26.57:50637] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae4fxtFa2S3EsATMdWN3HAAAABA"]
[Sun Apr 26 22:23:04.600666 2026] [:error] [pid 16515:tid 16539] [client 81.167.26.57:21221] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae4fyFtDrUmgHSvpuLxSJwAAAlU"]
[Sun Apr 26 22:23:07.216805 2026] [:error] [pid 8390:tid 8475] [client 81.167.26.57:10565] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae4fy4GPtFK_i9p5yxSV9gAAAJg"]
[Sun Apr 26 22:23:09.183825 2026] [:error] [pid 8390:tid 8458] [client 81.167.26.57:45987] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae4fzYGPtFK_i9p5yxSV-wAAAIc"]
[Sun Apr 26 22:23:11.180582 2026] [:error] [pid 8383:tid 8414] [client 81.167.26.57:55405] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae4fz9Fa2S3EsATMdWN3KwAAABE"]
[Sun Apr 26 22:23:15.030771 2026] [:error] [pid 8390:tid 8455] [client 81.167.26.57:17846] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae4f04GPtFK_i9p5yxSWBQAAAIQ"]
[Sun Apr 26 22:23:17.565967 2026] [:error] [pid 8390:tid 8467] [client 81.167.26.57:2416] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae4f1YGPtFK_i9p5yxSWBwAAAJA"]
[Sun Apr 26 22:23:20.178336 2026] [:error] [pid 22573:tid 22622] [client 81.167.26.57:5527] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae4f2HB3EmQlD4yKUt8XjgAAAY8"]
[Sun Apr 26 22:23:22.795081 2026] [:error] [pid 22572:tid 22592] [client 81.167.26.57:42784] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae4f2tXOViWCFU-pZzA_yAAAAU4"]
[Sun Apr 26 22:23:25.359354 2026] [:error] [pid 8390:tid 8458] [client 81.167.26.57:41290] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae4f3YGPtFK_i9p5yxSWHQAAAIc"]
[Sun Apr 26 22:23:27.962417 2026] [:error] [pid 8385:tid 8427] [client 81.167.26.57:18844] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae4f3zOy7_J84Wx3-ozftQAAAEM"]
[Sun Apr 26 22:23:29.971941 2026] [:error] [pid 13197:tid 13237] [client 81.167.26.57:46756] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ae4f4d3kktFKdSxTrBvhRwAAAsY"]
[Sun Apr 26 22:23:32.435492 2026] [:error] [pid 22573:tid 22615] [client 81.167.26.57:62757] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ae4f5HB3EmQlD4yKUt8XrQAAAYg"]
[Sun Apr 26 22:23:35.022009 2026] [:error] [pid 22573:tid 22608] [client 81.167.26.57:19442] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae4f53B3EmQlD4yKUt8XtAAAAYI"]
[Sun Apr 26 22:23:37.024491 2026] [:error] [pid 22573:tid 22606] [client 81.167.26.57:25327] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ae4f6XB3EmQlD4yKUt8XvgAAAYA"]
[Sun Apr 26 22:23:39.673659 2026] [:error] [pid 16515:tid 16525] [client 81.167.26.57:59670] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ae4f61tDrUmgHSvpuLxSPQAAAkc"]
[Sun Apr 26 22:23:41.782698 2026] [:error] [pid 22572:tid 22587] [client 81.167.26.57:20356] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ae4f7dXOViWCFU-pZzA_0QAAAUk"]
[Sun Apr 26 22:23:44.364833 2026] [:error] [pid 8383:tid 8409] [client 81.167.26.57:1755] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ae4f8NFa2S3EsATMdWN3SAAAAAw"]
[Sun Apr 26 22:23:46.957637 2026] [:error] [pid 8390:tid 8462] [client 81.167.26.57:32855] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ae4f8oGPtFK_i9p5yxSWegAAAIs"]
[Sun Apr 26 22:23:49.422072 2026] [:error] [pid 16515:tid 16531] [client 81.167.26.57:3504] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ae4f9VtDrUmgHSvpuLxSRAAAAk0"]
[Sun Apr 26 22:24:10.360223 2026] [:error] [pid 22573:tid 22631] [client 81.167.26.57:60849] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae4gCnB3EmQlD4yKUt8YEQAAAZg"]
[Sun Apr 26 22:24:14.188636 2026] [:error] [pid 13197:tid 13250] [client 81.167.26.57:54555] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae4gDt3kktFKdSxTrBvhTgAAAtI"]
[Sun Apr 26 22:25:10.908552 2026] [:error] [pid 8383:tid 8403] [client 212.47.78.129:51578] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae4gRtFa2S3EsATMdWN3lQAAAAY"]
[Sun Apr 26 22:25:11.490905 2026] [:error] [pid 22573:tid 22608] [client 212.47.78.129:58159] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae4gR3B3EmQlD4yKUt8YQgAAAYI"]
[Sun Apr 26 22:25:12.042904 2026] [:error] [pid 8383:tid 8421] [client 212.47.78.129:65236] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "ae4gSNFa2S3EsATMdWN3mgAAABg"]
[Mon Apr 27 00:38:06.802723 2026] [:error] [pid 16515:tid 16521] [client 212.47.78.129:49379] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae4_bltDrUmgHSvpuLxjnAAAAkM"]
[Mon Apr 27 00:38:07.355260 2026] [:error] [pid 8383:tid 8416] [client 212.47.78.129:62576] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae4_b9Fa2S3EsATMdWOgnQAAABM"]
[Mon Apr 27 00:38:07.940830 2026] [:error] [pid 22573:tid 22629] [client 212.47.78.129:63760] [client 212.47.78.129] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "ae4_b3B3EmQlD4yKUt8xlgAAAZY"]
[Mon Apr 27 02:17:54.664721 2026] [:error] [pid 8383:tid 8411] [client 147.135.213.9:42390] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ae5W0tFa2S3EsATMdWO4nwAAAA4"]
[Mon Apr 27 02:20:57.363634 2026] [:error] [pid 16574:tid 16606] [client 147.135.213.9:39926] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ae5XiX5MsX8wRQr99nZSYQAAA0I"]
[Mon Apr 27 02:20:57.815953 2026] [proxy_fcgi:error] [pid 13137:tid 13161] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:58.024839 2026] [proxy_fcgi:error] [pid 13137:tid 13158] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:58.239095 2026] [proxy_fcgi:error] [pid 13137:tid 13163] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:58.450956 2026] [proxy_fcgi:error] [pid 13137:tid 13156] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:58.659847 2026] [proxy_fcgi:error] [pid 13137:tid 13148] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:58.869306 2026] [proxy_fcgi:error] [pid 13137:tid 13143] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:59.082276 2026] [proxy_fcgi:error] [pid 13137:tid 13151] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:20:59.292406 2026] [proxy_fcgi:error] [pid 13137:tid 13140] [client 20.220.233.65:46685] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 02:21:01.312674 2026] [:error] [pid 8383:tid 8419] [client 147.135.213.9:58446] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ae5XjdFa2S3EsATMdWO5lwAAABY"]
[Mon Apr 27 02:21:03.596349 2026] [:error] [pid 22572:tid 22597] [client 147.135.213.9:58462] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae5Xj9XOViWCFU-pZzBiGQAAAVM"]
[Mon Apr 27 02:21:05.823427 2026] [:error] [pid 8383:tid 8412] [client 147.135.213.9:58464] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae5XkdFa2S3EsATMdWO5owAAAA8"]
[Mon Apr 27 02:21:08.484526 2026] [:error] [pid 22573:tid 22616] [client 147.135.213.9:47416] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ae5XlHB3EmQlD4yKUt8_VQAAAYk"]
[Mon Apr 27 02:21:10.886343 2026] [:error] [pid 13137:tid 13163] [client 147.135.213.9:47420] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ae5Xlt0RB4J0o4h5neHQ_gAAAhY"]
[Mon Apr 27 02:21:14.417670 2026] [:error] [pid 13137:tid 13164] [client 147.135.213.9:47428] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ae5Xmt0RB4J0o4h5neHRBQAAAhc"]
[Mon Apr 27 02:21:16.947781 2026] [:error] [pid 22573:tid 22616] [client 147.135.213.9:41542] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ae5XnHB3EmQlD4yKUt8_YgAAAYk"]
[Mon Apr 27 02:21:19.415578 2026] [:error] [pid 16574:tid 16631] [client 147.135.213.9:41552] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ae5Xn35MsX8wRQr99nZSZAAAA1I"]
[Mon Apr 27 02:21:23.552694 2026] [:error] [pid 13197:tid 13233] [client 147.135.213.9:41556] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae5Xo93kktFKdSxTrBv21gAAAsI"]
[Mon Apr 27 02:21:25.895552 2026] [:error] [pid 13137:tid 13143] [client 147.135.213.9:41560] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ae5Xpd0RB4J0o4h5neHRCwAAAgM"]
[Mon Apr 27 02:21:29.513348 2026] [:error] [pid 16515:tid 16532] [client 147.135.213.9:46462] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae5XqVtDrUmgHSvpuLxtgwAAAk4"]
[Mon Apr 27 02:21:34.998495 2026] [:error] [pid 8491:tid 8519] [client 147.135.213.9:46464] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae5Xriq7I7e6CJooQM09yQAAANQ"]
[Mon Apr 27 02:21:39.873714 2026] [:error] [pid 22572:tid 22593] [client 147.135.213.9:56706] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ae5Xs9XOViWCFU-pZzBiHQAAAU8"]
[Mon Apr 27 02:21:44.068882 2026] [:error] [pid 8383:tid 8411] [client 147.135.213.9:56708] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae5XuNFa2S3EsATMdWO5uwAAAA4"]
[Mon Apr 27 02:21:48.944930 2026] [:error] [pid 8383:tid 8397] [client 147.135.213.9:56346] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ae5XvNFa2S3EsATMdWO5xgAAAAA"]
[Mon Apr 27 02:21:52.684979 2026] [:error] [pid 8390:tid 8472] [client 147.135.213.9:56350] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ae5XwIGPtFK_i9p5yxTKSwAAAJU"]
[Mon Apr 27 04:02:20.142010 2026] [:error] [pid 22647:tid 22718] [client 43.167.241.46:46752] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae5vTGjfVULTjnk5SzNi2wAAAIg"]
[Mon Apr 27 04:08:51.814613 2026] [:error] [pid 22647:tid 22723] [client 89.163.146.197:57514] [client 89.163.146.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ae5w02jfVULTjnk5SzNlmwAAAI0"], referer: www.google.com
[Mon Apr 27 04:14:24.854262 2026] [proxy_fcgi:error] [pid 22751:tid 22772] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:24.876991 2026] [proxy_fcgi:error] [pid 22751:tid 22773] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:24.913084 2026] [proxy_fcgi:error] [pid 22751:tid 22767] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:24.931061 2026] [proxy_fcgi:error] [pid 22751:tid 22771] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:24.966032 2026] [proxy_fcgi:error] [pid 22751:tid 22776] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:24.986666 2026] [proxy_fcgi:error] [pid 22751:tid 22760] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:25.010406 2026] [proxy_fcgi:error] [pid 22751:tid 22765] [client 20.92.73.174:8124] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 04:14:25.077665 2026] [:error] [pid 22751:tid 22777] [client 20.92.73.174:8124] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae5yISc0tCpVyVdFok9jOAAAANc"]
[Mon Apr 27 04:14:25.140250 2026] [:error] [pid 22645:tid 22656] [client 20.92.73.174:8102] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae5yIX-Pq2r302zQbMaCywAAAAE"]
[Mon Apr 27 04:14:25.201708 2026] [:error] [pid 22647:tid 22712] [client 20.92.73.174:8111] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae5yIWjfVULTjnk5SzNoWwAAAII"]
[Mon Apr 27 04:14:25.265015 2026] [:error] [pid 22647:tid 22710] [client 20.92.73.174:8066] [client 20.92.73.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae5yIWjfVULTjnk5SzNoXQAAAIA"]
[Mon Apr 27 04:19:26.699351 2026] [:error] [pid 22751:tid 22771] [client 111.37.69.37:5284] [client 111.37.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae5zTic0tCpVyVdFok9oNAAAANE"], referer: http://switchcreative.net/
[Mon Apr 27 07:18:56.348792 2026] [:error] [pid 36789:tid 36807] [client 149.22.83.21:54962] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ae6dYNnrZBzXPaJGSeLcLAAAANA"]
[Mon Apr 27 07:18:58.629879 2026] [:error] [pid 36575:tid 36587] [client 149.22.83.21:36014] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae6dYreGZIkifrMjcl9FAwAAAQo"]
[Mon Apr 27 07:19:01.828316 2026] [:error] [pid 36575:tid 36578] [client 149.22.83.21:49562] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae6dZbeGZIkifrMjcl9FDAAAAQE"]
[Mon Apr 27 07:19:03.995004 2026] [:error] [pid 36489:tid 36533] [client 149.22.83.21:36018] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae6dZ46sRkW8OfGv18qxywAAAEw"]
[Mon Apr 27 07:19:07.075636 2026] [:error] [pid 36489:tid 36523] [client 149.22.83.21:57536] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae6da46sRkW8OfGv18qxzAAAAEI"]
[Mon Apr 27 07:19:09.988431 2026] [:error] [pid 36489:tid 36529] [client 149.22.83.21:57540] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ae6dbY6sRkW8OfGv18qx1AAAAEg"]
[Mon Apr 27 07:19:12.096292 2026] [:error] [pid 36488:tid 36500] [client 149.22.83.21:52172] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae6dcMIA2VZgjxmwXxP1swAAAAc"]
[Mon Apr 27 07:19:15.007973 2026] [:error] [pid 36490:tid 36550] [client 149.22.83.21:57552] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae6dc0xiWa1s9LPhuWKv-QAAAII"]
[Mon Apr 27 07:19:18.523912 2026] [:error] [pid 36789:tid 36793] [client 149.22.83.21:41762] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ae6ddtnrZBzXPaJGSeLcWQAAAMI"]
[Mon Apr 27 07:19:21.756174 2026] [:error] [pid 36489:tid 36530] [client 149.22.83.21:41778] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ae6deY6sRkW8OfGv18qx5gAAAEk"]
[Mon Apr 27 07:19:24.865978 2026] [:error] [pid 36575:tid 36591] [client 149.22.83.21:41788] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ae6dfLeGZIkifrMjcl9FHgAAAQ4"]
[Mon Apr 27 07:19:27.993653 2026] [:error] [pid 36490:tid 36549] [client 149.22.83.21:46052] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ae6df0xiWa1s9LPhuWKwCwAAAIE"]
[Mon Apr 27 07:19:31.062431 2026] [:error] [pid 36789:tid 36796] [client 149.22.83.21:46056] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ae6dg9nrZBzXPaJGSeLcdwAAAMU"]
[Mon Apr 27 07:19:34.154321 2026] [:error] [pid 36789:tid 36799] [client 149.22.83.21:46072] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ae6dhtnrZBzXPaJGSeLchgAAAMg"]
[Mon Apr 27 07:19:37.376766 2026] [:error] [pid 36789:tid 36809] [client 149.22.83.21:34992] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ae6didnrZBzXPaJGSeLcmQAAANI"]
[Mon Apr 27 07:19:40.514135 2026] [:error] [pid 36789:tid 36813] [client 149.22.83.21:34994] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ae6djNnrZBzXPaJGSeLcsAAAANY"]
[Mon Apr 27 07:19:43.533102 2026] [:error] [pid 36489:tid 36539] [client 149.22.83.21:35006] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ae6dj46sRkW8OfGv18qx8gAAAFI"]
[Mon Apr 27 07:19:46.706422 2026] [:error] [pid 36489:tid 36525] [client 149.22.83.21:57828] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ae6dko6sRkW8OfGv18qx-gAAAEQ"]
[Mon Apr 27 07:19:49.848307 2026] [:error] [pid 36489:tid 36539] [client 149.22.83.21:57838] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ae6dlY6sRkW8OfGv18qyBQAAAFI"]
[Mon Apr 27 07:19:52.867170 2026] [:error] [pid 36789:tid 36800] [client 149.22.83.21:57842] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae6dmNnrZBzXPaJGSeLcxQAAAMk"]
[Mon Apr 27 07:20:17.619324 2026] [:error] [pid 36489:tid 36540] [client 149.22.83.21:57848] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae6dsY6sRkW8OfGv18qyLgAAAFM"]
[Mon Apr 27 07:20:21.978604 2026] [:error] [pid 36575:tid 36587] [client 149.22.83.21:35216] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ae6dtbeGZIkifrMjcl9FeAAAAQo"]
[Mon Apr 27 07:20:25.091380 2026] [:error] [pid 36488:tid 36506] [client 149.22.83.21:35232] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ae6ducIA2VZgjxmwXxP1-wAAAA0"]
[Mon Apr 27 07:20:28.240651 2026] [:error] [pid 36575:tid 36599] [client 149.22.83.21:35140] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ae6dvLeGZIkifrMjcl9FhQAAARY"]
[Mon Apr 27 07:20:31.331889 2026] [:error] [pid 36488:tid 36508] [client 149.22.83.21:35142] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae6dv8IA2VZgjxmwXxP2BAAAAA8"]
[Mon Apr 27 07:20:34.471551 2026] [:error] [pid 36489:tid 36541] [client 149.22.83.21:35150] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae6dwo6sRkW8OfGv18qyPwAAAFQ"]
[Mon Apr 27 07:20:36.672410 2026] [:error] [pid 36490:tid 36553] [client 149.22.83.21:49358] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae6dxExiWa1s9LPhuWKweAAAAIU"]
[Mon Apr 27 07:20:39.870358 2026] [:error] [pid 36789:tid 36800] [client 149.22.83.21:55310] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae6dx9nrZBzXPaJGSeLdGgAAAMk"]
[Mon Apr 27 07:20:42.962986 2026] [:error] [pid 36490:tid 36560] [client 149.22.83.21:55318] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ae6dykxiWa1s9LPhuWKwfgAAAIw"]
[Mon Apr 27 07:20:45.116535 2026] [:error] [pid 36490:tid 36549] [client 149.22.83.21:49372] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae6dzUxiWa1s9LPhuWKwgQAAAIE"]
[Mon Apr 27 07:20:50.668461 2026] [:error] [pid 36789:tid 36794] [client 149.22.83.21:50594] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae6d0tnrZBzXPaJGSeLdNAAAAMM"]
[Mon Apr 27 07:20:53.066335 2026] [:error] [pid 36489:tid 36539] [client 149.22.83.21:46876] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae6d1Y6sRkW8OfGv18qySAAAAFI"]
[Mon Apr 27 07:20:59.214115 2026] [:error] [pid 36575:tid 36599] [client 149.22.83.21:42334] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae6d27eGZIkifrMjcl9FvwAAARY"]
[Mon Apr 27 07:21:01.481534 2026] [:error] [pid 36488:tid 36514] [client 149.22.83.21:60376] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae6d3cIA2VZgjxmwXxP2HgAAABU"]
[Mon Apr 27 07:21:05.687328 2026] [:error] [pid 36489:tid 36533] [client 149.22.83.21:42338] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae6d4Y6sRkW8OfGv18qyWgAAAEw"]
[Mon Apr 27 07:21:08.897156 2026] [:error] [pid 36789:tid 36812] [client 149.22.83.21:38066] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ae6d5NnrZBzXPaJGSeLdVwAAANU"]
[Mon Apr 27 07:21:11.971839 2026] [:error] [pid 36490:tid 36559] [client 149.22.83.21:38072] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ae6d50xiWa1s9LPhuWKwrQAAAIs"]
[Mon Apr 27 07:21:14.990435 2026] [:error] [pid 36789:tid 36810] [client 149.22.83.21:38084] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ae6d6tnrZBzXPaJGSeLdXgAAANM"]
[Mon Apr 27 07:21:45.108947 2026] [:error] [pid 36575:tid 36591] [client 149.22.83.21:43606] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae6eCbeGZIkifrMjcl9G8wAAAQ4"]
[Mon Apr 27 07:21:47.229356 2026] [:error] [pid 36789:tid 36811] [client 149.22.83.21:33280] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae6eC9nrZBzXPaJGSeLd3AAAANQ"]
[Mon Apr 27 07:21:50.261731 2026] [:error] [pid 36490:tid 36557] [client 149.22.83.21:45820] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae6eDkxiWa1s9LPhuWKw4gAAAIk"]
[Mon Apr 27 07:21:52.578958 2026] [:error] [pid 36489:tid 36538] [client 149.22.83.21:33294] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae6eEI6sRkW8OfGv18qykwAAAFE"]
[Mon Apr 27 07:21:54.274864 2026] [:error] [pid 36575:tid 36595] [client 149.22.83.21:33308] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae6eEreGZIkifrMjcl9HDAAAARI"]
[Mon Apr 27 07:21:58.442640 2026] [:error] [pid 36575:tid 36582] [client 149.22.83.21:46564] [client 149.22.83.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae6eFreGZIkifrMjcl9HGgAAAQU"]
[Mon Apr 27 08:33:00.974619 2026] [:error] [pid 50861:tid 50886] [client 122.161.241.10:9230] [client 122.161.241.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.241.10, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ae6uvGCmVQOCiCZfqR5pxgAAABU"]
[Mon Apr 27 08:33:00.985170 2026] [proxy_fcgi:error] [pid 50861:tid 50886] [client 122.161.241.10:9230] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 09:20:02.467819 2026] [:error] [pid 10867:tid 10876] [client 194.247.173.99:53686] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ae65wrOAkozQqeaYR1taGQAAAAY"]
[Mon Apr 27 09:20:05.376844 2026] [:error] [pid 10867:tid 10893] [client 194.247.173.99:36850] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae65xbOAkozQqeaYR1taGwAAABc"]
[Mon Apr 27 09:20:08.017430 2026] [:error] [pid 10926:tid 10937] [client 194.247.173.99:36856] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae65yM5JVz6UQRubscMHOgAAAYk"]
[Mon Apr 27 09:20:11.731007 2026] [:error] [pid 10867:tid 10873] [client 194.247.173.99:50492] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae65y7OAkozQqeaYR1taIgAAAAM"]
[Mon Apr 27 09:20:14.513466 2026] [:error] [pid 6971:tid 7018] [client 194.247.173.99:50494] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ae65zrOap7jCIaP4nNPavQAAANE"]
[Mon Apr 27 09:20:17.170702 2026] [:error] [pid 7056:tid 7070] [client 194.247.173.99:50498] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ae650SaiHlvwyvjHbet46wAAAQs"]
[Mon Apr 27 09:20:20.234312 2026] [:error] [pid 7056:tid 7083] [client 194.247.173.99:33966] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ae651CaiHlvwyvjHbet47gAAARg"]
[Mon Apr 27 09:20:23.534959 2026] [:error] [pid 7056:tid 7076] [client 194.247.173.99:33968] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae651yaiHlvwyvjHbet48gAAARE"]
[Mon Apr 27 09:20:26.367008 2026] [:error] [pid 10926:tid 10934] [client 194.247.173.99:33980] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae652s5JVz6UQRubscMHSgAAAYY"]
[Mon Apr 27 09:20:29.201162 2026] [:error] [pid 7056:tid 7068] [client 194.247.173.99:33996] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae653SaiHlvwyvjHbet4-gAAAQk"]
[Mon Apr 27 09:20:31.907283 2026] [:error] [pid 7056:tid 7069] [client 194.247.173.99:55010] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae653yaiHlvwyvjHbet4_wAAAQo"]
[Mon Apr 27 09:20:33.814722 2026] [:error] [pid 7056:tid 7071] [client 194.247.173.99:39322] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae654SaiHlvwyvjHbet5AQAAAQw"]
[Mon Apr 27 09:20:37.709223 2026] [:error] [pid 7056:tid 7060] [client 194.247.173.99:39326] [client 194.247.173.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae655SaiHlvwyvjHbet5BwAAAQE"]
[Mon Apr 27 09:24:43.100940 2026] [:error] [pid 6971:tid 7009] [client 104.28.152.248:57853] [client 104.28.152.248] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ae6627Oap7jCIaP4nNPbVAAAAMg"]
[Mon Apr 27 09:58:42.308930 2026] [:error] [pid 10896:tid 10898] [client 147.135.213.175:42216] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ae7C0l7aFv2GLXAkamnaoQAAAEA"]
[Mon Apr 27 09:58:44.147849 2026] [:error] [pid 6970:tid 6994] [client 147.135.213.175:44364] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ae7C1Cs_dFVzfQoHW0RKpQAAAJQ"]
[Mon Apr 27 09:58:46.035552 2026] [:error] [pid 6971:tid 7005] [client 147.135.213.175:44372] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ae7C1rOap7jCIaP4nNPiYQAAAMQ"]
[Mon Apr 27 09:58:47.923175 2026] [:error] [pid 7056:tid 7067] [client 147.135.213.175:44386] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ae7C1yaiHlvwyvjHbeuHawAAAQg"]
[Mon Apr 27 09:58:49.819351 2026] [:error] [pid 10896:tid 10911] [client 147.135.213.175:50834] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ae7C2V7aFv2GLXAkamnaqAAAAE0"]
[Mon Apr 27 09:58:51.855570 2026] [:error] [pid 10926:tid 10938] [client 147.135.213.175:50842] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ae7C285JVz6UQRubscMbzwAAAYo"]
[Mon Apr 27 09:58:53.756428 2026] [:error] [pid 10926:tid 10944] [client 147.135.213.175:50858] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae7C3c5JVz6UQRubscMb2QAAAZA"]
[Mon Apr 27 09:58:55.677959 2026] [:error] [pid 7056:tid 7061] [client 147.135.213.175:50866] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae7C3yaiHlvwyvjHbeuHfgAAAQI"]
[Mon Apr 27 09:58:57.591044 2026] [:error] [pid 7056:tid 7081] [client 147.135.213.175:50882] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae7C4SaiHlvwyvjHbeuHggAAARY"]
[Mon Apr 27 09:58:59.459404 2026] [:error] [pid 10867:tid 10890] [client 147.135.213.175:37182] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae7C47OAkozQqeaYR1tjAAAAABQ"]
[Mon Apr 27 09:59:01.382082 2026] [:error] [pid 10867:tid 10887] [client 147.135.213.175:37190] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ae7C5bOAkozQqeaYR1tjAwAAABE"]
[Mon Apr 27 09:59:03.282683 2026] [:error] [pid 10867:tid 10873] [client 147.135.213.175:37202] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae7C57OAkozQqeaYR1tjBgAAAAM"]
[Mon Apr 27 09:59:05.177335 2026] [:error] [pid 10896:tid 10903] [client 147.135.213.175:37204] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae7C6V7aFv2GLXAkamnavAAAAEU"]
[Mon Apr 27 09:59:07.102773 2026] [:error] [pid 6972:tid 7042] [client 147.135.213.175:37214] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae7C6-JniPbCiT6NuKfQfAAAAU4"]
[Mon Apr 27 09:59:09.187720 2026] [:error] [pid 10896:tid 10904] [client 147.135.213.175:33204] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ae7C7V7aFv2GLXAkamnaywAAAEY"]
[Mon Apr 27 09:59:11.242863 2026] [:error] [pid 6970:tid 6998] [client 147.135.213.175:33220] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ae7C7ys_dFVzfQoHW0RKtQAAAJg"]
[Mon Apr 27 09:59:13.027730 2026] [:error] [pid 10867:tid 10871] [client 147.135.213.175:33228] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ae7C8bOAkozQqeaYR1tjEwAAAAE"]
[Mon Apr 27 09:59:14.950735 2026] [:error] [pid 6971:tid 7009] [client 147.135.213.175:33234] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae7C8rOap7jCIaP4nNPikAAAAMg"]
[Mon Apr 27 09:59:17.057589 2026] [:error] [pid 6970:tid 6997] [client 147.135.213.175:33246] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae7C9Ss_dFVzfQoHW0RKuwAAAJc"]
[Mon Apr 27 09:59:18.971863 2026] [:error] [pid 10867:tid 10875] [client 147.135.213.175:41702] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae7C9rOAkozQqeaYR1tjFwAAAAU"]
[Mon Apr 27 09:59:20.886526 2026] [:error] [pid 10867:tid 10879] [client 147.135.213.175:41710] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae7C-LOAkozQqeaYR1tjGQAAAAk"]
[Mon Apr 27 09:59:22.798354 2026] [:error] [pid 10867:tid 10885] [client 147.135.213.175:41720] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae7C-rOAkozQqeaYR1tjIAAAAA8"]
[Mon Apr 27 09:59:24.700926 2026] [:error] [pid 7056:tid 7073] [client 147.135.213.175:41722] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae7C_CaiHlvwyvjHbeuHqgAAAQ4"]
[Mon Apr 27 09:59:26.638551 2026] [:error] [pid 6972:tid 7037] [client 147.135.213.175:41730] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ae7C_uJniPbCiT6NuKfQlQAAAUk"]
[Mon Apr 27 09:59:28.553945 2026] [:error] [pid 7056:tid 7080] [client 147.135.213.175:42588] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae7DACaiHlvwyvjHbeuHsQAAARU"]
[Mon Apr 27 09:59:30.446014 2026] [:error] [pid 6970:tid 6994] [client 147.135.213.175:42596] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae7DAis_dFVzfQoHW0RKyAAAAJQ"]
[Mon Apr 27 09:59:32.368563 2026] [:error] [pid 7056:tid 7071] [client 147.135.213.175:42600] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae7DBCaiHlvwyvjHbeuHtgAAAQw"]
[Mon Apr 27 09:59:34.250831 2026] [:error] [pid 10867:tid 10871] [client 147.135.213.175:42616] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae7DBrOAkozQqeaYR1tjKQAAAAE"]
[Mon Apr 27 09:59:36.140103 2026] [:error] [pid 6970:tid 6974] [client 147.135.213.175:42620] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae7DCCs_dFVzfQoHW0RKzwAAAIA"]
[Mon Apr 27 09:59:39.438787 2026] [:error] [pid 10926:tid 10937] [client 147.135.213.175:40646] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae7DC85JVz6UQRubscMcFwAAAYk"]
[Mon Apr 27 10:00:01.388970 2026] [:error] [pid 6971:tid 7003] [client 147.135.213.175:40654] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ae7DIbOap7jCIaP4nNPitwAAAMI"]
[Mon Apr 27 10:00:03.354297 2026] [:error] [pid 10867:tid 10871] [client 147.135.213.175:43862] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae7DI7OAkozQqeaYR1tjeQAAAAE"]
[Mon Apr 27 10:00:05.242139 2026] [:error] [pid 10867:tid 10879] [client 147.135.213.175:43868] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae7DJbOAkozQqeaYR1tjewAAAAk"]
[Mon Apr 27 10:00:07.272459 2026] [:error] [pid 7056:tid 7069] [client 147.135.213.175:43880] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae7DJyaiHlvwyvjHbeuIBAAAAQo"]
[Mon Apr 27 10:00:09.302122 2026] [:error] [pid 6970:tid 6986] [client 147.135.213.175:33890] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae7DKSs_dFVzfQoHW0RLOwAAAIw"]
[Mon Apr 27 10:00:11.177600 2026] [:error] [pid 7056:tid 7060] [client 147.135.213.175:33902] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae7DKyaiHlvwyvjHbeuICAAAAQE"]
[Mon Apr 27 10:00:13.208812 2026] [:error] [pid 10896:tid 10908] [client 147.135.213.175:33906] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae7DLV7aFv2GLXAkamna_gAAAEo"]
[Mon Apr 27 10:00:15.225137 2026] [:error] [pid 10867:tid 10890] [client 147.135.213.175:33912] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae7DL7OAkozQqeaYR1tjjAAAABQ"]
[Mon Apr 27 10:00:17.094405 2026] [:error] [pid 6971:tid 7021] [client 147.135.213.175:33920] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae7DMbOap7jCIaP4nNPiwAAAANQ"]
[Mon Apr 27 10:00:19.128210 2026] [:error] [pid 6972:tid 7029] [client 147.135.213.175:48160] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae7DM-JniPbCiT6NuKfQpwAAAUE"]
[Mon Apr 27 10:00:21.159524 2026] [:error] [pid 6970:tid 6982] [client 147.135.213.175:48168] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae7DNSs_dFVzfQoHW0RLRAAAAIg"]
[Mon Apr 27 10:00:23.022602 2026] [:error] [pid 10896:tid 10922] [client 147.135.213.175:48174] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae7DN17aFv2GLXAkamnbAQAAAFg"]
[Mon Apr 27 10:00:25.058639 2026] [:error] [pid 10926:tid 10934] [client 147.135.213.175:48178] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ae7DOc5JVz6UQRubscMcVwAAAYY"]
[Mon Apr 27 10:00:27.078137 2026] [:error] [pid 6972:tid 7039] [client 147.135.213.175:48190] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae7DO-JniPbCiT6NuKfQqwAAAUs"]
[Mon Apr 27 10:00:29.093506 2026] [:error] [pid 6972:tid 7038] [client 147.135.213.175:45166] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ae7DPeJniPbCiT6NuKfQrgAAAUo"]
[Mon Apr 27 10:00:30.959634 2026] [:error] [pid 7056:tid 7080] [client 147.135.213.175:45180] [client 147.135.213.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ae7DPiaiHlvwyvjHbeuIFwAAARU"]
[Mon Apr 27 11:48:46.496665 2026] [:error] [pid 55880:tid 55908] [client 147.135.213.32:33026] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae7cnqN2h-rTwcbUWTCK_gAAAJg"]
[Mon Apr 27 11:48:48.397783 2026] [:error] [pid 55882:tid 55945] [client 147.135.213.32:56990] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ae7coBT-oLgX4cIe87Mi8gAAAUY"]
[Mon Apr 27 11:48:50.369510 2026] [:error] [pid 55880:tid 55895] [client 147.135.213.32:57000] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ae7coqN2h-rTwcbUWTCLBAAAAIs"]
[Mon Apr 27 11:48:52.800144 2026] [:error] [pid 55881:tid 55928] [client 147.135.213.32:60938] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae7cpJw4Xkh9-1_nCVidwAAAANA"]
[Mon Apr 27 11:48:54.748663 2026] [:error] [pid 55881:tid 55935] [client 147.135.213.32:57010] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae7cppw4Xkh9-1_nCVidwgAAANc"]
[Mon Apr 27 11:48:57.210423 2026] [:error] [pid 55881:tid 55915] [client 147.135.213.32:60950] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae7cqZw4Xkh9-1_nCVidxQAAAMM"]
[Mon Apr 27 11:48:59.138834 2026] [:error] [pid 55882:tid 55940] [client 147.135.213.32:40884] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ae7cqxT-oLgX4cIe87Mi_wAAAUE"]
[Mon Apr 27 11:49:01.400282 2026] [:error] [pid 55967:tid 55977] [client 147.135.213.32:43610] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae7crZqILaJi17iamABq2gAAAAg"]
[Mon Apr 27 11:49:03.854195 2026] [:error] [pid 55967:tid 55985] [client 147.135.213.32:43614] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae7cr5qILaJi17iamABq4AAAABA"]
[Mon Apr 27 11:49:05.608923 2026] [:error] [pid 55881:tid 55926] [client 147.135.213.32:40888] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ae7csZw4Xkh9-1_nCVidyQAAAM4"]
[Mon Apr 27 11:49:07.410675 2026] [:error] [pid 55967:tid 55982] [client 147.135.213.32:50832] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ae7cs5qILaJi17iamABq5QAAAA0"]
[Mon Apr 27 11:49:09.221084 2026] [:error] [pid 55882:tid 55947] [client 147.135.213.32:50838] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ae7ctRT-oLgX4cIe87MjBwAAAUg"]
[Mon Apr 27 11:49:11.158864 2026] [:error] [pid 55967:tid 55991] [client 147.135.213.32:50840] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae7ct5qILaJi17iamABq6AAAABY"]
[Mon Apr 27 11:49:13.422045 2026] [:error] [pid 55882:tid 55957] [client 147.135.213.32:43036] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae7cuRT-oLgX4cIe87MjCwAAAVI"]
[Mon Apr 27 11:49:15.732074 2026] [:error] [pid 55881:tid 55930] [client 147.135.213.32:43052] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae7cu5w4Xkh9-1_nCVid0QAAANI"]
[Mon Apr 27 11:49:19.611515 2026] [:error] [pid 55880:tid 55885] [client 147.135.213.32:55182] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae7cv6N2h-rTwcbUWTCLGQAAAIE"]
[Mon Apr 27 11:49:23.403881 2026] [:error] [pid 55882:tid 55943] [client 147.135.213.32:55190] [client 147.135.213.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae7cwxT-oLgX4cIe87MjEQAAAUQ"]
[Mon Apr 27 13:13:48.006577 2026] [:error] [pid 62607:tid 62627] [client 43.130.26.3:35146] [client 43.130.26.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae7wjIXk80_zcPo33vebVwAAAFI"]
[Mon Apr 27 13:51:51.950605 2026] [:error] [pid 62510:tid 62564] [client 34.55.86.97:57169] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/system/js/core.js"] [unique_id "ae75d4CpoM1jGOxUMpv3eAAAANM"]
[Mon Apr 27 14:37:27.505372 2026] [:error] [pid 41010:tid 41043] [client 185.212.115.159:56929] [client 185.212.115.159] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||switchcreative.net|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/s3cmd.ini"] [unique_id "ae8EJzc-oOrM_e97_4DX7AAAAcE"]
[Mon Apr 27 15:02:51.477106 2026] [:error] [pid 41098:tid 41109] [client 180.153.236.219:5455] [client 180.153.236.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae8KG-IJ72vFwurGAAs3_AAAAAk"], referer: http://switchcreative.net/
[Mon Apr 27 19:55:54.252823 2026] [:error] [pid 5686:tid 5698] [client 51.68.34.57:41626] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ae9Oyhcinw5wXX1GgKhE5QAAAYI"]
[Mon Apr 27 19:55:56.070927 2026] [:error] [pid 5687:tid 5744] [client 51.68.34.57:51546] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae9OzPV0ZjE4BqstkBStwgAAAdQ"]
[Mon Apr 27 19:55:57.973589 2026] [:error] [pid 5783:tid 5805] [client 51.68.34.57:51562] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae9OzdGYC9akv7hyhJVIwwAAAFQ"]
[Mon Apr 27 19:55:59.923492 2026] [:error] [pid 5688:tid 5766] [client 51.68.34.57:51566] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae9Oz_ODqzfytZx8bbwiIQAAAA8"]
[Mon Apr 27 19:56:01.880831 2026] [:error] [pid 5686:tid 5699] [client 51.68.34.57:38436] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae9O0Rcinw5wXX1GgKhE7wAAAYM"]
[Mon Apr 27 19:56:03.933756 2026] [:error] [pid 5783:tid 5793] [client 51.68.34.57:38442] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae9O09GYC9akv7hyhJVIzQAAAEg"]
[Mon Apr 27 19:56:06.105271 2026] [:error] [pid 5687:tid 5728] [client 51.68.34.57:38450] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae9O1vV0ZjE4BqstkBSt0gAAAcQ"]
[Mon Apr 27 19:56:09.879356 2026] [:error] [pid 5688:tid 5753] [client 51.68.34.57:38460] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae9O2fODqzfytZx8bbwiOQAAAAI"]
[Mon Apr 27 19:58:25.261036 2026] [:error] [pid 5783:tid 5797] [client 51.68.34.57:47278] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae9PYdGYC9akv7hyhJVKaQAAAEw"]
[Mon Apr 27 19:58:27.132698 2026] [:error] [pid 5686:tid 5696] [client 51.68.34.57:47286] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae9PYxcinw5wXX1GgKhFXAAAAYA"]
[Mon Apr 27 19:58:29.089496 2026] [:error] [pid 5687:tid 5739] [client 51.68.34.57:47288] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ae9PZfV0ZjE4BqstkBSukwAAAc8"]
[Mon Apr 27 19:58:31.167963 2026] [:error] [pid 5783:tid 5797] [client 51.68.34.57:33226] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae9PZ9GYC9akv7hyhJVKpwAAAEw"]
[Mon Apr 27 19:58:32.992350 2026] [:error] [pid 5783:tid 5794] [client 51.68.34.57:33236] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ae9PaNGYC9akv7hyhJVKsAAAAEk"]
[Mon Apr 27 19:58:34.781250 2026] [:error] [pid 5783:tid 5805] [client 51.68.34.57:33246] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae9PatGYC9akv7hyhJVKuQAAAFQ"]
[Mon Apr 27 19:58:38.583541 2026] [:error] [pid 5688:tid 5774] [client 51.68.34.57:33254] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae9PbvODqzfytZx8bbwjfwAAABc"]
[Mon Apr 27 23:47:12.639183 2026] [:error] [pid 13554:tid 13559] [client 176.15.223.213:58776] [client 176.15.223.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae-FAHJx87Dl-xMmL92_lAAAAMM"]
[Tue Apr 28 01:14:44.213695 2026] [:error] [pid 13465:tid 13507] [client 147.135.214.166:32966] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ae-ZhP19I-6GBJQxn_jlywAAAEw"]
[Tue Apr 28 01:14:46.474385 2026] [:error] [pid 13464:tid 13488] [client 147.135.214.166:36338] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ae-ZhmIEa0q6oQ95zvFLMwAAAdQ"]
[Tue Apr 28 01:14:48.316595 2026] [:error] [pid 48914:tid 48939] [client 147.135.214.166:51126] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae-ZiHwuHR_nwT9alH8VzQAAAVY"]
[Tue Apr 28 01:14:51.001584 2026] [:error] [pid 36747:tid 36773] [client 147.135.214.166:36346] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ae-Zi89QpT00aPhkIcdYpQAAAZg"]
[Tue Apr 28 01:14:53.225147 2026] [:error] [pid 13465:tid 13503] [client 147.135.214.166:40636] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae-Zjf19I-6GBJQxn_jlzAAAAEg"]
[Tue Apr 28 01:14:55.734861 2026] [:error] [pid 13554:tid 13578] [client 147.135.214.166:41828] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ae-Zj3Jx87Dl-xMmL93VbQAAANY"]
[Tue Apr 28 01:14:58.127712 2026] [:error] [pid 31555:tid 31562] [client 147.135.214.166:41840] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ae-ZkrJDZf3DNaSMAJ266AAAAAU"]
[Tue Apr 28 01:15:00.052694 2026] [:error] [pid 13465:tid 13508] [client 147.135.214.166:50380] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae-ZlP19I-6GBJQxn_jl2gAAAE0"]
[Tue Apr 28 01:15:03.159155 2026] [:error] [pid 48914:tid 48923] [client 147.135.214.166:41854] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ae-Zl3wuHR_nwT9alH8V1AAAAUY"]
[Tue Apr 28 01:15:05.494659 2026] [:error] [pid 48914:tid 48930] [client 147.135.214.166:41864] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ae-ZmXwuHR_nwT9alH8V3AAAAU0"]
[Tue Apr 28 01:15:07.920545 2026] [:error] [pid 13554:tid 13556] [client 147.135.214.166:53952] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ae-Zm3Jx87Dl-xMmL93VggAAAMA"]
[Tue Apr 28 01:15:10.254814 2026] [:error] [pid 13465:tid 13519] [client 147.135.214.166:53966] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ae-Znv19I-6GBJQxn_jl4QAAAFg"]
[Tue Apr 28 01:15:12.605281 2026] [:error] [pid 13523:tid 13534] [client 147.135.214.166:53980] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ae-ZoOeav51IXKv1ebExpAAAAIk"]
[Tue Apr 28 01:15:15.251122 2026] [:error] [pid 13465:tid 13516] [client 147.135.214.166:53992] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ae-Zo_19I-6GBJQxn_jl5AAAAFU"]
[Tue Apr 28 01:15:17.806410 2026] [:error] [pid 13465:tid 13511] [client 147.135.214.166:56758] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ae-Zpf19I-6GBJQxn_jl6gAAAFA"]
[Tue Apr 28 01:15:20.166760 2026] [:error] [pid 13465:tid 13512] [client 147.135.214.166:56766] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ae-ZqP19I-6GBJQxn_jl8gAAAFE"]
[Tue Apr 28 01:15:22.763532 2026] [:error] [pid 13465:tid 13501] [client 147.135.214.166:56778] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ae-Zqv19I-6GBJQxn_jl9AAAAEY"]
[Tue Apr 28 01:15:25.031060 2026] [:error] [pid 13554:tid 13569] [client 147.135.214.166:56790] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ae-ZrXJx87Dl-xMmL93VjAAAAM0"]
[Tue Apr 28 01:15:27.596118 2026] [:error] [pid 48914:tid 48934] [client 147.135.214.166:42616] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ae-Zr3wuHR_nwT9alH8V5gAAAVE"]
[Tue Apr 28 01:15:30.044516 2026] [:error] [pid 13554:tid 13576] [client 147.135.214.166:42624] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ae-ZsnJx87Dl-xMmL93VlwAAANQ"]
[Tue Apr 28 01:15:32.697834 2026] [:error] [pid 13465:tid 13514] [client 147.135.214.166:42640] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae-ZtP19I-6GBJQxn_jl-QAAAFM"]
[Tue Apr 28 01:15:35.336647 2026] [:error] [pid 13554:tid 13559] [client 147.135.214.166:42646] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ae-Zt3Jx87Dl-xMmL93VpAAAAMM"]
[Tue Apr 28 01:15:37.690518 2026] [:error] [pid 42612:tid 42774] [client 147.135.214.166:53942] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ae-ZuTCDyZvIG2oFcJ7b4gAAARE"]
[Tue Apr 28 01:15:40.032739 2026] [:error] [pid 42612:tid 42772] [client 147.135.214.166:53948] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ae-ZvDCDyZvIG2oFcJ7b5AAAAQ8"]
[Tue Apr 28 01:16:01.451548 2026] [:error] [pid 13465:tid 13501] [client 147.135.214.166:53954] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ae-Z0f19I-6GBJQxn_jmKAAAAEY"]
[Tue Apr 28 01:16:03.748314 2026] [:error] [pid 13465:tid 13512] [client 147.135.214.166:36816] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae-Z0_19I-6GBJQxn_jmLwAAAFE"]
[Tue Apr 28 01:16:06.145784 2026] [:error] [pid 13554:tid 13560] [client 147.135.214.166:34334] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae-Z1nJx87Dl-xMmL93VuAAAAMQ"]
[Tue Apr 28 01:16:07.883360 2026] [:error] [pid 42612:tid 42772] [client 147.135.214.166:52694] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae-Z1zCDyZvIG2oFcJ7b6gAAAQ8"]
[Tue Apr 28 01:16:10.350919 2026] [:error] [pid 13523:tid 13547] [client 147.135.214.166:34336] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ae-Z2ueav51IXKv1ebExugAAAJY"]
[Tue Apr 28 01:16:12.883069 2026] [:error] [pid 13554:tid 13575] [client 147.135.214.166:34344] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ae-Z3HJx87Dl-xMmL93VvAAAANM"]
[Tue Apr 28 01:16:14.907420 2026] [:error] [pid 13465:tid 13514] [client 147.135.214.166:52700] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae-Z3v19I-6GBJQxn_jmSAAAAFM"]
[Tue Apr 28 01:16:17.498495 2026] [:error] [pid 13523:tid 13547] [client 147.135.214.166:41080] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ae-Z4eeav51IXKv1ebExwAAAAJY"]
[Tue Apr 28 01:16:19.379722 2026] [:error] [pid 13465:tid 13501] [client 147.135.214.166:34588] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae-Z4_19I-6GBJQxn_jmTgAAAEY"]
[Tue Apr 28 01:16:21.925974 2026] [:error] [pid 13554:tid 13567] [client 147.135.214.166:41084] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ae-Z5XJx87Dl-xMmL93VxAAAAMs"]
[Tue Apr 28 01:16:23.847986 2026] [:error] [pid 13465:tid 13497] [client 147.135.214.166:34590] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae-Z5_19I-6GBJQxn_jmVwAAAEI"]
[Tue Apr 28 01:16:26.391427 2026] [:error] [pid 36747:tid 36752] [client 147.135.214.166:49050] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ae-Z6s9QpT00aPhkIcdY-gAAAYM"]
[Tue Apr 28 01:16:28.725315 2026] [:error] [pid 31555:tid 31571] [client 147.135.214.166:49054] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ae-Z7LJDZf3DNaSMAJ27FQAAAA4"]
[Tue Apr 28 01:16:31.126214 2026] [:error] [pid 13465:tid 13499] [client 147.135.214.166:49056] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ae-Z7_19I-6GBJQxn_jmYQAAAEQ"]
[Tue Apr 28 01:16:33.667216 2026] [:error] [pid 13465:tid 13497] [client 147.135.214.166:49058] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ae-Z8f19I-6GBJQxn_jmZwAAAEI"]
[Tue Apr 28 01:16:35.680184 2026] [:error] [pid 48914:tid 48931] [client 147.135.214.166:48658] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ae-Z83wuHR_nwT9alH8WCQAAAU4"]
[Tue Apr 28 01:16:38.225503 2026] [:error] [pid 42612:tid 42760] [client 147.135.214.166:45448] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ae-Z9jCDyZvIG2oFcJ7b-QAAAQM"]
[Tue Apr 28 01:16:40.155890 2026] [:error] [pid 42612:tid 42776] [client 147.135.214.166:48674] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ae-Z-DCDyZvIG2oFcJ7b_AAAARI"]
[Tue Apr 28 01:16:42.543020 2026] [:error] [pid 13465:tid 13506] [client 147.135.214.166:45452] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ae-Z-v19I-6GBJQxn_jmgQAAAEs"]
[Tue Apr 28 01:16:44.872929 2026] [:error] [pid 13465:tid 13518] [client 147.135.214.166:45462] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ae-Z_P19I-6GBJQxn_jmgwAAAFc"]
[Tue Apr 28 01:16:47.293639 2026] [:error] [pid 48914:tid 48918] [client 147.135.214.166:50360] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ae-Z_3wuHR_nwT9alH8WGgAAAUE"]
[Tue Apr 28 01:16:49.797476 2026] [:error] [pid 48914:tid 48934] [client 147.135.214.166:50364] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ae-aAXwuHR_nwT9alH8WHgAAAVE"]
[Tue Apr 28 01:16:51.829104 2026] [:error] [pid 42612:tid 42774] [client 147.135.214.166:60256] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ae-aAzCDyZvIG2oFcJ7b_gAAARE"]
[Tue Apr 28 01:16:53.735268 2026] [:error] [pid 13465:tid 13500] [client 147.135.214.166:60258] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ae-aBf19I-6GBJQxn_jmjgAAAEU"]
[Tue Apr 28 01:16:55.637487 2026] [:error] [pid 13554:tid 13580] [client 147.135.214.166:41738] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ae-aB3Jx87Dl-xMmL93V8QAAANg"]
[Tue Apr 28 01:16:57.665893 2026] [:error] [pid 13465:tid 13519] [client 147.135.214.166:41754] [client 147.135.214.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ae-aCf19I-6GBJQxn_jmlAAAAFg"]
[Tue Apr 28 01:58:16.068431 2026] [:error] [pid 13464:tid 13479] [client 46.1.184.75:11845] [client 46.1.184.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.1.184.75, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ae-juGIEa0q6oQ95zvFQbAAAAcs"]
[Tue Apr 28 01:58:16.079578 2026] [proxy_fcgi:error] [pid 13464:tid 13479] [client 46.1.184.75:11845] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 02:20:02.168771 2026] [:error] [pid 42612:tid 42758] [client 217.181.84.188:33124] [client 217.181.84.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.181.84.188, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ae-o0jCDyZvIG2oFcJ7kOgAAAQE"]
[Tue Apr 28 02:20:02.176769 2026] [proxy_fcgi:error] [pid 42612:tid 42758] [client 217.181.84.188:33124] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 02:20:03.161570 2026] [:error] [pid 13465:tid 13514] [client 217.181.87.120:13010] [client 217.181.87.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.181.87.120, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ae-o0_19I-6GBJQxn_j6pgAAAFM"]
[Tue Apr 28 02:20:03.166111 2026] [proxy_fcgi:error] [pid 13465:tid 13514] [client 217.181.87.120:13010] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 02:20:04.122118 2026] [:error] [pid 13465:tid 13496] [client 195.63.26.11:46056] [client 195.63.26.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.63.26.11, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ae-o1P19I-6GBJQxn_j6qAAAAEE"]
[Tue Apr 28 02:20:04.126185 2026] [proxy_fcgi:error] [pid 13465:tid 13496] [client 195.63.26.11:46056] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 03:04:46.886342 2026] [:error] [pid 13465:tid 13497] [client 51.75.119.229:55000] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ae-zTv19I-6GBJQxn_gN0AAAAEI"]
[Tue Apr 28 03:04:48.942369 2026] [:error] [pid 42612:tid 42780] [client 51.75.119.229:53060] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ae-zUDCDyZvIG2oFcJ7pjQAAARY"]
[Tue Apr 28 03:04:50.964879 2026] [:error] [pid 36747:tid 36760] [client 51.75.119.229:53074] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ae-zUs9QpT00aPhkIcdzcgAAAYs"]
[Tue Apr 28 03:04:53.042619 2026] [:error] [pid 42612:tid 42781] [client 51.75.119.229:53088] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ae-zVTCDyZvIG2oFcJ7pkgAAARc"]
[Tue Apr 28 03:04:55.176956 2026] [:error] [pid 13554:tid 13576] [client 51.75.119.229:41948] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ae-zV3Jx87Dl-xMmL93zggAAANQ"]
[Tue Apr 28 03:04:57.207112 2026] [:error] [pid 13554:tid 13566] [client 51.75.119.229:41958] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ae-zWXJx87Dl-xMmL93ziwAAAMo"]
[Tue Apr 28 03:04:59.351719 2026] [:error] [pid 36747:tid 36749] [client 51.75.119.229:41966] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ae-zW89QpT00aPhkIcdzdgAAAYA"]
[Tue Apr 28 03:05:01.340488 2026] [:error] [pid 13465:tid 13508] [client 51.75.119.229:41978] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ae-zXf19I-6GBJQxn_gN1AAAAE0"]
[Tue Apr 28 03:05:03.181872 2026] [:error] [pid 13554:tid 13564] [client 51.75.119.229:41990] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae-zX3Jx87Dl-xMmL93zjgAAAMg"]
[Tue Apr 28 03:05:05.003397 2026] [:error] [pid 13465:tid 13512] [client 51.75.119.229:49504] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae-zYf19I-6GBJQxn_gN1wAAAFE"]
[Tue Apr 28 03:05:06.935124 2026] [:error] [pid 13554:tid 13576] [client 51.75.119.229:49508] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae-zYnJx87Dl-xMmL93zmQAAANQ"]
[Tue Apr 28 03:05:09.378986 2026] [:error] [pid 13465:tid 13499] [client 51.75.119.229:49520] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae-zZf19I-6GBJQxn_gN4QAAAEQ"]
[Tue Apr 28 03:05:11.942170 2026] [:error] [pid 31555:tid 31568] [client 51.75.119.229:50768] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ae-zZ7JDZf3DNaSMAJ3MTgAAAAs"]
[Tue Apr 28 03:05:13.850785 2026] [:error] [pid 13523:tid 13531] [client 51.75.119.229:49534] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ae-zaeeav51IXKv1ebE9SgAAAIY"]
[Tue Apr 28 03:05:16.434473 2026] [:error] [pid 13465:tid 13511] [client 51.75.119.229:54456] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ae-zbP19I-6GBJQxn_gODAAAAFA"]
[Tue Apr 28 03:05:19.997996 2026] [:error] [pid 42612:tid 42778] [client 51.75.119.229:54466] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ae-zbzCDyZvIG2oFcJ7powAAARQ"]
[Tue Apr 28 03:05:21.916874 2026] [:error] [pid 48914:tid 48919] [client 51.75.119.229:33894] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae-zcXwuHR_nwT9alH8qWgAAAUI"]
[Tue Apr 28 03:05:24.497963 2026] [:error] [pid 13465:tid 13515] [client 51.75.119.229:54472] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae-zdP19I-6GBJQxn_gOLgAAAFQ"]
[Tue Apr 28 03:05:27.120581 2026] [:error] [pid 36747:tid 36772] [client 51.75.119.229:46650] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ae-zd89QpT00aPhkIcdzpgAAAZc"]
[Tue Apr 28 03:05:29.640926 2026] [:error] [pid 13523:tid 13535] [client 51.75.119.229:46658] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ae-zeeeav51IXKv1ebE9WQAAAIo"]
[Tue Apr 28 03:05:31.688435 2026] [:error] [pid 42612:tid 42777] [client 51.75.119.229:58406] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae-zezCDyZvIG2oFcJ7prAAAARM"]
[Tue Apr 28 03:05:34.306491 2026] [:error] [pid 42612:tid 42773] [client 51.75.119.229:46664] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ae-zfjCDyZvIG2oFcJ7psQAAARA"]
[Tue Apr 28 03:05:37.038202 2026] [:error] [pid 13465:tid 13515] [client 51.75.119.229:59250] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ae-zgf19I-6GBJQxn_gOZQAAAFQ"]
[Tue Apr 28 03:05:39.629984 2026] [:error] [pid 13554:tid 13571] [client 51.75.119.229:59256] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ae-zg3Jx87Dl-xMmL93zzwAAAM8"]
[Tue Apr 28 03:05:42.710779 2026] [:error] [pid 42612:tid 42777] [client 51.75.119.229:59262] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ae-zhjCDyZvIG2oFcJ7ptgAAARM"]
[Tue Apr 28 03:05:44.814145 2026] [:error] [pid 13465:tid 13503] [client 51.75.119.229:52174] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae-ziP19I-6GBJQxn_gOdwAAAEg"]
[Tue Apr 28 03:06:08.432979 2026] [:error] [pid 13464:tid 13490] [client 51.75.119.229:59770] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae-zoGIEa0q6oQ95zvFWuQAAAdY"]
[Tue Apr 28 03:06:10.372971 2026] [:error] [pid 42612:tid 42761] [client 51.75.119.229:42608] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae-zojCDyZvIG2oFcJ7p0wAAAQQ"]
[Tue Apr 28 03:06:13.300718 2026] [:error] [pid 31555:tid 31574] [client 51.75.119.229:33776] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae-zpbJDZf3DNaSMAJ3MnAAAABE"]
[Tue Apr 28 03:06:15.370134 2026] [:error] [pid 13464:tid 13491] [client 51.75.119.229:49586] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae-zp2IEa0q6oQ95zvFWvQAAAdc"]
[Tue Apr 28 03:06:18.215115 2026] [:error] [pid 13523:tid 13547] [client 51.75.119.229:46240] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae-zqueav51IXKv1ebE9cQAAAJY"]
[Tue Apr 28 03:06:20.688104 2026] [:error] [pid 13465:tid 13513] [client 51.75.119.229:49590] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae-zrP19I-6GBJQxn_gOvgAAAFI"]
[Tue Apr 28 03:06:22.929751 2026] [:error] [pid 31555:tid 31577] [client 51.75.119.229:49606] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae-zrrJDZf3DNaSMAJ3MogAAABQ"]
[Tue Apr 28 03:06:25.155719 2026] [:error] [pid 13554:tid 13557] [client 51.75.119.229:60054] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae-zsXJx87Dl-xMmL930AQAAAME"]
[Tue Apr 28 03:06:27.421750 2026] [:error] [pid 13523:tid 13537] [client 51.75.119.229:60058] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae-zs-eav51IXKv1ebE9dgAAAIw"]
[Tue Apr 28 03:06:30.738600 2026] [:error] [pid 42612:tid 42781] [client 51.75.119.229:49770] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ae-ztjCDyZvIG2oFcJ7p3QAAARc"]
[Tue Apr 28 03:06:33.185153 2026] [:error] [pid 31555:tid 31581] [client 51.75.119.229:49778] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ae-zubJDZf3DNaSMAJ3MrgAAABg"]
[Tue Apr 28 03:06:36.272886 2026] [:error] [pid 13554:tid 13565] [client 51.75.119.229:50570] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ae-zvHJx87Dl-xMmL930BgAAAMk"]
[Tue Apr 28 03:06:38.129370 2026] [:error] [pid 13523:tid 13525] [client 51.75.119.229:56440] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ae-zvueav51IXKv1ebE9fgAAAIA"]
[Tue Apr 28 03:06:40.346653 2026] [:error] [pid 13465:tid 13509] [client 51.75.119.229:56456] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae-zwP19I-6GBJQxn_gO3wAAAE4"]
[Tue Apr 28 03:06:43.536941 2026] [:error] [pid 36747:tid 36758] [client 51.75.119.229:50584] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae-zw89QpT00aPhkIcdz4wAAAYk"]
[Tue Apr 28 03:06:46.110939 2026] [:error] [pid 13523:tid 13544] [client 51.75.119.229:46058] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae-zxueav51IXKv1ebE9hQAAAJM"]
[Tue Apr 28 03:06:48.487435 2026] [:error] [pid 13464:tid 13491] [client 51.75.119.229:46066] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae-zyGIEa0q6oQ95zvFWxQAAAdc"]
[Tue Apr 28 03:06:52.401445 2026] [:error] [pid 13554:tid 13564] [client 51.75.119.229:48084] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae-zzHJx87Dl-xMmL930EwAAAMg"]
[Tue Apr 28 03:06:54.672235 2026] [:error] [pid 31555:tid 31573] [client 51.75.119.229:47328] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae-zzrJDZf3DNaSMAJ3MvgAAABA"]
[Tue Apr 28 03:06:57.898729 2026] [:error] [pid 42612:tid 42774] [client 51.75.119.229:57022] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae-z0TCDyZvIG2oFcJ7p6QAAARE"]
[Tue Apr 28 03:07:00.503205 2026] [:error] [pid 13465:tid 13510] [client 51.75.119.229:47334] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae-z1P19I-6GBJQxn_gPBgAAAE8"]
[Tue Apr 28 03:07:03.287747 2026] [:error] [pid 36747:tid 36759] [client 51.75.119.229:57038] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae-z189QpT00aPhkIcdz8AAAAYo"]
[Tue Apr 28 03:07:05.055184 2026] [:error] [pid 31555:tid 31575] [client 51.75.119.229:37578] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae-z2bJDZf3DNaSMAJ3MwgAAABI"]
[Tue Apr 28 03:07:33.518716 2026] [:error] [pid 13464:tid 13489] [client 51.75.119.229:37580] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ae-z9WIEa0q6oQ95zvFW3wAAAdU"]
[Tue Apr 28 03:07:35.816621 2026] [:error] [pid 13554:tid 13579] [client 51.75.119.229:48664] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ae-z93Jx87Dl-xMmL930TQAAANc"]
[Tue Apr 28 03:07:38.119456 2026] [:error] [pid 48914:tid 48932] [client 51.75.119.229:48666] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ae-z-nwuHR_nwT9alH8q6wAAAU8"]
[Tue Apr 28 03:07:40.100403 2026] [:error] [pid 13554:tid 13577] [client 51.75.119.229:48668] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae-z_HJx87Dl-xMmL930VQAAANU"]
[Tue Apr 28 03:07:42.122654 2026] [:error] [pid 13554:tid 13566] [client 51.75.119.229:48674] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae-z_nJx87Dl-xMmL930WQAAAMo"]
[Tue Apr 28 03:07:44.228105 2026] [:error] [pid 36747:tid 36768] [client 51.75.119.229:57912] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae-0AM9QpT00aPhkIcd0CAAAAZM"]
[Tue Apr 28 03:07:46.920284 2026] [:error] [pid 13465:tid 13510] [client 51.75.119.229:57920] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae-0Av19I-6GBJQxn_gPPgAAAE8"]
[Tue Apr 28 03:07:49.154929 2026] [:error] [pid 42612:tid 42759] [client 51.75.119.229:57922] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ae-0BTCDyZvIG2oFcJ7p9wAAAQI"]
[Tue Apr 28 03:07:51.186202 2026] [:error] [pid 13465:tid 13495] [client 51.75.119.229:57924] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ae-0B_19I-6GBJQxn_gPQwAAAEA"]
[Tue Apr 28 03:07:53.384403 2026] [:error] [pid 13554:tid 13570] [client 51.75.119.229:57930] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ae-0CXJx87Dl-xMmL930bgAAAM4"]
[Tue Apr 28 03:07:56.141118 2026] [:error] [pid 48914:tid 48922] [client 51.75.119.229:47302] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ae-0DHwuHR_nwT9alH8q9gAAAUU"]
[Tue Apr 28 03:07:58.139746 2026] [:error] [pid 13465:tid 13498] [client 51.75.119.229:47308] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae-0Dv19I-6GBJQxn_gPUQAAAEM"]
[Tue Apr 28 03:07:59.923707 2026] [:error] [pid 48914:tid 48930] [client 185.194.178.60:25343] [client 185.194.178.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.60, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ae-0D3wuHR_nwT9alH8q9wAAAU0"]
[Tue Apr 28 03:07:59.933113 2026] [proxy_fcgi:error] [pid 48914:tid 48930] [client 185.194.178.60:25343] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 03:08:00.241356 2026] [:error] [pid 13554:tid 13570] [client 51.75.119.229:47322] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ae-0EHJx87Dl-xMmL930cgAAAM4"]
[Tue Apr 28 03:08:02.156881 2026] [:error] [pid 13554:tid 13569] [client 51.75.119.229:47330] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ae-0EnJx87Dl-xMmL930igAAAM0"]
[Tue Apr 28 03:08:04.181957 2026] [:error] [pid 48914:tid 48939] [client 51.75.119.229:60868] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae-0FHwuHR_nwT9alH8q_wAAAVY"]
[Tue Apr 28 03:08:06.515109 2026] [:error] [pid 13554:tid 13572] [client 51.75.119.229:60872] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ae-0FnJx87Dl-xMmL930sAAAANA"]
[Tue Apr 28 03:08:08.592811 2026] [:error] [pid 13554:tid 13573] [client 51.75.119.229:60886] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ae-0GHJx87Dl-xMmL930wwAAANE"]
[Tue Apr 28 03:11:22.738672 2026] [:error] [pid 13465:tid 13501] [client 51.75.119.229:55874] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ae-02v19I-6GBJQxn_gQkwAAAEY"]
[Tue Apr 28 03:11:24.596785 2026] [:error] [pid 31555:tid 31576] [client 51.75.119.229:52134] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ae-03LJDZf3DNaSMAJ3NRwAAABM"]
[Tue Apr 28 03:11:26.692969 2026] [:error] [pid 13465:tid 13517] [client 51.75.119.229:52142] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ae-03v19I-6GBJQxn_gQmAAAAFY"]
[Tue Apr 28 03:11:28.677441 2026] [:error] [pid 48914:tid 48941] [client 51.75.119.229:52152] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ae-04HwuHR_nwT9alH8rzQAAAVg"]
[Tue Apr 28 03:11:30.518464 2026] [:error] [pid 13554:tid 13577] [client 51.75.119.229:52158] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ae-04nJx87Dl-xMmL932TQAAANU"]
[Tue Apr 28 03:11:32.468973 2026] [:error] [pid 31555:tid 31575] [client 51.75.119.229:52172] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ae-05LJDZf3DNaSMAJ3NTQAAABI"]
[Tue Apr 28 03:11:34.523842 2026] [:error] [pid 42612:tid 42771] [client 51.75.119.229:60606] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ae-05jCDyZvIG2oFcJ7qUwAAAQ4"]
[Tue Apr 28 03:11:36.540907 2026] [:error] [pid 31555:tid 31572] [client 51.75.119.229:60614] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ae-06LJDZf3DNaSMAJ3NUgAAAA8"]
[Tue Apr 28 03:11:38.531003 2026] [:error] [pid 13554:tid 13577] [client 51.75.119.229:60630] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ae-06nJx87Dl-xMmL932YAAAANU"]
[Tue Apr 28 03:11:40.445197 2026] [:error] [pid 13554:tid 13572] [client 51.75.119.229:60640] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ae-07HJx87Dl-xMmL932ZAAAANA"]
[Tue Apr 28 03:11:42.629973 2026] [:error] [pid 42612:tid 42781] [client 51.75.119.229:60656] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ae-07jCDyZvIG2oFcJ7qWAAAARc"]
[Tue Apr 28 03:11:44.463380 2026] [:error] [pid 36747:tid 36757] [client 51.75.119.229:56572] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae-08M9QpT00aPhkIcd1KAAAAYg"]
[Tue Apr 28 03:11:46.887291 2026] [:error] [pid 42612:tid 42777] [client 51.75.119.229:44482] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ae-08jCDyZvIG2oFcJ7qWgAAARM"]
[Tue Apr 28 03:11:48.819699 2026] [:error] [pid 13554:tid 13567] [client 51.75.119.229:56576] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ae-09HJx87Dl-xMmL932agAAAMs"]
[Tue Apr 28 03:11:51.421492 2026] [:error] [pid 31555:tid 31579] [client 51.75.119.229:44498] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ae-097JDZf3DNaSMAJ3NWQAAABY"]
[Tue Apr 28 03:11:53.786042 2026] [:error] [pid 13465:tid 13513] [client 51.75.119.229:44508] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ae-0-f19I-6GBJQxn_gQpgAAAFI"]
[Tue Apr 28 03:11:55.795163 2026] [:error] [pid 31555:tid 31557] [client 51.75.119.229:51280] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae-0-7JDZf3DNaSMAJ3NXQAAAAA"]
[Tue Apr 28 03:11:58.224902 2026] [:error] [pid 13465:tid 13498] [client 51.75.119.229:35236] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae-0_v19I-6GBJQxn_gQsAAAAEM"]
[Tue Apr 28 03:12:00.828982 2026] [:error] [pid 13554:tid 13559] [client 51.75.119.229:35252] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ae-1AHJx87Dl-xMmL932cQAAAMM"]
[Tue Apr 28 03:12:03.335333 2026] [:error] [pid 13554:tid 13564] [client 51.75.119.229:35254] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ae-1A3Jx87Dl-xMmL932dAAAAMg"]
[Tue Apr 28 03:12:05.370986 2026] [:error] [pid 13465:tid 13506] [client 51.75.119.229:35470] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae-1Bf19I-6GBJQxn_gQuAAAAEs"]
[Tue Apr 28 03:12:07.722904 2026] [:error] [pid 48914:tid 48933] [client 51.75.119.229:40526] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ae-1B3wuHR_nwT9alH8r4gAAAVA"]
[Tue Apr 28 03:12:10.403689 2026] [:error] [pid 13465:tid 13508] [client 51.75.119.229:40528] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ae-1Cv19I-6GBJQxn_gQwAAAAE0"]
[Tue Apr 28 03:12:12.930690 2026] [:error] [pid 13465:tid 13501] [client 51.75.119.229:40542] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ae-1DP19I-6GBJQxn_gQxgAAAEY"]
[Tue Apr 28 03:12:15.346983 2026] [:error] [pid 48914:tid 48927] [client 51.75.119.229:51194] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ae-1D3wuHR_nwT9alH8r6AAAAUo"]
[Tue Apr 28 03:12:17.272215 2026] [:error] [pid 48914:tid 48930] [client 51.75.119.229:56016] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ae-1EXwuHR_nwT9alH8r6wAAAU0"]
[Tue Apr 28 03:12:19.639710 2026] [:error] [pid 13523:tid 13546] [client 51.75.119.229:51204] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ae-1E-eav51IXKv1ebE9_AAAAJU"]
[Tue Apr 28 03:12:42.279061 2026] [:error] [pid 13554:tid 13563] [client 51.75.119.229:51208] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ae-1KnJx87Dl-xMmL932nAAAAMc"]
[Tue Apr 28 03:12:44.741828 2026] [:error] [pid 13465:tid 13502] [client 51.75.119.229:36182] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ae-1LP19I-6GBJQxn_gQzQAAAEc"]
[Tue Apr 28 03:12:46.727252 2026] [:error] [pid 31555:tid 31575] [client 51.75.119.229:48286] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ae-1LrJDZf3DNaSMAJ3NfQAAABI"]
[Tue Apr 28 03:12:48.962441 2026] [:error] [pid 31555:tid 31568] [client 51.75.119.229:36192] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ae-1MLJDZf3DNaSMAJ3NgQAAAAs"]
[Tue Apr 28 03:12:50.994308 2026] [:error] [pid 31555:tid 31560] [client 51.75.119.229:48302] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae-1MrJDZf3DNaSMAJ3NgwAAAAM"]
[Tue Apr 28 03:12:53.070375 2026] [:error] [pid 42612:tid 42779] [client 51.75.119.229:48316] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae-1NTCDyZvIG2oFcJ7qZQAAARU"]
[Tue Apr 28 03:12:55.104927 2026] [:error] [pid 13465:tid 13497] [client 51.75.119.229:37618] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ae-1N_19I-6GBJQxn_gQzgAAAEI"]
[Tue Apr 28 03:12:56.996949 2026] [:error] [pid 13554:tid 13572] [client 51.75.119.229:37630] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ae-1OHJx87Dl-xMmL932rwAAANA"]
[Tue Apr 28 03:12:59.292971 2026] [:error] [pid 48914:tid 48934] [client 51.75.119.229:54214] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ae-1O3wuHR_nwT9alH8sAgAAAVE"]
[Tue Apr 28 03:13:01.606661 2026] [:error] [pid 48914:tid 48939] [client 51.75.119.229:54220] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ae-1PXwuHR_nwT9alH8sBQAAAVY"]
[Tue Apr 28 03:13:04.025430 2026] [:error] [pid 36747:tid 36767] [client 51.75.119.229:54234] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ae-1QM9QpT00aPhkIcd1TQAAAZI"]
[Tue Apr 28 03:13:06.084667 2026] [:error] [pid 13554:tid 13576] [client 51.75.119.229:41986] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ae-1QnJx87Dl-xMmL932vwAAANQ"]
[Tue Apr 28 03:13:08.094639 2026] [:error] [pid 13464:tid 13468] [client 51.75.119.229:42002] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae-1RGIEa0q6oQ95zvFXYQAAAcA"]
[Tue Apr 28 03:13:10.618658 2026] [:error] [pid 13465:tid 13513] [client 51.75.119.229:47374] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ae-1Rv19I-6GBJQxn_gQ0wAAAFI"]
[Tue Apr 28 03:13:12.574644 2026] [:error] [pid 13554:tid 13562] [client 51.75.119.229:42010] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae-1SHJx87Dl-xMmL932zQAAAMY"]
[Tue Apr 28 03:13:14.409628 2026] [:error] [pid 13465:tid 13497] [client 51.75.119.229:50088] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae-1Sv19I-6GBJQxn_gQ3QAAAEI"]
[Tue Apr 28 03:13:16.908948 2026] [:error] [pid 13554:tid 13572] [client 51.75.119.229:56900] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ae-1THJx87Dl-xMmL9322QAAANA"]
[Tue Apr 28 03:13:18.909697 2026] [:error] [pid 36747:tid 36754] [client 51.75.119.229:50102] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae-1Ts9QpT00aPhkIcd1UwAAAYU"]
[Tue Apr 28 03:13:21.315698 2026] [:error] [pid 36747:tid 36767] [client 51.75.119.229:56914] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ae-1Uc9QpT00aPhkIcd1WAAAAZI"]
[Tue Apr 28 03:13:23.440220 2026] [:error] [pid 13465:tid 13504] [client 51.75.119.229:50114] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae-1U_19I-6GBJQxn_gQ6QAAAEk"]
[Tue Apr 28 03:13:25.782000 2026] [:error] [pid 42612:tid 42780] [client 51.75.119.229:52468] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ae-1VTCDyZvIG2oFcJ7qbgAAARY"]
[Tue Apr 28 03:13:27.016593 2026] [:error] [pid 36747:tid 36763] [client 51.75.119.229:56324] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae-1V89QpT00aPhkIcd1YgAAAY4"]
[Tue Apr 28 03:13:30.885470 2026] [:error] [pid 13523:tid 13536] [client 51.75.119.229:56334] [client 51.75.119.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae-1Wueav51IXKv1ebE-EAAAAIs"]
[Tue Apr 28 03:19:51.683048 2026] [proxy_fcgi:error] [pid 13465:tid 13501] [client 13.74.146.113:16794] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 03:19:51.947432 2026] [proxy_fcgi:error] [pid 13465:tid 13499] [client 13.74.146.113:16794] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 03:19:52.211899 2026] [proxy_fcgi:error] [pid 13465:tid 13512] [client 13.74.146.113:16794] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 04:51:57.823102 2026] [:error] [pid 14577:tid 14592] [client 54.37.86.223:52144] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ae_MbSzBH-jwzlgiBdGiWwAAAAY"]
[Tue Apr 28 04:51:59.793066 2026] [:error] [pid 14579:tid 14658] [client 54.37.86.223:36696] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ae_MbxrUiOG83qKKuuDZWgAAAJI"]
[Tue Apr 28 04:52:01.686660 2026] [:error] [pid 14686:tid 14709] [client 54.37.86.223:54618] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ae_Mce-YPF1Xm7uiWQ4R2QAAANQ"]
[Tue Apr 28 04:52:04.044136 2026] [:error] [pid 14577:tid 14595] [client 54.37.86.223:34766] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ae_MdCzBH-jwzlgiBdGiZAAAAAk"]
[Tue Apr 28 04:52:05.897658 2026] [:error] [pid 14578:tid 14626] [client 54.37.86.223:54624] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ae_Mdengo3AwIJgfSHHtYAAAAE0"]
[Tue Apr 28 04:52:08.410874 2026] [:error] [pid 14577:tid 14605] [client 54.37.86.223:34780] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ae_MeCzBH-jwzlgiBdGibgAAABM"]
[Tue Apr 28 04:52:10.391410 2026] [:error] [pid 14578:tid 14637] [client 54.37.86.223:54638] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ae_Meungo3AwIJgfSHHtZgAAAFg"]
[Tue Apr 28 04:52:12.894597 2026] [:error] [pid 14578:tid 14620] [client 54.37.86.223:42716] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ae_MfOngo3AwIJgfSHHtagAAAEc"]
[Tue Apr 28 04:52:15.389487 2026] [:error] [pid 14579:tid 14656] [client 54.37.86.223:42718] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ae_MfxrUiOG83qKKuuDZcgAAAJA"]
[Tue Apr 28 04:52:17.244341 2026] [:error] [pid 14579:tid 14647] [client 54.37.86.223:40192] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ae_MgRrUiOG83qKKuuDZegAAAIc"]
[Tue Apr 28 04:52:19.279960 2026] [:error] [pid 14686:tid 14705] [client 54.37.86.223:40202] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ae_Mg--YPF1Xm7uiWQ4R-gAAANA"]
[Tue Apr 28 04:52:21.286528 2026] [:error] [pid 14579:tid 14656] [client 54.37.86.223:45586] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ae_MhRrUiOG83qKKuuDZjwAAAJA"]
[Tue Apr 28 04:52:23.155951 2026] [:error] [pid 14579:tid 14648] [client 54.37.86.223:45596] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae_MhxrUiOG83qKKuuDZmQAAAIg"]
[Tue Apr 28 04:52:25.665713 2026] [:error] [pid 14686:tid 14699] [client 54.37.86.223:59466] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ae_Mie-YPF1Xm7uiWQ4SBgAAAMo"]
[Tue Apr 28 04:52:28.151978 2026] [:error] [pid 14577:tid 14605] [client 54.37.86.223:59482] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ae_MjCzBH-jwzlgiBdGijAAAABM"]
[Tue Apr 28 04:52:31.268013 2026] [:error] [pid 14578:tid 14621] [client 54.37.86.223:51908] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae_Mj-ngo3AwIJgfSHHtkAAAAEg"]
[Tue Apr 28 04:52:35.136230 2026] [:error] [pid 14579:tid 14645] [client 54.37.86.223:51924] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ae_MkxrUiOG83qKKuuDZwAAAAIU"]
[Tue Apr 28 05:01:09.491728 2026] [:error] [pid 14578:tid 14637] [client 182.44.2.148:43798] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ae_Olengo3AwIJgfSHH1JgAAAFg"]
[Tue Apr 28 05:09:44.303031 2026] [:error] [pid 14686:tid 14703] [client 43.163.206.70:52788] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ae_QmO-YPF1Xm7uiWQ4e-gAAAM4"]
[Tue Apr 28 06:10:36.850571 2026] [proxy_fcgi:error] [pid 14579:tid 14648] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:37.097944 2026] [proxy_fcgi:error] [pid 14579:tid 14659] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:37.598415 2026] [proxy_fcgi:error] [pid 14579:tid 14653] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:37.841767 2026] [proxy_fcgi:error] [pid 14579:tid 14658] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:38.333872 2026] [proxy_fcgi:error] [pid 14579:tid 14660] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:38.575853 2026] [proxy_fcgi:error] [pid 14579:tid 14650] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:38.820604 2026] [proxy_fcgi:error] [pid 14579:tid 14645] [client 158.158.40.223:4395] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:10:39.602658 2026] [:error] [pid 14579:tid 14661] [client 158.158.40.223:4395] [client 158.158.40.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae_e3xrUiOG83qKKuuDxsgAAAJU"]
[Tue Apr 28 06:10:40.619307 2026] [:error] [pid 14577:tid 14606] [client 158.158.40.223:14143] [client 158.158.40.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae_e4CzBH-jwzlgiBdGzrAAAABQ"]
[Tue Apr 28 06:10:41.681658 2026] [:error] [pid 14577:tid 14596] [client 158.158.40.223:2251] [client 158.158.40.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae_e4SzBH-jwzlgiBdGzswAAAAo"]
[Tue Apr 28 06:10:42.661907 2026] [:error] [pid 14577:tid 14601] [client 158.158.40.223:10710] [client 158.158.40.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ae_e4izBH-jwzlgiBdGzuAAAAA8"]
[Tue Apr 28 06:19:27.698092 2026] [proxy_fcgi:error] [pid 6746:tid 6766] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:27.840572 2026] [proxy_fcgi:error] [pid 6746:tid 6750] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:29.481308 2026] [proxy_fcgi:error] [pid 6746:tid 6770] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:29.623520 2026] [proxy_fcgi:error] [pid 6746:tid 6756] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:29.765597 2026] [proxy_fcgi:error] [pid 6746:tid 6769] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:29.908143 2026] [proxy_fcgi:error] [pid 6746:tid 6749] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:30.049775 2026] [proxy_fcgi:error] [pid 6746:tid 6771] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:30.333340 2026] [proxy_fcgi:error] [pid 6746:tid 6761] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:30.480413 2026] [proxy_fcgi:error] [pid 6746:tid 6767] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:30.635039 2026] [proxy_fcgi:error] [pid 6746:tid 6759] [client 52.172.142.96:3569] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 06:19:30.772638 2026] [:error] [pid 6746:tid 6755] [client 52.172.142.96:3569] [client 52.172.142.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae_g8ruStsbXtMDpzS-Y-QAAAUc"]
[Tue Apr 28 06:19:31.328447 2026] [:error] [pid 14577:tid 14590] [client 52.172.142.96:18313] [client 52.172.142.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae_g8yzBH-jwzlgiBdG22wAAAAQ"]
[Tue Apr 28 06:19:31.889710 2026] [:error] [pid 14577:tid 14608] [client 52.172.142.96:3787] [client 52.172.142.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae_g8yzBH-jwzlgiBdG23gAAABY"]
[Tue Apr 28 06:19:32.464115 2026] [:error] [pid 14577:tid 14607] [client 52.172.142.96:15143] [client 52.172.142.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ae_g9CzBH-jwzlgiBdG24gAAABU"]
[Tue Apr 28 08:31:39.212269 2026] [:error] [pid 33864:tid 33871] [client 54.36.60.91:57116] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ae__6zXchLGZ4QggCsmTlQAAAIU"]
[Tue Apr 28 08:31:41.074941 2026] [:error] [pid 33864:tid 33884] [client 54.36.60.91:36842] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ae__7TXchLGZ4QggCsmTvQAAAJI"]
[Tue Apr 28 08:31:42.940478 2026] [:error] [pid 50889:tid 50892] [client 54.36.60.91:36846] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ae__7ozszBr00txEzGiB7AAAAAA"]
[Tue Apr 28 08:31:44.981394 2026] [:error] [pid 33864:tid 33867] [client 54.36.60.91:33336] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ae__8DXchLGZ4QggCsmT3QAAAIE"]
[Tue Apr 28 08:31:47.021742 2026] [:error] [pid 50889:tid 50914] [client 54.36.60.91:33342] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ae__84zszBr00txEzGiB9QAAABY"]
[Tue Apr 28 08:31:49.064246 2026] [:error] [pid 33776:tid 33827] [client 54.36.60.91:33348] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ae__9V-bEJ2CKP3iKADExgAAAFM"]
[Tue Apr 28 08:31:51.442155 2026] [:error] [pid 50889:tid 50899] [client 54.36.60.91:37806] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ae__94zszBr00txEzGiB-gAAAAc"]
[Tue Apr 28 08:31:53.478370 2026] [:error] [pid 50889:tid 50901] [client 54.36.60.91:32918] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ae__-YzszBr00txEzGiB_gAAAAk"]
[Tue Apr 28 08:31:55.357899 2026] [:error] [pid 33864:tid 33889] [client 54.36.60.91:32926] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ae__-zXchLGZ4QggCsmT7AAAAJc"]
[Tue Apr 28 08:31:57.874506 2026] [:error] [pid 50889:tid 50905] [client 54.36.60.91:43474] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ae___YzszBr00txEzGiCBwAAAA0"]
[Tue Apr 28 08:31:59.891050 2026] [:error] [pid 50889:tid 50903] [client 54.36.60.91:32928] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ae___4zszBr00txEzGiCCAAAAAs"]
[Tue Apr 28 08:32:01.780798 2026] [:error] [pid 33777:tid 33845] [client 54.36.60.91:32936] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afAAAbXUCFWqmordGGLWCAAAAQo"]
[Tue Apr 28 08:32:03.812136 2026] [:error] [pid 33775:tid 33781] [client 54.36.60.91:49790] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afAAA5sYOcoQrq88YbXWuAAAAMI"]
[Tue Apr 28 08:32:05.692899 2026] [:error] [pid 33777:tid 33859] [client 54.36.60.91:49806] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afAABbXUCFWqmordGGLWCwAAARg"]
[Tue Apr 28 08:32:07.706258 2026] [:error] [pid 33864:tid 33876] [client 54.36.60.91:49808] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afAABzXchLGZ4QggCsmUAQAAAIo"]
[Tue Apr 28 08:32:09.716646 2026] [:error] [pid 50889:tid 50900] [client 54.36.60.91:49818] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afAACYzszBr00txEzGiCEgAAAAg"]
[Tue Apr 28 08:32:12.076207 2026] [:error] [pid 33775:tid 33790] [client 54.36.60.91:41518] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afAADJsYOcoQrq88YbXWvQAAAMs"]
[Tue Apr 28 08:32:13.920812 2026] [:error] [pid 33864:tid 33882] [client 54.36.60.91:49918] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afAADTXchLGZ4QggCsmUCgAAAJA"]
[Tue Apr 28 08:32:16.412302 2026] [:error] [pid 33775:tid 33784] [client 54.36.60.91:48836] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afAAEJsYOcoQrq88YbXWwwAAAMU"]
[Tue Apr 28 08:32:18.401975 2026] [:error] [pid 33777:tid 33837] [client 54.36.60.91:49934] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afAAErXUCFWqmordGGLWDgAAAQI"]
[Tue Apr 28 08:32:20.427928 2026] [:error] [pid 33864:tid 33881] [client 54.36.60.91:49940] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afAAFDXchLGZ4QggCsmUFQAAAI8"]
[Tue Apr 28 08:32:22.940394 2026] [:error] [pid 33864:tid 33882] [client 54.36.60.91:48844] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afAAFjXchLGZ4QggCsmUGgAAAJA"]
[Tue Apr 28 08:32:25.408454 2026] [:error] [pid 33775:tid 33797] [client 54.36.60.91:49230] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afAAGZsYOcoQrq88YbXWxgAAANI"]
[Tue Apr 28 08:32:27.888201 2026] [:error] [pid 33775:tid 33786] [client 54.36.60.91:49234] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afAAG5sYOcoQrq88YbXWyQAAAMc"]
[Tue Apr 28 08:32:30.216865 2026] [:error] [pid 33777:tid 33842] [client 54.36.60.91:49240] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afAAHrXUCFWqmordGGLWHgAAAQc"]
[Tue Apr 28 08:32:32.693356 2026] [:error] [pid 33775:tid 33783] [client 54.36.60.91:49252] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afAAIJsYOcoQrq88YbXWzgAAAMQ"]
[Tue Apr 28 08:32:35.019618 2026] [:error] [pid 33775:tid 33782] [client 54.36.60.91:55570] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afAAI5sYOcoQrq88YbXW0gAAAMM"]
[Tue Apr 28 08:32:56.892747 2026] [:error] [pid 33864:tid 33870] [client 54.36.60.91:55578] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afAAODXchLGZ4QggCsmUqgAAAIQ"]
[Tue Apr 28 08:32:58.585154 2026] [:error] [pid 50889:tid 50906] [client 54.36.60.91:40184] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afAAOozszBr00txEzGiCmQAAAA4"]
[Tue Apr 28 08:33:01.037912 2026] [:error] [pid 33864:tid 33872] [client 54.36.60.91:55674] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afAAPTXchLGZ4QggCsmUsQAAAIY"]
[Tue Apr 28 08:33:02.868936 2026] [:error] [pid 33864:tid 33869] [client 54.36.60.91:40194] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afAAPjXchLGZ4QggCsmUswAAAIM"]
[Tue Apr 28 08:33:05.371180 2026] [:error] [pid 33777:tid 33841] [client 54.36.60.91:44730] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afAAQbXUCFWqmordGGLWRgAAAQY"]
[Tue Apr 28 08:33:07.377460 2026] [:error] [pid 33777:tid 33852] [client 54.36.60.91:38980] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afAAQ7XUCFWqmordGGLWSwAAARE"]
[Tue Apr 28 08:33:09.873761 2026] [:error] [pid 33777:tid 33841] [client 54.36.60.91:44736] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afAARbXUCFWqmordGGLWVQAAAQY"]
[Tue Apr 28 08:33:11.863024 2026] [:error] [pid 33776:tid 33818] [client 54.36.60.91:38984] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afAAR1-bEJ2CKP3iKADFGQAAAEo"]
[Tue Apr 28 08:33:14.349995 2026] [:error] [pid 50889:tid 50914] [client 54.36.60.91:57896] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afAASozszBr00txEzGiCoQAAABY"]
[Tue Apr 28 08:33:16.188183 2026] [:error] [pid 33776:tid 33815] [client 54.36.60.91:47536] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afAATF-bEJ2CKP3iKADFGwAAAEc"]
[Tue Apr 28 08:33:18.696251 2026] [:error] [pid 50889:tid 50895] [client 54.36.60.91:57904] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afAATozszBr00txEzGiCqgAAAAM"]
[Tue Apr 28 08:33:21.167170 2026] [:error] [pid 50889:tid 50896] [client 54.36.60.91:57910] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afAAUYzszBr00txEzGiCugAAAAQ"]
[Tue Apr 28 08:33:23.000942 2026] [:error] [pid 33775:tid 33782] [client 54.36.60.91:47542] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afAAUpsYOcoQrq88YbXXeAAAAMM"]
[Tue Apr 28 08:33:25.515604 2026] [:error] [pid 50889:tid 50892] [client 54.36.60.91:33730] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afAAVYzszBr00txEzGiC1QAAAAA"]
[Tue Apr 28 08:33:27.500215 2026] [:error] [pid 33777:tid 33845] [client 54.36.60.91:52396] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afAAV7XUCFWqmordGGLWfwAAAQo"]
[Tue Apr 28 08:33:30.001984 2026] [:error] [pid 33776:tid 33818] [client 54.36.60.91:33742] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afAAWl-bEJ2CKP3iKADFJgAAAEo"]
[Tue Apr 28 08:33:31.989146 2026] [:error] [pid 33777:tid 33840] [client 54.36.60.91:52406] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afAAW7XUCFWqmordGGLWggAAAQU"]
[Tue Apr 28 08:33:34.493537 2026] [:error] [pid 33864:tid 33869] [client 54.36.60.91:54940] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afAAXjXchLGZ4QggCsmU9gAAAIM"]
[Tue Apr 28 08:33:36.322607 2026] [:error] [pid 50889:tid 50908] [client 54.36.60.91:51166] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afAAYIzszBr00txEzGiDDAAAABA"]
[Tue Apr 28 08:33:38.345214 2026] [:error] [pid 33776:tid 33817] [client 54.36.60.91:51168] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afAAYl-bEJ2CKP3iKADFMAAAAEk"]
[Tue Apr 28 08:33:40.209573 2026] [:error] [pid 33864:tid 33885] [client 54.36.60.91:51182] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afAAZDXchLGZ4QggCsmVKQAAAJM"]
[Tue Apr 28 08:33:42.223079 2026] [:error] [pid 50889:tid 50900] [client 54.36.60.91:51188] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afAAZozszBr00txEzGiDJgAAAAg"]
[Tue Apr 28 08:33:44.722779 2026] [:error] [pid 33777:tid 33846] [client 54.36.60.91:59684] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afAAaLXUCFWqmordGGLWrAAAAQs"]
[Tue Apr 28 08:33:47.025802 2026] [:error] [pid 33864:tid 33879] [client 54.36.60.91:59696] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afAAazXchLGZ4QggCsmVRQAAAI0"]
[Tue Apr 28 08:33:49.776167 2026] [:error] [pid 33777:tid 33859] [client 54.36.60.91:46410] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afAAbbXUCFWqmordGGLWtwAAARg"]
[Tue Apr 28 08:33:53.646795 2026] [:error] [pid 33864:tid 33886] [client 54.36.60.91:52620] [client 54.36.60.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afAAcTXchLGZ4QggCsmVcwAAAJQ"]
[Tue Apr 28 10:11:48.990290 2026] [:error] [pid 50889:tid 50908] [client 95.85.252.99:55326] [client 95.85.252.99] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afAXZIzszBr00txEzGiwjwAAABA"]
[Tue Apr 28 10:11:49.376555 2026] [:error] [pid 50889:tid 50909] [client 95.85.252.99:55326] [client 95.85.252.99] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afAXZYzszBr00txEzGiwmAAAABE"]
[Tue Apr 28 11:28:34.577801 2026] [:error] [pid 2741:tid 2769] [client 182.43.70.143:48406] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afApYvp92FeOz1h6ILxKowAAAVc"]
[Tue Apr 28 11:37:11.412158 2026] [proxy_fcgi:error] [pid 50889:tid 50906] [client 52.141.35.48:2647] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 11:37:11.751510 2026] [:error] [pid 50889:tid 50904] [client 52.141.35.48:2647] [client 52.141.35.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.141.35.48, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "afArZ4zszBr00txEzGjPTwAAAAw"]
[Tue Apr 28 11:37:11.927782 2026] [proxy_fcgi:error] [pid 50889:tid 50896] [client 52.141.35.48:2647] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 11:37:12.625924 2026] [proxy_fcgi:error] [pid 50889:tid 50913] [client 52.141.35.48:2647] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 11:37:13.139808 2026] [proxy_fcgi:error] [pid 50889:tid 50908] [client 52.141.35.48:2647] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 11:37:13.322861 2026] [:error] [pid 50889:tid 50893] [client 52.141.35.48:2647] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "afAraYzszBr00txEzGjPWAAAAAE"]
[Tue Apr 28 11:37:13.960023 2026] [:error] [pid 2741:tid 2766] [client 52.141.35.48:2677] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "afArafp92FeOz1h6ILxQsgAAAVQ"]
[Tue Apr 28 11:37:14.585512 2026] [:error] [pid 2741:tid 2754] [client 52.141.35.48:3025] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "afAravp92FeOz1h6ILxQtgAAAUg"]
[Tue Apr 28 11:37:15.183641 2026] [:error] [pid 2741:tid 2759] [client 52.141.35.48:11132] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/crystal/"] [unique_id "afAra_p92FeOz1h6ILxQtwAAAU0"]
[Tue Apr 28 13:55:51.124375 2026] [:error] [pid 33776:tid 33815] [client 43.153.73.200:40854] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afBL51-bEJ2CKP3iKAD7vgAAAEc"]
[Tue Apr 28 15:02:37.273877 2026] [:error] [pid 2741:tid 2764] [client 81.167.26.57:53111] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afBbjfp92FeOz1h6ILyZ3QAAAVI"]
[Tue Apr 28 15:02:39.261034 2026] [:error] [pid 33864:tid 33888] [client 81.167.26.57:47624] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afBbjzXchLGZ4QggCsnqWgAAAJY"]
[Tue Apr 28 15:02:41.079401 2026] [:error] [pid 33775:tid 33790] [client 81.167.26.57:26351] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afBbkZsYOcoQrq88YbUK-gAAAMs"]
[Tue Apr 28 15:02:43.818926 2026] [:error] [pid 33864:tid 33878] [client 81.167.26.57:4617] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afBbkzXchLGZ4QggCsnqXAAAAIw"]
[Tue Apr 28 15:02:45.804690 2026] [:error] [pid 2741:tid 2759] [client 81.167.26.57:65365] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afBblfp92FeOz1h6ILyZ4AAAAU0"]
[Tue Apr 28 15:02:47.832475 2026] [:error] [pid 2741:tid 2758] [client 81.167.26.57:42115] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afBbl_p92FeOz1h6ILyZ4QAAAUw"]
[Tue Apr 28 15:02:49.206950 2026] [:error] [pid 33777:tid 33849] [client 81.167.26.57:29451] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afBbmbXUCFWqmordGGJoFQAAAQ4"]
[Tue Apr 28 15:02:53.185095 2026] [:error] [pid 33777:tid 33838] [client 81.167.26.57:54308] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afBbnbXUCFWqmordGGJoJQAAAQM"]
[Tue Apr 28 16:04:35.187906 2026] [proxy_fcgi:error] [pid 33777:tid 33843] [client 145.239.10.137:54682] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/data2.php
[Tue Apr 28 17:43:06.952934 2026] [:error] [pid 2741:tid 2759] [client 195.63.13.243:34568] [client 195.63.13.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.63.13.243, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afCBKvp92FeOz1h6ILzIsgAAAU0"]
[Tue Apr 28 17:43:06.962697 2026] [proxy_fcgi:error] [pid 2741:tid 2759] [client 195.63.13.243:34568] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 17:43:08.176912 2026] [:error] [pid 33776:tid 33812] [client 217.181.64.239:15706] [client 217.181.64.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.181.64.239, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afCBLF-bEJ2CKP3iKAAbbAAAAEQ"]
[Tue Apr 28 17:43:08.180953 2026] [proxy_fcgi:error] [pid 33776:tid 33812] [client 217.181.64.239:15706] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 17:43:12.893715 2026] [:error] [pid 33777:tid 33848] [client 195.63.28.166:31446] [client 195.63.28.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.63.28.166, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afCBMLXUCFWqmordGGKj4gAAAQ0"]
[Tue Apr 28 17:43:12.897570 2026] [proxy_fcgi:error] [pid 33777:tid 33848] [client 195.63.28.166:31446] AH01071: Got error 'Primary script unknown'
[Tue Apr 28 18:09:47.466522 2026] [:error] [pid 33864:tid 33890] [client 123.187.240.242:44895] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afCHazXchLGZ4QggCskHuAAAAJg"]
[Tue Apr 28 19:17:50.581454 2026] [:error] [pid 33864:tid 33883] [client 51.83.100.230:35718] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afCXXjXchLGZ4QggCskU5QAAAJE"]
[Tue Apr 28 19:17:52.733461 2026] [:error] [pid 33775:tid 33781] [client 51.83.100.230:57556] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afCXYJsYOcoQrq88YbUmpQAAAMI"]
[Tue Apr 28 19:17:55.123201 2026] [:error] [pid 33777:tid 33859] [client 51.83.100.230:46030] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afCXY7XUCFWqmordGGLGtAAAARg"]
[Tue Apr 28 19:17:57.118054 2026] [:error] [pid 33777:tid 33847] [client 51.83.100.230:60236] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afCXZbXUCFWqmordGGLGtwAAAQw"]
[Tue Apr 28 19:17:59.984671 2026] [:error] [pid 50889:tid 50912] [client 51.83.100.230:46044] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afCXZ4zszBr00txEzGg4TwAAABQ"]
[Tue Apr 28 19:18:02.563954 2026] [:error] [pid 2741:tid 2761] [client 51.83.100.230:46054] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afCXavp92FeOz1h6ILzftwAAAU8"]
[Tue Apr 28 19:18:04.475914 2026] [:error] [pid 2741:tid 2752] [client 51.83.100.230:37854] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afCXbPp92FeOz1h6ILzfuwAAAUY"]
[Tue Apr 28 19:18:07.293457 2026] [:error] [pid 2741:tid 2769] [client 51.83.100.230:44892] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afCXb_p92FeOz1h6ILzfvQAAAVc"]
[Tue Apr 28 19:18:09.833138 2026] [:error] [pid 50889:tid 50905] [client 51.83.100.230:44904] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afCXcYzszBr00txEzGg4VgAAAA0"]
[Tue Apr 28 19:18:12.591701 2026] [:error] [pid 33775:tid 33779] [client 51.83.100.230:44906] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afCXdJsYOcoQrq88YbUmqAAAAMA"]
[Tue Apr 28 19:18:15.295146 2026] [:error] [pid 50889:tid 50913] [client 51.83.100.230:41396] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afCXd4zszBr00txEzGg4XQAAABU"]
[Tue Apr 28 19:18:17.908654 2026] [:error] [pid 2741:tid 2748] [client 51.83.100.230:41412] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afCXefp92FeOz1h6ILzfvgAAAUI"]
[Tue Apr 28 19:18:20.568530 2026] [:error] [pid 33864:tid 33886] [client 51.83.100.230:41414] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afCXfDXchLGZ4QggCskU7wAAAJQ"]
[Tue Apr 28 19:18:23.002445 2026] [:error] [pid 33775:tid 33785] [client 51.83.100.230:41418] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afCXf5sYOcoQrq88YbUmqgAAAMY"]
[Tue Apr 28 19:18:25.424639 2026] [:error] [pid 2741:tid 2759] [client 51.83.100.230:41880] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afCXgfp92FeOz1h6ILzfwwAAAU0"]
[Tue Apr 28 19:18:27.807002 2026] [:error] [pid 33775:tid 33783] [client 51.83.100.230:41890] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afCXg5sYOcoQrq88YbUmqwAAAMQ"]
[Tue Apr 28 19:18:30.246840 2026] [:error] [pid 50889:tid 50908] [client 51.83.100.230:41904] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afCXhozszBr00txEzGg4bwAAABA"]
[Tue Apr 28 19:18:32.642874 2026] [:error] [pid 33777:tid 33835] [client 51.83.100.230:41914] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afCXiLXUCFWqmordGGLG5QAAAQA"]
[Tue Apr 28 19:18:35.240889 2026] [:error] [pid 33776:tid 33832] [client 51.83.100.230:48302] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afCXi1-bEJ2CKP3iKAApWAAAAFg"]
[Tue Apr 28 19:18:37.693718 2026] [:error] [pid 2741:tid 2758] [client 51.83.100.230:48312] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afCXjfp92FeOz1h6ILzf0gAAAUw"]
[Tue Apr 28 19:18:40.323212 2026] [:error] [pid 33777:tid 33856] [client 51.83.100.230:48324] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afCXkLXUCFWqmordGGLG5wAAARU"]
[Tue Apr 28 19:18:42.767457 2026] [:error] [pid 33776:tid 33825] [client 51.83.100.230:48338] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afCXkl-bEJ2CKP3iKAApXwAAAFE"]
[Tue Apr 28 19:18:45.066119 2026] [:error] [pid 33777:tid 33836] [client 51.83.100.230:43910] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afCXlbXUCFWqmordGGLG6wAAAQE"]
[Tue Apr 28 19:18:47.608196 2026] [:error] [pid 50889:tid 50906] [client 51.83.100.230:43920] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afCXl4zszBr00txEzGg4dgAAAA4"]
[Tue Apr 28 19:19:04.275481 2026] [:error] [pid 33777:tid 33854] [client 51.83.100.230:43930] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afCXqLXUCFWqmordGGLHBwAAARM"]
[Tue Apr 28 19:19:04.447222 2026] [:error] [pid 33775:tid 33796] [client 51.83.100.230:42748] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afCXqJsYOcoQrq88YbUmrQAAANE"]
[Tue Apr 28 19:19:06.654939 2026] [:error] [pid 33864:tid 33866] [client 51.83.100.230:53600] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afCXqjXchLGZ4QggCskU_QAAAIA"]
[Tue Apr 28 19:19:08.758172 2026] [:error] [pid 33775:tid 33783] [client 51.83.100.230:42754] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afCXrJsYOcoQrq88YbUmtwAAAMQ"]
[Tue Apr 28 19:19:09.036957 2026] [:error] [pid 33775:tid 33785] [client 51.83.100.230:53610] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afCXrZsYOcoQrq88YbUmuQAAAMY"]
[Tue Apr 28 19:19:11.456873 2026] [:error] [pid 33864:tid 33873] [client 51.83.100.230:53612] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afCXrzXchLGZ4QggCskVAgAAAIc"]
[Tue Apr 28 19:19:12.586690 2026] [:error] [pid 33864:tid 33871] [client 51.83.100.230:53616] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/24th%20slot.aspx"] [unique_id "afCXsDXchLGZ4QggCskVAwAAAIU"]
[Tue Apr 28 19:19:13.739110 2026] [:error] [pid 33775:tid 33802] [client 51.83.100.230:53626] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afCXsZsYOcoQrq88YbUmvQAAANc"]
[Tue Apr 28 19:19:15.386955 2026] [:error] [pid 50889:tid 50902] [client 51.83.100.230:42316] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "afCXs4zszBr00txEzGg4hQAAAAo"]
[Tue Apr 28 19:19:15.543653 2026] [:error] [pid 33864:tid 33870] [client 51.83.100.230:38062] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afCXszXchLGZ4QggCskVBQAAAIQ"]
[Tue Apr 28 19:19:18.070608 2026] [:error] [pid 33864:tid 33876] [client 51.83.100.230:42326] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afCXtjXchLGZ4QggCskVCQAAAIo"]
[Tue Apr 28 19:19:18.714570 2026] [:error] [pid 33776:tid 33814] [client 51.83.100.230:42342] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "afCXtl-bEJ2CKP3iKAApcAAAAEY"]
[Tue Apr 28 19:19:20.637593 2026] [:error] [pid 33777:tid 33839] [client 51.83.100.230:42352] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afCXuLXUCFWqmordGGLHEgAAAQQ"]
[Tue Apr 28 19:19:22.383543 2026] [:error] [pid 33777:tid 33856] [client 51.83.100.230:42358] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afCXurXUCFWqmordGGLHIAAAARU"]
[Tue Apr 28 19:19:22.582682 2026] [:error] [pid 2741:tid 2759] [client 51.83.100.230:38078] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afCXuvp92FeOz1h6ILzf-wAAAU0"]
[Tue Apr 28 19:19:25.093365 2026] [:error] [pid 33864:tid 33882] [client 51.83.100.230:60240] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afCXvTXchLGZ4QggCskVGwAAAJA"]
[Tue Apr 28 19:19:26.045322 2026] [:error] [pid 50889:tid 50914] [client 51.83.100.230:60248] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afCXvozszBr00txEzGg4igAAABY"]
[Tue Apr 28 19:19:26.866998 2026] [:error] [pid 33777:tid 33838] [client 51.83.100.230:49770] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afCXvrXUCFWqmordGGLHNQAAAQM"]
[Tue Apr 28 19:19:28.704463 2026] [:error] [pid 33777:tid 33836] [client 51.83.100.230:60264] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afCXwLXUCFWqmordGGLHOwAAAQE"]
[Tue Apr 28 19:19:29.154515 2026] [:error] [pid 50889:tid 50892] [client 51.83.100.230:60272] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afCXwYzszBr00txEzGg4jgAAAAA"]
[Tue Apr 28 19:19:30.937342 2026] [:error] [pid 33777:tid 33843] [client 51.83.100.230:49776] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afCXwrXUCFWqmordGGLHPQAAAQg"]
[Tue Apr 28 19:19:31.731185 2026] [:error] [pid 33777:tid 33858] [client 51.83.100.230:60288] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afCXw7XUCFWqmordGGLHPgAAARc"]
[Tue Apr 28 19:19:33.514305 2026] [:error] [pid 2741:tid 2751] [client 51.83.100.230:60302] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afCXxfp92FeOz1h6ILzgAAAAAUU"]
[Tue Apr 28 19:19:35.044264 2026] [:error] [pid 50889:tid 50907] [client 51.83.100.230:45744] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afCXx4zszBr00txEzGg4lAAAAA8"]
[Tue Apr 28 19:19:35.985518 2026] [:error] [pid 33777:tid 33852] [client 51.83.100.230:45752] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afCXx7XUCFWqmordGGLHQwAAARE"]
[Tue Apr 28 19:19:37.695479 2026] [:error] [pid 33864:tid 33875] [client 51.83.100.230:45762] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afCXyTXchLGZ4QggCskVHQAAAIk"]
[Tue Apr 28 19:19:38.532795 2026] [:error] [pid 2741:tid 2762] [client 51.83.100.230:45774] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afCXyvp92FeOz1h6ILzgAgAAAVA"]
[Tue Apr 28 19:19:40.948236 2026] [:error] [pid 2741:tid 2760] [client 51.83.100.230:45788] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afCXzPp92FeOz1h6ILzgAwAAAU4"]
[Tue Apr 28 19:19:41.252612 2026] [:error] [pid 2741:tid 2770] [client 51.83.100.230:45798] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afCXzfp92FeOz1h6ILzgBAAAAVg"]
[Tue Apr 28 19:19:42.928937 2026] [:error] [pid 2741:tid 2761] [client 51.83.100.230:48358] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afCXzvp92FeOz1h6ILzgCAAAAU8"]
[Tue Apr 28 19:19:44.341173 2026] [:error] [pid 50889:tid 50912] [client 51.83.100.230:45812] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afCX0IzszBr00txEzGg4ogAAABQ"]
[Tue Apr 28 19:19:45.403341 2026] [:error] [pid 33864:tid 33870] [client 51.83.100.230:56076] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afCX0TXchLGZ4QggCskVIQAAAIQ"]
[Tue Apr 28 19:19:47.001999 2026] [:error] [pid 2741:tid 2757] [client 51.83.100.230:56082] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afCX0_p92FeOz1h6ILzgDQAAAUs"]
[Tue Apr 28 19:19:47.271216 2026] [:error] [pid 33777:tid 33836] [client 51.83.100.230:47970] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afCX07XUCFWqmordGGLHTAAAAQE"]
[Tue Apr 28 19:19:50.025915 2026] [:error] [pid 33777:tid 33855] [client 51.83.100.230:56088] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afCX1rXUCFWqmordGGLHWQAAARQ"]
[Tue Apr 28 19:19:50.860500 2026] [:error] [pid 33777:tid 33843] [client 51.83.100.230:56086] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afCX1rXUCFWqmordGGLHWwAAAQg"]
[Tue Apr 28 19:19:53.275675 2026] [:error] [pid 33777:tid 33836] [client 51.83.100.230:56096] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afCX2bXUCFWqmordGGLHYQAAAQE"]
[Tue Apr 28 19:19:53.910626 2026] [:error] [pid 33776:tid 33827] [client 51.83.100.230:56108] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afCX2V-bEJ2CKP3iKAApewAAAFM"]
[Tue Apr 28 19:19:55.751306 2026] [:error] [pid 33777:tid 33851] [client 51.83.100.230:47164] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afCX27XUCFWqmordGGLHZAAAARA"]
[Tue Apr 28 19:19:56.879216 2026] [:error] [pid 33776:tid 33832] [client 51.83.100.230:47178] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afCX3F-bEJ2CKP3iKAApfAAAAFg"]
[Tue Apr 28 19:19:58.236939 2026] [:error] [pid 33776:tid 33812] [client 51.83.100.230:47186] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afCX3l-bEJ2CKP3iKAApfQAAAEQ"]
[Tue Apr 28 19:19:59.824810 2026] [:error] [pid 2741:tid 2763] [client 51.83.100.230:47194] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afCX3_p92FeOz1h6ILzgHQAAAVE"]
[Tue Apr 28 19:20:00.226588 2026] [:error] [pid 33864:tid 33882] [client 51.83.100.230:55806] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afCX4DXchLGZ4QggCskVIwAAAJA"]
[Tue Apr 28 19:20:02.251943 2026] [:error] [pid 33777:tid 33845] [client 51.83.100.230:55808] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afCX4rXUCFWqmordGGLHaAAAAQo"]
[Tue Apr 28 19:20:02.406490 2026] [:error] [pid 50889:tid 50901] [client 51.83.100.230:47200] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afCX4ozszBr00txEzGg4tQAAAAk"]
[Tue Apr 28 19:20:15.378514 2026] [:error] [pid 33777:tid 33854] [client 51.83.100.230:45616] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCX77XUCFWqmordGGLHgAAAARM"]
[Tue Apr 28 19:20:16.384685 2026] [:error] [pid 33777:tid 33859] [client 51.83.100.230:50334] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afCX8LXUCFWqmordGGLHgwAAARg"]
[Tue Apr 28 19:20:19.234675 2026] [:error] [pid 33777:tid 33858] [client 51.83.100.230:59666] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afCX87XUCFWqmordGGLHkgAAARc"]
[Tue Apr 28 19:20:19.236904 2026] [:error] [pid 2741:tid 2770] [client 51.83.100.230:45628] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCX8_p92FeOz1h6ILzgLAAAAVg"]
[Tue Apr 28 19:20:21.979660 2026] [:error] [pid 50889:tid 50907] [client 51.83.100.230:59674] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afCX9YzszBr00txEzGg4ugAAAA8"]
[Tue Apr 28 19:20:24.722921 2026] [:error] [pid 33864:tid 33884] [client 51.83.100.230:42162] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afCX-DXchLGZ4QggCskVKgAAAJI"]
[Tue Apr 28 19:20:28.033631 2026] [:error] [pid 33777:tid 33842] [client 51.83.100.230:42164] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afCX_LXUCFWqmordGGLHpQAAAQc"]
[Tue Apr 28 19:20:31.109303 2026] [:error] [pid 33777:tid 33846] [client 51.83.100.230:42176] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afCX_7XUCFWqmordGGLHrgAAAQs"]
[Tue Apr 28 19:20:34.115548 2026] [:error] [pid 2741:tid 2761] [client 51.83.100.230:42184] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afCYAvp92FeOz1h6ILzgPAAAAU8"]
[Tue Apr 28 19:20:37.257657 2026] [:error] [pid 33777:tid 33850] [client 51.83.100.230:36720] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afCYBbXUCFWqmordGGLHvgAAAQ8"]
[Tue Apr 28 19:20:40.583046 2026] [:error] [pid 33864:tid 33886] [client 51.83.100.230:36722] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afCYCDXchLGZ4QggCskVLwAAAJQ"]
[Tue Apr 28 19:20:43.602673 2026] [:error] [pid 33776:tid 33819] [client 51.83.100.230:36736] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afCYC1-bEJ2CKP3iKAAplQAAAEs"]
[Tue Apr 28 19:20:46.599149 2026] [:error] [pid 50889:tid 50895] [client 51.83.100.230:47930] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afCYDozszBr00txEzGg4vwAAAAM"]
[Tue Apr 28 19:20:49.320423 2026] [:error] [pid 33777:tid 33846] [client 51.83.100.230:47938] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afCYEbXUCFWqmordGGLHyQAAAQs"]
[Tue Apr 28 19:20:51.990441 2026] [:error] [pid 33777:tid 33849] [client 51.83.100.230:47954] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afCYE7XUCFWqmordGGLHzQAAAQ4"]
[Tue Apr 28 19:20:55.002207 2026] [:error] [pid 33777:tid 33850] [client 51.83.100.230:52908] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afCYF7XUCFWqmordGGLH3AAAAQ8"]
[Tue Apr 28 19:20:57.400754 2026] [:error] [pid 50889:tid 50906] [client 51.83.100.230:52920] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afCYGYzszBr00txEzGg4xwAAAA4"]
[Tue Apr 28 19:20:59.888370 2026] [:error] [pid 33864:tid 33884] [client 51.83.100.230:52922] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afCYGzXchLGZ4QggCskVSwAAAJI"]
[Tue Apr 28 19:21:02.821091 2026] [:error] [pid 50889:tid 50902] [client 51.83.100.230:52938] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afCYHozszBr00txEzGg4yAAAAAo"]
[Tue Apr 28 19:21:05.567714 2026] [:error] [pid 33777:tid 33841] [client 51.83.100.230:34262] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afCYIbXUCFWqmordGGLIAAAAAQY"]
[Tue Apr 28 19:21:09.060731 2026] [:error] [pid 50889:tid 50909] [client 51.83.100.230:34264] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afCYJYzszBr00txEzGg41QAAABE"]
[Tue Apr 28 19:21:12.248365 2026] [:error] [pid 50889:tid 50915] [client 51.83.100.230:34276] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afCYKIzszBr00txEzGg42AAAABc"]
[Tue Apr 28 19:21:42.559488 2026] [:error] [pid 50889:tid 50894] [client 51.83.100.230:47338] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCYRozszBr00txEzGg47gAAAAI"]
[Tue Apr 28 19:21:46.351160 2026] [:error] [pid 33777:tid 33837] [client 51.83.100.230:42002] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCYSrXUCFWqmordGGLIGQAAAQI"]
[Tue Apr 28 20:22:47.617699 2026] [:error] [pid 33777:tid 33835] [client 51.83.6.238:58568] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afCml7XUCFWqmordGGLg_wAAAQA"]
[Tue Apr 28 20:22:49.620089 2026] [:error] [pid 33777:tid 33854] [client 51.83.6.238:47690] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afCmmbXUCFWqmordGGLhBQAAARM"]
[Tue Apr 28 20:22:51.396515 2026] [:error] [pid 2741:tid 2751] [client 51.83.6.238:47694] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afCmm_p92FeOz1h6ILzxogAAAUU"]
[Tue Apr 28 20:22:53.297287 2026] [:error] [pid 50889:tid 50905] [client 51.83.6.238:47696] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afCmnYzszBr00txEzGhGtgAAAA0"]
[Tue Apr 28 20:22:55.151929 2026] [:error] [pid 2741:tid 2749] [client 51.83.6.238:47700] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afCmn_p92FeOz1h6ILzxpQAAAUM"]
[Tue Apr 28 20:22:56.989689 2026] [:error] [pid 33775:tid 33781] [client 51.83.6.238:47716] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afCmoJsYOcoQrq88YbUtSwAAAMI"]
[Tue Apr 28 20:22:58.760954 2026] [:error] [pid 2741:tid 2767] [client 51.83.6.238:47724] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afCmovp92FeOz1h6ILzxpwAAAVU"]
[Tue Apr 28 20:23:00.704421 2026] [:error] [pid 2741:tid 2765] [client 51.83.6.238:57814] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afCmpPp92FeOz1h6ILzxqAAAAVM"]
[Tue Apr 28 20:23:02.659131 2026] [:error] [pid 33777:tid 33836] [client 51.83.6.238:57818] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afCmprXUCFWqmordGGLhFQAAAQE"]
[Tue Apr 28 20:23:04.608704 2026] [:error] [pid 33777:tid 33857] [client 51.83.6.238:57824] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afCmqLXUCFWqmordGGLhGQAAARY"]
[Tue Apr 28 20:23:06.681802 2026] [:error] [pid 33776:tid 33817] [client 51.83.6.238:57834] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afCmql-bEJ2CKP3iKAAzFgAAAEk"]
[Tue Apr 28 20:23:08.465470 2026] [:error] [pid 33776:tid 33814] [client 51.83.6.238:57840] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afCmrF-bEJ2CKP3iKAAzGQAAAEY"]
[Tue Apr 28 20:23:10.871000 2026] [:error] [pid 33864:tid 33874] [client 51.83.6.238:42324] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afCmrjXchLGZ4QggCskgJQAAAIg"]
[Tue Apr 28 20:23:12.614798 2026] [:error] [pid 2741:tid 2768] [client 51.83.6.238:50136] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afCmsPp92FeOz1h6ILzxrwAAAVY"]
[Tue Apr 28 20:23:14.997857 2026] [:error] [pid 33776:tid 33819] [client 51.83.6.238:42338] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afCmsl-bEJ2CKP3iKAAzHwAAAEs"]
[Tue Apr 28 20:23:17.403030 2026] [:error] [pid 33776:tid 33810] [client 51.83.6.238:42346] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afCmtV-bEJ2CKP3iKAAzIgAAAEI"]
[Tue Apr 28 20:23:19.309942 2026] [:error] [pid 50889:tid 50914] [client 51.83.6.238:56230] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afCmt4zszBr00txEzGhGygAAABY"]
[Tue Apr 28 20:23:21.843689 2026] [:error] [pid 2741:tid 2752] [client 51.83.6.238:48012] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afCmufp92FeOz1h6ILzxugAAAUY"]
[Tue Apr 28 20:23:24.211210 2026] [:error] [pid 2741:tid 2759] [client 51.83.6.238:48014] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afCmvPp92FeOz1h6ILzxvAAAAU0"]
[Tue Apr 28 20:23:26.751363 2026] [:error] [pid 50889:tid 50893] [client 51.83.6.238:48020] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afCmvozszBr00txEzGhG1wAAAAE"]
[Tue Apr 28 20:23:28.772648 2026] [:error] [pid 2741:tid 2748] [client 51.83.6.238:56232] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afCmwPp92FeOz1h6ILzxwQAAAUI"]
[Tue Apr 28 20:23:31.147768 2026] [:error] [pid 2741:tid 2754] [client 51.83.6.238:45984] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afCmw_p92FeOz1h6ILzxxQAAAUg"]
[Tue Apr 28 20:23:33.647420 2026] [:error] [pid 2741:tid 2759] [client 51.83.6.238:45992] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afCmxfp92FeOz1h6ILzxzAAAAU0"]
[Tue Apr 28 20:23:36.181486 2026] [:error] [pid 2741:tid 2763] [client 51.83.6.238:46004] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afCmyPp92FeOz1h6ILzx0gAAAVE"]
[Tue Apr 28 20:23:38.704904 2026] [:error] [pid 33777:tid 33841] [client 51.83.6.238:46018] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afCmyrXUCFWqmordGGLhKAAAAQY"]
[Tue Apr 28 20:23:40.718961 2026] [:error] [pid 2741:tid 2763] [client 51.83.6.238:37112] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afCmzPp92FeOz1h6ILzx3gAAAVE"]
[Tue Apr 28 20:23:43.079863 2026] [:error] [pid 50889:tid 50892] [client 51.83.6.238:45374] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afCmz4zszBr00txEzGhG-gAAAAA"]
[Tue Apr 28 20:24:04.748490 2026] [:error] [pid 33777:tid 33836] [client 51.83.6.238:43808] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afCm5LXUCFWqmordGGLhUQAAAQE"]
[Tue Apr 28 20:24:06.714465 2026] [:error] [pid 2741:tid 2765] [client 51.83.6.238:44528] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afCm5vp92FeOz1h6ILzx9wAAAVM"]
[Tue Apr 28 20:24:08.730611 2026] [:error] [pid 50889:tid 50909] [client 51.83.6.238:44542] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afCm6IzszBr00txEzGhHHwAAABE"]
[Tue Apr 28 20:24:10.753113 2026] [:error] [pid 50889:tid 50900] [client 51.83.6.238:37380] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afCm6ozszBr00txEzGhHIQAAAAg"]
[Tue Apr 28 20:24:13.115632 2026] [:error] [pid 2741:tid 2768] [client 51.83.6.238:40450] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afCm7fp92FeOz1h6ILzx_AAAAVY"]
[Tue Apr 28 20:24:15.432711 2026] [:error] [pid 33777:tid 33844] [client 51.83.6.238:37382] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afCm77XUCFWqmordGGLhUgAAAQk"]
[Tue Apr 28 20:24:17.455985 2026] [:error] [pid 33777:tid 33846] [client 51.83.6.238:37384] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afCm8bXUCFWqmordGGLhVgAAAQs"]
[Tue Apr 28 20:24:19.484833 2026] [:error] [pid 50889:tid 50897] [client 51.83.6.238:58182] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afCm84zszBr00txEzGhHKAAAAAU"]
[Tue Apr 28 20:24:21.494302 2026] [:error] [pid 33776:tid 33810] [client 51.83.6.238:58192] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afCm9V-bEJ2CKP3iKAAzOAAAAEI"]
[Tue Apr 28 20:24:25.276797 2026] [:error] [pid 33864:tid 33880] [client 51.83.6.238:58204] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCm-TXchLGZ4QggCskgPwAAAI4"]
[Tue Apr 28 20:24:29.106297 2026] [:error] [pid 50889:tid 50892] [client 51.83.6.238:58216] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCm_YzszBr00txEzGhHMgAAAAA"]
[Tue Apr 28 20:57:35.238896 2026] [:error] [pid 33775:tid 33779] [client 51.68.34.57:38084] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afCuv5sYOcoQrq88YbUxhAAAAMA"]
[Tue Apr 28 20:57:37.764523 2026] [:error] [pid 2741:tid 2750] [client 51.68.34.57:37308] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afCuwfp92FeOz1h6ILz9SAAAAUQ"]
[Tue Apr 28 20:57:39.495857 2026] [:error] [pid 33777:tid 33835] [client 51.68.34.57:45654] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCuw7XUCFWqmordGGLthAAAAQA"]
[Tue Apr 28 20:57:43.386204 2026] [:error] [pid 33775:tid 33789] [client 51.68.34.57:49504] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCux5sYOcoQrq88YbUxhgAAAMo"]
[Tue Apr 28 20:59:10.805366 2026] [:error] [pid 33775:tid 33802] [client 51.68.34.57:43354] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afCvHpsYOcoQrq88YbUxqAAAANc"]
[Tue Apr 28 20:59:13.329540 2026] [:error] [pid 33777:tid 33850] [client 51.68.34.57:36306] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afCvIbXUCFWqmordGGLuXQAAAQ8"]
[Tue Apr 28 20:59:14.835546 2026] [:error] [pid 33775:tid 33797] [client 51.68.34.57:46552] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCvIpsYOcoQrq88YbUxqQAAANI"]
[Tue Apr 28 20:59:18.794086 2026] [:error] [pid 50889:tid 50910] [client 51.68.34.57:46568] [client 51.68.34.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afCvJozszBr00txEzGhOLgAAABI"]
[Tue Apr 28 21:54:17.014576 2026] [:error] [pid 50889:tid 50899] [client 43.135.135.57:57330] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afC8CYzszBr00txEzGhbbwAAAAc"]
[Wed Apr 29 01:04:14.736637 2026] [:error] [pid 2741:tid 2756] [client 153.75.244.88:52640] [client 153.75.244.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afDojvp92FeOz1h6ILw_mQAAAUo"]
[Wed Apr 29 01:12:34.343728 2026] [:error] [pid 3594:tid 3598] [client 80.244.46.23:44676] [client 80.244.46.23] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afDqglX25ha35uHxeYk4bgAAAYE"]
[Wed Apr 29 01:12:34.680719 2026] [:error] [pid 3594:tid 3608] [client 80.244.46.23:44676] [client 80.244.46.23] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afDqglX25ha35uHxeYk4bwAAAYs"]
[Wed Apr 29 01:27:53.806467 2026] [:error] [pid 33777:tid 33849] [client 147.135.213.27:58828] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afDuGbXUCFWqmordGGJIkQAAAQ4"]
[Wed Apr 29 01:27:55.828349 2026] [:error] [pid 33775:tid 33783] [client 147.135.213.27:41874] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afDuG5sYOcoQrq88YbVOpAAAAMQ"]
[Wed Apr 29 01:27:57.738424 2026] [:error] [pid 2741:tid 2765] [client 147.135.213.27:41882] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afDuHfp92FeOz1h6ILxFDgAAAVM"]
[Wed Apr 29 01:27:59.529137 2026] [:error] [pid 33777:tid 33855] [client 147.135.213.27:41884] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afDuH7XUCFWqmordGGJIkgAAARQ"]
[Wed Apr 29 01:28:01.435154 2026] [:error] [pid 33775:tid 33798] [client 147.135.213.27:41900] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afDuIZsYOcoQrq88YbVOpQAAANM"]
[Wed Apr 29 01:28:03.324668 2026] [:error] [pid 33777:tid 33840] [client 147.135.213.27:39402] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afDuI7XUCFWqmordGGJIlQAAAQU"]
[Wed Apr 29 01:28:05.743890 2026] [:error] [pid 33777:tid 33857] [client 147.135.213.27:43074] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afDuJbXUCFWqmordGGJIlgAAARY"]
[Wed Apr 29 01:28:07.539270 2026] [:error] [pid 33777:tid 33847] [client 147.135.213.27:39418] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afDuJ7XUCFWqmordGGJImQAAAQw"]
[Wed Apr 29 01:28:09.506685 2026] [:error] [pid 2741:tid 2746] [client 147.135.213.27:39430] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afDuKfp92FeOz1h6ILxFIgAAAUA"]
[Wed Apr 29 01:28:12.040816 2026] [:error] [pid 3594:tid 3604] [client 147.135.213.27:43082] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afDuLFX25ha35uHxeYk6vQAAAYc"]
[Wed Apr 29 01:28:13.927497 2026] [:error] [pid 33776:tid 33817] [client 147.135.213.27:49236] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afDuLV-bEJ2CKP3iKABeZgAAAEk"]
[Wed Apr 29 01:28:15.664752 2026] [:error] [pid 50889:tid 50893] [client 147.135.213.27:49246] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afDuL4zszBr00txEzGiCTwAAAAE"]
[Wed Apr 29 01:28:17.560837 2026] [:error] [pid 50889:tid 50901] [client 147.135.213.27:49254] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afDuMYzszBr00txEzGiCUAAAAAk"]
[Wed Apr 29 01:28:19.375130 2026] [:error] [pid 33864:tid 33870] [client 147.135.213.27:49264] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afDuMzXchLGZ4QggCslQYAAAAIQ"]
[Wed Apr 29 01:28:21.167882 2026] [:error] [pid 2741:tid 2769] [client 147.135.213.27:49278] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afDuNfp92FeOz1h6ILxFMwAAAVc"]
[Wed Apr 29 01:28:23.078793 2026] [:error] [pid 2741:tid 2768] [client 147.135.213.27:49288] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afDuN_p92FeOz1h6ILxFPAAAAVY"]
[Wed Apr 29 01:28:25.522815 2026] [:error] [pid 3594:tid 3602] [client 147.135.213.27:33036] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afDuOVX25ha35uHxeYk6wwAAAYU"]
[Wed Apr 29 01:28:27.361599 2026] [:error] [pid 33776:tid 33830] [client 147.135.213.27:51260] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afDuO1-bEJ2CKP3iKABebAAAAFY"]
[Wed Apr 29 01:28:29.657308 2026] [:error] [pid 33775:tid 33784] [client 147.135.213.27:33038] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afDuPZsYOcoQrq88YbVOqgAAAMU"]
[Wed Apr 29 01:28:31.577358 2026] [:error] [pid 33775:tid 33788] [client 147.135.213.27:51272] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afDuP5sYOcoQrq88YbVOqwAAAMk"]
[Wed Apr 29 01:28:33.705360 2026] [:error] [pid 3594:tid 3618] [client 147.135.213.27:35346] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afDuQVX25ha35uHxeYk6xwAAAZU"]
[Wed Apr 29 01:28:35.981414 2026] [:error] [pid 2741:tid 2761] [client 147.135.213.27:51028] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afDuQ_p92FeOz1h6ILxFWgAAAU8"]
[Wed Apr 29 01:28:38.389826 2026] [:error] [pid 2741:tid 2766] [client 147.135.213.27:51030] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afDuRvp92FeOz1h6ILxFXQAAAVQ"]
[Wed Apr 29 01:28:40.803281 2026] [:error] [pid 2741:tid 2747] [client 147.135.213.27:51032] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afDuSPp92FeOz1h6ILxFYAAAAUE"]
[Wed Apr 29 01:28:43.252115 2026] [:error] [pid 2741:tid 2750] [client 147.135.213.27:51040] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afDuS_p92FeOz1h6ILxFYwAAAUQ"]
[Wed Apr 29 01:28:45.797341 2026] [:error] [pid 2741:tid 2760] [client 147.135.213.27:38932] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afDuTfp92FeOz1h6ILxFbwAAAU4"]
[Wed Apr 29 01:28:48.252847 2026] [:error] [pid 2741:tid 2755] [client 147.135.213.27:38946] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afDuUPp92FeOz1h6ILxFcwAAAUk"]
[Wed Apr 29 01:28:50.173803 2026] [:error] [pid 33864:tid 33882] [client 147.135.213.27:43322] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afDuUjXchLGZ4QggCslQbgAAAJA"]
[Wed Apr 29 01:29:11.261341 2026] [:error] [pid 33864:tid 33870] [client 147.135.213.27:33306] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afDuZzXchLGZ4QggCslQkQAAAIQ"]
[Wed Apr 29 01:29:12.993563 2026] [:error] [pid 50889:tid 50897] [client 147.135.213.27:38952] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afDuaIzszBr00txEzGiCcgAAAAU"]
[Wed Apr 29 01:29:14.896629 2026] [:error] [pid 50889:tid 50905] [client 147.135.213.27:53720] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afDuaozszBr00txEzGiCdQAAAA0"]
[Wed Apr 29 01:29:17.452636 2026] [:error] [pid 33864:tid 33866] [client 147.135.213.27:49882] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afDubTXchLGZ4QggCslQlQAAAIA"]
[Wed Apr 29 01:29:19.364790 2026] [:error] [pid 33776:tid 33819] [client 147.135.213.27:53728] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afDub1-bEJ2CKP3iKABecAAAAEs"]
[Wed Apr 29 01:29:21.637612 2026] [:error] [pid 33864:tid 33887] [client 147.135.213.27:49892] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afDucTXchLGZ4QggCslQmwAAAJU"]
[Wed Apr 29 01:29:23.572773 2026] [:error] [pid 33775:tid 33790] [client 147.135.213.27:53226] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afDuc5sYOcoQrq88YbVOvwAAAMs"]
[Wed Apr 29 01:29:25.829857 2026] [:error] [pid 2741:tid 2749] [client 147.135.213.27:41740] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afDudfp92FeOz1h6ILxFngAAAUM"]
[Wed Apr 29 01:29:27.739174 2026] [:error] [pid 33776:tid 33831] [client 147.135.213.27:53236] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afDud1-bEJ2CKP3iKABedAAAAFc"]
[Wed Apr 29 01:29:30.124844 2026] [:error] [pid 50889:tid 50904] [client 147.135.213.27:41748] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afDueozszBr00txEzGiCdwAAAAw"]
[Wed Apr 29 01:29:32.442855 2026] [:error] [pid 33777:tid 33856] [client 147.135.213.27:41764] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afDufLXUCFWqmordGGJIuQAAARU"]
[Wed Apr 29 01:29:34.413689 2026] [:error] [pid 33777:tid 33851] [client 147.135.213.27:45958] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afDufrXUCFWqmordGGJIvAAAARA"]
[Wed Apr 29 01:29:36.696537 2026] [:error] [pid 50889:tid 50914] [client 147.135.213.27:38842] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afDugIzszBr00txEzGiCfAAAABY"]
[Wed Apr 29 01:29:38.578748 2026] [:error] [pid 33777:tid 33842] [client 147.135.213.27:45972] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afDugrXUCFWqmordGGJIwAAAAQc"]
[Wed Apr 29 01:29:40.868933 2026] [:error] [pid 33864:tid 33871] [client 147.135.213.27:38846] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afDuhDXchLGZ4QggCslQowAAAIU"]
[Wed Apr 29 01:29:42.698780 2026] [:error] [pid 2741:tid 2767] [client 147.135.213.27:45974] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afDuhvp92FeOz1h6ILxFrwAAAVU"]
[Wed Apr 29 01:29:44.991812 2026] [:error] [pid 2741:tid 2756] [client 147.135.213.27:48376] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afDuiPp92FeOz1h6ILxFtgAAAUo"]
[Wed Apr 29 01:29:46.906526 2026] [:error] [pid 2741:tid 2749] [client 147.135.213.27:45436] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afDuivp92FeOz1h6ILxFuAAAAUM"]
[Wed Apr 29 01:29:48.868785 2026] [:error] [pid 2741:tid 2747] [client 147.135.213.27:45448] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afDujPp92FeOz1h6ILxFvAAAAUE"]
[Wed Apr 29 01:29:50.837589 2026] [:error] [pid 3594:tid 3604] [client 147.135.213.27:45450] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afDujlX25ha35uHxeYk7BAAAAYc"]
[Wed Apr 29 01:29:52.902498 2026] [:error] [pid 33775:tid 33789] [client 147.135.213.27:45462] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afDukJsYOcoQrq88YbVOxgAAAMo"]
[Wed Apr 29 01:29:55.320655 2026] [:error] [pid 33775:tid 33786] [client 147.135.213.27:42764] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afDuk5sYOcoQrq88YbVOxwAAAMc"]
[Wed Apr 29 01:29:57.951113 2026] [:error] [pid 33864:tid 33871] [client 147.135.213.27:42776] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afDulTXchLGZ4QggCslQrwAAAIU"]
[Wed Apr 29 01:29:59.943772 2026] [:error] [pid 50889:tid 50896] [client 147.135.213.27:43508] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afDul4zszBr00txEzGiCiAAAAAQ"]
[Wed Apr 29 01:30:03.814290 2026] [:error] [pid 50889:tid 50908] [client 147.135.213.27:57766] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afDum4zszBr00txEzGiCiQAAABA"]
[Wed Apr 29 03:07:36.793224 2026] [:error] [pid 33776:tid 33808] [client 34.72.226.180:53036] [client 34.72.226.180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "afEFeF-bEJ2CKP3iKABpkAAAAEA"]
[Wed Apr 29 04:13:37.289001 2026] [proxy_fcgi:error] [pid 56863:tid 56871] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:37.514747 2026] [proxy_fcgi:error] [pid 56863:tid 56877] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:37.920190 2026] [proxy_fcgi:error] [pid 56863:tid 56876] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:38.121624 2026] [proxy_fcgi:error] [pid 56863:tid 56873] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:38.520494 2026] [proxy_fcgi:error] [pid 56863:tid 56874] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:38.721937 2026] [proxy_fcgi:error] [pid 56863:tid 56866] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:39.023006 2026] [proxy_fcgi:error] [pid 56863:tid 56872] [client 20.12.211.211:25122] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 04:13:39.564448 2026] [:error] [pid 56863:tid 56870] [client 20.12.211.211:25122] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afEU82QQTEnvYCOsiwLBFgAAAMU"]
[Wed Apr 29 04:13:41.860873 2026] [:error] [pid 26594:tid 26607] [client 20.12.211.211:10255] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afEU9ds-37Kay1vO52kgnAAAAQs"]
[Wed Apr 29 04:13:46.896814 2026] [:error] [pid 56755:tid 56771] [client 20.12.211.211:10245] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afEU-vdXjiwtyGfj4lw_yAAAAAc"]
[Wed Apr 29 06:04:39.453029 2026] [proxy_fcgi:error] [pid 40344:tid 40375] [client 145.239.10.137:43776] AH01071: Got error 'Primary script unknown', referer: http://switchcreative.net/tina.php
[Wed Apr 29 06:28:37.710442 2026] [:error] [pid 40343:tid 40357] [client 170.106.181.163:38180] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afE0lWiaWCZjSxz2ZNts3AAAAYo"]
[Wed Apr 29 07:40:03.872000 2026] [:error] [pid 40313:tid 40334] [client 36.111.67.189:47839] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afFFU6px5sKFuV9bHzplSwAAAVM"]
[Wed Apr 29 08:12:20.478809 2026] [:error] [pid 40313:tid 40322] [client 43.156.168.214:46568] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afFM5Kpx5sKFuV9bHzpx1gAAAUc"]
[Wed Apr 29 08:47:31.853799 2026] [:error] [pid 31658:tid 31671] [client 20.57.206.147:24553] [client 20.57.206.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.57.206.147, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/wp/xmlrpc.php"] [unique_id "afFVI4Y6yiug1fCvCd81lgAAAAg"]
[Wed Apr 29 13:09:21.454006 2026] [:error] [pid 45085:tid 45099] [client 65.108.78.33:23960] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afGSgdS7eNjgd8gD6ZzhiAAAAsw"]
[Wed Apr 29 13:09:23.924714 2026] [:error] [pid 61540:tid 61573] [client 65.108.78.33:5066] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afGSg-Q8cJB7pQslzIexRgAAAIA"]
[Wed Apr 29 13:09:25.830508 2026] [:error] [pid 44806:tid 44830] [client 65.108.78.33:64962] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afGShav5rSisMqePk8Up9QAAAdY"]
[Wed Apr 29 13:09:28.412900 2026] [:error] [pid 44806:tid 44808] [client 65.108.78.33:5076] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afGSiKv5rSisMqePk8Up_wAAAcA"]
[Wed Apr 29 13:09:30.363479 2026] [:error] [pid 2604:tid 2610] [client 65.108.78.33:64976] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afGSihx5WQMU1W68tTYVEQAAAEQ"]
[Wed Apr 29 13:09:32.927471 2026] [:error] [pid 45151:tid 45175] [client 65.108.78.33:20350] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afGSjO3qY0yu3yfud1Q3JgAAA1Y"]
[Wed Apr 29 13:09:35.433103 2026] [:error] [pid 61628:tid 61634] [client 65.108.78.33:20354] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afGSj_XzdLVcrP-YPZg4KAAAAME"]
[Wed Apr 29 13:09:37.512422 2026] [:error] [pid 44806:tid 44822] [client 65.108.78.33:49286] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afGSkav5rSisMqePk8UqGAAAAc4"]
[Wed Apr 29 13:09:40.065781 2026] [:error] [pid 44806:tid 44825] [client 65.108.78.33:20368] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afGSlKv5rSisMqePk8UqIQAAAdE"]
[Wed Apr 29 13:09:42.448686 2026] [:error] [pid 2604:tid 2629] [client 65.108.78.33:64064] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afGSlhx5WQMU1W68tTYVMwAAAFc"]
[Wed Apr 29 13:09:44.918662 2026] [:error] [pid 22901:tid 22920] [client 65.108.78.33:64070] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afGSmBvfVEXI-f42iRRFRAAAARE"]
[Wed Apr 29 13:09:47.422053 2026] [:error] [pid 61540:tid 61592] [client 65.108.78.33:64074] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afGSm-Q8cJB7pQslzIexTQAAAJM"]
[Wed Apr 29 13:09:50.047087 2026] [:error] [pid 61539:tid 61546] [client 65.108.78.33:64088] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afGSnl3XmLvOLqFtXVE1TQAAAAM"]
[Wed Apr 29 13:09:52.349179 2026] [:error] [pid 61540:tid 61596] [client 65.108.78.33:38002] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afGSoOQ8cJB7pQslzIexYAAAAJc"]
[Wed Apr 29 13:09:54.685657 2026] [:error] [pid 45085:tid 45095] [client 65.108.78.33:38014] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afGSotS7eNjgd8gD6ZzhqAAAAsg"]
[Wed Apr 29 13:09:57.125994 2026] [:error] [pid 61540:tid 61597] [client 65.108.78.33:38016] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afGSpeQ8cJB7pQslzIexqAAAAJg"]
[Wed Apr 29 13:09:59.750909 2026] [:error] [pid 61540:tid 61577] [client 65.108.78.33:38020] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afGSp-Q8cJB7pQslzIexvwAAAIQ"]
[Wed Apr 29 13:10:02.246378 2026] [:error] [pid 44806:tid 44832] [client 65.108.78.33:38036] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afGSqqv5rSisMqePk8UqcwAAAdg"]
[Wed Apr 29 13:10:04.712603 2026] [:error] [pid 44806:tid 44826] [client 65.108.78.33:5358] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afGSrKv5rSisMqePk8UqdgAAAdI"]
[Wed Apr 29 13:10:07.221619 2026] [:error] [pid 44806:tid 44815] [client 65.108.78.33:5374] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afGSr6v5rSisMqePk8UqegAAAcc"]
[Wed Apr 29 13:10:09.756324 2026] [:error] [pid 44806:tid 44829] [client 65.108.78.33:5384] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afGSsav5rSisMqePk8UqfgAAAdU"]
[Wed Apr 29 13:10:12.286456 2026] [:error] [pid 61540:tid 61574] [client 65.108.78.33:5394] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afGStOQ8cJB7pQslzIexxgAAAIE"]
[Wed Apr 29 13:10:14.783082 2026] [:error] [pid 45054:tid 45076] [client 65.108.78.33:10860] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afGStotL6SUL31r23c99FgAAApQ"]
[Wed Apr 29 13:10:17.404905 2026] [:error] [pid 2604:tid 2623] [client 65.108.78.33:10866] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afGSuRx5WQMU1W68tTYVbAAAAFE"]
[Wed Apr 29 13:10:47.296172 2026] [:error] [pid 61540:tid 61593] [client 65.108.78.33:26536] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afGS1-Q8cJB7pQslzIeybAAAAJQ"]
[Wed Apr 29 13:10:49.803688 2026] [:error] [pid 61540:tid 61590] [client 65.108.78.33:26542] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afGS2eQ8cJB7pQslzIeycgAAAJE"]
[Wed Apr 29 13:10:52.231480 2026] [:error] [pid 61540:tid 61597] [client 65.108.78.33:26548] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afGS3OQ8cJB7pQslzIeyeQAAAJg"]
[Wed Apr 29 13:10:54.316997 2026] [:error] [pid 45054:tid 45062] [client 65.108.78.33:16038] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afGS3otL6SUL31r23c99OwAAAoY"]
[Wed Apr 29 13:10:56.727074 2026] [:error] [pid 61540:tid 61575] [client 65.108.78.33:37440] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afGS4OQ8cJB7pQslzIeyfgAAAII"]
[Wed Apr 29 13:10:59.037349 2026] [:error] [pid 44860:tid 44880] [client 65.108.78.33:37456] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afGS40Q82el2g7ESJ15yJAAAAlI"]
[Wed Apr 29 13:11:01.098940 2026] [:error] [pid 61540:tid 61581] [client 65.108.78.33:16050] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afGS5eQ8cJB7pQslzIey6gAAAIg"]
[Wed Apr 29 13:11:03.638521 2026] [:error] [pid 44860:tid 44885] [client 65.108.78.33:14440] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afGS50Q82el2g7ESJ15yJwAAAlc"]
[Wed Apr 29 13:11:05.708374 2026] [:error] [pid 44860:tid 44881] [client 65.108.78.33:44890] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afGS6UQ82el2g7ESJ15yLAAAAlM"]
[Wed Apr 29 13:11:08.246203 2026] [:error] [pid 61540:tid 61589] [client 65.108.78.33:14454] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afGS7OQ8cJB7pQslzIey8AAAAJA"]
[Wed Apr 29 13:11:10.210376 2026] [:error] [pid 61540:tid 61592] [client 65.108.78.33:44906] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afGS7uQ8cJB7pQslzIey8wAAAJM"]
[Wed Apr 29 13:11:12.758623 2026] [:error] [pid 61540:tid 61578] [client 65.108.78.33:48022] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afGS8OQ8cJB7pQslzIey-gAAAIU"]
[Wed Apr 29 13:11:15.242058 2026] [:error] [pid 61540:tid 61593] [client 65.108.78.33:48032] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afGS8-Q8cJB7pQslzIezAAAAAJQ"]
[Wed Apr 29 13:11:17.740671 2026] [:error] [pid 45119:tid 45123] [client 65.108.78.33:48034] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afGS9cgCO5XKzjdJ_HYCKwAAAwI"]
[Wed Apr 29 13:11:20.207914 2026] [:error] [pid 61540:tid 61596] [client 65.108.78.33:48050] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afGS-OQ8cJB7pQslzIezCgAAAJc"]
[Wed Apr 29 13:11:22.118145 2026] [:error] [pid 61540:tid 61581] [client 65.108.78.33:5804] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afGS-uQ8cJB7pQslzIezDgAAAIg"]
[Wed Apr 29 13:11:24.673140 2026] [:error] [pid 61540:tid 61579] [client 65.108.78.33:18622] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afGS_OQ8cJB7pQslzIezEgAAAIY"]
[Wed Apr 29 13:11:26.725988 2026] [:error] [pid 2604:tid 2628] [client 65.108.78.33:5820] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afGS_hx5WQMU1W68tTYVvgAAAFY"]
[Wed Apr 29 13:11:29.254771 2026] [:error] [pid 44860:tid 44882] [client 65.108.78.33:18636] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afGTAUQ82el2g7ESJ15ySgAAAlQ"]
[Wed Apr 29 13:11:31.707703 2026] [:error] [pid 45085:tid 45093] [client 65.108.78.33:18646] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afGTA9S7eNjgd8gD6Zzh7gAAAsY"]
[Wed Apr 29 13:11:34.293090 2026] [:error] [pid 45054:tid 45077] [client 65.108.78.33:26762] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afGTBotL6SUL31r23c99iwAAApU"]
[Wed Apr 29 13:11:36.749613 2026] [:error] [pid 44860:tid 44865] [client 65.108.78.33:26770] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afGTCEQ82el2g7ESJ15yWwAAAkM"]
[Wed Apr 29 13:11:38.802045 2026] [:error] [pid 45054:tid 45074] [client 65.108.78.33:42468] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afGTCotL6SUL31r23c99mgAAApI"]
[Wed Apr 29 13:11:40.668073 2026] [:error] [pid 61540:tid 61577] [client 65.108.78.33:42470] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afGTDOQ8cJB7pQslzIezXwAAAIQ"]
[Wed Apr 29 13:11:42.680437 2026] [:error] [pid 22901:tid 22916] [client 65.108.78.33:21728] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afGTDhvfVEXI-f42iRRFhAAAAQ0"]
[Wed Apr 29 13:19:41.019368 2026] [:error] [pid 61540:tid 61591] [client 147.135.252.145:59764] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afGU7eQ8cJB7pQslzIe1ewAAAJI"]
[Wed Apr 29 13:19:43.173118 2026] [:error] [pid 45085:tid 45107] [client 147.135.252.145:41458] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afGU79S7eNjgd8gD6Zzi3AAAAtQ"]
[Wed Apr 29 13:19:56.833460 2026] [:error] [pid 45054:tid 45071] [client 147.135.252.145:47872] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afGU_ItL6SUL31r23c9-6QAAAo8"]
[Wed Apr 29 13:19:58.827857 2026] [:error] [pid 61628:tid 61643] [client 147.135.252.145:47874] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afGU_vXzdLVcrP-YPZg4rAAAAMo"]
[Wed Apr 29 13:20:00.845147 2026] [:error] [pid 61628:tid 61648] [client 147.135.252.145:54048] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afGVAPXzdLVcrP-YPZg4rQAAAM8"]
[Wed Apr 29 13:20:03.065133 2026] [:error] [pid 45119:tid 45143] [client 147.135.252.145:54056] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afGVA8gCO5XKzjdJ_HYC4QAAAxY"]
[Wed Apr 29 13:20:05.283897 2026] [:error] [pid 61628:tid 61635] [client 147.135.252.145:54072] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afGVBfXzdLVcrP-YPZg4sAAAAMI"]
[Wed Apr 29 13:20:07.382391 2026] [:error] [pid 45119:tid 45123] [client 147.135.252.145:54082] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afGVB8gCO5XKzjdJ_HYC4wAAAwI"]
[Wed Apr 29 13:20:09.408980 2026] [:error] [pid 45085:tid 45101] [client 147.135.252.145:54096] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afGVCdS7eNjgd8gD6Zzi4AAAAs4"]
[Wed Apr 29 13:20:11.433824 2026] [:error] [pid 45119:tid 45130] [client 147.135.252.145:53480] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afGVC8gCO5XKzjdJ_HYC5wAAAwk"]
[Wed Apr 29 13:20:13.645164 2026] [:error] [pid 22901:tid 22917] [client 147.135.252.145:53496] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afGVDRvfVEXI-f42iRRF6AAAAQ4"]
[Wed Apr 29 13:20:15.902626 2026] [:error] [pid 22901:tid 22903] [client 147.135.252.145:53500] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afGVDxvfVEXI-f42iRRF6QAAAQA"]
[Wed Apr 29 13:20:18.753159 2026] [:error] [pid 61540:tid 61583] [client 147.135.252.145:36540] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afGVEuQ8cJB7pQslzIe1igAAAIo"]
[Wed Apr 29 13:20:21.150081 2026] [:error] [pid 44860:tid 44867] [client 147.135.252.145:52682] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afGVFUQ82el2g7ESJ15zygAAAkU"]
[Wed Apr 29 13:20:23.766465 2026] [:error] [pid 45289:tid 45306] [client 147.135.252.145:54508] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afGVF1_vGmZY7dOOIwrGjAAAA44"]
[Wed Apr 29 13:20:26.518956 2026] [:error] [pid 45054:tid 45078] [client 147.135.252.145:54520] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afGVGotL6SUL31r23c9-8QAAApY"]
[Wed Apr 29 13:20:28.545436 2026] [:error] [pid 45054:tid 45066] [client 147.135.252.145:52698] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afGVHItL6SUL31r23c9-9QAAAoo"]
[Wed Apr 29 13:20:31.327345 2026] [:error] [pid 45054:tid 45080] [client 147.135.252.145:48658] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afGVH4tL6SUL31r23c9_BgAAApg"]
[Wed Apr 29 13:20:34.526512 2026] [:error] [pid 61540:tid 61584] [client 147.135.252.145:48668] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afGVIuQ8cJB7pQslzIe1pgAAAIs"]
[Wed Apr 29 13:20:37.648982 2026] [:error] [pid 22901:tid 22922] [client 147.135.252.145:48670] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afGVJRvfVEXI-f42iRRF7AAAARM"]
[Wed Apr 29 13:21:03.813562 2026] [:error] [pid 45289:tid 45315] [client 147.135.252.145:34324] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afGVP1_vGmZY7dOOIwrGlQAAA5c"]
[Wed Apr 29 13:21:05.777293 2026] [:error] [pid 45119:tid 45128] [client 147.135.252.145:36336] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afGVQcgCO5XKzjdJ_HYC8QAAAwc"]
[Wed Apr 29 13:21:08.051462 2026] [:error] [pid 44860:tid 44879] [client 147.135.252.145:36350] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afGVREQ82el2g7ESJ15z7AAAAlE"]
[Wed Apr 29 13:21:10.245305 2026] [:error] [pid 44860:tid 44865] [client 147.135.252.145:36352] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afGVRkQ82el2g7ESJ15z7gAAAkM"]
[Wed Apr 29 13:21:12.361211 2026] [:error] [pid 45119:tid 45137] [client 147.135.252.145:58870] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afGVSMgCO5XKzjdJ_HYC8gAAAxA"]
[Wed Apr 29 13:21:14.303186 2026] [:error] [pid 44860:tid 44869] [client 147.135.252.145:58878] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afGVSkQ82el2g7ESJ15z8QAAAkc"]
[Wed Apr 29 13:21:16.520456 2026] [:error] [pid 44860:tid 44886] [client 147.135.252.145:58884] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afGVTEQ82el2g7ESJ15z8gAAAlg"]
[Wed Apr 29 13:21:18.969587 2026] [:error] [pid 45085:tid 45102] [client 147.135.252.145:58892] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afGVTtS7eNjgd8gD6ZzjGAAAAs8"]
[Wed Apr 29 13:21:21.167800 2026] [:error] [pid 45085:tid 45095] [client 147.135.252.145:38982] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afGVUdS7eNjgd8gD6ZzjGgAAAsg"]
[Wed Apr 29 13:21:23.320478 2026] [:error] [pid 45085:tid 45093] [client 147.135.252.145:38992] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afGVU9S7eNjgd8gD6ZzjGwAAAsY"]
[Wed Apr 29 13:21:26.243137 2026] [:error] [pid 45085:tid 45088] [client 147.135.252.145:46438] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afGVVtS7eNjgd8gD6ZzjHQAAAsE"]
[Wed Apr 29 13:21:28.350201 2026] [:error] [pid 61540:tid 61590] [client 147.135.252.145:39004] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afGVWOQ8cJB7pQslzIe2GwAAAJE"]
[Wed Apr 29 13:21:30.427533 2026] [:error] [pid 22901:tid 22913] [client 147.135.252.145:39020] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afGVWhvfVEXI-f42iRRF9gAAAQo"]
[Wed Apr 29 13:21:33.689171 2026] [:error] [pid 44860:tid 44862] [client 147.135.252.145:53382] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afGVXUQ82el2g7ESJ15z9gAAAkA"]
[Wed Apr 29 13:21:36.438732 2026] [:error] [pid 45085:tid 45092] [client 147.135.252.145:53390] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afGVYNS7eNjgd8gD6ZzjIQAAAsU"]
[Wed Apr 29 13:21:40.599438 2026] [:error] [pid 2604:tid 2614] [client 147.135.252.145:53404] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afGVZBx5WQMU1W68tTYWZwAAAEg"]
[Wed Apr 29 13:21:44.639481 2026] [:error] [pid 61540:tid 61581] [client 147.135.252.145:37918] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afGVaOQ8cJB7pQslzIe2IQAAAIg"]
[Wed Apr 29 14:04:04.300532 2026] [:error] [pid 44766:tid 44792] [client 65.108.78.33:54804] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afGfVKVI9GtM_JyauAIw5QAAAZg"]
[Wed Apr 29 14:04:06.788026 2026] [:error] [pid 2604:tid 2623] [client 65.108.78.33:54816] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afGfVhx5WQMU1W68tTYZfQAAAFE"]
[Wed Apr 29 14:04:08.618702 2026] [:error] [pid 45054:tid 45078] [client 65.108.78.33:42544] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afGfWItL6SUL31r23c-GuQAAApY"]
[Wed Apr 29 14:04:11.058770 2026] [:error] [pid 44860:tid 44866] [client 65.108.78.33:54842] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afGfW0Q82el2g7ESJ155OwAAAkQ"]
[Wed Apr 29 14:04:12.949119 2026] [:error] [pid 22901:tid 22904] [client 65.108.78.33:40000] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afGfXBvfVEXI-f42iRRIKwAAAQE"]
[Wed Apr 29 14:04:15.529748 2026] [:error] [pid 2604:tid 2628] [client 65.108.78.33:20762] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afGfXxx5WQMU1W68tTYZhAAAAFY"]
[Wed Apr 29 14:04:18.053366 2026] [:error] [pid 61540:tid 61575] [client 65.108.78.33:20770] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afGfYuQ8cJB7pQslzIfCOwAAAII"]
[Wed Apr 29 14:04:19.989746 2026] [:error] [pid 61540:tid 61585] [client 65.108.78.33:40002] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afGfY-Q8cJB7pQslzIfCPQAAAIw"]
[Wed Apr 29 14:04:31.571695 2026] [:error] [pid 45054:tid 45059] [client 65.108.78.33:40176] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afGfb4tL6SUL31r23c-GyAAAAoM"]
[Wed Apr 29 14:04:34.008052 2026] [:error] [pid 61540:tid 61597] [client 65.108.78.33:3498] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afGfcuQ8cJB7pQslzIfCSAAAAJg"]
[Wed Apr 29 14:04:36.468986 2026] [:error] [pid 44860:tid 44866] [client 65.108.78.33:3500] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afGfdEQ82el2g7ESJ155SgAAAkQ"]
[Wed Apr 29 14:04:39.120302 2026] [:error] [pid 2604:tid 2624] [client 65.108.78.33:3514] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afGfdxx5WQMU1W68tTYZjgAAAFI"]
[Wed Apr 29 14:04:41.871232 2026] [:error] [pid 45289:tid 45295] [client 65.108.78.33:3528] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afGfeV_vGmZY7dOOIwrHuAAAA4M"]
[Wed Apr 29 14:04:44.423463 2026] [:error] [pid 61628:tid 61649] [client 65.108.78.33:51896] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afGffPXzdLVcrP-YPZg6aAAAANA"]
[Wed Apr 29 14:04:46.951232 2026] [:error] [pid 45054:tid 45080] [client 65.108.78.33:51902] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afGffotL6SUL31r23c-G1QAAApg"]
[Wed Apr 29 14:04:49.366099 2026] [:error] [pid 45054:tid 45076] [client 65.108.78.33:51916] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afGfgYtL6SUL31r23c-G2AAAApQ"]
[Wed Apr 29 14:04:51.882099 2026] [:error] [pid 45085:tid 45103] [client 65.108.78.33:51918] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afGfg9S7eNjgd8gD6ZzoXwAAAtA"]
[Wed Apr 29 14:04:54.263514 2026] [:error] [pid 2604:tid 2618] [client 65.108.78.33:59746] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afGfhhx5WQMU1W68tTYZlwAAAEw"]
[Wed Apr 29 14:04:56.818497 2026] [:error] [pid 2604:tid 2629] [client 65.108.78.33:59754] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afGfiBx5WQMU1W68tTYZnwAAAFc"]
[Wed Apr 29 14:04:59.147264 2026] [:error] [pid 45085:tid 45104] [client 65.108.78.33:59760] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afGfi9S7eNjgd8gD6ZzoYwAAAtE"]
[Wed Apr 29 14:05:29.432629 2026] [:error] [pid 45054:tid 45076] [client 65.108.78.33:54608] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afGfqYtL6SUL31r23c-G6AAAApQ"]
[Wed Apr 29 14:05:31.999171 2026] [:error] [pid 44860:tid 44876] [client 65.108.78.33:54612] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afGfq0Q82el2g7ESJ155agAAAk4"]
[Wed Apr 29 14:05:34.510863 2026] [:error] [pid 44860:tid 44883] [client 65.108.78.33:48404] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afGfrkQ82el2g7ESJ155bgAAAlU"]
[Wed Apr 29 14:05:37.070675 2026] [:error] [pid 61540:tid 61579] [client 65.108.78.33:48416] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afGfseQ8cJB7pQslzIfCZQAAAIY"]
[Wed Apr 29 14:05:39.550603 2026] [:error] [pid 2604:tid 2619] [client 65.108.78.33:48422] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afGfsxx5WQMU1W68tTYZrQAAAE0"]
[Wed Apr 29 14:05:41.983888 2026] [:error] [pid 2604:tid 2606] [client 65.108.78.33:48426] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afGftRx5WQMU1W68tTYZrwAAAEA"]
[Wed Apr 29 14:05:44.483897 2026] [:error] [pid 2604:tid 2620] [client 65.108.78.33:60254] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afGfuBx5WQMU1W68tTYZtAAAAE4"]
[Wed Apr 29 14:05:46.509521 2026] [:error] [pid 44766:tid 44778] [client 65.108.78.33:12712] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afGfuqVI9GtM_JyauAIw_AAAAYo"]
[Wed Apr 29 14:05:49.160339 2026] [:error] [pid 45289:tid 45304] [client 65.108.78.33:60266] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afGfvV_vGmZY7dOOIwrHwwAAA4w"]
[Wed Apr 29 14:05:51.778636 2026] [:error] [pid 45119:tid 45135] [client 65.108.78.33:60278] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afGfv8gCO5XKzjdJ_HYFiQAAAw4"]
[Wed Apr 29 14:05:53.775539 2026] [:error] [pid 22901:tid 22919] [client 65.108.78.33:29412] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afGfwRvfVEXI-f42iRRIPAAAARA"]
[Wed Apr 29 14:05:56.323239 2026] [:error] [pid 45054:tid 45061] [client 65.108.78.33:9546] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afGfxItL6SUL31r23c-G7QAAAoU"]
[Wed Apr 29 14:05:58.245675 2026] [:error] [pid 2604:tid 2630] [client 65.108.78.33:29418] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afGfxhx5WQMU1W68tTYZvQAAAFg"]
[Wed Apr 29 14:06:00.677979 2026] [:error] [pid 2604:tid 2626] [client 65.108.78.33:9550] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afGfyBx5WQMU1W68tTYZwQAAAFQ"]
[Wed Apr 29 14:06:02.690250 2026] [:error] [pid 45054:tid 45058] [client 65.108.78.33:36350] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afGfyotL6SUL31r23c-G7wAAAoI"]
[Wed Apr 29 14:06:05.312148 2026] [:error] [pid 44860:tid 44878] [client 65.108.78.33:51060] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afGfzUQ82el2g7ESJ155dAAAAlA"]
[Wed Apr 29 14:06:07.837359 2026] [:error] [pid 44860:tid 44867] [client 65.108.78.33:51064] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afGfz0Q82el2g7ESJ155dgAAAkU"]
[Wed Apr 29 14:06:10.398083 2026] [:error] [pid 45054:tid 45070] [client 65.108.78.33:51066] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afGf0otL6SUL31r23c-G8wAAAo4"]
[Wed Apr 29 14:06:12.941544 2026] [:error] [pid 45054:tid 45078] [client 65.108.78.33:61866] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afGf1ItL6SUL31r23c-G9AAAApY"]
[Wed Apr 29 14:06:14.792272 2026] [:error] [pid 22901:tid 22919] [client 65.108.78.33:5958] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afGf1hvfVEXI-f42iRRIRwAAARA"]
[Wed Apr 29 14:06:17.239726 2026] [:error] [pid 61628:tid 61652] [client 65.108.78.33:61880] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afGf2fXzdLVcrP-YPZg6dAAAANM"]
[Wed Apr 29 14:06:19.241305 2026] [:error] [pid 45054:tid 45074] [client 65.108.78.33:5964] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afGf24tL6SUL31r23c-G9wAAApI"]
[Wed Apr 29 14:06:21.729934 2026] [:error] [pid 44766:tid 44780] [client 65.108.78.33:61882] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afGf3aVI9GtM_JyauAIxBAAAAYw"]
[Wed Apr 29 14:06:24.164767 2026] [:error] [pid 45054:tid 45061] [client 65.108.78.33:18474] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afGf4ItL6SUL31r23c-G_QAAAoU"]
[Wed Apr 29 14:06:51.336896 2026] [:error] [pid 45054:tid 45077] [client 65.108.78.33:30674] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "afGf-4tL6SUL31r23c-HuAAAApU"]
[Wed Apr 29 14:06:53.317759 2026] [:error] [pid 45054:tid 45068] [client 65.108.78.33:8652] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afGf_YtL6SUL31r23c-HuwAAAow"]
[Wed Apr 29 14:06:55.346268 2026] [:error] [pid 45085:tid 45105] [client 65.108.78.33:8654] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afGf_9S7eNjgd8gD6ZzougAAAtI"]
[Wed Apr 29 14:06:57.174760 2026] [:error] [pid 45085:tid 45091] [client 65.108.78.33:8664] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afGgAdS7eNjgd8gD6ZzovAAAAsQ"]
[Wed Apr 29 14:14:55.309013 2026] [:error] [pid 44860:tid 44866] [client 43.134.177.47:50362] [client 43.134.177.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afGh30Q82el2g7ESJ156TgAAAkQ"]
[Wed Apr 29 14:38:29.125669 2026] [:error] [pid 45085:tid 45089] [client 217.182.195.181:44490] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afGnZdS7eNjgd8gD6ZzrMgAAAsI"]
[Wed Apr 29 14:38:31.448966 2026] [:error] [pid 61540:tid 61595] [client 217.182.195.181:34500] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afGnZ-Q8cJB7pQslzIfHdwAAAJY"]
[Wed Apr 29 14:38:33.832429 2026] [:error] [pid 61628:tid 61657] [client 217.182.195.181:34502] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afGnafXzdLVcrP-YPZg7rwAAANg"]
[Wed Apr 29 14:38:36.328999 2026] [:error] [pid 44860:tid 44886] [client 217.182.195.181:53520] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afGnbEQ82el2g7ESJ159WQAAAlg"]
[Wed Apr 29 14:38:39.993941 2026] [:error] [pid 2604:tid 2607] [client 217.182.195.181:52466] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afGnbxx5WQMU1W68tTYcDwAAAEE"]
[Wed Apr 29 15:39:00.332938 2026] [:error] [pid 45119:tid 45127] [client 45.119.85.39:51614] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "afG1lMgCO5XKzjdJ_HYOEgAAAwY"], referer: https://www.google.com
[Wed Apr 29 15:39:00.333025 2026] [:error] [pid 45119:tid 45127] [client 45.119.85.39:51614] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 158"] [hostname "switchcreative.net"] [uri "/wordpress/wp-login.php"] [unique_id "afG1lMgCO5XKzjdJ_HYOEgAAAwY"], referer: https://www.google.com
[Wed Apr 29 16:25:57.919694 2026] [:error] [pid 22901:tid 22913] [client 147.135.252.145:60520] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afHAlRvfVEXI-f42iRRTbQAAAQo"]
[Wed Apr 29 16:26:00.126189 2026] [:error] [pid 45085:tid 45109] [client 147.135.252.145:42436] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afHAmNS7eNjgd8gD6Zz8pQAAAtY"]
[Wed Apr 29 16:26:02.509594 2026] [:error] [pid 44766:tid 44774] [client 147.135.252.145:33404] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afHAmqVI9GtM_JyauAI6HQAAAYY"]
[Wed Apr 29 16:26:05.053682 2026] [:error] [pid 61540:tid 61582] [client 147.135.252.145:54682] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afHAneQ8cJB7pQslzIfbCgAAAIk"]
[Wed Apr 29 16:26:07.224635 2026] [:error] [pid 45054:tid 45063] [client 147.135.252.145:33412] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afHAn4tL6SUL31r23c-t_wAAAoc"]
[Wed Apr 29 16:26:09.871499 2026] [:error] [pid 45085:tid 45111] [client 147.135.252.145:54692] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afHAodS7eNjgd8gD6Zz8uwAAAtg"]
[Wed Apr 29 16:26:12.157652 2026] [:error] [pid 44860:tid 44875] [client 147.135.252.145:38144] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afHApEQ82el2g7ESJ16M5QAAAk0"]
[Wed Apr 29 16:26:14.988773 2026] [:error] [pid 44860:tid 44886] [client 147.135.252.145:48906] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afHApkQ82el2g7ESJ16M6AAAAlg"]
[Wed Apr 29 16:26:17.651950 2026] [:error] [pid 61540:tid 61580] [client 147.135.252.145:48916] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afHAqeQ8cJB7pQslzIfbDgAAAIc"]
[Wed Apr 29 16:26:19.948626 2026] [:error] [pid 45054:tid 45058] [client 147.135.252.145:38146] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afHAq4tL6SUL31r23c-uBQAAAoI"]
[Wed Apr 29 16:26:22.248189 2026] [:error] [pid 44766:tid 44773] [client 147.135.252.145:49196] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afHArqVI9GtM_JyauAI6IgAAAYU"]
[Wed Apr 29 16:26:24.304636 2026] [:error] [pid 45085:tid 45091] [client 147.135.252.145:49200] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afHAsNS7eNjgd8gD6Zz8wQAAAsQ"]
[Wed Apr 29 16:26:26.548109 2026] [:error] [pid 45085:tid 45094] [client 147.135.252.145:49202] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afHAstS7eNjgd8gD6Zz8xwAAAsc"]
[Wed Apr 29 16:26:29.568630 2026] [:error] [pid 44860:tid 44867] [client 147.135.252.145:59672] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afHAtUQ82el2g7ESJ16M7AAAAkU"]
[Wed Apr 29 16:26:32.557902 2026] [:error] [pid 45085:tid 45102] [client 147.135.252.145:57010] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afHAuNS7eNjgd8gD6Zz8zQAAAs8"]
[Wed Apr 29 16:26:36.017168 2026] [:error] [pid 45085:tid 45109] [client 147.135.252.145:35194] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afHAvNS7eNjgd8gD6Zz80wAAAtY"]
[Wed Apr 29 16:26:40.303786 2026] [:error] [pid 22901:tid 22908] [client 147.135.252.145:35196] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afHAwBvfVEXI-f42iRRTfgAAAQU"]
[Wed Apr 29 18:36:39.910724 2026] [:error] [pid 61540:tid 61581] [client 178.151.245.162:35786] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afHfN-Q8cJB7pQslzIfqPQAAAIg"]
[Wed Apr 29 18:36:41.781738 2026] [:error] [pid 45054:tid 45061] [client 178.151.245.162:42330] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afHfOYtL6SUL31r23c_KJwAAAoU"]
[Wed Apr 29 18:36:43.719169 2026] [:error] [pid 45054:tid 45069] [client 178.151.245.162:33410] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afHfO4tL6SUL31r23c_KOQAAAo0"]
[Wed Apr 29 18:36:45.845589 2026] [:error] [pid 45054:tid 45071] [client 178.151.245.162:33416] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afHfPYtL6SUL31r23c_KSQAAAo8"]
[Wed Apr 29 18:36:47.900415 2026] [:error] [pid 44860:tid 44882] [client 178.151.245.162:33426] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afHfP0Q82el2g7ESJ16ZtQAAAlQ"]
[Wed Apr 29 18:36:50.393314 2026] [:error] [pid 45054:tid 45067] [client 178.151.245.162:42956] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afHfQotL6SUL31r23c_KkwAAAos"]
[Wed Apr 29 18:36:52.362985 2026] [:error] [pid 45085:tid 45107] [client 178.151.245.162:33434] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afHfRNS7eNjgd8gD6ZwRKAAAAtQ"]
[Wed Apr 29 18:36:54.444460 2026] [:error] [pid 45085:tid 45098] [client 178.151.245.162:46984] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afHfRtS7eNjgd8gD6ZwRLwAAAss"]
[Wed Apr 29 18:36:57.119629 2026] [:error] [pid 44860:tid 44869] [client 178.151.245.162:53780] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afHfSUQ82el2g7ESJ16ZzQAAAkc"]
[Wed Apr 29 18:36:59.137410 2026] [:error] [pid 45085:tid 45106] [client 178.151.245.162:46986] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afHfS9S7eNjgd8gD6ZwRNAAAAtM"]
[Wed Apr 29 18:37:01.199655 2026] [:error] [pid 45054:tid 45056] [client 178.151.245.162:46992] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afHfTYtL6SUL31r23c_LEAAAAoA"]
[Wed Apr 29 18:37:03.085702 2026] [:error] [pid 45054:tid 45057] [client 178.151.245.162:47004] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afHfT4tL6SUL31r23c_LFAAAAoE"]
[Wed Apr 29 18:37:05.205316 2026] [:error] [pid 61540:tid 61589] [client 178.151.245.162:34810] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afHfUeQ8cJB7pQslzIfqWAAAAJA"]
[Wed Apr 29 18:37:07.281285 2026] [:error] [pid 45054:tid 45073] [client 178.151.245.162:34812] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afHfU4tL6SUL31r23c_LGgAAApE"]
[Wed Apr 29 18:37:09.208107 2026] [:error] [pid 45085:tid 45092] [client 178.151.245.162:34828] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afHfVdS7eNjgd8gD6ZwRPQAAAsU"]
[Wed Apr 29 18:37:11.683070 2026] [:error] [pid 61540:tid 61580] [client 178.151.245.162:51018] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afHfV-Q8cJB7pQslzIfqWQAAAIc"]
[Wed Apr 29 18:37:13.817489 2026] [:error] [pid 45085:tid 45109] [client 178.151.245.162:55752] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afHfWdS7eNjgd8gD6ZwRQQAAAtY"]
[Wed Apr 29 18:37:16.306110 2026] [:error] [pid 45054:tid 45069] [client 178.151.245.162:40724] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afHfXItL6SUL31r23c_LLQAAAo0"]
[Wed Apr 29 18:37:18.177748 2026] [:error] [pid 45054:tid 45064] [client 178.151.245.162:55764] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afHfXotL6SUL31r23c_LLgAAAog"]
[Wed Apr 29 18:37:20.250277 2026] [:error] [pid 45054:tid 45061] [client 178.151.245.162:55772] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afHfYItL6SUL31r23c_LNQAAAoU"]
[Wed Apr 29 18:37:22.874867 2026] [:error] [pid 61540:tid 61585] [client 178.151.245.162:40736] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afHfYuQ8cJB7pQslzIfqagAAAIw"]
[Wed Apr 29 18:37:25.374307 2026] [:error] [pid 22901:tid 22909] [client 178.151.245.162:40002] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afHfZRvfVEXI-f42iRRZ6gAAAQY"]
[Wed Apr 29 18:37:28.101246 2026] [:error] [pid 44766:tid 44771] [client 178.151.245.162:40012] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afHfaKVI9GtM_JyauAI_qwAAAYM"]
[Wed Apr 29 18:37:30.626389 2026] [:error] [pid 61540:tid 61575] [client 178.151.245.162:40018] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afHfauQ8cJB7pQslzIfqcgAAAII"]
[Wed Apr 29 18:37:33.158698 2026] [:error] [pid 44860:tid 44873] [client 178.151.245.162:40032] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afHfbUQ82el2g7ESJ16Z4QAAAks"]
[Wed Apr 29 18:37:35.641897 2026] [:error] [pid 44766:tid 44783] [client 178.151.245.162:57392] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afHfb6VI9GtM_JyauAI_rgAAAY8"]
[Wed Apr 29 18:37:37.487990 2026] [:error] [pid 45289:tid 45308] [client 178.151.245.162:38904] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afHfcV_vGmZY7dOOIwrQ2gAAA5A"]
[Wed Apr 29 18:37:59.387371 2026] [:error] [pid 45054:tid 45074] [client 178.151.245.162:43684] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afHfh4tL6SUL31r23c_LagAAApI"]
[Wed Apr 29 18:38:01.076715 2026] [:error] [pid 45085:tid 45097] [client 178.151.245.162:57406] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afHfidS7eNjgd8gD6ZwRcwAAAso"]
[Wed Apr 29 18:38:02.908362 2026] [:error] [pid 45119:tid 45142] [client 178.151.245.162:43692] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afHfisgCO5XKzjdJ_HYY1wAAAxU"]
[Wed Apr 29 18:38:05.368767 2026] [:error] [pid 61540:tid 61584] [client 178.151.245.162:39428] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afHfjeQ8cJB7pQslzIfqdgAAAIs"]
[Wed Apr 29 18:38:07.303947 2026] [:error] [pid 45085:tid 45107] [client 178.151.245.162:46478] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afHfj9S7eNjgd8gD6ZwRfgAAAtQ"]
[Wed Apr 29 18:38:09.797491 2026] [:error] [pid 44860:tid 44866] [client 178.151.245.162:39432] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afHfkUQ82el2g7ESJ16aEAAAAkQ"]
[Wed Apr 29 18:38:11.815423 2026] [:error] [pid 45289:tid 45298] [client 178.151.245.162:46492] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afHfk1_vGmZY7dOOIwrQ6AAAA4Y"]
[Wed Apr 29 18:38:14.446562 2026] [:error] [pid 45054:tid 45067] [client 178.151.245.162:37282] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afHflotL6SUL31r23c_LeAAAAos"]
[Wed Apr 29 18:38:16.579984 2026] [:error] [pid 45085:tid 45102] [client 178.151.245.162:54340] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afHfmNS7eNjgd8gD6ZwRjQAAAs8"]
[Wed Apr 29 18:38:19.071320 2026] [:error] [pid 44860:tid 44863] [client 178.151.245.162:37292] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afHfm0Q82el2g7ESJ16aHgAAAkE"]
[Wed Apr 29 18:38:21.622546 2026] [:error] [pid 45085:tid 45097] [client 178.151.245.162:37296] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afHfndS7eNjgd8gD6ZwRmwAAAso"]
[Wed Apr 29 18:38:23.827300 2026] [:error] [pid 45054:tid 45064] [client 178.151.245.162:46320] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afHfn4tL6SUL31r23c_LggAAAog"]
[Wed Apr 29 18:38:26.240306 2026] [:error] [pid 45054:tid 45078] [client 178.151.245.162:34694] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afHfootL6SUL31r23c_LkQAAApY"]
[Wed Apr 29 18:38:28.330139 2026] [:error] [pid 61628:tid 61645] [client 178.151.245.162:46336] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afHfpPXzdLVcrP-YPZhGFwAAAMw"]
[Wed Apr 29 18:38:30.762521 2026] [:error] [pid 45054:tid 45077] [client 178.151.245.162:34708] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afHfpotL6SUL31r23c_LkwAAApU"]
[Wed Apr 29 18:38:32.707013 2026] [:error] [pid 45054:tid 45080] [client 178.151.245.162:46350] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afHfqItL6SUL31r23c_LlAAAApg"]
[Wed Apr 29 18:38:35.207611 2026] [:error] [pid 44766:tid 44790] [client 178.151.245.162:45616] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afHfq6VI9GtM_JyauAI_2gAAAZY"]
[Wed Apr 29 18:38:37.315104 2026] [:error] [pid 2604:tid 2609] [client 178.151.245.162:52756] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afHfrRx5WQMU1W68tTYxRQAAAEM"]
[Wed Apr 29 18:38:39.371298 2026] [:error] [pid 45054:tid 45058] [client 178.151.245.162:52764] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afHfr4tL6SUL31r23c_LmAAAAoI"]
[Wed Apr 29 18:38:41.272702 2026] [:error] [pid 45119:tid 45127] [client 178.151.245.162:52772] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afHfscgCO5XKzjdJ_HYY4QAAAwY"]
[Wed Apr 29 18:38:43.183139 2026] [:error] [pid 45054:tid 45078] [client 178.151.245.162:52780] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afHfs4tL6SUL31r23c_LmgAAApY"]
[Wed Apr 29 18:38:45.612106 2026] [:error] [pid 45054:tid 45069] [client 178.151.245.162:33538] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afHftYtL6SUL31r23c_LoQAAAo0"]
[Wed Apr 29 18:38:48.120094 2026] [:error] [pid 44766:tid 44770] [client 178.151.245.162:33554] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afHfuKVI9GtM_JyauAI_3AAAAYI"]
[Wed Apr 29 18:38:50.048839 2026] [:error] [pid 44860:tid 44879] [client 178.151.245.162:44816] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afHfukQ82el2g7ESJ16aQwAAAlE"]
[Wed Apr 29 18:38:53.844302 2026] [:error] [pid 44766:tid 44782] [client 178.151.245.162:59838] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afHfvaVI9GtM_JyauAI_3gAAAY4"]
[Wed Apr 29 20:30:52.932170 2026] [:error] [pid 21227:tid 21233] [client 49.51.233.46:53250] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afH5_MB3c6U5AGPPsXqFgwAAAMA"]
[Wed Apr 29 21:40:08.781642 2026] [:error] [pid 21138:tid 21220] [client 111.230.233.46:48116] [client 111.230.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afIKOJuzwUiyMeUnp33uAgAAARc"]
[Wed Apr 29 23:00:11.672873 2026] [:error] [pid 21138:tid 21215] [client 34.75.233.62:40100] [client 34.75.233.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "afIc-5uzwUiyMeUnp30GNQAAARI"]
[Wed Apr 29 23:22:09.606485 2026] [proxy_fcgi:error] [pid 21137:tid 21172] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:09.865644 2026] [proxy_fcgi:error] [pid 21137:tid 21192] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:10.124649 2026] [proxy_fcgi:error] [pid 21137:tid 21170] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:10.383754 2026] [proxy_fcgi:error] [pid 21137:tid 21187] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:10.643229 2026] [proxy_fcgi:error] [pid 21137:tid 21182] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:10.902313 2026] [proxy_fcgi:error] [pid 21137:tid 21185] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:11.161556 2026] [proxy_fcgi:error] [pid 21137:tid 21173] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:11.420634 2026] [proxy_fcgi:error] [pid 21137:tid 21186] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:11.680295 2026] [proxy_fcgi:error] [pid 21137:tid 21178] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:11.952324 2026] [proxy_fcgi:error] [pid 21137:tid 21189] [client 20.215.248.255:1516] AH01071: Got error 'Primary script unknown'
[Wed Apr 29 23:22:12.472551 2026] [:error] [pid 21137:tid 21175] [client 20.215.248.255:1516] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afIiJPw-HnaioFPIurV31wAAAAY"]
[Wed Apr 29 23:22:13.497416 2026] [:error] [pid 21536:tid 21559] [client 20.215.248.255:1502] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afIiJSREaVkH9P5H_LQ4CAAAAJU"]
[Wed Apr 29 23:22:14.529807 2026] [:error] [pid 47618:tid 47633] [client 20.215.248.255:31355] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afIiJnHYUSxIrhce2OA2VAAAAUw"]
[Wed Apr 29 23:22:15.764925 2026] [:error] [pid 21137:tid 21173] [client 20.215.248.255:31358] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afIiJ_w-HnaioFPIurV33QAAAAQ"]
[Thu Apr 30 02:15:48.213665 2026] [:error] [pid 21137:tid 21190] [client 43.166.7.113:60210] [client 43.166.7.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afJK1Pw-HnaioFPIurWecQAAABU"]
[Thu Apr 30 02:23:06.877441 2026] [:error] [pid 21136:tid 21161] [client 37.187.226.31:33808] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afJMiilIfGGQdPVv8_MErAAAAFQ"]
[Thu Apr 30 02:23:08.952297 2026] [:error] [pid 21137:tid 21192] [client 37.187.226.31:33816] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afJMjPw-HnaioFPIurWf2QAAABc"]
[Thu Apr 30 02:23:10.910962 2026] [:error] [pid 21137:tid 21193] [client 37.187.226.31:33822] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afJMjvw-HnaioFPIurWf2wAAABg"]
[Thu Apr 30 02:23:12.803670 2026] [:error] [pid 21137:tid 21173] [client 37.187.226.31:37264] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afJMkPw-HnaioFPIurWf3QAAAAQ"]
[Thu Apr 30 02:23:14.704469 2026] [:error] [pid 21137:tid 21169] [client 37.187.226.31:37274] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afJMkvw-HnaioFPIurWf4AAAAAA"]
[Thu Apr 30 02:23:16.986736 2026] [:error] [pid 21137:tid 21192] [client 37.187.226.31:37282] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afJMlPw-HnaioFPIurWf5gAAABc"]
[Thu Apr 30 02:23:20.851637 2026] [:error] [pid 21536:tid 21542] [client 37.187.226.31:37290] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afJMmCREaVkH9P5H_LRO7gAAAIQ"]
[Thu Apr 30 02:30:53.624927 2026] [:error] [pid 21138:tid 21208] [client 94.103.81.20:47090] [client 94.103.81.20] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afJOXZuzwUiyMeUnp31FlgAAAQs"]
[Thu Apr 30 03:40:26.271225 2026] [:error] [pid 15354:tid 15392] [client 43.135.133.241:44974] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afJeqqC0nN78bCDAO3c5vQAAAME"]
[Thu Apr 30 06:20:39.315931 2026] [proxy_fcgi:error] [pid 18113:tid 18197] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:39.599855 2026] [proxy_fcgi:error] [pid 18113:tid 18190] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:39.884760 2026] [proxy_fcgi:error] [pid 18113:tid 18181] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:40.169635 2026] [proxy_fcgi:error] [pid 18113:tid 18191] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:40.738111 2026] [proxy_fcgi:error] [pid 18113:tid 18189] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:41.024377 2026] [proxy_fcgi:error] [pid 18113:tid 18178] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:41.308703 2026] [proxy_fcgi:error] [pid 18113:tid 18182] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:41.597632 2026] [proxy_fcgi:error] [pid 18113:tid 18194] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:41.883728 2026] [proxy_fcgi:error] [pid 18113:tid 18177] [client 20.215.248.255:1214] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 06:20:42.163294 2026] [:error] [pid 18113:tid 18198] [client 20.215.248.255:1214] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afKEOniIjwsVGkvz5IlVbgAAAJU"]
[Thu Apr 30 06:20:43.214741 2026] [:error] [pid 52350:tid 52364] [client 20.215.248.255:18148] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afKEO_1j4GHE9hm7bfc-rAAAAQY"]
[Thu Apr 30 06:20:44.318632 2026] [:error] [pid 18111:tid 18125] [client 20.215.248.255:32069] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afKEPGctLbxB7Q1_oK2BMgAAAAM"]
[Thu Apr 30 06:20:45.406616 2026] [:error] [pid 52350:tid 52370] [client 20.215.248.255:32081] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afKEPf1j4GHE9hm7bfc-rgAAAQw"]
[Thu Apr 30 07:47:56.791010 2026] [:error] [pid 18112:tid 18160] [client 145.239.65.236:33178] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afKYrCUrJv3y8j6Lm1uwRgAAAEo"]
[Thu Apr 30 07:47:59.322231 2026] [:error] [pid 52436:tid 52462] [client 145.239.65.236:53322] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afKYrwLFWPk_P7AfE8f8AgAAAVc"]
[Thu Apr 30 07:48:01.415129 2026] [:error] [pid 18111:tid 18130] [client 145.239.65.236:51006] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afKYsWctLbxB7Q1_oK2NDAAAAAg"]
[Thu Apr 30 07:48:03.722074 2026] [:error] [pid 52350:tid 52371] [client 145.239.65.236:53330] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afKYs_1j4GHE9hm7bfdUrwAAAQ0"]
[Thu Apr 30 07:48:05.612679 2026] [:error] [pid 18220:tid 18243] [client 145.239.65.236:51008] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afKYtcyESVSfAPebmxb71QAAANQ"]
[Thu Apr 30 07:48:07.909855 2026] [:error] [pid 18112:tid 18153] [client 145.239.65.236:53332] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afKYtyUrJv3y8j6Lm1uwlAAAAEM"]
[Thu Apr 30 07:48:10.267997 2026] [:error] [pid 52350:tid 52377] [client 145.239.65.236:49942] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afKYuv1j4GHE9hm7bfdUtgAAARM"]
[Thu Apr 30 07:48:12.345586 2026] [:error] [pid 18220:tid 18225] [client 145.239.65.236:60768] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afKYvMyESVSfAPebmxb72wAAAMI"]
[Thu Apr 30 07:48:14.610864 2026] [:error] [pid 52350:tid 52379] [client 145.239.65.236:49956] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afKYvv1j4GHE9hm7bfdUuwAAARU"]
[Thu Apr 30 07:48:17.044079 2026] [:error] [pid 18111:tid 18142] [client 145.239.65.236:49964] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afKYwWctLbxB7Q1_oK2NJAAAABQ"]
[Thu Apr 30 07:48:19.486843 2026] [:error] [pid 52436:tid 52446] [client 145.239.65.236:58882] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afKYwwLFWPk_P7AfE8f8EwAAAUc"]
[Thu Apr 30 07:48:21.887929 2026] [:error] [pid 52350:tid 52375] [client 145.239.65.236:58884] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afKYxf1j4GHE9hm7bfdUwQAAARE"]
[Thu Apr 30 07:48:24.407041 2026] [:error] [pid 18111:tid 18134] [client 145.239.65.236:58888] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afKYyGctLbxB7Q1_oK2NLAAAAAw"]
[Thu Apr 30 07:48:26.799826 2026] [:error] [pid 52350:tid 52379] [client 145.239.65.236:58898] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afKYyv1j4GHE9hm7bfdUxgAAARU"]
[Thu Apr 30 07:48:29.305733 2026] [:error] [pid 18111:tid 18139] [client 145.239.65.236:38486] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afKYzWctLbxB7Q1_oK2NNAAAABE"]
[Thu Apr 30 07:48:31.789711 2026] [:error] [pid 18113:tid 18196] [client 145.239.65.236:38492] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afKYz3iIjwsVGkvz5IlgIgAAAJM"]
[Thu Apr 30 07:48:34.120779 2026] [:error] [pid 52350:tid 52368] [client 145.239.65.236:38506] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afKY0v1j4GHE9hm7bfdU1AAAAQo"]
[Thu Apr 30 07:48:36.611007 2026] [:error] [pid 52350:tid 52361] [client 145.239.65.236:38516] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afKY1P1j4GHE9hm7bfdU2QAAAQM"]
[Thu Apr 30 07:48:38.947353 2026] [:error] [pid 18220:tid 18232] [client 145.239.65.236:33894] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afKY1syESVSfAPebmxb8AwAAAMk"]
[Thu Apr 30 07:48:41.447833 2026] [:error] [pid 52436:tid 52444] [client 145.239.65.236:33896] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afKY2QLFWPk_P7AfE8f8GQAAAUU"]
[Thu Apr 30 07:48:43.953939 2026] [:error] [pid 18112:tid 18159] [client 145.239.65.236:33906] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afKY2yUrJv3y8j6Lm1uwswAAAEk"]
[Thu Apr 30 07:48:46.470570 2026] [:error] [pid 18220:tid 18234] [client 145.239.65.236:33920] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afKY3syESVSfAPebmxb8EgAAAMs"]
[Thu Apr 30 07:48:48.961086 2026] [:error] [pid 18220:tid 18237] [client 145.239.65.236:45836] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afKY4MyESVSfAPebmxb8FwAAAM4"]
[Thu Apr 30 07:48:51.299171 2026] [:error] [pid 18111:tid 18127] [client 145.239.65.236:45848] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afKY42ctLbxB7Q1_oK2NSwAAAAU"]
[Thu Apr 30 07:48:53.777815 2026] [:error] [pid 18111:tid 18130] [client 145.239.65.236:45850] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afKY5WctLbxB7Q1_oK2NUgAAAAg"]
[Thu Apr 30 07:49:14.993528 2026] [:error] [pid 18220:tid 18234] [client 145.239.65.236:45864] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afKY-syESVSfAPebmxb8SgAAAMs"]
[Thu Apr 30 07:49:17.431951 2026] [:error] [pid 52350:tid 52374] [client 145.239.65.236:56954] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afKY_f1j4GHE9hm7bfdVEwAAARA"]
[Thu Apr 30 07:49:19.425285 2026] [:error] [pid 18111:tid 18131] [client 145.239.65.236:33008] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afKY_2ctLbxB7Q1_oK2NXAAAAAk"]
[Thu Apr 30 07:49:21.914519 2026] [:error] [pid 18111:tid 18125] [client 145.239.65.236:54186] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afKZAWctLbxB7Q1_oK2NXwAAAAM"]
[Thu Apr 30 07:49:24.241850 2026] [:error] [pid 18220:tid 18244] [client 145.239.65.236:54194] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afKZBMyESVSfAPebmxb8SwAAANU"]
[Thu Apr 30 07:49:26.237184 2026] [:error] [pid 18113:tid 18181] [client 145.239.65.236:33014] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afKZBniIjwsVGkvz5IlgQQAAAIQ"]
[Thu Apr 30 07:49:28.739034 2026] [:error] [pid 18112:tid 18166] [client 145.239.65.236:45420] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afKZCCUrJv3y8j6Lm1uxEgAAAFA"]
[Thu Apr 30 07:49:30.553613 2026] [:error] [pid 18112:tid 18151] [client 145.239.65.236:45970] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afKZCiUrJv3y8j6Lm1uxGgAAAEE"]
[Thu Apr 30 07:49:33.033843 2026] [:error] [pid 18112:tid 18172] [client 145.239.65.236:45428] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afKZDSUrJv3y8j6Lm1uxKwAAAFY"]
[Thu Apr 30 07:49:34.865304 2026] [:error] [pid 18111:tid 18124] [client 145.239.65.236:45978] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afKZDmctLbxB7Q1_oK2NYwAAAAI"]
[Thu Apr 30 07:49:37.339515 2026] [:error] [pid 18113:tid 18194] [client 145.239.65.236:45436] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afKZEXiIjwsVGkvz5IlgTQAAAJE"]
[Thu Apr 30 07:49:39.804690 2026] [:error] [pid 18111:tid 18136] [client 145.239.65.236:47660] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afKZE2ctLbxB7Q1_oK2NagAAAA4"]
[Thu Apr 30 07:49:42.287019 2026] [:error] [pid 18112:tid 18169] [client 145.239.65.236:47670] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afKZFiUrJv3y8j6Lm1uxPAAAAFM"]
[Thu Apr 30 07:49:44.744026 2026] [:error] [pid 18112:tid 18157] [client 145.239.65.236:47682] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afKZGCUrJv3y8j6Lm1uxPgAAAEc"]
[Thu Apr 30 07:49:46.586880 2026] [:error] [pid 18220:tid 18239] [client 145.239.65.236:49456] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afKZGsyESVSfAPebmxb8WwAAANA"]
[Thu Apr 30 07:49:49.085078 2026] [:error] [pid 18112:tid 18164] [client 145.239.65.236:54508] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afKZHSUrJv3y8j6Lm1uxQQAAAE4"]
[Thu Apr 30 07:49:51.050316 2026] [:error] [pid 52436:tid 52452] [client 145.239.65.236:52378] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afKZHwLFWPk_P7AfE8f8KQAAAU0"]
[Thu Apr 30 07:49:53.542930 2026] [:error] [pid 18111:tid 18136] [client 145.239.65.236:54522] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afKZIWctLbxB7Q1_oK2NcAAAAA4"]
[Thu Apr 30 07:49:56.002077 2026] [:error] [pid 18112:tid 18166] [client 145.239.65.236:54528] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afKZJCUrJv3y8j6Lm1uxTAAAAFA"]
[Thu Apr 30 07:49:58.460329 2026] [:error] [pid 18112:tid 18162] [client 145.239.65.236:54540] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afKZJiUrJv3y8j6Lm1uxTwAAAEw"]
[Thu Apr 30 07:50:00.917543 2026] [:error] [pid 52350:tid 52378] [client 145.239.65.236:45762] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afKZKP1j4GHE9hm7bfdVKwAAARQ"]
[Thu Apr 30 07:50:02.732140 2026] [:error] [pid 18112:tid 18156] [client 145.239.65.236:33762] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afKZKiUrJv3y8j6Lm1uxUgAAAEY"]
[Thu Apr 30 07:50:04.724834 2026] [:error] [pid 18112:tid 18165] [client 145.239.65.236:33770] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afKZLCUrJv3y8j6Lm1uxVgAAAE8"]
[Thu Apr 30 07:50:06.722459 2026] [:error] [pid 18112:tid 18158] [client 145.239.65.236:33782] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afKZLiUrJv3y8j6Lm1uxWQAAAEg"]
[Thu Apr 30 07:50:08.726753 2026] [:error] [pid 18112:tid 18167] [client 145.239.65.236:44938] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afKZMCUrJv3y8j6Lm1uxXwAAAFE"]
[Thu Apr 30 07:50:11.208076 2026] [:error] [pid 18113:tid 18177] [client 145.239.65.236:42466] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afKZM3iIjwsVGkvz5IlgUgAAAIA"]
[Thu Apr 30 08:41:14.490591 2026] [:error] [pid 18113:tid 18200] [client 187.109.50.18:9235] [client 187.109.50.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.109.50.18, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afKlKniIjwsVGkvz5IllJQAAAJc"]
[Thu Apr 30 08:41:14.501466 2026] [proxy_fcgi:error] [pid 18113:tid 18200] [client 187.109.50.18:9235] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 09:25:36.032709 2026] [:error] [pid 18111:tid 18129] [client 139.155.134.17:52124] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afKvkGctLbxB7Q1_oK2rRwAAAAc"]
[Thu Apr 30 09:40:33.511619 2026] [:error] [pid 53641:tid 53671] [client 5.135.131.226:56232] [client 5.135.131.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afKzEWC119wja3QGeAGJJAAAAZM"]
[Thu Apr 30 09:40:35.924710 2026] [:error] [pid 18111:tid 18145] [client 5.135.131.226:58108] [client 5.135.131.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afKzE2ctLbxB7Q1_oK2wxQAAABc"]
[Thu Apr 30 09:40:40.567525 2026] [:error] [pid 52350:tid 52369] [client 5.135.131.226:54578] [client 5.135.131.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afKzGP1j4GHE9hm7bfdm4gAAAQs"]
[Thu Apr 30 09:40:44.325262 2026] [:error] [pid 18112:tid 18172] [client 5.135.131.226:54592] [client 5.135.131.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afKzHCUrJv3y8j6Lm1vLUAAAAFY"]
[Thu Apr 30 10:00:25.661710 2026] [:error] [pid 18111:tid 18143] [client 43.134.73.5:50546] [client 43.134.73.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afK3uWctLbxB7Q1_oK22vwAAABU"]
[Thu Apr 30 10:51:30.586326 2026] [:error] [pid 18220:tid 18226] [client 62.84.185.55:4906] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afLDssyESVSfAPebmxYQSgAAAMM"]
[Thu Apr 30 10:51:34.027390 2026] [:error] [pid 52436:tid 52444] [client 62.84.185.55:4910] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afLDtgLFWPk_P7AfE8cNNQAAAUU"]
[Thu Apr 30 10:51:39.226558 2026] [:error] [pid 52350:tid 52380] [client 62.84.185.55:54298] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afLDu_1j4GHE9hm7bfdvvAAAARY"]
[Thu Apr 30 10:51:44.294203 2026] [:error] [pid 18112:tid 18150] [client 62.84.185.55:54312] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afLDwCUrJv3y8j6Lm1vWMwAAAEA"]
[Thu Apr 30 10:51:49.722987 2026] [:error] [pid 53641:tid 53667] [client 62.84.185.55:12146] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afLDxWC119wja3QGeAGYRgAAAY8"]
[Thu Apr 30 10:51:56.297152 2026] [:error] [pid 53641:tid 53671] [client 62.84.185.55:12150] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afLDzGC119wja3QGeAGYTAAAAZM"]
[Thu Apr 30 11:11:31.254745 2026] [:error] [pid 18112:tid 18173] [client 43.130.141.193:57464] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afLIYyUrJv3y8j6Lm1va7wAAAFc"]
[Thu Apr 30 11:27:47.764898 2026] [:error] [pid 18220:tid 18224] [client 82.102.18.190:32974] [client 82.102.18.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.190, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afLMM8yESVSfAPebmxYUtwAAAME"]
[Thu Apr 30 11:27:47.774540 2026] [proxy_fcgi:error] [pid 18220:tid 18224] [client 82.102.18.190:32974] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 11:27:51.591046 2026] [:error] [pid 18220:tid 18242] [client 82.102.18.190:32974] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "afLMN8yESVSfAPebmxYUwgAAANM"]
[Thu Apr 30 11:27:52.154341 2026] [:error] [pid 18112:tid 18153] [client 82.102.18.190:32990] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "afLMOCUrJv3y8j6Lm1vdiAAAAEM"]
[Thu Apr 30 11:27:52.735131 2026] [:error] [pid 18112:tid 18164] [client 82.102.18.190:32992] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "afLMOCUrJv3y8j6Lm1vdiQAAAE4"]
[Thu Apr 30 11:27:53.312147 2026] [:error] [pid 18220:tid 18226] [client 82.102.18.190:33002] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "afLMOcyESVSfAPebmxYUxQAAAMM"]
[Thu Apr 30 11:27:53.852331 2026] [:error] [pid 18112:tid 18151] [client 82.102.18.190:33014] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "afLMOSUrJv3y8j6Lm1vdigAAAEE"]
[Thu Apr 30 11:27:54.433633 2026] [:error] [pid 18220:tid 18229] [client 82.102.18.190:33018] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "afLMOsyESVSfAPebmxYUxwAAAMY"]
[Thu Apr 30 11:27:55.012740 2026] [:error] [pid 18111:tid 18125] [client 82.102.18.190:33032] [client 82.102.18.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "afLMO2ctLbxB7Q1_oK3W1AAAAAM"]
[Thu Apr 30 11:50:19.224321 2026] [:error] [pid 18111:tid 18125] [client 104.167.198.114:37554] [client 104.167.198.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afLRe2ctLbxB7Q1_oK3fNwAAAAM"]
[Thu Apr 30 12:25:13.967345 2026] [:error] [pid 18112:tid 18160] [client 20.215.248.255:25705] [client 20.215.248.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.215.248.255, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afLZqSUrJv3y8j6Lm1vnvwAAAEo"]
[Thu Apr 30 12:25:13.976524 2026] [proxy_fcgi:error] [pid 18112:tid 18160] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:14.513529 2026] [proxy_fcgi:error] [pid 18112:tid 18151] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:14.780842 2026] [proxy_fcgi:error] [pid 18112:tid 18169] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:15.315629 2026] [proxy_fcgi:error] [pid 18112:tid 18168] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:15.584191 2026] [proxy_fcgi:error] [pid 18112:tid 18165] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:15.873807 2026] [proxy_fcgi:error] [pid 18112:tid 18153] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:16.141329 2026] [autoindex:error] [pid 18112:tid 18150] [client 20.215.248.255:25705] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 30 12:25:16.408190 2026] [proxy_fcgi:error] [pid 18112:tid 18152] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:16.675979 2026] [proxy_fcgi:error] [pid 18112:tid 18170] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:16.944182 2026] [proxy_fcgi:error] [pid 18112:tid 18167] [client 20.215.248.255:25705] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 12:25:17.208746 2026] [:error] [pid 18112:tid 18171] [client 20.215.248.255:25705] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bk/index.php"] [unique_id "afLZrSUrJv3y8j6Lm1vnzQAAAFU"]
[Thu Apr 30 12:25:18.245014 2026] [:error] [pid 18112:tid 18159] [client 20.215.248.255:19896] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bk/index.php"] [unique_id "afLZriUrJv3y8j6Lm1vnzgAAAEk"]
[Thu Apr 30 12:25:19.294663 2026] [:error] [pid 18111:tid 18129] [client 20.215.248.255:17623] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bk/index.php"] [unique_id "afLZr2ctLbxB7Q1_oK3pCgAAAAc"]
[Thu Apr 30 12:25:20.364593 2026] [:error] [pid 18111:tid 18123] [client 20.215.248.255:22582] [client 20.215.248.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bk/index.php"] [unique_id "afLZsGctLbxB7Q1_oK3pFAAAAAE"]
[Thu Apr 30 12:26:40.430076 2026] [:error] [pid 18112:tid 18161] [client 79.137.67.86:57326] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afLaACUrJv3y8j6Lm1vn8QAAAEs"]
[Thu Apr 30 12:26:42.551465 2026] [:error] [pid 18112:tid 18151] [client 79.137.67.86:34896] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afLaAiUrJv3y8j6Lm1vn8gAAAEE"]
[Thu Apr 30 12:26:44.411999 2026] [:error] [pid 52350:tid 52377] [client 79.137.67.86:34902] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afLaBP1j4GHE9hm7bfd7SQAAARM"]
[Thu Apr 30 12:26:46.972044 2026] [:error] [pid 18111:tid 18142] [client 79.137.67.86:50468] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afLaBmctLbxB7Q1_oK3pkAAAABQ"]
[Thu Apr 30 12:26:49.371472 2026] [:error] [pid 18111:tid 18140] [client 79.137.67.86:41950] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afLaCWctLbxB7Q1_oK3pkQAAABI"]
[Thu Apr 30 12:26:52.899403 2026] [:error] [pid 52350:tid 52372] [client 79.137.67.86:59968] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afLaDP1j4GHE9hm7bfd7TwAAAQ4"]
[Thu Apr 30 12:26:56.642406 2026] [:error] [pid 18220:tid 18247] [client 79.137.67.86:59974] [client 79.137.67.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afLaEMyESVSfAPebmxYb1wAAANg"]
[Thu Apr 30 20:43:48.600404 2026] [autoindex:error] [pid 6456:tid 6461] [client 80.241.213.248:50527] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Apr 30 21:10:34.497650 2026] [:error] [pid 5733:tid 5809] [client 49.145.213.190:49269] [client 49.145.213.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.213.190, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afNUyvT55_Ioa9J2OpL0AAAAARM"]
[Thu Apr 30 21:10:34.509117 2026] [proxy_fcgi:error] [pid 5733:tid 5809] [client 49.145.213.190:49269] AH01071: Got error 'Primary script unknown'
[Thu Apr 30 21:30:31.069282 2026] [:error] [pid 6456:tid 6468] [client 1.12.70.96:58380] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afNZd0OBwsDodnkJK5xswwAAAEo"]
[Thu Apr 30 22:32:51.433441 2026] [:error] [pid 6456:tid 6465] [client 51.75.116.156:49094] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afNoE0OBwsDodnkJK5x-wQAAAEc"]
[Thu Apr 30 22:32:53.394229 2026] [:error] [pid 6456:tid 6469] [client 51.75.116.156:42460] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afNoFUOBwsDodnkJK5x-wwAAAEs"]
[Thu Apr 30 22:32:55.271468 2026] [:error] [pid 5820:tid 5829] [client 51.75.116.156:42476] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afNoFwyrLh3-LgH3Xv9mewAAAAc"]
[Thu Apr 30 22:32:57.314105 2026] [:error] [pid 5733:tid 5796] [client 51.75.116.156:60004] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afNoGfT55_Ioa9J2OpL_vAAAAQY"]
[Thu Apr 30 22:32:59.163013 2026] [:error] [pid 5820:tid 5839] [client 51.75.116.156:60008] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afNoGwyrLh3-LgH3Xv9mgAAAABE"]
[Thu Apr 30 22:33:01.186888 2026] [:error] [pid 5820:tid 5823] [client 51.75.116.156:60020] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afNoHQyrLh3-LgH3Xv9mhQAAAAE"]
[Thu Apr 30 22:33:03.212584 2026] [:error] [pid 5820:tid 5830] [client 51.75.116.156:60022] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afNoHwyrLh3-LgH3Xv9migAAAAg"]
[Thu Apr 30 22:33:05.079001 2026] [:error] [pid 5820:tid 5829] [client 51.75.116.156:60036] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afNoIQyrLh3-LgH3Xv9mjAAAAAc"]
[Thu Apr 30 22:33:07.078065 2026] [:error] [pid 5731:tid 5745] [client 51.75.116.156:47090] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afNoIw8tX7TbSfYoUIxN8wAAAIo"]
[Thu Apr 30 22:33:09.115704 2026] [:error] [pid 6456:tid 6472] [client 51.75.116.156:47104] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afNoJUOBwsDodnkJK5x-ygAAAE4"]
[Thu Apr 30 22:33:11.118500 2026] [:error] [pid 5820:tid 5844] [client 51.75.116.156:47118] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afNoJwyrLh3-LgH3Xv9mkwAAABY"]
[Thu Apr 30 22:33:13.117359 2026] [:error] [pid 5820:tid 5840] [client 51.75.116.156:47126] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afNoKQyrLh3-LgH3Xv9mlQAAABI"]
[Thu Apr 30 22:33:14.981651 2026] [:error] [pid 5733:tid 5797] [client 51.75.116.156:47128] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afNoKvT55_Ioa9J2OpL_0gAAAQc"]
[Thu Apr 30 22:33:16.998193 2026] [:error] [pid 6456:tid 6481] [client 51.75.116.156:38034] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afNoLEOBwsDodnkJK5x-1QAAAFc"]
[Thu Apr 30 22:33:18.994686 2026] [:error] [pid 5820:tid 5824] [client 51.75.116.156:38048] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afNoLgyrLh3-LgH3Xv9mpQAAAAI"]
[Thu Apr 30 22:33:20.997283 2026] [:error] [pid 5820:tid 5824] [client 51.75.116.156:38060] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afNoMAyrLh3-LgH3Xv9m1QAAAAI"]
[Thu Apr 30 22:33:23.010887 2026] [:error] [pid 5733:tid 5797] [client 51.75.116.156:38068] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afNoM_T55_Ioa9J2OpL_2gAAAQc"]
[Thu Apr 30 22:33:25.016448 2026] [:error] [pid 5731:tid 5753] [client 51.75.116.156:38076] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afNoNQ8tX7TbSfYoUIxN_wAAAJI"]
[Thu Apr 30 22:33:27.013044 2026] [:error] [pid 6456:tid 6471] [client 51.75.116.156:48326] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afNoN0OBwsDodnkJK5x-9QAAAE0"]
[Thu Apr 30 22:33:29.016194 2026] [:error] [pid 5733:tid 5800] [client 51.75.116.156:48342] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afNoOfT55_Ioa9J2OpL_6QAAAQo"]
[Thu Apr 30 22:33:31.016837 2026] [:error] [pid 5732:tid 5779] [client 51.75.116.156:48354] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afNoO9uJ3iSd5GdjqlhRYAAAANA"]
[Thu Apr 30 22:33:33.010640 2026] [:error] [pid 6456:tid 6470] [client 51.75.116.156:48366] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afNoPUOBwsDodnkJK5x-_gAAAEw"]
[Thu Apr 30 22:33:35.008021 2026] [:error] [pid 6456:tid 6474] [client 51.75.116.156:48374] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afNoP0OBwsDodnkJK5x_BgAAAFA"]
[Thu Apr 30 22:33:37.003176 2026] [:error] [pid 5820:tid 5846] [client 51.75.116.156:37166] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afNoQQyrLh3-LgH3Xv9m3AAAABg"]
[Thu Apr 30 22:33:38.995923 2026] [:error] [pid 5733:tid 5799] [client 51.75.116.156:37176] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afNoQvT55_Ioa9J2OpL_9QAAAQk"]
[Thu Apr 30 22:33:40.834050 2026] [:error] [pid 6456:tid 6460] [client 51.75.116.156:37182] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afNoREOBwsDodnkJK5x_EQAAAEI"]
[Thu Apr 30 22:33:42.842800 2026] [:error] [pid 5820:tid 5839] [client 51.75.116.156:37192] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afNoRgyrLh3-LgH3Xv9m4wAAABE"]
[Thu Apr 30 22:33:44.835293 2026] [:error] [pid 5820:tid 5844] [client 51.75.116.156:37208] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afNoSAyrLh3-LgH3Xv9m6AAAABY"]
[Thu Apr 30 22:33:48.156364 2026] [:error] [pid 6456:tid 6475] [client 51.75.116.156:57578] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afNoTEOBwsDodnkJK5x_HwAAAFE"]
[Thu Apr 30 22:34:09.928906 2026] [:error] [pid 5820:tid 5837] [client 51.75.116.156:57588] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afNoYQyrLh3-LgH3Xv9nDgAAAA8"]
[Thu Apr 30 22:34:11.856145 2026] [:error] [pid 6456:tid 6475] [client 51.75.116.156:33492] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afNoY0OBwsDodnkJK5x_PQAAAFE"]
[Thu Apr 30 22:34:13.859417 2026] [:error] [pid 5820:tid 5842] [client 51.75.116.156:33500] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afNoZQyrLh3-LgH3Xv9nEQAAABQ"]
[Thu Apr 30 22:34:15.851857 2026] [:error] [pid 5731:tid 5741] [client 51.75.116.156:33512] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afNoZw8tX7TbSfYoUIxOFwAAAIY"]
[Thu Apr 30 22:34:17.839761 2026] [:error] [pid 5731:tid 5748] [client 51.75.116.156:33702] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afNoaQ8tX7TbSfYoUIxOGQAAAI0"]
[Thu Apr 30 22:34:19.674122 2026] [:error] [pid 5820:tid 5823] [client 51.75.116.156:33712] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afNoawyrLh3-LgH3Xv9nEwAAAAE"]
[Thu Apr 30 22:34:21.656437 2026] [:error] [pid 5733:tid 5800] [client 51.75.116.156:33728] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afNobfT55_Ioa9J2OpIAGgAAAQo"]
[Thu Apr 30 22:34:23.484489 2026] [:error] [pid 6456:tid 6466] [client 51.75.116.156:33736] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afNob0OBwsDodnkJK5x_VgAAAEg"]
[Thu Apr 30 22:34:25.468128 2026] [:error] [pid 6456:tid 6478] [client 51.75.116.156:33738] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afNocUOBwsDodnkJK5x_WAAAAFQ"]
[Thu Apr 30 22:34:27.459427 2026] [:error] [pid 6456:tid 6471] [client 51.75.116.156:50966] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afNoc0OBwsDodnkJK5x_WgAAAE0"]
[Thu Apr 30 22:34:29.292612 2026] [:error] [pid 6456:tid 6479] [client 51.75.116.156:50978] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afNodUOBwsDodnkJK5x_XgAAAFU"]
[Thu Apr 30 22:34:31.280084 2026] [:error] [pid 6456:tid 6462] [client 51.75.116.156:50984] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afNod0OBwsDodnkJK5x_YgAAAEQ"]
[Thu Apr 30 22:34:33.268000 2026] [:error] [pid 6456:tid 6472] [client 51.75.116.156:50996] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afNoeUOBwsDodnkJK5x_ZgAAAE4"]
[Thu Apr 30 22:34:35.264960 2026] [:error] [pid 5820:tid 5833] [client 51.75.116.156:51002] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afNoewyrLh3-LgH3Xv9nGAAAAAs"]
[Thu Apr 30 22:34:37.096899 2026] [:error] [pid 6456:tid 6467] [client 51.75.116.156:50510] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afNofUOBwsDodnkJK5x_bAAAAEk"]
[Thu Apr 30 22:34:39.083318 2026] [:error] [pid 6456:tid 6470] [client 51.75.116.156:50526] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afNof0OBwsDodnkJK5x_cAAAAEw"]
[Thu Apr 30 22:34:41.070944 2026] [:error] [pid 5732:tid 5784] [client 51.75.116.156:50540] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afNogduJ3iSd5GdjqlhRiAAAANU"]
[Thu Apr 30 22:34:42.900693 2026] [:error] [pid 6456:tid 6481] [client 51.75.116.156:50548] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afNogkOBwsDodnkJK5x_ewAAAFc"]
[Thu Apr 30 22:34:44.887050 2026] [:error] [pid 5733:tid 5804] [client 51.75.116.156:50552] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afNohPT55_Ioa9J2OpIAIAAAAQ4"]
[Thu Apr 30 22:34:46.872746 2026] [:error] [pid 6456:tid 6470] [client 51.75.116.156:51858] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afNohkOBwsDodnkJK5x_fwAAAEw"]
[Thu Apr 30 22:34:48.703562 2026] [:error] [pid 5733:tid 5811] [client 51.75.116.156:51866] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afNoiPT55_Ioa9J2OpIAJwAAARU"]
[Thu Apr 30 22:34:50.690246 2026] [:error] [pid 5732:tid 5769] [client 51.75.116.156:51882] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afNoituJ3iSd5GdjqlhRjQAAAMY"]
[Thu Apr 30 22:34:52.673245 2026] [:error] [pid 5732:tid 5766] [client 51.75.116.156:51884] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afNojNuJ3iSd5GdjqlhRkQAAAMM"]
[Thu Apr 30 22:34:54.506556 2026] [:error] [pid 5733:tid 5799] [client 51.75.116.156:51894] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afNojvT55_Ioa9J2OpIALAAAAQk"]
[Thu Apr 30 22:34:56.496488 2026] [:error] [pid 5733:tid 5791] [client 51.75.116.156:41092] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afNokPT55_Ioa9J2OpIALgAAAQE"]
[Thu Apr 30 22:34:58.483242 2026] [:error] [pid 6456:tid 6474] [client 51.75.116.156:41108] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afNokkOBwsDodnkJK5x_gwAAAFA"]
[Thu Apr 30 22:35:00.314086 2026] [:error] [pid 6456:tid 6477] [client 51.75.116.156:41114] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afNolEOBwsDodnkJK5x_hQAAAFM"]
[Thu Apr 30 22:35:02.294609 2026] [:error] [pid 5820:tid 5837] [client 51.75.116.156:41120] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afNolgyrLh3-LgH3Xv9nLAAAAA8"]
[Thu Apr 30 22:35:04.275962 2026] [:error] [pid 5820:tid 5825] [client 51.75.116.156:41128] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afNomAyrLh3-LgH3Xv9nLQAAAAM"]
[Thu Apr 30 22:35:06.259567 2026] [:error] [pid 5820:tid 5830] [client 51.75.116.156:44570] [client 51.75.116.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afNomgyrLh3-LgH3Xv9nLwAAAAg"]
[Thu Apr 30 22:53:29.343051 2026] [:error] [pid 5732:tid 5768] [client 62.84.185.60:24684] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afNs6duJ3iSd5GdjqlhTYQAAAMU"]
[Thu Apr 30 22:53:31.850852 2026] [:error] [pid 5732:tid 5770] [client 62.84.185.60:54978] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afNs69uJ3iSd5GdjqlhTZQAAAMc"]
[Thu Apr 30 22:53:34.080038 2026] [:error] [pid 6456:tid 6471] [client 62.84.185.60:54982] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afNs7kOBwsDodnkJK5yDoAAAAE0"]
[Thu Apr 30 22:53:36.180832 2026] [:error] [pid 6456:tid 6480] [client 62.84.185.60:54994] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afNs8EOBwsDodnkJK5yDogAAAFY"]
[Thu Apr 30 22:53:38.544228 2026] [:error] [pid 5731:tid 5739] [client 62.84.185.60:55010] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afNs8g8tX7TbSfYoUIxPvAAAAIQ"]
[Thu Apr 30 22:53:40.561596 2026] [:error] [pid 5820:tid 5834] [client 62.84.185.60:55020] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afNs9AyrLh3-LgH3Xv9qZAAAAAw"]
[Thu Apr 30 22:53:42.848505 2026] [:error] [pid 6456:tid 6475] [client 62.84.185.60:36958] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afNs9kOBwsDodnkJK5yDowAAAFE"]
[Thu Apr 30 22:53:44.975875 2026] [:error] [pid 5820:tid 5827] [client 62.84.185.60:36970] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afNs-AyrLh3-LgH3Xv9qbAAAAAU"]
[Thu Apr 30 22:53:47.674822 2026] [:error] [pid 5731:tid 5740] [client 62.84.185.60:36986] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afNs-w8tX7TbSfYoUIxPwwAAAIU"]
[Thu Apr 30 22:53:49.709942 2026] [:error] [pid 5731:tid 5746] [client 62.84.185.60:36988] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afNs_Q8tX7TbSfYoUIxPxgAAAIs"]
[Thu Apr 30 22:53:52.313385 2026] [:error] [pid 5733:tid 5801] [client 62.84.185.60:49294] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afNtAPT55_Ioa9J2OpICQAAAAQs"]
[Thu Apr 30 22:53:54.532565 2026] [:error] [pid 5731:tid 5745] [client 62.84.185.60:54228] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afNtAg8tX7TbSfYoUIxPywAAAIo"]
[Thu Apr 30 22:53:57.319459 2026] [:error] [pid 5733:tid 5804] [client 62.84.185.60:49306] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afNtBfT55_Ioa9J2OpICQgAAAQ4"]
[Thu Apr 30 22:54:00.229189 2026] [:error] [pid 5732:tid 5786] [client 62.84.185.60:49316] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afNtCNuJ3iSd5GdjqlhTcAAAANc"]
[Thu Apr 30 22:54:02.821718 2026] [:error] [pid 5820:tid 5834] [client 62.84.185.60:51228] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afNtCgyrLh3-LgH3Xv9qgAAAAAw"]
[Thu Apr 30 22:54:05.927894 2026] [:error] [pid 5820:tid 5831] [client 62.84.185.60:52034] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afNtDQyrLh3-LgH3Xv9qhgAAAAk"]
[Thu Apr 30 22:54:08.788347 2026] [:error] [pid 6456:tid 6465] [client 62.84.185.60:52046] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afNtEEOBwsDodnkJK5yDswAAAEc"]
[Thu Apr 30 22:54:11.595258 2026] [:error] [pid 6456:tid 6466] [client 62.84.185.60:52062] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afNtE0OBwsDodnkJK5yDuQAAAEg"]
[Thu Apr 30 22:54:13.921170 2026] [:error] [pid 5820:tid 5828] [client 62.84.185.60:32108] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afNtFQyrLh3-LgH3Xv9qhwAAAAY"]
[Thu Apr 30 22:54:16.885706 2026] [:error] [pid 6456:tid 6458] [client 62.84.185.60:39676] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afNtGEOBwsDodnkJK5yDvAAAAEA"]
[Thu Apr 30 22:54:19.842618 2026] [:error] [pid 5731:tid 5747] [client 62.84.185.60:39684] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afNtGw8tX7TbSfYoUIxP1QAAAIw"]
[Thu Apr 30 22:54:22.498171 2026] [:error] [pid 6456:tid 6469] [client 62.84.185.60:44536] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afNtHkOBwsDodnkJK5yDvgAAAEs"]
[Thu Apr 30 22:54:25.157697 2026] [:error] [pid 6456:tid 6464] [client 62.84.185.60:44548] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afNtIUOBwsDodnkJK5yDyQAAAEY"]
[Thu Apr 30 22:54:55.063271 2026] [:error] [pid 5820:tid 5841] [client 62.84.185.60:28314] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afNtPwyrLh3-LgH3Xv9qngAAABM"]
[Thu Apr 30 22:54:57.291251 2026] [:error] [pid 6456:tid 6459] [client 62.84.185.60:28326] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afNtQUOBwsDodnkJK5yD6AAAAEE"]
[Thu Apr 30 22:54:59.577331 2026] [:error] [pid 6456:tid 6463] [client 62.84.185.60:28342] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afNtQ0OBwsDodnkJK5yD9AAAAEU"]
[Thu Apr 30 22:55:04.360575 2026] [:error] [pid 6456:tid 6462] [client 62.84.185.60:41464] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afNtSEOBwsDodnkJK5yEAQAAAEQ"]
[Thu Apr 30 22:55:06.645712 2026] [:error] [pid 5731:tid 5749] [client 62.84.185.60:41480] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afNtSg8tX7TbSfYoUIxP4gAAAI4"]
[Thu Apr 30 22:55:10.234570 2026] [:error] [pid 5731:tid 5736] [client 62.84.185.60:27468] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afNtTg8tX7TbSfYoUIxP5AAAAIE"]
[Thu Apr 30 22:55:13.813870 2026] [:error] [pid 6456:tid 6470] [client 62.84.185.60:44448] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afNtUUOBwsDodnkJK5yEEwAAAEw"]
[Thu Apr 30 22:55:15.814889 2026] [:error] [pid 6456:tid 6482] [client 62.84.185.60:44454] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afNtU0OBwsDodnkJK5yEFwAAAFg"]
[Thu Apr 30 22:55:18.191128 2026] [:error] [pid 5733:tid 5794] [client 62.84.185.60:44466] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afNtVvT55_Ioa9J2OpICVAAAAQQ"]
[Thu Apr 30 22:55:20.445972 2026] [:error] [pid 5733:tid 5814] [client 62.84.185.60:44482] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afNtWPT55_Ioa9J2OpICVQAAARg"]
[Thu Apr 30 22:55:22.310720 2026] [:error] [pid 5733:tid 5803] [client 62.84.185.60:64094] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afNtWvT55_Ioa9J2OpICVgAAAQ0"]
[Thu Apr 30 22:55:26.613869 2026] [:error] [pid 5733:tid 5790] [client 62.84.185.60:64106] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afNtXvT55_Ioa9J2OpICWgAAAQA"]
[Thu Apr 30 23:45:30.740620 2026] [:error] [pid 5731:tid 5754] [client 194.163.150.221:59140] [client 194.163.150.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afN5Gg8tX7TbSfYoUIxUugAAAJM"]
[Thu Apr 30 23:45:32.658950 2026] [:error] [pid 5733:tid 5795] [client 194.163.150.221:57224] [client 194.163.150.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afN5HPT55_Ioa9J2OpIIggAAAQU"]
[Thu Apr 30 23:45:34.928038 2026] [:error] [pid 5820:tid 5839] [client 194.163.150.221:57230] [client 194.163.150.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afN5HgyrLh3-LgH3Xv9z6QAAABE"]
[Thu Apr 30 23:45:38.429805 2026] [:error] [pid 5820:tid 5831] [client 194.163.150.221:57130] [client 194.163.150.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afN5IgyrLh3-LgH3Xv9z7AAAAAk"]
[Thu Apr 30 23:45:40.712747 2026] [:error] [pid 6456:tid 6480] [client 194.163.150.221:51182] [client 194.163.150.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afN5JEOBwsDodnkJK5ySZgAAAFY"]
[Thu Apr 30 23:52:04.072201 2026] [:error] [pid 21839:tid 21852] [client 54.37.252.231:52010] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afN6pJ_Sh66m95WwxJ4FbgAAAUo"]
[Thu Apr 30 23:52:06.476257 2026] [:error] [pid 5733:tid 5809] [client 54.37.252.231:44404] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afN6pvT55_Ioa9J2OpIJEAAAARM"]
[Thu Apr 30 23:52:08.266942 2026] [:error] [pid 5733:tid 5799] [client 54.37.252.231:46144] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afN6qPT55_Ioa9J2OpIJEQAAAQk"]
[Thu Apr 30 23:52:10.741974 2026] [:error] [pid 5731:tid 5758] [client 54.37.252.231:44412] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afN6qg8tX7TbSfYoUIxVNAAAAJc"]
[Thu Apr 30 23:52:12.674342 2026] [:error] [pid 5733:tid 5793] [client 54.37.252.231:33226] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afN6rPT55_Ioa9J2OpIJEwAAAQM"]
[Thu Apr 30 23:52:14.656250 2026] [:error] [pid 5733:tid 5808] [client 54.37.252.231:33230] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afN6rvT55_Ioa9J2OpIJFAAAARI"]
[Thu Apr 30 23:52:16.642603 2026] [:error] [pid 6456:tid 6460] [client 54.37.252.231:33232] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afN6sEOBwsDodnkJK5yUFgAAAEI"]
[Thu Apr 30 23:52:18.637402 2026] [:error] [pid 6456:tid 6469] [client 54.37.252.231:33244] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afN6skOBwsDodnkJK5yUGAAAAEs"]
[Thu Apr 30 23:52:21.100600 2026] [:error] [pid 21839:tid 21861] [client 54.37.252.231:46048] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afN6tZ_Sh66m95WwxJ4FbwAAAVM"]
[Thu Apr 30 23:52:23.031538 2026] [:error] [pid 5732:tid 5774] [client 54.37.252.231:43070] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afN6t9uJ3iSd5GdjqlhYmAAAAMs"]
[Thu Apr 30 23:52:25.511861 2026] [:error] [pid 5820:tid 5826] [client 54.37.252.231:52124] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afN6uQyrLh3-LgH3Xv90zgAAAAQ"]
[Thu Apr 30 23:52:27.310502 2026] [:error] [pid 21839:tid 21864] [client 54.37.252.231:43082] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afN6u5_Sh66m95WwxJ4FcgAAAVY"]
[Thu Apr 30 23:52:29.789637 2026] [:error] [pid 5732:tid 5764] [client 54.37.252.231:52134] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afN6vduJ3iSd5GdjqlhYmwAAAME"]
[Thu Apr 30 23:52:31.742515 2026] [:error] [pid 5731:tid 5745] [client 54.37.252.231:43098] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afN6vw8tX7TbSfYoUIxVPgAAAIo"]
[Thu Apr 30 23:52:34.216761 2026] [:error] [pid 5731:tid 5740] [client 54.37.252.231:39164] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afN6wg8tX7TbSfYoUIxVQQAAAIU"]
[Thu Apr 30 23:52:36.649683 2026] [:error] [pid 5820:tid 5822] [client 54.37.252.231:39176] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afN6xAyrLh3-LgH3Xv900wAAAAA"]
[Thu Apr 30 23:52:38.614807 2026] [:error] [pid 5820:tid 5824] [client 54.37.252.231:59620] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afN6xgyrLh3-LgH3Xv901QAAAAI"]
[Thu Apr 30 23:52:41.105061 2026] [:error] [pid 5820:tid 5834] [client 54.37.252.231:39188] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afN6yQyrLh3-LgH3Xv901gAAAAw"]
[Thu Apr 30 23:52:43.542794 2026] [:error] [pid 5731:tid 5751] [client 54.37.252.231:55468] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afN6yw8tX7TbSfYoUIxVRAAAAJA"]
[Thu Apr 30 23:52:45.922741 2026] [:error] [pid 21839:tid 21847] [client 54.37.252.231:55470] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afN6zZ_Sh66m95WwxJ4FdAAAAUU"]
[Thu Apr 30 23:52:48.345567 2026] [:error] [pid 5820:tid 5840] [client 54.37.252.231:55478] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afN60AyrLh3-LgH3Xv903QAAABI"]
[Thu Apr 30 23:52:50.318513 2026] [:error] [pid 6456:tid 6482] [client 54.37.252.231:38202] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afN60kOBwsDodnkJK5yULAAAAFg"]
[Thu Apr 30 23:52:52.788142 2026] [:error] [pid 5733:tid 5792] [client 54.37.252.231:41146] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afN61PT55_Ioa9J2OpIJHwAAAQI"]
[Thu Apr 30 23:52:55.223520 2026] [:error] [pid 5820:tid 5834] [client 54.37.252.231:41162] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afN61wyrLh3-LgH3Xv904AAAAAw"]
[Thu Apr 30 23:52:57.161917 2026] [:error] [pid 5820:tid 5835] [client 54.37.252.231:60168] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afN62QyrLh3-LgH3Xv904QAAAA0"]
[Thu Apr 30 23:52:59.637617 2026] [:error] [pid 6456:tid 6474] [client 54.37.252.231:41172] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afN620OBwsDodnkJK5yULgAAAFA"]
[Thu Apr 30 23:53:01.591955 2026] [:error] [pid 21839:tid 21842] [client 54.37.252.231:60178] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afN63Z_Sh66m95WwxJ4FdgAAAUA"]
[Thu Apr 30 23:53:16.424655 2026] [:error] [pid 21839:tid 21859] [client 162.62.132.25:37002] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afN67J_Sh66m95WwxJ4FmgAAAVE"]
[Thu Apr 30 23:53:22.596099 2026] [:error] [pid 6456:tid 6463] [client 54.37.252.231:56156] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afN68kOBwsDodnkJK5yUQAAAAEU"]
[Thu Apr 30 23:53:25.002320 2026] [:error] [pid 5820:tid 5835] [client 54.37.252.231:45662] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afN69QyrLh3-LgH3Xv906wAAAA0"]
[Thu Apr 30 23:53:27.447576 2026] [:error] [pid 5820:tid 5825] [client 54.37.252.231:45670] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afN69wyrLh3-LgH3Xv908gAAAAM"]
[Thu Apr 30 23:53:29.875707 2026] [:error] [pid 5820:tid 5832] [client 54.37.252.231:45684] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afN6-QyrLh3-LgH3Xv909QAAAAo"]
[Thu Apr 30 23:53:32.308468 2026] [:error] [pid 5820:tid 5824] [client 54.37.252.231:45690] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afN6_AyrLh3-LgH3Xv909wAAAAI"]
[Thu Apr 30 23:53:34.309681 2026] [:error] [pid 21839:tid 21866] [client 54.37.252.231:58316] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afN6_p_Sh66m95WwxJ4FowAAAVg"]
[Thu Apr 30 23:53:38.063695 2026] [:error] [pid 5731:tid 5747] [client 54.37.252.231:58330] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afN7Ag8tX7TbSfYoUIxVSgAAAIw"]
[Fri May 01 00:55:32.228425 2026] [:error] [pid 5731:tid 5740] [client 124.156.226.179:42818] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afOJhA8tX7TbSfYoUIxazAAAAIU"]
[Fri May 01 01:02:37.634854 2026] [:error] [pid 6456:tid 6481] [client 107.175.136.30:48720] [client 107.175.136.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afOLLUOBwsDodnkJK5yfjAAAAFc"]
[Fri May 01 01:26:39.854700 2026] [:error] [pid 5732:tid 5768] [client 65.108.78.33:49064] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afOQz9uJ3iSd5GdjqlhhAQAAAMU"]
[Fri May 01 01:26:42.387339 2026] [:error] [pid 5731:tid 5754] [client 65.108.78.33:52222] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afOQ0g8tX7TbSfYoUIxhBgAAAJM"]
[Fri May 01 01:26:44.271663 2026] [:error] [pid 5731:tid 5749] [client 65.108.78.33:61004] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afOQ1A8tX7TbSfYoUIxhBwAAAI4"]
[Fri May 01 01:26:46.755396 2026] [:error] [pid 6456:tid 6466] [client 65.108.78.33:52238] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afOQ1kOBwsDodnkJK5yi3QAAAEg"]
[Fri May 01 01:26:48.805592 2026] [:error] [pid 5731:tid 5750] [client 65.108.78.33:61014] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afOQ2A8tX7TbSfYoUIxhCgAAAI8"]
[Fri May 01 01:26:51.282787 2026] [:error] [pid 5731:tid 5751] [client 65.108.78.33:52246] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afOQ2w8tX7TbSfYoUIxhDAAAAJA"]
[Fri May 01 01:26:53.828709 2026] [:error] [pid 5731:tid 5754] [client 65.108.78.33:56584] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afOQ3Q8tX7TbSfYoUIxhEgAAAJM"]
[Fri May 01 01:26:55.876355 2026] [:error] [pid 5731:tid 5742] [client 65.108.78.33:7200] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afOQ3w8tX7TbSfYoUIxhEwAAAIc"]
[Fri May 01 01:26:58.407460 2026] [:error] [pid 5733:tid 5806] [client 65.108.78.33:56598] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afOQ4vT55_Ioa9J2OpIaEgAAARA"]
[Fri May 01 01:27:00.988663 2026] [:error] [pid 6456:tid 6472] [client 65.108.78.33:56606] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afOQ5EOBwsDodnkJK5yi5gAAAE4"]
[Fri May 01 01:27:03.491976 2026] [:error] [pid 6456:tid 6478] [client 65.108.78.33:39388] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afOQ50OBwsDodnkJK5yi6AAAAFQ"]
[Fri May 01 01:27:05.918990 2026] [:error] [pid 21839:tid 21862] [client 65.108.78.33:39406] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afOQ6Z_Sh66m95WwxJ4ZXwAAAVQ"]
[Fri May 01 01:27:08.466791 2026] [:error] [pid 5731:tid 5751] [client 65.108.78.33:39434] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afOQ7A8tX7TbSfYoUIxhFQAAAJA"]
[Fri May 01 01:27:10.983449 2026] [:error] [pid 21839:tid 21849] [client 65.108.78.33:39442] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afOQ7p_Sh66m95WwxJ4ZYQAAAUc"]
[Fri May 01 01:27:13.442111 2026] [:error] [pid 5732:tid 5782] [client 65.108.78.33:13574] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afOQ8duJ3iSd5GdjqlhhDAAAANM"]
[Fri May 01 01:27:15.800376 2026] [:error] [pid 5731:tid 5739] [client 65.108.78.33:13584] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afOQ8w8tX7TbSfYoUIxhFwAAAIQ"]
[Fri May 01 01:27:18.353720 2026] [:error] [pid 5733:tid 5799] [client 65.108.78.33:13596] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afOQ9vT55_Ioa9J2OpIaHAAAAQk"]
[Fri May 01 01:27:20.933261 2026] [:error] [pid 21839:tid 21850] [client 65.108.78.33:13598] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afOQ-J_Sh66m95WwxJ4ZZAAAAUg"]
[Fri May 01 01:27:23.332218 2026] [:error] [pid 21839:tid 21846] [client 65.108.78.33:29812] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afOQ-5_Sh66m95WwxJ4ZZQAAAUQ"]
[Fri May 01 01:27:25.852798 2026] [:error] [pid 5731:tid 5757] [client 65.108.78.33:29824] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afOQ_Q8tX7TbSfYoUIxhGQAAAJY"]
[Fri May 01 01:27:28.361097 2026] [:error] [pid 21839:tid 21864] [client 65.108.78.33:29828] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afORAJ_Sh66m95WwxJ4ZaQAAAVY"]
[Fri May 01 01:27:30.899541 2026] [:error] [pid 5820:tid 5828] [client 65.108.78.33:29836] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afORAgyrLh3-LgH3Xv-AvAAAAAY"]
[Fri May 01 01:27:33.310591 2026] [:error] [pid 21839:tid 21845] [client 65.108.78.33:20308] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afORBZ_Sh66m95WwxJ4ZbwAAAUM"]
[Fri May 01 01:27:35.793807 2026] [:error] [pid 5731:tid 5740] [client 65.108.78.33:20316] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afORBw8tX7TbSfYoUIxhIQAAAIU"]
[Fri May 01 01:28:05.603931 2026] [:error] [pid 5732:tid 5768] [client 65.108.78.33:5274] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afORJduJ3iSd5GdjqlhhGQAAAMU"]
[Fri May 01 01:28:08.085945 2026] [:error] [pid 5731:tid 5735] [client 65.108.78.33:5284] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afORKA8tX7TbSfYoUIxhKgAAAIA"]
[Fri May 01 01:28:10.619960 2026] [:error] [pid 5732:tid 5763] [client 65.108.78.33:5298] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afORKtuJ3iSd5GdjqlhhHAAAAMA"]
[Fri May 01 01:28:12.578524 2026] [:error] [pid 21839:tid 21864] [client 65.108.78.33:63908] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afORLJ_Sh66m95WwxJ4ZfgAAAVY"]
[Fri May 01 01:28:15.027962 2026] [:error] [pid 5731:tid 5749] [client 65.108.78.33:46762] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afORLw8tX7TbSfYoUIxhLgAAAI4"]
[Fri May 01 01:28:17.661380 2026] [:error] [pid 6456:tid 6477] [client 65.108.78.33:46772] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afORMUOBwsDodnkJK5yi-wAAAFM"]
[Fri May 01 01:28:19.593244 2026] [:error] [pid 21839:tid 21854] [client 65.108.78.33:63920] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afORM5_Sh66m95WwxJ4ZgAAAAUw"]
[Fri May 01 01:28:22.056271 2026] [:error] [pid 21839:tid 21847] [client 65.108.78.33:46776] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afORNp_Sh66m95WwxJ4ZgQAAAUU"]
[Fri May 01 01:28:24.116599 2026] [:error] [pid 5732:tid 5778] [client 65.108.78.33:17128] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afORONuJ3iSd5GdjqlhhIgAAAM8"]
[Fri May 01 01:28:26.637912 2026] [:error] [pid 5733:tid 5806] [client 65.108.78.33:51030] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afOROvT55_Ioa9J2OpIaJgAAARA"]
[Fri May 01 01:28:28.715447 2026] [:error] [pid 5732:tid 5764] [client 65.108.78.33:17132] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afORPNuJ3iSd5GdjqlhhJwAAAME"]
[Fri May 01 01:28:31.207562 2026] [:error] [pid 6456:tid 6482] [client 65.108.78.33:51046] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afORP0OBwsDodnkJK5yi_gAAAFg"]
[Fri May 01 01:28:33.805230 2026] [:error] [pid 5733:tid 5796] [client 65.108.78.33:53830] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afORQfT55_Ioa9J2OpIaLgAAAQY"]
[Fri May 01 01:28:36.386297 2026] [:error] [pid 5733:tid 5802] [client 65.108.78.33:53834] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afORRPT55_Ioa9J2OpIaMwAAAQw"]
[Fri May 01 01:28:38.873033 2026] [:error] [pid 5732:tid 5781] [client 65.108.78.33:53846] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afORRtuJ3iSd5GdjqlhhLgAAANI"]
[Fri May 01 01:28:40.710997 2026] [:error] [pid 5733:tid 5801] [client 65.108.78.33:36938] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afORSPT55_Ioa9J2OpIaOAAAAQs"]
[Fri May 01 01:28:43.165950 2026] [:error] [pid 5733:tid 5811] [client 65.108.78.33:49100] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afORS_T55_Ioa9J2OpIaPwAAARU"]
[Fri May 01 01:28:45.170990 2026] [:error] [pid 5731:tid 5759] [client 65.108.78.33:25018] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afORTQ8tX7TbSfYoUIxhOAAAAJg"]
[Fri May 01 01:28:47.655287 2026] [:error] [pid 5733:tid 5803] [client 65.108.78.33:49112] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afORT_T55_Ioa9J2OpIaSwAAAQ0"]
[Fri May 01 01:28:50.164917 2026] [:error] [pid 5733:tid 5797] [client 65.108.78.33:49126] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afORUvT55_Ioa9J2OpIaVAAAAQc"]
[Fri May 01 01:28:52.639821 2026] [:error] [pid 5733:tid 5796] [client 65.108.78.33:13330] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afORVPT55_Ioa9J2OpIaWwAAAQY"]
[Fri May 01 01:28:55.126228 2026] [:error] [pid 21839:tid 21847] [client 65.108.78.33:13334] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afORV5_Sh66m95WwxJ4ZiwAAAUU"]
[Fri May 01 01:28:57.205916 2026] [:error] [pid 5731:tid 5752] [client 65.108.78.33:37270] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afORWQ8tX7TbSfYoUIxhQwAAAJE"]
[Fri May 01 01:28:59.115603 2026] [:error] [pid 6456:tid 6462] [client 65.108.78.33:37280] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afORW0OBwsDodnkJK5yjEQAAAEQ"]
[Fri May 01 01:29:01.145024 2026] [:error] [pid 5733:tid 5793] [client 65.108.78.33:37292] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afORXfT55_Ioa9J2OpIaXwAAAQM"]
[Fri May 01 04:34:15.086370 2026] [:error] [pid 7664:tid 7680] [client 104.28.214.115:54981] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "afO8x0zx1NAXBnPqdssHzAAAAMw"]
[Fri May 01 04:34:15.608530 2026] [:error] [pid 7664:tid 7689] [client 104.28.214.115:54986] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-content/style.php"] [unique_id "afO8x0zx1NAXBnPqdssHzQAAANU"]
[Fri May 01 04:56:40.337084 2026] [:error] [pid 38015:tid 38052] [client 92.53.64.155:58647] [client 92.53.64.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afPCCMNJWoh41gYMCSVpRAAAAEE"]
[Fri May 01 05:48:46.626977 2026] [:error] [pid 38014:tid 38047] [client 147.135.128.94:52310] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afPOPlHplhcdzdndjk0EVAAAABg"]
[Fri May 01 05:48:48.496679 2026] [:error] [pid 38015:tid 38070] [client 147.135.128.94:38080] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afPOQMNJWoh41gYMCSVuzwAAAFM"]
[Fri May 01 05:48:50.863215 2026] [:error] [pid 6045:tid 6076] [client 147.135.128.94:59600] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afPOQj4a1vLt_qHgXBSfFAAAAVU"]
[Fri May 01 05:48:52.881128 2026] [:error] [pid 38014:tid 38039] [client 147.135.128.94:38084] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afPORFHplhcdzdndjk0EVQAAABA"]
[Fri May 01 05:48:54.909965 2026] [:error] [pid 6046:tid 6086] [client 147.135.128.94:38098] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afPORoyBrpmb1HMIbiTQ7QAAAYI"]
[Fri May 01 05:48:57.427857 2026] [:error] [pid 6046:tid 6090] [client 147.135.128.94:59606] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afPOSYyBrpmb1HMIbiTQ9QAAAYY"]
[Fri May 01 05:48:59.441308 2026] [:error] [pid 6045:tid 6076] [client 147.135.128.94:37996] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afPOSz4a1vLt_qHgXBSfHAAAAVU"]
[Fri May 01 05:49:02.051295 2026] [:error] [pid 6046:tid 6086] [client 147.135.128.94:47424] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afPOToyBrpmb1HMIbiTRBwAAAYI"]
[Fri May 01 05:49:04.009691 2026] [:error] [pid 5976:tid 6000] [client 147.135.128.94:38006] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afPOULbCb0ye2WjKldd70gAAARQ"]
[Fri May 01 05:49:06.524524 2026] [:error] [pid 38014:tid 38042] [client 147.135.128.94:47428] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afPOUlHplhcdzdndjk0EYgAAABM"]
[Fri May 01 05:49:08.540983 2026] [:error] [pid 5976:tid 5981] [client 147.135.128.94:33574] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afPOVLbCb0ye2WjKldd71QAAAQE"]
[Fri May 01 05:49:10.563251 2026] [:error] [pid 38117:tid 38129] [client 147.135.128.94:33576] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afPOVmhRYBrFpu8czJo05QAAAMQ"]
[Fri May 01 05:49:13.044068 2026] [:error] [pid 6046:tid 6084] [client 147.135.128.94:56166] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afPOWYyBrpmb1HMIbiTRHQAAAYA"]
[Fri May 01 05:49:15.101135 2026] [:error] [pid 38014:tid 38047] [client 147.135.128.94:33592] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afPOW1Hplhcdzdndjk0EZQAAABg"]
[Fri May 01 05:49:16.955370 2026] [:error] [pid 38016:tid 38102] [client 147.135.128.94:33596] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afPOXJFc1DCPy0LM72bh2QAAAJc"]
[Fri May 01 05:49:19.442511 2026] [:error] [pid 6046:tid 6102] [client 147.135.128.94:54906] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afPOX4yBrpmb1HMIbiTRIgAAAZI"]
[Fri May 01 05:49:21.456005 2026] [:error] [pid 38016:tid 38080] [client 147.135.128.94:54448] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afPOYZFc1DCPy0LM72bh8wAAAII"]
[Fri May 01 05:49:23.947945 2026] [:error] [pid 6046:tid 6102] [client 147.135.128.94:54910] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afPOY4yBrpmb1HMIbiTRNAAAAZI"]
[Fri May 01 05:49:25.958125 2026] [:error] [pid 6046:tid 6090] [client 147.135.128.94:54464] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afPOZYyBrpmb1HMIbiTROAAAAYY"]
[Fri May 01 05:49:27.978905 2026] [:error] [pid 38015:tid 38071] [client 147.135.128.94:34000] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afPOZ8NJWoh41gYMCSVu2wAAAFQ"]
[Fri May 01 05:49:29.980402 2026] [:error] [pid 5976:tid 5985] [client 147.135.128.94:34010] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afPOabbCb0ye2WjKldd74AAAAQU"]
[Fri May 01 05:49:31.976408 2026] [:error] [pid 6046:tid 6095] [client 147.135.128.94:34018] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afPOa4yBrpmb1HMIbiTRQAAAAYs"]
[Fri May 01 05:49:33.996856 2026] [:error] [pid 5976:tid 6003] [client 147.135.128.94:34028] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afPObbbCb0ye2WjKldd75AAAARc"]
[Fri May 01 05:49:35.905888 2026] [:error] [pid 38014:tid 38027] [client 147.135.128.94:34032] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afPOb1Hplhcdzdndjk0EkQAAAAQ"]
[Fri May 01 05:49:38.387835 2026] [:error] [pid 5976:tid 5980] [client 147.135.128.94:60530] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afPOcrbCb0ye2WjKldd76QAAAQA"]
[Fri May 01 05:49:40.849429 2026] [:error] [pid 38117:tid 38147] [client 147.135.128.94:60534] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afPOdGhRYBrFpu8czJo07wAAANY"]
[Fri May 01 05:49:44.389043 2026] [:error] [pid 38014:tid 38026] [client 147.135.128.94:45662] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afPOeFHplhcdzdndjk0EkwAAAAM"]
[Fri May 01 05:50:06.858410 2026] [:error] [pid 6046:tid 6102] [client 147.135.128.94:46576] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afPOjoyBrpmb1HMIbiTRZgAAAZI"]
[Fri May 01 05:50:08.795207 2026] [:error] [pid 38117:tid 38138] [client 147.135.128.94:43842] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afPOkGhRYBrFpu8czJo0-gAAAM0"]
[Fri May 01 05:50:10.822853 2026] [:error] [pid 38016:tid 38098] [client 147.135.128.94:43844] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afPOkpFc1DCPy0LM72biDAAAAJM"]
[Fri May 01 05:50:12.835760 2026] [:error] [pid 6045:tid 6074] [client 147.135.128.94:43854] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afPOlD4a1vLt_qHgXBSfUwAAAVM"]
[Fri May 01 05:50:14.834456 2026] [:error] [pid 5976:tid 5997] [client 147.135.128.94:43862] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afPOlrbCb0ye2WjKldd7-QAAARE"]
[Fri May 01 05:50:16.837730 2026] [:error] [pid 38015:tid 38065] [client 147.135.128.94:43866] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afPOmMNJWoh41gYMCSVu5gAAAE4"]
[Fri May 01 05:50:18.837194 2026] [:error] [pid 38016:tid 38088] [client 147.135.128.94:39758] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afPOmpFc1DCPy0LM72biEAAAAIo"]
[Fri May 01 05:50:20.847313 2026] [:error] [pid 38117:tid 38141] [client 147.135.128.94:39772] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afPOnGhRYBrFpu8czJo0_gAAANA"]
[Fri May 01 05:50:22.856313 2026] [:error] [pid 5976:tid 5986] [client 147.135.128.94:39784] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afPOnrbCb0ye2WjKldd8AQAAAQY"]
[Fri May 01 05:50:24.867308 2026] [:error] [pid 38015:tid 38070] [client 147.135.128.94:39796] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afPOoMNJWoh41gYMCSVu7QAAAFM"]
[Fri May 01 05:50:26.863755 2026] [:error] [pid 38016:tid 38103] [client 147.135.128.94:39812] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afPOopFc1DCPy0LM72biEQAAAJg"]
[Fri May 01 05:50:28.877385 2026] [:error] [pid 5976:tid 5995] [client 147.135.128.94:51502] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afPOpLbCb0ye2WjKldd8BAAAAQ8"]
[Fri May 01 05:50:30.876443 2026] [:error] [pid 38015:tid 38065] [client 147.135.128.94:51518] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afPOpsNJWoh41gYMCSVu-AAAAE4"]
[Fri May 01 05:50:32.880568 2026] [:error] [pid 38117:tid 38149] [client 147.135.128.94:51520] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afPOqGhRYBrFpu8czJo1AgAAANg"]
[Fri May 01 05:50:34.902034 2026] [:error] [pid 38117:tid 38129] [client 147.135.128.94:51524] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afPOqmhRYBrFpu8czJo1CQAAAMQ"]
[Fri May 01 05:50:37.382254 2026] [:error] [pid 38117:tid 38136] [client 147.135.128.94:52918] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afPOrWhRYBrFpu8czJo1DAAAAMs"]
[Fri May 01 05:50:39.272911 2026] [:error] [pid 5976:tid 5991] [client 147.135.128.94:52924] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afPOr7bCb0ye2WjKldd8CAAAAQs"]
[Fri May 01 05:50:41.271208 2026] [:error] [pid 38015:tid 38067] [client 147.135.128.94:52940] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afPOscNJWoh41gYMCSVvBQAAAFA"]
[Fri May 01 05:50:43.278756 2026] [:error] [pid 5976:tid 5984] [client 147.135.128.94:52944] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afPOs7bCb0ye2WjKldd8CgAAAQQ"]
[Fri May 01 05:50:45.286696 2026] [:error] [pid 38015:tid 38061] [client 147.135.128.94:52954] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afPOtcNJWoh41gYMCSVvDAAAAEo"]
[Fri May 01 05:50:47.294315 2026] [:error] [pid 38015:tid 38062] [client 147.135.128.94:40328] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afPOt8NJWoh41gYMCSVvDQAAAEs"]
[Fri May 01 05:50:49.291941 2026] [:error] [pid 6045:tid 6070] [client 147.135.128.94:40342] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afPOuT4a1vLt_qHgXBSfaAAAAU8"]
[Fri May 01 05:50:51.289778 2026] [:error] [pid 38015:tid 38053] [client 147.135.128.94:40346] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afPOu8NJWoh41gYMCSVvDwAAAEI"]
[Fri May 01 05:50:53.328215 2026] [:error] [pid 6045:tid 6072] [client 147.135.128.94:40354] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afPOvT4a1vLt_qHgXBSfbAAAAVE"]
[Fri May 01 05:50:55.306329 2026] [:error] [pid 6046:tid 6107] [client 147.135.128.94:40364] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afPOv4yBrpmb1HMIbiTRdgAAAZc"]
[Fri May 01 05:50:57.309713 2026] [:error] [pid 38016:tid 38080] [client 147.135.128.94:41964] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afPOwZFc1DCPy0LM72biHQAAAII"]
[Fri May 01 05:50:59.142917 2026] [:error] [pid 6045:tid 6079] [client 147.135.128.94:41976] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afPOwz4a1vLt_qHgXBSfbgAAAVg"]
[Fri May 01 07:13:02.484065 2026] [:error] [pid 6045:tid 6069] [client 43.165.167.72:52308] [client 43.165.167.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afPh_j4a1vLt_qHgXBSx5QAAAU4"]
[Fri May 01 08:32:52.880691 2026] [:error] [pid 38014:tid 38045] [client 43.165.167.72:57762] [client 43.165.167.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afP0tFHplhcdzdndjk0cNgAAABY"]
[Fri May 01 13:12:09.167325 2026] [:error] [pid 24995:tid 25012] [client 114.119.144.29:53825] [client 114.119.144.29] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afQ2KedJG9WB_Q_ne0tuAQAAAE0"]
[Fri May 01 15:42:51.753150 2026] [:error] [pid 24996:tid 25043] [client 162.62.213.187:42310] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afRZeyDBq9mMfUWQQeooeAAAAI4"]
[Fri May 01 15:44:45.376115 2026] [:error] [pid 33791:tid 33802] [client 217.182.195.233:40460] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afRZ7W9ixd-moLycM9CnbAAAAAg"]
[Fri May 01 15:44:47.242799 2026] [:error] [pid 33791:tid 33812] [client 217.182.195.233:37662] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afRZ729ixd-moLycM9CncgAAABI"]
[Fri May 01 15:44:49.375217 2026] [:error] [pid 24995:tid 25020] [client 217.182.195.233:37666] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afRZ8edJG9WB_Q_ne0uJjQAAAFU"]
[Fri May 01 15:44:51.189278 2026] [:error] [pid 24997:tid 25069] [client 217.182.195.233:51828] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afRZ8_OkHa4ScY5oo8yJRwAAAM0"]
[Fri May 01 15:44:53.099230 2026] [:error] [pid 24996:tid 25049] [client 217.182.195.233:51830] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afRZ9SDBq9mMfUWQQeopLQAAAJM"]
[Fri May 01 15:44:55.008152 2026] [:error] [pid 24995:tid 25001] [client 217.182.195.233:51842] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afRZ9-dJG9WB_Q_ne0uJlwAAAEI"]
[Fri May 01 15:44:56.790963 2026] [:error] [pid 25085:tid 25103] [client 217.182.195.233:51854] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afRZ-PuD8fWRiE0RX0HLvgAAAUw"]
[Fri May 01 15:44:58.887054 2026] [:error] [pid 25085:tid 25106] [client 217.182.195.233:51860] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afRZ-vuD8fWRiE0RX0HLwAAAAU8"]
[Fri May 01 15:45:01.035033 2026] [:error] [pid 24997:tid 25074] [client 217.182.195.233:41414] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afRZ_fOkHa4ScY5oo8yJXgAAANI"]
[Fri May 01 15:45:03.069339 2026] [:error] [pid 24996:tid 25041] [client 217.182.195.233:41422] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afRZ_yDBq9mMfUWQQeopOwAAAI0"]
[Fri May 01 15:45:05.105402 2026] [:error] [pid 33791:tid 33809] [client 217.182.195.233:41436] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afRaAW9ixd-moLycM9CnhAAAAA8"]
[Fri May 01 15:45:07.169083 2026] [:error] [pid 24997:tid 25070] [client 217.182.195.233:41440] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afRaA_OkHa4ScY5oo8yJbAAAAM4"]
[Fri May 01 15:45:09.212946 2026] [:error] [pid 25085:tid 25098] [client 217.182.195.233:41446] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afRaBfuD8fWRiE0RX0HLygAAAUc"]
[Fri May 01 15:45:11.124522 2026] [:error] [pid 33791:tid 33815] [client 217.182.195.233:34444] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afRaB29ixd-moLycM9CnlwAAABU"]
[Fri May 01 15:45:13.178455 2026] [:error] [pid 24997:tid 25058] [client 217.182.195.233:34446] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afRaCfOkHa4ScY5oo8yJcgAAAMQ"]
[Fri May 01 15:45:15.080726 2026] [:error] [pid 24997:tid 25063] [client 217.182.195.233:34452] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afRaC_OkHa4ScY5oo8yJdQAAAMc"]
[Fri May 01 15:45:16.985919 2026] [:error] [pid 33791:tid 33806] [client 217.182.195.233:34462] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afRaDG9ixd-moLycM9CnrwAAAAw"]
[Fri May 01 15:45:18.778252 2026] [:error] [pid 25085:tid 25111] [client 217.182.195.233:34476] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afRaDvuD8fWRiE0RX0HLzQAAAVQ"]
[Fri May 01 15:45:20.682423 2026] [:error] [pid 25085:tid 25104] [client 217.182.195.233:56072] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afRaEPuD8fWRiE0RX0HL1AAAAU0"]
[Fri May 01 15:45:22.627381 2026] [:error] [pid 25085:tid 25114] [client 217.182.195.233:56080] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afRaEvuD8fWRiE0RX0HL2QAAAVc"]
[Fri May 01 16:19:38.303773 2026] [:error] [pid 33791:tid 33800] [client 54.37.86.223:45852] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afRiGm9ixd-moLycM9C3ZQAAAAY"]
[Fri May 01 16:19:40.146643 2026] [:error] [pid 24997:tid 25076] [client 54.37.86.223:60226] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afRiHPOkHa4ScY5oo8yUDwAAANQ"]
[Fri May 01 16:19:42.170384 2026] [:error] [pid 33791:tid 33816] [client 54.37.86.223:42174] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afRiHm9ixd-moLycM9C3cgAAABY"]
[Fri May 01 16:19:44.202199 2026] [:error] [pid 33791:tid 33804] [client 54.37.86.223:42180] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afRiIG9ixd-moLycM9C3egAAAAo"]
[Fri May 01 16:19:46.074824 2026] [:error] [pid 24997:tid 25064] [client 54.37.86.223:42182] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afRiIvOkHa4ScY5oo8yUEwAAAMg"]
[Fri May 01 16:19:48.101737 2026] [:error] [pid 24996:tid 25053] [client 54.37.86.223:42190] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afRiJCDBq9mMfUWQQeowzwAAAJU"]
[Fri May 01 16:19:50.002172 2026] [:error] [pid 33791:tid 33806] [client 54.37.86.223:42206] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afRiJm9ixd-moLycM9C3fQAAAAw"]
[Fri May 01 16:19:52.045416 2026] [:error] [pid 33791:tid 33808] [client 54.37.86.223:37118] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afRiKG9ixd-moLycM9C3gwAAAA4"]
[Fri May 01 16:19:53.901652 2026] [:error] [pid 33791:tid 33809] [client 54.37.86.223:37122] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afRiKW9ixd-moLycM9C3hQAAAA8"]
[Fri May 01 16:19:55.927909 2026] [:error] [pid 24997:tid 25074] [client 54.37.86.223:37136] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afRiK_OkHa4ScY5oo8yUKAAAANI"]
[Fri May 01 16:19:57.810668 2026] [:error] [pid 24995:tid 25002] [client 54.37.86.223:37142] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afRiLedJG9WB_Q_ne0uPwgAAAEM"]
[Fri May 01 16:19:59.835348 2026] [:error] [pid 33791:tid 33795] [client 54.37.86.223:37154] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afRiL29ixd-moLycM9C3jAAAAAE"]
[Fri May 01 16:20:01.865977 2026] [:error] [pid 33791:tid 33801] [client 54.37.86.223:53370] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afRiMW9ixd-moLycM9C3kAAAAAc"]
[Fri May 01 16:20:03.886645 2026] [:error] [pid 24997:tid 25072] [client 54.37.86.223:53380] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afRiM_OkHa4ScY5oo8yUSgAAANA"]
[Fri May 01 16:20:05.892378 2026] [:error] [pid 25085:tid 25110] [client 54.37.86.223:53388] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afRiNfuD8fWRiE0RX0HTfAAAAVM"]
[Fri May 01 16:20:07.771974 2026] [:error] [pid 33791:tid 33803] [client 54.37.86.223:53402] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afRiN29ixd-moLycM9C3lgAAAAk"]
[Fri May 01 16:20:09.795814 2026] [:error] [pid 33791:tid 33795] [client 54.37.86.223:53418] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afRiOW9ixd-moLycM9C3ngAAAAE"]
[Fri May 01 16:20:11.663323 2026] [:error] [pid 24996:tid 25040] [client 54.37.86.223:40994] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afRiOyDBq9mMfUWQQeow9AAAAIw"]
[Fri May 01 16:20:13.680103 2026] [:error] [pid 24997:tid 25074] [client 54.37.86.223:41008] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afRiPfOkHa4ScY5oo8yUTwAAANI"]
[Fri May 01 16:20:15.698285 2026] [:error] [pid 33791:tid 33795] [client 54.37.86.223:41014] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afRiP29ixd-moLycM9C3qwAAAAE"]
[Fri May 01 16:20:17.724336 2026] [:error] [pid 33791:tid 33798] [client 54.37.86.223:41024] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afRiQW9ixd-moLycM9C3tgAAAAQ"]
[Fri May 01 16:20:19.763685 2026] [:error] [pid 33791:tid 33798] [client 54.37.86.223:41034] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afRiQ29ixd-moLycM9C3vQAAAAQ"]
[Fri May 01 16:20:21.602875 2026] [:error] [pid 25085:tid 25101] [client 54.37.86.223:55118] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afRiRfuD8fWRiE0RX0HTgAAAAUo"]
[Fri May 01 16:20:23.637671 2026] [:error] [pid 25085:tid 25112] [client 54.37.86.223:55122] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afRiR_uD8fWRiE0RX0HThwAAAVU"]
[Fri May 01 16:20:25.655702 2026] [:error] [pid 33791:tid 33812] [client 54.37.86.223:55132] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afRiSW9ixd-moLycM9C3xQAAABI"]
[Fri May 01 16:20:27.591223 2026] [:error] [pid 24996:tid 25033] [client 54.37.86.223:55140] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afRiSyDBq9mMfUWQQeow9gAAAIU"]
[Fri May 01 16:20:29.553301 2026] [:error] [pid 33791:tid 33802] [client 54.37.86.223:55148] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afRiTW9ixd-moLycM9C3zAAAAAg"]
[Fri May 01 16:20:31.566421 2026] [:error] [pid 25085:tid 25093] [client 54.37.86.223:57186] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afRiT_uD8fWRiE0RX0HTjgAAAUI"]
[Fri May 01 16:20:33.822352 2026] [:error] [pid 33791:tid 33803] [client 54.37.86.223:57202] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afRiUW9ixd-moLycM9C32AAAAAk"]
[Fri May 01 16:20:56.422071 2026] [:error] [pid 25085:tid 25098] [client 54.37.86.223:57204] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afRiaPuD8fWRiE0RX0HTpAAAAUc"]
[Fri May 01 16:20:58.358346 2026] [:error] [pid 24997:tid 25069] [client 54.37.86.223:51854] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afRiavOkHa4ScY5oo8yUgAAAAM0"]
[Fri May 01 16:21:00.359937 2026] [:error] [pid 24995:tid 25003] [client 54.37.86.223:51858] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afRibOdJG9WB_Q_ne0uP2QAAAEQ"]
[Fri May 01 17:30:43.858378 2026] [:error] [pid 24997:tid 25071] [client 38.242.239.223:47132] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afRyw_OkHa4ScY5oo8ynUgAAAM8"]
[Fri May 01 17:30:45.595408 2026] [:error] [pid 24996:tid 25037] [client 38.242.239.223:33062] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afRyxSDBq9mMfUWQQeo9bQAAAIk"]
[Fri May 01 17:30:47.660906 2026] [:error] [pid 25085:tid 25108] [client 38.242.239.223:51506] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afRyx_uD8fWRiE0RX0HjCQAAAVE"]
[Fri May 01 17:30:50.314656 2026] [:error] [pid 24996:tid 25041] [client 38.242.239.223:49802] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afRyyiDBq9mMfUWQQeo9cwAAAI0"]
[Fri May 01 17:30:52.463309 2026] [:error] [pid 24996:tid 25035] [client 38.242.239.223:44522] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afRyzCDBq9mMfUWQQeo9dgAAAIc"]
[Fri May 01 17:30:54.473788 2026] [:error] [pid 24996:tid 25029] [client 38.242.239.223:44530] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afRyziDBq9mMfUWQQeo9eQAAAIE"]
[Fri May 01 17:30:56.549525 2026] [:error] [pid 24996:tid 25041] [client 38.242.239.223:44538] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afRy0CDBq9mMfUWQQeo9fwAAAI0"]
[Fri May 01 17:30:58.751863 2026] [:error] [pid 24997:tid 25077] [client 38.242.239.223:43860] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afRy0vOkHa4ScY5oo8ynWQAAANU"]
[Fri May 01 17:31:00.820837 2026] [:error] [pid 24996:tid 25037] [client 38.242.239.223:43874] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afRy1CDBq9mMfUWQQeo9gQAAAIk"]
[Fri May 01 17:31:03.777194 2026] [:error] [pid 33791:tid 33817] [client 38.242.239.223:34996] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afRy129ixd-moLycM9DP7QAAABc"]
[Fri May 01 17:31:06.425214 2026] [:error] [pid 33791:tid 33809] [client 38.242.239.223:35008] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afRy2m9ixd-moLycM9DP_wAAAA8"]
[Fri May 01 17:31:08.438201 2026] [:error] [pid 24997:tid 25074] [client 38.242.239.223:43886] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afRy3POkHa4ScY5oo8ynlQAAANI"]
[Fri May 01 17:31:11.065508 2026] [:error] [pid 25085:tid 25103] [client 38.242.239.223:33846] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afRy3_uD8fWRiE0RX0HjNAAAAUw"]
[Fri May 01 17:31:13.645138 2026] [:error] [pid 33791:tid 33809] [client 38.242.239.223:33856] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afRy4W9ixd-moLycM9DQCQAAAA8"]
[Fri May 01 17:31:16.523955 2026] [:error] [pid 24995:tid 25003] [client 38.242.239.223:33870] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afRy5OdJG9WB_Q_ne0uaogAAAEQ"]
[Fri May 01 17:31:19.108302 2026] [:error] [pid 24995:tid 25011] [client 38.242.239.223:33884] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afRy5-dJG9WB_Q_ne0uaqQAAAEw"]
[Fri May 01 17:31:21.157161 2026] [:error] [pid 33791:tid 33801] [client 38.242.239.223:39604] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afRy6W9ixd-moLycM9DQDgAAAAc"]
[Fri May 01 17:31:23.858332 2026] [:error] [pid 25085:tid 25100] [client 38.242.239.223:34614] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afRy6_uD8fWRiE0RX0HjOgAAAUk"]
[Fri May 01 17:31:26.008589 2026] [:error] [pid 33791:tid 33794] [client 38.242.239.223:39612] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afRy7m9ixd-moLycM9DQHwAAAAA"]
[Fri May 01 17:31:28.102608 2026] [:error] [pid 24996:tid 25032] [client 38.242.239.223:39628] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afRy8CDBq9mMfUWQQeo9kQAAAIQ"]
[Fri May 01 17:31:30.087818 2026] [:error] [pid 24996:tid 25047] [client 38.242.239.223:55064] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afRy8iDBq9mMfUWQQeo9lAAAAJE"]
[Fri May 01 17:31:32.166974 2026] [:error] [pid 24996:tid 25033] [client 38.242.239.223:55068] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afRy9CDBq9mMfUWQQeo9mAAAAIU"]
[Fri May 01 17:31:34.911279 2026] [:error] [pid 24997:tid 25064] [client 38.242.239.223:58902] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afRy9vOkHa4ScY5oo8ynrwAAAMg"]
[Fri May 01 17:31:36.881597 2026] [:error] [pid 33791:tid 33797] [client 38.242.239.223:55078] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afRy-G9ixd-moLycM9DQNAAAAAM"]
[Fri May 01 17:31:39.500766 2026] [:error] [pid 33791:tid 33809] [client 38.242.239.223:55340] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afRy-29ixd-moLycM9DQRAAAAA8"]
[Fri May 01 17:31:41.583564 2026] [:error] [pid 25085:tid 25101] [client 38.242.239.223:39238] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afRy_fuD8fWRiE0RX0HjRAAAAUo"]
[Fri May 01 17:32:06.890284 2026] [:error] [pid 25085:tid 25110] [client 38.242.239.223:55362] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afRzFvuD8fWRiE0RX0HjagAAAVM"]
[Fri May 01 17:32:08.566330 2026] [:error] [pid 24995:tid 25023] [client 38.242.239.223:37702] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afRzGOdJG9WB_Q_ne0uawQAAAFg"]
[Fri May 01 17:32:11.090374 2026] [:error] [pid 24997:tid 25065] [client 38.242.239.223:44982] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afRzG_OkHa4ScY5oo8yn9QAAAMk"]
[Fri May 01 17:32:13.173548 2026] [:error] [pid 33791:tid 33796] [client 38.242.239.223:50758] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afRzHW9ixd-moLycM9DQqQAAAAI"]
[Fri May 01 17:32:15.781772 2026] [:error] [pid 24996:tid 25053] [client 38.242.239.223:44988] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afRzHyDBq9mMfUWQQeo9pgAAAJU"]
[Fri May 01 17:32:17.707543 2026] [:error] [pid 24997:tid 25054] [client 38.242.239.223:50774] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afRzIfOkHa4ScY5oo8yoCgAAAMM"]
[Fri May 01 17:32:19.729631 2026] [:error] [pid 24997:tid 25074] [client 38.242.239.223:60040] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afRzI_OkHa4ScY5oo8yoDQAAANI"]
[Fri May 01 17:32:22.376118 2026] [:error] [pid 33791:tid 33803] [client 38.242.239.223:47632] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afRzJm9ixd-moLycM9DQtwAAAAk"]
[Fri May 01 17:32:25.178919 2026] [:error] [pid 24996:tid 25047] [client 38.242.239.223:47634] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afRzKSDBq9mMfUWQQeo9rgAAAJE"]
[Fri May 01 17:32:27.622460 2026] [:error] [pid 33791:tid 33814] [client 38.242.239.223:47646] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afRzK29ixd-moLycM9DQxgAAABQ"]
[Fri May 01 17:32:30.206664 2026] [:error] [pid 25085:tid 25110] [client 38.242.239.223:54674] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afRzLvuD8fWRiE0RX0HjggAAAVM"]
[Fri May 01 17:32:32.667765 2026] [:error] [pid 24997:tid 25073] [client 38.242.239.223:54676] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afRzMPOkHa4ScY5oo8yoHQAAANE"]
[Fri May 01 17:32:35.447345 2026] [:error] [pid 24995:tid 25015] [client 38.242.239.223:54678] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afRzM-dJG9WB_Q_ne0ua0gAAAFA"]
[Fri May 01 17:32:38.026748 2026] [:error] [pid 33791:tid 33799] [client 38.242.239.223:54692] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afRzNm9ixd-moLycM9DQ2AAAAAU"]
[Fri May 01 17:32:40.674781 2026] [:error] [pid 24997:tid 25069] [client 38.242.239.223:46514] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afRzOPOkHa4ScY5oo8yoJQAAAM0"]
[Fri May 01 17:32:43.194073 2026] [:error] [pid 25085:tid 25111] [client 38.242.239.223:46528] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afRzO_uD8fWRiE0RX0HjlgAAAVQ"]
[Fri May 01 17:32:45.948715 2026] [:error] [pid 24996:tid 25048] [client 38.242.239.223:46532] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afRzPSDBq9mMfUWQQeo9xQAAAJI"]
[Fri May 01 17:32:47.892157 2026] [:error] [pid 24996:tid 25057] [client 38.242.239.223:38462] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afRzPyDBq9mMfUWQQeo9yAAAAJc"]
[Fri May 01 17:32:51.767055 2026] [:error] [pid 25085:tid 25100] [client 38.242.239.223:54284] [client 38.242.239.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afRzQ_uD8fWRiE0RX0HjpwAAAUk"]
[Fri May 01 18:12:40.140560 2026] [:error] [pid 24997:tid 25071] [client 34.63.123.63:60469] [client 34.63.123.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.123.63, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afR8mPOkHa4ScY5oo8yyvgAAAM8"]
[Fri May 01 18:12:40.150803 2026] [proxy_fcgi:error] [pid 24997:tid 25071] [client 34.63.123.63:60469] AH01071: Got error 'Primary script unknown'
[Fri May 01 18:12:42.575283 2026] [:error] [pid 24997:tid 25070] [client 34.63.123.63:60469] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "afR8mvOkHa4ScY5oo8yyzwAAAM4"]
[Fri May 01 18:12:43.005089 2026] [:error] [pid 24996:tid 25053] [client 34.63.123.63:55790] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "afR8myDBq9mMfUWQQepEdwAAAJU"]
[Fri May 01 18:12:43.432643 2026] [:error] [pid 24997:tid 25074] [client 34.63.123.63:52125] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "afR8m_OkHa4ScY5oo8yy0gAAANI"]
[Fri May 01 18:12:43.859866 2026] [:error] [pid 25085:tid 25111] [client 34.63.123.63:50326] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "afR8m_uD8fWRiE0RX0Hr7QAAAVQ"]
[Fri May 01 18:12:44.298171 2026] [:error] [pid 25085:tid 25094] [client 34.63.123.63:57032] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "afR8nPuD8fWRiE0RX0Hr7wAAAUM"]
[Fri May 01 18:12:44.735510 2026] [:error] [pid 25085:tid 25112] [client 34.63.123.63:60702] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "afR8nPuD8fWRiE0RX0Hr8gAAAVU"]
[Fri May 01 18:12:45.162668 2026] [:error] [pid 33791:tid 33802] [client 34.63.123.63:52807] [client 34.63.123.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "afR8nW9ixd-moLycM9DfTwAAAAg"]
[Fri May 01 20:58:30.441893 2026] [:error] [pid 24996:tid 25053] [client 147.135.252.179:59292] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afSjdiDBq9mMfUWQQepqIwAAAJU"]
[Fri May 01 20:58:33.514052 2026] [:error] [pid 24997:tid 25046] [client 147.135.252.179:34760] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afSjefOkHa4ScY5oo8zZewAAAMA"]
[Fri May 01 20:58:37.270374 2026] [:error] [pid 24997:tid 25066] [client 147.135.252.179:34774] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afSjffOkHa4ScY5oo8zZfQAAAMo"]
[Fri May 01 20:58:46.399643 2026] [:error] [pid 24996:tid 25033] [client 147.135.252.179:52450] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afSjhiDBq9mMfUWQQepqRwAAAIU"]
[Fri May 01 20:58:53.110642 2026] [:error] [pid 24996:tid 25036] [client 147.135.252.179:59042] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afSjjSDBq9mMfUWQQepqVgAAAIg"]
[Fri May 01 20:59:01.332353 2026] [:error] [pid 33791:tid 33808] [client 147.135.252.179:42112] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afSjlW9ixd-moLycM9AXiAAAAA4"]
[Fri May 01 20:59:06.981886 2026] [:error] [pid 24996:tid 25047] [client 147.135.252.179:44050] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afSjmiDBq9mMfUWQQepqdgAAAJE"]
[Fri May 01 20:59:14.417149 2026] [:error] [pid 33791:tid 33816] [client 147.135.252.179:47126] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afSjom9ixd-moLycM9AXqgAAABY"]
[Fri May 01 20:59:20.123118 2026] [:error] [pid 25085:tid 25094] [client 147.135.252.179:34090] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afSjqPuD8fWRiE0RX0ELhwAAAUM"]
[Fri May 01 20:59:24.216823 2026] [:error] [pid 24995:tid 25020] [client 147.135.252.179:51446] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afSjrOdJG9WB_Q_ne0u2fgAAAFU"]
[Fri May 01 21:01:11.255940 2026] [:error] [pid 33791:tid 33807] [client 147.135.252.179:59376] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afSkF29ixd-moLycM9AYUQAAAA0"]
[Fri May 01 21:01:13.244227 2026] [:error] [pid 24996:tid 25051] [client 147.135.252.179:59888] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afSkGSDBq9mMfUWQQeprXAAAAJQ"]
[Fri May 01 21:01:15.183973 2026] [:error] [pid 24996:tid 25030] [client 147.135.252.179:59902] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afSkGyDBq9mMfUWQQeprYAAAAII"]
[Fri May 01 21:01:17.109017 2026] [:error] [pid 33791:tid 33814] [client 147.135.252.179:59910] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afSkHW9ixd-moLycM9AYVAAAABQ"]
[Fri May 01 21:01:19.184655 2026] [:error] [pid 25320:tid 25346] [client 147.135.252.179:40324] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afSkH1c3wJ-3-XaXB3oOYAAAARc"]
[Fri May 01 21:01:21.061685 2026] [:error] [pid 24996:tid 25041] [client 147.135.252.179:40336] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afSkISDBq9mMfUWQQeprZgAAAI0"]
[Fri May 01 21:01:22.906074 2026] [:error] [pid 33791:tid 33806] [client 147.135.252.179:40344] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afSkIm9ixd-moLycM9AYXwAAAAw"]
[Fri May 01 21:01:25.000590 2026] [:error] [pid 33791:tid 33795] [client 147.135.252.179:40354] [client 147.135.252.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afSkJG9ixd-moLycM9AYYwAAAAE"]
[Fri May 01 21:13:34.993871 2026] [:error] [pid 24995:tid 25008] [client 43.166.136.24:37110] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afSm_udJG9WB_Q_ne0u4EwAAAEk"]
[Fri May 01 21:38:34.670420 2026] [:error] [pid 25085:tid 25115] [client 193.70.46.175:49020] [client 193.70.46.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afSs2vuD8fWRiE0RX0EQhwAAAVg"]
[Fri May 01 21:38:37.010324 2026] [:error] [pid 24996:tid 25031] [client 193.70.46.175:52476] [client 193.70.46.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afSs3SDBq9mMfUWQQep4GgAAAIM"]
[Fri May 01 21:38:44.280124 2026] [:error] [pid 25320:tid 25331] [client 193.70.46.175:56844] [client 193.70.46.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afSs5Fc3wJ-3-XaXB3oVWwAAAQg"]
[Fri May 01 21:38:48.090411 2026] [:error] [pid 24996:tid 25037] [client 193.70.46.175:56848] [client 193.70.46.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afSs6CDBq9mMfUWQQep4NAAAAIk"]
[Fri May 01 22:17:42.124378 2026] [:error] [pid 33791:tid 33798] [client 111.230.233.46:37450] [client 111.230.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afS2Bm9ixd-moLycM9AtcwAAAAQ"]
[Fri May 01 22:18:33.830484 2026] [:error] [pid 24996:tid 25031] [client 212.227.21.19:14196] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afS2OSDBq9mMfUWQQeqBXgAAAIM"]
[Fri May 01 22:18:36.141450 2026] [:error] [pid 33791:tid 33797] [client 212.227.21.19:14212] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afS2PG9ixd-moLycM9AtxwAAAAM"]
[Fri May 01 22:18:37.951756 2026] [:error] [pid 33791:tid 33802] [client 212.227.21.19:1296] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afS2PW9ixd-moLycM9AtzgAAAAg"]
[Fri May 01 22:18:40.528923 2026] [:error] [pid 33791:tid 33805] [client 212.227.21.19:38518] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afS2QG9ixd-moLycM9At1QAAAAs"]
[Fri May 01 22:18:42.451829 2026] [:error] [pid 24997:tid 25080] [client 212.227.21.19:1308] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afS2QvOkHa4ScY5oo8zkpgAAANg"]
[Fri May 01 22:18:44.992481 2026] [:error] [pid 24995:tid 25001] [client 212.227.21.19:38530] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afS2ROdJG9WB_Q_ne0u_OgAAAEI"]
[Fri May 01 22:18:47.496349 2026] [:error] [pid 24996:tid 25044] [client 212.227.21.19:38542] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afS2RyDBq9mMfUWQQeqBbQAAAI8"]
[Fri May 01 22:18:49.353962 2026] [:error] [pid 50214:tid 50219] [client 212.227.21.19:50512] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afS2SYs0pgrtfZkbhjNytgAAAYE"]
[Fri May 01 22:18:51.708050 2026] [:error] [pid 24995:tid 25014] [client 212.227.21.19:42550] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afS2S-dJG9WB_Q_ne0u_PwAAAE8"]
[Fri May 01 22:18:54.049071 2026] [:error] [pid 24996:tid 25045] [client 212.227.21.19:42554] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afS2TiDBq9mMfUWQQeqBdQAAAJA"]
[Fri May 01 22:18:56.556955 2026] [:error] [pid 33791:tid 33818] [client 212.227.21.19:42558] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afS2UG9ixd-moLycM9At8AAAABg"]
[Fri May 01 22:18:58.933214 2026] [:error] [pid 33791:tid 33818] [client 212.227.21.19:53178] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afS2Um9ixd-moLycM9At_wAAABg"]
[Fri May 01 22:19:01.286877 2026] [:error] [pid 50214:tid 50235] [client 212.227.21.19:53180] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afS2VYs0pgrtfZkbhjNyzQAAAZE"]
[Fri May 01 22:19:03.816485 2026] [:error] [pid 25085:tid 25104] [client 212.227.21.19:53182] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afS2V_uD8fWRiE0RX0EVWQAAAU0"]
[Fri May 01 22:19:06.283456 2026] [:error] [pid 24996:tid 25028] [client 212.227.21.19:53184] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afS2WiDBq9mMfUWQQeqBhwAAAIA"]
[Fri May 01 22:19:08.840058 2026] [:error] [pid 24996:tid 25041] [client 212.227.21.19:2874] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afS2XCDBq9mMfUWQQeqBigAAAI0"]
[Fri May 01 22:19:11.363434 2026] [:error] [pid 25320:tid 25346] [client 212.227.21.19:2880] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afS2X1c3wJ-3-XaXB3odQQAAARc"]
[Fri May 01 22:19:13.963073 2026] [:error] [pid 24996:tid 25038] [client 212.227.21.19:2882] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afS2YSDBq9mMfUWQQeqBmgAAAIo"]
[Fri May 01 22:19:16.281671 2026] [:error] [pid 33791:tid 33794] [client 212.227.21.19:2884] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afS2ZG9ixd-moLycM9AuCQAAAAA"]
[Fri May 01 22:19:18.837158 2026] [:error] [pid 33791:tid 33802] [client 212.227.21.19:29030] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afS2Zm9ixd-moLycM9AuEAAAAAg"]
[Fri May 01 22:19:21.347901 2026] [:error] [pid 33791:tid 33797] [client 212.227.21.19:29034] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afS2aW9ixd-moLycM9AuEgAAAAM"]
[Fri May 01 22:19:23.706954 2026] [:error] [pid 24997:tid 25062] [client 212.227.21.19:29044] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afS2a_OkHa4ScY5oo8zkzQAAAMY"]
[Fri May 01 22:19:26.047618 2026] [:error] [pid 50214:tid 50237] [client 212.227.21.19:29060] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afS2bos0pgrtfZkbhjNy4AAAAZM"]
[Fri May 01 22:19:28.537075 2026] [:error] [pid 25085:tid 25113] [client 212.227.21.19:17316] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afS2cPuD8fWRiE0RX0EVZQAAAVY"]
[Fri May 01 22:19:30.899913 2026] [:error] [pid 25320:tid 25326] [client 212.227.21.19:17332] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afS2clc3wJ-3-XaXB3odTAAAAQM"]
[Fri May 01 22:19:59.439332 2026] [:error] [pid 25320:tid 25333] [client 212.227.21.19:1176] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afS2j1c3wJ-3-XaXB3odaQAAAQo"]
[Fri May 01 22:20:01.920608 2026] [:error] [pid 25320:tid 25324] [client 212.227.21.19:1188] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afS2kVc3wJ-3-XaXB3odbwAAAQE"]
[Fri May 01 22:20:03.906484 2026] [:error] [pid 25320:tid 25333] [client 212.227.21.19:43632] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afS2k1c3wJ-3-XaXB3odcwAAAQo"]
[Fri May 01 22:20:06.230467 2026] [:error] [pid 33791:tid 33813] [client 212.227.21.19:1190] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afS2lm9ixd-moLycM9AuMAAAABM"]
[Fri May 01 22:20:08.748099 2026] [:error] [pid 33791:tid 33817] [client 212.227.21.19:65168] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afS2mG9ixd-moLycM9AuNgAAABc"]
[Fri May 01 22:20:10.595872 2026] [:error] [pid 24995:tid 24999] [client 212.227.21.19:55252] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afS2mudJG9WB_Q_ne0u_aAAAAEA"]
[Fri May 01 22:20:13.120645 2026] [:error] [pid 33791:tid 33794] [client 212.227.21.19:65180] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afS2nW9ixd-moLycM9AuQgAAAAA"]
[Fri May 01 22:20:15.092159 2026] [:error] [pid 33791:tid 33808] [client 212.227.21.19:55258] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afS2n29ixd-moLycM9AuRQAAAA4"]
[Fri May 01 22:20:17.533158 2026] [:error] [pid 50214:tid 50242] [client 212.227.21.19:65184] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afS2oYs0pgrtfZkbhjNy7gAAAZc"]
[Fri May 01 22:20:19.494737 2026] [:error] [pid 25085:tid 25110] [client 212.227.21.19:44740] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afS2o_uD8fWRiE0RX0EVewAAAVM"]
[Fri May 01 22:20:21.886450 2026] [:error] [pid 50214:tid 50222] [client 212.227.21.19:57510] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afS2pYs0pgrtfZkbhjNy8gAAAYQ"]
[Fri May 01 22:20:24.396569 2026] [:error] [pid 33791:tid 33810] [client 212.227.21.19:57520] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afS2qG9ixd-moLycM9AuWAAAABA"]
[Fri May 01 22:20:26.865020 2026] [:error] [pid 25085:tid 25101] [client 212.227.21.19:57528] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afS2qvuD8fWRiE0RX0EVfwAAAUo"]
[Fri May 01 22:20:29.304994 2026] [:error] [pid 50214:tid 50241] [client 212.227.21.19:45908] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afS2rYs0pgrtfZkbhjNy-QAAAZY"]
[Fri May 01 22:20:31.294883 2026] [:error] [pid 33791:tid 33805] [client 212.227.21.19:39874] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afS2r29ixd-moLycM9AuXwAAAAs"]
[Fri May 01 22:20:33.865719 2026] [:error] [pid 24996:tid 25043] [client 212.227.21.19:45922] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afS2sSDBq9mMfUWQQeqBtgAAAI4"]
[Fri May 01 22:20:35.938343 2026] [:error] [pid 24996:tid 25031] [client 212.227.21.19:39882] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afS2syDBq9mMfUWQQeqBvQAAAIM"]
[Fri May 01 22:20:38.434279 2026] [:error] [pid 33791:tid 33803] [client 212.227.21.19:18496] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afS2tm9ixd-moLycM9AuYwAAAAk"]
[Fri May 01 22:20:40.925779 2026] [:error] [pid 33791:tid 33814] [client 212.227.21.19:18498] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afS2uG9ixd-moLycM9AuaAAAABQ"]
[Fri May 01 22:20:43.292477 2026] [:error] [pid 33791:tid 33809] [client 212.227.21.19:18512] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afS2u29ixd-moLycM9AubwAAAA8"]
[Fri May 01 22:20:45.816060 2026] [:error] [pid 24996:tid 25036] [client 212.227.21.19:18516] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afS2vSDBq9mMfUWQQeqBxgAAAIg"]
[Fri May 01 22:20:47.792138 2026] [:error] [pid 33791:tid 33817] [client 212.227.21.19:18522] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afS2v29ixd-moLycM9AudwAAABc"]
[Fri May 01 22:20:49.797933 2026] [:error] [pid 33791:tid 33801] [client 212.227.21.19:18526] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afS2wW9ixd-moLycM9AuewAAAAc"]
[Fri May 01 22:20:51.754594 2026] [:error] [pid 33791:tid 33816] [client 212.227.21.19:18534] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afS2w29ixd-moLycM9AugAAAABY"]
[Fri May 01 22:20:53.708165 2026] [:error] [pid 33791:tid 33804] [client 212.227.21.19:18550] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afS2xW9ixd-moLycM9AuhwAAAAo"]
[Fri May 01 22:20:56.237217 2026] [:error] [pid 33791:tid 33807] [client 212.227.21.19:31082] [client 212.227.21.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afS2yG9ixd-moLycM9AujwAAAA0"]
[Fri May 01 22:50:39.569135 2026] [:error] [pid 50214:tid 50241] [client 52.14.179.179:55310] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ads.txt"] [unique_id "afS9v4s0pgrtfZkbhjN3nQAAAZY"]
[Fri May 01 22:50:39.575637 2026] [:error] [pid 25320:tid 25339] [client 52.14.179.179:55278] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.ico"] [unique_id "afS9v1c3wJ-3-XaXB3ojMwAAARA"]
[Fri May 01 22:50:39.575902 2026] [:error] [pid 33791:tid 33806] [client 52.14.179.179:55294] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/security.txt"] [unique_id "afS9v29ixd-moLycM9A2tAAAAAw"]
[Fri May 01 22:50:39.579336 2026] [:error] [pid 33791:tid 33815] [client 52.14.179.179:55320] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afS9v29ixd-moLycM9A2tQAAABU"]
[Fri May 01 22:50:40.494999 2026] [:error] [pid 50214:tid 50220] [client 52.14.179.179:55368] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ads.txt"] [unique_id "afS9wIs0pgrtfZkbhjN3oAAAAYI"]
[Fri May 01 22:50:40.495311 2026] [:error] [pid 25085:tid 25107] [client 52.14.179.179:55390] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/security.txt"] [unique_id "afS9wPuD8fWRiE0RX0EYnAAAAVA"]
[Fri May 01 22:50:40.495372 2026] [:error] [pid 25320:tid 25328] [client 52.14.179.179:55380] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.ico"] [unique_id "afS9wFc3wJ-3-XaXB3ojNwAAAQU"]
[Fri May 01 22:50:40.497011 2026] [:error] [pid 50214:tid 50234] [client 52.14.179.179:55392] [client 52.14.179.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afS9wIs0pgrtfZkbhjN3oQAAAZA"]
[Sat May 02 00:21:03.849040 2026] [:error] [pid 33791:tid 33814] [client 177.8.128.44:61829] [client 177.8.128.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.8.128.44, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afTS729ixd-moLycM9BaIgAAABQ"]
[Sat May 02 00:21:03.861704 2026] [proxy_fcgi:error] [pid 33791:tid 33814] [client 177.8.128.44:61829] AH01071: Got error 'Primary script unknown'
[Sat May 02 00:21:55.852697 2026] [:error] [pid 24995:tid 25020] [client 177.8.128.44:50713] [client 177.8.128.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.8.128.44, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afTTI-dJG9WB_Q_ne0vKigAAAFU"]
[Sat May 02 00:21:55.868958 2026] [proxy_fcgi:error] [pid 24995:tid 25020] [client 177.8.128.44:50713] AH01071: Got error 'Primary script unknown'
[Sat May 02 06:41:13.792759 2026] [:error] [pid 53436:tid 53506] [client 43.157.148.38:57672] [client 43.157.148.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afUsCa9N0xp8fccVM0Bp2wAAAIc"]
[Sat May 02 10:10:56.578212 2026] [:error] [pid 53436:tid 53521] [client 149.22.83.17:37492] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afVdMK9N0xp8fccVM0CXWAAAAJY"]
[Sat May 02 10:10:59.972028 2026] [:error] [pid 21339:tid 21354] [client 149.22.83.17:53362] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afVdMwN2KhHZavn0Te1z2gAAAY0"]
[Sat May 02 10:11:02.618539 2026] [:error] [pid 21339:tid 21365] [client 149.22.83.17:53370] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afVdNgN2KhHZavn0Te1z3gAAAZg"]
[Sat May 02 10:11:07.901937 2026] [:error] [pid 53435:tid 53478] [client 149.22.83.17:39990] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afVdO4Dmp7_z8QkjSzNq1AAAAEY"]
[Sat May 02 10:11:11.380885 2026] [:error] [pid 53435:tid 53473] [client 149.22.83.17:40006] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afVdP4Dmp7_z8QkjSzNq2wAAAEE"]
[Sat May 02 10:11:15.129502 2026] [:error] [pid 21339:tid 21356] [client 149.22.83.17:42340] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afVdQwN2KhHZavn0Te1z5QAAAY8"]
[Sat May 02 10:11:19.124834 2026] [:error] [pid 22846:tid 22851] [client 149.22.83.17:42342] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afVdR4m1Ms03Mfhp3abJOgAAAQM"]
[Sat May 02 10:11:22.968334 2026] [:error] [pid 21339:tid 21343] [client 149.22.83.17:42352] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afVdSgN2KhHZavn0Te1z5wAAAYI"]
[Sat May 02 10:11:25.679087 2026] [:error] [pid 53435:tid 53472] [client 149.22.83.17:52356] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afVdTYDmp7_z8QkjSzNq7wAAAEA"]
[Sat May 02 10:11:29.204435 2026] [:error] [pid 53540:tid 53559] [client 149.22.83.17:52370] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afVdUdQYV6qJFftBNynPTAAAANE"]
[Sat May 02 10:11:32.144408 2026] [:error] [pid 21339:tid 21341] [client 149.22.83.17:52378] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afVdVAN2KhHZavn0Te1z-wAAAYA"]
[Sat May 02 10:11:35.389739 2026] [:error] [pid 53435:tid 53481] [client 149.22.83.17:41642] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afVdV4Dmp7_z8QkjSzNq9gAAAEk"]
[Sat May 02 10:11:40.106501 2026] [:error] [pid 53436:tid 53515] [client 149.22.83.17:41654] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afVdXK9N0xp8fccVM0CXdAAAAJA"]
[Sat May 02 10:11:42.440514 2026] [:error] [pid 53434:tid 53460] [client 149.22.83.17:41662] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afVdXu9BXmRQcbfsxlwZsAAAABE"]
[Sat May 02 10:11:45.259356 2026] [:error] [pid 53435:tid 53477] [client 149.22.83.17:57162] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afVdYYDmp7_z8QkjSzNq-AAAAEU"]
[Sat May 02 10:11:47.825906 2026] [:error] [pid 53435:tid 53494] [client 149.22.83.17:57164] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afVdY4Dmp7_z8QkjSzNrAAAAAFY"]
[Sat May 02 10:11:51.280138 2026] [:error] [pid 21339:tid 21354] [client 149.22.83.17:57180] [client 149.22.83.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afVdZwN2KhHZavn0Te10DQAAAY0"]
[Sat May 02 11:57:03.937905 2026] [:error] [pid 52010:tid 52047] [client 195.201.199.99:49240] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afV2DwiR6wohDtdeJMCdvwAAAsQ"]
[Sat May 02 11:57:05.961557 2026] [:error] [pid 11894:tid 11907] [client 195.201.199.99:49004] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afV2ETHh6DQF1tkXIKydYAAAAUo"]
[Sat May 02 11:57:08.341301 2026] [:error] [pid 11894:tid 11921] [client 195.201.199.99:53282] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afV2FDHh6DQF1tkXIKydYwAAAVg"]
[Sat May 02 11:57:10.994191 2026] [:error] [pid 52010:tid 52051] [client 195.201.199.99:51784] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afV2FgiR6wohDtdeJMCdwQAAAsg"]
[Sat May 02 11:57:13.134687 2026] [:error] [pid 22846:tid 22858] [client 195.201.199.99:54376] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afV2GYm1Ms03Mfhp3abUZwAAAQo"]
[Sat May 02 11:57:15.260307 2026] [:error] [pid 52010:tid 52065] [client 195.201.199.99:54888] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afV2GwiR6wohDtdeJMCdwgAAAtY"]
[Sat May 02 11:57:17.302127 2026] [:error] [pid 51950:tid 52004] [client 195.201.199.99:55350] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afV2HYoBJzYZ3RKUhdjoegAAAlg"]
[Sat May 02 11:57:19.500426 2026] [:error] [pid 51950:tid 51994] [client 195.201.199.99:55844] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afV2H4oBJzYZ3RKUhdjofAAAAk4"]
[Sat May 02 11:57:21.866549 2026] [:error] [pid 52010:tid 52059] [client 195.201.199.99:56434] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afV2IQiR6wohDtdeJMCdxAAAAtA"]
[Sat May 02 11:57:24.777932 2026] [:error] [pid 52124:tid 52148] [client 195.201.199.99:55248] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afV2JDjabaZ9NMm8eQtpFQAAA5M"]
[Sat May 02 11:57:27.226978 2026] [:error] [pid 51950:tid 51982] [client 195.201.199.99:55832] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afV2J4oBJzYZ3RKUhdjogAAAAkI"]
[Sat May 02 11:57:29.235891 2026] [:error] [pid 52010:tid 52062] [client 195.201.199.99:58390] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afV2KQiR6wohDtdeJMCdyQAAAtM"]
[Sat May 02 11:57:31.701757 2026] [:error] [pid 52010:tid 52052] [client 195.201.199.99:56858] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afV2KwiR6wohDtdeJMCd0gAAAsk"]
[Sat May 02 11:57:34.331423 2026] [:error] [pid 52124:tid 52135] [client 195.201.199.99:57458] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afV2LjjabaZ9NMm8eQtpGAAAA4Y"]
[Sat May 02 11:57:37.121360 2026] [:error] [pid 52010:tid 52044] [client 195.201.199.99:58044] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afV2MQiR6wohDtdeJMCd5AAAAsE"]
[Sat May 02 11:57:39.776382 2026] [:error] [pid 53434:tid 53443] [client 195.201.199.99:58550] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afV2M-9BXmRQcbfsxlwoQgAAAAA"]
[Sat May 02 11:57:41.804271 2026] [:error] [pid 22846:tid 22871] [client 195.201.199.99:60966] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afV2NYm1Ms03Mfhp3abUbQAAARc"]
[Sat May 02 11:57:44.092933 2026] [:error] [pid 11894:tid 11904] [client 195.201.199.99:59360] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afV2ODHh6DQF1tkXIKydaAAAAUc"]
[Sat May 02 11:57:46.317333 2026] [:error] [pid 52010:tid 52064] [client 195.201.199.99:33604] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afV2OgiR6wohDtdeJMCd9gAAAtU"]
[Sat May 02 11:57:48.611838 2026] [:error] [pid 11894:tid 11918] [client 195.201.199.99:34016] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afV2PDHh6DQF1tkXIKydaQAAAVU"]
[Sat May 02 11:57:50.942934 2026] [:error] [pid 52010:tid 52053] [client 195.201.199.99:34494] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afV2PgiR6wohDtdeJMCd-gAAAso"]
[Sat May 02 11:57:53.036925 2026] [:error] [pid 52010:tid 52056] [client 195.201.199.99:34920] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afV2QQiR6wohDtdeJMCd_QAAAs0"]
[Sat May 02 11:57:55.444866 2026] [:error] [pid 52010:tid 52051] [client 195.201.199.99:33398] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afV2QwiR6wohDtdeJMCeAQAAAsg"]
[Sat May 02 11:57:57.488846 2026] [:error] [pid 11894:tid 11916] [client 195.201.199.99:35974] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afV2RTHh6DQF1tkXIKydcgAAAVM"]
[Sat May 02 11:58:00.178199 2026] [:error] [pid 52010:tid 52063] [client 195.201.199.99:34464] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afV2SAiR6wohDtdeJMCeBwAAAtQ"]
[Sat May 02 11:59:27.026523 2026] [:error] [pid 51950:tid 51992] [client 79.137.67.30:34758] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afV2n4oBJzYZ3RKUhdjowgAAAkw"]
[Sat May 02 11:59:29.532776 2026] [:error] [pid 53436:tid 53499] [client 79.137.67.30:39454] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afV2oa9N0xp8fccVM0CjvwAAAIA"]
[Sat May 02 11:59:31.398520 2026] [:error] [pid 22846:tid 22854] [client 79.137.67.30:34474] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afV2o4m1Ms03Mfhp3abUfwAAAQY"]
[Sat May 02 11:59:33.916048 2026] [:error] [pid 51950:tid 51981] [client 79.137.67.30:39462] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afV2pYoBJzYZ3RKUhdjoxwAAAkE"]
[Sat May 02 11:59:35.943823 2026] [:error] [pid 52010:tid 52047] [client 79.137.67.30:54550] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afV2pwiR6wohDtdeJMCeYAAAAsQ"]
[Sat May 02 11:59:38.320521 2026] [:error] [pid 52012:tid 52090] [client 79.137.67.30:59156] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afV2qkzSWr-8cpS83mhUPwAAA00"]
[Sat May 02 11:59:40.355603 2026] [:error] [pid 51950:tid 52002] [client 79.137.67.30:54552] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afV2rIoBJzYZ3RKUhdjo0QAAAlY"]
[Sat May 02 11:59:42.715176 2026] [:error] [pid 51950:tid 52001] [client 79.137.67.30:59166] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afV2rooBJzYZ3RKUhdjo1QAAAlU"]
[Sat May 02 11:59:44.754406 2026] [:error] [pid 11894:tid 11921] [client 79.137.67.30:49168] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afV2sDHh6DQF1tkXIKydtAAAAVg"]
[Sat May 02 11:59:46.623681 2026] [:error] [pid 51950:tid 51999] [client 79.137.67.30:49184] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afV2sooBJzYZ3RKUhdjo2wAAAlM"]
[Sat May 02 11:59:49.147397 2026] [:error] [pid 51950:tid 51990] [client 79.137.67.30:51008] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afV2tYoBJzYZ3RKUhdjo4wAAAko"]
[Sat May 02 11:59:51.658512 2026] [:error] [pid 52010:tid 52057] [client 79.137.67.30:51018] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afV2twiR6wohDtdeJMCeYgAAAs4"]
[Sat May 02 11:59:54.182872 2026] [:error] [pid 52010:tid 52052] [client 79.137.67.30:51034] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afV2ugiR6wohDtdeJMCeaQAAAsk"]
[Sat May 02 11:59:56.680553 2026] [:error] [pid 52012:tid 52080] [client 79.137.67.30:60206] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afV2vEzSWr-8cpS83mhUQQAAA0M"]
[Sat May 02 11:59:59.191336 2026] [:error] [pid 51950:tid 51984] [client 79.137.67.30:60208] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afV2v4oBJzYZ3RKUhdjo6QAAAkQ"]
[Sat May 02 12:00:01.696383 2026] [:error] [pid 52124:tid 52148] [client 79.137.67.30:60218] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afV2wTjabaZ9NMm8eQtpLAAAA5M"]
[Sat May 02 12:00:04.188168 2026] [:error] [pid 22846:tid 22858] [client 79.137.67.30:60232] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afV2xIm1Ms03Mfhp3abUhgAAAQo"]
[Sat May 02 12:00:06.553075 2026] [:error] [pid 51950:tid 51996] [client 79.137.67.30:38502] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afV2xooBJzYZ3RKUhdjo7gAAAlA"]
[Sat May 02 12:00:08.882110 2026] [:error] [pid 51917:tid 51926] [client 79.137.67.30:38512] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afV2yK7wZviJ7BgcCi8IZgAAAcc"]
[Sat May 02 12:00:11.378088 2026] [:error] [pid 22846:tid 22864] [client 79.137.67.30:38518] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afV2y4m1Ms03Mfhp3abUiAAAARA"]
[Sat May 02 12:00:13.863336 2026] [:error] [pid 53435:tid 53473] [client 79.137.67.30:48062] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afV2zYDmp7_z8QkjSzN5RAAAAEE"]
[Sat May 02 12:00:17.624459 2026] [:error] [pid 11894:tid 11911] [client 79.137.67.30:55172] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afV20THh6DQF1tkXIKydygAAAU4"]
[Sat May 02 12:35:12.771950 2026] [:error] [pid 52012:tid 52084] [client 192.96.159.129:59902] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afV_AEzSWr-8cpS83mhWXgAAA0c"]
[Sat May 02 15:32:27.670875 2026] [:error] [pid 52010:tid 52048] [client 5.135.131.86:48208] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afWoiwiR6wohDtdeJMDIfgAAAsU"]
[Sat May 02 15:32:31.670893 2026] [:error] [pid 52010:tid 52054] [client 5.135.131.86:51872] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afWojwiR6wohDtdeJMDIhgAAAss"]
[Sat May 02 15:32:34.050733 2026] [:error] [pid 11894:tid 11908] [client 5.135.131.86:37478] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afWokjHh6DQF1tkXIKy1DQAAAUs"]
[Sat May 02 15:32:36.457563 2026] [:error] [pid 53434:tid 53451] [client 5.135.131.86:54206] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afWolO9BXmRQcbfsxlxZrgAAAAg"]
[Sat May 02 15:32:39.023532 2026] [:error] [pid 51950:tid 51994] [client 5.135.131.86:54222] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afWol4oBJzYZ3RKUhdgUQgAAAk4"]
[Sat May 02 15:32:40.942788 2026] [:error] [pid 52124:tid 52134] [client 5.135.131.86:37484] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afWomDjabaZ9NMm8eQt2gAAAA4U"]
[Sat May 02 15:32:43.379050 2026] [:error] [pid 51917:tid 51940] [client 5.135.131.86:41342] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afWom67wZviJ7BgcCi8mAAAAAdU"]
[Sat May 02 15:32:45.752018 2026] [:error] [pid 51917:tid 51922] [client 5.135.131.86:41346] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afWona7wZviJ7BgcCi8mBgAAAcM"]
[Sat May 02 15:32:48.282172 2026] [:error] [pid 53435:tid 53476] [client 5.135.131.86:41356] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afWooIDmp7_z8QkjSzOHWAAAAEQ"]
[Sat May 02 15:32:50.653645 2026] [:error] [pid 53436:tid 53510] [client 5.135.131.86:41362] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afWooq9N0xp8fccVM0C3LAAAAIs"]
[Sat May 02 15:32:53.047721 2026] [:error] [pid 53436:tid 53499] [client 5.135.131.86:35286] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afWopa9N0xp8fccVM0C3LQAAAIA"]
[Sat May 02 15:32:55.424364 2026] [:error] [pid 53434:tid 53448] [client 5.135.131.86:35292] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afWop-9BXmRQcbfsxlxZvQAAAAU"]
[Sat May 02 15:32:57.812131 2026] [:error] [pid 52010:tid 52050] [client 5.135.131.86:35294] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afWoqQiR6wohDtdeJMDInQAAAsc"]
[Sat May 02 15:33:00.326052 2026] [:error] [pid 52010:tid 52048] [client 5.135.131.86:35302] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afWorAiR6wohDtdeJMDIpAAAAsU"]
[Sat May 02 15:33:02.860510 2026] [:error] [pid 53434:tid 53446] [client 5.135.131.86:55622] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afWoru9BXmRQcbfsxlxZwQAAAAM"]
[Sat May 02 15:33:05.364938 2026] [:error] [pid 51917:tid 51929] [client 5.135.131.86:55630] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afWosa7wZviJ7BgcCi8mHAAAAco"]
[Sat May 02 15:33:07.901805 2026] [:error] [pid 52010:tid 52055] [client 5.135.131.86:55640] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afWoswiR6wohDtdeJMDIrgAAAsw"]
[Sat May 02 15:33:10.407659 2026] [:error] [pid 52124:tid 52148] [client 5.135.131.86:55642] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afWotjjabaZ9NMm8eQt2jAAAA5M"]
[Sat May 02 15:33:12.905251 2026] [:error] [pid 51950:tid 51982] [client 5.135.131.86:36788] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afWouIoBJzYZ3RKUhdgUbAAAAkI"]
[Sat May 02 15:33:15.436346 2026] [:error] [pid 53436:tid 53518] [client 5.135.131.86:36792] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afWou69N0xp8fccVM0C3QAAAAJM"]
[Sat May 02 15:33:17.956001 2026] [:error] [pid 52012:tid 52084] [client 5.135.131.86:36806] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afWovUzSWr-8cpS83mhgXQAAA0c"]
[Sat May 02 15:33:20.461711 2026] [:error] [pid 51950:tid 51981] [client 5.135.131.86:36812] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afWowIoBJzYZ3RKUhdgUdwAAAkE"]
[Sat May 02 15:33:22.885647 2026] [:error] [pid 53434:tid 53463] [client 5.135.131.86:49428] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afWowu9BXmRQcbfsxlxZzgAAABQ"]
[Sat May 02 15:33:25.387899 2026] [:error] [pid 51950:tid 52000] [client 5.135.131.86:49434] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afWoxYoBJzYZ3RKUhdgUeQAAAlQ"]
[Sat May 02 15:33:46.905473 2026] [:error] [pid 52010:tid 52051] [client 5.135.131.86:49440] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afWo2giR6wohDtdeJMDI5AAAAsg"]
[Sat May 02 15:33:48.905568 2026] [:error] [pid 51950:tid 51980] [client 5.135.131.86:42122] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afWo3IoBJzYZ3RKUhdgUpgAAAkA"]
[Sat May 02 15:33:50.790444 2026] [:error] [pid 51950:tid 51988] [client 5.135.131.86:42130] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afWo3ooBJzYZ3RKUhdgUqgAAAkg"]
[Sat May 02 15:33:52.807419 2026] [:error] [pid 52124:tid 52139] [client 5.135.131.86:39846] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afWo4DjabaZ9NMm8eQt2lwAAA4o"]
[Sat May 02 15:33:54.699434 2026] [:error] [pid 53436:tid 53519] [client 5.135.131.86:39858] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afWo4q9N0xp8fccVM0C3TAAAAJQ"]
[Sat May 02 15:33:56.738921 2026] [:error] [pid 53434:tid 53467] [client 5.135.131.86:39874] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afWo5O9BXmRQcbfsxlxZ4AAAABg"]
[Sat May 02 15:33:58.625832 2026] [:error] [pid 53434:tid 53451] [client 5.135.131.86:39890] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afWo5u9BXmRQcbfsxlxZ6QAAAAg"]
[Sat May 02 15:34:01.144487 2026] [:error] [pid 52010:tid 52060] [client 5.135.131.86:53424] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afWo6QiR6wohDtdeJMDI8AAAAtE"]
[Sat May 02 15:34:03.530049 2026] [:error] [pid 52010:tid 52047] [client 5.135.131.86:53662] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afWo6wiR6wohDtdeJMDI9AAAAsQ"]
[Sat May 02 15:34:06.023654 2026] [:error] [pid 22846:tid 22848] [client 5.135.131.86:53674] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afWo7om1Ms03Mfhp3ablNAAAAQA"]
[Sat May 02 15:34:08.532824 2026] [:error] [pid 52010:tid 52055] [client 5.135.131.86:53678] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afWo8AiR6wohDtdeJMDI9wAAAsw"]
[Sat May 02 15:34:10.397258 2026] [:error] [pid 51950:tid 51993] [client 5.135.131.86:51174] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afWo8ooBJzYZ3RKUhdgUtwAAAk0"]
[Sat May 02 15:34:12.410324 2026] [:error] [pid 52124:tid 52142] [client 5.135.131.86:51512] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afWo9DjabaZ9NMm8eQt2oQAAA40"]
[Sat May 02 15:34:14.789685 2026] [:error] [pid 52010:tid 52058] [client 5.135.131.86:42962] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afWo9giR6wohDtdeJMDI_AAAAs8"]
[Sat May 02 15:34:16.621641 2026] [:error] [pid 51917:tid 51923] [client 5.135.131.86:51522] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afWo-K7wZviJ7BgcCi8mSgAAAcQ"]
[Sat May 02 15:34:19.030149 2026] [:error] [pid 53435:tid 53474] [client 5.135.131.86:42970] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afWo-4Dmp7_z8QkjSzOHjQAAAEI"]
[Sat May 02 15:34:21.024086 2026] [:error] [pid 53434:tid 53456] [client 5.135.131.86:51524] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afWo_e9BXmRQcbfsxlxZ8gAAAA0"]
[Sat May 02 15:34:23.543190 2026] [:error] [pid 53436:tid 53511] [client 5.135.131.86:54996] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afWo_69N0xp8fccVM0C3YAAAAIw"]
[Sat May 02 15:34:26.055938 2026] [:error] [pid 52010:tid 52065] [client 5.135.131.86:55006] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afWpAgiR6wohDtdeJMDJBQAAAtY"]
[Sat May 02 15:34:28.065721 2026] [:error] [pid 11894:tid 11912] [client 5.135.131.86:46268] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afWpBDHh6DQF1tkXIKy1VgAAAU8"]
[Sat May 02 15:34:30.581164 2026] [:error] [pid 52010:tid 52059] [client 5.135.131.86:55010] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afWpBgiR6wohDtdeJMDJDQAAAtA"]
[Sat May 02 15:34:33.087602 2026] [:error] [pid 53434:tid 53464] [client 5.135.131.86:40730] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afWpCe9BXmRQcbfsxlxZ-gAAABU"]
[Sat May 02 15:34:35.591430 2026] [:error] [pid 53434:tid 53443] [client 5.135.131.86:40732] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afWpC-9BXmRQcbfsxlxZ_QAAAAA"]
[Sat May 02 15:34:38.112975 2026] [:error] [pid 51950:tid 51992] [client 5.135.131.86:40746] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afWpDooBJzYZ3RKUhdgUxwAAAkw"]
[Sat May 02 15:34:40.079405 2026] [:error] [pid 53434:tid 53465] [client 5.135.131.86:36358] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afWpEO9BXmRQcbfsxlxaBAAAABY"]
[Sat May 02 15:34:42.592394 2026] [:error] [pid 52010:tid 52050] [client 5.135.131.86:40758] [client 5.135.131.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afWpEgiR6wohDtdeJMDJIQAAAsc"]
[Sat May 02 15:50:17.663131 2026] [:error] [pid 11894:tid 11916] [client 43.165.198.224:51274] [client 43.165.198.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afWsuTHh6DQF1tkXIKy2twAAAVM"]
[Sat May 02 17:06:30.693281 2026] [:error] [pid 53434:tid 53449] [client 43.157.95.131:33906] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afW-lu9BXmRQcbfsxlxwBQAAAAY"]
[Sat May 02 18:58:07.125970 2026] [:error] [pid 22846:tid 22869] [client 185.80.233.80:56482] [client 185.80.233.80] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=multipart/alternative"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afXYv4m1Ms03Mfhp3ab2jwAAARU"]
[Sat May 02 21:50:37.770094 2026] [:error] [pid 52012:tid 52085] [client 105.102.31.57:63031] [client 105.102.31.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.102.31.57, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afYBLUzSWr-8cpS83mi93QAAA0g"]
[Sat May 02 21:50:37.781746 2026] [proxy_fcgi:error] [pid 52012:tid 52085] [client 105.102.31.57:63031] AH01071: Got error 'Primary script unknown'
[Sat May 02 22:27:08.292245 2026] [:error] [pid 52010:tid 52065] [client 43.166.226.57:42422] [client 43.166.226.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afYJvAiR6wohDtdeJMA4bgAAAtY"]
[Sat May 02 23:35:12.475814 2026] [:error] [pid 53435:tid 53496] [client 43.162.109.249:46058] [client 43.162.109.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afYZsIDmp7_z8QkjSzPuSwAAAFg"]
[Sat May 02 23:47:27.700035 2026] [:error] [pid 53436:tid 53520] [client 146.56.199.139:43558] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afYcj69N0xp8fccVM0DjsQAAAJU"]
[Sun May 03 01:50:12.664692 2026] [proxy_fcgi:error] [pid 52010:tid 52052] [client 20.151.130.38:57443] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:12.873737 2026] [proxy_fcgi:error] [pid 52010:tid 52064] [client 20.151.130.38:57443] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:13.114359 2026] [proxy_fcgi:error] [pid 52010:tid 52067] [client 20.151.130.38:57443] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:13.407011 2026] [proxy_fcgi:error] [pid 52010:tid 52046] [client 20.151.130.38:57443] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:13.624858 2026] [proxy_fcgi:error] [pid 52010:tid 52049] [client 20.151.130.38:57443] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:13.848036 2026] [:error] [pid 52010:tid 52056] [client 20.151.130.38:57443] [client 20.151.130.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "afY5VQiR6wohDtdeJMBrrwAAAs0"]
[Sun May 03 01:50:14.919124 2026] [proxy_fcgi:error] [pid 53435:tid 53495] [client 20.151.130.38:15957] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:15.439992 2026] [proxy_fcgi:error] [pid 53435:tid 53474] [client 20.151.130.38:15957] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:15.760093 2026] [proxy_fcgi:error] [pid 53435:tid 53476] [client 20.151.130.38:15957] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:15.972269 2026] [proxy_fcgi:error] [pid 53435:tid 53479] [client 20.151.130.38:15957] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:16.193853 2026] [proxy_fcgi:error] [pid 53435:tid 53483] [client 20.151.130.38:15957] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:50:16.550988 2026] [:error] [pid 53435:tid 53480] [client 20.151.130.38:15957] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afY5WIDmp7_z8QkjSzMZqgAAAEg"]
[Sun May 03 01:50:20.531858 2026] [:error] [pid 53434:tid 53460] [client 20.151.130.38:15953] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afY5XO9BXmRQcbfsxly5pgAAABE"]
[Sun May 03 01:50:23.951811 2026] [:error] [pid 53435:tid 53490] [client 20.151.130.38:60299] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afY5X4Dmp7_z8QkjSzMZugAAAFI"]
[Sun May 03 01:50:48.277947 2026] [:error] [pid 52012:tid 52096] [client 20.151.130.38:15999] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afY5eEzSWr-8cpS83mgiLwAAA1M"]
[Sun May 03 01:50:56.611456 2026] [:error] [pid 53436:tid 53519] [client 20.151.130.38:15710] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afY5gK9N0xp8fccVM0DvbwAAAJQ"]
[Sun May 03 01:50:58.922300 2026] [:error] [pid 53436:tid 53505] [client 20.151.130.38:15696] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afY5gq9N0xp8fccVM0DvcAAAAIY"]
[Sun May 03 01:51:00.898183 2026] [:error] [pid 52010:tid 52066] [client 20.151.130.38:60327] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afY5hAiR6wohDtdeJMBrwwAAAtc"]
[Sun May 03 01:51:04.591861 2026] [:error] [pid 52124:tid 52142] [client 20.151.130.38:16356] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afY5iDjabaZ9NMm8eQuffAAAA40"]
[Sun May 03 01:51:09.811576 2026] [:error] [pid 52010:tid 52054] [client 20.151.130.38:15722] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afY5jQiR6wohDtdeJMBrzgAAAss"]
[Sun May 03 01:51:12.935484 2026] [:error] [pid 52012:tid 52083] [client 20.151.130.38:16375] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afY5kEzSWr-8cpS83mgiQgAAA0Y"]
[Sun May 03 01:51:15.990900 2026] [:error] [pid 52010:tid 52061] [client 20.151.130.38:60320] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afY5kwiR6wohDtdeJMBr0wAAAtI"]
[Sun May 03 01:51:19.095265 2026] [proxy_fcgi:error] [pid 51950:tid 52004] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:20.124365 2026] [proxy_fcgi:error] [pid 51950:tid 51994] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:20.352284 2026] [proxy_fcgi:error] [pid 51950:tid 52001] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:20.678863 2026] [proxy_fcgi:error] [pid 51950:tid 51997] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:20.892419 2026] [proxy_fcgi:error] [pid 51950:tid 52002] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:21.309345 2026] [proxy_fcgi:error] [pid 51950:tid 51987] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:21.538078 2026] [proxy_fcgi:error] [pid 51950:tid 51989] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:21.856151 2026] [proxy_fcgi:error] [pid 51950:tid 51986] [client 20.151.130.38:15954] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:51:22.066849 2026] [:error] [pid 51950:tid 51993] [client 20.151.130.38:15954] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afY5mooBJzYZ3RKUhdiORAAAAk0"]
[Sun May 03 01:51:29.481002 2026] [:error] [pid 52124:tid 52146] [client 20.151.130.38:15716] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afY5oTjabaZ9NMm8eQufjAAAA5E"]
[Sun May 03 01:51:31.036652 2026] [:error] [pid 53435:tid 53478] [client 20.151.130.38:61762] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afY5o4Dmp7_z8QkjSzMZ6QAAAEY"]
[Sun May 03 01:51:34.779700 2026] [:error] [pid 51950:tid 51981] [client 20.151.130.38:15685] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afY5pooBJzYZ3RKUhdiOUgAAAkE"]
[Sun May 03 01:51:36.236725 2026] [:error] [pid 22846:tid 22855] [client 20.151.130.38:61791] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "afY5qIm1Ms03Mfhp3aYWMwAAAQc"]
[Sun May 03 01:51:38.493119 2026] [:error] [pid 52010:tid 52056] [client 20.151.130.38:15944] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "afY5qgiR6wohDtdeJMBr6wAAAs0"]
[Sun May 03 01:51:43.079445 2026] [:error] [pid 53434:tid 53454] [client 20.151.130.38:15700] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/solo1.php"] [unique_id "afY5r-9BXmRQcbfsxly57QAAAAs"]
[Sun May 03 01:51:50.181978 2026] [:error] [pid 53435:tid 53488] [client 20.151.130.38:15853] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afY5toDmp7_z8QkjSzMaCQAAAFA"]
[Sun May 03 01:51:51.550732 2026] [:error] [pid 52010:tid 52048] [client 20.151.130.38:61789] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afY5twiR6wohDtdeJMBr9gAAAsU"]
[Sun May 03 01:51:56.807495 2026] [:error] [pid 53435:tid 53478] [client 20.151.130.38:15967] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afY5vIDmp7_z8QkjSzMaHAAAAEY"]
[Sun May 03 01:52:02.340632 2026] [:error] [pid 53434:tid 53458] [client 20.151.130.38:16362] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afY5wu9BXmRQcbfsxly59wAAAA8"]
[Sun May 03 01:52:22.413892 2026] [proxy_fcgi:error] [pid 52010:tid 52058] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:23.540586 2026] [proxy_fcgi:error] [pid 52010:tid 52066] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:23.751866 2026] [proxy_fcgi:error] [pid 52010:tid 52057] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:23.964988 2026] [proxy_fcgi:error] [pid 52010:tid 52053] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:24.198473 2026] [proxy_fcgi:error] [pid 52010:tid 52044] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:24.411835 2026] [proxy_fcgi:error] [pid 52010:tid 52052] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:24.622138 2026] [proxy_fcgi:error] [pid 52010:tid 52054] [client 20.151.130.38:60310] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:52:24.829732 2026] [:error] [pid 52010:tid 52048] [client 20.151.130.38:60310] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afY52AiR6wohDtdeJMBsIAAAAsU"]
[Sun May 03 01:52:27.632937 2026] [:error] [pid 53435:tid 53473] [client 20.151.130.38:16325] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afY524Dmp7_z8QkjSzMaQQAAAEE"]
[Sun May 03 01:52:32.110866 2026] [:error] [pid 22846:tid 22855] [client 20.151.130.38:15972] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afY54Im1Ms03Mfhp3aYWTwAAAQc"]
[Sun May 03 01:52:55.007332 2026] [:error] [pid 11894:tid 11906] [client 20.151.130.38:15961] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afY59zHh6DQF1tkXIKz8FwAAAUk"]
[Sun May 03 01:52:57.243800 2026] [:error] [pid 51950:tid 51981] [client 20.151.130.38:61804] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afY5-YoBJzYZ3RKUhdiO0gAAAkE"]
[Sun May 03 01:52:58.136297 2026] [:error] [pid 52124:tid 52153] [client 20.151.130.38:16354] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afY5-jjabaZ9NMm8eQufnwAAA5g"]
[Sun May 03 01:52:59.664492 2026] [:error] [pid 52010:tid 52052] [client 20.151.130.38:15743] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afY5-wiR6wohDtdeJMBsKgAAAsk"]
[Sun May 03 01:53:04.862415 2026] [:error] [pid 52010:tid 52043] [client 20.151.130.38:61792] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "afY6AAiR6wohDtdeJMBsLwAAAsA"]
[Sun May 03 01:53:06.653890 2026] [:error] [pid 53435:tid 53481] [client 20.151.130.38:15690] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "afY6AoDmp7_z8QkjSzMaWQAAAEk"]
[Sun May 03 01:53:08.750208 2026] [:error] [pid 52010:tid 52063] [client 20.151.130.38:16376] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "afY6BAiR6wohDtdeJMBsMwAAAtQ"]
[Sun May 03 01:53:11.923628 2026] [:error] [pid 53435:tid 53496] [client 20.151.130.38:61774] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-bda.php"] [unique_id "afY6B4Dmp7_z8QkjSzMaXQAAAFg"]
[Sun May 03 01:53:20.629597 2026] [:error] [pid 53435:tid 53492] [client 20.151.130.38:60302] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bhm.php"] [unique_id "afY6EIDmp7_z8QkjSzMaYgAAAFQ"]
[Sun May 03 01:53:26.833498 2026] [proxy_fcgi:error] [pid 52010:tid 52066] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:27.050074 2026] [proxy_fcgi:error] [pid 52010:tid 52065] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:27.266395 2026] [proxy_fcgi:error] [pid 52010:tid 52059] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:27.500677 2026] [proxy_fcgi:error] [pid 52010:tid 52052] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:27.718438 2026] [proxy_fcgi:error] [pid 52010:tid 52057] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:27.948522 2026] [proxy_fcgi:error] [pid 52010:tid 52051] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:28.179201 2026] [proxy_fcgi:error] [pid 52010:tid 52067] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:28.394164 2026] [proxy_fcgi:error] [pid 52010:tid 52054] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:28.842052 2026] [proxy_fcgi:error] [pid 52010:tid 52064] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:29.058999 2026] [proxy_fcgi:error] [pid 52010:tid 52046] [client 20.151.130.38:61816] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:53:29.287339 2026] [:error] [pid 52010:tid 52047] [client 20.151.130.38:61816] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afY6GQiR6wohDtdeJMBsTgAAAsQ"]
[Sun May 03 01:53:31.868500 2026] [:error] [pid 52012:tid 52082] [client 20.151.130.38:61769] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afY6G0zSWr-8cpS83mgi1AAAA0U"]
[Sun May 03 01:53:47.495191 2026] [:error] [pid 52010:tid 52044] [client 20.151.130.38:60298] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "afY6KwiR6wohDtdeJMBsaAAAAsE"]
[Sun May 03 01:54:07.089908 2026] [:error] [pid 51917:tid 51938] [client 20.151.130.38:16351] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afY6P67wZviJ7BgcCi93HwAAAdM"]
[Sun May 03 01:54:08.307670 2026] [:error] [pid 52010:tid 52055] [client 20.151.130.38:15698] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afY6QAiR6wohDtdeJMBshAAAAsw"]
[Sun May 03 01:54:11.065128 2026] [:error] [pid 53436:tid 53521] [client 20.151.130.38:15970] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afY6Q69N0xp8fccVM0DvogAAAJY"]
[Sun May 03 01:54:14.544602 2026] [:error] [pid 51950:tid 51988] [client 20.151.130.38:15947] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afY6RooBJzYZ3RKUhdiPBAAAAkg"]
[Sun May 03 01:54:15.848927 2026] [:error] [pid 53435:tid 53488] [client 20.151.130.38:15963] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afY6R4Dmp7_z8QkjSzMajgAAAFA"]
[Sun May 03 01:54:23.241784 2026] [:error] [pid 53435:tid 53476] [client 20.151.130.38:16320] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afY6T4Dmp7_z8QkjSzMangAAAEQ"]
[Sun May 03 01:54:33.006390 2026] [proxy_fcgi:error] [pid 52124:tid 52142] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:33.231214 2026] [proxy_fcgi:error] [pid 52124:tid 52132] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:33.458806 2026] [proxy_fcgi:error] [pid 52124:tid 52153] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:33.669524 2026] [proxy_fcgi:error] [pid 52124:tid 52131] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:33.879213 2026] [proxy_fcgi:error] [pid 52124:tid 52146] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:34.111510 2026] [proxy_fcgi:error] [pid 52124:tid 52151] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:34.320907 2026] [proxy_fcgi:error] [pid 52124:tid 52140] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:35.764459 2026] [proxy_fcgi:error] [pid 52124:tid 52148] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:35.974725 2026] [proxy_fcgi:error] [pid 52124:tid 52136] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:36.185425 2026] [proxy_fcgi:error] [pid 52124:tid 52130] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:36.395634 2026] [proxy_fcgi:error] [pid 52124:tid 52152] [client 20.151.130.38:15971] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:54:36.601598 2026] [:error] [pid 52124:tid 52139] [client 20.151.130.38:15971] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afY6XDjabaZ9NMm8eQufwAAAA4o"]
[Sun May 03 01:54:37.964603 2026] [:error] [pid 53436:tid 53514] [client 20.151.130.38:60341] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afY6Xa9N0xp8fccVM0DvqgAAAI8"]
[Sun May 03 01:54:49.417211 2026] [:error] [pid 52012:tid 52087] [client 20.151.130.38:65140] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afY6aUzSWr-8cpS83mgjJAAAA0o"]
[Sun May 03 01:54:56.406251 2026] [:error] [pid 52012:tid 52102] [client 20.151.130.38:16374] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afY6cEzSWr-8cpS83mgjPgAAA1g"]
[Sun May 03 01:54:58.826604 2026] [:error] [pid 52010:tid 52052] [client 20.151.130.38:61781] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afY6cgiR6wohDtdeJMBsnQAAAsk"]
[Sun May 03 01:55:04.175204 2026] [:error] [pid 53435:tid 53493] [client 20.151.130.38:65088] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afY6eIDmp7_z8QkjSzMauQAAAFU"]
[Sun May 03 01:55:11.228941 2026] [:error] [pid 53435:tid 53488] [client 20.151.130.38:16331] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afY6f4Dmp7_z8QkjSzMaxAAAAFA"]
[Sun May 03 01:55:14.160961 2026] [:error] [pid 22846:tid 22850] [client 20.151.130.38:61768] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afY6gom1Ms03Mfhp3aYWcgAAAQI"]
[Sun May 03 01:55:28.831968 2026] [:error] [pid 51950:tid 51998] [client 20.151.130.38:61790] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "afY6kIoBJzYZ3RKUhdiPGgAAAlI"]
[Sun May 03 01:55:37.131829 2026] [proxy_fcgi:error] [pid 53435:tid 53495] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:37.357829 2026] [proxy_fcgi:error] [pid 53435:tid 53496] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:37.566682 2026] [proxy_fcgi:error] [pid 53435:tid 53472] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:37.776678 2026] [proxy_fcgi:error] [pid 53435:tid 53484] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:38.101790 2026] [proxy_fcgi:error] [pid 53435:tid 53475] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:38.311691 2026] [proxy_fcgi:error] [pid 53435:tid 53488] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:38.709904 2026] [proxy_fcgi:error] [pid 53435:tid 53493] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:38.918964 2026] [proxy_fcgi:error] [pid 53435:tid 53481] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:39.130833 2026] [proxy_fcgi:error] [pid 53435:tid 53473] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:39.340424 2026] [proxy_fcgi:error] [pid 53435:tid 53476] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:39.573035 2026] [proxy_fcgi:error] [pid 53435:tid 53477] [client 20.151.130.38:65115] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:55:39.780555 2026] [:error] [pid 53435:tid 53491] [client 20.151.130.38:65115] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "afY6m4Dmp7_z8QkjSzMa4gAAAFM"]
[Sun May 03 01:55:51.367210 2026] [:error] [pid 52124:tid 52139] [client 20.151.130.38:59201] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "afY6pzjabaZ9NMm8eQufyAAAA4o"]
[Sun May 03 01:55:54.694670 2026] [:error] [pid 52010:tid 52053] [client 20.151.130.38:65116] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "afY6qgiR6wohDtdeJMBsvgAAAso"]
[Sun May 03 01:56:00.431986 2026] [:error] [pid 52010:tid 52051] [client 20.151.130.38:65130] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "afY6sAiR6wohDtdeJMBswQAAAsg"]
[Sun May 03 01:56:17.245083 2026] [:error] [pid 51917:tid 51936] [client 20.151.130.38:59254] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "afY6wa7wZviJ7BgcCi93hAAAAdE"]
[Sun May 03 01:56:18.666113 2026] [:error] [pid 53435:tid 53495] [client 20.151.130.38:65097] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "afY6woDmp7_z8QkjSzMbBwAAAFc"]
[Sun May 03 01:56:20.956975 2026] [:error] [pid 51950:tid 51987] [client 20.151.130.38:59211] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/nastar.php"] [unique_id "afY6xIoBJzYZ3RKUhdiPnAAAAkc"]
[Sun May 03 01:56:35.873019 2026] [:error] [pid 51950:tid 51980] [client 20.151.130.38:64268] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "afY604oBJzYZ3RKUhdiPoQAAAkA"]
[Sun May 03 01:56:38.326288 2026] [:error] [pid 53435:tid 53491] [client 20.151.130.38:59222] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "afY61oDmp7_z8QkjSzMbGAAAAFM"]
[Sun May 03 01:56:40.366808 2026] [proxy_fcgi:error] [pid 51950:tid 51993] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:40.576327 2026] [proxy_fcgi:error] [pid 51950:tid 51991] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:40.932640 2026] [proxy_fcgi:error] [pid 51950:tid 51990] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:41.143012 2026] [proxy_fcgi:error] [pid 51950:tid 51994] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:41.355281 2026] [proxy_fcgi:error] [pid 51950:tid 51999] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:41.563469 2026] [proxy_fcgi:error] [pid 51950:tid 51998] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:41.773124 2026] [proxy_fcgi:error] [pid 51950:tid 51984] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:41.990807 2026] [proxy_fcgi:error] [pid 51950:tid 51982] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:42.218113 2026] [proxy_fcgi:error] [pid 51950:tid 52001] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:42.433936 2026] [proxy_fcgi:error] [pid 51950:tid 51987] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:42.643087 2026] [proxy_fcgi:error] [pid 51950:tid 51988] [client 20.151.130.38:59217] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:56:43.071955 2026] [:error] [pid 51950:tid 51995] [client 20.151.130.38:59217] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "afY624oBJzYZ3RKUhdiPrwAAAk8"]
[Sun May 03 01:57:00.453401 2026] [:error] [pid 52124:tid 52144] [client 20.151.130.38:65126] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afY67DjabaZ9NMm8eQuf0QAAA48"]
[Sun May 03 01:57:02.242736 2026] [:error] [pid 52012:tid 52084] [client 20.151.130.38:59252] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afY67kzSWr-8cpS83mgjpgAAA0c"]
[Sun May 03 01:57:05.388492 2026] [:error] [pid 53435:tid 53482] [client 20.151.130.38:59244] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afY68YDmp7_z8QkjSzMbLwAAAEo"]
[Sun May 03 01:57:09.935593 2026] [:error] [pid 11894:tid 11917] [client 20.151.130.38:62368] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afY69THh6DQF1tkXIKz8kgAAAVQ"]
[Sun May 03 01:57:12.908487 2026] [:error] [pid 52012:tid 52086] [client 20.151.130.38:59233] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afY6-EzSWr-8cpS83mgjqwAAA0k"]
[Sun May 03 01:57:15.199409 2026] [:error] [pid 52012:tid 52101] [client 20.151.130.38:62369] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afY6-0zSWr-8cpS83mgjrgAAA1c"]
[Sun May 03 01:57:23.541398 2026] [:error] [pid 51950:tid 52001] [client 20.151.130.38:62363] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afY7A4oBJzYZ3RKUhdiPwAAAAlU"]
[Sun May 03 01:57:27.264022 2026] [:error] [pid 53435:tid 53493] [client 20.151.130.38:59225] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afY7B4Dmp7_z8QkjSzMbNQAAAFU"]
[Sun May 03 01:57:43.028470 2026] [proxy_fcgi:error] [pid 52124:tid 52134] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:43.274975 2026] [proxy_fcgi:error] [pid 52124:tid 52141] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:43.544995 2026] [proxy_fcgi:error] [pid 52124:tid 52143] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:43.762850 2026] [proxy_fcgi:error] [pid 52124:tid 52132] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:43.996923 2026] [proxy_fcgi:error] [pid 52124:tid 52147] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:44.453649 2026] [proxy_fcgi:error] [pid 52124:tid 52146] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:44.666767 2026] [proxy_fcgi:error] [pid 52124:tid 52151] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:45.200702 2026] [proxy_fcgi:error] [pid 52124:tid 52130] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:45.432981 2026] [proxy_fcgi:error] [pid 52124:tid 52140] [client 20.151.130.38:64266] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:57:45.784421 2026] [:error] [pid 52124:tid 52136] [client 20.151.130.38:64266] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afY7GTjabaZ9NMm8eQuf5wAAA4c"]
[Sun May 03 01:57:49.405916 2026] [:error] [pid 53434:tid 53458] [client 20.151.130.38:64291] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afY7He9BXmRQcbfsxly6fAAAAA8"]
[Sun May 03 01:57:52.259351 2026] [:error] [pid 53435:tid 53492] [client 20.151.130.38:56716] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afY7IIDmp7_z8QkjSzMbSwAAAFQ"]
[Sun May 03 01:57:55.555374 2026] [:error] [pid 53434:tid 53459] [client 20.151.130.38:15383] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afY7I-9BXmRQcbfsxly6fgAAABA"]
[Sun May 03 01:58:00.905515 2026] [:error] [pid 52012:tid 52091] [client 20.151.130.38:61048] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afY7KEzSWr-8cpS83mgj1wAAA04"]
[Sun May 03 01:58:02.104317 2026] [:error] [pid 53435:tid 53482] [client 20.151.130.38:61052] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afY7KoDmp7_z8QkjSzMbWAAAAEo"]
[Sun May 03 01:58:05.278686 2026] [:error] [pid 53436:tid 53523] [client 20.151.130.38:15380] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afY7La9N0xp8fccVM0Dv4AAAAJg"]
[Sun May 03 01:58:10.725072 2026] [:error] [pid 52012:tid 52075] [client 20.151.130.38:64263] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afY7MkzSWr-8cpS83mgj2wAAA0A"]
[Sun May 03 01:58:11.867710 2026] [:error] [pid 22846:tid 22858] [client 20.151.130.38:15418] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "afY7M4m1Ms03Mfhp3aYWnwAAAQo"]
[Sun May 03 01:58:15.759752 2026] [:error] [pid 52012:tid 52092] [client 20.151.130.38:61038] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "afY7N0zSWr-8cpS83mgj4QAAA08"]
[Sun May 03 01:58:18.258229 2026] [:error] [pid 53436:tid 53503] [client 20.151.130.38:61023] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "afY7Oq9N0xp8fccVM0Dv5wAAAIQ"]
[Sun May 03 01:58:19.670970 2026] [:error] [pid 22846:tid 22849] [client 20.151.130.38:56711] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8xyz.php"] [unique_id "afY7O4m1Ms03Mfhp3aYWoAAAAQE"]
[Sun May 03 01:58:20.484501 2026] [:error] [pid 53435:tid 53493] [client 20.151.130.38:64264] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afY7PIDmp7_z8QkjSzMbZQAAAFU"]
[Sun May 03 01:58:21.992338 2026] [:error] [pid 53435:tid 53479] [client 20.151.130.38:15367] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afY7PYDmp7_z8QkjSzMbaAAAAEc"]
[Sun May 03 01:58:30.872639 2026] [:error] [pid 51950:tid 51997] [client 20.151.130.38:56750] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afY7RooBJzYZ3RKUhdiP-gAAAlE"]
[Sun May 03 01:58:33.196472 2026] [:error] [pid 52124:tid 52142] [client 20.151.130.38:64259] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afY7STjabaZ9NMm8eQuf7QAAA40"]
[Sun May 03 01:58:34.547884 2026] [:error] [pid 53436:tid 53507] [client 20.151.130.38:56705] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afY7Sq9N0xp8fccVM0Dv8gAAAIg"]
[Sun May 03 01:58:36.029864 2026] [:error] [pid 53434:tid 53466] [client 20.151.130.38:61005] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afY7TO9BXmRQcbfsxly6kQAAABc"]
[Sun May 03 01:58:43.367177 2026] [:error] [pid 22846:tid 22869] [client 20.151.130.38:15390] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afY7U4m1Ms03Mfhp3aYWqgAAARU"]
[Sun May 03 01:58:45.473249 2026] [proxy_fcgi:error] [pid 11894:tid 11907] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:45.683981 2026] [proxy_fcgi:error] [pid 11894:tid 11904] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:46.024768 2026] [proxy_fcgi:error] [pid 11894:tid 11918] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:46.245853 2026] [proxy_fcgi:error] [pid 11894:tid 11913] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:46.462918 2026] [proxy_fcgi:error] [pid 11894:tid 11899] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:46.890406 2026] [proxy_fcgi:error] [pid 11894:tid 11905] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:47.100989 2026] [proxy_fcgi:error] [pid 11894:tid 11898] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:47.868131 2026] [proxy_fcgi:error] [pid 11894:tid 11916] [client 20.151.130.38:57887] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:58:48.294142 2026] [:error] [pid 11894:tid 11902] [client 20.151.130.38:57887] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "afY7WDHh6DQF1tkXIKz81AAAAUU"]
[Sun May 03 01:58:49.264960 2026] [:error] [pid 52012:tid 52089] [client 20.151.130.38:61033] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "afY7WUzSWr-8cpS83mgj9AAAA0w"]
[Sun May 03 01:58:50.084648 2026] [:error] [pid 52012:tid 52083] [client 20.151.130.38:57899] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "afY7WkzSWr-8cpS83mgj-AAAA0Y"]
[Sun May 03 01:58:51.823456 2026] [:error] [pid 51950:tid 51988] [client 20.151.130.38:61039] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "afY7W4oBJzYZ3RKUhdiP_wAAAkg"]
[Sun May 03 01:58:53.092706 2026] [:error] [pid 52012:tid 52088] [client 20.151.130.38:61024] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afY7XUzSWr-8cpS83mgj_wAAA0s"]
[Sun May 03 01:58:56.850586 2026] [:error] [pid 52012:tid 52084] [client 20.151.130.38:61022] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afY7YEzSWr-8cpS83mgkBAAAA0c"]
[Sun May 03 01:59:02.217728 2026] [:error] [pid 51950:tid 51994] [client 20.151.130.38:16089] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afY7ZooBJzYZ3RKUhdiQBQAAAk4"]
[Sun May 03 01:59:03.555556 2026] [:error] [pid 53434:tid 53445] [client 20.151.130.38:16117] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afY7Z-9BXmRQcbfsxly6owAAAAI"]
[Sun May 03 01:59:09.170041 2026] [:error] [pid 52010:tid 52044] [client 20.151.130.38:16069] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "afY7bQiR6wohDtdeJMBtNAAAAsE"]
[Sun May 03 01:59:10.686148 2026] [:error] [pid 51950:tid 52000] [client 20.151.130.38:16130] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "afY7booBJzYZ3RKUhdiQDQAAAlQ"]
[Sun May 03 01:59:14.575783 2026] [:error] [pid 52124:tid 52148] [client 20.151.130.38:16079] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "afY7cjjabaZ9NMm8eQuf-QAAA5M"]
[Sun May 03 01:59:16.867230 2026] [:error] [pid 22846:tid 22870] [client 20.151.130.38:16165] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/fi.php"] [unique_id "afY7dIm1Ms03Mfhp3aYWuQAAARY"]
[Sun May 03 01:59:19.105274 2026] [:error] [pid 51917:tid 51932] [client 20.151.130.38:16164] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "afY7d67wZviJ7BgcCi930QAAAc0"]
[Sun May 03 01:59:28.029939 2026] [:error] [pid 52124:tid 52149] [client 20.151.130.38:63020] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "afY7gDjabaZ9NMm8eQugBQAAA5Q"]
[Sun May 03 01:59:29.490065 2026] [:error] [pid 11894:tid 11913] [client 20.151.130.38:63027] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fe5.php"] [unique_id "afY7gTHh6DQF1tkXIKz85wAAAVA"]
[Sun May 03 01:59:33.649204 2026] [:error] [pid 11894:tid 11907] [client 20.151.130.38:16269] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY7hTHh6DQF1tkXIKz86wAAAUo"]
[Sun May 03 01:59:36.882610 2026] [:error] [pid 51950:tid 51982] [client 20.151.130.38:64359] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY7iIoBJzYZ3RKUhdiQGQAAAkI"]
[Sun May 03 01:59:40.153742 2026] [:error] [pid 52012:tid 52094] [client 20.151.130.38:62982] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY7jEzSWr-8cpS83mgkIgAAA1E"]
[Sun May 03 01:59:41.439853 2026] [:error] [pid 53435:tid 53478] [client 20.151.130.38:65064] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY7jYDmp7_z8QkjSzMbhgAAAEY"]
[Sun May 03 01:59:43.082002 2026] [:error] [pid 52012:tid 52096] [client 20.151.130.38:65045] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afY7j0zSWr-8cpS83mgkLAAAA1M"]
[Sun May 03 01:59:46.382142 2026] [:error] [pid 51917:tid 51943] [client 20.151.130.38:16288] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afY7kq7wZviJ7BgcCi932wAAAdg"]
[Sun May 03 01:59:47.705009 2026] [:error] [pid 52012:tid 52078] [client 20.151.130.38:15877] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afY7k0zSWr-8cpS83mgkNQAAA0E"]
[Sun May 03 01:59:50.255104 2026] [proxy_fcgi:error] [pid 11894:tid 11914] [client 20.151.130.38:15908] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:50.466293 2026] [proxy_fcgi:error] [pid 11894:tid 11909] [client 20.151.130.38:15908] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:50.697911 2026] [proxy_fcgi:error] [pid 11894:tid 11916] [client 20.151.130.38:15908] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:51.193998 2026] [:error] [pid 11894:tid 11912] [client 20.151.130.38:15908] [client 20.151.130.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afY7lzHh6DQF1tkXIKz8_gAAAU8"]
[Sun May 03 01:59:52.413209 2026] [proxy_fcgi:error] [pid 52010:tid 52047] [client 20.151.130.38:16256] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:53.052791 2026] [proxy_fcgi:error] [pid 52010:tid 52054] [client 20.151.130.38:16256] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:53.700175 2026] [proxy_fcgi:error] [pid 52010:tid 52061] [client 20.151.130.38:16256] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:53.916600 2026] [proxy_fcgi:error] [pid 52010:tid 52046] [client 20.151.130.38:16256] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:54.125800 2026] [proxy_fcgi:error] [pid 52010:tid 52065] [client 20.151.130.38:16256] AH01071: Got error 'Primary script unknown'
[Sun May 03 01:59:54.349561 2026] [:error] [pid 52010:tid 52066] [client 20.151.130.38:16256] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afY7mgiR6wohDtdeJMBtRQAAAtc"]
[Sun May 03 01:59:57.841743 2026] [:error] [pid 53435:tid 53474] [client 20.151.130.38:15919] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afY7nYDmp7_z8QkjSzMblwAAAEI"]
[Sun May 03 02:00:00.935336 2026] [:error] [pid 53435:tid 53489] [client 20.151.130.38:16298] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afY7oIDmp7_z8QkjSzMbmQAAAFE"]
[Sun May 03 02:00:07.967360 2026] [:error] [pid 52010:tid 52064] [client 20.151.130.38:65047] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afY7pwiR6wohDtdeJMBtTwAAAtU"]
[Sun May 03 02:00:10.685214 2026] [:error] [pid 52010:tid 52049] [client 20.151.130.38:15881] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY7qgiR6wohDtdeJMBtVAAAAsY"]
[Sun May 03 02:00:12.355036 2026] [:error] [pid 53435:tid 53487] [client 20.151.130.38:64366] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY7rIDmp7_z8QkjSzMbqQAAAE8"]
[Sun May 03 02:00:14.780194 2026] [:error] [pid 53435:tid 53484] [client 20.151.130.38:64367] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY7roDmp7_z8QkjSzMbrgAAAEw"]
[Sun May 03 02:00:16.429927 2026] [:error] [pid 52012:tid 52094] [client 20.151.130.38:16182] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY7sEzSWr-8cpS83mgkRgAAA1E"]
[Sun May 03 02:00:18.208363 2026] [:error] [pid 52012:tid 52079] [client 20.151.130.38:15883] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afY7skzSWr-8cpS83mgkSgAAA0I"]
[Sun May 03 02:00:20.053116 2026] [:error] [pid 53435:tid 53472] [client 20.151.130.38:56819] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afY7tIDmp7_z8QkjSzMbtAAAAEA"]
[Sun May 03 02:00:22.981700 2026] [:error] [pid 52124:tid 52132] [client 20.151.130.38:15909] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afY7tjjabaZ9NMm8eQugDwAAA4M"]
[Sun May 03 02:00:31.323754 2026] [:error] [pid 22846:tid 22870] [client 20.151.130.38:64324] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afY7v4m1Ms03Mfhp3aYWyAAAARY"]
[Sun May 03 02:00:34.076375 2026] [:error] [pid 52010:tid 52066] [client 20.151.130.38:15888] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "afY7wgiR6wohDtdeJMBtXwAAAtc"]
[Sun May 03 02:00:36.418630 2026] [:error] [pid 51950:tid 51984] [client 20.151.130.38:15892] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "afY7xIoBJzYZ3RKUhdiQOwAAAkQ"]
[Sun May 03 02:00:37.785511 2026] [:error] [pid 52012:tid 52099] [client 20.151.130.38:15886] [client 20.151.130.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file48.php"] [unique_id "afY7xUzSWr-8cpS83mgkZAAAA1Y"]
[Sun May 03 02:01:02.214506 2026] [proxy_fcgi:error] [pid 53435:tid 53496] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:02.430117 2026] [proxy_fcgi:error] [pid 53435:tid 53492] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:02.818476 2026] [proxy_fcgi:error] [pid 53435:tid 53485] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:03.061539 2026] [proxy_fcgi:error] [pid 53435:tid 53476] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:03.281375 2026] [proxy_fcgi:error] [pid 53435:tid 53495] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:03.494635 2026] [proxy_fcgi:error] [pid 53435:tid 53488] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 02:01:03.922345 2026] [proxy_fcgi:error] [pid 53435:tid 53477] [client 20.151.130.38:64328] AH01071: Got error 'Primary script unknown'
[Sun May 03 04:45:37.553845 2026] [:error] [pid 40637:tid 40666] [client 144.172.116.102:44680] [client 144.172.116.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afZicZB-U30YNJ6CyVgxpwAAABM"]
[Sun May 03 05:20:30.123441 2026] [:error] [pid 21934:tid 21942] [client 51.68.235.38:47634] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afZqnnWfIjnWjXCxeM4j7gAAAQY"]
[Sun May 03 05:20:34.497790 2026] [:error] [pid 40638:tid 40677] [client 51.68.235.38:58496] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afZqovh3VcFjJ7H1mBalvAAAAEM"]
[Sun May 03 05:20:37.458053 2026] [:error] [pid 21934:tid 21955] [client 51.68.235.38:48304] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afZqpXWfIjnWjXCxeM4kCgAAARM"]
[Sun May 03 05:20:40.564595 2026] [:error] [pid 40732:tid 40749] [client 51.68.235.38:58504] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afZqqP1lQrIvlEdzcVcQAwAAAMU"]
[Sun May 03 05:20:43.740973 2026] [:error] [pid 21934:tid 21944] [client 51.68.235.38:35118] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afZqq3WfIjnWjXCxeM4kIAAAAQg"]
[Sun May 03 05:20:48.047463 2026] [:error] [pid 40732:tid 40760] [client 51.68.235.38:36682] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afZqsP1lQrIvlEdzcVcQFQAAANA"]
[Sun May 03 05:20:51.421449 2026] [:error] [pid 40637:tid 40667] [client 51.68.235.38:35134] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afZqs5B-U30YNJ6CyVg59gAAABQ"]
[Sun May 03 05:20:55.162444 2026] [:error] [pid 40639:tid 40706] [client 51.68.235.38:35736] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afZqt69rkyoICq7qxvFg5wAAAIU"]
[Sun May 03 05:20:58.263451 2026] [:error] [pid 21934:tid 21939] [client 51.68.235.38:36712] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afZqunWfIjnWjXCxeM4kKAAAAQM"]
[Sun May 03 05:21:01.158782 2026] [:error] [pid 21934:tid 21955] [client 51.68.235.38:36716] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afZqvXWfIjnWjXCxeM4kOAAAARM"]
[Sun May 03 05:21:05.354059 2026] [:error] [pid 40639:tid 40708] [client 51.68.235.38:57646] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afZqwa9rkyoICq7qxvFg-QAAAIc"]
[Sun May 03 05:21:09.274446 2026] [:error] [pid 40639:tid 40717] [client 51.68.235.38:57648] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afZqxa9rkyoICq7qxvFg_wAAAJA"]
[Sun May 03 05:21:12.527481 2026] [:error] [pid 40732:tid 40746] [client 51.68.235.38:57660] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afZqyP1lQrIvlEdzcVcQVwAAAMI"]
[Sun May 03 05:21:15.741820 2026] [:error] [pid 40638:tid 40681] [client 51.68.235.38:47694] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afZqy_h3VcFjJ7H1mBal9gAAAEc"]
[Sun May 03 05:21:18.532610 2026] [:error] [pid 40637:tid 40657] [client 51.68.235.38:47704] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afZqzpB-U30YNJ6CyVg6IwAAAAo"]
[Sun May 03 05:21:21.659135 2026] [:error] [pid 40732:tid 40755] [client 51.68.235.38:47712] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afZq0f1lQrIvlEdzcVcQbQAAAMs"]
[Sun May 03 05:21:24.814139 2026] [:error] [pid 40638:tid 40683] [client 51.68.235.38:47212] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afZq1Ph3VcFjJ7H1mBamFAAAAEk"]
[Sun May 03 05:21:54.494899 2026] [:error] [pid 40638:tid 40691] [client 51.68.235.38:36374] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afZq8vh3VcFjJ7H1mBamOAAAAFE"]
[Sun May 03 05:21:57.025693 2026] [:error] [pid 40732:tid 40752] [client 51.68.235.38:38276] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afZq9f1lQrIvlEdzcVcQmgAAAMg"]
[Sun May 03 05:21:59.567558 2026] [:error] [pid 40638:tid 40697] [client 51.68.235.38:38286] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afZq9_h3VcFjJ7H1mBamOwAAAFc"]
[Sun May 03 05:22:01.659151 2026] [:error] [pid 40638:tid 40688] [client 51.68.235.38:38288] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afZq-fh3VcFjJ7H1mBamQQAAAE4"]
[Sun May 03 05:22:04.570942 2026] [:error] [pid 40639:tid 40706] [client 51.68.235.38:55612] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afZq_K9rkyoICq7qxvFhLQAAAIU"]
[Sun May 03 05:22:06.725505 2026] [:error] [pid 40639:tid 40716] [client 51.68.235.38:55624] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afZq_q9rkyoICq7qxvFhMQAAAI8"]
[Sun May 03 05:22:08.780443 2026] [:error] [pid 21934:tid 21956] [client 51.68.235.38:55632] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afZrAHWfIjnWjXCxeM4krAAAARQ"]
[Sun May 03 05:22:10.834892 2026] [:error] [pid 40639:tid 40723] [client 51.68.235.38:55640] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afZrAq9rkyoICq7qxvFhOAAAAJY"]
[Sun May 03 05:52:53.449815 2026] [:error] [pid 40638:tid 40675] [client 145.239.65.226:58798] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afZyNfh3VcFjJ7H1mBausQAAAEE"]
[Sun May 03 05:52:55.692084 2026] [:error] [pid 40732:tid 40751] [client 145.239.65.226:38794] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afZyN_1lQrIvlEdzcVcbXAAAAMc"]
[Sun May 03 05:52:57.836639 2026] [:error] [pid 40638:tid 40696] [client 145.239.65.226:38810] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afZyOfh3VcFjJ7H1mBauugAAAFY"]
[Sun May 03 05:53:00.019269 2026] [:error] [pid 40639:tid 40722] [client 145.239.65.226:38818] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afZyPK9rkyoICq7qxvFq3AAAAJU"]
[Sun May 03 05:53:02.092014 2026] [:error] [pid 40732:tid 40767] [client 145.239.65.226:51838] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afZyPv1lQrIvlEdzcVcbbAAAANc"]
[Sun May 03 05:53:04.137985 2026] [:error] [pid 21934:tid 21938] [client 145.239.65.226:51852] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afZyQHWfIjnWjXCxeM41qgAAAQI"]
[Sun May 03 05:53:06.132356 2026] [:error] [pid 21934:tid 21945] [client 145.239.65.226:51854] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afZyQnWfIjnWjXCxeM41tAAAAQk"]
[Sun May 03 05:53:08.097783 2026] [:error] [pid 40638:tid 40688] [client 145.239.65.226:51856] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afZyRPh3VcFjJ7H1mBau1AAAAE4"]
[Sun May 03 05:53:10.189763 2026] [:error] [pid 21934:tid 21953] [client 145.239.65.226:51858] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afZyRnWfIjnWjXCxeM41ywAAARE"]
[Sun May 03 05:53:12.149509 2026] [:error] [pid 21934:tid 21942] [client 145.239.65.226:35560] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afZySHWfIjnWjXCxeM410AAAAQY"]
[Sun May 03 05:53:14.036118 2026] [:error] [pid 40732:tid 40764] [client 145.239.65.226:35564] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afZySv1lQrIvlEdzcVcbfwAAANQ"]
[Sun May 03 05:53:15.923937 2026] [:error] [pid 21934:tid 21952] [client 145.239.65.226:35566] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afZyS3WfIjnWjXCxeM415AAAARA"]
[Sun May 03 05:53:18.022294 2026] [:error] [pid 40639:tid 40715] [client 145.239.65.226:35572] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afZyTq9rkyoICq7qxvFq9gAAAI4"]
[Sun May 03 05:53:19.935885 2026] [:error] [pid 40637:tid 40663] [client 145.239.65.226:35580] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afZyT5B-U30YNJ6CyVhCMwAAABA"]
[Sun May 03 05:53:21.855071 2026] [:error] [pid 21934:tid 21955] [client 145.239.65.226:54672] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afZyUXWfIjnWjXCxeM41-wAAARM"]
[Sun May 03 05:53:23.843064 2026] [:error] [pid 21934:tid 21948] [client 145.239.65.226:54682] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afZyU3WfIjnWjXCxeM42CQAAAQw"]
[Sun May 03 05:53:25.642900 2026] [:error] [pid 40638:tid 40690] [client 145.239.65.226:54684] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afZyVfh3VcFjJ7H1mBau5AAAAFA"]
[Sun May 03 05:53:27.437507 2026] [:error] [pid 21934:tid 21959] [client 145.239.65.226:54686] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afZyV3WfIjnWjXCxeM42IwAAARc"]
[Sun May 03 05:53:29.276327 2026] [:error] [pid 21934:tid 21956] [client 145.239.65.226:54688] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afZyWXWfIjnWjXCxeM42MAAAARQ"]
[Sun May 03 05:53:31.128253 2026] [:error] [pid 21934:tid 21951] [client 145.239.65.226:54704] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afZyW3WfIjnWjXCxeM42MwAAAQ8"]
[Sun May 03 05:53:32.956133 2026] [:error] [pid 40732:tid 40765] [client 145.239.65.226:57464] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afZyXP1lQrIvlEdzcVcblgAAANU"]
[Sun May 03 05:53:35.076778 2026] [:error] [pid 40637:tid 40654] [client 145.239.65.226:57478] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afZyX5B-U30YNJ6CyVhCPAAAAAc"]
[Sun May 03 05:53:36.984131 2026] [:error] [pid 21934:tid 21960] [client 145.239.65.226:57494] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afZyYHWfIjnWjXCxeM42RwAAARg"]
[Sun May 03 05:53:38.860264 2026] [:error] [pid 21934:tid 21960] [client 145.239.65.226:57496] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afZyYnWfIjnWjXCxeM42TwAAARg"]
[Sun May 03 05:53:40.846008 2026] [:error] [pid 40639:tid 40719] [client 145.239.65.226:57504] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afZyZK9rkyoICq7qxvFrMQAAAJI"]
[Sun May 03 06:51:40.613849 2026] [:error] [pid 40456:tid 40470] [client 124.156.225.181:57336] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afZ__DSujTvwdzEkjSfBAwAAAYw"]
[Sun May 03 08:22:09.160766 2026] [:error] [pid 37246:tid 37267] [client 135.181.180.59:49102] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afaVMThvYFGNwhnPamp5ewAAARE"]
[Sun May 03 08:22:10.995516 2026] [:error] [pid 40456:tid 40472] [client 135.181.180.59:65294] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afaVMjSujTvwdzEkjSfaIgAAAY4"]
[Sun May 03 08:22:13.567471 2026] [:error] [pid 37127:tid 37189] [client 135.181.180.59:49116] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afaVNf8khJXb5O5aWVXdHAAAAEU"]
[Sun May 03 08:22:16.068543 2026] [:error] [pid 40456:tid 40481] [client 135.181.180.59:41850] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afaVODSujTvwdzEkjSfaJAAAAZc"]
[Sun May 03 08:22:17.937971 2026] [:error] [pid 40456:tid 40467] [client 135.181.180.59:12946] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afaVOTSujTvwdzEkjSfaKAAAAYk"]
[Sun May 03 08:22:19.875930 2026] [:error] [pid 37127:tid 37210] [client 135.181.180.59:12960] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afaVO_8khJXb5O5aWVXdIgAAAFg"]
[Sun May 03 08:22:21.923738 2026] [:error] [pid 37127:tid 37191] [client 135.181.180.59:12970] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afaVPf8khJXb5O5aWVXdJgAAAEc"]
[Sun May 03 08:22:23.787459 2026] [:error] [pid 37126:tid 37167] [client 135.181.180.59:12976] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afaVP_R_A42N-LtDyrvgAgAAAA4"]
[Sun May 03 08:22:26.360630 2026] [:error] [pid 37130:tid 37216] [client 135.181.180.59:59166] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afaVQqIu7bmXKXicRk804gAAAIM"]
[Sun May 03 08:22:28.879653 2026] [:error] [pid 40456:tid 40472] [client 135.181.180.59:59172] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afaVRDSujTvwdzEkjSfaOgAAAY4"]
[Sun May 03 08:22:30.985276 2026] [:error] [pid 40386:tid 40408] [client 135.181.180.59:18070] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afaVRlHJDYRXUf3IbRTeVQAAANQ"]
[Sun May 03 08:22:34.821161 2026] [:error] [pid 40456:tid 40462] [client 135.181.180.59:5252] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afaVSjSujTvwdzEkjSfaQgAAAYQ"]
[Sun May 03 08:48:07.122318 2026] [:error] [pid 37127:tid 37201] [client 147.135.213.130:41738] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afabR_8khJXb5O5aWVXjXgAAAFA"]
[Sun May 03 08:48:08.816069 2026] [:error] [pid 37126:tid 37165] [client 147.135.213.130:43800] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afabSPR_A42N-LtDyrvj-AAAAAw"]
[Sun May 03 08:48:11.204793 2026] [:error] [pid 37127:tid 37186] [client 147.135.213.130:53236] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afabS_8khJXb5O5aWVXjZwAAAEI"]
[Sun May 03 08:48:13.130553 2026] [:error] [pid 37127:tid 37189] [client 147.135.213.130:56286] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afabTf8khJXb5O5aWVXjagAAAEU"]
[Sun May 03 08:48:13.281072 2026] [:error] [pid 37127:tid 37190] [client 147.135.213.130:53240] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afabTf8khJXb5O5aWVXjawAAAEY"]
[Sun May 03 08:48:14.790082 2026] [:error] [pid 40422:tid 40426] [client 147.135.213.130:56292] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afabTkHBbBLrXh6PBuuP8wAAAUA"]
[Sun May 03 08:48:15.519090 2026] [:error] [pid 40422:tid 40430] [client 147.135.213.130:53254] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afabT0HBbBLrXh6PBuuP9QAAAUQ"]
[Sun May 03 08:48:18.041972 2026] [:error] [pid 40422:tid 40431] [client 147.135.213.130:53260] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afabUkHBbBLrXh6PBuuP_AAAAUU"]
[Sun May 03 08:48:18.610039 2026] [:error] [pid 37246:tid 37251] [client 147.135.213.130:57928] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "afabUjhvYFGNwhnPamqDpQAAAQM"]
[Sun May 03 08:48:20.134097 2026] [:error] [pid 40456:tid 40466] [client 147.135.213.130:57932] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afabVDSujTvwdzEkjSfjBQAAAYg"]
[Sun May 03 08:48:22.799169 2026] [:error] [pid 40456:tid 40477] [client 147.135.213.130:46346] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afabVjSujTvwdzEkjSfjEAAAAZM"]
[Sun May 03 08:48:25.281955 2026] [:error] [pid 40386:tid 40399] [client 147.135.213.130:46358] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afabWVHJDYRXUf3IbRTjswAAAMs"]
[Sun May 03 08:48:27.891016 2026] [:error] [pid 40422:tid 40435] [client 147.135.213.130:46368] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afabW0HBbBLrXh6PBuuQBgAAAUk"]
[Sun May 03 08:48:30.535656 2026] [:error] [pid 37246:tid 37271] [client 147.135.213.130:43366] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afabXjhvYFGNwhnPamqDrQAAARU"]
[Sun May 03 08:48:32.971830 2026] [:error] [pid 40456:tid 40461] [client 147.135.213.130:43382] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afabYDSujTvwdzEkjSfjGgAAAYM"]
[Sun May 03 08:48:35.468941 2026] [:error] [pid 40422:tid 40442] [client 147.135.213.130:43384] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afabY0HBbBLrXh6PBuuQEwAAAVA"]
[Sun May 03 08:48:37.872361 2026] [:error] [pid 37246:tid 37267] [client 147.135.213.130:43386] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afabZThvYFGNwhnPamqDtgAAARE"]
[Sun May 03 08:48:40.275518 2026] [:error] [pid 40422:tid 40445] [client 147.135.213.130:35780] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afabaEHBbBLrXh6PBuuQHQAAAVM"]
[Sun May 03 08:48:42.587166 2026] [:error] [pid 40422:tid 40429] [client 147.135.213.130:35784] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afabakHBbBLrXh6PBuuQIgAAAUM"]
[Sun May 03 08:48:45.117973 2026] [:error] [pid 37130:tid 37233] [client 147.135.213.130:35794] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afabbaIu7bmXKXicRk86IgAAAJQ"]
[Sun May 03 08:48:47.677122 2026] [:error] [pid 37246:tid 37269] [client 147.135.213.130:35796] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afabbzhvYFGNwhnPamqDwgAAARM"]
[Sun May 03 08:48:50.114439 2026] [:error] [pid 40456:tid 40472] [client 147.135.213.130:36512] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afabcjSujTvwdzEkjSfjKQAAAY4"]
[Sun May 03 08:48:52.387442 2026] [:error] [pid 40386:tid 40390] [client 147.135.213.130:36522] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afabdFHJDYRXUf3IbRTjwgAAAMI"]
[Sun May 03 08:48:54.802016 2026] [:error] [pid 37130:tid 37227] [client 147.135.213.130:36534] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afabdqIu7bmXKXicRk86KAAAAI4"]
[Sun May 03 08:48:57.317765 2026] [:error] [pid 40422:tid 40442] [client 147.135.213.130:36548] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afabeUHBbBLrXh6PBuuQLAAAAVA"]
[Sun May 03 08:48:57.326995 2026] [:error] [pid 40422:tid 40448] [client 147.135.213.130:55496] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afabeUHBbBLrXh6PBuuQLQAAAVY"]
[Sun May 03 08:48:59.658791 2026] [:error] [pid 40456:tid 40463] [client 147.135.213.130:54354] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afabezSujTvwdzEkjSfjPAAAAYU"]
[Sun May 03 08:49:00.949662 2026] [:error] [pid 37127:tid 37189] [client 147.135.213.130:57020] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afabfP8khJXb5O5aWVXjhwAAAEU"]
[Sun May 03 08:49:01.965864 2026] [:error] [pid 37246:tid 37270] [client 147.135.213.130:54366] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afabfThvYFGNwhnPamqD1gAAARQ"]
[Sun May 03 08:49:04.388518 2026] [:error] [pid 40456:tid 40479] [client 147.135.213.130:54378] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afabgDSujTvwdzEkjSfjRQAAAZU"]
[Sun May 03 08:49:25.797536 2026] [:error] [pid 37130:tid 37233] [client 147.135.213.130:54390] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afablaIu7bmXKXicRk86VgAAAJQ"]
[Sun May 03 08:49:27.670033 2026] [:error] [pid 37127:tid 37209] [client 147.135.213.130:55036] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afabl_8khJXb5O5aWVXjqwAAAFc"]
[Sun May 03 08:49:29.620990 2026] [:error] [pid 37127:tid 37207] [client 147.135.213.130:43830] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afabmf8khJXb5O5aWVXjrgAAAFU"]
[Sun May 03 08:49:31.609975 2026] [:error] [pid 37130:tid 37218] [client 147.135.213.130:43840] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afabm6Iu7bmXKXicRk86WQAAAIU"]
[Sun May 03 08:49:33.501453 2026] [:error] [pid 37130:tid 37216] [client 147.135.213.130:43854] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afabnaIu7bmXKXicRk86WgAAAIM"]
[Sun May 03 08:49:35.368282 2026] [:error] [pid 40456:tid 40460] [client 147.135.213.130:43860] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afabnzSujTvwdzEkjSfjXwAAAYI"]
[Sun May 03 08:49:37.486783 2026] [:error] [pid 37130:tid 37237] [client 147.135.213.130:43870] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afaboaIu7bmXKXicRk86XAAAAJg"]
[Sun May 03 08:49:39.928600 2026] [:error] [pid 37127:tid 37185] [client 147.135.213.130:44734] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afabo_8khJXb5O5aWVXjuAAAAEE"]
[Sun May 03 08:49:42.407157 2026] [:error] [pid 40456:tid 40475] [client 147.135.213.130:44742] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afabpjSujTvwdzEkjSfjcAAAAZE"]
[Sun May 03 08:49:44.905036 2026] [:error] [pid 37130:tid 37224] [client 147.135.213.130:44758] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afabqKIu7bmXKXicRk86ZAAAAIs"]
[Sun May 03 08:49:47.266329 2026] [:error] [pid 40422:tid 40448] [client 147.135.213.130:44774] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afabq0HBbBLrXh6PBuuQWwAAAVY"]
[Sun May 03 08:49:49.276745 2026] [:error] [pid 40422:tid 40439] [client 147.135.213.130:44348] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afabrUHBbBLrXh6PBuuQZgAAAU0"]
[Sun May 03 08:49:51.229920 2026] [:error] [pid 40386:tid 40400] [client 147.135.213.130:44356] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afabr1HJDYRXUf3IbRTj7QAAAMw"]
[Sun May 03 08:49:53.890523 2026] [:error] [pid 40422:tid 40450] [client 147.135.213.130:59860] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afabsUHBbBLrXh6PBuuQdwAAAVg"]
[Sun May 03 08:49:55.852032 2026] [:error] [pid 40422:tid 40448] [client 147.135.213.130:44370] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afabs0HBbBLrXh6PBuuQewAAAVY"]
[Sun May 03 08:49:58.313399 2026] [:error] [pid 40422:tid 40431] [client 147.135.213.130:59874] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afabtkHBbBLrXh6PBuuQgwAAAUU"]
[Sun May 03 08:50:00.163294 2026] [:error] [pid 37130:tid 37235] [client 147.135.213.130:47526] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afabuKIu7bmXKXicRk86cAAAAJY"]
[Sun May 03 08:50:02.616443 2026] [:error] [pid 40422:tid 40428] [client 147.135.213.130:54978] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afabukHBbBLrXh6PBuuQkQAAAUI"]
[Sun May 03 08:50:05.019681 2026] [:error] [pid 40422:tid 40429] [client 147.135.213.130:54980] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afabvUHBbBLrXh6PBuuQmwAAAUM"]
[Sun May 03 08:50:07.127779 2026] [:error] [pid 40422:tid 40426] [client 147.135.213.130:47534] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afabv0HBbBLrXh6PBuuQoAAAAUA"]
[Sun May 03 08:50:09.599092 2026] [:error] [pid 37246:tid 37252] [client 147.135.213.130:51840] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afabwThvYFGNwhnPamqEMwAAAQQ"]
[Sun May 03 08:50:12.152221 2026] [:error] [pid 40456:tid 40465] [client 147.135.213.130:51856] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afabxDSujTvwdzEkjSfjewAAAYc"]
[Sun May 03 08:50:14.545812 2026] [:error] [pid 37246:tid 37254] [client 147.135.213.130:51858] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afabxjhvYFGNwhnPamqENgAAAQY"]
[Sun May 03 08:50:17.004662 2026] [:error] [pid 40422:tid 40429] [client 147.135.213.130:51868] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afabyUHBbBLrXh6PBuuQpgAAAUM"]
[Sun May 03 08:50:18.803678 2026] [:error] [pid 37127:tid 37201] [client 147.135.213.130:59720] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afabyv8khJXb5O5aWVXj1wAAAFA"]
[Sun May 03 08:50:21.260813 2026] [:error] [pid 40422:tid 40428] [client 147.135.213.130:45942] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afabzUHBbBLrXh6PBuuQrAAAAUI"]
[Sun May 03 08:50:23.669068 2026] [:error] [pid 37246:tid 37261] [client 147.135.213.130:45958] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afabzzhvYFGNwhnPamqEPgAAAQs"]
[Sun May 03 10:04:19.944116 2026] [:error] [pid 40386:tid 40389] [client 135.181.180.59:50690] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afatI1HJDYRXUf3IbRTt2wAAAME"]
[Sun May 03 10:04:23.157876 2026] [:error] [pid 40386:tid 40404] [client 135.181.180.59:38626] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afatJ1HJDYRXUf3IbRTt3AAAANA"]
[Sun May 03 10:04:27.082303 2026] [:error] [pid 40422:tid 40447] [client 135.181.180.59:39916] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afatK0HBbBLrXh6PBuuwswAAAVU"]
[Sun May 03 11:19:06.555068 2026] [:error] [pid 40422:tid 40447] [client 51.68.235.235:44092] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afa-qkHBbBLrXh6PBuvJpwAAAVU"]
[Sun May 03 11:19:08.307515 2026] [:error] [pid 40386:tid 40402] [client 51.68.235.235:45922] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afa-rFHJDYRXUf3IbRT2YQAAAM4"]
[Sun May 03 11:19:10.244293 2026] [:error] [pid 37126:tid 37158] [client 51.68.235.235:59056] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afa-rvR_A42N-LtDyrvzOAAAAAU"]
[Sun May 03 11:19:12.830584 2026] [:error] [pid 40422:tid 40434] [client 51.68.235.235:41162] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afa-sEHBbBLrXh6PBuvJuAAAAUg"]
[Sun May 03 11:19:14.801660 2026] [:error] [pid 40422:tid 40437] [client 51.68.235.235:59066] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afa-skHBbBLrXh6PBuvJvwAAAUs"]
[Sun May 03 11:19:16.607649 2026] [:error] [pid 40422:tid 40448] [client 51.68.235.235:59632] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afa-tEHBbBLrXh6PBuvJwgAAAVY"]
[Sun May 03 11:19:18.636563 2026] [:error] [pid 40422:tid 40436] [client 51.68.235.235:59646] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afa-tkHBbBLrXh6PBuvJwwAAAUo"]
[Sun May 03 11:19:20.448567 2026] [:error] [pid 40422:tid 40431] [client 51.68.235.235:59654] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afa-uEHBbBLrXh6PBuvJyAAAAUU"]
[Sun May 03 11:19:22.281800 2026] [:error] [pid 40422:tid 40447] [client 51.68.235.235:59664] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afa-ukHBbBLrXh6PBuvJywAAAVU"]
[Sun May 03 11:19:24.910450 2026] [:error] [pid 40456:tid 40479] [client 51.68.235.235:42850] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afa-vDSujTvwdzEkjScD_AAAAZU"]
[Sun May 03 11:19:27.395824 2026] [:error] [pid 40422:tid 40426] [client 51.68.235.235:38144] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afa-v0HBbBLrXh6PBuvJ2AAAAUA"]
[Sun May 03 11:19:29.351803 2026] [:error] [pid 40422:tid 40428] [client 51.68.235.235:49166] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afa-wUHBbBLrXh6PBuvJ3QAAAUI"]
[Sun May 03 11:19:31.803644 2026] [:error] [pid 37130:tid 37236] [client 51.68.235.235:38158] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afa-w6Iu7bmXKXicRk9QmAAAAJc"]
[Sun May 03 11:19:34.380464 2026] [:error] [pid 37126:tid 37158] [client 51.68.235.235:38166] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afa-xvR_A42N-LtDyrvzSQAAAAU"]
[Sun May 03 11:19:36.766172 2026] [:error] [pid 37246:tid 37254] [client 51.68.235.235:56974] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afa-yDhvYFGNwhnPamqsgwAAAQY"]
[Sun May 03 11:19:39.189783 2026] [:error] [pid 40386:tid 40404] [client 51.68.235.235:56990] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afa-y1HJDYRXUf3IbRT2cAAAANA"]
[Sun May 03 11:19:41.078168 2026] [:error] [pid 40422:tid 40436] [client 51.68.235.235:48238] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afa-zUHBbBLrXh6PBuvJ4AAAAUo"]
[Sun May 03 11:19:43.464698 2026] [:error] [pid 37246:tid 37251] [client 51.68.235.235:56998] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afa-zzhvYFGNwhnPamqsigAAAQM"]
[Sun May 03 11:19:45.545814 2026] [:error] [pid 40422:tid 40447] [client 51.68.235.235:59816] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afa-0UHBbBLrXh6PBuvJ5gAAAVU"]
[Sun May 03 11:19:47.455768 2026] [:error] [pid 37246:tid 37265] [client 51.68.235.235:59826] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afa-0zhvYFGNwhnPamqskQAAAQ8"]
[Sun May 03 11:19:49.524496 2026] [:error] [pid 40422:tid 40448] [client 51.68.235.235:59828] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afa-1UHBbBLrXh6PBuvJ6gAAAVY"]
[Sun May 03 11:19:51.409471 2026] [:error] [pid 40386:tid 40401] [client 51.68.235.235:59844] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afa-11HJDYRXUf3IbRT2fwAAAM0"]
[Sun May 03 11:19:53.946444 2026] [:error] [pid 37126:tid 37157] [client 51.68.235.235:56344] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afa-2fR_A42N-LtDyrvzVQAAAAQ"]
[Sun May 03 11:19:55.835480 2026] [:error] [pid 37126:tid 37177] [client 51.68.235.235:50592] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afa-2_R_A42N-LtDyrvzWgAAABg"]
[Sun May 03 11:19:58.228303 2026] [:error] [pid 40386:tid 40411] [client 51.68.235.235:43048] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afa-3lHJDYRXUf3IbRT2hwAAANc"]
[Sun May 03 11:20:00.116496 2026] [:error] [pid 40422:tid 40443] [client 51.68.235.235:50596] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afa-4EHBbBLrXh6PBuvKEgAAAVE"]
[Sun May 03 11:20:02.157895 2026] [:error] [pid 40456:tid 40465] [client 51.68.235.235:50608] [client 51.68.235.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afa-4jSujTvwdzEkjScEBQAAAYc"]
[Sun May 03 11:45:01.525479 2026] [:error] [pid 40456:tid 40480] [client 119.91.20.139:36136] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afbEvTSujTvwdzEkjScJ2wAAAZY"]
[Sun May 03 13:04:15.295494 2026] [:error] [pid 40422:tid 40444] [client 62.84.185.52:40096] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afbXT0HBbBLrXh6PBuvtdgAAAVI"]
[Sun May 03 13:04:17.169982 2026] [:error] [pid 37127:tid 37200] [client 62.84.185.52:40100] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afbXUf8khJXb5O5aWVUQTQAAAE8"]
[Sun May 03 13:04:19.754391 2026] [:error] [pid 40422:tid 40433] [client 62.84.185.52:16550] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afbXU0HBbBLrXh6PBuvthQAAAUc"]
[Sun May 03 13:04:21.772481 2026] [:error] [pid 37126:tid 37151] [client 62.84.185.52:39742] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afbXVfR_A42N-LtDyrv9MwAAAAA"]
[Sun May 03 13:04:23.802109 2026] [:error] [pid 40422:tid 40433] [client 62.84.185.52:39750] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afbXV0HBbBLrXh6PBuvtkAAAAUc"]
[Sun May 03 13:04:26.310497 2026] [:error] [pid 37126:tid 37153] [client 62.84.185.52:41920] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afbXWvR_A42N-LtDyrv9PAAAAAI"]
[Sun May 03 13:04:28.315035 2026] [:error] [pid 37130:tid 37213] [client 62.84.185.52:39756] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afbXXKIu7bmXKXicRk9daQAAAIA"]
[Sun May 03 13:04:30.937944 2026] [:error] [pid 37127:tid 37190] [client 62.84.185.52:41928] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afbXXv8khJXb5O5aWVUQXAAAAEY"]
[Sun May 03 13:04:32.842855 2026] [:error] [pid 40422:tid 40442] [client 62.84.185.52:27802] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afbXYEHBbBLrXh6PBuvtowAAAVA"]
[Sun May 03 13:04:34.873870 2026] [:error] [pid 37126:tid 37158] [client 62.84.185.52:27806] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afbXYvR_A42N-LtDyrv9PgAAAAU"]
[Sun May 03 13:04:36.883817 2026] [:error] [pid 40422:tid 40430] [client 62.84.185.52:27818] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afbXZEHBbBLrXh6PBuvtsgAAAUQ"]
[Sun May 03 13:04:38.907405 2026] [:error] [pid 40422:tid 40446] [client 62.84.185.52:27832] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afbXZkHBbBLrXh6PBuvtuAAAAVQ"]
[Sun May 03 13:04:40.895212 2026] [:error] [pid 37246:tid 37256] [client 62.84.185.52:26912] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afbXaDhvYFGNwhnPamrHnwAAAQg"]
[Sun May 03 13:04:42.907617 2026] [:error] [pid 40456:tid 40476] [client 62.84.185.52:26928] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afbXajSujTvwdzEkjScYCgAAAZI"]
[Sun May 03 13:04:45.567713 2026] [:error] [pid 40386:tid 40412] [client 62.84.185.52:26922] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afbXbVHJDYRXUf3IbRQBbQAAANg"]
[Sun May 03 13:04:48.239133 2026] [:error] [pid 37246:tid 37249] [client 62.84.185.52:26926] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afbXcDhvYFGNwhnPamrHpAAAAQE"]
[Sun May 03 13:04:50.136621 2026] [:error] [pid 40422:tid 40439] [client 62.84.185.52:26930] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afbXckHBbBLrXh6PBuvtywAAAU0"]
[Sun May 03 13:04:53.837384 2026] [:error] [pid 40422:tid 40434] [client 62.84.185.52:42496] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afbXdUHBbBLrXh6PBuvt0QAAAUg"]
[Sun May 03 15:54:50.433332 2026] [:error] [pid 37126:tid 37167] [client 43.133.91.48:40634] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afb_SvR_A42N-LtDyrsYZAAAAA4"]
[Sun May 03 21:03:26.363080 2026] [:error] [pid 54535:tid 54560] [client 103.24.85.28:52442] [client 103.24.85.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.24.85.28, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afdHnvRyz79iR-ntJRL4EQAAAhc"]
[Sun May 03 21:03:26.376575 2026] [proxy_fcgi:error] [pid 54535:tid 54560] [client 103.24.85.28:52442] AH01071: Got error 'Primary script unknown'
[Sun May 03 21:04:32.443531 2026] [:error] [pid 40422:tid 40435] [client 185.231.100.76:35402] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afdH4EHBbBLrXh6PButNzAAAAUk"]
[Sun May 03 21:04:34.419303 2026] [:error] [pid 34432:tid 34451] [client 185.231.100.76:35962] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afdH4p73JKVQ0wlof4J-XwAAAdE"]
[Sun May 03 21:04:36.431900 2026] [:error] [pid 34432:tid 34436] [client 185.231.100.76:35974] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afdH5J73JKVQ0wlof4J-YAAAAcI"]
[Sun May 03 21:04:38.427971 2026] [:error] [pid 40422:tid 40436] [client 185.231.100.76:35978] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afdH5kHBbBLrXh6PButN2AAAAUo"]
[Sun May 03 21:04:40.412833 2026] [:error] [pid 37127:tid 37200] [client 185.231.100.76:35992] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afdH6P8khJXb5O5aWVVIiwAAAE8"]
[Sun May 03 21:04:42.421478 2026] [:error] [pid 37126:tid 37173] [client 185.231.100.76:36008] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afdH6vR_A42N-LtDyrtJPgAAABQ"]
[Sun May 03 21:04:44.441417 2026] [:error] [pid 34432:tid 34447] [client 185.231.100.76:47454] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afdH7J73JKVQ0wlof4J-aAAAAc0"]
[Sun May 03 21:04:46.449701 2026] [:error] [pid 54535:tid 54557] [client 185.231.100.76:47466] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afdH7vRyz79iR-ntJRL4UAAAAhQ"]
[Sun May 03 21:04:48.466386 2026] [:error] [pid 34432:tid 34456] [client 185.231.100.76:47472] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afdH8J73JKVQ0wlof4J-bQAAAdY"]
[Sun May 03 21:04:50.475775 2026] [:error] [pid 54535:tid 54548] [client 185.231.100.76:47482] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afdH8vRyz79iR-ntJRL4WAAAAgs"]
[Sun May 03 21:04:52.494489 2026] [:error] [pid 34432:tid 34457] [client 185.231.100.76:47494] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afdH9J73JKVQ0wlof4J-bgAAAdc"]
[Sun May 03 21:04:54.497600 2026] [:error] [pid 54535:tid 54547] [client 185.231.100.76:45974] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afdH9vRyz79iR-ntJRL4WQAAAgo"]
[Sun May 03 21:04:56.501307 2026] [:error] [pid 34432:tid 34446] [client 185.231.100.76:45976] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afdH-J73JKVQ0wlof4J-cwAAAcw"]
[Sun May 03 21:04:58.508144 2026] [:error] [pid 34432:tid 34451] [client 185.231.100.76:45986] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afdH-p73JKVQ0wlof4J-eAAAAdE"]
[Sun May 03 21:05:00.361848 2026] [:error] [pid 54535:tid 54561] [client 185.231.100.76:45994] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afdH_PRyz79iR-ntJRL4XgAAAhg"]
[Sun May 03 21:05:02.383828 2026] [:error] [pid 34432:tid 34434] [client 185.231.100.76:46002] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afdH_p73JKVQ0wlof4J-fwAAAcA"]
[Sun May 03 21:05:04.283994 2026] [:error] [pid 34432:tid 34452] [client 185.231.100.76:60250] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afdIAJ73JKVQ0wlof4J-hAAAAdI"]
[Sun May 03 21:05:06.318229 2026] [:error] [pid 34432:tid 34457] [client 185.231.100.76:60258] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afdIAp73JKVQ0wlof4J-iwAAAdc"]
[Sun May 03 21:05:08.244358 2026] [:error] [pid 34432:tid 34437] [client 185.231.100.76:60268] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afdIBJ73JKVQ0wlof4J-kAAAAcM"]
[Sun May 03 21:05:10.105366 2026] [:error] [pid 40422:tid 40439] [client 185.231.100.76:60272] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afdIBkHBbBLrXh6PButN2wAAAU0"]
[Sun May 03 21:05:12.108749 2026] [:error] [pid 54535:tid 54555] [client 185.231.100.76:60280] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afdICPRyz79iR-ntJRL4YwAAAhI"]
[Sun May 03 21:05:14.096652 2026] [:error] [pid 54535:tid 54553] [client 185.231.100.76:53622] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afdICvRyz79iR-ntJRL4ZgAAAhA"]
[Sun May 03 21:05:16.112660 2026] [:error] [pid 37246:tid 37250] [client 185.231.100.76:53628] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afdIDDhvYFGNwhnPamovgwAAAQI"]
[Sun May 03 21:05:18.119779 2026] [:error] [pid 34432:tid 34436] [client 185.231.100.76:53638] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afdIDp73JKVQ0wlof4J-mwAAAcI"]
[Sun May 03 21:05:20.126950 2026] [:error] [pid 34432:tid 34446] [client 185.231.100.76:53646] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afdIEJ73JKVQ0wlof4J-owAAAcw"]
[Sun May 03 21:05:22.170984 2026] [:error] [pid 40422:tid 40444] [client 185.231.100.76:53656] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afdIEkHBbBLrXh6PButN3QAAAVI"]
[Sun May 03 21:05:24.206331 2026] [:error] [pid 54535:tid 54552] [client 185.231.100.76:55048] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afdIFPRyz79iR-ntJRL4cwAAAg8"]
[Sun May 03 21:05:26.207434 2026] [:error] [pid 37246:tid 37259] [client 185.231.100.76:55050] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afdIFjhvYFGNwhnPamovigAAAQo"]
[Sun May 03 21:05:27.436823 2026] [:error] [pid 40422:tid 40447] [client 185.231.100.76:55056] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afdIF0HBbBLrXh6PButN3wAAAVU"]
[Sun May 03 21:05:49.584319 2026] [:error] [pid 34432:tid 34446] [client 185.231.100.76:55066] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afdILZ73JKVQ0wlof4J-3wAAAcw"]
[Sun May 03 21:05:51.551714 2026] [:error] [pid 54535:tid 54537] [client 185.231.100.76:51626] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afdIL_Ryz79iR-ntJRL4nwAAAgA"]
[Sun May 03 21:05:53.583164 2026] [:error] [pid 37246:tid 37250] [client 185.231.100.76:57642] [client 185.231.100.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afdIMThvYFGNwhnPamovpwAAAQI"]
[Sun May 03 21:31:44.802963 2026] [:error] [pid 40456:tid 40459] [client 43.164.129.191:48852] [client 43.164.129.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afdOQDSujTvwdzEkjSdbHQAAAYE"]
[Sun May 03 23:10:37.472986 2026] [:error] [pid 37246:tid 37248] [client 54.37.252.231:43478] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afdlbThvYFGNwhnPampA3AAAAQA"]
[Sun May 03 23:10:39.334262 2026] [:error] [pid 37246:tid 37268] [client 54.37.252.231:37078] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afdlbzhvYFGNwhnPampA4gAAARI"]
[Sun May 03 23:10:41.321323 2026] [:error] [pid 37246:tid 37250] [client 54.37.252.231:37084] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afdlcThvYFGNwhnPampA5AAAAQI"]
[Sun May 03 23:10:43.307749 2026] [:error] [pid 34432:tid 34439] [client 54.37.252.231:45252] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afdlc573JKVQ0wlof4KaVwAAAcU"]
[Sun May 03 23:10:45.108201 2026] [:error] [pid 37127:tid 37196] [client 54.37.252.231:45268] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afdldf8khJXb5O5aWVVQogAAAEw"]
[Sun May 03 23:10:47.175570 2026] [:error] [pid 34432:tid 34458] [client 54.37.252.231:45276] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afdld573JKVQ0wlof4KaYwAAAdg"]
[Sun May 03 23:10:49.056629 2026] [:error] [pid 37130:tid 37236] [client 54.37.252.231:45280] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afdleaIu7bmXKXicRk-VfAAAAJc"]
[Sun May 03 23:10:51.109436 2026] [:error] [pid 37130:tid 37225] [client 54.37.252.231:45282] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afdle6Iu7bmXKXicRk-VggAAAIw"]
[Sun May 03 23:10:53.037332 2026] [:error] [pid 40386:tid 40405] [client 54.37.252.231:33018] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afdlfVHJDYRXUf3IbRQwZwAAANE"]
[Sun May 03 23:10:54.959335 2026] [:error] [pid 37127:tid 37208] [client 54.37.252.231:33034] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afdlfv8khJXb5O5aWVVQpAAAAFY"]
[Sun May 03 23:10:56.859653 2026] [:error] [pid 40422:tid 40444] [client 54.37.252.231:33040] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afdlgEHBbBLrXh6PButZowAAAVI"]
[Sun May 03 23:10:58.902680 2026] [:error] [pid 40422:tid 40443] [client 54.37.252.231:33044] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afdlgkHBbBLrXh6PButZpwAAAVE"]
[Sun May 03 23:11:00.916726 2026] [:error] [pid 40422:tid 40432] [client 54.37.252.231:33054] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afdlhEHBbBLrXh6PButZqQAAAUY"]
[Sun May 03 23:11:02.871180 2026] [:error] [pid 37130:tid 37220] [client 54.37.252.231:56476] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afdlhqIu7bmXKXicRk-VhgAAAIc"]
[Sun May 03 23:11:04.784770 2026] [:error] [pid 34432:tid 34449] [client 54.37.252.231:56490] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afdliJ73JKVQ0wlof4KabAAAAc8"]
[Sun May 03 23:11:06.831905 2026] [:error] [pid 37130:tid 37228] [client 54.37.252.231:56504] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afdliqIu7bmXKXicRk-ViwAAAI8"]
[Sun May 03 23:11:08.917450 2026] [:error] [pid 54535:tid 54538] [client 54.37.252.231:56514] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afdljPRyz79iR-ntJRINBQAAAgE"]
[Sun May 03 23:11:10.879780 2026] [:error] [pid 34432:tid 34447] [client 54.37.252.231:56520] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afdljp73JKVQ0wlof4KadwAAAc0"]
[Sun May 03 23:11:12.974633 2026] [:error] [pid 40456:tid 40467] [client 54.37.252.231:50202] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afdlkDSujTvwdzEkjSdkfgAAAYk"]
[Sun May 03 23:11:14.986944 2026] [:error] [pid 40422:tid 40433] [client 54.37.252.231:50216] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afdlkkHBbBLrXh6PButZsgAAAUc"]
[Sun May 03 23:11:17.111096 2026] [:error] [pid 34432:tid 34444] [client 54.37.252.231:50224] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afdllZ73JKVQ0wlof4KaegAAAco"]
[Sun May 03 23:11:19.118389 2026] [:error] [pid 37130:tid 37224] [client 54.37.252.231:50228] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afdll6Iu7bmXKXicRk-VlAAAAIs"]
[Sun May 03 23:11:21.077568 2026] [:error] [pid 37126:tid 37172] [client 54.37.252.231:50234] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afdlmfR_A42N-LtDyrtXIwAAABM"]
[Sun May 03 23:11:22.975342 2026] [:error] [pid 34432:tid 34443] [client 54.37.252.231:55902] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afdlmp73JKVQ0wlof4KafwAAAck"]
[Sun May 03 23:11:25.003769 2026] [:error] [pid 37130:tid 37237] [client 54.37.252.231:55914] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afdlnaIu7bmXKXicRk-VmAAAAJg"]
[Sun May 03 23:11:27.057037 2026] [:error] [pid 40422:tid 40441] [client 54.37.252.231:55922] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afdln0HBbBLrXh6PButZvQAAAU8"]
[Mon May 04 01:05:38.039673 2026] [:error] [pid 37127:tid 37208] [client 162.14.81.106:38356] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afeAYv8khJXb5O5aWVVUdwAAAFY"]
[Mon May 04 01:59:43.904164 2026] [:error] [pid 37130:tid 37228] [client 51.250.87.193:53380] [client 51.250.87.193] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/x-ms-wmv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afeND6Iu7bmXKXicRk-lzQAAAI8"]
[Mon May 04 02:08:35.590321 2026] [:error] [pid 37246:tid 37253] [client 62.84.185.52:54816] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afePIzhvYFGNwhnPampLIgAAAQU"]
[Mon May 04 02:08:38.218464 2026] [:error] [pid 37130:tid 37217] [client 62.84.185.52:54822] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afePJqIu7bmXKXicRk-mMwAAAIQ"]
[Mon May 04 02:08:40.394225 2026] [:error] [pid 54535:tid 54561] [client 62.84.185.52:48124] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afePKPRyz79iR-ntJRIopgAAAhg"]
[Mon May 04 02:08:43.059699 2026] [:error] [pid 40422:tid 40447] [client 62.84.185.52:12864] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afePK0HBbBLrXh6PButiUAAAAVU"]
[Mon May 04 02:08:45.077864 2026] [:error] [pid 34432:tid 34450] [client 62.84.185.52:45764] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afePLZ73JKVQ0wlof4KpzQAAAdA"]
[Mon May 04 02:08:47.729946 2026] [:error] [pid 40456:tid 40460] [client 62.84.185.52:12880] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afePLzSujTvwdzEkjSd1LQAAAYI"]
[Mon May 04 02:08:49.800270 2026] [:error] [pid 40456:tid 40466] [client 62.84.185.52:45770] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afePMTSujTvwdzEkjSd1NwAAAYg"]
[Mon May 04 02:08:52.401176 2026] [:error] [pid 40456:tid 40471] [client 62.84.185.52:30764] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afePNDSujTvwdzEkjSd1bwAAAY0"]
[Mon May 04 02:08:54.416956 2026] [:error] [pid 40386:tid 40404] [client 62.84.185.52:63848] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afePNlHJDYRXUf3IbRRCGQAAANA"]
[Mon May 04 02:08:56.334614 2026] [:error] [pid 54535:tid 54555] [client 62.84.185.52:63862] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afePOPRyz79iR-ntJRIoqAAAAhI"]
[Mon May 04 02:08:58.964478 2026] [:error] [pid 40386:tid 40396] [client 62.84.185.52:30780] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afePOlHJDYRXUf3IbRRCHAAAAMg"]
[Mon May 04 02:09:01.682924 2026] [:error] [pid 37130:tid 37232] [client 62.84.185.52:37068] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afePPaIu7bmXKXicRk-mNAAAAJM"]
[Mon May 04 02:09:04.412801 2026] [:error] [pid 40386:tid 40399] [client 62.84.185.52:37070] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afePQFHJDYRXUf3IbRRCIQAAAMs"]
[Mon May 04 02:09:07.179435 2026] [:error] [pid 37246:tid 37274] [client 62.84.185.52:37078] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afePQzhvYFGNwhnPampLKgAAARg"]
[Mon May 04 02:09:09.770517 2026] [:error] [pid 37130:tid 37230] [client 62.84.185.52:37088] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afePRaIu7bmXKXicRk-mNgAAAJE"]
[Mon May 04 02:09:12.451769 2026] [:error] [pid 40386:tid 40406] [client 62.84.185.52:19824] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afePSFHJDYRXUf3IbRRCKAAAANI"]
[Mon May 04 02:09:14.974097 2026] [:error] [pid 37130:tid 37213] [client 62.84.185.52:19838] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afePSqIu7bmXKXicRk-mOAAAAIA"]
[Mon May 04 02:09:17.465006 2026] [:error] [pid 40456:tid 40478] [client 62.84.185.52:19852] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afePTTSujTvwdzEkjSd1fQAAAZQ"]
[Mon May 04 02:09:20.090720 2026] [:error] [pid 54535:tid 54545] [client 62.84.185.52:19858] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afePUPRyz79iR-ntJRIorAAAAgg"]
[Mon May 04 02:09:22.797179 2026] [:error] [pid 40386:tid 40405] [client 62.84.185.52:46176] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afePUlHJDYRXUf3IbRRCLQAAANE"]
[Mon May 04 02:09:24.476733 2026] [:error] [pid 54535:tid 54553] [client 62.84.185.52:30506] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afePVPRyz79iR-ntJRIorgAAAhA"]
[Mon May 04 02:09:28.237455 2026] [:error] [pid 54535:tid 54556] [client 62.84.185.52:30516] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afePWPRyz79iR-ntJRIosQAAAhM"]
[Mon May 04 02:12:12.147616 2026] [:error] [pid 54535:tid 54552] [client 35.198.212.52:46440] [client 35.198.212.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "afeP_PRyz79iR-ntJRIpGQAAAg8"]
[Mon May 04 02:12:29.047435 2026] [:error] [pid 37127:tid 37186] [client 79.137.67.30:45118] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afeQDf8khJXb5O5aWVVXCwAAAEI"]
[Mon May 04 02:12:32.824714 2026] [:error] [pid 40422:tid 40442] [client 79.137.67.30:35804] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afeQEEHBbBLrXh6PButilQAAAVA"]
[Mon May 04 02:12:38.396246 2026] [:error] [pid 34432:tid 34445] [client 79.137.67.30:42148] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afeQFp73JKVQ0wlof4KqBwAAAcs"]
[Mon May 04 02:12:44.157901 2026] [:error] [pid 37246:tid 37265] [client 79.137.67.30:42162] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afeQHDhvYFGNwhnPampLiAAAAQ8"]
[Mon May 04 02:12:48.389851 2026] [:error] [pid 40386:tid 40408] [client 79.137.67.30:44882] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afeQIFHJDYRXUf3IbRRCbgAAANQ"]
[Mon May 04 02:12:52.164779 2026] [:error] [pid 40386:tid 40403] [client 79.137.67.30:44890] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afeQJFHJDYRXUf3IbRRCdgAAAM8"]
[Mon May 04 02:12:55.612988 2026] [:error] [pid 40386:tid 40411] [client 79.137.67.30:59540] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afeQJ1HJDYRXUf3IbRRCfAAAANc"]
[Mon May 04 02:12:59.478417 2026] [:error] [pid 40422:tid 40449] [client 79.137.67.30:59544] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afeQK0HBbBLrXh6PButipAAAAVc"]
[Mon May 04 02:13:04.421141 2026] [:error] [pid 40386:tid 40398] [client 79.137.67.30:48590] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afeQMFHJDYRXUf3IbRRCiQAAAMo"]
[Mon May 04 02:13:08.606246 2026] [:error] [pid 54535:tid 54560] [client 79.137.67.30:47336] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afeQNPRyz79iR-ntJRIpRQAAAhc"]
[Mon May 04 02:13:11.240499 2026] [:error] [pid 54535:tid 54537] [client 79.137.67.30:43564] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afeQN_Ryz79iR-ntJRIpSwAAAgA"]
[Mon May 04 02:13:16.638150 2026] [:error] [pid 40422:tid 40448] [client 79.137.67.30:42038] [client 79.137.67.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afeQPEHBbBLrXh6PButiqAAAAVY"]
[Mon May 04 02:49:01.197671 2026] [:error] [pid 54535:tid 54540] [client 54.36.60.82:41560] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afeYnfRyz79iR-ntJRIyMwAAAgM"]
[Mon May 04 02:49:02.933999 2026] [:error] [pid 54535:tid 54554] [client 54.36.60.82:36694] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afeYnvRyz79iR-ntJRIyOgAAAhE"]
[Mon May 04 02:49:05.254326 2026] [:error] [pid 40422:tid 40449] [client 54.36.60.82:58498] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afeYoUHBbBLrXh6PButk6AAAAVc"]
[Mon May 04 02:49:07.291173 2026] [:error] [pid 34432:tid 34456] [client 54.36.60.82:60464] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afeYo573JKVQ0wlof4Kt4QAAAdY"]
[Mon May 04 02:49:09.665270 2026] [:error] [pid 34432:tid 34442] [client 54.36.60.82:58504] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afeYpZ73JKVQ0wlof4Kt5AAAAcg"]
[Mon May 04 02:49:12.191279 2026] [:error] [pid 40386:tid 40406] [client 54.36.60.82:58514] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afeYqFHJDYRXUf3IbRRJ-wAAANI"]
[Mon May 04 02:49:14.072861 2026] [:error] [pid 34432:tid 34449] [client 54.36.60.82:49614] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afeYqp73JKVQ0wlof4Kt6gAAAc8"]
[Mon May 04 02:49:16.450675 2026] [:error] [pid 54535:tid 54560] [client 54.36.60.82:51716] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afeYrPRyz79iR-ntJRIyRAAAAhc"]
[Mon May 04 02:49:18.960336 2026] [:error] [pid 40386:tid 40407] [client 54.36.60.82:51730] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afeYrlHJDYRXUf3IbRRKBQAAANM"]
[Mon May 04 02:49:21.471122 2026] [:error] [pid 54535:tid 54555] [client 54.36.60.82:51732] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afeYsfRyz79iR-ntJRIyTAAAAhI"]
[Mon May 04 02:49:24.013685 2026] [:error] [pid 54535:tid 54552] [client 54.36.60.82:51734] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afeYtPRyz79iR-ntJRIyUAAAAg8"]
[Mon May 04 02:49:26.516604 2026] [:error] [pid 34432:tid 34447] [client 54.36.60.82:33120] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afeYtp73JKVQ0wlof4Kt8wAAAc0"]
[Mon May 04 02:49:28.885681 2026] [:error] [pid 37127:tid 37200] [client 54.36.60.82:33122] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afeYuP8khJXb5O5aWVVZsQAAAE8"]
[Mon May 04 02:49:31.399091 2026] [:error] [pid 37127:tid 37206] [client 54.36.60.82:33138] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afeYu_8khJXb5O5aWVVZswAAAFQ"]
[Mon May 04 02:49:33.925450 2026] [:error] [pid 37246:tid 37253] [client 54.36.60.82:33154] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afeYvThvYFGNwhnPampOygAAAQU"]
[Mon May 04 02:49:36.443879 2026] [:error] [pid 34432:tid 34445] [client 54.36.60.82:35392] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afeYwJ73JKVQ0wlof4Kt9QAAAcs"]
[Mon May 04 02:49:38.818568 2026] [:error] [pid 40456:tid 40468] [client 54.36.60.82:35396] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afeYwjSujTvwdzEkjSd7pwAAAYo"]
[Mon May 04 02:49:41.331164 2026] [:error] [pid 37130:tid 37229] [client 54.36.60.82:35410] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afeYxaIu7bmXKXicRk-rgQAAAJA"]
[Mon May 04 02:49:43.864464 2026] [:error] [pid 40386:tid 40389] [client 54.36.60.82:35418] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afeYx1HJDYRXUf3IbRRKKAAAAME"]
[Mon May 04 02:49:46.361826 2026] [:error] [pid 37130:tid 37215] [client 54.36.60.82:43210] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afeYyqIu7bmXKXicRk-rhgAAAII"]
[Mon May 04 02:49:48.872834 2026] [:error] [pid 54535:tid 54547] [client 54.36.60.82:43220] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afeYzPRyz79iR-ntJRIybAAAAgo"]
[Mon May 04 02:49:51.219170 2026] [:error] [pid 54535:tid 54544] [client 54.36.60.82:43232] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afeYz_Ryz79iR-ntJRIydQAAAgc"]
[Mon May 04 02:49:53.729984 2026] [:error] [pid 54535:tid 54549] [client 54.36.60.82:43240] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afeY0fRyz79iR-ntJRIyfQAAAgw"]
[Mon May 04 02:49:56.321328 2026] [:error] [pid 40386:tid 40400] [client 54.36.60.82:37284] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afeY1FHJDYRXUf3IbRRKSAAAAMw"]
[Mon May 04 02:49:58.736191 2026] [:error] [pid 34432:tid 34447] [client 54.36.60.82:37298] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afeY1p73JKVQ0wlof4KuJwAAAc0"]
[Mon May 04 02:50:20.392995 2026] [:error] [pid 54535:tid 54550] [client 54.36.60.82:36736] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afeY7PRyz79iR-ntJRIy3wAAAg0"]
[Mon May 04 02:50:22.197580 2026] [:error] [pid 54535:tid 54537] [client 54.36.60.82:36740] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afeY7vRyz79iR-ntJRIy4QAAAgA"]
[Mon May 04 02:50:24.226557 2026] [:error] [pid 40386:tid 40403] [client 54.36.60.82:44394] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afeY8FHJDYRXUf3IbRRKXQAAAM8"]
[Mon May 04 02:50:26.109011 2026] [:error] [pid 40422:tid 40442] [client 54.36.60.82:44396] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afeY8kHBbBLrXh6PButlGAAAAVA"]
[Mon May 04 02:50:28.636628 2026] [:error] [pid 34432:tid 34447] [client 54.36.60.82:59502] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afeY9J73JKVQ0wlof4KuPQAAAc0"]
[Mon May 04 02:50:31.130679 2026] [:error] [pid 37130:tid 37214] [client 54.36.60.82:59514] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afeY96Iu7bmXKXicRk-rqAAAAIE"]
[Mon May 04 02:50:33.618934 2026] [:error] [pid 37127:tid 37193] [client 54.36.60.82:59528] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afeY-f8khJXb5O5aWVVZxwAAAEk"]
[Mon May 04 02:50:36.105797 2026] [:error] [pid 40456:tid 40476] [client 54.36.60.82:43986] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afeY_DSujTvwdzEkjSd75gAAAZI"]
[Mon May 04 02:50:37.950128 2026] [:error] [pid 37130:tid 37226] [client 54.36.60.82:56364] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afeY_aIu7bmXKXicRk-rrQAAAI0"]
[Mon May 04 02:50:39.820328 2026] [:error] [pid 34432:tid 34450] [client 54.36.60.82:56370] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afeY_573JKVQ0wlof4KuRAAAAdA"]
[Mon May 04 02:50:42.352059 2026] [:error] [pid 40386:tid 40406] [client 54.36.60.82:43990] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afeZAlHJDYRXUf3IbRRKaAAAANI"]
[Mon May 04 02:50:44.367305 2026] [:error] [pid 37126:tid 37174] [client 54.36.60.82:54080] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afeZBPR_A42N-LtDyrth2wAAABU"]
[Mon May 04 02:50:46.868201 2026] [:error] [pid 37130:tid 37216] [client 54.36.60.82:40536] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afeZBqIu7bmXKXicRk-rrwAAAIM"]
[Mon May 04 02:50:48.870705 2026] [:error] [pid 40456:tid 40459] [client 54.36.60.82:54088] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afeZCDSujTvwdzEkjSd76wAAAYE"]
[Mon May 04 02:50:51.237666 2026] [:error] [pid 54535:tid 54550] [client 54.36.60.82:40552] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afeZC_Ryz79iR-ntJRIy7wAAAg0"]
[Mon May 04 02:50:53.751666 2026] [:error] [pid 34432:tid 34449] [client 54.36.60.82:40564] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afeZDZ73JKVQ0wlof4KuSQAAAc8"]
[Mon May 04 02:50:55.751091 2026] [:error] [pid 40386:tid 40409] [client 54.36.60.82:53322] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afeZD1HJDYRXUf3IbRRKcwAAANU"]
[Mon May 04 02:50:58.245459 2026] [:error] [pid 40386:tid 40404] [client 54.36.60.82:60146] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afeZElHJDYRXUf3IbRRKeAAAANA"]
[Mon May 04 02:51:00.726951 2026] [:error] [pid 40422:tid 40430] [client 54.36.60.82:60160] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afeZFEHBbBLrXh6PButlKAAAAUQ"]
[Mon May 04 02:51:03.217554 2026] [:error] [pid 40456:tid 40461] [client 54.36.60.82:60172] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afeZFzSujTvwdzEkjSd79AAAAYM"]
[Mon May 04 02:51:05.549499 2026] [:error] [pid 40386:tid 40388] [client 54.36.60.82:54244] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afeZGVHJDYRXUf3IbRRKfQAAAMA"]
[Mon May 04 02:51:07.388539 2026] [:error] [pid 40422:tid 40448] [client 54.36.60.82:52696] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afeZG0HBbBLrXh6PButlLAAAAVY"]
[Mon May 04 02:51:09.877022 2026] [:error] [pid 40456:tid 40471] [client 54.36.60.82:54256] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afeZHTSujTvwdzEkjSd7_AAAAY0"]
[Mon May 04 02:51:12.341288 2026] [:error] [pid 40456:tid 40477] [client 54.36.60.82:54270] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afeZIDSujTvwdzEkjSd7_gAAAZM"]
[Mon May 04 02:51:14.674444 2026] [:error] [pid 40456:tid 40465] [client 54.36.60.82:57950] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afeZIjSujTvwdzEkjSd8BAAAAYc"]
[Mon May 04 02:51:17.143033 2026] [:error] [pid 37130:tid 37222] [client 54.36.60.82:57966] [client 54.36.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afeZJaIu7bmXKXicRk-rvAAAAIk"]
[Mon May 04 02:55:09.959588 2026] [:error] [pid 40386:tid 40401] [client 35.198.62.246:41902] [client 35.198.62.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "afeaDVHJDYRXUf3IbRRLKgAAAM0"]
[Mon May 04 03:23:12.336821 2026] [:error] [pid 26759:tid 26843] [client 147.135.215.173:33768] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afegoHTQzuI3-n6k7pIEcgAAAJQ"]
[Mon May 04 03:23:15.161544 2026] [:error] [pid 26758:tid 26799] [client 147.135.215.173:57002] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afego_p1jng1F6GaHV9DbQAAAEM"]
[Mon May 04 03:23:17.975037 2026] [:error] [pid 26759:tid 26831] [client 147.135.215.173:57010] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afegpXTQzuI3-n6k7pIEdAAAAIg"]
[Mon May 04 03:23:20.741462 2026] [:error] [pid 26758:tid 26817] [client 147.135.215.173:57012] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afegqPp1jng1F6GaHV9DdQAAAFU"]
[Mon May 04 03:23:23.608037 2026] [:error] [pid 26758:tid 26804] [client 147.135.215.173:58804] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afegq_p1jng1F6GaHV9DgAAAAEg"]
[Mon May 04 03:23:27.577377 2026] [:error] [pid 26850:tid 26871] [client 147.135.215.173:58818] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afegr6A7BDRPbakhWt50UAAAANM"]
[Mon May 04 03:24:33.948930 2026] [proxy_fcgi:error] [pid 26757:tid 26779] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:34.142790 2026] [proxy_fcgi:error] [pid 26757:tid 26786] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:34.528837 2026] [proxy_fcgi:error] [pid 26757:tid 26781] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:34.774278 2026] [proxy_fcgi:error] [pid 26757:tid 26780] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:35.196642 2026] [proxy_fcgi:error] [pid 26757:tid 26769] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:35.387696 2026] [proxy_fcgi:error] [pid 26757:tid 26789] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:35.580010 2026] [proxy_fcgi:error] [pid 26757:tid 26783] [client 52.165.198.204:15851] AH01071: Got error 'Primary script unknown'
[Mon May 04 03:24:36.095956 2026] [:error] [pid 26757:tid 26790] [client 52.165.198.204:15851] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afeg9CkJqXTdIITFcawZPwAAABU"]
[Mon May 04 03:24:38.313485 2026] [:error] [pid 26757:tid 26786] [client 52.165.198.204:27525] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afeg9ikJqXTdIITFcawZRgAAABE"]
[Mon May 04 03:24:40.778062 2026] [:error] [pid 26850:tid 26871] [client 52.165.198.204:27365] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afeg-KA7BDRPbakhWt500QAAANM"]
[Mon May 04 03:24:42.138526 2026] [:error] [pid 26758:tid 26798] [client 52.165.198.204:15822] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "afeg-vp1jng1F6GaHV9DzwAAAEI"]
[Mon May 04 04:36:39.338998 2026] [:error] [pid 57154:tid 57165] [client 49.51.183.220:47860] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afex1_4DAn7umy_ATRzI2QAAAMg"]
[Mon May 04 05:12:04.136712 2026] [:error] [pid 57047:tid 57113] [client 217.182.195.126:56162] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afe6JFtCAxKLCAMkLV2SXgAAAFc"]
[Mon May 04 05:12:05.926837 2026] [:error] [pid 57046:tid 57076] [client 217.182.195.126:60884] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afe6JYDA4d1tYGL7mqAdagAAAA8"]
[Mon May 04 05:12:07.846768 2026] [:error] [pid 31168:tid 31189] [client 217.182.195.126:37334] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afe6J7JUVgN8GV2P4h5H4gAAAVM"]
[Mon May 04 05:12:10.462433 2026] [:error] [pid 57046:tid 57080] [client 217.182.195.126:52922] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afe6KoDA4d1tYGL7mqAdbQAAABM"]
[Mon May 04 05:12:12.397791 2026] [:error] [pid 57048:tid 57123] [client 217.182.195.126:37340] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afe6LIZINtpBgqE164JGnAAAAIY"]
[Mon May 04 05:12:14.413933 2026] [:error] [pid 31168:tid 31184] [client 217.182.195.126:37352] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afe6LrJUVgN8GV2P4h5H8gAAAU4"]
[Mon May 04 05:12:16.315988 2026] [:error] [pid 57154:tid 57163] [client 217.182.195.126:34530] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afe6MP4DAn7umy_ATRzU4wAAAMY"]
[Mon May 04 05:12:18.277050 2026] [:error] [pid 58625:tid 58633] [client 217.182.195.126:34544] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afe6MvZfjPGFqq6KSLkLggAAAQU"]
[Mon May 04 05:12:20.144687 2026] [:error] [pid 57048:tid 57122] [client 217.182.195.126:34560] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afe6NIZINtpBgqE164JGoQAAAIU"]
[Mon May 04 05:12:22.573608 2026] [:error] [pid 57048:tid 57121] [client 217.182.195.126:50410] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afe6NoZINtpBgqE164JGogAAAIQ"]
[Mon May 04 05:12:25.119065 2026] [:error] [pid 57154:tid 57171] [client 217.182.195.126:50422] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afe6Of4DAn7umy_ATRzU-AAAAM4"]
[Mon May 04 05:12:26.847977 2026] [:error] [pid 57154:tid 57172] [client 217.182.195.126:45584] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afe6Ov4DAn7umy_ATRzU_wAAAM8"]
[Mon May 04 05:12:29.142321 2026] [:error] [pid 57048:tid 57138] [client 217.182.195.126:33318] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afe6PYZINtpBgqE164JGtAAAAJU"]
[Mon May 04 05:12:31.656275 2026] [:error] [pid 57047:tid 57108] [client 217.182.195.126:33326] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afe6P1tCAxKLCAMkLV2SZgAAAFI"]
[Mon May 04 05:12:34.044007 2026] [:error] [pid 58625:tid 58634] [client 217.182.195.126:33334] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afe6QvZfjPGFqq6KSLkLmwAAAQY"]
[Mon May 04 05:12:36.350881 2026] [:error] [pid 57048:tid 57127] [client 217.182.195.126:38796] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afe6RIZINtpBgqE164JGyQAAAIo"]
[Mon May 04 05:12:38.383124 2026] [:error] [pid 58625:tid 58629] [client 217.182.195.126:46280] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afe6RvZfjPGFqq6KSLkLnwAAAQE"]
[Mon May 04 05:12:40.796427 2026] [:error] [pid 58625:tid 58644] [client 217.182.195.126:38804] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afe6SPZfjPGFqq6KSLkLpwAAARA"]
[Mon May 04 05:12:42.810982 2026] [:error] [pid 57048:tid 57130] [client 217.182.195.126:46282] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afe6SoZINtpBgqE164JG2wAAAI0"]
[Mon May 04 05:12:44.849151 2026] [:error] [pid 57048:tid 57123] [client 217.182.195.126:46284] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afe6TIZINtpBgqE164JG3AAAAIY"]
[Mon May 04 05:12:46.777733 2026] [:error] [pid 58625:tid 58646] [client 217.182.195.126:43910] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afe6TvZfjPGFqq6KSLkLrgAAARI"]
[Mon May 04 05:12:48.673838 2026] [:error] [pid 57047:tid 57099] [client 217.182.195.126:43920] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afe6UFtCAxKLCAMkLV2SeAAAAEk"]
[Mon May 04 05:12:51.062551 2026] [:error] [pid 58625:tid 58649] [client 217.182.195.126:33352] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afe6U_ZfjPGFqq6KSLkLtwAAARU"]
[Mon May 04 05:12:53.097787 2026] [:error] [pid 31168:tid 31179] [client 217.182.195.126:43924] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afe6VbJUVgN8GV2P4h5IIwAAAUk"]
[Mon May 04 05:12:55.374018 2026] [:error] [pid 57154:tid 57161] [client 217.182.195.126:33362] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afe6V_4DAn7umy_ATRzVVgAAAMQ"]
[Mon May 04 05:12:57.312080 2026] [:error] [pid 31168:tid 31170] [client 217.182.195.126:59008] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afe6WbJUVgN8GV2P4h5IKQAAAUA"]
[Mon May 04 05:12:59.209828 2026] [:error] [pid 58625:tid 58637] [client 217.182.195.126:59020] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afe6W_ZfjPGFqq6KSLkLvQAAAQk"]
[Mon May 04 05:13:01.136274 2026] [:error] [pid 58625:tid 58633] [client 217.182.195.126:59022] [client 217.182.195.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afe6XfZfjPGFqq6KSLkLwQAAAQU"]
[Mon May 04 05:44:56.749305 2026] [:error] [pid 31168:tid 31177] [client 43.166.131.228:48358] [client 43.166.131.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "affB2LJUVgN8GV2P4h5P_wAAAUc"]
[Mon May 04 05:52:22.678196 2026] [proxy_fcgi:error] [pid 57046:tid 57085] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:22.895463 2026] [proxy_fcgi:error] [pid 57046:tid 57070] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:23.106965 2026] [proxy_fcgi:error] [pid 57046:tid 57063] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:23.316814 2026] [proxy_fcgi:error] [pid 57046:tid 57068] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:23.526995 2026] [proxy_fcgi:error] [pid 57046:tid 57069] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:23.829247 2026] [proxy_fcgi:error] [pid 57046:tid 57076] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:24.040536 2026] [proxy_fcgi:error] [pid 57046:tid 57075] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:24.271266 2026] [proxy_fcgi:error] [pid 57046:tid 57082] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:24.482704 2026] [proxy_fcgi:error] [pid 57046:tid 57061] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:24.693169 2026] [proxy_fcgi:error] [pid 57046:tid 57079] [client 20.104.97.84:65031] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:52:24.905515 2026] [:error] [pid 57046:tid 57066] [client 20.104.97.84:65031] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "affDmIDA4d1tYGL7mqAifAAAAAU"]
[Mon May 04 05:52:25.419035 2026] [:error] [pid 57046:tid 57083] [client 20.104.97.84:65125] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "affDmYDA4d1tYGL7mqAifQAAABY"]
[Mon May 04 05:52:25.889435 2026] [:error] [pid 58625:tid 58629] [client 20.104.97.84:65134] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "affDmfZfjPGFqq6KSLkbXQAAAQE"]
[Mon May 04 05:52:26.384394 2026] [:error] [pid 31168:tid 31178] [client 20.104.97.84:65146] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/G-In.php"] [unique_id "affDmrJUVgN8GV2P4h5R-gAAAUg"]
[Mon May 04 05:52:26.853322 2026] [:error] [pid 58625:tid 58631] [client 20.104.97.84:65135] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "affDmvZfjPGFqq6KSLkbYAAAAQM"]
[Mon May 04 05:52:27.407689 2026] [:error] [pid 31168:tid 31171] [client 20.104.97.84:65038] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "affDm7JUVgN8GV2P4h5R-wAAAUE"]
[Mon May 04 05:52:28.098465 2026] [:error] [pid 58625:tid 58650] [client 20.104.97.84:64591] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "affDnPZfjPGFqq6KSLkbZQAAARY"]
[Mon May 04 05:52:28.569379 2026] [:error] [pid 57048:tid 57125] [client 20.104.97.84:65123] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aj11.php"] [unique_id "affDnIZINtpBgqE164JPiwAAAIg"]
[Mon May 04 05:52:29.023417 2026] [:error] [pid 58625:tid 58642] [client 20.104.97.84:65072] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "affDnfZfjPGFqq6KSLkbagAAAQ4"]
[Mon May 04 05:52:29.795992 2026] [:error] [pid 31168:tid 31175] [client 20.104.97.84:65096] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "affDnbJUVgN8GV2P4h5R_QAAAUU"]
[Mon May 04 05:52:30.405387 2026] [:error] [pid 31168:tid 31170] [client 20.104.97.84:65085] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "affDnrJUVgN8GV2P4h5SAAAAAUA"]
[Mon May 04 05:52:30.852107 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:64584] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "affDnrJUVgN8GV2P4h5SAQAAAUw"]
[Mon May 04 05:52:31.370056 2026] [:error] [pid 58625:tid 58639] [client 20.104.97.84:65104] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "affDn_ZfjPGFqq6KSLkbcwAAAQs"]
[Mon May 04 05:52:32.170432 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:65151] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "affDoPZfjPGFqq6KSLkbdwAAAQo"]
[Mon May 04 05:52:32.812750 2026] [:error] [pid 31168:tid 31190] [client 20.104.97.84:65049] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "affDoLJUVgN8GV2P4h5SBAAAAVQ"]
[Mon May 04 05:52:33.310511 2026] [:error] [pid 57046:tid 57072] [client 20.104.97.84:65054] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xroot.php"] [unique_id "affDoYDA4d1tYGL7mqAigAAAAAs"]
[Mon May 04 05:52:33.920754 2026] [:error] [pid 57154:tid 57157] [client 20.104.97.84:65130] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "affDof4DAn7umy_ATRzgDQAAAMA"]
[Mon May 04 05:52:34.431154 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:64590] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "affDovZfjPGFqq6KSLkbgQAAAQo"]
[Mon May 04 05:52:35.027577 2026] [:error] [pid 57154:tid 57167] [client 20.104.97.84:65045] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "affDo_4DAn7umy_ATRzgDwAAAMo"]
[Mon May 04 05:52:35.622868 2026] [:error] [pid 57048:tid 57129] [client 20.104.97.84:64592] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tea.php"] [unique_id "affDo4ZINtpBgqE164JPjgAAAIw"]
[Mon May 04 05:52:36.428210 2026] [:error] [pid 58625:tid 58641] [client 20.104.97.84:65113] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "affDpPZfjPGFqq6KSLkbiQAAAQ0"]
[Mon May 04 05:52:37.024838 2026] [:error] [pid 31168:tid 31185] [client 20.104.97.84:65089] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "affDpbJUVgN8GV2P4h5SCAAAAU8"]
[Mon May 04 05:52:37.853904 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:65080] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "affDpfZfjPGFqq6KSLkbjwAAARQ"]
[Mon May 04 05:52:38.588078 2026] [:error] [pid 58625:tid 58628] [client 20.104.97.84:65035] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "affDpvZfjPGFqq6KSLkbkAAAAQA"]
[Mon May 04 05:52:39.115390 2026] [:error] [pid 31168:tid 31193] [client 20.104.97.84:65065] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "affDp7JUVgN8GV2P4h5SCgAAAVc"]
[Mon May 04 05:52:39.673891 2026] [:error] [pid 58625:tid 58649] [client 20.104.97.84:65055] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "affDp_ZfjPGFqq6KSLkbkwAAARU"]
[Mon May 04 05:52:40.291945 2026] [:error] [pid 58625:tid 58644] [client 20.104.97.84:64566] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "affDqPZfjPGFqq6KSLkblQAAARA"]
[Mon May 04 05:52:41.063838 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:65111] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aios-bootstrap.php"] [unique_id "affDqf4DAn7umy_ATRzgEwAAANI"]
[Mon May 04 05:52:41.895156 2026] [:error] [pid 57154:tid 57172] [client 20.104.97.84:65075] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "affDqf4DAn7umy_ATRzgFQAAAM8"]
[Mon May 04 05:52:42.470934 2026] [:error] [pid 58625:tid 58642] [client 20.104.97.84:64596] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "affDqvZfjPGFqq6KSLkblgAAAQ4"]
[Mon May 04 05:52:43.176697 2026] [:error] [pid 57154:tid 57157] [client 20.104.97.84:65086] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "affDq_4DAn7umy_ATRzgGgAAAMA"]
[Mon May 04 05:52:43.713073 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:65037] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "affDq_4DAn7umy_ATRzgHAAAANE"]
[Mon May 04 05:52:44.433502 2026] [:error] [pid 57154:tid 57173] [client 20.104.97.84:53446] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "affDrP4DAn7umy_ATRzgIQAAANA"]
[Mon May 04 05:52:45.150830 2026] [:error] [pid 58625:tid 58631] [client 20.104.97.84:65149] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "affDrfZfjPGFqq6KSLkbmgAAAQM"]
[Mon May 04 05:52:45.605251 2026] [:error] [pid 58625:tid 58646] [client 20.104.97.84:64581] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "affDrfZfjPGFqq6KSLkbmwAAARI"]
[Mon May 04 05:52:46.287775 2026] [:error] [pid 57154:tid 57161] [client 20.104.97.84:65118] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/006.php"] [unique_id "affDrv4DAn7umy_ATRzgJQAAAMQ"]
[Mon May 04 05:52:46.776918 2026] [:error] [pid 31168:tid 31177] [client 20.104.97.84:65103] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "affDrrJUVgN8GV2P4h5SDgAAAUc"]
[Mon May 04 05:52:47.267937 2026] [:error] [pid 57154:tid 57165] [client 20.104.97.84:64517] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "affDr_4DAn7umy_ATRzgKAAAAMg"]
[Mon May 04 05:52:47.771509 2026] [:error] [pid 57046:tid 57069] [client 20.104.97.84:65082] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "affDr4DA4d1tYGL7mqAihAAAAAg"]
[Mon May 04 05:52:48.276715 2026] [:error] [pid 57154:tid 57177] [client 20.104.97.84:65027] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kikikoko.php"] [unique_id "affDsP4DAn7umy_ATRzgLAAAANQ"]
[Mon May 04 05:52:49.047080 2026] [:error] [pid 57047:tid 57104] [client 20.104.97.84:64604] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "affDsVtCAxKLCAMkLV2YtAAAAE4"]
[Mon May 04 05:52:49.568348 2026] [:error] [pid 57048:tid 57118] [client 20.104.97.84:64587] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "affDsYZINtpBgqE164JPlAAAAIE"]
[Mon May 04 05:52:50.392326 2026] [:error] [pid 31168:tid 31194] [client 20.104.97.84:65067] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "affDsrJUVgN8GV2P4h5SEQAAAVg"]
[Mon May 04 05:52:50.915804 2026] [:error] [pid 58625:tid 58645] [client 20.104.97.84:65098] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "affDsvZfjPGFqq6KSLkbowAAARE"]
[Mon May 04 05:52:51.428143 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:65028] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "affDs_ZfjPGFqq6KSLkbpQAAAQo"]
[Mon May 04 05:52:52.060306 2026] [:error] [pid 31168:tid 31179] [client 20.104.97.84:65029] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "affDtLJUVgN8GV2P4h5SFwAAAUk"]
[Mon May 04 05:52:52.736775 2026] [:error] [pid 57047:tid 57094] [client 20.104.97.84:53448] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "affDtFtCAxKLCAMkLV2YtgAAAEQ"]
[Mon May 04 05:52:53.778014 2026] [:error] [pid 58625:tid 58635] [client 20.104.97.84:64549] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "affDtfZfjPGFqq6KSLkbqgAAAQc"]
[Mon May 04 05:52:54.440020 2026] [:error] [pid 57048:tid 57139] [client 20.104.97.84:65129] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "affDtoZINtpBgqE164JPlwAAAJY"]
[Mon May 04 05:52:54.944774 2026] [:error] [pid 31168:tid 31180] [client 20.104.97.84:65121] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "affDtrJUVgN8GV2P4h5SGQAAAUo"]
[Mon May 04 05:52:55.943018 2026] [:error] [pid 57047:tid 57112] [client 20.104.97.84:64579] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "affDt1tCAxKLCAMkLV2YuQAAAFY"]
[Mon May 04 05:52:56.571346 2026] [:error] [pid 31168:tid 31171] [client 20.104.97.84:64622] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "affDuLJUVgN8GV2P4h5SGgAAAUE"]
[Mon May 04 05:52:57.066085 2026] [:error] [pid 58625:tid 58649] [client 20.104.97.84:64631] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "affDufZfjPGFqq6KSLkbsQAAARU"]
[Mon May 04 05:52:57.692574 2026] [:error] [pid 57046:tid 57077] [client 20.104.97.84:65084] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "affDuYDA4d1tYGL7mqAiigAAABA"]
[Mon May 04 05:52:58.388059 2026] [:error] [pid 57154:tid 57167] [client 20.104.97.84:64625] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "affDuv4DAn7umy_ATRzgNQAAAMo"]
[Mon May 04 05:52:58.845335 2026] [:error] [pid 57047:tid 57113] [client 20.104.97.84:64597] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qhupyoon.php"] [unique_id "affDultCAxKLCAMkLV2YugAAAFc"]
[Mon May 04 05:52:59.384851 2026] [:error] [pid 57046:tid 57078] [client 20.104.97.84:65071] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "affDu4DA4d1tYGL7mqAijAAAABE"]
[Mon May 04 05:52:59.937397 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:65100] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "affDu_4DAn7umy_ATRzgOQAAANE"]
[Mon May 04 05:53:00.556737 2026] [:error] [pid 57047:tid 57096] [client 20.104.97.84:65109] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "affDvFtCAxKLCAMkLV2YvAAAAEY"]
[Mon May 04 05:53:01.049721 2026] [:error] [pid 57154:tid 57164] [client 20.104.97.84:64557] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "affDvf4DAn7umy_ATRzgPgAAAMc"]
[Mon May 04 05:53:01.667671 2026] [:error] [pid 31168:tid 31180] [client 20.104.97.84:65095] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "affDvbJUVgN8GV2P4h5SJQAAAUo"]
[Mon May 04 05:53:02.304013 2026] [:error] [pid 58625:tid 58644] [client 20.104.97.84:65114] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "affDvvZfjPGFqq6KSLkb6QAAARA"]
[Mon May 04 05:53:02.798485 2026] [:error] [pid 58625:tid 58636] [client 20.104.97.84:65131] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "affDvvZfjPGFqq6KSLkcAAAAAQg"]
[Mon May 04 05:53:03.395404 2026] [:error] [pid 57048:tid 57134] [client 20.104.97.84:65136] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "affDv4ZINtpBgqE164JPmwAAAJE"]
[Mon May 04 05:53:03.927706 2026] [:error] [pid 57154:tid 57179] [client 20.104.97.84:65145] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "affDv_4DAn7umy_ATRzgbgAAANY"]
[Mon May 04 05:53:04.573706 2026] [:error] [pid 57154:tid 57167] [client 20.104.97.84:65034] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "affDwP4DAn7umy_ATRzgbwAAAMo"]
[Mon May 04 05:53:05.116454 2026] [:error] [pid 57048:tid 57122] [client 20.104.97.84:65077] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "affDwYZINtpBgqE164JPnQAAAIU"]
[Mon May 04 05:53:05.784879 2026] [:error] [pid 57048:tid 57136] [client 20.104.97.84:65088] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/6ap7e.php"] [unique_id "affDwYZINtpBgqE164JPoAAAAJM"]
[Mon May 04 05:53:06.637804 2026] [:error] [pid 57047:tid 57105] [client 20.104.97.84:64578] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "affDwltCAxKLCAMkLV2YwAAAAE8"]
[Mon May 04 05:53:07.115001 2026] [:error] [pid 57047:tid 57106] [client 20.104.97.84:64595] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "affDw1tCAxKLCAMkLV2YwgAAAFA"]
[Mon May 04 05:53:07.631868 2026] [:error] [pid 57048:tid 57120] [client 20.104.97.84:65024] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "affDw4ZINtpBgqE164JPowAAAIM"]
[Mon May 04 05:53:08.189381 2026] [:error] [pid 57048:tid 57137] [client 20.104.97.84:64530] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "affDxIZINtpBgqE164JPpQAAAJQ"]
[Mon May 04 05:53:08.656605 2026] [:error] [pid 31168:tid 31181] [client 20.104.97.84:65143] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "affDxLJUVgN8GV2P4h5SLAAAAUs"]
[Mon May 04 05:53:09.577692 2026] [:error] [pid 58625:tid 58646] [client 20.104.97.84:65050] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "affDxfZfjPGFqq6KSLkcKQAAARI"]
[Mon May 04 05:53:10.153035 2026] [:error] [pid 57048:tid 57121] [client 20.104.97.84:65060] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "affDxoZINtpBgqE164JPqAAAAIQ"]
[Mon May 04 05:53:10.777431 2026] [:error] [pid 31168:tid 31189] [client 20.104.97.84:64600] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "affDxrJUVgN8GV2P4h5SMwAAAVM"]
[Mon May 04 05:53:11.527684 2026] [:error] [pid 31168:tid 31173] [client 20.104.97.84:64531] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "affDx7JUVgN8GV2P4h5SNwAAAUM"]
[Mon May 04 05:53:12.117161 2026] [:error] [pid 31168:tid 31192] [client 20.104.97.84:53475] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "affDyLJUVgN8GV2P4h5SOgAAAVY"]
[Mon May 04 05:53:12.772250 2026] [:error] [pid 31168:tid 31188] [client 20.104.97.84:65119] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "affDyLJUVgN8GV2P4h5SQAAAAVI"]
[Mon May 04 05:53:13.356573 2026] [:error] [pid 57154:tid 57178] [client 20.104.97.84:65064] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "affDyf4DAn7umy_ATRzgeAAAANU"]
[Mon May 04 05:53:13.878325 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:65090] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "affDyf4DAn7umy_ATRzgfQAAANM"]
[Mon May 04 05:53:14.615255 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:64529] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "affDyrJUVgN8GV2P4h5SSAAAAVU"]
[Mon May 04 05:53:15.165167 2026] [:error] [pid 57047:tid 57094] [client 20.104.97.84:65061] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "affDy1tCAxKLCAMkLV2YyAAAAEQ"]
[Mon May 04 05:53:15.785764 2026] [:error] [pid 57047:tid 57106] [client 20.104.97.84:65071] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zogy1.php"] [unique_id "affDy1tCAxKLCAMkLV2YywAAAFA"]
[Mon May 04 05:53:16.250898 2026] [:error] [pid 31168:tid 31172] [client 20.104.97.84:65141] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "affDzLJUVgN8GV2P4h5STgAAAUI"]
[Mon May 04 05:53:17.015478 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:65138] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "affDzf4DAn7umy_ATRzghQAAAMw"]
[Mon May 04 05:53:17.835924 2026] [:error] [pid 57046:tid 57066] [client 20.104.97.84:64614] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "affDzYDA4d1tYGL7mqAiqAAAAAU"]
[Mon May 04 05:53:18.675276 2026] [:error] [pid 57047:tid 57112] [client 20.104.97.84:53500] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "affDzltCAxKLCAMkLV2YzQAAAFY"]
[Mon May 04 05:53:19.309454 2026] [:error] [pid 58625:tid 58634] [client 20.104.97.84:65052] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "affDz_ZfjPGFqq6KSLkcZQAAAQY"]
[Mon May 04 05:53:19.873764 2026] [:error] [pid 57047:tid 57101] [client 20.104.97.84:65110] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "affDz1tCAxKLCAMkLV2YzgAAAEs"]
[Mon May 04 05:53:21.330949 2026] [:error] [pid 57154:tid 57160] [client 20.104.97.84:64583] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "affD0f4DAn7umy_ATRzghwAAAMM"]
[Mon May 04 05:53:21.921845 2026] [:error] [pid 57048:tid 57137] [client 20.104.97.84:64627] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "affD0YZINtpBgqE164JPrgAAAJQ"]
[Mon May 04 05:53:22.556553 2026] [:error] [pid 31168:tid 31175] [client 20.104.97.84:65032] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "affD0rJUVgN8GV2P4h5SUwAAAUU"]
[Mon May 04 05:53:23.524755 2026] [:error] [pid 57154:tid 57165] [client 20.104.97.84:65087] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "affD0_4DAn7umy_ATRzgiwAAAMg"]
[Mon May 04 05:53:24.143710 2026] [proxy_fcgi:error] [pid 57154:tid 57158] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:24.362600 2026] [proxy_fcgi:error] [pid 57154:tid 57169] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:24.575054 2026] [proxy_fcgi:error] [pid 57154:tid 57162] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:24.787741 2026] [proxy_fcgi:error] [pid 57154:tid 57164] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:25.003636 2026] [proxy_fcgi:error] [pid 57154:tid 57180] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:25.216565 2026] [proxy_fcgi:error] [pid 57154:tid 57179] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:25.458995 2026] [proxy_fcgi:error] [pid 57154:tid 57177] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:25.670896 2026] [proxy_fcgi:error] [pid 57154:tid 57163] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:25.883361 2026] [proxy_fcgi:error] [pid 57154:tid 57174] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:26.276671 2026] [proxy_fcgi:error] [pid 57154:tid 57159] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:26.489002 2026] [proxy_fcgi:error] [pid 57154:tid 57173] [client 20.104.97.84:65097] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:53:26.706642 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:65097] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "affD1v4DAn7umy_ATRzgmgAAANM"]
[Mon May 04 05:53:27.719431 2026] [:error] [pid 31168:tid 31184] [client 20.104.97.84:64601] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "affD17JUVgN8GV2P4h5SWAAAAU4"]
[Mon May 04 05:53:28.553128 2026] [:error] [pid 57154:tid 57171] [client 20.104.97.84:65147] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "affD2P4DAn7umy_ATRzgnQAAAM4"]
[Mon May 04 05:53:29.477852 2026] [:error] [pid 57154:tid 57170] [client 20.104.97.84:64525] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index0.php"] [unique_id "affD2f4DAn7umy_ATRzgnwAAAM0"]
[Mon May 04 05:53:30.423546 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:64535] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "affD2rJUVgN8GV2P4h5SXgAAAVU"]
[Mon May 04 05:53:31.038524 2026] [:error] [pid 57154:tid 57180] [client 20.104.97.84:65102] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "affD2_4DAn7umy_ATRzgoAAAANc"]
[Mon May 04 05:53:31.938030 2026] [:error] [pid 58625:tid 58634] [client 20.104.97.84:65124] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "affD2_ZfjPGFqq6KSLkcnAAAAQY"]
[Mon May 04 05:53:32.549016 2026] [:error] [pid 58625:tid 58650] [client 20.104.97.84:65079] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-01ul.php"] [unique_id "affD3PZfjPGFqq6KSLkcngAAARY"]
[Mon May 04 05:53:33.141706 2026] [:error] [pid 31168:tid 31170] [client 20.104.97.84:65078] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "affD3bJUVgN8GV2P4h5SYwAAAUA"]
[Mon May 04 05:53:33.787790 2026] [:error] [pid 57154:tid 57173] [client 20.104.97.84:64527] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "affD3f4DAn7umy_ATRzgogAAANA"]
[Mon May 04 05:53:34.384788 2026] [:error] [pid 58625:tid 58639] [client 20.104.97.84:65059] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "affD3vZfjPGFqq6KSLkcoQAAAQs"]
[Mon May 04 05:53:34.891355 2026] [:error] [pid 57047:tid 57090] [client 20.104.97.84:64546] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/e3.php"] [unique_id "affD3ltCAxKLCAMkLV2Y4wAAAEA"]
[Mon May 04 05:53:35.644598 2026] [:error] [pid 31168:tid 31190] [client 20.104.97.84:64516] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "affD37JUVgN8GV2P4h5SaQAAAVQ"]
[Mon May 04 05:53:36.154296 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:64522] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "affD4P4DAn7umy_ATRzgpgAAANI"]
[Mon May 04 05:53:36.775662 2026] [:error] [pid 58625:tid 58635] [client 20.104.97.84:64541] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "affD4PZfjPGFqq6KSLkcqAAAAQc"]
[Mon May 04 05:53:37.299178 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:65039] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fkohd.php"] [unique_id "affD4f4DAn7umy_ATRzgqQAAAME"]
[Mon May 04 05:53:37.862087 2026] [:error] [pid 57047:tid 57107] [client 20.104.97.84:64609] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "affD4VtCAxKLCAMkLV2Y5QAAAFE"]
[Mon May 04 05:53:38.408400 2026] [:error] [pid 58625:tid 58644] [client 20.104.97.84:65040] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "affD4vZfjPGFqq6KSLkcsAAAARA"]
[Mon May 04 05:53:38.956974 2026] [:error] [pid 57154:tid 57177] [client 20.104.97.84:65063] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "affD4v4DAn7umy_ATRzgrAAAANQ"]
[Mon May 04 05:53:39.518157 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:64617] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "affD47JUVgN8GV2P4h5SbwAAAUw"]
[Mon May 04 05:53:40.181158 2026] [:error] [pid 57047:tid 57102] [client 20.104.97.84:64603] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "affD5FtCAxKLCAMkLV2Y6QAAAEw"]
[Mon May 04 05:53:40.734628 2026] [:error] [pid 58625:tid 58633] [client 20.104.97.84:65122] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "affD5PZfjPGFqq6KSLkcswAAAQU"]
[Mon May 04 05:53:41.346189 2026] [:error] [pid 57048:tid 57125] [client 20.104.97.84:65025] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "affD5YZINtpBgqE164JP4QAAAIg"]
[Mon May 04 05:53:42.093826 2026] [:error] [pid 57154:tid 57159] [client 20.104.97.84:64621] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws80.php"] [unique_id "affD5v4DAn7umy_ATRzgrQAAAMI"]
[Mon May 04 05:53:42.693377 2026] [:error] [pid 31168:tid 31192] [client 20.104.97.84:64515] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "affD5rJUVgN8GV2P4h5ScwAAAVY"]
[Mon May 04 05:53:43.246124 2026] [:error] [pid 58625:tid 58652] [client 20.104.97.84:65070] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "affD5_ZfjPGFqq6KSLkcugAAARg"]
[Mon May 04 05:53:44.037646 2026] [:error] [pid 58625:tid 58637] [client 20.104.97.84:64554] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "affD6PZfjPGFqq6KSLkcvQAAAQk"]
[Mon May 04 05:53:44.596159 2026] [:error] [pid 57048:tid 57140] [client 20.104.97.84:53441] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "affD6IZINtpBgqE164JP5AAAAJc"]
[Mon May 04 05:53:45.128096 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:64570] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "affD6fZfjPGFqq6KSLkcxgAAAQo"]
[Mon May 04 05:53:45.798689 2026] [:error] [pid 58625:tid 58641] [client 20.104.97.84:65041] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "affD6fZfjPGFqq6KSLkczAAAAQ0"]
[Mon May 04 05:53:46.310507 2026] [:error] [pid 58625:tid 58637] [client 20.104.97.84:65033] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "affD6vZfjPGFqq6KSLkczgAAAQk"]
[Mon May 04 05:53:47.046962 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:64612] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xy.php"] [unique_id "affD6_4DAn7umy_ATRzgrwAAAME"]
[Mon May 04 05:53:47.846785 2026] [:error] [pid 31168:tid 31183] [client 20.104.97.84:65062] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "affD67JUVgN8GV2P4h5SeQAAAU0"]
[Mon May 04 05:53:48.361311 2026] [:error] [pid 31168:tid 31174] [client 20.104.97.84:53444] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "affD7LJUVgN8GV2P4h5SewAAAUQ"]
[Mon May 04 05:53:48.971201 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:65069] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "affD7LJUVgN8GV2P4h5SfQAAAVU"]
[Mon May 04 05:53:49.504301 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:65150] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/masks.php"] [unique_id "affD7f4DAn7umy_ATRzgsgAAAMw"]
[Mon May 04 05:53:50.140824 2026] [:error] [pid 57154:tid 57172] [client 20.104.97.84:65127] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "affD7v4DAn7umy_ATRzgswAAAM8"]
[Mon May 04 05:53:50.643050 2026] [:error] [pid 57048:tid 57132] [client 20.104.97.84:65057] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "affD7oZINtpBgqE164JP6QAAAI8"]
[Mon May 04 05:53:51.228294 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:64594] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "affD7_4DAn7umy_ATRzgtAAAAMU"]
[Mon May 04 05:53:51.836930 2026] [:error] [pid 57048:tid 57134] [client 20.104.97.84:65139] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "affD74ZINtpBgqE164JP7QAAAJE"]
[Mon May 04 05:53:52.522448 2026] [:error] [pid 57047:tid 57099] [client 20.104.97.84:53470] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "affD8FtCAxKLCAMkLV2Y8AAAAEk"]
[Mon May 04 05:53:53.065390 2026] [:error] [pid 57046:tid 57071] [client 20.104.97.84:53455] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "affD8YDA4d1tYGL7mqAisQAAAAo"]
[Mon May 04 05:53:53.598158 2026] [:error] [pid 57047:tid 57097] [client 20.104.97.84:53471] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "affD8VtCAxKLCAMkLV2Y8QAAAEc"]
[Mon May 04 05:53:54.356467 2026] [:error] [pid 57154:tid 57163] [client 20.104.97.84:64602] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xfun.php"] [unique_id "affD8v4DAn7umy_ATRzguAAAAMY"]
[Mon May 04 05:53:54.958191 2026] [:error] [pid 57048:tid 57118] [client 20.104.97.84:65126] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "affD8oZINtpBgqE164JP8QAAAIE"]
[Mon May 04 05:53:55.515419 2026] [:error] [pid 58625:tid 58635] [client 20.104.97.84:65107] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "affD8_ZfjPGFqq6KSLkc1AAAAQc"]
[Mon May 04 05:53:56.116021 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:53437] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "affD9P4DAn7umy_ATRzguQAAANM"]
[Mon May 04 05:53:56.602315 2026] [:error] [pid 58625:tid 58649] [client 20.104.97.84:65047] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "affD9PZfjPGFqq6KSLkc2QAAARU"]
[Mon May 04 05:53:57.178005 2026] [:error] [pid 57048:tid 57122] [client 20.104.97.84:53447] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "affD9YZINtpBgqE164JP8wAAAIU"]
[Mon May 04 05:53:57.887184 2026] [:error] [pid 57048:tid 57141] [client 20.104.97.84:65101] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "affD9YZINtpBgqE164JP9AAAAJg"]
[Mon May 04 05:53:58.343650 2026] [:error] [pid 57048:tid 57133] [client 20.104.97.84:53485] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "affD9oZINtpBgqE164JP9QAAAJA"]
[Mon May 04 05:53:58.771497 2026] [:error] [pid 57046:tid 57085] [client 20.104.97.84:53481] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "affD9oDA4d1tYGL7mqAitgAAABg"]
[Mon May 04 05:53:59.237772 2026] [:error] [pid 31168:tid 31184] [client 20.104.97.84:64526] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "affD97JUVgN8GV2P4h5ShAAAAU4"]
[Mon May 04 05:53:59.780458 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:53460] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "affD97JUVgN8GV2P4h5ShgAAAUw"]
[Mon May 04 05:54:00.227604 2026] [:error] [pid 31168:tid 31173] [client 20.104.97.84:65066] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "affD-LJUVgN8GV2P4h5SiAAAAUM"]
[Mon May 04 05:54:00.707863 2026] [:error] [pid 31168:tid 31176] [client 20.104.97.84:64577] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpconf.php"] [unique_id "affD-LJUVgN8GV2P4h5SiwAAAUY"]
[Mon May 04 05:54:01.316726 2026] [:error] [pid 58625:tid 58632] [client 20.104.97.84:65048] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "affD-fZfjPGFqq6KSLkc3wAAAQQ"]
[Mon May 04 05:54:01.833148 2026] [:error] [pid 31168:tid 31192] [client 20.104.97.84:64538] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "affD-bJUVgN8GV2P4h5SjQAAAVY"]
[Mon May 04 05:54:02.413759 2026] [:error] [pid 57047:tid 57103] [client 20.104.97.84:64629] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "affD-ltCAxKLCAMkLV2Y9QAAAE0"]
[Mon May 04 05:54:02.947706 2026] [:error] [pid 57046:tid 57079] [client 20.104.97.84:64565] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "affD-oDA4d1tYGL7mqAiugAAABI"]
[Mon May 04 05:54:03.424292 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:53451] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "affD-_4DAn7umy_ATRzgugAAANI"]
[Mon May 04 05:54:03.996641 2026] [:error] [pid 57048:tid 57117] [client 20.104.97.84:65115] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "affD-4ZINtpBgqE164JP-QAAAIA"]
[Mon May 04 05:54:04.531152 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:65058] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "affD_P4DAn7umy_ATRzguwAAAME"]
[Mon May 04 05:54:05.269808 2026] [:error] [pid 31168:tid 31194] [client 20.104.97.84:53417] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-zx.php"] [unique_id "affD_bJUVgN8GV2P4h5SkgAAAVg"]
[Mon May 04 05:54:05.797781 2026] [:error] [pid 57154:tid 57172] [client 20.104.97.84:64580] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "affD_f4DAn7umy_ATRzgvgAAAM8"]
[Mon May 04 05:54:06.276752 2026] [:error] [pid 58625:tid 58636] [client 20.104.97.84:64628] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "affD_vZfjPGFqq6KSLkc5gAAAQg"]
[Mon May 04 05:54:06.765999 2026] [:error] [pid 57154:tid 57164] [client 20.104.97.84:65068] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "affD_v4DAn7umy_ATRzgwQAAAMc"]
[Mon May 04 05:54:07.207252 2026] [:error] [pid 58625:tid 58650] [client 20.104.97.84:53498] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "affD__ZfjPGFqq6KSLkc5wAAARY"]
[Mon May 04 05:54:07.742820 2026] [:error] [pid 57046:tid 57073] [client 20.104.97.84:53472] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "affD_4DA4d1tYGL7mqAivQAAAAw"]
[Mon May 04 05:54:08.317690 2026] [:error] [pid 57154:tid 57160] [client 20.104.97.84:53459] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "affEAP4DAn7umy_ATRzgxgAAAMM"]
[Mon May 04 05:54:08.969574 2026] [:error] [pid 31168:tid 31192] [client 20.104.97.84:65053] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "affEALJUVgN8GV2P4h5SlAAAAVY"]
[Mon May 04 05:54:09.490348 2026] [:error] [pid 57154:tid 57159] [client 20.104.97.84:64593] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mar.php"] [unique_id "affEAf4DAn7umy_ATRzgyAAAAMI"]
[Mon May 04 05:54:10.143289 2026] [:error] [pid 57046:tid 57068] [client 20.104.97.84:53405] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "affEAoDA4d1tYGL7mqAivwAAAAc"]
[Mon May 04 05:54:10.619575 2026] [:error] [pid 31168:tid 31179] [client 20.104.97.84:64611] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "affEArJUVgN8GV2P4h5SlgAAAUk"]
[Mon May 04 05:54:11.145494 2026] [:error] [pid 57048:tid 57135] [client 20.104.97.84:65142] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "affEA4ZINtpBgqE164JP-wAAAJI"]
[Mon May 04 05:54:11.998351 2026] [:error] [pid 57046:tid 57069] [client 20.104.97.84:65116] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "affEA4DA4d1tYGL7mqAiwQAAAAg"]
[Mon May 04 05:54:12.445729 2026] [:error] [pid 31168:tid 31188] [client 20.104.97.84:64536] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jodohghi.php"] [unique_id "affEBLJUVgN8GV2P4h5SlwAAAVI"]
[Mon May 04 05:54:13.069309 2026] [:error] [pid 58625:tid 58639] [client 20.104.97.84:64556] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jodohghi.php"] [unique_id "affEBfZfjPGFqq6KSLkc7AAAAQs"]
[Mon May 04 05:54:13.601838 2026] [:error] [pid 57048:tid 57141] [client 20.104.97.84:65067] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jodohghi.php"] [unique_id "affEBYZINtpBgqE164JP_wAAAJg"]
[Mon May 04 05:54:14.454308 2026] [:error] [pid 58625:tid 58644] [client 20.104.97.84:65137] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jodohghi.php"] [unique_id "affEBvZfjPGFqq6KSLkc8AAAARA"]
[Mon May 04 05:54:15.004175 2026] [:error] [pid 58625:tid 58634] [client 20.104.97.84:64534] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "affEB_ZfjPGFqq6KSLkc8gAAAQY"]
[Mon May 04 05:54:15.835402 2026] [:error] [pid 58625:tid 58628] [client 20.104.97.84:64616] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "affEB_ZfjPGFqq6KSLkc-AAAAQA"]
[Mon May 04 05:54:16.318988 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:65044] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "affECP4DAn7umy_ATRzgzAAAANE"]
[Mon May 04 05:54:17.182348 2026] [:error] [pid 58625:tid 58629] [client 20.104.97.84:53462] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "affECfZfjPGFqq6KSLkc_AAAAQE"]
[Mon May 04 05:54:17.648534 2026] [:error] [pid 58625:tid 58636] [client 20.104.97.84:53499] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rivasqup.php"] [unique_id "affECfZfjPGFqq6KSLkc_gAAAQg"]
[Mon May 04 05:54:18.213945 2026] [:error] [pid 58625:tid 58632] [client 20.104.97.84:65076] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rivasqup.php"] [unique_id "affECvZfjPGFqq6KSLkdBAAAAQQ"]
[Mon May 04 05:54:18.845016 2026] [:error] [pid 31168:tid 31183] [client 20.104.97.84:64610] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rivasqup.php"] [unique_id "affECrJUVgN8GV2P4h5SmgAAAU0"]
[Mon May 04 05:54:19.582598 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:64533] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rivasqup.php"] [unique_id "affEC_4DAn7umy_ATRzg0QAAAME"]
[Mon May 04 05:54:20.083277 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:53493] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "affEDLJUVgN8GV2P4h5SnwAAAUw"]
[Mon May 04 05:54:20.681059 2026] [:error] [pid 31168:tid 31174] [client 20.104.97.84:65105] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "affEDLJUVgN8GV2P4h5SoAAAAUQ"]
[Mon May 04 05:54:21.229999 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:64576] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "affEDf4DAn7umy_ATRzg1AAAAMU"]
[Mon May 04 05:54:21.710543 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:53458] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "affEDf4DAn7umy_ATRzg1QAAAMw"]
[Mon May 04 05:54:22.201669 2026] [:error] [pid 57154:tid 57177] [client 20.104.97.84:64585] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dshtv.php"] [unique_id "affEDv4DAn7umy_ATRzg1gAAANQ"]
[Mon May 04 05:54:22.688269 2026] [:error] [pid 57154:tid 57160] [client 20.104.97.84:53456] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dshtv.php"] [unique_id "affEDv4DAn7umy_ATRzg2AAAAMM"]
[Mon May 04 05:54:23.299208 2026] [:error] [pid 31168:tid 31189] [client 20.104.97.84:53492] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dshtv.php"] [unique_id "affED7JUVgN8GV2P4h5SpAAAAVM"]
[Mon May 04 05:54:23.922837 2026] [:error] [pid 57048:tid 57123] [client 20.104.97.84:53484] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dshtv.php"] [unique_id "affED4ZINtpBgqE164JQAwAAAIY"]
[Mon May 04 05:54:24.499425 2026] [:error] [pid 31168:tid 31179] [client 20.104.97.84:53388] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sym403.php"] [unique_id "affEELJUVgN8GV2P4h5SpgAAAUk"]
[Mon May 04 05:54:25.063039 2026] [:error] [pid 57048:tid 57135] [client 20.104.97.84:64613] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sym403.php"] [unique_id "affEEYZINtpBgqE164JQBAAAAJI"]
[Mon May 04 05:54:25.657631 2026] [:error] [pid 31168:tid 31186] [client 20.104.97.84:65117] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sym403.php"] [unique_id "affEEbJUVgN8GV2P4h5SqAAAAVA"]
[Mon May 04 05:54:26.242788 2026] [proxy_fcgi:error] [pid 57048:tid 57141] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:26.453113 2026] [proxy_fcgi:error] [pid 57048:tid 57125] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:26.663704 2026] [proxy_fcgi:error] [pid 57048:tid 57133] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:26.880083 2026] [proxy_fcgi:error] [pid 57048:tid 57120] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:27.148838 2026] [proxy_fcgi:error] [pid 57048:tid 57127] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:27.361319 2026] [proxy_fcgi:error] [pid 57048:tid 57140] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:27.604339 2026] [proxy_fcgi:error] [pid 57048:tid 57124] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:27.856428 2026] [proxy_fcgi:error] [pid 57048:tid 57119] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:28.067066 2026] [proxy_fcgi:error] [pid 57048:tid 57137] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:28.290503 2026] [proxy_fcgi:error] [pid 57048:tid 57117] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:28.509642 2026] [proxy_fcgi:error] [pid 57048:tid 57118] [client 20.104.97.84:65030] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:54:28.716219 2026] [:error] [pid 57048:tid 57128] [client 20.104.97.84:65030] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "affEFIZINtpBgqE164JQFAAAAIs"]
[Mon May 04 05:54:29.387180 2026] [:error] [pid 58625:tid 58640] [client 20.104.97.84:65073] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "affEFfZfjPGFqq6KSLkdDgAAAQw"]
[Mon May 04 05:54:29.889811 2026] [:error] [pid 57154:tid 57159] [client 20.104.97.84:53381] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "affEFf4DAn7umy_ATRzg3gAAAMI"]
[Mon May 04 05:54:30.415538 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:64608] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/knw.php"] [unique_id "affEFv4DAn7umy_ATRzg4QAAANE"]
[Mon May 04 05:54:31.016722 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:53377] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "affEF_4DAn7umy_ATRzg4gAAANM"]
[Mon May 04 05:54:31.526087 2026] [:error] [pid 57154:tid 57168] [client 20.104.97.84:64607] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "affEF_4DAn7umy_ATRzg5QAAAMs"]
[Mon May 04 05:54:32.013542 2026] [:error] [pid 58625:tid 58651] [client 20.104.97.84:64561] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "affEGPZfjPGFqq6KSLkdFAAAARc"]
[Mon May 04 05:54:32.592797 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:64582] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fi.php"] [unique_id "affEGPZfjPGFqq6KSLkdFQAAARQ"]
[Mon May 04 05:54:33.064725 2026] [:error] [pid 58625:tid 58631] [client 20.104.97.84:53442] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "affEGfZfjPGFqq6KSLkdFwAAAQM"]
[Mon May 04 05:54:33.655727 2026] [:error] [pid 57154:tid 57172] [client 20.104.97.84:64638] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "affEGf4DAn7umy_ATRzg6AAAAM8"]
[Mon May 04 05:54:34.182826 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:65099] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "affEGv4DAn7umy_ATRzg6gAAAMU"]
[Mon May 04 05:54:34.721684 2026] [:error] [pid 57046:tid 57085] [client 20.104.97.84:65144] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jlex.php"] [unique_id "affEGoDA4d1tYGL7mqAixgAAABg"]
[Mon May 04 05:54:35.368263 2026] [:error] [pid 57154:tid 57178] [client 20.104.97.84:64634] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "affEG_4DAn7umy_ATRzg7QAAANU"]
[Mon May 04 05:54:35.864935 2026] [:error] [pid 58625:tid 58636] [client 20.104.97.84:65043] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "affEG_ZfjPGFqq6KSLkdHAAAAQg"]
[Mon May 04 05:54:36.440397 2026] [:error] [pid 58625:tid 58651] [client 20.104.97.84:64520] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "affEHPZfjPGFqq6KSLkdHQAAARc"]
[Mon May 04 05:54:37.022338 2026] [:error] [pid 58625:tid 58652] [client 20.104.97.84:64558] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-k7djufwez2.php"] [unique_id "affEHfZfjPGFqq6KSLkdHwAAARg"]
[Mon May 04 05:54:37.750193 2026] [:error] [pid 57048:tid 57135] [client 20.104.97.84:53483] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "affEHYZINtpBgqE164JQFQAAAJI"]
[Mon May 04 05:54:38.281110 2026] [:error] [pid 31168:tid 31193] [client 20.104.97.84:64518] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "affEHrJUVgN8GV2P4h5SrQAAAVc"]
[Mon May 04 05:54:38.801117 2026] [:error] [pid 57048:tid 57134] [client 20.104.97.84:64567] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "affEHoZINtpBgqE164JQFgAAAJE"]
[Mon May 04 05:54:39.330364 2026] [:error] [pid 57047:tid 57106] [client 20.104.97.84:64633] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-tiroto.php"] [unique_id "affEH1tCAxKLCAMkLV2Y-QAAAFA"]
[Mon May 04 05:54:39.897710 2026] [:error] [pid 58625:tid 58647] [client 20.104.97.84:64564] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "affEH_ZfjPGFqq6KSLkdIwAAARM"]
[Mon May 04 05:54:40.480953 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:64639] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "affEIP4DAn7umy_ATRzg8gAAAMU"]
[Mon May 04 05:54:41.085555 2026] [:error] [pid 57048:tid 57133] [client 20.104.97.84:64537] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "affEIYZINtpBgqE164JQGAAAAJA"]
[Mon May 04 05:54:41.623858 2026] [:error] [pid 57047:tid 57102] [client 20.104.97.84:64513] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/son.php"] [unique_id "affEIVtCAxKLCAMkLV2Y_AAAAEw"]
[Mon May 04 05:54:42.124635 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:8294] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "affEIvZfjPGFqq6KSLkdJwAAARQ"]
[Mon May 04 05:54:42.625933 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:65046] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "affEIv4DAn7umy_ATRzg9AAAANE"]
[Mon May 04 05:54:43.127669 2026] [:error] [pid 31168:tid 31170] [client 20.104.97.84:65051] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "affEI7JUVgN8GV2P4h5SrwAAAUA"]
[Mon May 04 05:54:43.566324 2026] [:error] [pid 57048:tid 57120] [client 20.104.97.84:53376] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/99.php"] [unique_id "affEI4ZINtpBgqE164JQGgAAAIM"]
[Mon May 04 05:54:44.093089 2026] [:error] [pid 57154:tid 57171] [client 20.104.97.84:65091] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "affEJP4DAn7umy_ATRzg-AAAAM4"]
[Mon May 04 05:54:44.606950 2026] [:error] [pid 57046:tid 57083] [client 20.104.97.84:64571] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "affEJIDA4d1tYGL7mqAizgAAABY"]
[Mon May 04 05:54:45.055349 2026] [:error] [pid 31168:tid 31194] [client 20.104.97.84:64544] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "affEJbJUVgN8GV2P4h5SsAAAAVg"]
[Mon May 04 05:54:45.554326 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:53480] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "affEJf4DAn7umy_ATRzg-QAAAME"]
[Mon May 04 05:54:46.004055 2026] [:error] [pid 57048:tid 57127] [client 20.104.97.84:64586] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "affEJoZINtpBgqE164JQGwAAAIo"]
[Mon May 04 05:54:46.541995 2026] [:error] [pid 57154:tid 57161] [client 20.104.97.84:64626] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "affEJv4DAn7umy_ATRzg-wAAAMQ"]
[Mon May 04 05:54:47.125612 2026] [:error] [pid 58625:tid 58641] [client 20.104.97.84:65036] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "affEJ_ZfjPGFqq6KSLkdLAAAAQ0"]
[Mon May 04 05:54:47.822709 2026] [:error] [pid 58625:tid 58637] [client 20.104.97.84:64635] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/filefuns.php"] [unique_id "affEJ_ZfjPGFqq6KSLkdMAAAAQk"]
[Mon May 04 05:54:48.304476 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:64540] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "affEKLJUVgN8GV2P4h5SsQAAAUw"]
[Mon May 04 05:54:48.846224 2026] [:error] [pid 31168:tid 31171] [client 20.104.97.84:64512] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "affEKLJUVgN8GV2P4h5SsgAAAUE"]
[Mon May 04 05:54:49.450839 2026] [:error] [pid 58625:tid 58645] [client 20.104.97.84:53390] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "affEKfZfjPGFqq6KSLkdNQAAARE"]
[Mon May 04 05:54:50.131760 2026] [:error] [pid 57048:tid 57137] [client 20.104.97.84:64550] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ay.php"] [unique_id "affEKoZINtpBgqE164JQHAAAAJQ"]
[Mon May 04 05:54:50.663488 2026] [:error] [pid 57154:tid 57181] [client 20.104.97.84:53466] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "affEKv4DAn7umy_ATRzg_gAAANg"]
[Mon May 04 05:54:51.231031 2026] [:error] [pid 57047:tid 57099] [client 20.104.97.84:64575] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "affEK1tCAxKLCAMkLV2ZAQAAAEk"]
[Mon May 04 05:54:51.664165 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:64599] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "affEK7JUVgN8GV2P4h5StAAAAVU"]
[Mon May 04 05:54:52.216457 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:53449] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "affELP4DAn7umy_ATRzhAQAAANM"]
[Mon May 04 05:54:52.713391 2026] [:error] [pid 31168:tid 31190] [client 20.104.97.84:53403] [client 20.104.97.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "affELLJUVgN8GV2P4h5StQAAAVQ"]
[Mon May 04 05:54:53.492489 2026] [:error] [pid 57154:tid 57171] [client 20.104.97.84:64551] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "affELf4DAn7umy_ATRzhAgAAAM4"]
[Mon May 04 05:54:54.187975 2026] [:error] [pid 58625:tid 58645] [client 20.104.97.84:53477] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "affELvZfjPGFqq6KSLkdPAAAARE"]
[Mon May 04 05:54:54.760380 2026] [:error] [pid 58625:tid 58651] [client 20.104.97.84:64523] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "affELvZfjPGFqq6KSLkdPQAAARc"]
[Mon May 04 05:54:55.365474 2026] [:error] [pid 31168:tid 31192] [client 20.104.97.84:64562] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "affEL7JUVgN8GV2P4h5SuAAAAVY"]
[Mon May 04 05:54:55.910196 2026] [:error] [pid 31168:tid 31179] [client 20.104.97.84:64588] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "affEL7JUVgN8GV2P4h5SugAAAUk"]
[Mon May 04 05:54:56.469810 2026] [:error] [pid 57047:tid 57094] [client 20.104.97.84:64598] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "affEMFtCAxKLCAMkLV2ZBAAAAEQ"]
[Mon May 04 05:54:57.157585 2026] [:error] [pid 57047:tid 57107] [client 20.104.97.84:64623] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "affEMVtCAxKLCAMkLV2ZBQAAAFE"]
[Mon May 04 05:54:57.772447 2026] [:error] [pid 57154:tid 57161] [client 20.104.97.84:65081] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1a.php"] [unique_id "affEMf4DAn7umy_ATRzhBAAAAMQ"]
[Mon May 04 05:54:58.270268 2026] [:error] [pid 31168:tid 31183] [client 20.104.97.84:53413] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "affEMrJUVgN8GV2P4h5SvwAAAU0"]
[Mon May 04 05:54:58.759523 2026] [:error] [pid 57047:tid 57093] [client 20.104.97.84:64519] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "affEMltCAxKLCAMkLV2ZCAAAAEM"]
[Mon May 04 05:54:59.227222 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:8289] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "affEM_4DAn7umy_ATRzhBgAAAMU"]
[Mon May 04 05:54:59.696770 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:65140] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rh.php"] [unique_id "affEM7JUVgN8GV2P4h5SxAAAAVU"]
[Mon May 04 05:55:00.150590 2026] [:error] [pid 31168:tid 31190] [client 20.104.97.84:42180] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "affENLJUVgN8GV2P4h5SxQAAAVQ"]
[Mon May 04 05:55:00.769270 2026] [:error] [pid 31168:tid 31176] [client 20.104.97.84:64618] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "affENLJUVgN8GV2P4h5SxgAAAUY"]
[Mon May 04 05:55:01.336637 2026] [:error] [pid 57154:tid 57178] [client 20.104.97.84:42191] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "affENf4DAn7umy_ATRzhCQAAANU"]
[Mon May 04 05:55:01.867885 2026] [:error] [pid 31168:tid 31187] [client 20.104.97.84:65083] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-kikikoko.php"] [unique_id "affENbJUVgN8GV2P4h5SxwAAAVE"]
[Mon May 04 05:55:02.437066 2026] [:error] [pid 57048:tid 57118] [client 20.104.97.84:65074] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "affENoZINtpBgqE164JQHgAAAIE"]
[Mon May 04 05:55:03.412399 2026] [:error] [pid 31168:tid 31184] [client 20.104.97.84:53461] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "affEN7JUVgN8GV2P4h5SygAAAU4"]
[Mon May 04 05:55:03.974629 2026] [:error] [pid 31168:tid 31194] [client 20.104.97.84:53478] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "affEN7JUVgN8GV2P4h5SzAAAAVg"]
[Mon May 04 05:55:04.545486 2026] [:error] [pid 31168:tid 31180] [client 20.104.97.84:8266] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "affEOLJUVgN8GV2P4h5S0AAAAUo"]
[Mon May 04 05:55:05.209556 2026] [:error] [pid 57154:tid 57177] [client 20.104.97.84:53503] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tramuibs.php"] [unique_id "affEOf4DAn7umy_ATRzhCgAAANQ"]
[Mon May 04 05:55:05.726562 2026] [:error] [pid 31168:tid 31193] [client 20.104.97.84:53380] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tramuibs.php"] [unique_id "affEObJUVgN8GV2P4h5S1wAAAVc"]
[Mon May 04 05:55:06.206215 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:64568] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tramuibs.php"] [unique_id "affEOvZfjPGFqq6KSLkdSAAAARQ"]
[Mon May 04 05:55:06.790925 2026] [:error] [pid 31168:tid 31182] [client 20.104.97.84:53467] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tramuibs.php"] [unique_id "affEOrJUVgN8GV2P4h5S2AAAAUw"]
[Mon May 04 05:55:07.277720 2026] [:error] [pid 57154:tid 57179] [client 20.104.97.84:64632] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "affEO_4DAn7umy_ATRzhCwAAANY"]
[Mon May 04 05:55:08.034613 2026] [:error] [pid 58625:tid 58645] [client 20.104.97.84:53490] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "affEPPZfjPGFqq6KSLkdSwAAARE"]
[Mon May 04 05:55:08.565850 2026] [:error] [pid 57048:tid 57136] [client 20.104.97.84:53394] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "affEPIZINtpBgqE164JQIQAAAJM"]
[Mon May 04 05:55:09.041058 2026] [:error] [pid 58625:tid 58640] [client 20.104.97.84:53406] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "affEPfZfjPGFqq6KSLkdTAAAAQw"]
[Mon May 04 05:55:09.564391 2026] [:error] [pid 57048:tid 57139] [client 20.104.97.84:65106] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "affEPYZINtpBgqE164JQIgAAAJY"]
[Mon May 04 05:55:10.107466 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:64605] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "affEPvZfjPGFqq6KSLkdTwAAAQo"]
[Mon May 04 05:55:10.693656 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:53486] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "affEPvZfjPGFqq6KSLkdUgAAARQ"]
[Mon May 04 05:55:11.228443 2026] [:error] [pid 57047:tid 57096] [client 20.104.97.84:64547] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test1.php"] [unique_id "affEP1tCAxKLCAMkLV2ZCgAAAEY"]
[Mon May 04 05:55:11.849061 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:64555] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "affEP_4DAn7umy_ATRzhFgAAAMw"]
[Mon May 04 05:55:12.333228 2026] [:error] [pid 57047:tid 57110] [client 20.104.97.84:64539] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "affEQFtCAxKLCAMkLV2ZDAAAAFQ"]
[Mon May 04 05:55:12.828096 2026] [:error] [pid 57047:tid 57090] [client 20.104.97.84:53468] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "affEQFtCAxKLCAMkLV2ZDgAAAEA"]
[Mon May 04 05:55:13.308449 2026] [:error] [pid 57047:tid 57100] [client 20.104.97.84:64528] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bpxrn.php"] [unique_id "affEQVtCAxKLCAMkLV2ZDwAAAEo"]
[Mon May 04 05:55:13.806423 2026] [:error] [pid 58625:tid 58645] [client 20.104.97.84:53450] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "affEQfZfjPGFqq6KSLkdVAAAARE"]
[Mon May 04 05:55:14.501840 2026] [:error] [pid 58625:tid 58634] [client 20.104.97.84:64543] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "affEQvZfjPGFqq6KSLkdVgAAAQY"]
[Mon May 04 05:55:14.929860 2026] [:error] [pid 58625:tid 58641] [client 20.104.97.84:53489] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "affEQvZfjPGFqq6KSLkdWAAAAQ0"]
[Mon May 04 05:55:15.391884 2026] [:error] [pid 58625:tid 58651] [client 20.104.97.84:8291] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "affEQ_ZfjPGFqq6KSLkdXAAAARc"]
[Mon May 04 05:55:15.882973 2026] [:error] [pid 57047:tid 57094] [client 20.104.97.84:53474] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "affEQ1tCAxKLCAMkLV2ZEQAAAEQ"]
[Mon May 04 05:55:16.380384 2026] [:error] [pid 57047:tid 57106] [client 20.104.97.84:8260] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "affERFtCAxKLCAMkLV2ZEgAAAFA"]
[Mon May 04 05:55:16.978168 2026] [:error] [pid 57048:tid 57118] [client 20.104.97.84:64552] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "affERIZINtpBgqE164JQKgAAAIE"]
[Mon May 04 05:55:17.471778 2026] [:error] [pid 57048:tid 57131] [client 20.104.97.84:64572] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws37.php"] [unique_id "affERYZINtpBgqE164JQLAAAAI4"]
[Mon May 04 05:55:17.955165 2026] [:error] [pid 57048:tid 57130] [client 20.104.97.84:64553] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "affERYZINtpBgqE164JQLwAAAI0"]
[Mon May 04 05:55:18.444021 2026] [:error] [pid 57047:tid 57102] [client 20.104.97.84:42196] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "affERltCAxKLCAMkLV2ZEwAAAEw"]
[Mon May 04 05:55:19.000660 2026] [:error] [pid 57048:tid 57141] [client 20.104.97.84:53434] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "affERoZINtpBgqE164JQNAAAAJg"]
[Mon May 04 05:55:19.486569 2026] [:error] [pid 57154:tid 57178] [client 20.104.97.84:65120] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "affER_4DAn7umy_ATRzhGgAAANU"]
[Mon May 04 05:55:20.034128 2026] [:error] [pid 57154:tid 57181] [client 20.104.97.84:64573] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "affESP4DAn7umy_ATRzhHQAAANg"]
[Mon May 04 05:55:20.531187 2026] [:error] [pid 57154:tid 57162] [client 20.104.97.84:64569] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "affESP4DAn7umy_ATRzhHgAAAMU"]
[Mon May 04 05:55:21.117267 2026] [:error] [pid 57047:tid 57101] [client 20.104.97.84:53399] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "affESVtCAxKLCAMkLV2ZFwAAAEs"]
[Mon May 04 05:55:21.671176 2026] [:error] [pid 57154:tid 57177] [client 20.104.97.84:53421] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bojcdooq.php"] [unique_id "affESf4DAn7umy_ATRzhIAAAANQ"]
[Mon May 04 05:55:22.247834 2026] [:error] [pid 58625:tid 58639] [client 20.104.97.84:8296] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "affESvZfjPGFqq6KSLkdXwAAAQs"]
[Mon May 04 05:55:22.904822 2026] [:error] [pid 57154:tid 57163] [client 20.104.97.84:53497] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "affESv4DAn7umy_ATRzhIgAAAMY"]
[Mon May 04 05:55:23.433367 2026] [:error] [pid 58625:tid 58648] [client 20.104.97.84:64563] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "affES_ZfjPGFqq6KSLkdYAAAARQ"]
[Mon May 04 05:55:23.975430 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:42177] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zdd.php"] [unique_id "affES_ZfjPGFqq6KSLkdYQAAAQo"]
[Mon May 04 05:55:24.537097 2026] [:error] [pid 57154:tid 57171] [client 20.104.97.84:8290] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "affETP4DAn7umy_ATRzhJQAAAM4"]
[Mon May 04 05:55:25.073151 2026] [:error] [pid 57047:tid 57090] [client 20.104.97.84:64548] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "affETVtCAxKLCAMkLV2ZGwAAAEA"]
[Mon May 04 05:55:25.539273 2026] [:error] [pid 31168:tid 31177] [client 20.104.97.84:53482] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "affETbJUVgN8GV2P4h5S6wAAAUc"]
[Mon May 04 05:55:26.254378 2026] [:error] [pid 57047:tid 57106] [client 20.104.97.84:53435] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/133.php"] [unique_id "affETltCAxKLCAMkLV2ZHQAAAFA"]
[Mon May 04 05:55:26.724677 2026] [:error] [pid 31168:tid 31173] [client 20.104.97.84:64615] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "affETrJUVgN8GV2P4h5S8AAAAUM"]
[Mon May 04 05:55:27.249382 2026] [:error] [pid 31168:tid 31171] [client 20.104.97.84:53402] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "affET7JUVgN8GV2P4h5S8wAAAUE"]
[Mon May 04 05:55:27.818733 2026] [:error] [pid 31168:tid 31190] [client 20.104.97.84:65042] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jq.php"] [unique_id "affET7JUVgN8GV2P4h5S9wAAAVQ"]
[Mon May 04 05:55:28.332427 2026] [proxy_fcgi:error] [pid 57154:tid 57167] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:28.541868 2026] [proxy_fcgi:error] [pid 57154:tid 57159] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:28.771940 2026] [proxy_fcgi:error] [pid 57154:tid 57177] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:29.164389 2026] [proxy_fcgi:error] [pid 57154:tid 57171] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:29.464760 2026] [proxy_fcgi:error] [pid 57154:tid 57166] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:29.684311 2026] [proxy_fcgi:error] [pid 57154:tid 57174] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:29.905990 2026] [proxy_fcgi:error] [pid 57154:tid 57164] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:30.140900 2026] [proxy_fcgi:error] [pid 57154:tid 57168] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:30.351391 2026] [proxy_fcgi:error] [pid 57154:tid 57173] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:30.601095 2026] [proxy_fcgi:error] [pid 57154:tid 57172] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:30.835100 2026] [proxy_fcgi:error] [pid 57154:tid 57167] [client 20.104.97.84:53427] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:55:31.041673 2026] [:error] [pid 57154:tid 57181] [client 20.104.97.84:53427] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "affEU_4DAn7umy_ATRzhOQAAANg"]
[Mon May 04 05:55:31.803623 2026] [:error] [pid 58625:tid 58632] [client 20.104.97.84:65112] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "affEU_ZfjPGFqq6KSLkdaAAAAQQ"]
[Mon May 04 05:55:32.502868 2026] [:error] [pid 57047:tid 57110] [client 20.104.97.84:64559] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "affEVFtCAxKLCAMkLV2ZJQAAAFQ"]
[Mon May 04 05:55:33.291744 2026] [:error] [pid 57047:tid 57109] [client 20.104.97.84:53445] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shelp.php"] [unique_id "affEVVtCAxKLCAMkLV2ZKQAAAFM"]
[Mon May 04 05:55:34.012832 2026] [:error] [pid 57154:tid 57164] [client 20.104.97.84:8281] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seyv.php"] [unique_id "affEVv4DAn7umy_ATRzhQAAAAMc"]
[Mon May 04 05:55:34.531672 2026] [:error] [pid 58625:tid 58633] [client 20.104.97.84:65056] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seyv.php"] [unique_id "affEVvZfjPGFqq6KSLkdawAAAQU"]
[Mon May 04 05:55:35.066508 2026] [:error] [pid 57047:tid 57107] [client 20.104.97.84:42207] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seyv.php"] [unique_id "affEV1tCAxKLCAMkLV2ZKwAAAFE"]
[Mon May 04 05:55:35.755783 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:42214] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seyv.php"] [unique_id "affEV_4DAn7umy_ATRzhQwAAANI"]
[Mon May 04 05:55:36.261677 2026] [:error] [pid 57154:tid 57161] [client 20.104.97.84:53418] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad821.php"] [unique_id "affEWP4DAn7umy_ATRzhRAAAAMQ"]
[Mon May 04 05:55:36.833891 2026] [:error] [pid 57047:tid 57093] [client 20.104.97.84:53410] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad821.php"] [unique_id "affEWFtCAxKLCAMkLV2ZLAAAAEM"]
[Mon May 04 05:55:37.314968 2026] [:error] [pid 58625:tid 58628] [client 20.104.97.84:8311] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad821.php"] [unique_id "affEWfZfjPGFqq6KSLkdbwAAAQA"]
[Mon May 04 05:55:37.798418 2026] [:error] [pid 57154:tid 57166] [client 20.104.97.84:53464] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad821.php"] [unique_id "affEWf4DAn7umy_ATRzhSQAAAMk"]
[Mon May 04 05:55:38.360912 2026] [:error] [pid 57046:tid 57061] [client 20.104.97.84:53457] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8210.php"] [unique_id "affEWoDA4d1tYGL7mqAi0QAAAAA"]
[Mon May 04 05:55:38.898037 2026] [:error] [pid 57154:tid 57167] [client 20.104.97.84:53440] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8210.php"] [unique_id "affEWv4DAn7umy_ATRzhUQAAAMo"]
[Mon May 04 05:55:39.504817 2026] [:error] [pid 58625:tid 58652] [client 20.104.97.84:53379] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8210.php"] [unique_id "affEW_ZfjPGFqq6KSLkdcgAAARg"]
[Mon May 04 05:55:39.994453 2026] [:error] [pid 58625:tid 58630] [client 20.104.97.84:8269] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8210.php"] [unique_id "affEW_ZfjPGFqq6KSLkdcwAAAQI"]
[Mon May 04 05:55:40.541468 2026] [:error] [pid 58625:tid 58632] [client 20.104.97.84:42188] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8rd1.php"] [unique_id "affEXPZfjPGFqq6KSLkddwAAAQQ"]
[Mon May 04 05:55:41.198313 2026] [:error] [pid 31168:tid 31183] [client 20.104.97.84:8275] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8rd1.php"] [unique_id "affEXbJUVgN8GV2P4h5S_AAAAU0"]
[Mon May 04 05:55:41.716447 2026] [:error] [pid 31168:tid 31187] [client 20.104.97.84:53494] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8rd1.php"] [unique_id "affEXbJUVgN8GV2P4h5S_gAAAVE"]
[Mon May 04 05:55:42.377823 2026] [:error] [pid 31168:tid 31191] [client 20.104.97.84:42231] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sad8rd1.php"] [unique_id "affEXrJUVgN8GV2P4h5S_wAAAVU"]
[Mon May 04 05:55:42.995042 2026] [:error] [pid 31168:tid 31184] [client 20.104.97.84:8256] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzgf5.php"] [unique_id "affEXrJUVgN8GV2P4h5TAQAAAU4"]
[Mon May 04 05:55:43.596707 2026] [:error] [pid 57154:tid 57160] [client 20.104.97.84:64619] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzgf5.php"] [unique_id "affEX_4DAn7umy_ATRzhVgAAAMM"]
[Mon May 04 05:55:44.185793 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:53396] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzgf5.php"] [unique_id "affEYP4DAn7umy_ATRzhWAAAANM"]
[Mon May 04 05:55:44.639648 2026] [:error] [pid 31168:tid 31171] [client 20.104.97.84:42135] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzgf5.php"] [unique_id "affEYLJUVgN8GV2P4h5TAwAAAUE"]
[Mon May 04 05:55:45.255085 2026] [:error] [pid 57154:tid 57174] [client 20.104.97.84:64574] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzw9t.php"] [unique_id "affEYf4DAn7umy_ATRzhXAAAANE"]
[Mon May 04 05:55:45.998649 2026] [:error] [pid 57048:tid 57120] [client 20.104.97.84:42183] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzw9t.php"] [unique_id "affEYYZINtpBgqE164JQOgAAAIM"]
[Mon May 04 05:55:46.830576 2026] [:error] [pid 58625:tid 58646] [client 20.104.97.84:65133] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzw9t.php"] [unique_id "affEYvZfjPGFqq6KSLkdgAAAARI"]
[Mon May 04 05:55:47.484933 2026] [:error] [pid 58625:tid 58642] [client 20.104.97.84:65094] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saxzw9t.php"] [unique_id "affEY_ZfjPGFqq6KSLkdggAAAQ4"]
[Mon May 04 05:55:48.076790 2026] [:error] [pid 31168:tid 31185] [client 20.104.97.84:53382] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "affEZLJUVgN8GV2P4h5TBwAAAU8"]
[Mon May 04 05:55:48.520103 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:53392] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "affEZP4DAn7umy_ATRzhYQAAANI"]
[Mon May 04 05:55:49.072871 2026] [:error] [pid 57047:tid 57090] [client 20.104.97.84:53426] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "affEZVtCAxKLCAMkLV2ZLQAAAEA"]
[Mon May 04 05:55:49.533096 2026] [:error] [pid 57048:tid 57125] [client 20.104.97.84:53398] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sder5252u.php"] [unique_id "affEZYZINtpBgqE164JQPAAAAIg"]
[Mon May 04 05:55:50.272513 2026] [:error] [pid 57047:tid 57113] [client 20.104.97.84:53487] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "affEZltCAxKLCAMkLV2ZLgAAAFc"]
[Mon May 04 05:55:50.876704 2026] [:error] [pid 57048:tid 57138] [client 20.104.97.84:8271] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "affEZoZINtpBgqE164JQQAAAAJU"]
[Mon May 04 05:55:51.419113 2026] [:error] [pid 58625:tid 58631] [client 20.104.97.84:53454] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "affEZ_ZfjPGFqq6KSLkdhwAAAQM"]
[Mon May 04 05:55:52.139718 2026] [:error] [pid 57048:tid 57126] [client 20.104.97.84:8295] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sderty5u.php"] [unique_id "affEaIZINtpBgqE164JQQQAAAIk"]
[Mon May 04 05:55:52.692473 2026] [:error] [pid 31168:tid 31188] [client 20.104.97.84:53488] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "affEaLJUVgN8GV2P4h5TCAAAAVI"]
[Mon May 04 05:55:53.567882 2026] [:error] [pid 57048:tid 57139] [client 20.104.97.84:65108] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "affEaYZINtpBgqE164JQQgAAAJY"]
[Mon May 04 05:55:54.502800 2026] [:error] [pid 57154:tid 57171] [client 20.104.97.84:53414] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "affEav4DAn7umy_ATRzhbgAAAM4"]
[Mon May 04 05:55:55.338355 2026] [:error] [pid 57047:tid 57104] [client 20.104.97.84:8294] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hilk.php"] [unique_id "affEa1tCAxKLCAMkLV2ZMQAAAE4"]
[Mon May 04 05:55:56.042314 2026] [:error] [pid 57047:tid 57091] [client 20.104.97.84:8257] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "affEbFtCAxKLCAMkLV2ZNAAAAEE"]
[Mon May 04 05:55:56.607889 2026] [:error] [pid 31168:tid 31184] [client 20.104.97.84:42228] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "affEbLJUVgN8GV2P4h5TDwAAAU4"]
[Mon May 04 05:55:57.213287 2026] [:error] [pid 57048:tid 57132] [client 20.104.97.84:53502] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "affEbYZINtpBgqE164JQRAAAAI8"]
[Mon May 04 05:55:57.909675 2026] [:error] [pid 57046:tid 57083] [client 20.104.97.84:53416] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/miso.php"] [unique_id "affEbYDA4d1tYGL7mqAi1gAAABY"]
[Mon May 04 05:55:58.462175 2026] [:error] [pid 31168:tid 31185] [client 20.104.97.84:53422] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "affEbrJUVgN8GV2P4h5TEgAAAU8"]
[Mon May 04 05:55:59.073437 2026] [:error] [pid 31168:tid 31176] [client 20.104.97.84:64589] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "affEb7JUVgN8GV2P4h5TEwAAAUY"]
[Mon May 04 05:55:59.720442 2026] [:error] [pid 57154:tid 57176] [client 20.104.97.84:8258] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "affEb_4DAn7umy_ATRzhdQAAANM"]
[Mon May 04 05:56:00.379293 2026] [:error] [pid 57154:tid 57172] [client 20.104.97.84:8264] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "affEcP4DAn7umy_ATRzhdgAAAM8"]
[Mon May 04 05:56:00.884203 2026] [:error] [pid 31168:tid 31181] [client 20.104.97.84:53411] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "affEcLJUVgN8GV2P4h5TFQAAAUs"]
[Mon May 04 05:56:01.466450 2026] [:error] [pid 57154:tid 57170] [client 20.104.97.84:53469] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "affEcf4DAn7umy_ATRzheAAAAM0"]
[Mon May 04 05:56:02.250574 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:8293] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "affEcv4DAn7umy_ATRzhegAAAMw"]
[Mon May 04 05:56:03.664295 2026] [:error] [pid 58625:tid 58644] [client 20.104.97.84:8268] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/checkout.php"] [unique_id "affEc_ZfjPGFqq6KSLkdiQAAARA"]
[Mon May 04 05:56:04.599792 2026] [:error] [pid 57048:tid 57134] [client 20.104.97.84:8310] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "affEdIZINtpBgqE164JQTgAAAJE"]
[Mon May 04 05:56:05.191917 2026] [:error] [pid 57154:tid 57167] [client 20.104.97.84:53452] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "affEdf4DAn7umy_ATRzhggAAAMo"]
[Mon May 04 05:56:06.036998 2026] [:error] [pid 57046:tid 57077] [client 20.104.97.84:53409] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "affEdoDA4d1tYGL7mqAi3AAAABA"]
[Mon May 04 05:56:06.560424 2026] [:error] [pid 57048:tid 57125] [client 20.104.97.84:42185] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fictioner.php"] [unique_id "affEdoZINtpBgqE164JQUAAAAIg"]
[Mon May 04 05:56:07.240868 2026] [:error] [pid 57154:tid 57164] [client 20.104.97.84:53430] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "affEd_4DAn7umy_ATRzhigAAAMc"]
[Mon May 04 05:56:08.012511 2026] [:error] [pid 57154:tid 57161] [client 20.104.97.84:64560] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "affEeP4DAn7umy_ATRzhjAAAAMQ"]
[Mon May 04 05:56:09.021664 2026] [:error] [pid 57154:tid 57178] [client 20.104.97.84:8309] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "affEef4DAn7umy_ATRzhjgAAANU"]
[Mon May 04 05:56:09.569937 2026] [:error] [pid 57046:tid 57067] [client 20.104.97.84:65132] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "affEeYDA4d1tYGL7mqAi3wAAAAY"]
[Mon May 04 05:56:10.294626 2026] [:error] [pid 57046:tid 57075] [client 20.104.97.84:8279] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "affEeoDA4d1tYGL7mqAi4QAAAA4"]
[Mon May 04 05:56:10.961587 2026] [:error] [pid 57046:tid 57074] [client 20.104.97.84:53495] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "affEeoDA4d1tYGL7mqAi4wAAAA0"]
[Mon May 04 05:56:11.690323 2026] [:error] [pid 57046:tid 57062] [client 20.104.97.84:42143] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "affEe4DA4d1tYGL7mqAi5AAAAAE"]
[Mon May 04 05:56:12.400050 2026] [:error] [pid 57048:tid 57134] [client 20.104.97.84:64636] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxa.php"] [unique_id "affEfIZINtpBgqE164JQVAAAAJE"]
[Mon May 04 05:56:12.951763 2026] [:error] [pid 57048:tid 57130] [client 20.104.97.84:53429] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "affEfIZINtpBgqE164JQVgAAAI0"]
[Mon May 04 05:56:13.442541 2026] [:error] [pid 57046:tid 57077] [client 20.104.97.84:53391] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "affEfYDA4d1tYGL7mqAi6QAAABA"]
[Mon May 04 05:56:14.027453 2026] [:error] [pid 57048:tid 57141] [client 20.104.97.84:64637] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "affEfoZINtpBgqE164JQWAAAAJg"]
[Mon May 04 05:56:14.615758 2026] [:error] [pid 57046:tid 57076] [client 20.104.97.84:53463] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "affEfoDA4d1tYGL7mqAi7AAAAA8"]
[Mon May 04 05:56:15.119594 2026] [:error] [pid 57048:tid 57122] [client 20.104.97.84:42238] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "affEf4ZINtpBgqE164JQWgAAAIU"]
[Mon May 04 05:56:15.601734 2026] [:error] [pid 58625:tid 58650] [client 20.104.97.84:42123] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "affEf_ZfjPGFqq6KSLkdigAAARY"]
[Mon May 04 05:56:16.441044 2026] [:error] [pid 57048:tid 57140] [client 20.104.97.84:8314] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "affEgIZINtpBgqE164JQXQAAAJc"]
[Mon May 04 05:56:17.094977 2026] [:error] [pid 57154:tid 57159] [client 20.104.97.84:8288] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asyn-upload.php"] [unique_id "affEgf4DAn7umy_ATRzhkQAAAMI"]
[Mon May 04 05:56:17.643712 2026] [:error] [pid 57154:tid 57158] [client 20.104.97.84:42233] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "affEgf4DAn7umy_ATRzhlAAAAME"]
[Mon May 04 05:56:18.238920 2026] [:error] [pid 57154:tid 57169] [client 20.104.97.84:8308] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "affEgv4DAn7umy_ATRzhlwAAAMw"]
[Mon May 04 05:56:18.848703 2026] [:error] [pid 57154:tid 57179] [client 20.104.97.84:42119] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "affEgv4DAn7umy_ATRzhmgAAANY"]
[Mon May 04 05:56:19.443054 2026] [:error] [pid 58625:tid 58647] [client 20.104.97.84:8259] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/redixsx.php"] [unique_id "affEg_ZfjPGFqq6KSLkdjwAAARM"]
[Mon May 04 05:56:19.916744 2026] [:error] [pid 58625:tid 58632] [client 20.104.97.84:53491] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "affEg_ZfjPGFqq6KSLkdkQAAAQQ"]
[Mon May 04 05:56:20.508173 2026] [:error] [pid 58625:tid 58633] [client 20.104.97.84:8285] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "affEhPZfjPGFqq6KSLkdkwAAAQU"]
[Mon May 04 05:56:20.982370 2026] [:error] [pid 58625:tid 58642] [client 20.104.97.84:53404] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "affEhPZfjPGFqq6KSLkdlgAAAQ4"]
[Mon May 04 05:56:21.446317 2026] [:error] [pid 31168:tid 31188] [client 20.104.97.84:42201] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "affEhbJUVgN8GV2P4h5THwAAAVI"]
[Mon May 04 05:56:21.920686 2026] [:error] [pid 58625:tid 58638] [client 20.104.97.84:42230] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "affEhfZfjPGFqq6KSLkdmAAAAQo"]
[Mon May 04 05:56:22.492463 2026] [:error] [pid 58625:tid 58652] [client 20.104.97.84:53378] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "affEhvZfjPGFqq6KSLkdmQAAARg"]
[Mon May 04 05:56:22.956261 2026] [:error] [pid 58625:tid 58650] [client 20.104.97.84:42229] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "affEhvZfjPGFqq6KSLkdmgAAARY"]
[Mon May 04 05:56:23.543335 2026] [:error] [pid 57048:tid 57130] [client 20.104.97.84:42117] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "affEh4ZINtpBgqE164JQXgAAAI0"]
[Mon May 04 05:56:24.043663 2026] [:error] [pid 58625:tid 58641] [client 20.104.97.84:42133] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "affEiPZfjPGFqq6KSLkdnAAAAQ0"]
[Mon May 04 05:56:24.651403 2026] [:error] [pid 58625:tid 58647] [client 20.104.97.84:53476] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "affEiPZfjPGFqq6KSLkdnwAAARM"]
[Mon May 04 05:56:25.143360 2026] [:error] [pid 57048:tid 57132] [client 20.104.97.84:8261] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "affEiYZINtpBgqE164JQXwAAAI8"]
[Mon May 04 05:56:25.628781 2026] [:error] [pid 57046:tid 57061] [client 20.104.97.84:53383] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/67.php"] [unique_id "affEiYDA4d1tYGL7mqAi7gAAAAA"]
[Mon May 04 05:56:26.110216 2026] [:error] [pid 57048:tid 57135] [client 20.104.97.84:8318] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "affEioZINtpBgqE164JQYgAAAJI"]
[Mon May 04 05:56:26.961631 2026] [:error] [pid 57154:tid 57175] [client 20.104.97.84:42186] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "affEiv4DAn7umy_ATRzhnQAAANI"]
[Mon May 04 05:56:27.586571 2026] [:error] [pid 57154:tid 57164] [client 20.104.97.84:53465] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "affEi_4DAn7umy_ATRzhngAAAMc"]
[Mon May 04 05:56:28.244032 2026] [:error] [pid 58625:tid 58628] [client 20.104.97.84:8307] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1mrX.php"] [unique_id "affEjPZfjPGFqq6KSLkdpgAAAQA"]
[Mon May 04 05:56:28.903784 2026] [:error] [pid 58625:tid 58629] [client 20.104.97.84:53428] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "affEjPZfjPGFqq6KSLkdpwAAAQE"]
[Mon May 04 05:56:29.533732 2026] [:error] [pid 58625:tid 58635] [client 20.104.97.84:42159] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x402.php"] [unique_id "affEjfZfjPGFqq6KSLkdqwAAAQc"]
[Mon May 04 05:56:30.012853 2026] [proxy_fcgi:error] [pid 58625:tid 58644] [client 20.104.97.84:53424] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:56:30.221490 2026] [proxy_fcgi:error] [pid 58625:tid 58647] [client 20.104.97.84:53424] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:56:30.430007 2026] [proxy_fcgi:error] [pid 58625:tid 58629] [client 20.104.97.84:53424] AH01071: Got error 'Primary script unknown'
[Mon May 04 05:56:30.639438 2026] [proxy_fcgi:error] [pid 58625:tid 58632] [client 20.104.97.84:53424] AH01071: Got error 'Primary script unknown'
[Mon May 04 06:23:52.926873 2026] [:error] [pid 57046:tid 57079] [client 51.77.218.189:59658] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "affK-IDA4d1tYGL7mqAmSwAAABI"]
[Mon May 04 06:23:54.494065 2026] [:error] [pid 57154:tid 57169] [client 51.77.218.189:32806] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "affK-v4DAn7umy_ATRzp3QAAAMw"]
[Mon May 04 06:23:56.428393 2026] [:error] [pid 57154:tid 57178] [client 51.77.218.189:56546] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "affK_P4DAn7umy_ATRzp4wAAANU"]
[Mon May 04 06:23:58.914148 2026] [:error] [pid 58625:tid 58640] [client 51.77.218.189:43016] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "affK_vZfjPGFqq6KSLkp3AAAAQw"]
[Mon May 04 06:24:00.730615 2026] [:error] [pid 57047:tid 57110] [client 51.77.218.189:56558] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "affLAFtCAxKLCAMkLV2eRwAAAFQ"]
[Mon May 04 06:24:03.218919 2026] [:error] [pid 58625:tid 58650] [client 51.77.218.189:43024] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "affLA_ZfjPGFqq6KSLkp8wAAARY"]
[Mon May 04 06:24:05.034161 2026] [:error] [pid 58625:tid 58629] [client 51.77.218.189:36760] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "affLBfZfjPGFqq6KSLkp9gAAAQE"]
[Mon May 04 06:24:07.038648 2026] [:error] [pid 57154:tid 57178] [client 51.77.218.189:36766] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "affLB_4DAn7umy_ATRzp_QAAANU"]
[Mon May 04 06:24:09.025212 2026] [:error] [pid 57047:tid 57111] [client 51.77.218.189:36782] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "affLCVtCAxKLCAMkLV2eTwAAAFU"]
[Mon May 04 06:24:11.021914 2026] [:error] [pid 58625:tid 58628] [client 51.77.218.189:36790] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "affLC_ZfjPGFqq6KSLkqAQAAAQA"]
[Mon May 04 06:24:13.020089 2026] [:error] [pid 57154:tid 57176] [client 51.77.218.189:36800] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "affLDf4DAn7umy_ATRzqCgAAANM"]
[Mon May 04 06:24:15.006982 2026] [:error] [pid 58625:tid 58638] [client 51.77.218.189:58740] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "affLD_ZfjPGFqq6KSLkqCgAAAQo"]
[Mon May 04 06:24:17.513722 2026] [:error] [pid 57154:tid 57180] [client 51.77.218.189:36224] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "affLEf4DAn7umy_ATRzqDAAAANc"]
[Mon May 04 06:24:19.947935 2026] [:error] [pid 58625:tid 58652] [client 51.77.218.189:36230] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "affLE_ZfjPGFqq6KSLkqFAAAARg"]
[Mon May 04 06:24:22.388148 2026] [:error] [pid 58625:tid 58647] [client 51.77.218.189:58748] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "affLFvZfjPGFqq6KSLkqGQAAARM"]
[Mon May 04 06:24:26.206269 2026] [:error] [pid 57046:tid 57083] [client 51.77.218.189:56876] [client 51.77.218.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "affLGoDA4d1tYGL7mqAmXQAAABY"]
[Mon May 04 09:54:40.004029 2026] [:error] [pid 12022:tid 12048] [client 20.9.90.138:16986] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "aff8YEVhgvCNKBWnaTJGdAAAAJg"]
[Mon May 04 09:54:40.754202 2026] [:error] [pid 12022:tid 12046] [client 20.9.90.138:26641] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "aff8YEVhgvCNKBWnaTJGdgAAAJY"]
[Mon May 04 09:54:41.529265 2026] [:error] [pid 33186:tid 33207] [client 20.9.90.138:18499] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "aff8Ybqlqe0DcmBS9VzueAAAABI"]
[Mon May 04 09:54:42.305341 2026] [:error] [pid 33186:tid 33189] [client 20.9.90.138:26631] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "aff8Yrqlqe0DcmBS9VzumQAAAAA"]
[Mon May 04 10:05:55.646049 2026] [:error] [pid 33186:tid 33192] [client 104.207.42.144:46443] [client 104.207.42.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aff_A7qlqe0DcmBS9Vz15gAAAAM"]
[Mon May 04 10:36:03.361527 2026] [:error] [pid 11958:tid 11976] [client 153.75.244.88:35504] [client 153.75.244.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afgGEzAK_o2NLEdfAUlFZAAAAE8"]
[Mon May 04 10:50:02.555409 2026] [:error] [pid 12022:tid 12045] [client 82.24.46.5:39492] [client 82.24.46.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "afgJWkVhgvCNKBWnaTJWAgAAAJU"]
[Mon May 04 11:32:28.039818 2026] [:error] [pid 11958:tid 11966] [client 43.164.194.198:51644] [client 43.164.194.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afgTTDAK_o2NLEdfAUlQJAAAAEU"]
[Mon May 04 12:41:22.186187 2026] [:error] [pid 12022:tid 12024] [client 43.153.36.110:59682] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afgjckVhgvCNKBWnaTJ5kQAAAIA"]
[Mon May 04 12:42:43.209719 2026] [:error] [pid 64610:tid 64630] [client 185.231.101.82:17296] [client 185.231.101.82] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/ogg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afgjw2hJ7aZW62UOoWhF4gAAARI"]
[Mon May 04 12:42:43.210011 2026] [:error] [pid 64610:tid 64630] [client 185.231.101.82:17296] [client 185.231.101.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afgjw2hJ7aZW62UOoWhF4gAAARI"]
[Mon May 04 12:52:00.842434 2026] [:error] [pid 64610:tid 64629] [client 139.155.134.17:57756] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afgl8GhJ7aZW62UOoWhLkAAAARE"]
[Mon May 04 14:42:05.354660 2026] [:error] [pid 53248:tid 53256] [client 51.68.235.38:50958] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afg_vQPqlCce9bsWu6i7qgAAAAY"]
[Mon May 04 14:42:07.230616 2026] [:error] [pid 53161:tid 53240] [client 51.68.235.38:45978] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afg_v05l1qgo2JEi65l4yAAAAFc"]
[Mon May 04 14:42:09.193694 2026] [:error] [pid 53248:tid 53269] [client 51.68.235.38:45984] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afg_wQPqlCce9bsWu6i7sAAAABM"]
[Mon May 04 14:42:11.093663 2026] [:error] [pid 53248:tid 53268] [client 51.68.235.38:45996] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afg_wwPqlCce9bsWu6i7ugAAABI"]
[Mon May 04 14:42:12.967632 2026] [:error] [pid 53159:tid 53175] [client 51.68.235.38:45998] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afg_xFZg7pq4CfE3tM-bFgAAAMw"]
[Mon May 04 14:42:14.866040 2026] [:error] [pid 53248:tid 53258] [client 51.68.235.38:40958] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afg_xgPqlCce9bsWu6i7yQAAAAg"]
[Mon May 04 14:42:16.783504 2026] [:error] [pid 53248:tid 53254] [client 51.68.235.38:40962] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afg_yAPqlCce9bsWu6i70AAAAAQ"]
[Mon May 04 14:42:18.594004 2026] [:error] [pid 53248:tid 53266] [client 51.68.235.38:40974] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afg_ygPqlCce9bsWu6i71gAAABA"]
[Mon May 04 14:42:20.431008 2026] [:error] [pid 53248:tid 53256] [client 51.68.235.38:40990] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afg_zAPqlCce9bsWu6i77QAAAAY"]
[Mon May 04 14:42:22.388682 2026] [:error] [pid 53159:tid 53179] [client 51.68.235.38:41004] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afg_zlZg7pq4CfE3tM-bLQAAANA"]
[Mon May 04 14:42:24.367353 2026] [:error] [pid 53248:tid 53256] [client 51.68.235.38:49828] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afg_0APqlCce9bsWu6i8awAAAAY"]
[Mon May 04 14:42:26.355962 2026] [:error] [pid 53161:tid 53235] [client 51.68.235.38:49836] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afg_0k5l1qgo2JEi65l5NQAAAFI"]
[Mon May 04 14:42:28.247195 2026] [:error] [pid 53159:tid 53168] [client 51.68.235.38:49852] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afg_1FZg7pq4CfE3tM-bcAAAAMU"]
[Mon May 04 14:42:30.188351 2026] [:error] [pid 53159:tid 53185] [client 51.68.235.38:49864] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afg_1lZg7pq4CfE3tM-bewAAANY"]
[Mon May 04 14:42:32.137627 2026] [:error] [pid 53161:tid 53225] [client 51.68.235.38:49876] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afg_2E5l1qgo2JEi65l5SQAAAEg"]
[Mon May 04 14:42:34.147013 2026] [:error] [pid 53248:tid 53251] [client 51.68.235.38:48040] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afg_2gPqlCce9bsWu6i8mwAAAAE"]
[Mon May 04 14:42:35.954781 2026] [:error] [pid 53248:tid 53263] [client 51.68.235.38:48056] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afg_2wPqlCce9bsWu6i8ogAAAA0"]
[Mon May 04 14:42:37.816810 2026] [:error] [pid 53248:tid 53254] [client 51.68.235.38:48066] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afg_3QPqlCce9bsWu6i8pwAAAAQ"]
[Mon May 04 14:42:39.663586 2026] [:error] [pid 53161:tid 53231] [client 51.68.235.38:48070] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afg_305l1qgo2JEi65l5TQAAAE4"]
[Mon May 04 14:42:41.499765 2026] [:error] [pid 53159:tid 53169] [client 51.68.235.38:48078] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afg_4VZg7pq4CfE3tM-biwAAAMY"]
[Mon May 04 14:42:43.412736 2026] [:error] [pid 53160:tid 53192] [client 51.68.235.38:35038] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afg_46NFKJC8NNHHXb49UQAAAQI"]
[Mon May 04 14:42:45.370168 2026] [:error] [pid 53160:tid 53212] [client 51.68.235.38:35052] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afg_5aNFKJC8NNHHXb49UgAAARY"]
[Mon May 04 14:42:47.307824 2026] [:error] [pid 53248:tid 53261] [client 51.68.235.38:35068] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afg_5wPqlCce9bsWu6i8xQAAAAs"]
[Mon May 04 14:42:49.319303 2026] [:error] [pid 53248:tid 53250] [client 51.68.235.38:35080] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afg_6QPqlCce9bsWu6i8yQAAAAA"]
[Mon May 04 14:42:51.458082 2026] [:error] [pid 53248:tid 53260] [client 51.68.235.38:35088] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afg_6wPqlCce9bsWu6i81AAAAAo"]
[Mon May 04 14:42:53.416797 2026] [:error] [pid 53248:tid 53271] [client 51.68.235.38:49386] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afg_7QPqlCce9bsWu6i84AAAABU"]
[Mon May 04 14:42:55.382982 2026] [:error] [pid 53161:tid 53224] [client 51.68.235.38:49388] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afg_705l1qgo2JEi65l5YwAAAEc"]
[Mon May 04 14:42:57.464953 2026] [:error] [pid 53160:tid 53194] [client 51.68.235.38:49396] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afg_8aNFKJC8NNHHXb49ZgAAAQQ"]
[Mon May 04 14:42:59.791857 2026] [:error] [pid 53160:tid 53195] [client 51.68.235.38:49404] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afg_86NFKJC8NNHHXb49bQAAAQU"]
[Mon May 04 14:43:21.843431 2026] [:error] [pid 53248:tid 53266] [client 51.68.235.38:54588] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afhACQPqlCce9bsWu6i9MAAAABA"]
[Mon May 04 14:43:23.700604 2026] [:error] [pid 53248:tid 53259] [client 51.68.235.38:55820] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afhACwPqlCce9bsWu6i9NgAAAAk"]
[Mon May 04 14:43:25.725848 2026] [:error] [pid 53159:tid 53180] [client 51.68.235.38:55826] [client 51.68.235.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afhADVZg7pq4CfE3tM-brQAAANE"]
[Mon May 04 14:53:50.411063 2026] [proxy_fcgi:error] [pid 53248:tid 53270] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:50.656856 2026] [proxy_fcgi:error] [pid 53248:tid 53271] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:50.991858 2026] [proxy_fcgi:error] [pid 53248:tid 53257] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:51.239335 2026] [proxy_fcgi:error] [pid 53248:tid 53250] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:51.487354 2026] [proxy_fcgi:error] [pid 53248:tid 53261] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:51.733094 2026] [proxy_fcgi:error] [pid 53248:tid 53264] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:52.223169 2026] [proxy_fcgi:error] [pid 53248:tid 53272] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:52.517169 2026] [proxy_fcgi:error] [pid 53248:tid 53256] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:52.786175 2026] [proxy_fcgi:error] [pid 53248:tid 53265] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:53.044963 2026] [proxy_fcgi:error] [pid 53248:tid 53271] [client 52.165.198.204:9539] AH01071: Got error 'Primary script unknown'
[Mon May 04 14:53:53.323041 2026] [:error] [pid 53248:tid 53254] [client 52.165.198.204:9539] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "afhCgQPqlCce9bsWu6jC-wAAAAQ"]
[Mon May 04 14:53:57.218041 2026] [:error] [pid 53248:tid 53274] [client 52.165.198.204:9420] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "afhChQPqlCce9bsWu6jC_gAAABg"]
[Mon May 04 14:53:58.574366 2026] [:error] [pid 53160:tid 53200] [client 52.165.198.204:9553] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "afhChqNFKJC8NNHHXb5A5wAAAQo"]
[Mon May 04 14:54:00.365589 2026] [:error] [pid 53159:tid 53177] [client 52.165.198.204:9593] [client 52.165.198.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php"] [unique_id "afhCiFZg7pq4CfE3tM-fNQAAAM4"]
[Mon May 04 15:45:06.453156 2026] [:error] [pid 61150:tid 61163] [client 136.107.232.91:64427] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afhOgu8QXWVLiwIGVpc8OwAAAUo"]
[Mon May 04 15:45:06.940002 2026] [:error] [pid 61044:tid 61116] [client 136.107.232.91:49569] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afhOgkw8w2zZZXI6H1tmEgAAAA4"]
[Mon May 04 15:45:07.394103 2026] [:error] [pid 61042:tid 61052] [client 136.107.232.91:51267] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afhOg0nAPPS1fjubA9Qq8QAAAMY"]
[Mon May 04 16:33:22.676394 2026] [:error] [pid 61043:tid 61098] [client 209.87.169.207:53323] [client 209.87.169.207] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "afhZ0p8-LwtfURjiAbB9iQAAAFc"]
[Mon May 04 16:50:20.006191 2026] [:error] [pid 61043:tid 61093] [client 135.181.180.59:29218] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afhdzJ8-LwtfURjiAbCGLAAAAFI"]
[Mon May 04 16:50:21.929773 2026] [:error] [pid 61043:tid 61080] [client 135.181.180.59:29222] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afhdzZ8-LwtfURjiAbCGMgAAAEU"]
[Mon May 04 16:50:23.815887 2026] [:error] [pid 61043:tid 61096] [client 135.181.180.59:29230] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afhdz58-LwtfURjiAbCGNwAAAFU"]
[Mon May 04 16:50:25.741276 2026] [:error] [pid 61150:tid 61160] [client 135.181.180.59:8850] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afhd0e8QXWVLiwIGVpdUZQAAAUc"]
[Mon May 04 16:50:27.686993 2026] [:error] [pid 61043:tid 61095] [client 135.181.180.59:8852] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afhd058-LwtfURjiAbCGbwAAAFQ"]
[Mon May 04 16:50:29.683880 2026] [:error] [pid 61043:tid 61086] [client 135.181.180.59:8858] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afhd1Z8-LwtfURjiAbCGeAAAAEs"]
[Mon May 04 16:50:31.701011 2026] [:error] [pid 61043:tid 61095] [client 135.181.180.59:8864] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afhd158-LwtfURjiAbCGegAAAFQ"]
[Mon May 04 16:50:33.717336 2026] [:error] [pid 3341:tid 3367] [client 135.181.180.59:8866] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afhd2U9o3_LordU0wW7_QgAAAJc"]
[Mon May 04 16:50:35.684693 2026] [:error] [pid 61043:tid 61097] [client 135.181.180.59:23890] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afhd258-LwtfURjiAbCGhwAAAFY"]
[Mon May 04 16:50:37.740742 2026] [:error] [pid 3341:tid 3354] [client 135.181.180.59:23892] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afhd3U9o3_LordU0wW7_TQAAAIo"]
[Mon May 04 16:50:39.661267 2026] [:error] [pid 61042:tid 61065] [client 135.181.180.59:23894] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afhd30nAPPS1fjubA9Q3jgAAANM"]
[Mon May 04 16:50:41.719061 2026] [:error] [pid 61042:tid 61064] [client 135.181.180.59:23900] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afhd4UnAPPS1fjubA9Q3jwAAANI"]
[Mon May 04 16:50:43.640251 2026] [:error] [pid 61044:tid 61111] [client 135.181.180.59:23906] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afhd40w8w2zZZXI6H1t2BwAAAAk"]
[Mon May 04 16:50:45.626623 2026] [:error] [pid 61043:tid 61077] [client 135.181.180.59:48480] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afhd5Z8-LwtfURjiAbCGnAAAAEI"]
[Mon May 04 16:50:47.646360 2026] [:error] [pid 61043:tid 61095] [client 135.181.180.59:48484] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afhd558-LwtfURjiAbCGoAAAAFQ"]
[Mon May 04 16:50:49.712584 2026] [:error] [pid 61043:tid 61088] [client 135.181.180.59:48488] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afhd6Z8-LwtfURjiAbCGpQAAAE0"]
[Mon May 04 16:50:51.727161 2026] [:error] [pid 3341:tid 3368] [client 135.181.180.59:48500] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afhd609o3_LordU0wW7_VQAAAJg"]
[Mon May 04 16:50:53.706836 2026] [:error] [pid 3341:tid 3351] [client 135.181.180.59:48514] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afhd7U9o3_LordU0wW7_VgAAAIc"]
[Mon May 04 16:50:55.635532 2026] [:error] [pid 61043:tid 61095] [client 135.181.180.59:57474] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afhd758-LwtfURjiAbCGtwAAAFQ"]
[Mon May 04 16:50:57.600323 2026] [:error] [pid 61150:tid 61157] [client 135.181.180.59:57478] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afhd8e8QXWVLiwIGVpdUsQAAAUQ"]
[Mon May 04 16:50:59.529702 2026] [:error] [pid 61042:tid 61052] [client 135.181.180.59:57488] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afhd80nAPPS1fjubA9Q3lwAAAMY"]
[Mon May 04 16:51:01.473258 2026] [:error] [pid 61043:tid 61084] [client 135.181.180.59:57492] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afhd9Z8-LwtfURjiAbCGuwAAAEk"]
[Mon May 04 16:51:03.417698 2026] [:error] [pid 61150:tid 61154] [client 135.181.180.59:57496] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afhd9-8QXWVLiwIGVpdUwQAAAUE"]
[Mon May 04 16:51:05.378077 2026] [:error] [pid 61042:tid 61065] [client 135.181.180.59:12742] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afhd-UnAPPS1fjubA9Q3ngAAANM"]
[Mon May 04 16:51:07.350818 2026] [:error] [pid 3341:tid 3366] [client 135.181.180.59:12748] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afhd-09o3_LordU0wW7_WgAAAJY"]
[Mon May 04 16:51:09.353974 2026] [:error] [pid 61043:tid 61081] [client 135.181.180.59:12754] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afhd_Z8-LwtfURjiAbCGxQAAAEY"]
[Mon May 04 19:01:52.407492 2026] [:error] [pid 61150:tid 61174] [client 217.154.63.119:57098] [client 217.154.63.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "afh8oO8QXWVLiwIGVpdvEwAAAVU"]
[Mon May 04 19:27:07.113521 2026] [:error] [pid 32471:tid 32497] [client 106.192.127.91:65358] [client 106.192.127.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.192.127.91, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afiCi3mjpb9EYq6AqhJDLAAAARc"]
[Mon May 04 19:27:07.124556 2026] [proxy_fcgi:error] [pid 32471:tid 32497] [client 106.192.127.91:65358] AH01071: Got error 'Primary script unknown'
[Mon May 04 19:28:00.357477 2026] [:error] [pid 61043:tid 61078] [client 106.192.127.91:50169] [client 106.192.127.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.192.127.91, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afiCwJ8-LwtfURjiAbCwLQAAAEM"]
[Mon May 04 19:28:00.367507 2026] [proxy_fcgi:error] [pid 61043:tid 61078] [client 106.192.127.91:50169] AH01071: Got error 'Primary script unknown'
[Mon May 04 19:35:59.154326 2026] [:error] [pid 61042:tid 61049] [client 217.182.195.181:43212] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afiEn0nAPPS1fjubA9RN7wAAAMM"]
[Mon May 04 19:36:01.578706 2026] [:error] [pid 61150:tid 61161] [client 217.182.195.181:46192] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afiEoe8QXWVLiwIGVpd2bQAAAUg"]
[Mon May 04 19:36:03.495350 2026] [:error] [pid 61044:tid 61121] [client 217.182.195.181:54746] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afiEo0w8w2zZZXI6H1uRcAAAABM"]
[Mon May 04 19:36:05.953964 2026] [:error] [pid 61042:tid 61048] [client 217.182.195.181:46196] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afiEpUnAPPS1fjubA9RN9QAAAMI"]
[Mon May 04 19:36:08.319944 2026] [:error] [pid 61044:tid 61106] [client 217.182.195.181:46200] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afiEqEw8w2zZZXI6H1uRcQAAAAQ"]
[Mon May 04 19:36:10.278890 2026] [:error] [pid 61043:tid 61076] [client 217.182.195.181:40250] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afiEqp8-LwtfURjiAbCydAAAAEE"]
[Mon May 04 19:36:12.307879 2026] [:error] [pid 61043:tid 61098] [client 217.182.195.181:40266] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afiErJ8-LwtfURjiAbCyeQAAAFc"]
[Mon May 04 19:36:14.910161 2026] [:error] [pid 61044:tid 61111] [client 217.182.195.181:43652] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afiErkw8w2zZZXI6H1uReAAAAAk"]
[Mon May 04 19:36:17.305560 2026] [:error] [pid 61042:tid 61064] [client 217.182.195.181:43666] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afiEsUnAPPS1fjubA9RN-AAAANI"]
[Mon May 04 19:36:19.801585 2026] [:error] [pid 61044:tid 61118] [client 217.182.195.181:41072] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afiEs0w8w2zZZXI6H1uRgQAAABA"]
[Mon May 04 19:36:21.845159 2026] [:error] [pid 61043:tid 61080] [client 217.182.195.181:44094] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afiEtZ8-LwtfURjiAbCyhQAAAEU"]
[Mon May 04 19:36:24.240629 2026] [:error] [pid 61044:tid 61102] [client 217.182.195.181:41082] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afiEuEw8w2zZZXI6H1uRiQAAAAA"]
[Mon May 04 19:36:26.612984 2026] [:error] [pid 3341:tid 3347] [client 217.182.195.181:41096] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afiEuk9o3_LordU0wW48VQAAAIM"]
[Mon May 04 19:36:29.112950 2026] [:error] [pid 3341:tid 3354] [client 217.182.195.181:60556] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afiEvU9o3_LordU0wW48XwAAAIo"]
[Mon May 04 19:36:31.121083 2026] [:error] [pid 61042:tid 61051] [client 217.182.195.181:36918] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afiEv0nAPPS1fjubA9ROAgAAAMU"]
[Mon May 04 19:36:33.346549 2026] [:error] [pid 3341:tid 3356] [client 217.182.195.181:60560] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afiEwU9o3_LordU0wW48ZQAAAIw"]
[Mon May 04 19:36:35.353699 2026] [:error] [pid 3341:tid 3354] [client 217.182.195.181:36922] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afiEw09o3_LordU0wW48bQAAAIo"]
[Mon May 04 19:36:37.874758 2026] [:error] [pid 3341:tid 3347] [client 217.182.195.181:60574] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afiExU9o3_LordU0wW48cAAAAIM"]
[Mon May 04 19:36:40.376941 2026] [:error] [pid 3341:tid 3367] [client 217.182.195.181:48564] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afiEyE9o3_LordU0wW48gwAAAJc"]
[Mon May 04 19:36:42.360858 2026] [:error] [pid 61044:tid 61108] [client 217.182.195.181:33636] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afiEykw8w2zZZXI6H1uRlwAAAAY"]
[Mon May 04 19:36:44.868643 2026] [:error] [pid 32471:tid 32485] [client 217.182.195.181:48568] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afiEzHmjpb9EYq6AqhJGrwAAAQs"]
[Mon May 04 19:36:46.868838 2026] [:error] [pid 3341:tid 3346] [client 217.182.195.181:33642] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afiEzk9o3_LordU0wW48jgAAAII"]
[Mon May 04 19:36:48.912863 2026] [:error] [pid 3341:tid 3347] [client 217.182.195.181:44992] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afiE0E9o3_LordU0wW48kwAAAIM"]
[Mon May 04 19:36:51.415249 2026] [:error] [pid 3341:tid 3361] [client 217.182.195.181:40856] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afiE009o3_LordU0wW48lwAAAJE"]
[Mon May 04 19:36:53.424502 2026] [:error] [pid 61044:tid 61114] [client 217.182.195.181:45002] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afiE1Uw8w2zZZXI6H1uRmAAAAAw"]
[Mon May 04 19:36:55.918029 2026] [:error] [pid 61150:tid 61169] [client 217.182.195.181:40860] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afiE1-8QXWVLiwIGVpd2lQAAAVA"]
[Mon May 04 19:37:17.436365 2026] [:error] [pid 61043:tid 61080] [client 217.182.195.181:37504] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afiE7Z8-LwtfURjiAbCy2gAAAEU"]
[Mon May 04 19:37:19.750854 2026] [:error] [pid 61044:tid 61118] [client 217.182.195.181:51532] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afiE70w8w2zZZXI6H1uSAgAAABA"]
[Mon May 04 19:37:22.786874 2026] [:error] [pid 61150:tid 61168] [client 217.182.195.181:42582] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afiE8u8QXWVLiwIGVpd24QAAAU8"]
[Mon May 04 19:37:26.560074 2026] [:error] [pid 3341:tid 3361] [client 217.182.195.181:42586] [client 217.182.195.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afiE9k9o3_LordU0wW49HgAAAJE"]
[Mon May 04 20:24:07.853293 2026] [:error] [pid 61150:tid 61171] [client 34.24.211.32:54362] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afiP5-8QXWVLiwIGVpd_4gAAAVI"]
[Mon May 04 20:43:39.674560 2026] [:error] [pid 3341:tid 3368] [client 95.91.110.210:35040] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afiUe09o3_LordU0wW5bAAAAAJg"]
[Mon May 04 20:43:42.415879 2026] [:error] [pid 61043:tid 61097] [client 95.91.110.210:29464] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afiUfp8-LwtfURjiAbDBlgAAAFY"]
[Mon May 04 20:43:44.910823 2026] [:error] [pid 61044:tid 61110] [client 95.91.110.210:35808] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afiUgEw8w2zZZXI6H1ubXAAAAAg"]
[Mon May 04 20:43:46.943781 2026] [:error] [pid 61043:tid 61088] [client 95.91.110.210:16704] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afiUgp8-LwtfURjiAbDBmwAAAE0"]
[Mon May 04 20:43:51.043694 2026] [:error] [pid 61150:tid 61175] [client 95.91.110.210:28910] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afiUh-8QXWVLiwIGVpeDmgAAAVY"]
[Mon May 04 20:43:54.490437 2026] [:error] [pid 3341:tid 3367] [client 95.91.110.210:16712] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afiUik9o3_LordU0wW5bGQAAAJc"]
[Mon May 04 20:43:56.977615 2026] [:error] [pid 61043:tid 61093] [client 95.91.110.210:52390] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afiUjJ8-LwtfURjiAbDBoQAAAFI"]
[Mon May 04 20:43:59.482546 2026] [:error] [pid 3341:tid 3355] [client 95.91.110.210:52406] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afiUj09o3_LordU0wW5bHwAAAIs"]
[Mon May 04 20:44:02.560484 2026] [:error] [pid 61043:tid 61085] [client 95.91.110.210:52416] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afiUkp8-LwtfURjiAbDBqQAAAEo"]
[Mon May 04 20:44:05.063925 2026] [:error] [pid 3341:tid 3357] [client 95.91.110.210:52420] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afiUlU9o3_LordU0wW5bJQAAAI0"]
[Mon May 04 20:44:08.177769 2026] [:error] [pid 61043:tid 61095] [client 95.91.110.210:32916] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afiUmJ8-LwtfURjiAbDBvAAAAFQ"]
[Mon May 04 20:44:10.167018 2026] [:error] [pid 61150:tid 61161] [client 95.91.110.210:19722] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afiUmu8QXWVLiwIGVpeDqAAAAUg"]
[Mon May 04 20:44:13.264294 2026] [:error] [pid 32471:tid 32498] [client 95.91.110.210:32918] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afiUnXmjpb9EYq6AqhJbzAAAARg"]
[Mon May 04 20:44:15.084680 2026] [:error] [pid 32471:tid 32490] [client 95.91.110.210:26734] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afiUn3mjpb9EYq6AqhJb0AAAARA"]
[Mon May 04 20:44:18.665574 2026] [:error] [pid 32471:tid 32478] [client 95.91.110.210:23224] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afiUonmjpb9EYq6AqhJb1AAAAQQ"]
[Mon May 04 20:44:21.752850 2026] [:error] [pid 61042:tid 61057] [client 95.91.110.210:26744] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afiUpUnAPPS1fjubA9RXOwAAAMs"]
[Mon May 04 20:44:24.352436 2026] [:error] [pid 3341:tid 3344] [client 95.91.110.210:23234] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afiUqE9o3_LordU0wW5baQAAAIA"]
[Mon May 04 20:44:27.201028 2026] [:error] [pid 61044:tid 61114] [client 95.91.110.210:39634] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afiUq0w8w2zZZXI6H1ubewAAAAw"]
[Mon May 04 20:44:29.741690 2026] [:error] [pid 3341:tid 3366] [client 95.91.110.210:39638] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afiUrU9o3_LordU0wW5bggAAAJY"]
[Mon May 04 20:45:05.998305 2026] [:error] [pid 32471:tid 32477] [client 95.91.110.210:53368] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afiU0Xmjpb9EYq6AqhJcBQAAAQM"]
[Mon May 04 20:45:08.654059 2026] [:error] [pid 61042:tid 61055] [client 95.91.110.210:12514] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afiU1EnAPPS1fjubA9RXawAAAMk"]
[Mon May 04 20:45:11.388984 2026] [:error] [pid 61042:tid 61068] [client 95.91.110.210:12522] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afiU10nAPPS1fjubA9RXbwAAANY"]
[Mon May 04 20:45:15.052897 2026] [:error] [pid 61044:tid 61117] [client 95.91.110.210:12526] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afiU20w8w2zZZXI6H1ubowAAAA8"]
[Mon May 04 20:45:18.129964 2026] [:error] [pid 61044:tid 61106] [client 95.91.110.210:7670] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afiU3kw8w2zZZXI6H1ubqAAAAAQ"]
[Mon May 04 20:45:20.113570 2026] [:error] [pid 61042:tid 61056] [client 95.91.110.210:7680] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afiU4EnAPPS1fjubA9RXdwAAAMo"]
[Mon May 04 20:45:22.331410 2026] [:error] [pid 32471:tid 32493] [client 95.91.110.210:7690] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afiU4nmjpb9EYq6AqhJcDAAAARM"]
[Mon May 04 20:45:25.524819 2026] [:error] [pid 3341:tid 3350] [client 95.91.110.210:7698] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afiU5U9o3_LordU0wW5brAAAAIY"]
[Mon May 04 20:45:33.679041 2026] [:error] [pid 3341:tid 3358] [client 95.91.110.210:40534] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afiU7U9o3_LordU0wW5bswAAAI4"]
[Mon May 04 20:45:36.762598 2026] [:error] [pid 32471:tid 32474] [client 95.91.110.210:8306] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afiU8Hmjpb9EYq6AqhJcHgAAAQA"]
[Mon May 04 20:45:40.369449 2026] [:error] [pid 61042:tid 61053] [client 95.91.110.210:25942] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afiU9EnAPPS1fjubA9RXhgAAAMc"]
[Mon May 04 20:45:43.321417 2026] [:error] [pid 61150:tid 61162] [client 95.91.110.210:25958] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afiU9-8QXWVLiwIGVpeD9QAAAUk"]
[Mon May 04 20:45:48.071483 2026] [:error] [pid 61044:tid 61112] [client 95.91.110.210:53696] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afiU_Ew8w2zZZXI6H1ub3QAAAAo"]
[Mon May 04 20:45:51.038703 2026] [:error] [pid 32471:tid 32475] [client 95.91.110.210:48504] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afiU_3mjpb9EYq6AqhJcPgAAAQE"]
[Mon May 04 20:45:53.721323 2026] [:error] [pid 3341:tid 3347] [client 95.91.110.210:48520] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afiVAU9o3_LordU0wW5b4AAAAIM"]
[Mon May 04 20:45:58.421143 2026] [:error] [pid 61150:tid 61172] [client 95.91.110.210:43070] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afiVBu8QXWVLiwIGVpeECwAAAVM"]
[Mon May 04 20:46:00.373186 2026] [:error] [pid 32471:tid 32484] [client 95.91.110.210:20488] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afiVCHmjpb9EYq6AqhJcSgAAAQo"]
[Mon May 04 20:46:32.487898 2026] [:error] [pid 61150:tid 61169] [client 95.91.110.210:60838] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afiVKO8QXWVLiwIGVpeETAAAAVA"]
[Mon May 04 20:46:46.643560 2026] [:error] [pid 32471:tid 32481] [client 95.91.110.210:33852] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afiVNnmjpb9EYq6AqhJcbwAAAQc"]
[Mon May 04 20:46:49.152071 2026] [:error] [pid 32471:tid 32477] [client 95.91.110.210:30884] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afiVOXmjpb9EYq6AqhJccAAAAQM"]
[Mon May 04 20:46:52.820362 2026] [:error] [pid 61044:tid 61104] [client 95.91.110.210:30890] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afiVPEw8w2zZZXI6H1ucFAAAAAI"]
[Mon May 04 20:46:56.039918 2026] [:error] [pid 61043:tid 61083] [client 95.91.110.210:2060] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afiVQJ8-LwtfURjiAbDC0AAAAEg"]
[Mon May 04 20:47:01.778214 2026] [:error] [pid 61150:tid 61154] [client 95.91.110.210:2066] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afiVRe8QXWVLiwIGVpeEaAAAAUE"]
[Mon May 04 21:58:21.604821 2026] [:error] [pid 61042:tid 61058] [client 135.181.180.59:29964] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afil_UnAPPS1fjubA9RhkgAAAMw"]
[Mon May 04 21:58:24.082899 2026] [:error] [pid 61042:tid 61062] [client 135.181.180.59:29972] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afimAEnAPPS1fjubA9RhlAAAANA"]
[Mon May 04 21:58:26.641658 2026] [:error] [pid 61042:tid 61046] [client 135.181.180.59:26764] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afimAknAPPS1fjubA9RhlgAAAMA"]
[Mon May 04 21:58:29.084093 2026] [:error] [pid 32471:tid 32498] [client 135.181.180.59:26780] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afimBXmjpb9EYq6AqhJyVgAAARg"]
[Mon May 04 21:58:45.338318 2026] [:error] [pid 61043:tid 61082] [client 135.181.180.59:8752] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afimFZ8-LwtfURjiAbDRsQAAAEc"]
[Mon May 04 21:58:47.919292 2026] [:error] [pid 61043:tid 61093] [client 135.181.180.59:8756] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afimF58-LwtfURjiAbDRtQAAAFI"]
[Mon May 04 21:58:50.509242 2026] [:error] [pid 32471:tid 32488] [client 135.181.180.59:8766] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afimGnmjpb9EYq6AqhJyagAAAQ4"]
[Mon May 04 21:58:52.998378 2026] [:error] [pid 61044:tid 61104] [client 135.181.180.59:8776] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afimHEw8w2zZZXI6H1un8AAAAAI"]
[Mon May 04 21:58:55.464870 2026] [:error] [pid 61044:tid 61105] [client 135.181.180.59:61342] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afimH0w8w2zZZXI6H1un9AAAAAM"]
[Mon May 04 21:58:57.608159 2026] [:error] [pid 61044:tid 61118] [client 135.181.180.59:29912] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afimIUw8w2zZZXI6H1un9QAAABA"]
[Mon May 04 21:59:01.460273 2026] [:error] [pid 61150:tid 61163] [client 135.181.180.59:29916] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afimJe8QXWVLiwIGVpeSMwAAAUo"]
[Mon May 04 22:26:47.008136 2026] [:error] [pid 61044:tid 61125] [client 51.77.216.81:38108] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afisp0w8w2zZZXI6H1uryQAAABc"]
[Mon May 04 22:26:48.657124 2026] [:error] [pid 32471:tid 32474] [client 51.77.216.81:40828] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afisqHmjpb9EYq6AqhJ6KgAAAQA"]
[Mon May 04 22:26:50.562439 2026] [:error] [pid 61042:tid 61070] [client 51.77.216.81:47614] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afisqknAPPS1fjubA9RksgAAANg"]
[Mon May 04 22:26:52.885627 2026] [:error] [pid 3341:tid 3345] [client 51.77.216.81:50194] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afisrE9o3_LordU0wW6AJQAAAIE"]
[Mon May 04 22:26:54.728458 2026] [:error] [pid 61043:tid 61092] [client 51.77.216.81:47626] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afisrp8-LwtfURjiAbDXqgAAAFE"]
[Mon May 04 22:26:56.695154 2026] [:error] [pid 61043:tid 61099] [client 51.77.216.81:47636] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afissJ8-LwtfURjiAbDXrwAAAFg"]
[Mon May 04 22:26:58.738458 2026] [:error] [pid 61150:tid 61159] [client 51.77.216.81:47652] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afissu8QXWVLiwIGVpeXgwAAAUY"]
[Mon May 04 22:27:00.772698 2026] [:error] [pid 61044:tid 61105] [client 51.77.216.81:46196] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afistEw8w2zZZXI6H1urzgAAAAM"]
[Mon May 04 22:27:02.667849 2026] [:error] [pid 61044:tid 61103] [client 51.77.216.81:46210] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afistkw8w2zZZXI6H1ur0gAAAAE"]
[Mon May 04 22:27:05.020103 2026] [:error] [pid 3341:tid 3362] [client 51.77.216.81:34972] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afisuU9o3_LordU0wW6AMQAAAJI"]
[Mon May 04 22:27:07.350887 2026] [:error] [pid 61044:tid 61106] [client 51.77.216.81:34984] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afisu0w8w2zZZXI6H1ur1AAAAAQ"]
[Mon May 04 22:27:09.173793 2026] [:error] [pid 3341:tid 3351] [client 51.77.216.81:59048] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afisvU9o3_LordU0wW6ANwAAAIc"]
[Mon May 04 22:27:11.525124 2026] [:error] [pid 3341:tid 3345] [client 51.77.216.81:35706] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afisv09o3_LordU0wW6AQQAAAIE"]
[Mon May 04 22:27:13.912630 2026] [:error] [pid 61150:tid 61155] [client 51.77.216.81:35716] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afiswe8QXWVLiwIGVpeXkwAAAUI"]
[Mon May 04 22:27:16.443899 2026] [:error] [pid 61150:tid 61173] [client 51.77.216.81:35728] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afisxO8QXWVLiwIGVpeXmgAAAVQ"]
[Mon May 04 22:27:18.938993 2026] [:error] [pid 3341:tid 3345] [client 51.77.216.81:35740] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afisxk9o3_LordU0wW6AUQAAAIE"]
[Mon May 04 22:27:20.905728 2026] [:error] [pid 32471:tid 32493] [client 51.77.216.81:54014] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afisyHmjpb9EYq6AqhJ6WwAAARM"]
[Mon May 04 22:27:23.391087 2026] [:error] [pid 32471:tid 32484] [client 51.77.216.81:44780] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afisy3mjpb9EYq6AqhJ6aQAAAQo"]
[Mon May 04 22:27:25.345354 2026] [:error] [pid 32471:tid 32483] [client 51.77.216.81:54024] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afiszXmjpb9EYq6AqhJ6egAAAQk"]
[Mon May 04 22:27:27.398905 2026] [:error] [pid 61044:tid 61109] [client 51.77.216.81:54040] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afisz0w8w2zZZXI6H1ur3gAAAAc"]
[Mon May 04 22:27:29.483972 2026] [:error] [pid 3341:tid 3360] [client 51.77.216.81:40814] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afis0U9o3_LordU0wW6AfAAAAJA"]
[Mon May 04 22:27:31.410508 2026] [:error] [pid 61150:tid 61176] [client 51.77.216.81:40818] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afis0-8QXWVLiwIGVpeXnwAAAVc"]
[Mon May 04 22:27:33.843807 2026] [:error] [pid 61042:tid 61060] [client 51.77.216.81:50010] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afis1UnAPPS1fjubA9RkzwAAAM4"]
[Mon May 04 22:27:35.707784 2026] [:error] [pid 61150:tid 61157] [client 51.77.216.81:40834] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afis1-8QXWVLiwIGVpeXpAAAAUQ"]
[Mon May 04 22:27:38.155656 2026] [:error] [pid 3341:tid 3346] [client 51.77.216.81:50026] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afis2k9o3_LordU0wW6AigAAAII"]
[Mon May 04 22:27:40.210653 2026] [:error] [pid 61043:tid 61090] [client 51.77.216.81:44976] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afis3J8-LwtfURjiAbDXzgAAAE8"]
[Mon May 04 22:27:42.249385 2026] [:error] [pid 3341:tid 3360] [client 51.77.216.81:44990] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afis3k9o3_LordU0wW6AmQAAAJA"]
[Mon May 04 22:27:44.349801 2026] [:error] [pid 3341:tid 3347] [client 51.77.216.81:45004] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afis4E9o3_LordU0wW6AnwAAAIM"]
[Mon May 04 22:45:51.759773 2026] [:error] [pid 61043:tid 61084] [client 209.87.169.4:20917] [client 209.87.169.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "afixH58-LwtfURjiAbDbrAAAAEk"]
[Mon May 04 23:07:04.210726 2026] [:error] [pid 3341:tid 3353] [client 95.26.40.48:56084] [client 95.26.40.48] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "switchcreative.net"] [uri "/"] [unique_id "afi2GE9o3_LordU0wW6NEAAAAIk"]
[Mon May 04 23:07:04.211596 2026] [:error] [pid 3341:tid 3353] [client 95.26.40.48:56084] [client 95.26.40.48] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||switchcreative.net|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afi2GE9o3_LordU0wW6NEAAAAIk"]
[Mon May 04 23:07:04.211685 2026] [:error] [pid 3341:tid 3353] [client 95.26.40.48:56084] [client 95.26.40.48] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afi2GE9o3_LordU0wW6NEAAAAIk"]
[Tue May 05 00:00:00.146855 2026] [:error] [pid 32471:tid 32486] [client 62.84.185.63:26700] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afjCgHmjpb9EYq6AqhKVXgAAAQw"]
[Tue May 05 00:00:02.189075 2026] [:error] [pid 3341:tid 3350] [client 62.84.185.63:41164] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afjCgk9o3_LordU0wW6iwQAAAIY"]
[Tue May 05 00:00:04.989577 2026] [:error] [pid 3341:tid 3355] [client 62.84.185.63:25758] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afjChE9o3_LordU0wW6ixgAAAIs"]
[Tue May 05 00:00:06.987024 2026] [:error] [pid 3341:tid 3345] [client 62.84.185.63:41172] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afjChk9o3_LordU0wW6i0AAAAIE"]
[Tue May 05 00:00:09.046534 2026] [:error] [pid 61043:tid 61079] [client 62.84.185.63:41186] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afjCiZ8-LwtfURjiAbDrZwAAAEQ"]
[Tue May 05 00:00:11.620665 2026] [:error] [pid 32471:tid 32481] [client 62.84.185.63:25762] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afjCi3mjpb9EYq6AqhKVagAAAQc"]
[Tue May 05 00:00:13.615024 2026] [:error] [pid 61150:tid 61174] [client 62.84.185.63:25666] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afjCje8QXWVLiwIGVpeqGgAAAVU"]
[Tue May 05 00:00:16.203771 2026] [:error] [pid 61150:tid 61164] [client 62.84.185.63:8498] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afjCkO8QXWVLiwIGVpeqHQAAAUs"]
[Tue May 05 00:00:18.295384 2026] [:error] [pid 61043:tid 61092] [client 62.84.185.63:25668] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afjCkp8-LwtfURjiAbDrawAAAFE"]
[Tue May 05 00:00:20.392083 2026] [:error] [pid 61044:tid 61115] [client 62.84.185.63:25678] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afjClEw8w2zZZXI6H1u7DAAAAA0"]
[Tue May 05 00:00:22.372302 2026] [:error] [pid 61043:tid 61089] [client 62.84.185.63:5374] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afjClp8-LwtfURjiAbDrbgAAAE4"]
[Tue May 05 00:00:24.410819 2026] [:error] [pid 32471:tid 32484] [client 62.84.185.63:5386] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afjCmHmjpb9EYq6AqhKVggAAAQo"]
[Tue May 05 00:00:26.371422 2026] [:error] [pid 3341:tid 3358] [client 62.84.185.63:5394] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afjCmk9o3_LordU0wW6i2gAAAI4"]
[Tue May 05 00:00:28.366935 2026] [:error] [pid 61044:tid 61117] [client 62.84.185.63:5402] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afjCnEw8w2zZZXI6H1u7EAAAAA8"]
[Tue May 05 00:00:30.830137 2026] [:error] [pid 32471:tid 32485] [client 62.84.185.63:36114] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afjCnnmjpb9EYq6AqhKVhwAAAQs"]
[Tue May 05 00:00:33.447717 2026] [:error] [pid 61150:tid 61170] [client 62.84.185.63:27932] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afjCoe8QXWVLiwIGVpeqJAAAAVE"]
[Tue May 05 00:00:35.135090 2026] [:error] [pid 61042:tid 61063] [client 62.84.185.63:30492] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afjCo0nAPPS1fjubA9RyeQAAANE"]
[Tue May 05 00:00:39.118434 2026] [:error] [pid 61043:tid 61081] [client 62.84.185.63:30496] [client 62.84.185.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afjCp58-LwtfURjiAbDrfAAAAEY"]
[Tue May 05 00:45:40.220456 2026] [:error] [pid 61044:tid 61121] [client 101.32.208.70:48580] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afjNNEw8w2zZZXI6H1vBnAAAABM"]
[Tue May 05 01:33:42.149912 2026] [proxy_fcgi:error] [pid 61043:tid 61088] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:42.350316 2026] [proxy_fcgi:error] [pid 61043:tid 61084] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:42.558055 2026] [proxy_fcgi:error] [pid 61043:tid 61097] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:42.762071 2026] [proxy_fcgi:error] [pid 61043:tid 61096] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:42.973962 2026] [proxy_fcgi:error] [pid 61043:tid 61086] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:43.162896 2026] [proxy_fcgi:error] [pid 61043:tid 61083] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:43.359224 2026] [proxy_fcgi:error] [pid 61043:tid 61091] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:43.574009 2026] [proxy_fcgi:error] [pid 61043:tid 61098] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:43.763018 2026] [proxy_fcgi:error] [pid 61043:tid 61078] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:44.015110 2026] [proxy_fcgi:error] [pid 61043:tid 61090] [client 20.29.119.89:17367] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:33:44.202747 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:17367] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afjYeJ8-LwtfURjiAbD_4gAAAFM"]
[Tue May 05 01:33:44.654278 2026] [:error] [pid 61044:tid 61115] [client 20.29.119.89:17281] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afjYeEw8w2zZZXI6H1vJBQAAAA0"]
[Tue May 05 01:33:45.098806 2026] [:error] [pid 61044:tid 61122] [client 20.29.119.89:17386] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afjYeUw8w2zZZXI6H1vJBgAAABQ"]
[Tue May 05 01:33:45.521331 2026] [:error] [pid 61043:tid 61081] [client 20.29.119.89:17354] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afjYeZ8-LwtfURjiAbD_5AAAAEY"]
[Tue May 05 01:33:45.932718 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17348] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "afjYeU9o3_LordU0wW7IYAAAAIA"]
[Tue May 05 01:33:46.405196 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17354] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "afjYenmjpb9EYq6AqhKyrgAAAQQ"]
[Tue May 05 01:33:46.919219 2026] [:error] [pid 61044:tid 61107] [client 20.29.119.89:17317] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "afjYekw8w2zZZXI6H1vJBwAAAAU"]
[Tue May 05 01:33:47.399247 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:17352] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "afjYe3mjpb9EYq6AqhKysQAAAQg"]
[Tue May 05 01:33:48.011248 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:17403] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jk.php"] [unique_id "afjYfEnAPPS1fjubA9SAUwAAAM8"]
[Tue May 05 01:33:48.686716 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:17282] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jk.php"] [unique_id "afjYfHmjpb9EYq6AqhKytgAAAQo"]
[Tue May 05 01:33:49.071450 2026] [:error] [pid 61042:tid 61049] [client 20.29.119.89:17404] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jk.php"] [unique_id "afjYfUnAPPS1fjubA9SAVgAAAMM"]
[Tue May 05 01:33:49.524108 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:17292] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jk.php"] [unique_id "afjYfZ8-LwtfURjiAbD_5wAAAEE"]
[Tue May 05 01:33:49.941779 2026] [:error] [pid 32471:tid 32480] [client 20.29.119.89:17349] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gcqoa.php"] [unique_id "afjYfXmjpb9EYq6AqhKyuQAAAQY"]
[Tue May 05 01:33:50.376999 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:17314] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gcqoa.php"] [unique_id "afjYfu8QXWVLiwIGVpe6kQAAAUI"]
[Tue May 05 01:33:50.779878 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:17297] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gcqoa.php"] [unique_id "afjYfp8-LwtfURjiAbD_6AAAAEQ"]
[Tue May 05 01:33:51.211739 2026] [:error] [pid 61043:tid 61099] [client 20.29.119.89:17393] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gcqoa.php"] [unique_id "afjYf58-LwtfURjiAbD_6QAAAFg"]
[Tue May 05 01:33:51.626919 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:17360] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-editor.php"] [unique_id "afjYf09o3_LordU0wW7IYgAAAII"]
[Tue May 05 01:33:52.039321 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:17359] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-editor.php"] [unique_id "afjYgE9o3_LordU0wW7IZAAAAJg"]
[Tue May 05 01:33:52.444535 2026] [:error] [pid 61043:tid 61078] [client 20.29.119.89:17309] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-editor.php"] [unique_id "afjYgJ8-LwtfURjiAbD_6wAAAEM"]
[Tue May 05 01:33:52.846729 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:17289] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-editor.php"] [unique_id "afjYgE9o3_LordU0wW7IZwAAAJM"]
[Tue May 05 01:33:53.255011 2026] [:error] [pid 61044:tid 61110] [client 20.29.119.89:17388] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-install.php"] [unique_id "afjYgUw8w2zZZXI6H1vJCAAAAAg"]
[Tue May 05 01:33:53.629708 2026] [:error] [pid 61043:tid 61077] [client 20.29.119.89:17365] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-install.php"] [unique_id "afjYgZ8-LwtfURjiAbD_7gAAAEI"]
[Tue May 05 01:33:54.061497 2026] [:error] [pid 61043:tid 61081] [client 20.29.119.89:17366] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-install.php"] [unique_id "afjYgp8-LwtfURjiAbD_7wAAAEY"]
[Tue May 05 01:33:54.443091 2026] [:error] [pid 61043:tid 61075] [client 20.29.119.89:17407] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/plugin-install.php"] [unique_id "afjYgp8-LwtfURjiAbD_8AAAAEA"]
[Tue May 05 01:33:54.826457 2026] [:error] [pid 61042:tid 61046] [client 20.29.119.89:17300] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profile.php"] [unique_id "afjYgknAPPS1fjubA9SAWwAAAMA"]
[Tue May 05 01:33:55.230270 2026] [:error] [pid 61042:tid 61054] [client 20.29.119.89:17284] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profile.php"] [unique_id "afjYg0nAPPS1fjubA9SAXgAAAMg"]
[Tue May 05 01:33:55.635320 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:17387] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profile.php"] [unique_id "afjYg58-LwtfURjiAbD_8QAAAE4"]
[Tue May 05 01:33:56.021288 2026] [:error] [pid 61043:tid 61088] [client 20.29.119.89:17319] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/profile.php"] [unique_id "afjYhJ8-LwtfURjiAbD_8gAAAE0"]
[Tue May 05 01:33:56.439140 2026] [:error] [pid 61043:tid 61096] [client 20.29.119.89:17298] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "afjYhJ8-LwtfURjiAbD_9QAAAFU"]
[Tue May 05 01:33:56.881809 2026] [:error] [pid 32471:tid 32496] [client 20.29.119.89:17401] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "afjYhHmjpb9EYq6AqhKyvAAAARY"]
[Tue May 05 01:33:57.267111 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:17320] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "afjYhZ8-LwtfURjiAbD_-QAAAEQ"]
[Tue May 05 01:33:57.683092 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17371] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "afjYhU9o3_LordU0wW7IaAAAAIw"]
[Tue May 05 01:33:58.109911 2026] [:error] [pid 61044:tid 61124] [client 20.29.119.89:17337] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "afjYhkw8w2zZZXI6H1vJDQAAABY"]
[Tue May 05 01:33:58.534549 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:17378] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "afjYhp8-LwtfURjiAbD_-wAAAEc"]
[Tue May 05 01:33:58.958884 2026] [:error] [pid 61043:tid 61081] [client 20.29.119.89:17302] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "afjYhp8-LwtfURjiAbAAAgAAAEY"]
[Tue May 05 01:33:59.440573 2026] [:error] [pid 61043:tid 61088] [client 20.29.119.89:17377] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "afjYh58-LwtfURjiAbAABAAAAE0"]
[Tue May 05 01:33:59.864801 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:17384] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-api.php"] [unique_id "afjYh09o3_LordU0wW7IagAAAIY"]
[Tue May 05 01:34:00.389067 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17294] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-api.php"] [unique_id "afjYiE9o3_LordU0wW7IawAAAIQ"]
[Tue May 05 01:34:00.961217 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:17400] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-api.php"] [unique_id "afjYiE9o3_LordU0wW7IbgAAAIk"]
[Tue May 05 01:34:01.369709 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:17235] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-api.php"] [unique_id "afjYie8QXWVLiwIGVpe6lwAAAUI"]
[Tue May 05 01:34:01.889848 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:17372] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-atom.php"] [unique_id "afjYiUnAPPS1fjubA9SAZAAAAM8"]
[Tue May 05 01:34:02.452743 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17238] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-atom.php"] [unique_id "afjYinmjpb9EYq6AqhKywgAAAQQ"]
[Tue May 05 01:34:03.070458 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17291] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-atom.php"] [unique_id "afjYi09o3_LordU0wW7IdgAAAIA"]
[Tue May 05 01:34:03.800857 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:17375] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-class-atom.php"] [unique_id "afjYi09o3_LordU0wW7IdwAAAIc"]
[Tue May 05 01:34:04.398692 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:17310] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afjYjHmjpb9EYq6AqhKyxAAAAQA"]
[Tue May 05 01:34:05.015754 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:17286] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afjYjU9o3_LordU0wW7IfQAAAJA"]
[Tue May 05 01:34:05.581650 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:17392] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afjYjU9o3_LordU0wW7IfwAAAIg"]
[Tue May 05 01:34:06.110529 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:17340] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afjYjk9o3_LordU0wW7IgQAAAJg"]
[Tue May 05 01:34:06.623009 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:17342] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signup.php"] [unique_id "afjYjk9o3_LordU0wW7IhAAAAJE"]
[Tue May 05 01:34:07.115931 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17287] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signup.php"] [unique_id "afjYj3mjpb9EYq6AqhKyxQAAAQk"]
[Tue May 05 01:34:07.607952 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17402] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signup.php"] [unique_id "afjYj09o3_LordU0wW7IhwAAAIQ"]
[Tue May 05 01:34:08.059162 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:17341] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signup.php"] [unique_id "afjYkO8QXWVLiwIGVpe6rQAAAUA"]
[Tue May 05 01:34:08.522658 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17383] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xmlsia.php"] [unique_id "afjYkE9o3_LordU0wW7IigAAAIE"]
[Tue May 05 01:34:09.001611 2026] [:error] [pid 61150:tid 61172] [client 20.29.119.89:17405] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xmlsia.php"] [unique_id "afjYke8QXWVLiwIGVpe6rgAAAVM"]
[Tue May 05 01:34:09.476789 2026] [:error] [pid 61150:tid 61154] [client 20.29.119.89:17239] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xmlsia.php"] [unique_id "afjYke8QXWVLiwIGVpe6rwAAAUE"]
[Tue May 05 01:34:09.930987 2026] [:error] [pid 61042:tid 61054] [client 20.29.119.89:17322] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xmlsia.php"] [unique_id "afjYkUnAPPS1fjubA9SAcwAAAMg"]
[Tue May 05 01:34:10.380602 2026] [:error] [pid 61044:tid 61122] [client 20.29.119.89:17293] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-inic3.php"] [unique_id "afjYkkw8w2zZZXI6H1vJDwAAABQ"]
[Tue May 05 01:34:10.818696 2026] [:error] [pid 61044:tid 61123] [client 20.29.119.89:17398] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-inic3.php"] [unique_id "afjYkkw8w2zZZXI6H1vJEQAAABU"]
[Tue May 05 01:34:11.254409 2026] [:error] [pid 61044:tid 61110] [client 20.29.119.89:17381] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-inic3.php"] [unique_id "afjYk0w8w2zZZXI6H1vJFAAAAAg"]
[Tue May 05 01:34:11.696517 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17311] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-inic3.php"] [unique_id "afjYk09o3_LordU0wW7IjQAAAIQ"]
[Tue May 05 01:34:12.152584 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17347] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "afjYlE9o3_LordU0wW7IjgAAAIE"]
[Tue May 05 01:34:12.599576 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:17295] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "afjYlHmjpb9EYq6AqhKyyAAAAQo"]
[Tue May 05 01:34:13.088230 2026] [:error] [pid 61043:tid 61090] [client 20.29.119.89:17382] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "afjYlZ8-LwtfURjiAbAABQAAAE8"]
[Tue May 05 01:34:13.567209 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:17331] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "afjYlZ8-LwtfURjiAbAABgAAAE4"]
[Tue May 05 01:34:14.039624 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17299] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afjYlnmjpb9EYq6AqhKyygAAAQQ"]
[Tue May 05 01:34:14.492911 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:17390] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afjYlnmjpb9EYq6AqhKyzAAAAQ0"]
[Tue May 05 01:34:14.967651 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:17267] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afjYlk9o3_LordU0wW7IkAAAAJM"]
[Tue May 05 01:34:15.395122 2026] [:error] [pid 61042:tid 61069] [client 20.29.119.89:17362] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afjYl0nAPPS1fjubA9SAdwAAANc"]
[Tue May 05 01:34:15.850501 2026] [:error] [pid 61150:tid 61167] [client 20.29.119.89:17358] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "afjYl-8QXWVLiwIGVpe6tgAAAU4"]
[Tue May 05 01:34:16.322183 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:17232] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "afjYmE9o3_LordU0wW7IkgAAAIU"]
[Tue May 05 01:34:16.865451 2026] [:error] [pid 61042:tid 61068] [client 20.29.119.89:17154] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "afjYmEnAPPS1fjubA9SAeQAAANY"]
[Tue May 05 01:34:17.300075 2026] [:error] [pid 61042:tid 61051] [client 20.29.119.89:17368] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "afjYmUnAPPS1fjubA9SAegAAAMU"]
[Tue May 05 01:34:17.756483 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:17385] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afjYmZ8-LwtfURjiAbAACQAAAFE"]
[Tue May 05 01:34:18.192364 2026] [:error] [pid 61150:tid 61157] [client 20.29.119.89:17288] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afjYmu8QXWVLiwIGVpe6twAAAUQ"]
[Tue May 05 01:34:18.660211 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:17391] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afjYmnmjpb9EYq6AqhKy0wAAARU"]
[Tue May 05 01:34:19.172913 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:17361] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afjYm0nAPPS1fjubA9SAfAAAAMs"]
[Tue May 05 01:34:19.614430 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:17307] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjYm09o3_LordU0wW7IlQAAAJI"]
[Tue May 05 01:34:20.082999 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:17395] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjYnE9o3_LordU0wW7IlgAAAIM"]
[Tue May 05 01:34:20.581576 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:17351] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjYnJ8-LwtfURjiAbAACgAAAFQ"]
[Tue May 05 01:34:20.986728 2026] [:error] [pid 61042:tid 61065] [client 20.29.119.89:17294] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjYnEnAPPS1fjubA9SAfQAAANM"]
[Tue May 05 01:34:21.419651 2026] [:error] [pid 61043:tid 61086] [client 20.29.119.89:17222] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afjYnZ8-LwtfURjiAbAACwAAAEs"]
[Tue May 05 01:34:21.852104 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:17363] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afjYnXmjpb9EYq6AqhKy1gAAARE"]
[Tue May 05 01:34:22.329976 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:17218] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afjYnnmjpb9EYq6AqhKy1wAAARQ"]
[Tue May 05 01:34:22.782705 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:17370] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afjYnnmjpb9EYq6AqhKy2AAAAQA"]
[Tue May 05 01:34:23.210377 2026] [:error] [pid 61042:tid 61064] [client 20.29.119.89:17326] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afjYn0nAPPS1fjubA9SAfgAAANI"]
[Tue May 05 01:34:23.605318 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:17313] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afjYn58-LwtfURjiAbAAEQAAAEo"]
[Tue May 05 01:34:24.028537 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:17254] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afjYoE9o3_LordU0wW7ImwAAAJc"]
[Tue May 05 01:34:24.480977 2026] [:error] [pid 61150:tid 61160] [client 20.29.119.89:17280] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afjYoO8QXWVLiwIGVpe6ugAAAUc"]
[Tue May 05 01:34:24.920313 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:17312] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afjYoE9o3_LordU0wW7InQAAAIU"]
[Tue May 05 01:34:25.327327 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17394] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afjYoU9o3_LordU0wW7InwAAAIA"]
[Tue May 05 01:34:25.744396 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17233] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afjYoU9o3_LordU0wW7IoAAAAIE"]
[Tue May 05 01:34:26.254055 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:17356] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afjYonmjpb9EYq6AqhKy2gAAARE"]
[Tue May 05 01:34:27.520367 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:17344] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afjYo09o3_LordU0wW7IpAAAAIs"]
[Tue May 05 01:34:27.962882 2026] [:error] [pid 61150:tid 61156] [client 20.29.119.89:17296] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afjYo-8QXWVLiwIGVpe6vgAAAUM"]
[Tue May 05 01:34:28.404121 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:17259] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afjYpE9o3_LordU0wW7IpgAAAJA"]
[Tue May 05 01:34:28.801366 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:17323] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afjYpE9o3_LordU0wW7IpwAAAIU"]
[Tue May 05 01:34:29.319317 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:17256] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-slss.php"] [unique_id "afjYpXmjpb9EYq6AqhKy2wAAARA"]
[Tue May 05 01:34:29.748546 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:17303] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-slss.php"] [unique_id "afjYpZ8-LwtfURjiAbAAFwAAAEo"]
[Tue May 05 01:34:30.245910 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17220] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-slss.php"] [unique_id "afjYpk9o3_LordU0wW7IqQAAAIA"]
[Tue May 05 01:34:31.335271 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:17228] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-slss.php"] [unique_id "afjYp3mjpb9EYq6AqhKy3wAAAQI"]
[Tue May 05 01:34:32.599501 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17321] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afjYqE9o3_LordU0wW7IrgAAAJQ"]
[Tue May 05 01:34:33.408272 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:17369] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afjYqZ8-LwtfURjiAbAAHAAAAEE"]
[Tue May 05 01:34:34.536166 2026] [:error] [pid 61044:tid 61104] [client 20.29.119.89:17357] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afjYqkw8w2zZZXI6H1vJJQAAAAI"]
[Tue May 05 01:34:34.976468 2026] [:error] [pid 61043:tid 61091] [client 20.29.119.89:17329] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afjYqp8-LwtfURjiAbAAHQAAAFA"]
[Tue May 05 01:34:35.394152 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17285] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "afjYq09o3_LordU0wW7ItAAAAIQ"]
[Tue May 05 01:34:35.944323 2026] [:error] [pid 61044:tid 61102] [client 20.29.119.89:17396] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "afjYq0w8w2zZZXI6H1vJJgAAAAA"]
[Tue May 05 01:34:36.359505 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17158] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "afjYrE9o3_LordU0wW7IuQAAAJQ"]
[Tue May 05 01:34:37.312598 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:17353] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "afjYrU9o3_LordU0wW7IvAAAAIs"]
[Tue May 05 01:34:39.303921 2026] [:error] [pid 61044:tid 61113] [client 20.29.119.89:17255] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afjYr0w8w2zZZXI6H1vJJwAAAAs"]
[Tue May 05 01:34:41.979911 2026] [:error] [pid 61042:tid 61070] [client 20.29.119.89:17224] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afjYsUnAPPS1fjubA9SAggAAANg"]
[Tue May 05 01:34:42.564254 2026] [:error] [pid 61150:tid 61164] [client 20.29.119.89:17229] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afjYsu8QXWVLiwIGVpe6yAAAAUs"]
[Tue May 05 01:34:43.282159 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17251] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afjYs09o3_LordU0wW7IwwAAAIQ"]
[Tue May 05 01:34:43.921598 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17241] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "afjYs09o3_LordU0wW7IxAAAAIw"]
[Tue May 05 01:34:44.926080 2026] [proxy_fcgi:error] [pid 3341:tid 3365] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:45.318331 2026] [proxy_fcgi:error] [pid 3341:tid 3355] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:45.509483 2026] [proxy_fcgi:error] [pid 3341:tid 3366] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:45.701508 2026] [proxy_fcgi:error] [pid 3341:tid 3358] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:45.892051 2026] [proxy_fcgi:error] [pid 3341:tid 3367] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:46.098620 2026] [proxy_fcgi:error] [pid 3341:tid 3360] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:46.289780 2026] [proxy_fcgi:error] [pid 3341:tid 3349] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:46.480657 2026] [proxy_fcgi:error] [pid 3341:tid 3350] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:46.673075 2026] [proxy_fcgi:error] [pid 3341:tid 3347] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:46.878889 2026] [proxy_fcgi:error] [pid 3341:tid 3357] [client 20.29.119.89:17223] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:34:47.103507 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:17223] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-bonbon.php"] [unique_id "afjYt09o3_LordU0wW7I0gAAAJE"]
[Tue May 05 01:34:48.314590 2026] [:error] [pid 32471:tid 32481] [client 20.29.119.89:17246] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-bonbon.php"] [unique_id "afjYuHmjpb9EYq6AqhKy6wAAAQc"]
[Tue May 05 01:34:49.077312 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17343] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-bonbon.php"] [unique_id "afjYuU9o3_LordU0wW7I1QAAAJQ"]
[Tue May 05 01:34:49.833017 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:17316] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-bonbon.php"] [unique_id "afjYuU9o3_LordU0wW7I1wAAAJM"]
[Tue May 05 01:34:50.478685 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17332] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/at.php"] [unique_id "afjYuk9o3_LordU0wW7I2QAAAI4"]
[Tue May 05 01:34:50.905545 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17216] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/at.php"] [unique_id "afjYuk9o3_LordU0wW7I3AAAAI8"]
[Tue May 05 01:34:51.357316 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17389] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/at.php"] [unique_id "afjYu3mjpb9EYq6AqhKy7QAAAQ4"]
[Tue May 05 01:34:51.751090 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17355] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/at.php"] [unique_id "afjYu3mjpb9EYq6AqhKy8AAAAQQ"]
[Tue May 05 01:34:52.521067 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:17227] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "afjYvJ8-LwtfURjiAbAAIQAAAE4"]
[Tue May 05 01:34:52.987965 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:17234] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "afjYvHmjpb9EYq6AqhKy9gAAARI"]
[Tue May 05 01:34:53.466244 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17283] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "afjYvXmjpb9EYq6AqhKy9wAAAQk"]
[Tue May 05 01:34:54.006435 2026] [:error] [pid 61150:tid 61166] [client 20.29.119.89:17339] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rithin.php"] [unique_id "afjYvu8QXWVLiwIGVpe61AAAAU0"]
[Tue May 05 01:34:54.489981 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:17306] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "afjYvu8QXWVLiwIGVpe61wAAAUw"]
[Tue May 05 01:34:54.896010 2026] [:error] [pid 61043:tid 61087] [client 20.29.119.89:17406] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "afjYvp8-LwtfURjiAbAAIgAAAEw"]
[Tue May 05 01:34:55.360346 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17247] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "afjYv09o3_LordU0wW7I3gAAAIw"]
[Tue May 05 01:34:56.165295 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:17262] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "afjYwE9o3_LordU0wW7I4AAAAJM"]
[Tue May 05 01:34:56.669744 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:17271] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afjYwE9o3_LordU0wW7I4QAAAJU"]
[Tue May 05 01:34:57.638336 2026] [:error] [pid 61044:tid 61121] [client 20.29.119.89:17333] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afjYwUw8w2zZZXI6H1vJNAAAABM"]
[Tue May 05 01:34:58.179122 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:17374] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afjYwp8-LwtfURjiAbAAJAAAAFE"]
[Tue May 05 01:34:58.839761 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:17155] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afjYwk9o3_LordU0wW7I5gAAAI0"]
[Tue May 05 01:34:59.438797 2026] [:error] [pid 61044:tid 61105] [client 20.29.119.89:17257] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afjYw0w8w2zZZXI6H1vJNQAAAAM"]
[Tue May 05 01:34:59.944753 2026] [:error] [pid 61150:tid 61177] [client 20.29.119.89:17330] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afjYw-8QXWVLiwIGVpe62QAAAVg"]
[Tue May 05 01:35:00.423396 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17327] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afjYxE9o3_LordU0wW7I6AAAAIQ"]
[Tue May 05 01:35:01.008159 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17308] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afjYxU9o3_LordU0wW7I6QAAAIw"]
[Tue May 05 01:35:01.507964 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17240] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolv2.php"] [unique_id "afjYxXmjpb9EYq6AqhKy-wAAAQk"]
[Tue May 05 01:35:01.983183 2026] [:error] [pid 32471:tid 32493] [client 20.29.119.89:17324] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolv2.php"] [unique_id "afjYxXmjpb9EYq6AqhKy_QAAARM"]
[Tue May 05 01:35:02.488594 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17287] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolv2.php"] [unique_id "afjYxk9o3_LordU0wW7I6wAAAI4"]
[Tue May 05 01:35:02.933266 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:17335] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wolv2.php"] [unique_id "afjYxk9o3_LordU0wW7I7QAAAJY"]
[Tue May 05 01:35:03.383863 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:17264] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "afjYx-8QXWVLiwIGVpe63QAAAUA"]
[Tue May 05 01:35:03.831927 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:17226] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "afjYx09o3_LordU0wW7I7gAAAJI"]
[Tue May 05 01:35:04.287596 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17318] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "afjYyE9o3_LordU0wW7I8AAAAIQ"]
[Tue May 05 01:35:04.717697 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:17252] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/iov.php"] [unique_id "afjYyEnAPPS1fjubA9SAjAAAAM8"]
[Tue May 05 01:35:05.404611 2026] [:error] [pid 61042:tid 61052] [client 20.29.119.89:17186] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "afjYyUnAPPS1fjubA9SAjQAAAMY"]
[Tue May 05 01:35:05.830664 2026] [:error] [pid 61150:tid 61166] [client 20.29.119.89:17253] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "afjYye8QXWVLiwIGVpe64AAAAU0"]
[Tue May 05 01:35:06.354274 2026] [:error] [pid 32471:tid 32479] [client 20.29.119.89:17180] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "afjYynmjpb9EYq6AqhKzAQAAAQU"]
[Tue May 05 01:35:06.864289 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17328] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Sanskrit.php"] [unique_id "afjYynmjpb9EYq6AqhKzBAAAAQ4"]
[Tue May 05 01:35:07.383836 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:17183] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ffile.php"] [unique_id "afjYy3mjpb9EYq6AqhKzBgAAAQ0"]
[Tue May 05 01:35:07.799585 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:17301] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ffile.php"] [unique_id "afjYy58-LwtfURjiAbAAKQAAAEo"]
[Tue May 05 01:35:08.297462 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:17237] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ffile.php"] [unique_id "afjYzHmjpb9EYq6AqhKzCQAAARI"]
[Tue May 05 01:35:08.733742 2026] [:error] [pid 61044:tid 61112] [client 20.29.119.89:17249] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ffile.php"] [unique_id "afjYzEw8w2zZZXI6H1vJPgAAAAo"]
[Tue May 05 01:35:09.234465 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17269] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "afjYzU9o3_LordU0wW7I9wAAAI4"]
[Tue May 05 01:35:09.640096 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:17304] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "afjYzU9o3_LordU0wW7I-AAAAIU"]
[Tue May 05 01:35:10.108157 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:17305] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "afjYzk9o3_LordU0wW7I_AAAAJE"]
[Tue May 05 01:35:10.734273 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:17156] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/layout.php"] [unique_id "afjYzk9o3_LordU0wW7I_wAAAJg"]
[Tue May 05 01:35:11.221167 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17397] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afjYz09o3_LordU0wW7JAAAAAIo"]
[Tue May 05 01:35:11.788062 2026] [:error] [pid 61150:tid 61167] [client 20.29.119.89:17315] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afjYz-8QXWVLiwIGVpe66AAAAU4"]
[Tue May 05 01:35:12.663470 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:17266] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afjY0Hmjpb9EYq6AqhKzDgAAAQM"]
[Tue May 05 01:35:13.130888 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17217] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afjY0U9o3_LordU0wW7JAwAAAIQ"]
[Tue May 05 01:35:13.553831 2026] [:error] [pid 3341:tid 3352] [client 20.29.119.89:17107] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afjY0U9o3_LordU0wW7JBQAAAIg"]
[Tue May 05 01:35:13.959627 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17334] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afjY0U9o3_LordU0wW7JBgAAAIE"]
[Tue May 05 01:35:14.370838 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:17290] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afjY0k9o3_LordU0wW7JCQAAAIk"]
[Tue May 05 01:35:14.790946 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17258] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afjY0k9o3_LordU0wW7JCgAAAIw"]
[Tue May 05 01:35:15.186641 2026] [:error] [pid 61150:tid 61157] [client 20.29.119.89:17265] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "afjY0-8QXWVLiwIGVpe67gAAAUQ"]
[Tue May 05 01:35:15.604086 2026] [:error] [pid 61150:tid 61173] [client 20.29.119.89:17184] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "afjY0-8QXWVLiwIGVpe67wAAAVQ"]
[Tue May 05 01:35:15.988367 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17153] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "afjY009o3_LordU0wW7JDQAAAJQ"]
[Tue May 05 01:35:16.401231 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17165] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xozx.php"] [unique_id "afjY1E9o3_LordU0wW7JEAAAAI8"]
[Tue May 05 01:35:16.862223 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17250] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "afjY1E9o3_LordU0wW7JEgAAAIQ"]
[Tue May 05 01:35:17.287336 2026] [:error] [pid 3341:tid 3365] [client 20.29.119.89:17170] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "afjY1U9o3_LordU0wW7JFQAAAJU"]
[Tue May 05 01:35:17.682779 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17111] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "afjY1U9o3_LordU0wW7JFgAAAIA"]
[Tue May 05 01:35:18.091809 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:17270] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/less.php"] [unique_id "afjY1nmjpb9EYq6AqhKzDwAAAQA"]
[Tue May 05 01:35:18.501970 2026] [:error] [pid 3341:tid 3368] [client 20.29.119.89:17236] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "afjY1k9o3_LordU0wW7JGwAAAJg"]
[Tue May 05 01:35:18.941288 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17275] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "afjY1k9o3_LordU0wW7JHQAAAI8"]
[Tue May 05 01:35:19.427701 2026] [:error] [pid 61044:tid 61118] [client 20.29.119.89:17225] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "afjY10w8w2zZZXI6H1vJQAAAABA"]
[Tue May 05 01:35:19.824563 2026] [:error] [pid 61044:tid 61102] [client 20.29.119.89:17350] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "afjY10w8w2zZZXI6H1vJQQAAAAA"]
[Tue May 05 01:35:20.281383 2026] [:error] [pid 61044:tid 61126] [client 20.29.119.89:17095] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afjY2Ew8w2zZZXI6H1vJQwAAABg"]
[Tue May 05 01:35:20.663805 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17185] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afjY2Hmjpb9EYq6AqhKzEwAAAQ4"]
[Tue May 05 01:35:21.078229 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17174] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afjY2Xmjpb9EYq6AqhKzFQAAAQQ"]
[Tue May 05 01:35:21.488903 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:17203] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afjY2Xmjpb9EYq6AqhKzFgAAAQI"]
[Tue May 05 01:35:21.936820 2026] [:error] [pid 32471:tid 32475] [client 20.29.119.89:17188] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afjY2Xmjpb9EYq6AqhKzGgAAAQE"]
[Tue May 05 01:35:22.349454 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:17221] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afjY2nmjpb9EYq6AqhKzGwAAAQg"]
[Tue May 05 01:35:22.754126 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:17219] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afjY2nmjpb9EYq6AqhKzHQAAAQo"]
[Tue May 05 01:35:23.220900 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:17194] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afjY23mjpb9EYq6AqhKzIQAAAQs"]
[Tue May 05 01:35:23.640279 2026] [:error] [pid 32471:tid 32474] [client 20.29.119.89:17379] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "afjY23mjpb9EYq6AqhKzIgAAAQA"]
[Tue May 05 01:35:24.042079 2026] [:error] [pid 61150:tid 61170] [client 20.29.119.89:17244] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "afjY3O8QXWVLiwIGVpe68gAAAVE"]
[Tue May 05 01:35:24.441327 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:17209] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "afjY3J8-LwtfURjiAbAALAAAAFE"]
[Tue May 05 01:35:24.867801 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:17373] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wander.php"] [unique_id "afjY3J8-LwtfURjiAbAALQAAAFQ"]
[Tue May 05 01:35:25.280351 2026] [:error] [pid 61042:tid 61058] [client 20.29.119.89:17097] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "afjY3UnAPPS1fjubA9SAkAAAAMw"]
[Tue May 05 01:35:25.668615 2026] [:error] [pid 61043:tid 61076] [client 20.29.119.89:17244] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "afjY3Z8-LwtfURjiAbAAMQAAAEE"]
[Tue May 05 01:35:26.052847 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:17263] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "afjY3k9o3_LordU0wW7JHwAAAIY"]
[Tue May 05 01:35:26.454281 2026] [:error] [pid 61042:tid 61065] [client 20.29.119.89:17210] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-db.php"] [unique_id "afjY3knAPPS1fjubA9SAkQAAANM"]
[Tue May 05 01:35:26.873314 2026] [:error] [pid 61150:tid 61163] [client 20.29.119.89:17338] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "afjY3u8QXWVLiwIGVpe69QAAAUo"]
[Tue May 05 01:35:27.296340 2026] [:error] [pid 61150:tid 61175] [client 20.29.119.89:17101] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "afjY3-8QXWVLiwIGVpe69gAAAVY"]
[Tue May 05 01:35:27.777792 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17268] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "afjY309o3_LordU0wW7JIQAAAIA"]
[Tue May 05 01:35:28.430477 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:17242] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/domains.php"] [unique_id "afjY4J8-LwtfURjiAbAAMgAAAFM"]
[Tue May 05 01:35:29.992589 2026] [:error] [pid 61043:tid 61093] [client 20.29.119.89:17279] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afjY4Z8-LwtfURjiAbAAMwAAAFI"]
[Tue May 05 01:35:31.037877 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:17230] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afjY43mjpb9EYq6AqhKzKgAAAQw"]
[Tue May 05 01:35:31.796684 2026] [:error] [pid 61043:tid 61084] [client 20.29.119.89:17260] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afjY458-LwtfURjiAbAANAAAAEk"]
[Tue May 05 01:35:32.265776 2026] [:error] [pid 61150:tid 61166] [client 20.29.119.89:17172] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afjY5O8QXWVLiwIGVpe6-wAAAU0"]
[Tue May 05 01:35:32.706978 2026] [:error] [pid 61044:tid 61119] [client 20.29.119.89:17200] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ouh.php"] [unique_id "afjY5Ew8w2zZZXI6H1vJRwAAABE"]
[Tue May 05 01:35:33.128860 2026] [:error] [pid 61042:tid 61047] [client 20.29.119.89:17191] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ouh.php"] [unique_id "afjY5UnAPPS1fjubA9SAkgAAAME"]
[Tue May 05 01:35:33.547939 2026] [:error] [pid 61150:tid 61160] [client 20.29.119.89:17121] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ouh.php"] [unique_id "afjY5e8QXWVLiwIGVpe6_AAAAUc"]
[Tue May 05 01:35:34.054772 2026] [:error] [pid 61150:tid 61154] [client 20.29.119.89:17380] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ouh.php"] [unique_id "afjY5u8QXWVLiwIGVpe6_QAAAUE"]
[Tue May 05 01:35:34.548102 2026] [:error] [pid 61150:tid 61168] [client 20.29.119.89:17108] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afjY5u8QXWVLiwIGVpe6_wAAAU8"]
[Tue May 05 01:35:35.011034 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:17213] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afjY509o3_LordU0wW7JIwAAAIc"]
[Tue May 05 01:35:35.467669 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:17212] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afjY509o3_LordU0wW7JJAAAAJI"]
[Tue May 05 01:35:35.961404 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:17345] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afjY53mjpb9EYq6AqhKzMAAAARQ"]
[Tue May 05 01:35:36.411990 2026] [:error] [pid 61043:tid 61087] [client 20.29.119.89:17161] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "afjY6J8-LwtfURjiAbAAOgAAAEw"]
[Tue May 05 01:35:36.836195 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:17278] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "afjY6Hmjpb9EYq6AqhKzMQAAARg"]
[Tue May 05 01:35:37.330411 2026] [:error] [pid 61150:tid 61159] [client 20.29.119.89:17175] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "afjY6e8QXWVLiwIGVpe7AQAAAUY"]
[Tue May 05 01:35:37.780492 2026] [:error] [pid 61150:tid 61169] [client 20.29.119.89:17177] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sko.php"] [unique_id "afjY6e8QXWVLiwIGVpe7AgAAAVA"]
[Tue May 05 01:35:38.273077 2026] [:error] [pid 61044:tid 61107] [client 20.29.119.89:17231] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afjY6kw8w2zZZXI6H1vJSQAAAAU"]
[Tue May 05 01:35:38.875121 2026] [:error] [pid 61044:tid 61121] [client 20.29.119.89:17336] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afjY6kw8w2zZZXI6H1vJSwAAABM"]
[Tue May 05 01:35:39.682398 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17141] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afjY63mjpb9EYq6AqhKzNAAAAQ4"]
[Tue May 05 01:35:40.229596 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17166] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afjY7Hmjpb9EYq6AqhKzNQAAAQk"]
[Tue May 05 01:35:40.751107 2026] [:error] [pid 61150:tid 61173] [client 20.29.119.89:17173] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cliner.php"] [unique_id "afjY7O8QXWVLiwIGVpe7AwAAAVQ"]
[Tue May 05 01:35:41.241923 2026] [:error] [pid 61150:tid 61166] [client 20.29.119.89:17189] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cliner.php"] [unique_id "afjY7e8QXWVLiwIGVpe7BAAAAU0"]
[Tue May 05 01:35:41.754428 2026] [:error] [pid 61150:tid 61172] [client 20.29.119.89:17192] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cliner.php"] [unique_id "afjY7e8QXWVLiwIGVpe7BgAAAVM"]
[Tue May 05 01:35:42.394435 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:17160] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cliner.php"] [unique_id "afjY7k9o3_LordU0wW7JKAAAAJY"]
[Tue May 05 01:35:42.989816 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:17089] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-sx10.php"] [unique_id "afjY7u8QXWVLiwIGVpe7BwAAAUw"]
[Tue May 05 01:35:43.503892 2026] [:error] [pid 61043:tid 61086] [client 20.29.119.89:17176] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-sx10.php"] [unique_id "afjY758-LwtfURjiAbAAPgAAAEs"]
[Tue May 05 01:35:43.978138 2026] [:error] [pid 61150:tid 61158] [client 20.29.119.89:17193] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-sx10.php"] [unique_id "afjY7-8QXWVLiwIGVpe7CAAAAUU"]
[Tue May 05 01:35:44.411666 2026] [:error] [pid 61150:tid 61160] [client 20.29.119.89:17098] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-sx10.php"] [unique_id "afjY8O8QXWVLiwIGVpe7CQAAAUc"]
[Tue May 05 01:35:44.950823 2026] [:error] [pid 61150:tid 61174] [client 20.29.119.89:17094] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "afjY8O8QXWVLiwIGVpe7DAAAAVU"]
[Tue May 05 01:35:45.354279 2026] [:error] [pid 61150:tid 61177] [client 20.29.119.89:17346] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "afjY8e8QXWVLiwIGVpe7DQAAAVg"]
[Tue May 05 01:35:45.750214 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:17245] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packed.php"] [unique_id "afjY8Xmjpb9EYq6AqhKzPAAAARA"]
[Tue May 05 01:35:46.280751 2026] [proxy_fcgi:error] [pid 61043:tid 61092] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:46.471592 2026] [proxy_fcgi:error] [pid 61043:tid 61096] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:46.663659 2026] [proxy_fcgi:error] [pid 61043:tid 61076] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:48.241910 2026] [proxy_fcgi:error] [pid 61043:tid 61076] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:48.433396 2026] [proxy_fcgi:error] [pid 61043:tid 61080] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:48.629435 2026] [proxy_fcgi:error] [pid 61043:tid 61082] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:48.825959 2026] [proxy_fcgi:error] [pid 61043:tid 61085] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:49.017220 2026] [proxy_fcgi:error] [pid 61043:tid 61075] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:49.211934 2026] [proxy_fcgi:error] [pid 61043:tid 61077] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:49.408372 2026] [proxy_fcgi:error] [pid 61043:tid 61086] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:49.611646 2026] [proxy_fcgi:error] [pid 61043:tid 61081] [client 20.29.119.89:17140] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:35:49.799508 2026] [:error] [pid 61043:tid 61099] [client 20.29.119.89:17140] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "afjY9Z8-LwtfURjiAbAAUQAAAFg"]
[Tue May 05 01:35:50.224362 2026] [:error] [pid 61043:tid 61092] [client 20.29.119.89:17130] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "afjY9p8-LwtfURjiAbAAUgAAAFE"]
[Tue May 05 01:35:50.638917 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:17157] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "afjY9nmjpb9EYq6AqhKzQAAAARg"]
[Tue May 05 01:35:51.021532 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:17105] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/opts.php"] [unique_id "afjY93mjpb9EYq6AqhKzQQAAAQw"]
[Tue May 05 01:35:51.416293 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:17091] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afjY909o3_LordU0wW7JLgAAAIc"]
[Tue May 05 01:35:51.810693 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17211] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afjY909o3_LordU0wW7JLwAAAIo"]
[Tue May 05 01:35:52.221557 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17117] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afjY-E9o3_LordU0wW7JMQAAAIw"]
[Tue May 05 01:35:52.634606 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17204] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afjY-E9o3_LordU0wW7JMwAAAI8"]
[Tue May 05 01:35:53.065510 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:17093] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hook.php"] [unique_id "afjY-U9o3_LordU0wW7JNAAAAIk"]
[Tue May 05 01:35:53.457025 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17040] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hook.php"] [unique_id "afjY-U9o3_LordU0wW7JNQAAAI4"]
[Tue May 05 01:35:53.836801 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:17144] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hook.php"] [unique_id "afjY-UnAPPS1fjubA9SAmAAAAM8"]
[Tue May 05 01:35:54.249141 2026] [:error] [pid 61042:tid 61046] [client 20.29.119.89:17364] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hook.php"] [unique_id "afjY-knAPPS1fjubA9SAmgAAAMA"]
[Tue May 05 01:35:54.643439 2026] [:error] [pid 61044:tid 61123] [client 20.29.119.89:17190] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/racs3.php"] [unique_id "afjY-kw8w2zZZXI6H1vJTwAAABU"]
[Tue May 05 01:35:55.042768 2026] [:error] [pid 61044:tid 61110] [client 20.29.119.89:17214] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/racs3.php"] [unique_id "afjY-0w8w2zZZXI6H1vJUAAAAAg"]
[Tue May 05 01:35:55.429601 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:17167] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/racs3.php"] [unique_id "afjY-09o3_LordU0wW7JNwAAAJE"]
[Tue May 05 01:35:55.849879 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17348] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/racs3.php"] [unique_id "afjY-09o3_LordU0wW7JOQAAAIA"]
[Tue May 05 01:35:56.279509 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:17099] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zzkhe.php"] [unique_id "afjY_E9o3_LordU0wW7JOwAAAIM"]
[Tue May 05 01:35:56.668376 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17197] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zzkhe.php"] [unique_id "afjY_Hmjpb9EYq6AqhKzRQAAAQk"]
[Tue May 05 01:35:57.054756 2026] [:error] [pid 3341:tid 3356] [client 20.29.119.89:17261] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zzkhe.php"] [unique_id "afjY_U9o3_LordU0wW7JQAAAAIw"]
[Tue May 05 01:35:57.444228 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:17145] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zzkhe.php"] [unique_id "afjY_Xmjpb9EYq6AqhKzRgAAAQo"]
[Tue May 05 01:35:57.834199 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:17067] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjY_Xmjpb9EYq6AqhKzSAAAARc"]
[Tue May 05 01:35:58.219028 2026] [:error] [pid 32471:tid 32496] [client 20.29.119.89:17114] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjY_nmjpb9EYq6AqhKzSgAAARY"]
[Tue May 05 01:35:58.618874 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:17202] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjY_nmjpb9EYq6AqhKzTAAAARQ"]
[Tue May 05 01:35:59.019382 2026] [:error] [pid 32471:tid 32476] [client 20.29.119.89:17277] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afjY_3mjpb9EYq6AqhKzTgAAAQI"]
[Tue May 05 01:35:59.418855 2026] [:error] [pid 61150:tid 61155] [client 20.29.119.89:17142] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "afjY_-8QXWVLiwIGVpe7GAAAAUI"]
[Tue May 05 01:35:59.809479 2026] [:error] [pid 61043:tid 61091] [client 20.29.119.89:17195] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "afjY_58-LwtfURjiAbAAVgAAAFA"]
[Tue May 05 01:36:00.232222 2026] [:error] [pid 32471:tid 32498] [client 20.29.119.89:17208] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "afjZAHmjpb9EYq6AqhKzUAAAARg"]
[Tue May 05 01:36:00.640018 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17049] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mga.php"] [unique_id "afjZAHmjpb9EYq6AqhKzUQAAAQQ"]
[Tue May 05 01:36:01.037745 2026] [:error] [pid 32471:tid 32475] [client 20.29.119.89:17201] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xml.php"] [unique_id "afjZAXmjpb9EYq6AqhKzUgAAAQE"]
[Tue May 05 01:36:01.452048 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:17129] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xml.php"] [unique_id "afjZAZ8-LwtfURjiAbAAWAAAAFQ"]
[Tue May 05 01:36:01.868179 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:17162] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xml.php"] [unique_id "afjZAXmjpb9EYq6AqhKzUwAAAQg"]
[Tue May 05 01:36:02.292534 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:17123] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xml.php"] [unique_id "afjZAk9o3_LordU0wW7JQQAAAJY"]
[Tue May 05 01:36:02.708672 2026] [:error] [pid 61042:tid 61057] [client 20.29.119.89:17102] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xinder.php"] [unique_id "afjZAknAPPS1fjubA9SAnwAAAMs"]
[Tue May 05 01:36:03.109196 2026] [:error] [pid 61150:tid 61166] [client 20.29.119.89:17181] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xinder.php"] [unique_id "afjZA-8QXWVLiwIGVpe7GQAAAU0"]
[Tue May 05 01:36:03.491658 2026] [:error] [pid 32471:tid 32487] [client 20.29.119.89:17205] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xinder.php"] [unique_id "afjZA3mjpb9EYq6AqhKzVAAAAQ0"]
[Tue May 05 01:36:03.893940 2026] [:error] [pid 61042:tid 61052] [client 20.29.119.89:17126] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xinder.php"] [unique_id "afjZA0nAPPS1fjubA9SAoQAAAMY"]
[Tue May 05 01:36:04.277947 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:17182] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "afjZBHmjpb9EYq6AqhKzVQAAARU"]
[Tue May 05 01:36:04.657634 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:17272] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "afjZBO8QXWVLiwIGVpe7GwAAAUA"]
[Tue May 05 01:36:05.041839 2026] [:error] [pid 3341:tid 3344] [client 20.29.119.89:17207] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "afjZBU9o3_LordU0wW7JRAAAAIA"]
[Tue May 05 01:36:05.429024 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:17048] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doc.php"] [unique_id "afjZBU9o3_LordU0wW7JRQAAAIM"]
[Tue May 05 01:36:05.819602 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17150] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/academy.php"] [unique_id "afjZBU9o3_LordU0wW7JRwAAAIo"]
[Tue May 05 01:36:06.245354 2026] [:error] [pid 61044:tid 61117] [client 20.29.119.89:17164] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/academy.php"] [unique_id "afjZBkw8w2zZZXI6H1vJVwAAAA8"]
[Tue May 05 01:36:06.707346 2026] [:error] [pid 61042:tid 61059] [client 20.29.119.89:17163] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/academy.php"] [unique_id "afjZBknAPPS1fjubA9SApAAAAM0"]
[Tue May 05 01:36:07.141922 2026] [:error] [pid 61043:tid 61080] [client 20.29.119.89:17196] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/academy.php"] [unique_id "afjZB58-LwtfURjiAbAAWwAAAEU"]
[Tue May 05 01:36:07.622172 2026] [:error] [pid 61044:tid 61110] [client 20.29.119.89:17106] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/owl.php"] [unique_id "afjZB0w8w2zZZXI6H1vJWAAAAAg"]
[Tue May 05 01:36:08.132301 2026] [:error] [pid 61042:tid 61056] [client 20.29.119.89:17168] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/owl.php"] [unique_id "afjZCEnAPPS1fjubA9SApQAAAMo"]
[Tue May 05 01:36:08.562222 2026] [:error] [pid 61043:tid 61078] [client 20.29.119.89:17037] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/owl.php"] [unique_id "afjZCJ8-LwtfURjiAbAAXQAAAEM"]
[Tue May 05 01:36:08.962583 2026] [:error] [pid 61150:tid 61161] [client 20.29.119.89:17033] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/owl.php"] [unique_id "afjZCO8QXWVLiwIGVpe7HQAAAUg"]
[Tue May 05 01:36:09.372426 2026] [:error] [pid 61043:tid 61084] [client 20.29.119.89:17276] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "afjZCZ8-LwtfURjiAbAAXgAAAEk"]
[Tue May 05 01:36:09.788439 2026] [:error] [pid 61150:tid 61168] [client 20.29.119.89:17273] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "afjZCe8QXWVLiwIGVpe7HgAAAU8"]
[Tue May 05 01:36:10.186310 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:17056] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "afjZCnmjpb9EYq6AqhKzWQAAAQw"]
[Tue May 05 01:36:10.627747 2026] [:error] [pid 32471:tid 32482] [client 20.29.119.89:17178] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class19.php"] [unique_id "afjZCnmjpb9EYq6AqhKzWgAAAQg"]
[Tue May 05 01:36:11.029957 2026] [:error] [pid 32471:tid 32477] [client 20.29.119.89:17274] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xm.php"] [unique_id "afjZC3mjpb9EYq6AqhKzWwAAAQM"]
[Tue May 05 01:36:11.409749 2026] [:error] [pid 61044:tid 61106] [client 20.29.119.89:17090] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xm.php"] [unique_id "afjZC0w8w2zZZXI6H1vJWgAAAAQ"]
[Tue May 05 01:36:11.799024 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:17027] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xm.php"] [unique_id "afjZC3mjpb9EYq6AqhKzXAAAAQs"]
[Tue May 05 01:36:12.318476 2026] [:error] [pid 61044:tid 61108] [client 20.29.119.89:16960] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xm.php"] [unique_id "afjZDEw8w2zZZXI6H1vJWwAAAAY"]
[Tue May 05 01:36:12.801462 2026] [:error] [pid 32471:tid 32490] [client 20.29.119.89:17110] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/do.php"] [unique_id "afjZDHmjpb9EYq6AqhKzXgAAARA"]
[Tue May 05 01:36:13.188966 2026] [:error] [pid 32471:tid 32489] [client 20.29.119.89:17215] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/do.php"] [unique_id "afjZDXmjpb9EYq6AqhKzYQAAAQ8"]
[Tue May 05 01:36:13.593588 2026] [:error] [pid 32471:tid 32481] [client 20.29.119.89:17038] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/do.php"] [unique_id "afjZDXmjpb9EYq6AqhKzYwAAAQc"]
[Tue May 05 01:36:14.018526 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:17064] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/do.php"] [unique_id "afjZDu8QXWVLiwIGVpe7IgAAAVc"]
[Tue May 05 01:36:14.431361 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:17112] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "afjZDk9o3_LordU0wW7JSgAAAII"]
[Tue May 05 01:36:14.979747 2026] [:error] [pid 61044:tid 61121] [client 20.29.119.89:17399] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "afjZDkw8w2zZZXI6H1vJXAAAABM"]
[Tue May 05 01:36:15.407055 2026] [:error] [pid 3341:tid 3362] [client 20.29.119.89:17127] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "afjZD09o3_LordU0wW7JTAAAAJI"]
[Tue May 05 01:36:15.849975 2026] [:error] [pid 61042:tid 61048] [client 20.29.119.89:17137] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/myfile.php"] [unique_id "afjZD0nAPPS1fjubA9SAqAAAAMI"]
[Tue May 05 01:36:16.248607 2026] [:error] [pid 61150:tid 61175] [client 20.29.119.89:17030] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "afjZEO8QXWVLiwIGVpe7JgAAAVY"]
[Tue May 05 01:36:16.699168 2026] [:error] [pid 61043:tid 61083] [client 20.29.119.89:17026] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "afjZEJ8-LwtfURjiAbAAfQAAAEg"]
[Tue May 05 01:36:17.152571 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:17044] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "afjZEXmjpb9EYq6AqhKzbAAAARE"]
[Tue May 05 01:36:17.647350 2026] [:error] [pid 61043:tid 61079] [client 20.29.119.89:17136] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "afjZEZ8-LwtfURjiAbAAfwAAAEQ"]
[Tue May 05 01:36:18.150722 2026] [:error] [pid 61150:tid 61160] [client 20.29.119.89:17171] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasfu.php"] [unique_id "afjZEu8QXWVLiwIGVpe7JwAAAUc"]
[Tue May 05 01:36:18.648903 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:17029] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasfu.php"] [unique_id "afjZEk9o3_LordU0wW7JUAAAAIM"]
[Tue May 05 01:36:19.110730 2026] [:error] [pid 32471:tid 32495] [client 20.29.119.89:17065] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasfu.php"] [unique_id "afjZE3mjpb9EYq6AqhKzcAAAARU"]
[Tue May 05 01:36:19.589418 2026] [:error] [pid 32471:tid 32493] [client 20.29.119.89:17055] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yasfu.php"] [unique_id "afjZE3mjpb9EYq6AqhKzcgAAARM"]
[Tue May 05 01:36:20.023686 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:17116] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "afjZFHmjpb9EYq6AqhKzdAAAARI"]
[Tue May 05 01:36:20.426508 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17134] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "afjZFE9o3_LordU0wW7JUwAAAIE"]
[Tue May 05 01:36:20.835741 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:17152] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "afjZFHmjpb9EYq6AqhKzdgAAAQw"]
[Tue May 05 01:36:21.230222 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:17376] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sid3.php"] [unique_id "afjZFU9o3_LordU0wW7JVAAAAJA"]
[Tue May 05 01:36:21.611383 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:17081] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "afjZFU9o3_LordU0wW7JVQAAAIk"]
[Tue May 05 01:36:22.015608 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17078] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "afjZFk9o3_LordU0wW7JVwAAAI8"]
[Tue May 05 01:36:22.483574 2026] [:error] [pid 3341:tid 3357] [client 20.29.119.89:17051] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "afjZFk9o3_LordU0wW7JWAAAAI0"]
[Tue May 05 01:36:22.918070 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17147] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "afjZFk9o3_LordU0wW7JWQAAAI4"]
[Tue May 05 01:36:23.347360 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:16981] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afjZF09o3_LordU0wW7JWgAAAJY"]
[Tue May 05 01:36:23.769452 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17080] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afjZF09o3_LordU0wW7JWwAAAJQ"]
[Tue May 05 01:36:24.212346 2026] [:error] [pid 3341:tid 3361] [client 20.29.119.89:17169] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afjZGE9o3_LordU0wW7JXQAAAJE"]
[Tue May 05 01:36:24.680207 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17118] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afjZGE9o3_LordU0wW7JYAAAAIo"]
[Tue May 05 01:36:25.061372 2026] [:error] [pid 3341:tid 3351] [client 20.29.119.89:17024] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afjZGU9o3_LordU0wW7JYwAAAIc"]
[Tue May 05 01:36:25.450150 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17143] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afjZGXmjpb9EYq6AqhKzfQAAAQQ"]
[Tue May 05 01:36:25.827649 2026] [:error] [pid 61042:tid 61070] [client 20.29.119.89:17103] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afjZGUnAPPS1fjubA9SArAAAANg"]
[Tue May 05 01:36:26.206954 2026] [:error] [pid 3341:tid 3349] [client 20.29.119.89:17139] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afjZGk9o3_LordU0wW7JZgAAAIU"]
[Tue May 05 01:36:26.624741 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:17104] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afjZGnmjpb9EYq6AqhKzfgAAARI"]
[Tue May 05 01:36:27.027656 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17058] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afjZG09o3_LordU0wW7JagAAAJQ"]
[Tue May 05 01:36:27.445687 2026] [:error] [pid 61150:tid 61156] [client 20.29.119.89:17119] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afjZG-8QXWVLiwIGVpe7KAAAAUM"]
[Tue May 05 01:36:27.845491 2026] [:error] [pid 61044:tid 61114] [client 20.29.119.89:16978] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afjZG0w8w2zZZXI6H1vJYQAAAAw"]
[Tue May 05 01:36:28.255188 2026] [:error] [pid 3341:tid 3355] [client 20.29.119.89:17115] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clirp.php"] [unique_id "afjZHE9o3_LordU0wW7JawAAAIs"]
[Tue May 05 01:36:28.648124 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17054] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clirp.php"] [unique_id "afjZHE9o3_LordU0wW7JbAAAAIo"]
[Tue May 05 01:36:29.049798 2026] [:error] [pid 61043:tid 61093] [client 20.29.119.89:17146] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clirp.php"] [unique_id "afjZHZ8-LwtfURjiAbAAggAAAFI"]
[Tue May 05 01:36:29.447482 2026] [:error] [pid 3341:tid 3345] [client 20.29.119.89:17148] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/clirp.php"] [unique_id "afjZHU9o3_LordU0wW7JbgAAAIE"]
[Tue May 05 01:36:29.842056 2026] [:error] [pid 3341:tid 3360] [client 20.29.119.89:17032] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "afjZHU9o3_LordU0wW7JbwAAAJA"]
[Tue May 05 01:36:30.235906 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:16980] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "afjZHk9o3_LordU0wW7JcAAAAIk"]
[Tue May 05 01:36:30.615055 2026] [:error] [pid 32471:tid 32494] [client 20.29.119.89:17069] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "afjZHnmjpb9EYq6AqhKzgQAAARQ"]
[Tue May 05 01:36:31.044064 2026] [:error] [pid 61150:tid 61165] [client 20.29.119.89:17031] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rendi59.php"] [unique_id "afjZH-8QXWVLiwIGVpe7KQAAAUw"]
[Tue May 05 01:36:31.423591 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17084] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afjZH09o3_LordU0wW7JcQAAAJQ"]
[Tue May 05 01:36:31.810130 2026] [:error] [pid 3341:tid 3363] [client 20.29.119.89:17072] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afjZH09o3_LordU0wW7JcgAAAJM"]
[Tue May 05 01:36:32.247692 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17179] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afjZIE9o3_LordU0wW7JdAAAAIo"]
[Tue May 05 01:36:32.655838 2026] [:error] [pid 32471:tid 32479] [client 20.29.119.89:17199] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afjZIHmjpb9EYq6AqhKzhQAAAQU"]
[Tue May 05 01:36:33.132186 2026] [:error] [pid 32471:tid 32496] [client 20.29.119.89:17149] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tox.php"] [unique_id "afjZIXmjpb9EYq6AqhKzhgAAARY"]
[Tue May 05 01:36:33.549722 2026] [:error] [pid 61150:tid 61170] [client 20.29.119.89:17077] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tox.php"] [unique_id "afjZIe8QXWVLiwIGVpe7KgAAAVE"]
[Tue May 05 01:36:34.084470 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:17042] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tox.php"] [unique_id "afjZIu8QXWVLiwIGVpe7KwAAAVc"]
[Tue May 05 01:36:34.568267 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17206] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tox.php"] [unique_id "afjZIk9o3_LordU0wW7JeAAAAI8"]
[Tue May 05 01:36:34.971897 2026] [:error] [pid 3341:tid 3346] [client 20.29.119.89:17187] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "afjZIk9o3_LordU0wW7JeQAAAII"]
[Tue May 05 01:36:35.418750 2026] [:error] [pid 61150:tid 61171] [client 20.29.119.89:17120] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "afjZI-8QXWVLiwIGVpe7MAAAAVI"]
[Tue May 05 01:36:35.875485 2026] [:error] [pid 32471:tid 32486] [client 20.29.119.89:17043] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "afjZI3mjpb9EYq6AqhKziQAAAQw"]
[Tue May 05 01:36:36.385876 2026] [:error] [pid 3341:tid 3366] [client 20.29.119.89:17138] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file9.php"] [unique_id "afjZJE9o3_LordU0wW7JegAAAJY"]
[Tue May 05 01:36:36.826973 2026] [:error] [pid 61150:tid 61174] [client 20.29.119.89:16964] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccu.php"] [unique_id "afjZJO8QXWVLiwIGVpe7MQAAAVU"]
[Tue May 05 01:36:37.302026 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17083] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccu.php"] [unique_id "afjZJXmjpb9EYq6AqhKzjAAAAQk"]
[Tue May 05 01:36:37.684927 2026] [:error] [pid 32471:tid 32484] [client 20.29.119.89:16988] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccu.php"] [unique_id "afjZJXmjpb9EYq6AqhKzjQAAAQo"]
[Tue May 05 01:36:38.067369 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17198] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccu.php"] [unique_id "afjZJnmjpb9EYq6AqhKzjwAAAQ4"]
[Tue May 05 01:36:38.473465 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:17079] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-x7.php"] [unique_id "afjZJk9o3_LordU0wW7JewAAAJQ"]
[Tue May 05 01:36:38.871335 2026] [:error] [pid 3341:tid 3358] [client 20.29.119.89:17046] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-x7.php"] [unique_id "afjZJk9o3_LordU0wW7JfAAAAI4"]
[Tue May 05 01:36:39.377509 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:17096] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-x7.php"] [unique_id "afjZJ09o3_LordU0wW7JfgAAAIo"]
[Tue May 05 01:36:39.767931 2026] [:error] [pid 61150:tid 61153] [client 20.29.119.89:17012] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-x7.php"] [unique_id "afjZJ-8QXWVLiwIGVpe7NAAAAUA"]
[Tue May 05 01:36:40.271630 2026] [:error] [pid 3341:tid 3353] [client 20.29.119.89:16997] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "afjZKE9o3_LordU0wW7JgQAAAIk"]
[Tue May 05 01:36:40.674987 2026] [:error] [pid 3341:tid 3359] [client 20.29.119.89:17013] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "afjZKE9o3_LordU0wW7JgwAAAI8"]
[Tue May 05 01:36:41.256734 2026] [:error] [pid 32471:tid 32485] [client 20.29.119.89:17100] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "afjZKXmjpb9EYq6AqhKzlgAAAQs"]
[Tue May 05 01:36:41.710096 2026] [:error] [pid 61043:tid 61095] [client 20.29.119.89:17109] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-aaa.php"] [unique_id "afjZKZ8-LwtfURjiAbAAhgAAAFQ"]
[Tue May 05 01:36:42.162898 2026] [:error] [pid 32471:tid 32483] [client 20.29.119.89:17073] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afjZKnmjpb9EYq6AqhKzlwAAAQk"]
[Tue May 05 01:36:42.643093 2026] [:error] [pid 32471:tid 32497] [client 20.29.119.89:17060] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afjZKnmjpb9EYq6AqhKzmAAAARc"]
[Tue May 05 01:36:43.096550 2026] [:error] [pid 61042:tid 61055] [client 20.29.119.89:17039] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afjZK0nAPPS1fjubA9SAsgAAAMk"]
[Tue May 05 01:36:43.562094 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:17124] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afjZK09o3_LordU0wW7JigAAAIY"]
[Tue May 05 01:36:44.024414 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:17062] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file5.php"] [unique_id "afjZLO8QXWVLiwIGVpe7NQAAAVc"]
[Tue May 05 01:36:44.480917 2026] [:error] [pid 61042:tid 61048] [client 20.29.119.89:17125] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file5.php"] [unique_id "afjZLEnAPPS1fjubA9SAswAAAMI"]
[Tue May 05 01:36:44.956373 2026] [:error] [pid 61043:tid 61080] [client 20.29.119.89:17159] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file5.php"] [unique_id "afjZLJ8-LwtfURjiAbAAhwAAAEU"]
[Tue May 05 01:36:45.355640 2026] [:error] [pid 3341:tid 3348] [client 20.29.119.89:17028] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file5.php"] [unique_id "afjZLU9o3_LordU0wW7JjQAAAIQ"]
[Tue May 05 01:36:45.872521 2026] [:error] [pid 61044:tid 61113] [client 20.29.119.89:17053] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xrm.php"] [unique_id "afjZLUw8w2zZZXI6H1vJZwAAAAs"]
[Tue May 05 01:36:46.300928 2026] [:error] [pid 61044:tid 61104] [client 20.29.119.89:17248] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xrm.php"] [unique_id "afjZLkw8w2zZZXI6H1vJaQAAAAI"]
[Tue May 05 01:36:46.702884 2026] [:error] [pid 61042:tid 61069] [client 20.29.119.89:17070] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xrm.php"] [unique_id "afjZLknAPPS1fjubA9SAtAAAANc"]
[Tue May 05 01:36:47.113789 2026] [:error] [pid 61042:tid 61068] [client 20.29.119.89:17025] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xrm.php"] [unique_id "afjZL0nAPPS1fjubA9SAtQAAANY"]
[Tue May 05 01:36:47.606681 2026] [:error] [pid 61043:tid 61090] [client 20.29.119.89:16961] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "afjZL58-LwtfURjiAbAAiAAAAE8"]
[Tue May 05 01:36:48.037530 2026] [:error] [pid 61043:tid 61082] [client 20.29.119.89:17034] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "afjZMJ8-LwtfURjiAbAAiQAAAEc"]
[Tue May 05 01:36:48.529817 2026] [:error] [pid 61042:tid 61051] [client 20.29.119.89:16973] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "afjZMEnAPPS1fjubA9SAtgAAAMU"]
[Tue May 05 01:36:48.979148 2026] [:error] [pid 61042:tid 61061] [client 20.29.119.89:17001] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-asudo.php"] [unique_id "afjZMEnAPPS1fjubA9SAtwAAAM8"]
[Tue May 05 01:36:49.444538 2026] [proxy_fcgi:error] [pid 3341:tid 3360] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:49.636928 2026] [proxy_fcgi:error] [pid 3341:tid 3353] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:49.832422 2026] [proxy_fcgi:error] [pid 3341:tid 3359] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:50.025385 2026] [proxy_fcgi:error] [pid 3341:tid 3347] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:50.219570 2026] [proxy_fcgi:error] [pid 3341:tid 3368] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:50.414212 2026] [proxy_fcgi:error] [pid 3341:tid 3357] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:50.607441 2026] [proxy_fcgi:error] [pid 3341:tid 3366] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:50.799430 2026] [proxy_fcgi:error] [pid 3341:tid 3349] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:51.002400 2026] [proxy_fcgi:error] [pid 3341:tid 3350] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:51.194780 2026] [proxy_fcgi:error] [pid 3341:tid 3352] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:51.387213 2026] [proxy_fcgi:error] [pid 3341:tid 3365] [client 20.29.119.89:16962] AH01071: Got error 'Primary script unknown'
[Tue May 05 01:36:51.579584 2026] [:error] [pid 3341:tid 3354] [client 20.29.119.89:16962] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-Blogs.php"] [unique_id "afjZM09o3_LordU0wW7JnwAAAIo"]
[Tue May 05 01:36:52.078402 2026] [:error] [pid 61044:tid 61120] [client 20.29.119.89:17088] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-Blogs.php"] [unique_id "afjZNEw8w2zZZXI6H1vJbAAAABI"]
[Tue May 05 01:36:52.532774 2026] [:error] [pid 32471:tid 32491] [client 20.29.119.89:17006] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-Blogs.php"] [unique_id "afjZNHmjpb9EYq6AqhKzoAAAARE"]
[Tue May 05 01:36:52.934483 2026] [:error] [pid 32471:tid 32488] [client 20.29.119.89:17050] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-Blogs.php"] [unique_id "afjZNHmjpb9EYq6AqhKzoQAAAQ4"]
[Tue May 05 01:36:53.398583 2026] [:error] [pid 61044:tid 61119] [client 20.29.119.89:16996] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp_ok.php"] [unique_id "afjZNUw8w2zZZXI6H1vJbgAAABE"]
[Tue May 05 01:36:53.833916 2026] [:error] [pid 61150:tid 61171] [client 20.29.119.89:16995] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp_ok.php"] [unique_id "afjZNe8QXWVLiwIGVpe7NwAAAVI"]
[Tue May 05 01:36:54.255771 2026] [:error] [pid 61044:tid 61125] [client 20.29.119.89:17122] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp_ok.php"] [unique_id "afjZNkw8w2zZZXI6H1vJbwAAABc"]
[Tue May 05 01:36:54.673159 2026] [:error] [pid 3341:tid 3367] [client 20.29.119.89:17086] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp_ok.php"] [unique_id "afjZNk9o3_LordU0wW7JoAAAAJc"]
[Tue May 05 01:36:55.139813 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17036] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afjZN3mjpb9EYq6AqhKzpQAAAQQ"]
[Tue May 05 01:36:55.567605 2026] [:error] [pid 3341:tid 3347] [client 20.29.119.89:16967] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afjZN09o3_LordU0wW7JoQAAAIM"]
[Tue May 05 01:36:55.996470 2026] [:error] [pid 61043:tid 61085] [client 20.29.119.89:17076] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afjZN58-LwtfURjiAbAAiwAAAEo"]
[Tue May 05 01:36:56.401289 2026] [:error] [pid 61150:tid 61172] [client 20.29.119.89:16971] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "afjZOO8QXWVLiwIGVpe7PQAAAVM"]
[Tue May 05 01:36:56.801323 2026] [:error] [pid 61150:tid 61173] [client 20.29.119.89:17085] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file88.php"] [unique_id "afjZOO8QXWVLiwIGVpe7PgAAAVQ"]
[Tue May 05 01:36:57.212301 2026] [:error] [pid 3341:tid 3350] [client 20.29.119.89:17018] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file88.php"] [unique_id "afjZOU9o3_LordU0wW7JowAAAIY"]
[Tue May 05 01:36:57.610428 2026] [:error] [pid 61042:tid 61060] [client 20.29.119.89:17071] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file88.php"] [unique_id "afjZOUnAPPS1fjubA9SAvAAAAM4"]
[Tue May 05 01:36:58.189052 2026] [:error] [pid 61044:tid 61126] [client 20.29.119.89:17151] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file88.php"] [unique_id "afjZOkw8w2zZZXI6H1vJcgAAABg"]
[Tue May 05 01:36:58.641182 2026] [:error] [pid 61043:tid 61088] [client 20.29.119.89:17132] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "afjZOp8-LwtfURjiAbAAjAAAAE0"]
[Tue May 05 01:36:59.056916 2026] [:error] [pid 61042:tid 61054] [client 20.29.119.89:16984] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "afjZO0nAPPS1fjubA9SAvQAAAMg"]
[Tue May 05 01:36:59.616960 2026] [:error] [pid 3341:tid 3364] [client 20.29.119.89:16963] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "afjZO09o3_LordU0wW7JpgAAAJQ"]
[Tue May 05 01:37:00.045778 2026] [:error] [pid 61043:tid 61097] [client 20.29.119.89:16930] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file32.php"] [unique_id "afjZPJ8-LwtfURjiAbAAjQAAAFY"]
[Tue May 05 01:37:00.446871 2026] [:error] [pid 61043:tid 61086] [client 20.29.119.89:17243] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp.php"] [unique_id "afjZPJ8-LwtfURjiAbAAjwAAAEs"]
[Tue May 05 01:37:00.981519 2026] [:error] [pid 61150:tid 61176] [client 20.29.119.89:17000] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp.php"] [unique_id "afjZPO8QXWVLiwIGVpe7RAAAAVc"]
[Tue May 05 01:37:01.427982 2026] [:error] [pid 32471:tid 32478] [client 20.29.119.89:17087] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp.php"] [unique_id "afjZPXmjpb9EYq6AqhKzqQAAAQQ"]
[Tue May 05 01:37:01.847197 2026] [:error] [pid 61043:tid 61089] [client 20.29.119.89:17133] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-wp.php"] [unique_id "afjZPZ8-LwtfURjiAbAAkwAAAE4"]
[Tue May 05 01:37:02.273999 2026] [:error] [pid 61043:tid 61087] [client 20.29.119.89:17041] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afjZPp8-LwtfURjiAbAAlQAAAEw"]
[Tue May 05 01:37:02.651415 2026] [:error] [pid 61043:tid 61094] [client 20.29.119.89:17131] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afjZPp8-LwtfURjiAbAAmAAAAFM"]
[Tue May 05 01:37:03.065503 2026] [:error] [pid 32471:tid 32492] [client 20.29.119.89:17113] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afjZP3mjpb9EYq6AqhKzqwAAARI"]
[Tue May 05 01:37:03.449132 2026] [:error] [pid 61042:tid 61064] [client 20.29.119.89:17135] [client 20.29.119.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afjZP0nAPPS1fjubA9SAvgAAANI"]
[Tue May 05 01:57:55.638125 2026] [:error] [pid 61150:tid 61166] [client 123.207.65.62:55162] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afjeI-8QXWVLiwIGVpe-YAAAAU0"]
[Tue May 05 02:00:07.010699 2026] [:error] [pid 61043:tid 61075] [client 170.106.140.110:59796] [client 170.106.140.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afjep58-LwtfURjiAbAFlgAAAEA"]
[Tue May 05 03:36:05.829896 2026] [:error] [pid 61150:tid 61158] [client 178.35.104.247:36518] [client 178.35.104.247] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/mp4"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afj1Je8QXWVLiwIGVpfOwgAAAUU"]
[Tue May 05 03:36:06.156942 2026] [:error] [pid 61150:tid 61161] [client 178.35.104.247:36518] [client 178.35.104.247] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=video/mp4"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afj1Ju8QXWVLiwIGVpfOxAAAAUg"]
[Tue May 05 07:48:46.882161 2026] [:error] [pid 39178:tid 39195] [client 43.167.236.228:46262] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afkwXjaPrgTaiOD_15vEmAAAAM8"]
[Tue May 05 07:50:59.951080 2026] [proxy_fcgi:error] [pid 39073:tid 39153] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:00.232291 2026] [proxy_fcgi:error] [pid 39073:tid 39149] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:00.568308 2026] [proxy_fcgi:error] [pid 39073:tid 39148] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:00.882645 2026] [proxy_fcgi:error] [pid 39073:tid 39149] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:01.213169 2026] [proxy_fcgi:error] [pid 39073:tid 39137] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:01.495857 2026] [proxy_fcgi:error] [pid 39073:tid 39158] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:01.784317 2026] [proxy_fcgi:error] [pid 39073:tid 39155] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:02.086308 2026] [proxy_fcgi:error] [pid 39073:tid 39147] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:02.705887 2026] [proxy_fcgi:error] [pid 39073:tid 39147] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:02.990686 2026] [proxy_fcgi:error] [pid 39073:tid 39145] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:03.299772 2026] [proxy_fcgi:error] [pid 39073:tid 39136] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:03.587170 2026] [proxy_fcgi:error] [pid 39073:tid 39157] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:03.878315 2026] [proxy_fcgi:error] [pid 39073:tid 39136] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:04.224313 2026] [proxy_fcgi:error] [pid 39073:tid 39150] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:04.516835 2026] [proxy_fcgi:error] [pid 39073:tid 39149] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:04.814297 2026] [proxy_fcgi:error] [pid 39073:tid 39154] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:05.116648 2026] [proxy_fcgi:error] [pid 39073:tid 39142] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:05.405284 2026] [proxy_fcgi:error] [pid 39073:tid 39139] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:07.720630 2026] [proxy_fcgi:error] [pid 39073:tid 39157] [client 45.86.200.104:32231] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:09.444141 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.104:32231] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afkw7f0kT1BNjk46BkeMYgAAAIQ"]
[Tue May 05 07:51:10.833823 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.79:34921] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "afkw7iepFwKgA_SKOHg1sAAAARA"]
[Tue May 05 07:51:13.389307 2026] [proxy_fcgi:error] [pid 39073:tid 39147] [client 45.86.200.82:56675] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:14.235226 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.82:56675] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tinyfilemanager.php"] [unique_id "afkw8v0kT1BNjk46BkeNDgAAAIg"]
[Tue May 05 07:51:15.067307 2026] [proxy_fcgi:error] [pid 41055:tid 41063] [client 45.86.200.99:27585] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:15.356316 2026] [proxy_fcgi:error] [pid 41055:tid 41081] [client 45.86.200.99:27585] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:15.624027 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.99:27585] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "afkw8yepFwKgA_SKOHg2HwAAAQc"]
[Tue May 05 07:51:16.438152 2026] [proxy_fcgi:error] [pid 41055:tid 41082] [client 45.86.200.79:55135] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:17.832741 2026] [:error] [pid 41055:tid 41072] [client 45.86.200.79:55135] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "afkw9SepFwKgA_SKOHg2agAAAQ4"]
[Tue May 05 07:51:18.651128 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.52:23469] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "afkw9jaPrgTaiOD_15vTlQAAAM8"]
[Tue May 05 07:51:19.195460 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.100:32079] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "afkw9_0kT1BNjk46BkeNuAAAAJE"]
[Tue May 05 07:51:19.744101 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.51:43719] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "afkw9yepFwKgA_SKOHg2pgAAAQM"]
[Tue May 05 07:51:20.299307 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.104:55905] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afkw-CepFwKgA_SKOHg2swAAARY"]
[Tue May 05 07:51:21.904626 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.92:56531] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "afkw-folSHl4aAnrIotSLgAAAFg"]
[Tue May 05 07:51:23.741075 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.74:46215] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "afkw-3G_NPOxSH0O9aRMqQAAAUM"]
[Tue May 05 07:51:24.322574 2026] [proxy_fcgi:error] [pid 39178:tid 39199] [client 45.86.200.107:44315] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:24.897465 2026] [:error] [pid 39178:tid 39189] [client 45.86.200.107:44315] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/filemanager.php"] [unique_id "afkw_DaPrgTaiOD_15vUHwAAAMk"]
[Tue May 05 07:51:26.515415 2026] [proxy_fcgi:error] [pid 41055:tid 41076] [client 45.86.200.108:46227] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:26.799688 2026] [proxy_fcgi:error] [pid 41055:tid 41058] [client 45.86.200.108:46227] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:27.067350 2026] [:error] [pid 41055:tid 41067] [client 45.86.200.108:46227] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afkw_yepFwKgA_SKOHg3nQAAAQk"]
[Tue May 05 07:51:30.807677 2026] [:error] [pid 41055:tid 41067] [client 45.86.200.82:38205] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "afkxAiepFwKgA_SKOHg4KwAAAQk"]
[Tue May 05 07:51:32.522665 2026] [proxy_fcgi:error] [pid 39072:tid 39113] [client 45.86.200.101:57743] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:32.790254 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.101:57743] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "afkxBPolSHl4aAnrIotTjQAAAEU"]
[Tue May 05 07:51:33.343437 2026] [proxy_fcgi:error] [pid 53856:tid 53877] [client 185.82.72.4:50881] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:34.188299 2026] [proxy_fcgi:error] [pid 53856:tid 53869] [client 185.82.72.4:50881] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:35.017584 2026] [:error] [pid 53856:tid 53882] [client 185.82.72.4:50881] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "afkxB3G_NPOxSH0O9aROHgAAAVE"]
[Tue May 05 07:51:35.566317 2026] [proxy_fcgi:error] [pid 53856:tid 53877] [client 45.86.200.96:58147] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:35.829991 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.96:58147] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "afkxB3G_NPOxSH0O9aROQgAAAU0"]
[Tue May 05 07:51:37.370309 2026] [proxy_fcgi:error] [pid 53856:tid 53886] [client 45.86.200.106:36363] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:37.927191 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.106:36363] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/defaults.php"] [unique_id "afkxCXG_NPOxSH0O9aROdgAAAUk"]
[Tue May 05 07:51:38.481464 2026] [proxy_fcgi:error] [pid 39178:tid 39200] [client 45.86.200.94:24833] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:38.771338 2026] [:error] [pid 39178:tid 39187] [client 45.86.200.94:24833] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "afkxCjaPrgTaiOD_15vV0gAAAMc"]
[Tue May 05 07:51:39.597641 2026] [proxy_fcgi:error] [pid 53856:tid 53878] [client 45.86.200.85:45225] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:39.874296 2026] [proxy_fcgi:error] [pid 53856:tid 53876] [client 45.86.200.85:45225] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:40.426652 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.85:45225] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afkxDHG_NPOxSH0O9aROsQAAAUk"]
[Tue May 05 07:51:41.263156 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.54:56443] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afkxDSepFwKgA_SKOHg5kAAAARA"]
[Tue May 05 07:51:42.086698 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.88:25111] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/index.php"] [unique_id "afkxDiepFwKgA_SKOHg5rgAAARY"]
[Tue May 05 07:51:42.622379 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.74:32675] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "afkxDjaPrgTaiOD_15vWVQAAANU"]
[Tue May 05 07:51:43.161350 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.112:33217] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "afkxD_olSHl4aAnrIotVYgAAAFE"]
[Tue May 05 07:51:44.281308 2026] [proxy_fcgi:error] [pid 41055:tid 41082] [client 45.86.200.57:24491] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:44.555249 2026] [:error] [pid 41055:tid 41062] [client 45.86.200.57:24491] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/info.php"] [unique_id "afkxECepFwKgA_SKOHg56wAAAQQ"]
[Tue May 05 07:51:45.130326 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.108:58177] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/class.api.php"] [unique_id "afkxESepFwKgA_SKOHg5-QAAAQo"]
[Tue May 05 07:51:45.684298 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.97:59665] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "afkxESepFwKgA_SKOHg6EAAAAQg"]
[Tue May 05 07:51:47.812299 2026] [proxy_fcgi:error] [pid 39072:tid 39131] [client 45.86.200.82:21299] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:48.087851 2026] [proxy_fcgi:error] [pid 39072:tid 39126] [client 45.86.200.82:21299] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:48.362023 2026] [proxy_fcgi:error] [pid 39072:tid 39113] [client 45.86.200.82:21299] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:48.642331 2026] [proxy_fcgi:error] [pid 39072:tid 39118] [client 45.86.200.82:21299] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:49.470415 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.82:21299] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "afkxFfolSHl4aAnrIotWOAAAAFU"]
[Tue May 05 07:51:50.906799 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.58:45951] [client 45.86.200.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.58, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afkxFjaPrgTaiOD_15vXcAAAANc"]
[Tue May 05 07:51:51.199290 2026] [proxy_fcgi:error] [pid 39178:tid 39183] [client 45.86.200.58:45951] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:51.777656 2026] [proxy_fcgi:error] [pid 39178:tid 39190] [client 45.86.200.58:45951] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:52.664298 2026] [proxy_fcgi:error] [pid 39178:tid 39201] [client 45.86.200.58:45951] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:52.973301 2026] [proxy_fcgi:error] [pid 39178:tid 39184] [client 45.86.200.58:45951] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:57.789911 2026] [:error] [pid 39178:tid 39199] [client 45.86.200.58:45951] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afkxHTaPrgTaiOD_15vYSAAAANM"]
[Tue May 05 07:51:59.641342 2026] [proxy_fcgi:error] [pid 53856:tid 53866] [client 45.86.200.88:21385] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:59.913247 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.88:21385] [client 45.86.200.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.88, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/user/wp-login.php"] [unique_id "afkxH3G_NPOxSH0O9aRRLQAAAVA"]
[Tue May 05 07:52:00.466614 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.88:21385] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/item.php"] [unique_id "afkxIHG_NPOxSH0O9aRRRwAAAVM"]
[Tue May 05 07:52:04.262328 2026] [proxy_fcgi:error] [pid 53856:tid 53877] [client 45.86.200.89:58173] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:05.126918 2026] [proxy_fcgi:error] [pid 53856:tid 53868] [client 45.86.200.89:58173] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:05.710299 2026] [proxy_fcgi:error] [pid 53856:tid 53865] [client 45.86.200.89:58173] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:06.254633 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.89:58173] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/husky301.php"] [unique_id "afkxJnG_NPOxSH0O9aRSTgAAAVQ"]
[Tue May 05 07:52:06.800293 2026] [proxy_fcgi:error] [pid 53856:tid 53876] [client 45.86.200.104:22171] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:07.633713 2026] [proxy_fcgi:error] [pid 53856:tid 53872] [client 45.86.200.104:22171] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:08.204300 2026] [proxy_fcgi:error] [pid 53856:tid 53880] [client 45.86.200.104:22171] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:08.757303 2026] [proxy_fcgi:error] [pid 53856:tid 53889] [client 45.86.200.104:22171] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:09.062338 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.104:22171] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "afkxKXG_NPOxSH0O9aRS4AAAAVM"]
[Tue May 05 07:52:09.609845 2026] [proxy_fcgi:error] [pid 39071:tid 39086] [client 45.86.200.105:39367] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:09.885307 2026] [proxy_fcgi:error] [pid 39071:tid 39082] [client 45.86.200.105:39367] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:10.151785 2026] [:error] [pid 39071:tid 39084] [client 45.86.200.105:39367] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/classwithtostring.php"] [unique_id "afkxKovmnRMz9gRzix3E3QAAAAQ"]
[Tue May 05 07:52:10.969285 2026] [proxy_fcgi:error] [pid 41055:tid 41082] [client 45.86.200.96:45201] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:11.519889 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.96:45201] [client 45.86.200.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.96, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-login.php"] [unique_id "afkxKyepFwKgA_SKOHg85wAAARc"]
[Tue May 05 07:52:11.810751 2026] [:error] [pid 41055:tid 41076] [client 45.86.200.96:45201] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "afkxKyepFwKgA_SKOHg88wAAARI"]
[Tue May 05 07:52:14.628307 2026] [proxy_fcgi:error] [pid 39073:tid 39144] [client 45.86.200.77:33285] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:15.177334 2026] [proxy_fcgi:error] [pid 39073:tid 39143] [client 45.86.200.77:33285] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:15.754325 2026] [proxy_fcgi:error] [pid 39073:tid 39140] [client 45.86.200.77:33285] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:16.342350 2026] [proxy_fcgi:error] [pid 39073:tid 39147] [client 45.86.200.77:33285] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:16.924296 2026] [proxy_fcgi:error] [pid 39073:tid 39151] [client 45.86.200.77:33285] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:17.208249 2026] [:error] [pid 39073:tid 39134] [client 45.86.200.77:33285] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "afkxMf0kT1BNjk46BkeUpAAAAIA"]
[Tue May 05 07:52:17.770304 2026] [proxy_fcgi:error] [pid 39178:tid 39191] [client 45.86.200.101:56631] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:18.614298 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.101:56631] [client 45.86.200.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.101, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "afkxMjaPrgTaiOD_15vaiAAAAMU"]
[Tue May 05 07:52:18.913292 2026] [proxy_fcgi:error] [pid 39178:tid 39184] [client 45.86.200.101:56631] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:19.208424 2026] [proxy_fcgi:error] [pid 39178:tid 39200] [client 45.86.200.101:56631] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:19.512295 2026] [proxy_fcgi:error] [pid 39178:tid 39184] [client 45.86.200.101:56631] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:19.801458 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.101:56631] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/about.php"] [unique_id "afkxMzaPrgTaiOD_15vaqQAAAMM"]
[Tue May 05 07:52:20.394166 2026] [proxy_fcgi:error] [pid 39071:tid 39095] [client 45.86.200.105:55987] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:20.662392 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.105:55987] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/infi.php"] [unique_id "afkxNIvmnRMz9gRzix3FygAAAA4"]
[Tue May 05 07:52:21.544944 2026] [proxy_fcgi:error] [pid 39071:tid 39084] [client 45.86.200.57:53851] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:21.826476 2026] [:error] [pid 39071:tid 39080] [client 45.86.200.57:53851] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "afkxNYvmnRMz9gRzix3F6gAAAAA"]
[Tue May 05 07:52:22.645301 2026] [proxy_fcgi:error] [pid 39072:tid 39118] [client 45.86.200.85:41763] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:22.932332 2026] [proxy_fcgi:error] [pid 39072:tid 39130] [client 45.86.200.85:41763] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:23.205176 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.85:41763] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "afkxN_olSHl4aAnrIotbEgAAAFY"]
[Tue May 05 07:52:23.739372 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.59:52871] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/index.php"] [unique_id "afkxNyepFwKgA_SKOHg-bwAAAQA"]
[Tue May 05 07:52:24.328289 2026] [proxy_fcgi:error] [pid 39073:tid 39135] [client 45.86.200.110:25829] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:24.616563 2026] [proxy_fcgi:error] [pid 39073:tid 39150] [client 45.86.200.110:25829] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:25.768771 2026] [:error] [pid 39073:tid 39158] [client 45.86.200.110:25829] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "afkxOf0kT1BNjk46BkeVfQAAAJg"]
[Tue May 05 07:52:26.637134 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.60:46933] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "afkxOiepFwKgA_SKOHg-1QAAARM"]
[Tue May 05 07:52:27.192303 2026] [proxy_fcgi:error] [pid 39072:tid 39117] [client 45.86.200.56:56281] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:28.037858 2026] [:error] [pid 39072:tid 39125] [client 45.86.200.56:56281] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/edit.php"] [unique_id "afkxPPolSHl4aAnrIotb4AAAAFI"]
[Tue May 05 07:52:28.626098 2026] [proxy_fcgi:error] [pid 39178:tid 39186] [client 45.86.200.108:20777] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:29.207338 2026] [proxy_fcgi:error] [pid 39178:tid 39195] [client 45.86.200.108:20777] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:29.486010 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.108:20777] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "afkxPTaPrgTaiOD_15vbqQAAANI"]
[Tue May 05 07:52:31.140292 2026] [proxy_fcgi:error] [pid 41055:tid 41058] [client 45.86.200.107:22889] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:31.683201 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.107:22889] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/click.php"] [unique_id "afkxPyepFwKgA_SKOHg_cQAAAQA"]
[Tue May 05 07:52:33.346310 2026] [proxy_fcgi:error] [pid 53856:tid 53867] [client 45.86.200.75:64011] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:34.179774 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.75:64011] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "afkxQnG_NPOxSH0O9aRWSAAAAVc"]
[Tue May 05 07:52:34.995299 2026] [proxy_fcgi:error] [pid 39071:tid 39086] [client 45.86.200.76:40505] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:35.579295 2026] [proxy_fcgi:error] [pid 39071:tid 39103] [client 45.86.200.76:40505] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:35.873309 2026] [proxy_fcgi:error] [pid 39071:tid 39086] [client 45.86.200.76:40505] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:36.427317 2026] [proxy_fcgi:error] [pid 39071:tid 39086] [client 45.86.200.76:40505] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:36.710680 2026] [:error] [pid 39071:tid 39103] [client 45.86.200.76:40505] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "afkxRIvmnRMz9gRzix3HUQAAABc"]
[Tue May 05 07:52:37.266139 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.51:32735] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/xl2023.php"] [unique_id "afkxRXG_NPOxSH0O9aRW1wAAAUw"]
[Tue May 05 07:52:37.838858 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.110:38851] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/admin.php"] [unique_id "afkxRf0kT1BNjk46BkeWtAAAAJY"]
[Tue May 05 07:52:38.382416 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.100:56755] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/dog.php"] [unique_id "afkxRovmnRMz9gRzix3HbAAAABU"]
[Tue May 05 07:52:38.939630 2026] [proxy_fcgi:error] [pid 39071:tid 39104] [client 45.86.200.103:40965] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:39.206111 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.103:40965] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "afkxR4vmnRMz9gRzix3HjQAAABQ"]
[Tue May 05 07:52:39.737779 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.54:48577] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "afkxR_olSHl4aAnrIotdQQAAAEI"]
[Tue May 05 07:52:41.312321 2026] [proxy_fcgi:error] [pid 41055:tid 41059] [client 45.86.200.111:61793] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:41.856273 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.111:61793] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "afkxSSepFwKgA_SKOHhAxwAAAQ8"]
[Tue May 05 07:52:42.394127 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.53:29799] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "afkxSnG_NPOxSH0O9aRXuAAAAUA"]
[Tue May 05 07:52:44.045310 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.56:31785] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/admin.php"] [unique_id "afkxTHG_NPOxSH0O9aRYAAAAAU4"]
[Tue May 05 07:52:45.601771 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.57:65521] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/security.php"] [unique_id "afkxTYvmnRMz9gRzix3IPwAAABQ"]
[Tue May 05 07:52:46.436027 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.96:65283] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "afkxTjaPrgTaiOD_15vdIgAAANY"]
[Tue May 05 07:52:47.565574 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.105:64733] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/about.php"] [unique_id "afkxT_0kT1BNjk46BkeXkwAAAIQ"]
[Tue May 05 07:52:48.110300 2026] [proxy_fcgi:error] [pid 39071:tid 39099] [client 45.86.200.56:53943] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:48.961300 2026] [proxy_fcgi:error] [pid 39071:tid 39104] [client 45.86.200.56:53943] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:49.267692 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.56:53943] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "afkxUYvmnRMz9gRzix3IqwAAAAM"]
[Tue May 05 07:52:50.097124 2026] [proxy_fcgi:error] [pid 53856:tid 53883] [client 45.86.200.107:51367] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:50.424318 2026] [proxy_fcgi:error] [pid 53856:tid 53876] [client 45.86.200.107:51367] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:51.533819 2026] [proxy_fcgi:error] [pid 53856:tid 53881] [client 45.86.200.107:51367] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:51.805106 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.107:51367] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/file.php"] [unique_id "afkxU3G_NPOxSH0O9aRZWQAAAUw"]
[Tue May 05 07:52:52.351359 2026] [proxy_fcgi:error] [pid 41055:tid 41076] [client 45.86.200.101:50081] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:53.186443 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.101:50081] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "afkxVSepFwKgA_SKOHhB3gAAAQA"]
[Tue May 05 07:52:54.827807 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.52:28167] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "afkxViepFwKgA_SKOHhB_wAAARA"]
[Tue May 05 07:52:56.589300 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.84:57511] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afkxWIvmnRMz9gRzix3JhAAAAAU"]
[Tue May 05 07:52:57.737302 2026] [proxy_fcgi:error] [pid 39072:tid 39113] [client 45.86.200.100:33249] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:58.009247 2026] [proxy_fcgi:error] [pid 39072:tid 39117] [client 45.86.200.100:33249] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:58.293308 2026] [proxy_fcgi:error] [pid 39072:tid 39126] [client 45.86.200.100:33249] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:58.571837 2026] [proxy_fcgi:error] [pid 39072:tid 39126] [client 45.86.200.100:33249] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:59.958940 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.100:33249] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "afkxW_olSHl4aAnrIotfmAAAAEs"]
[Tue May 05 07:53:00.520113 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.91:29663] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "afkxXHG_NPOxSH0O9aRavQAAAUE"]
[Tue May 05 07:53:01.075040 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.101:58803] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "afkxXXG_NPOxSH0O9aRa1gAAAUA"]
[Tue May 05 07:53:01.615196 2026] [:error] [pid 39072:tid 39126] [client 45.86.200.77:26059] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "afkxXfolSHl4aAnrIotfzAAAAFM"]
[Tue May 05 07:53:02.163453 2026] [:error] [pid 39073:tid 39140] [client 45.86.200.94:26593] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "afkxXv0kT1BNjk46BkeZRgAAAIY"]
[Tue May 05 07:53:02.711424 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.88:37881] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "afkxXvolSHl4aAnrIotf7wAAAE8"]
[Tue May 05 07:53:03.551019 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.86:59899] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/index.php"] [unique_id "afkxXzaPrgTaiOD_15veggAAANQ"]
[Tue May 05 07:53:04.118609 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.76:26239] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "afkxYHG_NPOxSH0O9aRbdgAAAUw"]
[Tue May 05 07:53:04.689440 2026] [:error] [pid 39073:tid 39149] [client 45.86.200.99:63581] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "afkxYP0kT1BNjk46BkeZyQAAAI8"]
[Tue May 05 07:53:05.225282 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.82:25973] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "afkxYf0kT1BNjk46BkeZ2QAAAJM"]
[Tue May 05 07:53:06.325354 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.59:60899] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/themes.php"] [unique_id "afkxYvolSHl4aAnrIotgYQAAAEI"]
[Tue May 05 07:53:07.165722 2026] [:error] [pid 41055:tid 41059] [client 185.82.72.4:31943] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/index.php"] [unique_id "afkxYyepFwKgA_SKOHhDVwAAAQE"]
[Tue May 05 07:53:08.725332 2026] [proxy_fcgi:error] [pid 39072:tid 39128] [client 45.86.200.89:33039] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:09.298538 2026] [:error] [pid 39072:tid 39113] [client 45.86.200.89:33039] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "afkxZfolSHl4aAnrIotgwQAAAEY"]
[Tue May 05 07:53:10.412298 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.92:51541] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/about.php"] [unique_id "afkxZvolSHl4aAnrIotg5AAAAFU"]
[Tue May 05 07:53:10.967304 2026] [proxy_fcgi:error] [pid 41055:tid 41062] [client 45.86.200.108:27397] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:11.549293 2026] [proxy_fcgi:error] [pid 41055:tid 41068] [client 45.86.200.108:27397] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:11.821764 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.108:27397] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "afkxZyepFwKgA_SKOHhD3AAAAQM"]
[Tue May 05 07:53:15.635299 2026] [proxy_fcgi:error] [pid 41055:tid 41073] [client 45.86.200.107:49101] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:15.924519 2026] [proxy_fcgi:error] [pid 41055:tid 41079] [client 45.86.200.107:49101] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:16.200324 2026] [proxy_fcgi:error] [pid 41055:tid 41075] [client 45.86.200.107:49101] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:16.471406 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.107:49101] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/about.php"] [unique_id "afkxbCepFwKgA_SKOHhEZgAAAQc"]
[Tue May 05 07:53:17.013289 2026] [proxy_fcgi:error] [pid 39178:tid 39198] [client 45.86.200.56:33131] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:17.283373 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.56:33131] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/wp-class.php"] [unique_id "afkxbTaPrgTaiOD_15vf1QAAANY"]
[Tue May 05 07:53:18.423588 2026] [proxy_fcgi:error] [pid 53856:tid 53867] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:18.719310 2026] [proxy_fcgi:error] [pid 53856:tid 53888] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:19.002799 2026] [proxy_fcgi:error] [pid 53856:tid 53877] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:19.569286 2026] [proxy_fcgi:error] [pid 53856:tid 53883] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:20.396304 2026] [proxy_fcgi:error] [pid 53856:tid 53879] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:20.674306 2026] [proxy_fcgi:error] [pid 53856:tid 53874] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:20.945935 2026] [proxy_fcgi:error] [pid 53856:tid 53868] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:21.224289 2026] [proxy_fcgi:error] [pid 53856:tid 53880] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:22.063287 2026] [proxy_fcgi:error] [pid 53856:tid 53866] [client 45.86.200.86:31569] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:22.327638 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.86:31569] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "afkxcnG_NPOxSH0O9aReNwAAAUg"]
[Tue May 05 07:53:23.906905 2026] [:error] [pid 39178:tid 39194] [client 45.86.200.91:53973] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "afkxczaPrgTaiOD_15vgnwAAAM4"]
[Tue May 05 07:53:25.492839 2026] [proxy_fcgi:error] [pid 39178:tid 39180] [client 45.86.200.109:40049] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:25.791503 2026] [:error] [pid 39178:tid 39199] [client 45.86.200.109:40049] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "afkxdTaPrgTaiOD_15vgzAAAANM"]
[Tue May 05 07:53:26.618310 2026] [proxy_fcgi:error] [pid 41055:tid 41066] [client 45.86.200.98:35769] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:26.887119 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.98:35769] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "afkxdiepFwKgA_SKOHhFpQAAARM"]
[Tue May 05 07:53:28.609619 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.97:55123] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "afkxeCepFwKgA_SKOHhF7wAAARc"]
[Tue May 05 07:53:31.400672 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.103:46233] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afkxezaPrgTaiOD_15vhVQAAAM8"]
[Tue May 05 07:53:31.937416 2026] [:error] [pid 39073:tid 39140] [client 185.82.72.3:31743] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/fm.php"] [unique_id "afkxe_0kT1BNjk46Bkec3QAAAIY"]
[Tue May 05 07:53:33.337295 2026] [proxy_fcgi:error] [pid 39073:tid 39151] [client 185.82.72.3:51749] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:33.896580 2026] [:error] [pid 39073:tid 39155] [client 185.82.72.3:51749] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "afkxff0kT1BNjk46BkedGwAAAJU"]
[Tue May 05 07:53:34.759311 2026] [proxy_fcgi:error] [pid 39071:tid 39085] [client 45.86.200.104:64711] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:35.312633 2026] [:error] [pid 39071:tid 39088] [client 45.86.200.104:64711] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/function.php"] [unique_id "afkxf4vmnRMz9gRzix3OYgAAAAg"]
[Tue May 05 07:53:35.844661 2026] [:error] [pid 39073:tid 39158] [client 185.82.72.3:53415] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/plugins.php"] [unique_id "afkxf_0kT1BNjk46BkedTQAAAJg"]
[Tue May 05 07:53:36.686590 2026] [proxy_fcgi:error] [pid 39073:tid 39142] [client 45.86.200.98:30039] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:36.967187 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.98:30039] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/chosen.php"] [unique_id "afkxgP0kT1BNjk46BkedcwAAAJI"]
[Tue May 05 07:53:37.513278 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.79:32915] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "afkxgSepFwKgA_SKOHhHOAAAAQI"]
[Tue May 05 07:53:38.649244 2026] [proxy_fcgi:error] [pid 39071:tid 39093] [client 45.86.200.58:42711] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:38.927296 2026] [proxy_fcgi:error] [pid 39071:tid 39099] [client 45.86.200.58:42711] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:39.487093 2026] [proxy_fcgi:error] [pid 39071:tid 39088] [client 45.86.200.58:42711] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:40.051502 2026] [:error] [pid 39071:tid 39095] [client 45.86.200.58:42711] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/atomlib.php"] [unique_id "afkxhIvmnRMz9gRzix3O1wAAAA8"]
[Tue May 05 07:53:40.609166 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.87:47593] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/index.php"] [unique_id "afkxhDaPrgTaiOD_15viZQAAANE"]
[Tue May 05 07:53:41.163305 2026] [proxy_fcgi:error] [pid 53856:tid 53872] [client 45.86.200.76:64253] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:41.446767 2026] [proxy_fcgi:error] [pid 53856:tid 53867] [client 45.86.200.76:64253] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:42.017482 2026] [proxy_fcgi:error] [pid 53856:tid 53877] [client 45.86.200.76:64253] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:53:42.295610 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.76:64253] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "afkxhnG_NPOxSH0O9aRhQQAAAUw"]
[Tue May 05 07:53:42.856664 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.54:53105] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "afkxhvolSHl4aAnrIotkQwAAAE8"]
[Tue May 05 07:53:58.406322 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.106:44961] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 09:03:17.834428 2026] [:error] [pid 41055:tid 41070] [client 43.128.156.124:52618] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aflB1SepFwKgA_SKOHhmRwAAAQw"]
[Tue May 05 10:25:04.002644 2026] [:error] [pid 25745:tid 25822] [client 217.182.195.179:32858] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aflVAJsd7hb7vrvCNBmz7wAAANU"]
[Tue May 05 10:25:07.020976 2026] [:error] [pid 25835:tid 25839] [client 217.182.195.179:55000] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aflVA1DT5nGJyh1439wm8wAAAQI"]
[Tue May 05 10:25:10.724995 2026] [:error] [pid 25745:tid 25817] [client 217.182.195.179:55006] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aflVBpsd7hb7vrvCNBm0HgAAANA"]
[Tue May 05 10:25:13.400091 2026] [:error] [pid 25743:tid 25747] [client 217.182.195.179:55012] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aflVCW-PCMRhF5DdUnNiygAAAAA"]
[Tue May 05 10:25:16.631455 2026] [:error] [pid 25745:tid 25809] [client 217.182.195.179:50810] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aflVDJsd7hb7vrvCNBm0awAAAMg"]
[Tue May 05 10:25:19.602946 2026] [:error] [pid 25744:tid 25779] [client 217.182.195.179:50824] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aflVDyR8IuyzjkW06ONnwwAAAIU"]
[Tue May 05 10:25:23.317497 2026] [:error] [pid 25745:tid 25816] [client 217.182.195.179:50826] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aflVE5sd7hb7vrvCNBm0xwAAAM8"]
[Tue May 05 10:25:26.694022 2026] [:error] [pid 25744:tid 25777] [client 217.182.195.179:44712] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aflVFiR8IuyzjkW06ONn5wAAAIM"]
[Tue May 05 10:25:29.625789 2026] [:error] [pid 25835:tid 25843] [client 217.182.195.179:44726] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aflVGVDT5nGJyh1439wnYQAAAQY"]
[Tue May 05 10:25:33.336412 2026] [:error] [pid 25835:tid 25847] [client 217.182.195.179:44736] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aflVHVDT5nGJyh1439wndAAAAQo"]
[Tue May 05 10:25:38.083319 2026] [:error] [pid 25743:tid 25761] [client 217.182.195.179:43638] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aflVIm-PCMRhF5DdUnNjRAAAAA4"]
[Tue May 05 10:25:41.363712 2026] [:error] [pid 25743:tid 25766] [client 217.182.195.179:43640] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aflVJW-PCMRhF5DdUnNjSQAAABM"]
[Tue May 05 10:25:44.483974 2026] [:error] [pid 25744:tid 25798] [client 217.182.195.179:43652] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aflVKCR8IuyzjkW06ONn_wAAAJg"]
[Tue May 05 10:25:47.995142 2026] [:error] [pid 25835:tid 25848] [client 217.182.195.179:36760] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aflVK1DT5nGJyh1439wnkwAAAQs"]
[Tue May 05 10:25:51.803216 2026] [:error] [pid 25744:tid 25794] [client 217.182.195.179:36772] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aflVLyR8IuyzjkW06ONoDgAAAJQ"]
[Tue May 05 10:25:54.881407 2026] [:error] [pid 25835:tid 25846] [client 217.182.195.179:36788] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aflVMlDT5nGJyh1439wnpwAAAQk"]
[Tue May 05 10:25:58.460878 2026] [:error] [pid 25835:tid 25856] [client 217.182.195.179:33236] [client 217.182.195.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aflVNlDT5nGJyh1439wntQAAARM"]
[Tue May 05 11:41:00.077190 2026] [:error] [pid 25744:tid 25784] [client 79.127.164.178:39097] [client 79.127.164.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aflmzCR8IuyzjkW06ON9kQAAAIo"]
[Tue May 05 13:37:15.365126 2026] [:error] [pid 54732:tid 54741] [client 162.14.81.106:60412] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afmCC7GgYlDOb3nfuJSP-gAAAEc"]
[Tue May 05 14:04:39.412670 2026] [:error] [pid 54732:tid 54746] [client 54.37.252.118:54558] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "afmId7GgYlDOb3nfuJSckgAAAEw"]
[Tue May 05 14:04:39.539770 2026] [:error] [pid 25744:tid 25787] [client 54.37.252.118:54570] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "afmIdyR8IuyzjkW06OOg4QAAAI0"]
[Tue May 05 14:04:41.577165 2026] [:error] [pid 25745:tid 25802] [client 54.37.252.118:46372] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "afmIeZsd7hb7vrvCNBn91AAAAME"]
[Tue May 05 14:04:41.588685 2026] [:error] [pid 54732:tid 54757] [client 54.37.252.118:46376] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "afmIebGgYlDOb3nfuJScmwAAAFc"]
[Tue May 05 14:04:43.620436 2026] [:error] [pid 54732:tid 54739] [client 54.37.252.118:54580] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afmIe7GgYlDOb3nfuJScogAAAEU"]
[Tue May 05 14:04:44.119902 2026] [:error] [pid 25835:tid 25842] [client 54.37.252.118:54590] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afmIfFDT5nGJyh1439yHdAAAAQU"]
[Tue May 05 14:04:46.004310 2026] [:error] [pid 25745:tid 25823] [client 54.37.252.118:59404] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afmIfpsd7hb7vrvCNBn92AAAANY"]
[Tue May 05 14:04:47.057223 2026] [:error] [pid 25745:tid 25815] [client 54.37.252.118:59414] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afmIf5sd7hb7vrvCNBn93QAAAM4"]
[Tue May 05 14:04:48.478413 2026] [:error] [pid 54732:tid 54750] [client 54.37.252.118:59796] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afmIgLGgYlDOb3nfuJScrAAAAFA"]
[Tue May 05 14:04:49.460681 2026] [:error] [pid 54732:tid 54734] [client 54.37.252.118:59798] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afmIgbGgYlDOb3nfuJScrgAAAEA"]
[Tue May 05 14:04:50.774616 2026] [:error] [pid 25744:tid 25786] [client 54.37.252.118:59430] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afmIgiR8IuyzjkW06OOg7QAAAIw"]
[Tue May 05 14:04:52.605518 2026] [:error] [pid 54732:tid 54756] [client 54.37.252.118:59432] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afmIhLGgYlDOb3nfuJScvAAAAFY"]
[Tue May 05 14:04:53.494185 2026] [:error] [pid 54732:tid 54737] [client 54.37.252.118:59446] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afmIhbGgYlDOb3nfuJScvwAAAEM"]
[Tue May 05 14:04:55.422479 2026] [:error] [pid 54732:tid 54741] [client 54.37.252.118:35650] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afmIh7GgYlDOb3nfuJScwQAAAEc"]
[Tue May 05 14:04:55.999168 2026] [:error] [pid 25835:tid 25850] [client 54.37.252.118:35090] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afmIh1DT5nGJyh1439yHhwAAAQ0"]
[Tue May 05 14:04:58.436921 2026] [:error] [pid 25744:tid 25777] [client 54.37.252.118:35666] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afmIiiR8IuyzjkW06OOg9QAAAIM"]
[Tue May 05 14:04:58.608615 2026] [:error] [pid 25745:tid 25815] [client 54.37.252.118:35100] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afmIipsd7hb7vrvCNBn95gAAAM4"]
[Tue May 05 14:05:00.561082 2026] [:error] [pid 25744:tid 25780] [client 54.37.252.118:35672] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afmIjCR8IuyzjkW06OOg-gAAAIY"]
[Tue May 05 14:05:01.366158 2026] [:error] [pid 25745:tid 25821] [client 54.37.252.118:35114] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afmIjZsd7hb7vrvCNBn96QAAANQ"]
[Tue May 05 14:05:03.074370 2026] [:error] [pid 25743:tid 25764] [client 54.37.252.118:35126] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afmIj2-PCMRhF5DdUnORWgAAABE"]
[Tue May 05 14:05:03.312670 2026] [:error] [pid 25835:tid 25845] [client 54.37.252.118:35686] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afmIj1DT5nGJyh1439yHlQAAAQg"]
[Tue May 05 14:05:04.964975 2026] [:error] [pid 25835:tid 25837] [client 54.37.252.118:32810] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afmIkFDT5nGJyh1439yHlwAAAQA"]
[Tue May 05 14:05:06.340535 2026] [:error] [pid 25835:tid 25846] [client 54.37.252.118:57096] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afmIklDT5nGJyh1439yHmgAAAQk"]
[Tue May 05 14:05:07.938359 2026] [:error] [pid 54732:tid 54748] [client 54.37.252.118:57112] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afmIk7GgYlDOb3nfuJSc3AAAAE4"]
[Tue May 05 14:05:08.594446 2026] [:error] [pid 25744:tid 25787] [client 54.37.252.118:32812] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afmIlCR8IuyzjkW06OOhAQAAAI0"]
[Tue May 05 14:05:10.578507 2026] [:error] [pid 25835:tid 25857] [client 54.37.252.118:57122] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afmIllDT5nGJyh1439yHpAAAARQ"]
[Tue May 05 14:05:11.641077 2026] [:error] [pid 25835:tid 25848] [client 54.37.252.118:57132] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afmIl1DT5nGJyh1439yHqAAAAQs"]
[Tue May 05 14:05:13.174449 2026] [:error] [pid 54732:tid 54740] [client 54.37.252.118:57138] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afmImbGgYlDOb3nfuJSc5QAAAEY"]
[Tue May 05 14:05:14.305975 2026] [:error] [pid 54732:tid 54737] [client 54.37.252.118:57154] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afmImrGgYlDOb3nfuJSc6QAAAEM"]
[Tue May 05 14:05:15.713597 2026] [:error] [pid 25835:tid 25840] [client 54.37.252.118:56886] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afmIm1DT5nGJyh1439yHrgAAAQM"]
[Tue May 05 14:05:16.893321 2026] [:error] [pid 25743:tid 25752] [client 54.37.252.118:56898] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afmInG-PCMRhF5DdUnORbAAAAAU"]
[Tue May 05 14:05:18.133316 2026] [:error] [pid 25835:tid 25838] [client 54.37.252.118:56908] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afmInlDT5nGJyh1439yHsgAAAQE"]
[Tue May 05 14:05:19.544943 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:56914] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afmIn1DT5nGJyh1439yHtQAAAQY"]
[Tue May 05 14:05:20.058650 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:41474] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afmIoLGgYlDOb3nfuJSc-QAAAFE"]
[Tue May 05 14:05:22.521674 2026] [:error] [pid 25835:tid 25858] [client 54.37.252.118:56924] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afmIolDT5nGJyh1439yHuwAAARU"]
[Tue May 05 14:05:22.626029 2026] [:error] [pid 54732:tid 54754] [client 54.37.252.118:56932] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afmIorGgYlDOb3nfuJSc_gAAAFQ"]
[Tue May 05 14:05:24.725513 2026] [:error] [pid 25745:tid 25816] [client 54.37.252.118:55498] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afmIpJsd7hb7vrvCNBn9_gAAAM8"]
[Tue May 05 14:05:24.951986 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:55504] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afmIpJsd7hb7vrvCNBn-AAAAANc"]
[Tue May 05 14:05:27.362162 2026] [:error] [pid 25745:tid 25825] [client 54.37.252.118:37030] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afmIp5sd7hb7vrvCNBn-BwAAANg"]
[Tue May 05 14:05:27.809881 2026] [:error] [pid 25743:tid 25749] [client 54.37.252.118:37014] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afmIp2-PCMRhF5DdUnORdwAAAAI"]
[Tue May 05 14:05:29.592324 2026] [:error] [pid 25745:tid 25817] [client 54.37.252.118:55518] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afmIqZsd7hb7vrvCNBn-CwAAANA"]
[Tue May 05 14:05:30.012485 2026] [:error] [pid 25835:tid 25839] [client 54.37.252.118:55522] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afmIqlDT5nGJyh1439yHyAAAAQI"]
[Tue May 05 14:05:31.997657 2026] [:error] [pid 25745:tid 25810] [client 54.37.252.118:37032] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afmIq5sd7hb7vrvCNBn-EAAAAMk"]
[Tue May 05 14:05:32.846162 2026] [:error] [pid 25745:tid 25802] [client 54.37.252.118:37042] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afmIrJsd7hb7vrvCNBn-FAAAAME"]
[Tue May 05 14:05:34.726446 2026] [:error] [pid 54732:tid 54758] [client 54.37.252.118:59640] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afmIrrGgYlDOb3nfuJSdHAAAAFg"]
[Tue May 05 14:05:34.733522 2026] [:error] [pid 54732:tid 54734] [client 54.37.252.118:59654] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afmIrrGgYlDOb3nfuJSdHQAAAEA"]
[Tue May 05 14:05:48.585944 2026] [:error] [pid 25744:tid 25776] [client 54.37.252.118:52266] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afmIvCR8IuyzjkW06OOhOgAAAII"]
[Tue May 05 14:05:48.832784 2026] [:error] [pid 54732:tid 54756] [client 54.37.252.118:52274] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afmIvLGgYlDOb3nfuJSdNQAAAFY"]
[Tue May 05 14:05:51.488051 2026] [:error] [pid 54732:tid 54752] [client 54.37.252.118:54754] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afmIv7GgYlDOb3nfuJSdOwAAAFI"]
[Tue May 05 14:05:52.299530 2026] [:error] [pid 54732:tid 54750] [client 54.37.252.118:54770] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afmIwLGgYlDOb3nfuJSdPQAAAFA"]
[Tue May 05 14:05:54.174668 2026] [:error] [pid 54732:tid 54753] [client 54.37.252.118:46120] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afmIwrGgYlDOb3nfuJSdQgAAAFM"]
[Tue May 05 14:05:54.303054 2026] [:error] [pid 25745:tid 25810] [client 54.37.252.118:46128] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afmIwpsd7hb7vrvCNBn-IgAAAMk"]
[Tue May 05 14:05:56.951377 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:59592] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afmIxLGgYlDOb3nfuJSdSAAAAFE"]
[Tue May 05 14:05:57.153024 2026] [:error] [pid 25743:tid 25764] [client 54.37.252.118:59608] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afmIxW-PCMRhF5DdUnORjAAAABE"]
[Tue May 05 14:05:59.132016 2026] [:error] [pid 25835:tid 25842] [client 54.37.252.118:46138] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afmIx1DT5nGJyh1439yH6wAAAQU"]
[Tue May 05 14:05:59.689538 2026] [:error] [pid 25835:tid 25861] [client 54.37.252.118:59618] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afmIx1DT5nGJyh1439yH7QAAARg"]
[Tue May 05 14:06:01.732732 2026] [:error] [pid 25743:tid 25751] [client 54.37.252.118:59632] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afmIyW-PCMRhF5DdUnORjgAAAAQ"]
[Tue May 05 14:06:02.620987 2026] [:error] [pid 54732:tid 54754] [client 54.37.252.118:46146] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afmIyrGgYlDOb3nfuJSdWQAAAFQ"]
[Tue May 05 14:06:03.666006 2026] [:error] [pid 25835:tid 25841] [client 54.37.252.118:46154] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afmIy1DT5nGJyh1439yH8wAAAQQ"]
[Tue May 05 14:06:06.163949 2026] [:error] [pid 54732:tid 54739] [client 54.37.252.118:37220] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afmIzrGgYlDOb3nfuJSdYQAAAEU"]
[Tue May 05 14:06:06.228020 2026] [:error] [pid 54732:tid 54745] [client 54.37.252.118:37230] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afmIzrGgYlDOb3nfuJSdYgAAAEs"]
[Tue May 05 14:06:08.962835 2026] [:error] [pid 25745:tid 25814] [client 54.37.252.118:48766] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afmI0Jsd7hb7vrvCNBn-KAAAAM0"]
[Tue May 05 14:06:09.380632 2026] [:error] [pid 54732:tid 54754] [client 54.37.252.118:37244] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afmI0bGgYlDOb3nfuJSdaQAAAFQ"]
[Tue May 05 14:06:11.701547 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:37246] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afmI01DT5nGJyh1439yH-AAAAQY"]
[Tue May 05 14:06:12.172178 2026] [:error] [pid 54732:tid 54737] [client 54.37.252.118:37256] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afmI1LGgYlDOb3nfuJSdcAAAAEM"]
[Tue May 05 14:06:14.584101 2026] [:error] [pid 25743:tid 25748] [client 54.37.252.118:35608] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afmI1m-PCMRhF5DdUnORlQAAAAE"]
[Tue May 05 14:06:14.770884 2026] [:error] [pid 25745:tid 25804] [client 54.37.252.118:42026] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afmI1psd7hb7vrvCNBn-LQAAAMM"]
[Tue May 05 14:06:17.501986 2026] [:error] [pid 25835:tid 25848] [client 54.37.252.118:42040] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afmI2VDT5nGJyh1439yIBAAAAQs"]
[Tue May 05 14:06:18.149511 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:42048] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afmI2psd7hb7vrvCNBn-NAAAANc"]
[Tue May 05 14:06:19.603050 2026] [:error] [pid 25744:tid 25776] [client 54.37.252.118:35618] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afmI2yR8IuyzjkW06OOhUAAAAII"]
[Tue May 05 14:06:20.851892 2026] [:error] [pid 25744:tid 25791] [client 54.37.252.118:42050] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afmI3CR8IuyzjkW06OOhVQAAAJE"]
[Tue May 05 14:06:22.167958 2026] [:error] [pid 25744:tid 25784] [client 54.37.252.118:42060] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afmI3iR8IuyzjkW06OOhWAAAAIo"]
[Tue May 05 14:06:23.856209 2026] [:error] [pid 25835:tid 25856] [client 54.37.252.118:42068] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afmI31DT5nGJyh1439yIGgAAARM"]
[Tue May 05 14:06:24.547007 2026] [:error] [pid 54732:tid 54745] [client 54.37.252.118:42076] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afmI4LGgYlDOb3nfuJSdgAAAAEs"]
[Tue May 05 14:06:27.077926 2026] [:error] [pid 25835:tid 25858] [client 54.37.252.118:57202] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afmI41DT5nGJyh1439yIJwAAARU"]
[Tue May 05 14:06:27.298561 2026] [:error] [pid 25745:tid 25823] [client 54.37.252.118:57204] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afmI45sd7hb7vrvCNBn-OgAAANY"]
[Tue May 05 14:06:30.070379 2026] [:error] [pid 25744:tid 25797] [client 54.37.252.118:57210] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afmI5iR8IuyzjkW06OOhbAAAAJc"]
[Tue May 05 14:06:30.988864 2026] [:error] [pid 25744:tid 25794] [client 54.37.252.118:57220] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afmI5iR8IuyzjkW06OOhcAAAAJQ"]
[Tue May 05 14:06:32.833436 2026] [:error] [pid 54732:tid 54756] [client 54.37.252.118:57234] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afmI6LGgYlDOb3nfuJSdhwAAAFY"]
[Tue May 05 14:06:33.362654 2026] [:error] [pid 25835:tid 25861] [client 54.37.252.118:48200] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afmI6VDT5nGJyh1439yIXgAAARg"]
[Tue May 05 14:06:34.798682 2026] [:error] [pid 54732:tid 54748] [client 54.37.252.118:46238] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afmI6rGgYlDOb3nfuJSdigAAAE4"]
[Tue May 05 14:06:36.555190 2026] [:error] [pid 54732:tid 54740] [client 54.37.252.118:58420] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afmI7LGgYlDOb3nfuJSdkwAAAEY"]
[Tue May 05 14:06:36.859338 2026] [:error] [pid 54732:tid 54754] [client 54.37.252.118:46240] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afmI7LGgYlDOb3nfuJSdnQAAAFQ"]
[Tue May 05 14:06:38.830167 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:46256] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afmI7rGgYlDOb3nfuJSdqwAAAFE"]
[Tue May 05 14:06:39.624370 2026] [:error] [pid 25744:tid 25796] [client 54.37.252.118:58424] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afmI7yR8IuyzjkW06OOhdAAAAJY"]
[Tue May 05 14:06:40.769547 2026] [:error] [pid 25835:tid 25855] [client 54.37.252.118:46272] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afmI8FDT5nGJyh1439yIbwAAARI"]
[Tue May 05 14:06:42.970815 2026] [:error] [pid 25743:tid 25769] [client 54.37.252.118:58426] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afmI8m-PCMRhF5DdUnOR2QAAABY"]
[Tue May 05 14:06:43.141642 2026] [:error] [pid 25745:tid 25809] [client 54.37.252.118:46278] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afmI85sd7hb7vrvCNBn-bgAAAMg"]
[Tue May 05 14:06:45.278755 2026] [:error] [pid 54732:tid 54739] [client 54.37.252.118:50180] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afmI9bGgYlDOb3nfuJSdtwAAAEU"]
[Tue May 05 14:06:56.999810 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:49420] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afmJAFDT5nGJyh1439yIiQAAAQY"]
[Tue May 05 14:06:58.650658 2026] [:error] [pid 25744:tid 25790] [client 54.37.252.118:41684] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afmJAiR8IuyzjkW06OOhiwAAAJA"]
[Tue May 05 14:06:58.900437 2026] [:error] [pid 25835:tid 25839] [client 54.37.252.118:50202] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afmJAlDT5nGJyh1439yIjwAAAQI"]
[Tue May 05 14:07:01.131608 2026] [:error] [pid 25745:tid 25810] [client 54.37.252.118:53080] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afmJBZsd7hb7vrvCNBn-fQAAAMk"]
[Tue May 05 14:07:01.179024 2026] [:error] [pid 25743:tid 25748] [client 54.37.252.118:49434] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afmJBW-PCMRhF5DdUnOR5wAAAAE"]
[Tue May 05 14:07:03.024102 2026] [:error] [pid 54732:tid 54752] [client 54.37.252.118:49448] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afmJB7GgYlDOb3nfuJSdygAAAFI"]
[Tue May 05 14:07:03.158842 2026] [:error] [pid 54732:tid 54740] [client 54.37.252.118:49454] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afmJB7GgYlDOb3nfuJSdywAAAEY"]
[Tue May 05 14:07:05.720736 2026] [:error] [pid 25744:tid 25786] [client 54.37.252.118:44864] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afmJCSR8IuyzjkW06OOhkAAAAIw"]
[Tue May 05 14:07:06.022279 2026] [:error] [pid 25744:tid 25781] [client 54.37.252.118:44870] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afmJCiR8IuyzjkW06OOhkQAAAIc"]
[Tue May 05 14:07:07.985778 2026] [:error] [pid 54732:tid 54747] [client 54.37.252.118:45816] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afmJC7GgYlDOb3nfuJSd2QAAAE0"]
[Tue May 05 14:07:08.495876 2026] [:error] [pid 54732:tid 54744] [client 54.37.252.118:44884] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afmJDLGgYlDOb3nfuJSd2wAAAEo"]
[Tue May 05 14:07:10.441668 2026] [:error] [pid 54732:tid 54743] [client 54.37.252.118:44898] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afmJDrGgYlDOb3nfuJSd4wAAAEk"]
[Tue May 05 14:07:11.034574 2026] [:error] [pid 25743:tid 25748] [client 54.37.252.118:44914] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afmJD2-PCMRhF5DdUnOR7wAAAAE"]
[Tue May 05 14:07:12.570872 2026] [:error] [pid 25835:tid 25837] [client 54.37.252.118:45830] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afmJEFDT5nGJyh1439yIlgAAAQA"]
[Tue May 05 14:07:13.663434 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:44920] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afmJEbGgYlDOb3nfuJSd9QAAAFE"]
[Tue May 05 14:07:15.077291 2026] [:error] [pid 25835:tid 25838] [client 54.37.252.118:60092] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afmJE1DT5nGJyh1439yImAAAAQE"]
[Tue May 05 14:07:15.855145 2026] [:error] [pid 25744:tid 25785] [client 54.37.252.118:43008] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afmJEyR8IuyzjkW06OOhmgAAAIs"]
[Tue May 05 14:07:17.737996 2026] [:error] [pid 25745:tid 25810] [client 54.37.252.118:60094] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afmJFZsd7hb7vrvCNBn-jAAAAMk"]
[Tue May 05 14:07:18.586345 2026] [:error] [pid 25744:tid 25777] [client 54.37.252.118:60108] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afmJFiR8IuyzjkW06OOhnQAAAIM"]
[Tue May 05 14:07:19.933398 2026] [:error] [pid 25835:tid 25846] [client 54.37.252.118:43014] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afmJF1DT5nGJyh1439yIngAAAQk"]
[Tue May 05 14:07:21.163981 2026] [:error] [pid 25835:tid 25841] [client 54.37.252.118:60120] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afmJGVDT5nGJyh1439yIpAAAAQQ"]
[Tue May 05 14:07:22.396758 2026] [:error] [pid 25835:tid 25853] [client 54.37.252.118:60136] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afmJGlDT5nGJyh1439yIqgAAARA"]
[Tue May 05 14:07:23.045076 2026] [:error] [pid 54732:tid 54744] [client 54.37.252.118:43020] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afmJG7GgYlDOb3nfuJSd_AAAAEo"]
[Tue May 05 14:07:24.493040 2026] [:error] [pid 25835:tid 25861] [client 54.37.252.118:52996] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afmJHFDT5nGJyh1439yIrwAAARg"]
[Tue May 05 14:07:25.590002 2026] [:error] [pid 54732:tid 54746] [client 54.37.252.118:59610] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afmJHbGgYlDOb3nfuJSd_wAAAEw"]
[Tue May 05 14:07:27.041955 2026] [:error] [pid 54732:tid 54747] [client 54.37.252.118:59622] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afmJH7GgYlDOb3nfuJSeAgAAAE0"]
[Tue May 05 14:07:27.653764 2026] [:error] [pid 54732:tid 54757] [client 54.37.252.118:53000] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afmJH7GgYlDOb3nfuJSeBAAAAFc"]
[Tue May 05 14:07:29.128735 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:53008] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afmJIbGgYlDOb3nfuJSeCAAAAFE"]
[Tue May 05 14:07:30.195840 2026] [:error] [pid 25745:tid 25819] [client 54.37.252.118:59638] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afmJIpsd7hb7vrvCNBn-mgAAANI"]
[Tue May 05 14:07:31.730988 2026] [:error] [pid 25835:tid 25853] [client 54.37.252.118:59642] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afmJI1DT5nGJyh1439yItQAAARA"]
[Tue May 05 14:07:32.285775 2026] [:error] [pid 25743:tid 25770] [client 54.37.252.118:53014] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afmJJG-PCMRhF5DdUnOR_wAAABc"]
[Tue May 05 14:07:34.275505 2026] [:error] [pid 25743:tid 25754] [client 54.37.252.118:59656] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afmJJm-PCMRhF5DdUnOSAQAAAAc"]
[Tue May 05 14:07:34.854811 2026] [:error] [pid 54732:tid 54740] [client 54.37.252.118:49296] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afmJJrGgYlDOb3nfuJSeDQAAAEY"]
[Tue May 05 14:07:36.311689 2026] [:error] [pid 25743:tid 25748] [client 54.37.252.118:47346] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afmJKG-PCMRhF5DdUnOSBAAAAAE"]
[Tue May 05 14:07:37.360316 2026] [:error] [pid 25835:tid 25861] [client 54.37.252.118:49312] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afmJKVDT5nGJyh1439yIvQAAARg"]
[Tue May 05 14:07:39.014460 2026] [:error] [pid 25835:tid 25859] [client 54.37.252.118:49320] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afmJK1DT5nGJyh1439yIwAAAARY"]
[Tue May 05 14:07:39.371367 2026] [:error] [pid 25745:tid 25809] [client 54.37.252.118:47354] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afmJK5sd7hb7vrvCNBn-pQAAAMg"]
[Tue May 05 14:07:41.116992 2026] [:error] [pid 54732:tid 54742] [client 54.37.252.118:47358] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afmJLbGgYlDOb3nfuJSeDwAAAEg"]
[Tue May 05 14:07:41.762595 2026] [:error] [pid 25745:tid 25811] [client 54.37.252.118:49332] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afmJLZsd7hb7vrvCNBn-rQAAAMo"]
[Tue May 05 14:07:43.532383 2026] [:error] [pid 25745:tid 25804] [client 54.37.252.118:49344] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afmJL5sd7hb7vrvCNBn-tgAAAMM"]
[Tue May 05 14:07:43.805968 2026] [:error] [pid 25745:tid 25819] [client 54.37.252.118:47368] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afmJL5sd7hb7vrvCNBn-twAAANI"]
[Tue May 05 14:07:45.989255 2026] [:error] [pid 54732:tid 54746] [client 54.37.252.118:44330] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afmJMbGgYlDOb3nfuJSeEwAAAEw"]
[Tue May 05 14:07:46.584711 2026] [:error] [pid 25745:tid 25807] [client 54.37.252.118:44334] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "afmJMpsd7hb7vrvCNBn-vAAAAMY"]
[Tue May 05 14:07:48.490191 2026] [:error] [pid 25745:tid 25808] [client 54.37.252.118:44350] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afmJNJsd7hb7vrvCNBn-wQAAAMc"]
[Tue May 05 14:07:48.591274 2026] [:error] [pid 25835:tid 25857] [client 54.37.252.118:49252] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afmJNFDT5nGJyh1439yIygAAARQ"]
[Tue May 05 14:07:51.146271 2026] [:error] [pid 25835:tid 25845] [client 54.37.252.118:44372] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afmJN1DT5nGJyh1439yIzQAAAQg"]
[Tue May 05 14:07:51.228630 2026] [:error] [pid 25835:tid 25844] [client 54.37.252.118:44360] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afmJN1DT5nGJyh1439yIzgAAAQc"]
[Tue May 05 14:07:53.361106 2026] [:error] [pid 25835:tid 25860] [client 54.37.252.118:49258] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afmJOVDT5nGJyh1439yI0QAAARc"]
[Tue May 05 14:07:53.884844 2026] [:error] [pid 25835:tid 25842] [client 54.37.252.118:44384] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afmJOVDT5nGJyh1439yI0gAAAQU"]
[Tue May 05 14:07:55.823846 2026] [:error] [pid 25743:tid 25765] [client 54.37.252.118:33324] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afmJO2-PCMRhF5DdUnOSEAAAABI"]
[Tue May 05 14:07:55.930463 2026] [:error] [pid 54732:tid 54755] [client 54.37.252.118:34572] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afmJO7GgYlDOb3nfuJSeGQAAAFU"]
[Tue May 05 14:08:08.038654 2026] [:error] [pid 25744:tid 25778] [client 54.37.252.118:33336] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afmJSCR8IuyzjkW06OOhrwAAAIQ"]
[Tue May 05 14:08:09.132957 2026] [:error] [pid 25745:tid 25825] [client 54.37.252.118:44606] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afmJSZsd7hb7vrvCNBn-4QAAANg"]
[Tue May 05 14:08:10.003465 2026] [:error] [pid 25835:tid 25838] [client 54.37.252.118:44614] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afmJSlDT5nGJyh1439yI8AAAAQE"]
[Tue May 05 14:08:10.709123 2026] [:error] [pid 25835:tid 25858] [client 54.37.252.118:33346] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afmJSlDT5nGJyh1439yI8QAAARU"]
[Tue May 05 14:08:12.604915 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:49290] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afmJTFDT5nGJyh1439yI-QAAAQY"]
[Tue May 05 14:08:13.123819 2026] [:error] [pid 54732:tid 54746] [client 54.37.252.118:49300] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afmJTbGgYlDOb3nfuJSeJAAAAEw"]
[Tue May 05 14:08:14.790083 2026] [:error] [pid 54732:tid 54752] [client 54.37.252.118:53870] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afmJTrGgYlDOb3nfuJSeJQAAAFI"]
[Tue May 05 14:08:15.177390 2026] [:error] [pid 25835:tid 25856] [client 54.37.252.118:53872] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afmJT1DT5nGJyh1439yI_QAAARM"]
[Tue May 05 14:08:16.881122 2026] [:error] [pid 25745:tid 25825] [client 54.37.252.118:53886] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afmJUJsd7hb7vrvCNBn-6wAAANg"]
[Tue May 05 14:08:17.941421 2026] [:error] [pid 54732:tid 54736] [client 54.37.252.118:43836] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afmJUbGgYlDOb3nfuJSeKAAAAEI"]
[Tue May 05 14:08:19.536572 2026] [:error] [pid 25745:tid 25809] [client 54.37.252.118:43848] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afmJU5sd7hb7vrvCNBn-7gAAAMg"]
[Tue May 05 14:08:19.877334 2026] [:error] [pid 54732:tid 54740] [client 54.37.252.118:53894] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afmJU7GgYlDOb3nfuJSeLAAAAEY"]
[Tue May 05 14:08:21.561204 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:53906] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afmJVZsd7hb7vrvCNBn-8gAAANc"]
[Tue May 05 14:08:22.370089 2026] [:error] [pid 25835:tid 25846] [client 54.37.252.118:43860] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afmJVlDT5nGJyh1439yJCQAAAQk"]
[Tue May 05 14:08:24.075230 2026] [:error] [pid 54732:tid 54739] [client 54.37.252.118:43870] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afmJWLGgYlDOb3nfuJSeNgAAAEU"]
[Tue May 05 14:08:24.905730 2026] [:error] [pid 25835:tid 25860] [client 54.37.252.118:43806] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afmJWFDT5nGJyh1439yJDAAAARc"]
[Tue May 05 14:08:26.094886 2026] [:error] [pid 25743:tid 25762] [client 54.37.252.118:59918] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afmJWm-PCMRhF5DdUnOSIAAAAA8"]
[Tue May 05 14:08:26.720297 2026] [:error] [pid 54732:tid 54755] [client 54.37.252.118:59932] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afmJWrGgYlDOb3nfuJSeQAAAAFU"]
[Tue May 05 14:08:28.461519 2026] [:error] [pid 25744:tid 25783] [client 54.37.252.118:43808] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afmJXCR8IuyzjkW06OOhswAAAIk"]
[Tue May 05 14:08:29.256966 2026] [:error] [pid 54732:tid 54745] [client 54.37.252.118:43816] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afmJXbGgYlDOb3nfuJSeVAAAAEs"]
[Tue May 05 14:08:30.682094 2026] [:error] [pid 25743:tid 25768] [client 54.37.252.118:59936] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afmJXm-PCMRhF5DdUnOSKAAAABU"]
[Tue May 05 14:08:31.026533 2026] [:error] [pid 54732:tid 54757] [client 54.37.252.118:59948] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afmJX7GgYlDOb3nfuJSeWgAAAFc"]
[Tue May 05 14:08:33.121011 2026] [:error] [pid 25743:tid 25756] [client 54.37.252.118:59956] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afmJYW-PCMRhF5DdUnOSLAAAAAk"]
[Tue May 05 14:08:33.237196 2026] [:error] [pid 54732:tid 54747] [client 54.37.252.118:43818] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afmJYbGgYlDOb3nfuJSeYgAAAE0"]
[Tue May 05 14:08:35.368193 2026] [:error] [pid 25835:tid 25855] [client 54.37.252.118:48340] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afmJY1DT5nGJyh1439yJEgAAARI"]
[Tue May 05 14:08:35.601840 2026] [:error] [pid 25745:tid 25818] [client 54.37.252.118:58594] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afmJY5sd7hb7vrvCNBn--QAAANE"]
[Tue May 05 14:08:37.659768 2026] [:error] [pid 54732:tid 54753] [client 54.37.252.118:48342] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afmJZbGgYlDOb3nfuJSeZwAAAFM"]
[Tue May 05 14:08:37.916929 2026] [:error] [pid 25745:tid 25825] [client 54.37.252.118:58610] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afmJZZsd7hb7vrvCNBn--wAAANg"]
[Tue May 05 14:08:40.183524 2026] [:error] [pid 54732:tid 54752] [client 54.37.252.118:58616] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afmJaLGgYlDOb3nfuJSeaQAAAFI"]
[Tue May 05 14:08:40.371983 2026] [:error] [pid 25745:tid 25822] [client 54.37.252.118:58624] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afmJaJsd7hb7vrvCNBn-_wAAANU"]
[Tue May 05 14:08:42.239625 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:48346] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afmJapsd7hb7vrvCNBn_BQAAANc"]
[Tue May 05 14:08:42.934328 2026] [:error] [pid 25745:tid 25802] [client 54.37.252.118:58632] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afmJapsd7hb7vrvCNBn_BgAAAME"]
[Tue May 05 14:08:44.681299 2026] [:error] [pid 25835:tid 25848] [client 54.37.252.118:35132] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afmJbFDT5nGJyh1439yJIAAAAQs"]
[Tue May 05 14:08:45.425175 2026] [:error] [pid 25745:tid 25819] [client 54.37.252.118:35136] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afmJbZsd7hb7vrvCNBn_CgAAANI"]
[Tue May 05 14:08:46.683741 2026] [:error] [pid 25745:tid 25816] [client 54.37.252.118:36216] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afmJbpsd7hb7vrvCNBn_DQAAAM8"]
[Tue May 05 14:08:47.972177 2026] [:error] [pid 25835:tid 25856] [client 54.37.252.118:35146] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afmJb1DT5nGJyh1439yJIwAAARM"]
[Tue May 05 14:08:49.159669 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:35148] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afmJcbGgYlDOb3nfuJSebwAAAFE"]
[Tue May 05 14:08:50.735006 2026] [:error] [pid 25744:tid 25782] [client 54.37.252.118:35150] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afmJciR8IuyzjkW06OOhuwAAAIg"]
[Tue May 05 14:08:51.075001 2026] [:error] [pid 54732:tid 54757] [client 54.37.252.118:36222] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afmJc7GgYlDOb3nfuJSecgAAAFc"]
[Tue May 05 14:08:53.436280 2026] [:error] [pid 25835:tid 25859] [client 54.37.252.118:35160] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afmJdVDT5nGJyh1439yJKAAAARY"]
[Tue May 05 14:08:53.630443 2026] [:error] [pid 25835:tid 25851] [client 54.37.252.118:35172] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afmJdVDT5nGJyh1439yJKgAAAQ4"]
[Tue May 05 14:08:56.022933 2026] [:error] [pid 25745:tid 25807] [client 54.37.252.118:38566] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afmJeJsd7hb7vrvCNBn_FAAAAMY"]
[Tue May 05 14:08:56.076564 2026] [:error] [pid 25745:tid 25808] [client 54.37.252.118:38578] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afmJeJsd7hb7vrvCNBn_FgAAAMc"]
[Tue May 05 14:08:58.459688 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:38586] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afmJerGgYlDOb3nfuJSeeQAAAFE"]
[Tue May 05 14:08:58.601275 2026] [:error] [pid 25744:tid 25778] [client 54.37.252.118:38602] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afmJeiR8IuyzjkW06OOhwwAAAIQ"]
[Tue May 05 14:09:00.964079 2026] [:error] [pid 25835:tid 25858] [client 54.37.252.118:38612] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afmJfFDT5nGJyh1439yJMAAAARU"]
[Tue May 05 14:09:01.234143 2026] [:error] [pid 25743:tid 25764] [client 54.37.252.118:38616] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afmJfW-PCMRhF5DdUnOSPAAAABE"]
[Tue May 05 14:09:03.326539 2026] [:error] [pid 54732:tid 54749] [client 54.37.252.118:38628] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afmJf7GgYlDOb3nfuJSefAAAAE8"]
[Tue May 05 14:09:03.659005 2026] [:error] [pid 54732:tid 54754] [client 54.37.252.118:38636] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afmJf7GgYlDOb3nfuJSefQAAAFQ"]
[Tue May 05 14:09:05.808175 2026] [:error] [pid 54732:tid 54753] [client 54.37.252.118:36800] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afmJgbGgYlDOb3nfuJSegQAAAFM"]
[Tue May 05 14:09:06.148736 2026] [:error] [pid 25835:tid 25839] [client 54.37.252.118:36802] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afmJglDT5nGJyh1439yJOAAAAQI"]
[Tue May 05 14:09:18.238183 2026] [:error] [pid 25835:tid 25848] [client 54.37.252.118:54730] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afmJjlDT5nGJyh1439yJQAAAAQs"]
[Tue May 05 14:09:18.574559 2026] [:error] [pid 25745:tid 25803] [client 54.37.252.118:36808] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afmJjpsd7hb7vrvCNBn_MQAAAMI"]
[Tue May 05 14:09:20.319198 2026] [:error] [pid 25744:tid 25778] [client 54.37.252.118:60928] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afmJkCR8IuyzjkW06OOh1gAAAIQ"]
[Tue May 05 14:09:20.964602 2026] [:error] [pid 25745:tid 25807] [client 54.37.252.118:49296] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afmJkJsd7hb7vrvCNBn_MwAAAMY"]
[Tue May 05 14:09:22.164969 2026] [:error] [pid 54732:tid 54756] [client 54.37.252.118:60932] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afmJkrGgYlDOb3nfuJSejgAAAFY"]
[Tue May 05 14:09:22.380144 2026] [:error] [pid 25835:tid 25858] [client 54.37.252.118:60940] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afmJklDT5nGJyh1439yJQwAAARU"]
[Tue May 05 14:09:24.331103 2026] [:error] [pid 54732:tid 54751] [client 54.37.252.118:42048] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afmJlLGgYlDOb3nfuJSekgAAAFE"]
[Tue May 05 14:09:25.987857 2026] [:error] [pid 54732:tid 54758] [client 54.37.252.118:42050] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afmJlbGgYlDOb3nfuJSelgAAAFg"]
[Tue May 05 14:09:26.312135 2026] [:error] [pid 54732:tid 54736] [client 54.37.252.118:42066] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afmJlrGgYlDOb3nfuJSelwAAAEI"]
[Tue May 05 14:09:28.371901 2026] [:error] [pid 25745:tid 25810] [client 54.37.252.118:42080] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afmJmJsd7hb7vrvCNBn_QwAAAMk"]
[Tue May 05 14:09:30.389778 2026] [:error] [pid 25744:tid 25794] [client 54.37.252.118:42086] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afmJmiR8IuyzjkW06OOh4QAAAJQ"]
[Tue May 05 14:09:32.346151 2026] [:error] [pid 25745:tid 25823] [client 54.37.252.118:42092] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afmJnJsd7hb7vrvCNBn_TAAAANY"]
[Tue May 05 14:09:34.160924 2026] [:error] [pid 25835:tid 25860] [client 54.37.252.118:57896] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afmJnlDT5nGJyh1439yJUgAAARc"]
[Tue May 05 14:09:36.158105 2026] [:error] [pid 54732:tid 54735] [client 54.37.252.118:57908] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afmJoLGgYlDOb3nfuJSepgAAAEE"]
[Tue May 05 14:09:38.038021 2026] [:error] [pid 54732:tid 54749] [client 54.37.252.118:57912] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afmJorGgYlDOb3nfuJSeqAAAAE8"]
[Tue May 05 14:09:40.120815 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:57924] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afmJpFDT5nGJyh1439yJXQAAAQY"]
[Tue May 05 14:09:41.997615 2026] [:error] [pid 54732:tid 54757] [client 54.37.252.118:57930] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afmJpbGgYlDOb3nfuJSesQAAAFc"]
[Tue May 05 14:09:43.926206 2026] [:error] [pid 25745:tid 25817] [client 54.37.252.118:57940] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afmJp5sd7hb7vrvCNBn_VQAAANA"]
[Tue May 05 14:09:45.766488 2026] [:error] [pid 25743:tid 25749] [client 54.37.252.118:50550] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afmJqW-PCMRhF5DdUnOSbQAAAAI"]
[Tue May 05 14:09:47.576524 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:50554] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afmJq1DT5nGJyh1439yJYQAAAQY"]
[Tue May 05 14:09:49.469769 2026] [:error] [pid 25835:tid 25845] [client 54.37.252.118:50570] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afmJrVDT5nGJyh1439yJZAAAAQg"]
[Tue May 05 14:09:51.389380 2026] [:error] [pid 25745:tid 25811] [client 54.37.252.118:50584] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afmJr5sd7hb7vrvCNBn_YgAAAMo"]
[Tue May 05 14:09:53.473989 2026] [:error] [pid 54732:tid 54734] [client 54.37.252.118:50594] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afmJsbGgYlDOb3nfuJSewAAAAEA"]
[Tue May 05 14:09:55.375930 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:42770] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afmJs5sd7hb7vrvCNBn_ZgAAANc"]
[Tue May 05 14:09:57.333647 2026] [:error] [pid 25835:tid 25855] [client 54.37.252.118:42776] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afmJtVDT5nGJyh1439yJcAAAARI"]
[Tue May 05 14:09:59.204118 2026] [:error] [pid 25835:tid 25852] [client 54.37.252.118:42778] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afmJt1DT5nGJyh1439yJeQAAAQ8"]
[Tue May 05 14:10:01.133358 2026] [:error] [pid 25745:tid 25824] [client 54.37.252.118:42792] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afmJuZsd7hb7vrvCNBn_agAAANc"]
[Tue May 05 14:10:03.190963 2026] [:error] [pid 25743:tid 25752] [client 54.37.252.118:42808] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afmJu2-PCMRhF5DdUnOSdAAAAAU"]
[Tue May 05 14:10:05.096673 2026] [:error] [pid 25744:tid 25783] [client 54.37.252.118:47314] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afmJvSR8IuyzjkW06OOh6QAAAIk"]
[Tue May 05 14:10:07.010998 2026] [:error] [pid 25743:tid 25769] [client 54.37.252.118:47324] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afmJv2-PCMRhF5DdUnOSdwAAABY"]
[Tue May 05 14:10:08.921540 2026] [:error] [pid 54732:tid 54758] [client 54.37.252.118:47326] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afmJwLGgYlDOb3nfuJSewwAAAFg"]
[Tue May 05 14:10:10.978714 2026] [:error] [pid 25835:tid 25843] [client 54.37.252.118:47336] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afmJwlDT5nGJyh1439yJjgAAAQY"]
[Tue May 05 14:10:12.877843 2026] [:error] [pid 25835:tid 25840] [client 54.37.252.118:47342] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afmJxFDT5nGJyh1439yJkgAAAQM"]
[Tue May 05 14:10:14.916327 2026] [:error] [pid 54732:tid 54750] [client 54.37.252.118:34616] [client 54.37.252.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afmJxrGgYlDOb3nfuJSeyQAAAFA"]
[Tue May 05 14:49:48.617181 2026] [:error] [pid 54732:tid 54740] [client 43.164.1.211:59968] [client 43.164.1.211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afmTDLGgYlDOb3nfuJSyTAAAAEY"]
[Tue May 05 15:55:24.881638 2026] [:error] [pid 54732:tid 54757] [client 43.166.226.186:42780] [client 43.166.226.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afmibLGgYlDOb3nfuJTT0gAAAFc"]
[Tue May 05 16:14:24.334286 2026] [proxy_fcgi:error] [pid 25835:tid 25842] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.368144 2026] [proxy_fcgi:error] [pid 25835:tid 25849] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.385873 2026] [proxy_fcgi:error] [pid 25835:tid 25860] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.423679 2026] [proxy_fcgi:error] [pid 25835:tid 25859] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.441065 2026] [proxy_fcgi:error] [pid 25835:tid 25841] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.504282 2026] [proxy_fcgi:error] [pid 25835:tid 25861] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.523649 2026] [proxy_fcgi:error] [pid 25835:tid 25854] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.540818 2026] [proxy_fcgi:error] [pid 25835:tid 25837] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:24.592569 2026] [proxy_fcgi:error] [pid 25835:tid 25847] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:26.224292 2026] [proxy_fcgi:error] [pid 25835:tid 25856] [client 20.92.81.103:1465] AH01071: Got error 'Primary script unknown'
[Tue May 05 16:14:26.257475 2026] [:error] [pid 25835:tid 25851] [client 20.92.81.103:1465] [client 20.92.81.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afmm4lDT5nGJyh1439yv-AAAAQ4"]
[Tue May 05 16:14:26.370852 2026] [:error] [pid 25835:tid 25848] [client 20.92.81.103:2543] [client 20.92.81.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afmm4lDT5nGJyh1439yv-QAAAQs"]
[Tue May 05 16:14:26.437200 2026] [:error] [pid 25835:tid 25845] [client 20.92.81.103:2559] [client 20.92.81.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afmm4lDT5nGJyh1439yv-gAAAQg"]
[Tue May 05 16:14:26.502056 2026] [:error] [pid 54732:tid 54737] [client 20.92.81.103:2634] [client 20.92.81.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afmm4rGgYlDOb3nfuJTa5wAAAEM"]
[Tue May 05 16:15:22.775485 2026] [:error] [pid 25835:tid 25849] [client 86.97.165.63:53257] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afmnGlDT5nGJyh1439ywTAAAAQw"]
[Tue May 05 16:15:22.786080 2026] [proxy_fcgi:error] [pid 25835:tid 25849] [client 86.97.165.63:53257] AH01071: Got error 'Primary script unknown'
[Tue May 05 17:34:50.033696 2026] [:error] [pid 25745:tid 25811] [client 54.36.179.84:35490] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afm5upsd7hb7vrvCNBkyBgAAAMo"]
[Tue May 05 17:34:52.492799 2026] [:error] [pid 54732:tid 54737] [client 54.36.179.84:52666] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afm5vLGgYlDOb3nfuJT-8AAAAEM"]
[Tue May 05 17:34:54.402965 2026] [:error] [pid 25835:tid 25850] [client 54.36.179.84:55748] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afm5vlDT5nGJyh1439zGfgAAAQ0"]
[Tue May 05 17:34:56.341222 2026] [:error] [pid 25744:tid 25775] [client 54.36.179.84:47686] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afm5wCR8IuyzjkW06OPIgAAAAIE"]
[Tue May 05 17:34:58.944165 2026] [:error] [pid 25744:tid 25783] [client 54.36.179.84:45958] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afm5wiR8IuyzjkW06OPIhwAAAIk"]
[Tue May 05 17:35:00.882446 2026] [:error] [pid 25744:tid 25791] [client 54.36.179.84:47702] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afm5xCR8IuyzjkW06OPIjwAAAJE"]
[Tue May 05 17:35:03.260625 2026] [:error] [pid 25835:tid 25860] [client 54.36.179.84:45960] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afm5x1DT5nGJyh1439zGiQAAARc"]
[Tue May 05 17:35:05.173882 2026] [:error] [pid 25743:tid 25755] [client 54.36.179.84:47708] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afm5yW-PCMRhF5DdUnOzzAAAAAg"]
[Tue May 05 17:35:07.057919 2026] [:error] [pid 25745:tid 25820] [client 54.36.179.84:60298] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afm5y5sd7hb7vrvCNBkyLwAAANM"]
[Tue May 05 17:35:08.970971 2026] [:error] [pid 54732:tid 54734] [client 54.36.179.84:60312] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afm5zLGgYlDOb3nfuJT--wAAAEA"]
[Tue May 05 17:35:10.863835 2026] [:error] [pid 25835:tid 25840] [client 54.36.179.84:60326] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afm5zlDT5nGJyh1439zGmwAAAQM"]
[Tue May 05 17:35:12.785067 2026] [:error] [pid 25835:tid 25851] [client 54.36.179.84:60336] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afm50FDT5nGJyh1439zGowAAAQ4"]
[Tue May 05 17:35:14.709972 2026] [:error] [pid 25743:tid 25757] [client 54.36.179.84:60342] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afm50m-PCMRhF5DdUnOz0AAAAAo"]
[Tue May 05 17:35:17.280825 2026] [:error] [pid 25835:tid 25838] [client 54.36.179.84:40562] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afm51VDT5nGJyh1439zGsgAAAQE"]
[Tue May 05 17:35:19.712727 2026] [:error] [pid 54732:tid 54743] [client 54.36.179.84:40568] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afm517GgYlDOb3nfuJT_AQAAAEk"]
[Tue May 05 17:35:22.925076 2026] [:error] [pid 54732:tid 54751] [client 54.36.179.84:37030] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afm52rGgYlDOb3nfuJT_BQAAAFE"]
[Tue May 05 17:35:26.654475 2026] [:error] [pid 25744:tid 25776] [client 54.36.179.84:44546] [client 54.36.179.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afm53iR8IuyzjkW06OPIuQAAAII"]
[Tue May 05 21:27:53.855323 2026] [:error] [pid 25743:tid 25756] [client 43.159.132.207:36386] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afnwWW-PCMRhF5DdUnP14QAAAAk"]
[Tue May 05 23:39:49.465545 2026] [:error] [pid 25744:tid 25774] [client 192.129.178.51:36718] [client 192.129.178.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.129.178.51, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afoPRSR8IuyzjkW06OMVjwAAAIA"]
[Tue May 05 23:39:49.475967 2026] [proxy_fcgi:error] [pid 25744:tid 25774] [client 192.129.178.51:36718] AH01071: Got error 'Primary script unknown'
[Tue May 05 23:39:49.640742 2026] [:error] [pid 2324:tid 2346] [client 192.129.178.51:36748] [client 192.129.178.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.129.178.51, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afoPRWqe2hrcI52A1Hy-rAAAAVQ"]
[Tue May 05 23:39:49.649325 2026] [proxy_fcgi:error] [pid 2324:tid 2346] [client 192.129.178.51:36748] AH01071: Got error 'Primary script unknown'
[Wed May 06 02:34:56.102386 2026] [:error] [pid 25835:tid 25849] [client 2.26.12.101:19594] [client 2.26.12.101] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afo4UFDT5nGJyh1439wTXAAAAQw"]
[Wed May 06 02:57:21.136538 2026] [:error] [pid 25744:tid 25780] [client 175.27.171.245:51564] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afo9kSR8IuyzjkW06OM9oAAAAIY"]
[Wed May 06 03:12:22.186444 2026] [:error] [pid 2324:tid 2347] [client 51.75.119.75:60684] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afpBFmqe2hrcI52A1HwDWQAAAVU"]
[Wed May 06 03:12:24.122710 2026] [:error] [pid 2324:tid 2327] [client 51.75.119.75:34362] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afpBGGqe2hrcI52A1HwDYgAAAUE"]
[Wed May 06 03:12:25.935510 2026] [:error] [pid 2324:tid 2327] [client 51.75.119.75:34370] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afpBGWqe2hrcI52A1HwDaQAAAUE"]
[Wed May 06 03:12:27.985962 2026] [:error] [pid 25835:tid 25841] [client 51.75.119.75:34380] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afpBG1DT5nGJyh1439wYtwAAAQQ"]
[Wed May 06 03:12:30.037406 2026] [:error] [pid 25835:tid 25857] [client 51.75.119.75:34382] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afpBHlDT5nGJyh1439wYvgAAARQ"]
[Wed May 06 03:12:32.122625 2026] [:error] [pid 25743:tid 25753] [client 51.75.119.75:34388] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afpBIG-PCMRhF5DdUnNOJwAAAAY"]
[Wed May 06 03:12:34.175859 2026] [:error] [pid 25744:tid 25777] [client 51.75.119.75:36324] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afpBIiR8IuyzjkW06ONBGwAAAIM"]
[Wed May 06 03:12:36.097106 2026] [:error] [pid 25744:tid 25795] [client 51.75.119.75:36336] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afpBJCR8IuyzjkW06ONBHQAAAJU"]
[Wed May 06 03:12:38.087385 2026] [:error] [pid 2324:tid 2330] [client 51.75.119.75:36342] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afpBJmqe2hrcI52A1HwDfQAAAUQ"]
[Wed May 06 03:12:39.978155 2026] [:error] [pid 25835:tid 25849] [client 51.75.119.75:36344] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afpBJ1DT5nGJyh1439wYygAAAQw"]
[Wed May 06 03:12:42.031906 2026] [:error] [pid 25743:tid 25757] [client 51.75.119.75:36350] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afpBKm-PCMRhF5DdUnNOOAAAAAo"]
[Wed May 06 03:12:44.053343 2026] [:error] [pid 2324:tid 2341] [client 51.75.119.75:45258] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afpBLGqe2hrcI52A1HwDggAAAU8"]
[Wed May 06 03:12:45.966396 2026] [:error] [pid 25743:tid 25754] [client 51.75.119.75:45274] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afpBLW-PCMRhF5DdUnNOQAAAAAc"]
[Wed May 06 03:12:48.095275 2026] [:error] [pid 2324:tid 2330] [client 51.75.119.75:45286] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afpBMGqe2hrcI52A1HwDiQAAAUQ"]
[Wed May 06 03:12:50.131302 2026] [:error] [pid 2324:tid 2349] [client 51.75.119.75:45294] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afpBMmqe2hrcI52A1HwDkAAAAVc"]
[Wed May 06 03:12:52.205565 2026] [:error] [pid 25743:tid 25759] [client 51.75.119.75:45310] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afpBNG-PCMRhF5DdUnNOSgAAAAw"]
[Wed May 06 03:12:54.007843 2026] [:error] [pid 54732:tid 54748] [client 51.75.119.75:37726] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afpBNrGgYlDOb3nfuJRkywAAAE4"]
[Wed May 06 03:12:55.987588 2026] [:error] [pid 2324:tid 2340] [client 51.75.119.75:37738] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afpBN2qe2hrcI52A1HwDnAAAAU4"]
[Wed May 06 03:12:57.905088 2026] [:error] [pid 25835:tid 25845] [client 51.75.119.75:37744] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afpBOVDT5nGJyh1439wY1gAAAQg"]
[Wed May 06 03:12:59.886107 2026] [:error] [pid 25745:tid 25823] [client 51.75.119.75:37756] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afpBO5sd7hb7vrvCNBl7gAAAANY"]
[Wed May 06 03:13:01.885655 2026] [:error] [pid 2324:tid 2326] [client 51.75.119.75:37770] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afpBPWqe2hrcI52A1HwDogAAAUA"]
[Wed May 06 03:13:03.992297 2026] [:error] [pid 25745:tid 25811] [client 51.75.119.75:47170] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afpBP5sd7hb7vrvCNBl7ggAAAMo"]
[Wed May 06 03:13:05.863079 2026] [:error] [pid 25743:tid 25750] [client 51.75.119.75:47172] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afpBQW-PCMRhF5DdUnNOVAAAAAM"]
[Wed May 06 03:13:07.843603 2026] [:error] [pid 25745:tid 25801] [client 51.75.119.75:47182] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afpBQ5sd7hb7vrvCNBl7hwAAAMA"]
[Wed May 06 03:13:09.822371 2026] [:error] [pid 25744:tid 25786] [client 51.75.119.75:47190] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afpBRSR8IuyzjkW06ONBPgAAAIw"]
[Wed May 06 03:13:11.775914 2026] [:error] [pid 2324:tid 2326] [client 51.75.119.75:47200] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afpBR2qe2hrcI52A1HwDqAAAAUA"]
[Wed May 06 03:13:13.620402 2026] [:error] [pid 2324:tid 2334] [client 51.75.119.75:47212] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afpBSWqe2hrcI52A1HwDrgAAAUg"]
[Wed May 06 03:13:15.412916 2026] [:error] [pid 25745:tid 25814] [client 51.75.119.75:37072] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afpBS5sd7hb7vrvCNBl7jgAAAM0"]
[Wed May 06 03:13:17.689985 2026] [:error] [pid 25745:tid 25824] [client 51.75.119.75:37082] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afpBTZsd7hb7vrvCNBl7kgAAANc"]
[Wed May 06 03:13:40.087493 2026] [:error] [pid 25743:tid 25750] [client 51.75.119.75:37092] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afpBZG-PCMRhF5DdUnNOmgAAAAM"]
[Wed May 06 03:13:42.152897 2026] [:error] [pid 25743:tid 25761] [client 51.75.119.75:54240] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afpBZm-PCMRhF5DdUnNOngAAAA4"]
[Wed May 06 03:13:44.063417 2026] [:error] [pid 25743:tid 25759] [client 51.75.119.75:49534] [client 51.75.119.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afpBaG-PCMRhF5DdUnNOogAAAAw"]
[Wed May 06 04:13:45.390506 2026] [:error] [pid 48759:tid 48842] [client 43.159.128.247:58118] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afpPeamcftH9JrQl_yG1lgAAAJQ"]
[Wed May 06 05:17:55.430076 2026] [:error] [pid 48867:tid 48872] [client 43.130.3.122:50914] [client 43.130.3.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afpeg1ZQ-8ZcCbMZPy4BDAAAAMI"]
[Wed May 06 06:34:09.867327 2026] [:error] [pid 48759:tid 48841] [client 104.196.99.52:59670] [client 104.196.99.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "afpwYamcftH9JrQl_yHYHwAAAJM"]
[Wed May 06 08:05:01.191392 2026] [:error] [pid 13443:tid 13449] [client 145.239.65.236:55006] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afqFrQCyfZallDmsQrdWewAAAUQ"]
[Wed May 06 08:05:05.316327 2026] [:error] [pid 9664:tid 9779] [client 145.239.65.236:33758] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afqFsQH4OZbrg1SjsBO4oQAAAJE"]
[Wed May 06 08:05:07.297172 2026] [:error] [pid 9789:tid 9798] [client 145.239.65.236:44258] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afqFsz_YStPJSCHPkUX-BgAAAEc"]
[Wed May 06 08:05:09.786988 2026] [:error] [pid 9664:tid 9763] [client 145.239.65.236:46300] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afqFtQH4OZbrg1SjsBO4rAAAAIE"]
[Wed May 06 08:05:11.754169 2026] [:error] [pid 9789:tid 9792] [client 145.239.65.236:52588] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afqFtz_YStPJSCHPkUX-CgAAAEE"]
[Wed May 06 08:05:14.254549 2026] [:error] [pid 9789:tid 9796] [client 145.239.65.236:46302] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afqFuj_YStPJSCHPkUX-DwAAAEU"]
[Wed May 06 08:05:16.563564 2026] [:error] [pid 9789:tid 9799] [client 145.239.65.236:46310] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afqFvD_YStPJSCHPkUX-EwAAAEg"]
[Wed May 06 08:05:19.038652 2026] [:error] [pid 9664:tid 9770] [client 145.239.65.236:60456] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afqFvwH4OZbrg1SjsBO4wwAAAIg"]
[Wed May 06 08:05:21.348349 2026] [:error] [pid 9659:tid 9735] [client 145.239.65.236:60466] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afqFwfwJnWjd8JHpBts8nQAAAME"]
[Wed May 06 08:05:23.670341 2026] [:error] [pid 9664:tid 9786] [client 145.239.65.236:60476] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afqFwwH4OZbrg1SjsBO42gAAAJg"]
[Wed May 06 08:05:25.654951 2026] [:error] [pid 13414:tid 13416] [client 145.239.65.236:45402] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afqFxUuJQpWjVpJTu_nSWQAAAQA"]
[Wed May 06 08:05:28.124301 2026] [:error] [pid 13443:tid 13455] [client 145.239.65.236:60486] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afqFyACyfZallDmsQrdWggAAAUo"]
[Wed May 06 08:05:30.106859 2026] [:error] [pid 9653:tid 9716] [client 145.239.65.236:44122] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afqFyqhJ49Xc4dqq0B5blAAAABI"]
[Wed May 06 08:05:32.611468 2026] [:error] [pid 9659:tid 9749] [client 145.239.65.236:47844] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afqFzPwJnWjd8JHpBts8pgAAAM8"]
[Wed May 06 08:05:34.581847 2026] [:error] [pid 9664:tid 9785] [client 145.239.65.236:44138] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afqFzgH4OZbrg1SjsBO47wAAAJc"]
[Wed May 06 08:05:37.075012 2026] [:error] [pid 9664:tid 9776] [client 145.239.65.236:47860] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afqF0QH4OZbrg1SjsBO49gAAAI4"]
[Wed May 06 08:05:38.899173 2026] [:error] [pid 9659:tid 9752] [client 145.239.65.236:59888] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afqF0vwJnWjd8JHpBts8qQAAANI"]
[Wed May 06 08:05:41.379517 2026] [:error] [pid 9659:tid 9741] [client 145.239.65.236:53622] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afqF1fwJnWjd8JHpBts8qgAAAMc"]
[Wed May 06 08:05:43.845130 2026] [:error] [pid 9664:tid 9786] [client 145.239.65.236:53636] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afqF1wH4OZbrg1SjsBO4_gAAAJg"]
[Wed May 06 08:05:46.317564 2026] [:error] [pid 9664:tid 9772] [client 145.239.65.236:53652] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afqF2gH4OZbrg1SjsBO5AgAAAIo"]
[Wed May 06 08:05:48.787184 2026] [:error] [pid 9664:tid 9783] [client 145.239.65.236:47394] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afqF3AH4OZbrg1SjsBO5BQAAAJU"]
[Wed May 06 08:05:51.270152 2026] [:error] [pid 9664:tid 9773] [client 145.239.65.236:47410] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afqF3wH4OZbrg1SjsBO5CgAAAIs"]
[Wed May 06 08:05:53.098146 2026] [:error] [pid 9664:tid 9762] [client 145.239.65.236:40774] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afqF4QH4OZbrg1SjsBO5CwAAAIA"]
[Wed May 06 08:05:55.590696 2026] [:error] [pid 9664:tid 9779] [client 145.239.65.236:47424] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afqF4wH4OZbrg1SjsBO5EAAAAJE"]
[Wed May 06 08:05:58.064537 2026] [:error] [pid 13443:tid 13467] [client 145.239.65.236:47432] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afqF5gCyfZallDmsQrdWiwAAAVY"]
[Wed May 06 08:06:19.773535 2026] [:error] [pid 9789:tid 9804] [client 145.239.65.236:60734] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afqF-z_YStPJSCHPkUX-2AAAAE0"]
[Wed May 06 08:06:22.192887 2026] [:error] [pid 9664:tid 9767] [client 145.239.65.236:35976] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afqF_gH4OZbrg1SjsBO5QwAAAIU"]
[Wed May 06 08:06:24.670252 2026] [:error] [pid 9789:tid 9792] [client 145.239.65.236:35984] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afqGAD_YStPJSCHPkUX-3QAAAEE"]
[Wed May 06 08:06:27.169563 2026] [:error] [pid 13443:tid 13452] [client 145.239.65.236:35998] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afqGAwCyfZallDmsQrdWlAAAAUc"]
[Wed May 06 08:06:29.637029 2026] [:error] [pid 13443:tid 13469] [client 145.239.65.236:33406] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afqGBQCyfZallDmsQrdWlgAAAVg"]
[Wed May 06 08:06:31.467832 2026] [:error] [pid 13414:tid 13439] [client 145.239.65.236:40432] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afqGB0uJQpWjVpJTu_nSaAAAARc"]
[Wed May 06 08:06:33.468070 2026] [:error] [pid 13414:tid 13438] [client 145.239.65.236:40448] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afqGCUuJQpWjVpJTu_nSaQAAARY"]
[Wed May 06 08:06:35.489507 2026] [:error] [pid 13414:tid 13440] [client 145.239.65.236:40450] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afqGC0uJQpWjVpJTu_nSbQAAARg"]
[Wed May 06 08:06:37.504635 2026] [:error] [pid 9789:tid 9800] [client 145.239.65.236:40456] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afqGDT_YStPJSCHPkUX-4gAAAEk"]
[Wed May 06 08:06:39.376178 2026] [:error] [pid 9789:tid 9810] [client 145.239.65.236:38854] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afqGDz_YStPJSCHPkUX-5gAAAFM"]
[Wed May 06 08:06:41.375305 2026] [:error] [pid 9664:tid 9767] [client 145.239.65.236:38864] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afqGEQH4OZbrg1SjsBO5WAAAAIU"]
[Wed May 06 08:06:43.394355 2026] [:error] [pid 9789:tid 9811] [client 145.239.65.236:38874] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afqGEz_YStPJSCHPkUX-6AAAAFQ"]
[Wed May 06 08:06:45.905642 2026] [:error] [pid 9789:tid 9792] [client 145.239.65.236:35580] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afqGFT_YStPJSCHPkUX-6gAAAEE"]
[Wed May 06 08:06:48.392310 2026] [:error] [pid 13414:tid 13417] [client 145.239.65.236:35584] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afqGGEuJQpWjVpJTu_nScgAAAQE"]
[Wed May 06 08:06:50.867216 2026] [:error] [pid 13414:tid 13431] [client 145.239.65.236:36822] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afqGGkuJQpWjVpJTu_nSdAAAAQ8"]
[Wed May 06 08:06:53.322293 2026] [:error] [pid 9789:tid 9812] [client 145.239.65.236:36834] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afqGHT_YStPJSCHPkUX-7wAAAFU"]
[Wed May 06 08:06:55.326174 2026] [:error] [pid 9664:tid 9767] [client 145.239.65.236:40892] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afqGHwH4OZbrg1SjsBO5YQAAAIU"]
[Wed May 06 08:06:57.821024 2026] [:error] [pid 13443:tid 13466] [client 145.239.65.236:36842] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afqGIQCyfZallDmsQrdWowAAAVU"]
[Wed May 06 08:07:00.285609 2026] [:error] [pid 13414:tid 13428] [client 145.239.65.236:52298] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afqGJEuJQpWjVpJTu_nSeAAAAQw"]
[Wed May 06 08:07:02.117824 2026] [:error] [pid 13443:tid 13445] [client 145.239.65.236:38294] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afqGJgCyfZallDmsQrdWpwAAAUA"]
[Wed May 06 08:07:04.606250 2026] [:error] [pid 9659:tid 9753] [client 145.239.65.236:52304] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afqGKPwJnWjd8JHpBts8ywAAANM"]
[Wed May 06 08:07:06.436825 2026] [:error] [pid 9659:tid 9744] [client 145.239.65.236:38300] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afqGKvwJnWjd8JHpBts8zAAAAMo"]
[Wed May 06 08:07:08.911091 2026] [:error] [pid 9789:tid 9806] [client 145.239.65.236:44924] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afqGLD_YStPJSCHPkUX-9gAAAE8"]
[Wed May 06 08:07:10.890982 2026] [:error] [pid 9789:tid 9812] [client 145.239.65.236:45040] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afqGLj_YStPJSCHPkUX--wAAAFU"]
[Wed May 06 08:07:13.390181 2026] [:error] [pid 9789:tid 9798] [client 145.239.65.236:44934] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afqGMT_YStPJSCHPkUX-_wAAAEc"]
[Wed May 06 08:07:15.738134 2026] [:error] [pid 9789:tid 9791] [client 145.239.65.236:44946] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afqGMz_YStPJSCHPkUX_AwAAAEA"]
[Wed May 06 08:07:17.734324 2026] [:error] [pid 9789:tid 9796] [client 145.239.65.236:45042] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afqGNT_YStPJSCHPkUX_BgAAAEU"]
[Wed May 06 08:07:39.171920 2026] [:error] [pid 9789:tid 9791] [client 145.239.65.236:53290] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afqGSz_YStPJSCHPkUX_GwAAAEA"]
[Wed May 06 08:07:41.474418 2026] [:error] [pid 13414:tid 13419] [client 145.239.65.236:52732] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afqGTUuJQpWjVpJTu_nSkQAAAQM"]
[Wed May 06 08:07:43.470910 2026] [:error] [pid 13414:tid 13429] [client 145.239.65.236:34918] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afqGT0uJQpWjVpJTu_nSlQAAAQ0"]
[Wed May 06 08:07:46.026524 2026] [:error] [pid 9789:tid 9806] [client 145.239.65.236:52738] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afqGUj_YStPJSCHPkUX_HQAAAE8"]
[Wed May 06 08:07:48.523503 2026] [:error] [pid 9659:tid 9751] [client 145.239.65.236:52744] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afqGVPwJnWjd8JHpBts82wAAANE"]
[Wed May 06 08:07:50.399662 2026] [:error] [pid 9659:tid 9742] [client 145.239.65.236:46022] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afqGVvwJnWjd8JHpBts83AAAAMg"]
[Wed May 06 08:07:52.911165 2026] [:error] [pid 9659:tid 9754] [client 145.239.65.236:37332] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afqGWPwJnWjd8JHpBts84AAAANQ"]
[Wed May 06 08:07:54.924640 2026] [:error] [pid 9659:tid 9743] [client 145.239.65.236:46028] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afqGWvwJnWjd8JHpBts84gAAAMk"]
[Wed May 06 08:07:57.294731 2026] [:error] [pid 13414:tid 13426] [client 145.239.65.236:37342] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afqGXUuJQpWjVpJTu_nSpAAAAQo"]
[Wed May 06 08:07:59.624171 2026] [:error] [pid 9653:tid 9714] [client 145.239.65.236:52846] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afqGX6hJ49Xc4dqq0B5bvgAAABA"]
[Wed May 06 08:08:01.627422 2026] [:error] [pid 9659:tid 9756] [client 145.239.65.236:48828] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afqGYfwJnWjd8JHpBts85AAAANY"]
[Wed May 06 08:08:04.137025 2026] [:error] [pid 13414:tid 13440] [client 145.239.65.236:52862] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afqGZEuJQpWjVpJTu_nSrgAAARg"]
[Wed May 06 08:08:06.154945 2026] [:error] [pid 9659:tid 9747] [client 145.239.65.236:48830] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afqGZvwJnWjd8JHpBts86AAAAM0"]
[Wed May 06 08:08:08.179401 2026] [:error] [pid 13414:tid 13427] [client 145.239.65.236:39644] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afqGaEuJQpWjVpJTu_nSsAAAAQs"]
[Wed May 06 08:08:10.532440 2026] [:error] [pid 9659:tid 9734] [client 145.239.65.236:42374] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afqGavwJnWjd8JHpBts87gAAAMA"]
[Wed May 06 08:08:12.357954 2026] [:error] [pid 9659:tid 9743] [client 145.239.65.236:39656] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afqGbPwJnWjd8JHpBts88AAAAMk"]
[Wed May 06 08:08:14.871832 2026] [:error] [pid 13443:tid 13463] [client 145.239.65.236:42378] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afqGbgCyfZallDmsQrdWxgAAAVI"]
[Wed May 06 08:08:16.867463 2026] [:error] [pid 9653:tid 9716] [client 145.239.65.236:39662] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afqGcKhJ49Xc4dqq0B5bwwAAABI"]
[Wed May 06 08:08:19.249633 2026] [:error] [pid 9789:tid 9798] [client 145.239.65.236:54674] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afqGcz_YStPJSCHPkUX_IQAAAEc"]
[Wed May 06 08:08:21.076915 2026] [:error] [pid 9789:tid 9813] [client 145.239.65.236:47154] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afqGdT_YStPJSCHPkUX_IwAAAFY"]
[Wed May 06 08:08:23.559535 2026] [:error] [pid 13414:tid 13429] [client 145.239.65.236:54688] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afqGd0uJQpWjVpJTu_nSugAAAQ0"]
[Wed May 06 08:08:25.546380 2026] [:error] [pid 9659:tid 9755] [client 145.239.65.236:47160] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afqGefwJnWjd8JHpBts8_QAAANU"]
[Wed May 06 08:08:28.023183 2026] [:error] [pid 9789:tid 9809] [client 145.239.65.236:54692] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afqGfD_YStPJSCHPkUX_PwAAAFI"]
[Wed May 06 08:08:30.481162 2026] [:error] [pid 9664:tid 9781] [client 145.239.65.236:36514] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afqGfgH4OZbrg1SjsBO5hwAAAJM"]
[Wed May 06 08:08:32.949146 2026] [:error] [pid 9789:tid 9806] [client 145.239.65.236:36518] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afqGgD_YStPJSCHPkUX_aQAAAE8"]
[Wed May 06 08:08:35.295075 2026] [:error] [pid 9664:tid 9767] [client 145.239.65.236:36522] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afqGgwH4OZbrg1SjsBO5jQAAAIU"]
[Wed May 06 08:08:57.482039 2026] [:error] [pid 13414:tid 13430] [client 145.239.65.236:56874] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "afqGmUuJQpWjVpJTu_nS2wAAAQ4"]
[Wed May 06 08:08:59.411447 2026] [:error] [pid 13414:tid 13427] [client 145.239.65.236:39844] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afqGm0uJQpWjVpJTu_nS3QAAAQs"]
[Wed May 06 08:09:01.415343 2026] [:error] [pid 13414:tid 13417] [client 145.239.65.236:39858] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afqGnUuJQpWjVpJTu_nS4AAAAQE"]
[Wed May 06 08:09:03.411752 2026] [:error] [pid 9664:tid 9785] [client 145.239.65.236:39862] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afqGnwH4OZbrg1SjsBO5vgAAAJc"]
[Wed May 06 08:09:05.408940 2026] [:error] [pid 13414:tid 13433] [client 145.239.65.236:39870] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afqGoUuJQpWjVpJTu_nS4QAAARE"]
[Wed May 06 08:09:07.411894 2026] [:error] [pid 9789:tid 9805] [client 145.239.65.236:39884] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afqGoz_YStPJSCHPkUX_qAAAAE4"]
[Wed May 06 08:09:09.408088 2026] [:error] [pid 9653:tid 9703] [client 145.239.65.236:55890] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afqGpahJ49Xc4dqq0B5b2QAAAAU"]
[Wed May 06 08:09:11.408459 2026] [:error] [pid 13414:tid 13440] [client 145.239.65.236:55906] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afqGp0uJQpWjVpJTu_nS5QAAARg"]
[Wed May 06 08:09:13.403719 2026] [:error] [pid 9664:tid 9767] [client 145.239.65.236:55920] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afqGqQH4OZbrg1SjsBO5wAAAAIU"]
[Wed May 06 08:09:15.245944 2026] [:error] [pid 13414:tid 13418] [client 145.239.65.236:55922] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afqGq0uJQpWjVpJTu_nS5gAAAQI"]
[Wed May 06 08:09:17.241127 2026] [:error] [pid 9659:tid 9756] [client 145.239.65.236:55934] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afqGrfwJnWjd8JHpBts9MAAAANY"]
[Wed May 06 08:09:19.250120 2026] [:error] [pid 13443:tid 13456] [client 145.239.65.236:50372] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afqGrwCyfZallDmsQrdW7AAAAUs"]
[Wed May 06 08:09:21.246086 2026] [:error] [pid 9659:tid 9755] [client 145.239.65.236:50388] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afqGsfwJnWjd8JHpBts9MwAAANU"]
[Wed May 06 08:09:23.254858 2026] [:error] [pid 13414:tid 13417] [client 145.239.65.236:50392] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afqGs0uJQpWjVpJTu_nS7AAAAQE"]
[Wed May 06 08:09:25.246913 2026] [:error] [pid 13443:tid 13452] [client 145.239.65.236:50400] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afqGtQCyfZallDmsQrdW7gAAAUc"]
[Wed May 06 08:09:27.238807 2026] [:error] [pid 9664:tid 9779] [client 145.239.65.236:50416] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afqGtwH4OZbrg1SjsBO5xwAAAJE"]
[Wed May 06 08:09:29.237055 2026] [:error] [pid 9659:tid 9737] [client 145.239.65.236:44306] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afqGufwJnWjd8JHpBts9OgAAAMM"]
[Wed May 06 08:09:31.240820 2026] [:error] [pid 9664:tid 9782] [client 145.239.65.236:44310] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afqGuwH4OZbrg1SjsBO5zAAAAJQ"]
[Wed May 06 08:09:33.249082 2026] [:error] [pid 9664:tid 9765] [client 145.239.65.236:44316] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afqGvQH4OZbrg1SjsBO50QAAAIM"]
[Wed May 06 08:09:35.264960 2026] [:error] [pid 9789:tid 9791] [client 145.239.65.236:44328] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afqGvz_YStPJSCHPkUX_ugAAAEA"]
[Wed May 06 08:09:37.271805 2026] [:error] [pid 9789:tid 9805] [client 145.239.65.236:44342] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afqGwT_YStPJSCHPkUX_vQAAAE4"]
[Wed May 06 08:09:39.288022 2026] [:error] [pid 9659:tid 9757] [client 145.239.65.236:39766] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afqGw_wJnWjd8JHpBts9TAAAANc"]
[Wed May 06 08:09:41.142675 2026] [:error] [pid 13414:tid 13432] [client 145.239.65.236:39778] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afqGxUuJQpWjVpJTu_nS-AAAARA"]
[Wed May 06 08:09:43.157381 2026] [:error] [pid 9653:tid 9698] [client 145.239.65.236:39780] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afqGx6hJ49Xc4dqq0B5b5QAAAAA"]
[Wed May 06 08:09:45.177730 2026] [:error] [pid 9659:tid 9746] [client 145.239.65.236:39784] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afqGyfwJnWjd8JHpBts9TgAAAMw"]
[Wed May 06 08:09:47.199695 2026] [:error] [pid 13443:tid 13451] [client 145.239.65.236:39800] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afqGywCyfZallDmsQrdW8QAAAUY"]
[Wed May 06 08:09:49.075559 2026] [:error] [pid 13443:tid 13455] [client 145.239.65.236:37550] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afqGzQCyfZallDmsQrdW8wAAAUo"]
[Wed May 06 08:09:51.083334 2026] [:error] [pid 9664:tid 9784] [client 145.239.65.236:37564] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afqGzwH4OZbrg1SjsBO53QAAAJY"]
[Wed May 06 08:09:53.089563 2026] [:error] [pid 9664:tid 9786] [client 145.239.65.236:37576] [client 145.239.65.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afqG0QH4OZbrg1SjsBO54AAAAJg"]
[Wed May 06 09:58:49.670671 2026] [:error] [pid 13443:tid 13458] [client 104.248.93.192:59243] [client 104.248.93.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.93.192, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afqgWQCyfZallDmsQrdsvwAAAU0"]
[Wed May 06 09:58:49.682704 2026] [proxy_fcgi:error] [pid 13443:tid 13458] [client 104.248.93.192:59243] AH01071: Got error 'Primary script unknown'
[Wed May 06 10:47:05.346793 2026] [:error] [pid 9659:tid 9742] [client 146.190.165.160:55781] [client 146.190.165.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.190.165.160, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afqrqfwJnWjd8JHpBttSQQAAAMg"]
[Wed May 06 10:47:05.359883 2026] [proxy_fcgi:error] [pid 9659:tid 9742] [client 146.190.165.160:55781] AH01071: Got error 'Primary script unknown'
[Wed May 06 11:20:09.499855 2026] [:error] [pid 482:tid 502] [client 43.157.95.131:49826] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afqzacxs8HOc_nWgOW7DogAAAdI"]
[Wed May 06 11:53:05.438791 2026] [:error] [pid 592:tid 610] [client 176.44.29.189:22915] [client 176.44.29.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.44.29.189, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afq7IZiX28mb6xLi2PyF0AAAAo4"]
[Wed May 06 11:53:05.451580 2026] [proxy_fcgi:error] [pid 592:tid 610] [client 176.44.29.189:22915] AH01071: Got error 'Primary script unknown'
[Wed May 06 12:05:37.182998 2026] [:error] [pid 482:tid 489] [client 149.224.91.41:62204] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afq-Ecxs8HOc_nWgOW7SggAAAcU"]
[Wed May 06 12:05:38.906164 2026] [:error] [pid 592:tid 611] [client 149.224.91.41:59261] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afq-EpiX28mb6xLi2PyGfQAAAo8"]
[Wed May 06 12:05:41.303641 2026] [:error] [pid 592:tid 600] [client 149.224.91.41:62745] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afq-FZiX28mb6xLi2PyGfgAAAoQ"]
[Wed May 06 12:05:43.235092 2026] [:error] [pid 13414:tid 13427] [client 149.224.91.41:60258] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afq-F0uJQpWjVpJTu_nxnQAAAQs"]
[Wed May 06 12:05:45.911222 2026] [:error] [pid 9664:tid 9776] [client 149.224.91.41:59518] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afq-GQH4OZbrg1SjsBP-5QAAAI4"]
[Wed May 06 12:05:47.786896 2026] [:error] [pid 482:tid 500] [client 149.224.91.41:61579] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afq-G8xs8HOc_nWgOW7SiQAAAdA"]
[Wed May 06 12:05:49.797126 2026] [:error] [pid 9659:tid 9758] [client 149.224.91.41:60277] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afq-HfwJnWjd8JHpBttZSAAAANg"]
[Wed May 06 12:05:52.239472 2026] [:error] [pid 482:tid 504] [client 149.224.91.41:59510] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afq-IMxs8HOc_nWgOW7SjAAAAdQ"]
[Wed May 06 12:05:54.674521 2026] [:error] [pid 9659:tid 9738] [client 149.224.91.41:60293] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afq-IvwJnWjd8JHpBttZSgAAAMQ"]
[Wed May 06 12:05:57.125591 2026] [:error] [pid 9659:tid 9753] [client 149.224.91.41:59184] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afq-JfwJnWjd8JHpBttZSwAAANM"]
[Wed May 06 12:05:59.370617 2026] [:error] [pid 592:tid 603] [client 149.224.91.41:60108] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afq-J5iX28mb6xLi2PyGggAAAoc"]
[Wed May 06 12:06:01.980055 2026] [:error] [pid 13443:tid 13448] [client 149.224.91.41:63458] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afq-KQCyfZallDmsQrd5fgAAAUM"]
[Wed May 06 12:06:03.897534 2026] [:error] [pid 9659:tid 9745] [client 149.224.91.41:64855] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afq-K_wJnWjd8JHpBttZTAAAAMs"]
[Wed May 06 12:06:05.988083 2026] [:error] [pid 482:tid 489] [client 149.224.91.41:62707] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afq-Lcxs8HOc_nWgOW7S8wAAAcU"]
[Wed May 06 12:06:07.866346 2026] [:error] [pid 482:tid 504] [client 149.224.91.41:64198] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afq-L8xs8HOc_nWgOW7S9QAAAdQ"]
[Wed May 06 12:06:10.526468 2026] [:error] [pid 482:tid 492] [client 149.224.91.41:61964] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afq-Msxs8HOc_nWgOW7TBAAAAcg"]
[Wed May 06 12:06:21.850556 2026] [:error] [pid 482:tid 496] [client 149.224.91.41:62869] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afq-Pcxs8HOc_nWgOW7THQAAAcw"]
[Wed May 06 12:06:24.339837 2026] [:error] [pid 9664:tid 9778] [client 149.224.91.41:60983] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afq-QAH4OZbrg1SjsBP_EgAAAJA"]
[Wed May 06 12:06:26.937336 2026] [:error] [pid 482:tid 510] [client 149.224.91.41:61690] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afq-Qsxs8HOc_nWgOW7TIAAAAdg"]
[Wed May 06 12:06:28.956642 2026] [:error] [pid 9653:tid 9700] [client 149.224.91.41:59255] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afq-RKhJ49Xc4dqq0B6CaQAAAAI"]
[Wed May 06 12:06:31.484743 2026] [:error] [pid 9653:tid 9721] [client 149.224.91.41:61799] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afq-R6hJ49Xc4dqq0B6CawAAABc"]
[Wed May 06 12:06:33.904598 2026] [:error] [pid 592:tid 615] [client 149.224.91.41:64123] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afq-SZiX28mb6xLi2PyGjAAAApE"]
[Wed May 06 12:06:57.077122 2026] [:error] [pid 9653:tid 9699] [client 149.224.91.41:59765] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afq-YahJ49Xc4dqq0B6CiQAAAAE"]
[Wed May 06 12:06:58.766601 2026] [:error] [pid 9653:tid 9703] [client 149.224.91.41:62161] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afq-YqhJ49Xc4dqq0B6CigAAAAU"]
[Wed May 06 12:07:00.644972 2026] [:error] [pid 63810:tid 63830] [client 149.224.91.41:63037] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afq-ZHpnbsN9Zf6i5IEcbQAAAZA"]
[Wed May 06 12:07:03.154020 2026] [:error] [pid 63810:tid 63821] [client 149.224.91.41:62015] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afq-Z3pnbsN9Zf6i5IEcbgAAAYc"]
[Wed May 06 12:07:05.728313 2026] [:error] [pid 13414:tid 13425] [client 149.224.91.41:61568] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afq-aUuJQpWjVpJTu_nxuwAAAQk"]
[Wed May 06 12:07:08.328616 2026] [:error] [pid 9664:tid 9763] [client 149.224.91.41:60011] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afq-bAH4OZbrg1SjsBP_IgAAAIE"]
[Wed May 06 12:07:10.797192 2026] [:error] [pid 9653:tid 9706] [client 149.224.91.41:62845] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afq-bqhJ49Xc4dqq0B6CjwAAAAg"]
[Wed May 06 12:07:12.766724 2026] [:error] [pid 9789:tid 9805] [client 149.224.91.41:62046] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afq-cD_YStPJSCHPkUU5FAAAAE4"]
[Wed May 06 12:07:15.248513 2026] [:error] [pid 9659:tid 9737] [client 149.224.91.41:63605] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afq-c_wJnWjd8JHpBttZbAAAAMM"]
[Wed May 06 12:07:17.267684 2026] [:error] [pid 557:tid 580] [client 149.224.91.41:62176] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afq-dTZjFR8Vd8ce80ATbgAAAlU"]
[Wed May 06 12:07:19.797273 2026] [:error] [pid 9789:tid 9796] [client 149.224.91.41:64974] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afq-dz_YStPJSCHPkUU5IwAAAEU"]
[Wed May 06 12:07:21.869829 2026] [:error] [pid 9664:tid 9770] [client 149.224.91.41:61197] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afq-eQH4OZbrg1SjsBP_JQAAAIg"]
[Wed May 06 12:07:23.825891 2026] [:error] [pid 9789:tid 9806] [client 149.224.91.41:63853] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afq-ez_YStPJSCHPkUU5KQAAAE8"]
[Wed May 06 12:07:25.967333 2026] [:error] [pid 9789:tid 9813] [client 149.224.91.41:63607] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afq-fT_YStPJSCHPkUU5KwAAAFY"]
[Wed May 06 12:07:32.994260 2026] [:error] [pid 482:tid 488] [client 149.224.91.41:61829] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "afq-hMxs8HOc_nWgOW7TPwAAAcQ"]
[Wed May 06 12:07:34.997352 2026] [:error] [pid 9659:tid 9740] [client 149.224.91.41:64074] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afq-hvwJnWjd8JHpBttZcgAAAMY"]
[Wed May 06 12:07:37.541145 2026] [:error] [pid 9789:tid 9797] [client 149.224.91.41:61213] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "afq-iT_YStPJSCHPkUU5NQAAAEY"]
[Wed May 06 12:07:39.391782 2026] [:error] [pid 9789:tid 9812] [client 149.224.91.41:62966] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afq-iz_YStPJSCHPkUU5NwAAAFU"]
[Wed May 06 12:07:41.353033 2026] [:error] [pid 13414:tid 13438] [client 149.224.91.41:59858] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afq-jUuJQpWjVpJTu_nxwQAAARY"]
[Wed May 06 12:07:43.328473 2026] [:error] [pid 9659:tid 9739] [client 149.224.91.41:61724] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afq-j_wJnWjd8JHpBttZcwAAAMU"]
[Wed May 06 12:07:45.411141 2026] [:error] [pid 482:tid 504] [client 149.224.91.41:59559] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afq-kcxs8HOc_nWgOW7TQQAAAdQ"]
[Wed May 06 12:07:47.920474 2026] [:error] [pid 482:tid 509] [client 149.224.91.41:63926] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afq-k8xs8HOc_nWgOW7TRQAAAdc"]
[Wed May 06 12:07:49.764917 2026] [:error] [pid 482:tid 494] [client 149.224.91.41:60610] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afq-lcxs8HOc_nWgOW7TSQAAAco"]
[Wed May 06 12:07:51.737989 2026] [:error] [pid 482:tid 488] [client 149.224.91.41:63122] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afq-l8xs8HOc_nWgOW7TTAAAAcQ"]
[Wed May 06 12:08:34.736466 2026] [:error] [pid 9653:tid 9704] [client 149.224.91.41:63841] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afq-wqhJ49Xc4dqq0B6C2AAAAAY"]
[Wed May 06 12:08:36.526195 2026] [:error] [pid 9789:tid 9801] [client 149.224.91.41:62550] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afq-xD_YStPJSCHPkUU5SwAAAEo"]
[Wed May 06 12:08:38.422292 2026] [:error] [pid 9653:tid 9716] [client 149.224.91.41:64026] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afq-xqhJ49Xc4dqq0B6C4QAAABI"]
[Wed May 06 12:08:40.535263 2026] [:error] [pid 9789:tid 9813] [client 149.224.91.41:59140] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "afq-yD_YStPJSCHPkUU5TgAAAFY"]
[Wed May 06 12:08:42.614901 2026] [:error] [pid 9659:tid 9745] [client 149.224.91.41:62384] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "afq-yvwJnWjd8JHpBttZhgAAAMs"]
[Wed May 06 12:08:44.749382 2026] [:error] [pid 9653:tid 9722] [client 149.224.91.41:62218] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "afq-zKhJ49Xc4dqq0B6C5QAAABg"]
[Wed May 06 12:08:46.538616 2026] [:error] [pid 9659:tid 9747] [client 149.224.91.41:61568] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afq-zvwJnWjd8JHpBttZiAAAAM0"]
[Wed May 06 12:08:48.495956 2026] [:error] [pid 9789:tid 9812] [client 149.224.91.41:59937] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afq-0D_YStPJSCHPkUU5VQAAAFU"]
[Wed May 06 12:08:51.074393 2026] [:error] [pid 9653:tid 9721] [client 149.224.91.41:63637] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afq-06hJ49Xc4dqq0B6C8QAAABc"]
[Wed May 06 12:08:53.500471 2026] [:error] [pid 482:tid 503] [client 149.224.91.41:61939] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afq-1cxs8HOc_nWgOW7TkgAAAdM"]
[Wed May 06 12:08:55.833553 2026] [:error] [pid 482:tid 500] [client 149.224.91.41:60250] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afq-18xs8HOc_nWgOW7TnAAAAdA"]
[Wed May 06 12:08:59.885931 2026] [:error] [pid 9653:tid 9698] [client 149.224.91.41:61976] [client 149.224.91.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afq-26hJ49Xc4dqq0B6C-AAAAAA"]
[Wed May 06 13:43:30.483681 2026] [:error] [pid 13414:tid 13428] [client 68.183.22.192:49306] [client 68.183.22.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.22.192, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afrVAkuJQpWjVpJTu_n6cAAAAQw"]
[Wed May 06 13:43:30.494697 2026] [proxy_fcgi:error] [pid 13414:tid 13428] [client 68.183.22.192:49306] AH01071: Got error 'Primary script unknown'
[Wed May 06 13:43:30.748305 2026] [:error] [pid 9789:tid 9796] [client 68.183.22.192:49320] [client 68.183.22.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.22.192, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afrVAj_YStPJSCHPkUVLpgAAAEU"]
[Wed May 06 13:43:30.752332 2026] [proxy_fcgi:error] [pid 9789:tid 9796] [client 68.183.22.192:49320] AH01071: Got error 'Primary script unknown'
[Wed May 06 15:07:46.479954 2026] [:error] [pid 9659:tid 9738] [client 89.124.79.150:56880] [client 89.124.79.150] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=audio/x-ms-wma"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afrowvwJnWjd8JHpBtttBwAAAMQ"]
[Wed May 06 18:26:06.599368 2026] [:error] [pid 482:tid 494] [client 43.165.7.132:47144] [client 43.165.7.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afsXPsxs8HOc_nWgOW4yMwAAAco"]
[Wed May 06 20:14:26.780773 2026] [:error] [pid 9789:tid 9807] [client 135.181.213.219:8422] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afswoj_YStPJSCHPkUWLLAAAAFA"]
[Wed May 06 20:14:28.804138 2026] [:error] [pid 9653:tid 9701] [client 135.181.213.219:8426] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afswpKhJ49Xc4dqq0B4BNAAAAAM"]
[Wed May 06 20:14:30.855557 2026] [:error] [pid 13414:tid 13417] [client 135.181.213.219:57952] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afswpkuJQpWjVpJTu_kcMAAAAQE"]
[Wed May 06 20:14:32.863142 2026] [:error] [pid 9664:tid 9762] [client 135.181.213.219:57960] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afswqAH4OZbrg1SjsBNBzQAAAIA"]
[Wed May 06 20:14:34.739037 2026] [:error] [pid 482:tid 507] [client 135.181.213.219:57976] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afswqsxs8HOc_nWgOW5HHwAAAdU"]
[Wed May 06 20:14:36.767285 2026] [:error] [pid 13443:tid 13466] [client 135.181.213.219:57992] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afswrACyfZallDmsQreYxAAAAVU"]
[Wed May 06 20:14:38.777146 2026] [:error] [pid 9659:tid 9752] [client 135.181.213.219:58004] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afswrvwJnWjd8JHpBtuNGQAAANI"]
[Wed May 06 20:14:40.783548 2026] [:error] [pid 63810:tid 63830] [client 135.181.213.219:33934] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afswsHpnbsN9Zf6i5IE34AAAAZA"]
[Wed May 06 20:14:42.793140 2026] [:error] [pid 63810:tid 63838] [client 135.181.213.219:33946] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afswsnpnbsN9Zf6i5IE34QAAAZg"]
[Wed May 06 20:14:44.842570 2026] [:error] [pid 9664:tid 9782] [client 135.181.213.219:33954] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afswtAH4OZbrg1SjsBNB0gAAAJQ"]
[Wed May 06 20:14:46.849267 2026] [:error] [pid 9664:tid 9785] [client 135.181.213.219:33962] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afswtgH4OZbrg1SjsBNB0wAAAJc"]
[Wed May 06 20:14:48.753871 2026] [:error] [pid 13414:tid 13418] [client 135.181.213.219:33972] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afswuEuJQpWjVpJTu_kcNwAAAQI"]
[Wed May 06 20:14:50.694817 2026] [:error] [pid 9789:tid 9800] [client 135.181.213.219:64780] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afswuj_YStPJSCHPkUWLPAAAAEk"]
[Wed May 06 20:14:52.553421 2026] [:error] [pid 9659:tid 9753] [client 135.181.213.219:64794] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afswvPwJnWjd8JHpBtuNKAAAANM"]
[Wed May 06 20:14:54.620898 2026] [:error] [pid 9664:tid 9774] [client 135.181.213.219:64810] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afswvgH4OZbrg1SjsBNB3gAAAIw"]
[Wed May 06 20:14:56.547312 2026] [:error] [pid 13443:tid 13445] [client 135.181.213.219:64826] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afswwACyfZallDmsQreYzgAAAUA"]
[Wed May 06 20:14:58.554396 2026] [:error] [pid 482:tid 486] [client 135.181.213.219:64842] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afswwsxs8HOc_nWgOW5HLgAAAcI"]
[Wed May 06 20:15:00.588622 2026] [:error] [pid 13443:tid 13456] [client 135.181.213.219:17924] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afswxACyfZallDmsQreY0AAAAUs"]
[Wed May 06 20:15:02.486972 2026] [:error] [pid 63810:tid 63829] [client 135.181.213.219:17938] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afswxnpnbsN9Zf6i5IE35AAAAY8"]
[Wed May 06 20:15:04.494317 2026] [:error] [pid 482:tid 502] [client 135.181.213.219:17942] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afswyMxs8HOc_nWgOW5HRgAAAdI"]
[Wed May 06 20:15:06.517172 2026] [:error] [pid 9659:tid 9739] [client 135.181.213.219:17954] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afswyvwJnWjd8JHpBtuNOAAAAMU"]
[Wed May 06 20:15:08.508020 2026] [:error] [pid 482:tid 493] [client 135.181.213.219:17968] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afswzMxs8HOc_nWgOW5HUQAAAck"]
[Wed May 06 20:15:10.538592 2026] [:error] [pid 9789:tid 9809] [client 135.181.213.219:5198] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afswzj_YStPJSCHPkUWLZwAAAFI"]
[Wed May 06 20:15:45.934536 2026] [:error] [pid 9664:tid 9771] [client 135.181.213.219:54628] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afsw8QH4OZbrg1SjsBNB9wAAAIk"]
[Wed May 06 20:15:47.968826 2026] [:error] [pid 63810:tid 63824] [client 135.181.213.219:54642] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afsw83pnbsN9Zf6i5IE37wAAAYo"]
[Wed May 06 20:15:50.002183 2026] [:error] [pid 9659:tid 9738] [client 135.181.213.219:55080] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afsw9vwJnWjd8JHpBtuNSwAAAMQ"]
[Wed May 06 20:15:51.900844 2026] [:error] [pid 9653:tid 9709] [client 135.181.213.219:55096] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afsw96hJ49Xc4dqq0B4BaAAAAAs"]
[Wed May 06 20:15:53.947323 2026] [:error] [pid 592:tid 606] [client 135.181.213.219:55108] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afsw-ZiX28mb6xLi2PyrzAAAAoo"]
[Wed May 06 20:15:55.849849 2026] [:error] [pid 557:tid 560] [client 135.181.213.219:55120] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afsw-zZjFR8Vd8ce80As3AAAAkE"]
[Wed May 06 20:15:57.902996 2026] [:error] [pid 557:tid 583] [client 135.181.213.219:55126] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afsw_TZjFR8Vd8ce80As3gAAAlg"]
[Wed May 06 20:15:59.798195 2026] [:error] [pid 592:tid 606] [client 135.181.213.219:21798] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afsw_5iX28mb6xLi2Pyr1wAAAoo"]
[Wed May 06 21:22:43.871185 2026] [:error] [pid 9653:tid 9714] [client 37.187.27.125:59034] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aftAo6hJ49Xc4dqq0B4WUgAAABA"]
[Wed May 06 21:22:46.091647 2026] [:error] [pid 482:tid 500] [client 37.187.27.125:59630] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aftApsxs8HOc_nWgOW5YrQAAAdA"]
[Wed May 06 21:22:48.335519 2026] [:error] [pid 13414:tid 13439] [client 37.187.27.125:59902] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aftAqEuJQpWjVpJTu_kiOgAAARc"]
[Wed May 06 21:22:50.411291 2026] [:error] [pid 9653:tid 9711] [client 37.187.27.125:60146] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aftAqqhJ49Xc4dqq0B4WXgAAAA0"]
[Wed May 06 21:22:52.479323 2026] [:error] [pid 9653:tid 9722] [client 37.187.27.125:60398] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aftArKhJ49Xc4dqq0B4WagAAABg"]
[Wed May 06 21:22:54.465711 2026] [:error] [pid 9653:tid 9706] [client 37.187.27.125:60616] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aftArqhJ49Xc4dqq0B4WcAAAAAg"]
[Wed May 06 21:22:56.509281 2026] [:error] [pid 13443:tid 13447] [client 37.187.27.125:60814] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aftAsACyfZallDmsQredPgAAAUI"]
[Wed May 06 21:23:01.350197 2026] [:error] [pid 9653:tid 9716] [client 37.187.27.125:33170] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aftAtahJ49Xc4dqq0B4WkgAAABI"]
[Wed May 06 21:23:03.589904 2026] [:error] [pid 9653:tid 9699] [client 37.187.27.125:33450] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aftAt6hJ49Xc4dqq0B4WlwAAAAE"]
[Wed May 06 21:23:05.608470 2026] [:error] [pid 557:tid 583] [client 37.187.27.125:33706] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aftAuTZjFR8Vd8ce80AwfwAAAlg"]
[Wed May 06 21:23:07.688935 2026] [:error] [pid 482:tid 489] [client 37.187.27.125:33950] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aftAu8xs8HOc_nWgOW5Y4gAAAcU"]
[Wed May 06 21:23:10.015152 2026] [:error] [pid 592:tid 608] [client 37.187.27.125:34254] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aftAvpiX28mb6xLi2Pyw5AAAAow"]
[Wed May 06 21:23:12.246080 2026] [:error] [pid 9653:tid 9710] [client 37.187.27.125:34528] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aftAwKhJ49Xc4dqq0B4WsAAAAAw"]
[Wed May 06 21:23:14.335637 2026] [:error] [pid 9664:tid 9777] [client 37.187.27.125:34776] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aftAwgH4OZbrg1SjsBNLpwAAAI8"]
[Wed May 06 21:23:16.429380 2026] [:error] [pid 9653:tid 9713] [client 37.187.27.125:35034] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aftAxKhJ49Xc4dqq0B4WvQAAAA8"]
[Wed May 06 21:23:18.533408 2026] [:error] [pid 13443:tid 13459] [client 37.187.27.125:35292] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aftAxgCyfZallDmsQredSQAAAU4"]
[Wed May 06 21:23:20.674981 2026] [:error] [pid 9659:tid 9752] [client 37.187.27.125:35568] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aftAyPwJnWjd8JHpBtuV6QAAANI"]
[Wed May 06 21:23:22.839439 2026] [:error] [pid 9659:tid 9747] [client 37.187.27.125:35840] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aftAyvwJnWjd8JHpBtuV7QAAAM0"]
[Wed May 06 21:23:24.861890 2026] [:error] [pid 9789:tid 9809] [client 37.187.27.125:36064] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aftAzD_YStPJSCHPkUWaawAAAFI"]
[Wed May 06 21:23:27.087372 2026] [:error] [pid 9664:tid 9767] [client 37.187.27.125:36434] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aftAzwH4OZbrg1SjsBNLvwAAAIU"]
[Wed May 06 21:23:29.385278 2026] [:error] [pid 592:tid 617] [client 37.187.27.125:36764] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aftA0ZiX28mb6xLi2Pyw9QAAApI"]
[Wed May 06 21:23:33.563604 2026] [:error] [pid 13443:tid 13445] [client 37.187.27.125:37406] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aftA1QCyfZallDmsQredVwAAAUA"]
[Wed May 06 21:23:36.805218 2026] [:error] [pid 13414:tid 13420] [client 37.187.27.125:37796] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aftA2EuJQpWjVpJTu_kiWQAAAQQ"]
[Thu May 07 00:18:57.855870 2026] [:error] [pid 482:tid 490] [client 154.204.6.52:53110] [client 154.204.6.52] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aftp8cxs8HOc_nWgOW6FKAAAAcY"]
[Thu May 07 01:11:07.765226 2026] [:error] [pid 9659:tid 9751] [client 43.130.91.95:47560] [client 43.130.91.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aft2K_wJnWjd8JHpBtuycAAAANE"]
[Thu May 07 01:56:09.587972 2026] [proxy_fcgi:error] [pid 13414:tid 13416] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:09.782620 2026] [proxy_fcgi:error] [pid 13414:tid 13431] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:09.976965 2026] [proxy_fcgi:error] [pid 13414:tid 13422] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:10.168682 2026] [proxy_fcgi:error] [pid 13414:tid 13424] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:10.362120 2026] [proxy_fcgi:error] [pid 13414:tid 13418] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:10.554085 2026] [proxy_fcgi:error] [pid 13414:tid 13417] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:10.746781 2026] [proxy_fcgi:error] [pid 13414:tid 13428] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:10.938462 2026] [proxy_fcgi:error] [pid 13414:tid 13440] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:11.131074 2026] [proxy_fcgi:error] [pid 13414:tid 13433] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:11.323731 2026] [proxy_fcgi:error] [pid 13414:tid 13423] [client 20.9.85.117:32627] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:56:11.511493 2026] [:error] [pid 13414:tid 13432] [client 20.9.85.117:32627] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afuAu0uJQpWjVpJTu_k-1gAAARA"]
[Thu May 07 01:56:11.884548 2026] [:error] [pid 592:tid 609] [client 20.9.85.117:32611] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afuAu5iX28mb6xLi2PzJewAAAo0"]
[Thu May 07 01:56:12.264757 2026] [:error] [pid 592:tid 610] [client 20.9.85.117:32580] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afuAvJiX28mb6xLi2PzJfAAAAo4"]
[Thu May 07 01:56:12.640538 2026] [:error] [pid 9653:tid 9704] [client 20.9.85.117:32584] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afuAvKhJ49Xc4dqq0B53ewAAAAY"]
[Thu May 07 01:56:13.017160 2026] [:error] [pid 9653:tid 9701] [client 20.9.85.117:32631] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "afuAvahJ49Xc4dqq0B53fAAAAAM"]
[Thu May 07 01:56:13.395656 2026] [:error] [pid 9653:tid 9710] [client 20.9.85.117:32626] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "afuAvahJ49Xc4dqq0B53fwAAAAw"]
[Thu May 07 01:56:13.771902 2026] [:error] [pid 9653:tid 9706] [client 20.9.85.117:32585] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "afuAvahJ49Xc4dqq0B53hAAAAAg"]
[Thu May 07 01:56:14.155213 2026] [:error] [pid 9653:tid 9702] [client 20.9.85.117:32622] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "afuAvqhJ49Xc4dqq0B53hgAAAAQ"]
[Thu May 07 01:56:14.535556 2026] [:error] [pid 9789:tid 9801] [client 20.9.85.117:32579] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afuAvj_YStPJSCHPkUXV9AAAAEo"]
[Thu May 07 01:56:14.909885 2026] [:error] [pid 9789:tid 9793] [client 20.9.85.117:32638] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afuAvj_YStPJSCHPkUXV-AAAAEI"]
[Thu May 07 01:56:15.295917 2026] [:error] [pid 9789:tid 9815] [client 20.9.85.117:32604] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afuAvz_YStPJSCHPkUXV-gAAAFg"]
[Thu May 07 01:56:15.671753 2026] [:error] [pid 9789:tid 9805] [client 20.9.85.117:32529] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "afuAvz_YStPJSCHPkUXV_AAAAE4"]
[Thu May 07 01:56:16.048644 2026] [:error] [pid 13443:tid 13446] [client 20.9.85.117:32634] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "afuAwACyfZallDmsQre0lQAAAUE"]
[Thu May 07 01:56:16.426645 2026] [:error] [pid 63810:tid 63822] [client 20.9.85.117:32595] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "afuAwHpnbsN9Zf6i5IFSoAAAAYg"]
[Thu May 07 01:56:16.799948 2026] [:error] [pid 557:tid 578] [client 20.9.85.117:32576] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "afuAwDZjFR8Vd8ce80BBbAAAAlM"]
[Thu May 07 01:56:17.176083 2026] [:error] [pid 13414:tid 13429] [client 20.9.85.117:32612] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "afuAwUuJQpWjVpJTu_k-3AAAAQ0"]
[Thu May 07 01:56:17.550107 2026] [:error] [pid 13443:tid 13445] [client 20.9.85.117:32602] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afuAwQCyfZallDmsQre0mQAAAUA"]
[Thu May 07 01:56:17.924732 2026] [:error] [pid 13443:tid 13459] [client 20.9.85.117:32513] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afuAwQCyfZallDmsQre0nQAAAU4"]
[Thu May 07 01:56:18.304375 2026] [:error] [pid 13443:tid 13458] [client 20.9.85.117:32615] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afuAwgCyfZallDmsQre0nwAAAU0"]
[Thu May 07 01:56:18.679443 2026] [:error] [pid 13414:tid 13420] [client 20.9.85.117:32613] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "afuAwkuJQpWjVpJTu_k-4wAAAQQ"]
[Thu May 07 01:56:19.061947 2026] [:error] [pid 13443:tid 13464] [client 20.9.85.117:32607] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afuAwwCyfZallDmsQre0oQAAAVM"]
[Thu May 07 01:56:19.442780 2026] [:error] [pid 9664:tid 9778] [client 20.9.85.117:32619] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afuAwwH4OZbrg1SjsBN57gAAAJA"]
[Thu May 07 01:56:19.817591 2026] [:error] [pid 9664:tid 9786] [client 20.9.85.117:32628] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afuAwwH4OZbrg1SjsBN58gAAAJg"]
[Thu May 07 01:56:20.204548 2026] [:error] [pid 9664:tid 9777] [client 20.9.85.117:32639] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "afuAxAH4OZbrg1SjsBN59AAAAI8"]
[Thu May 07 01:56:20.580291 2026] [:error] [pid 9664:tid 9766] [client 20.9.85.117:32625] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "afuAxAH4OZbrg1SjsBN59wAAAIQ"]
[Thu May 07 01:56:20.954387 2026] [:error] [pid 482:tid 500] [client 20.9.85.117:32623] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "afuAxMxs8HOc_nWgOW6heAAAAdA"]
[Thu May 07 01:56:21.334531 2026] [:error] [pid 592:tid 599] [client 20.9.85.117:32525] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "afuAxZiX28mb6xLi2PzJgAAAAoM"]
[Thu May 07 01:56:21.713144 2026] [:error] [pid 482:tid 499] [client 20.9.85.117:32521] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "afuAxcxs8HOc_nWgOW6hewAAAc8"]
[Thu May 07 01:56:22.092030 2026] [:error] [pid 482:tid 491] [client 20.9.85.117:32587] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuAxsxs8HOc_nWgOW6hfwAAAcc"]
[Thu May 07 01:56:22.469359 2026] [:error] [pid 557:tid 565] [client 20.9.85.117:32577] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuAxjZjFR8Vd8ce80BBbQAAAkY"]
[Thu May 07 01:56:22.846214 2026] [:error] [pid 9664:tid 9773] [client 20.9.85.117:32457] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuAxgH4OZbrg1SjsBN5-gAAAIs"]
[Thu May 07 01:56:23.227443 2026] [:error] [pid 557:tid 561] [client 20.9.85.117:32637] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuAxzZjFR8Vd8ce80BBbgAAAkI"]
[Thu May 07 01:56:23.597584 2026] [:error] [pid 557:tid 560] [client 20.9.85.117:32526] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afuAxzZjFR8Vd8ce80BBcAAAAkE"]
[Thu May 07 01:56:23.973367 2026] [:error] [pid 63810:tid 63826] [client 20.9.85.117:32636] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afuAx3pnbsN9Zf6i5IFSpgAAAYw"]
[Thu May 07 01:56:24.358585 2026] [:error] [pid 592:tid 617] [client 20.9.85.117:32581] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afuAyJiX28mb6xLi2PzJhQAAApI"]
[Thu May 07 01:56:24.731500 2026] [:error] [pid 63810:tid 63818] [client 20.9.85.117:32530] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "afuAyHpnbsN9Zf6i5IFSrAAAAYQ"]
[Thu May 07 01:56:25.110683 2026] [:error] [pid 482:tid 501] [client 20.9.85.117:32635] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afuAycxs8HOc_nWgOW6hggAAAdE"]
[Thu May 07 01:56:25.485407 2026] [:error] [pid 9789:tid 9807] [client 20.9.85.117:32574] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afuAyT_YStPJSCHPkUXWDAAAAFA"]
[Thu May 07 01:56:25.859084 2026] [:error] [pid 9789:tid 9796] [client 20.9.85.117:32568] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afuAyT_YStPJSCHPkUXWEwAAAEU"]
[Thu May 07 01:56:26.240743 2026] [:error] [pid 13414:tid 13431] [client 20.9.85.117:32621] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "afuAykuJQpWjVpJTu_k-7wAAAQ8"]
[Thu May 07 01:56:26.611790 2026] [:error] [pid 13443:tid 13463] [client 20.9.85.117:32603] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afuAygCyfZallDmsQre0pwAAAVI"]
[Thu May 07 01:56:26.990657 2026] [:error] [pid 557:tid 579] [client 20.9.85.117:32541] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afuAyjZjFR8Vd8ce80BBdwAAAlQ"]
[Thu May 07 01:56:27.365955 2026] [:error] [pid 13443:tid 13458] [client 20.9.85.117:32549] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afuAywCyfZallDmsQre0qwAAAU0"]
[Thu May 07 01:56:27.739307 2026] [:error] [pid 482:tid 502] [client 20.9.85.117:32610] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "afuAy8xs8HOc_nWgOW6hhAAAAdI"]
[Thu May 07 01:56:28.116480 2026] [:error] [pid 9664:tid 9775] [client 20.9.85.117:32515] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afuAzAH4OZbrg1SjsBN5_AAAAI0"]
[Thu May 07 01:56:28.499499 2026] [:error] [pid 557:tid 577] [client 20.9.85.117:32565] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afuAzDZjFR8Vd8ce80BBewAAAlI"]
[Thu May 07 01:56:28.873646 2026] [:error] [pid 557:tid 574] [client 20.9.85.117:32516] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afuAzDZjFR8Vd8ce80BBfAAAAk8"]
[Thu May 07 01:56:29.256677 2026] [:error] [pid 9653:tid 9700] [client 20.9.85.117:32524] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "afuAzahJ49Xc4dqq0B53oQAAAAI"]
[Thu May 07 01:56:29.632840 2026] [:error] [pid 557:tid 564] [client 20.9.85.117:32633] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afuAzTZjFR8Vd8ce80BBfgAAAkU"]
[Thu May 07 01:56:30.019163 2026] [:error] [pid 63810:tid 63821] [client 20.9.85.117:32586] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afuAznpnbsN9Zf6i5IFSuQAAAYc"]
[Thu May 07 01:56:30.395190 2026] [:error] [pid 13443:tid 13451] [client 20.9.85.117:32618] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afuAzgCyfZallDmsQre0sAAAAUY"]
[Thu May 07 01:56:30.769814 2026] [:error] [pid 9789:tid 9809] [client 20.9.85.117:32591] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "afuAzj_YStPJSCHPkUXWGAAAAFI"]
[Thu May 07 01:56:31.146899 2026] [:error] [pid 9789:tid 9794] [client 20.9.85.117:32624] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afuAzz_YStPJSCHPkUXWGwAAAEM"]
[Thu May 07 01:56:31.519934 2026] [:error] [pid 9653:tid 9710] [client 20.9.85.117:32550] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afuAz6hJ49Xc4dqq0B53qgAAAAw"]
[Thu May 07 01:56:31.892125 2026] [:error] [pid 9653:tid 9706] [client 20.9.85.117:32620] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afuAz6hJ49Xc4dqq0B53rQAAAAg"]
[Thu May 07 01:56:32.269524 2026] [:error] [pid 557:tid 576] [client 20.9.85.117:32538] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "afuA0DZjFR8Vd8ce80BBgAAAAlE"]
[Thu May 07 01:56:32.648897 2026] [:error] [pid 9653:tid 9701] [client 20.9.85.117:32560] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "afuA0KhJ49Xc4dqq0B53sgAAAAM"]
[Thu May 07 01:56:33.020901 2026] [:error] [pid 9664:tid 9766] [client 20.9.85.117:32578] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "afuA0QH4OZbrg1SjsBN6BgAAAIQ"]
[Thu May 07 01:56:33.393219 2026] [:error] [pid 9789:tid 9807] [client 20.9.85.117:32527] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "afuA0T_YStPJSCHPkUXWHQAAAFA"]
[Thu May 07 01:56:33.764191 2026] [:error] [pid 13443:tid 13446] [client 20.9.85.117:32537] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "afuA0QCyfZallDmsQre0tAAAAUE"]
[Thu May 07 01:56:34.140974 2026] [:error] [pid 13414:tid 13432] [client 20.9.85.117:32593] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "afuA0kuJQpWjVpJTu_k-9wAAARA"]
[Thu May 07 01:56:34.531361 2026] [:error] [pid 9789:tid 9804] [client 20.9.85.117:32605] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "afuA0j_YStPJSCHPkUXWIAAAAE0"]
[Thu May 07 01:56:34.908144 2026] [:error] [pid 9653:tid 9722] [client 20.9.85.117:32531] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "afuA0qhJ49Xc4dqq0B53uQAAABg"]
[Thu May 07 01:56:35.289533 2026] [:error] [pid 13443:tid 13466] [client 20.9.85.117:32520] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "afuA0wCyfZallDmsQre0tQAAAVU"]
[Thu May 07 01:56:35.667439 2026] [:error] [pid 9653:tid 9716] [client 20.9.85.117:32606] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afuA06hJ49Xc4dqq0B53uwAAABI"]
[Thu May 07 01:56:36.042451 2026] [:error] [pid 9659:tid 9736] [client 20.9.85.117:32553] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afuA1PwJnWjd8JHpBtu4fwAAAMI"]
[Thu May 07 01:56:36.419879 2026] [:error] [pid 9664:tid 9778] [client 20.9.85.117:32601] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afuA1AH4OZbrg1SjsBN6CwAAAJA"]
[Thu May 07 01:56:36.791571 2026] [:error] [pid 9659:tid 9739] [client 20.9.85.117:32519] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "afuA1PwJnWjd8JHpBtu4hAAAAMU"]
[Thu May 07 01:56:37.163319 2026] [:error] [pid 9659:tid 9747] [client 20.9.85.117:32551] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "afuA1fwJnWjd8JHpBtu4hgAAAM0"]
[Thu May 07 01:56:37.540533 2026] [:error] [pid 9664:tid 9776] [client 20.9.85.117:32449] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "afuA1QH4OZbrg1SjsBN6DgAAAI4"]
[Thu May 07 01:56:37.918780 2026] [:error] [pid 557:tid 571] [client 20.9.85.117:32540] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "afuA1TZjFR8Vd8ce80BBhwAAAkw"]
[Thu May 07 01:56:38.300664 2026] [:error] [pid 9653:tid 9699] [client 20.9.85.117:32571] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "afuA1qhJ49Xc4dqq0B53xAAAAAE"]
[Thu May 07 01:56:38.673321 2026] [:error] [pid 9653:tid 9709] [client 20.9.85.117:32588] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "afuA1qhJ49Xc4dqq0B53xQAAAAs"]
[Thu May 07 01:56:39.048722 2026] [:error] [pid 9664:tid 9781] [client 20.9.85.117:32448] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "afuA1wH4OZbrg1SjsBN6FAAAAJM"]
[Thu May 07 01:56:39.428488 2026] [:error] [pid 482:tid 492] [client 20.9.85.117:32535] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "afuA18xs8HOc_nWgOW6hjwAAAcg"]
[Thu May 07 01:56:39.807661 2026] [:error] [pid 9653:tid 9700] [client 20.9.85.117:32453] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "afuA16hJ49Xc4dqq0B53zQAAAAI"]
[Thu May 07 01:56:40.182041 2026] [:error] [pid 557:tid 572] [client 20.9.85.117:32614] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fun.php"] [unique_id "afuA2DZjFR8Vd8ce80BBigAAAk0"]
[Thu May 07 01:56:40.560408 2026] [:error] [pid 482:tid 491] [client 20.9.85.117:32556] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fun.php"] [unique_id "afuA2Mxs8HOc_nWgOW6hkAAAAcc"]
[Thu May 07 01:56:40.936571 2026] [:error] [pid 13414:tid 13426] [client 20.9.85.117:32542] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fun.php"] [unique_id "afuA2EuJQpWjVpJTu_k--wAAAQo"]
[Thu May 07 01:56:41.320469 2026] [:error] [pid 13414:tid 13430] [client 20.9.85.117:32522] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fun.php"] [unique_id "afuA2UuJQpWjVpJTu_k-_AAAAQ4"]
[Thu May 07 01:56:41.695907 2026] [:error] [pid 482:tid 484] [client 20.9.85.117:32572] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afuA2cxs8HOc_nWgOW6hlQAAAcA"]
[Thu May 07 01:56:42.077766 2026] [:error] [pid 482:tid 503] [client 20.9.85.117:32583] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afuA2sxs8HOc_nWgOW6hlwAAAdM"]
[Thu May 07 01:56:42.452832 2026] [:error] [pid 9659:tid 9739] [client 20.9.85.117:32555] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afuA2vwJnWjd8JHpBtu4lAAAAMU"]
[Thu May 07 01:56:42.839349 2026] [:error] [pid 9659:tid 9745] [client 20.9.85.117:32563] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afuA2vwJnWjd8JHpBtu4lgAAAMs"]
[Thu May 07 01:56:43.230484 2026] [:error] [pid 9653:tid 9706] [client 20.9.85.117:32547] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "afuA26hJ49Xc4dqq0B531wAAAAg"]
[Thu May 07 01:56:43.604556 2026] [:error] [pid 9664:tid 9774] [client 20.9.85.117:32518] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "afuA2wH4OZbrg1SjsBN6LwAAAIw"]
[Thu May 07 01:56:43.983356 2026] [:error] [pid 9664:tid 9771] [client 20.9.85.117:32573] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "afuA2wH4OZbrg1SjsBN6NAAAAIk"]
[Thu May 07 01:56:44.363384 2026] [:error] [pid 63810:tid 63830] [client 20.9.85.117:32630] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "afuA3HpnbsN9Zf6i5IFS7AAAAZA"]
[Thu May 07 01:56:44.737437 2026] [:error] [pid 9664:tid 9766] [client 20.9.85.117:32609] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "afuA3AH4OZbrg1SjsBN6OgAAAIQ"]
[Thu May 07 01:56:45.116866 2026] [:error] [pid 9664:tid 9781] [client 20.9.85.117:32528] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "afuA3QH4OZbrg1SjsBN6PAAAAJM"]
[Thu May 07 01:56:45.495828 2026] [:error] [pid 592:tid 620] [client 20.9.85.117:32592] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "afuA3ZiX28mb6xLi2PzJlAAAApU"]
[Thu May 07 01:56:45.878667 2026] [:error] [pid 592:tid 617] [client 20.9.85.117:32532] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-trackback.php"] [unique_id "afuA3ZiX28mb6xLi2PzJlQAAApI"]
[Thu May 07 01:56:46.260167 2026] [:error] [pid 9659:tid 9758] [client 20.9.85.117:32523] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afuA3vwJnWjd8JHpBtu4ngAAANg"]
[Thu May 07 01:56:46.630321 2026] [:error] [pid 9664:tid 9772] [client 20.9.85.117:32469] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afuA3gH4OZbrg1SjsBN6QAAAAIo"]
[Thu May 07 01:56:47.004112 2026] [:error] [pid 9664:tid 9775] [client 20.9.85.117:32559] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afuA3wH4OZbrg1SjsBN6QQAAAI0"]
[Thu May 07 01:56:47.380529 2026] [:error] [pid 482:tid 500] [client 20.9.85.117:32512] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afuA38xs8HOc_nWgOW6hnwAAAdA"]
[Thu May 07 01:56:47.751585 2026] [:error] [pid 592:tid 607] [client 20.9.85.117:32456] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afuA35iX28mb6xLi2PzJlgAAAos"]
[Thu May 07 01:56:48.125464 2026] [:error] [pid 482:tid 495] [client 20.9.85.117:32599] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afuA4Mxs8HOc_nWgOW6howAAAcs"]
[Thu May 07 01:56:48.506490 2026] [:error] [pid 9653:tid 9707] [client 20.9.85.117:32454] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afuA4KhJ49Xc4dqq0B534wAAAAk"]
[Thu May 07 01:56:48.888190 2026] [:error] [pid 13414:tid 13418] [client 20.9.85.117:32561] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "afuA4EuJQpWjVpJTu_k_BwAAAQI"]
[Thu May 07 01:56:49.267461 2026] [:error] [pid 482:tid 503] [client 20.9.85.117:32544] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afuA4cxs8HOc_nWgOW6hpQAAAdM"]
[Thu May 07 01:56:49.643604 2026] [:error] [pid 9664:tid 9786] [client 20.9.85.117:32552] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afuA4QH4OZbrg1SjsBN6RQAAAJg"]
[Thu May 07 01:56:50.018251 2026] [:error] [pid 9664:tid 9785] [client 20.9.85.117:32557] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afuA4gH4OZbrg1SjsBN6SQAAAJc"]
[Thu May 07 01:56:50.401293 2026] [:error] [pid 9653:tid 9722] [client 20.9.85.117:32539] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afuA4qhJ49Xc4dqq0B536gAAABg"]
[Thu May 07 01:56:50.780300 2026] [:error] [pid 9664:tid 9764] [client 20.9.85.117:32476] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "afuA4gH4OZbrg1SjsBN6UAAAAII"]
[Thu May 07 01:56:51.163290 2026] [:error] [pid 9664:tid 9783] [client 20.9.85.117:32567] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "afuA4wH4OZbrg1SjsBN6VQAAAJU"]
[Thu May 07 01:56:51.540207 2026] [:error] [pid 592:tid 610] [client 20.9.85.117:32548] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "afuA45iX28mb6xLi2PzJnAAAAo4"]
[Thu May 07 01:56:51.914502 2026] [:error] [pid 482:tid 489] [client 20.9.85.117:32558] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "afuA48xs8HOc_nWgOW6hqQAAAcU"]
[Thu May 07 01:56:52.294955 2026] [:error] [pid 9659:tid 9738] [client 20.9.85.117:32589] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afuA5PwJnWjd8JHpBtu4pgAAAMQ"]
[Thu May 07 01:56:52.670271 2026] [:error] [pid 9653:tid 9708] [client 20.9.85.117:32608] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afuA5KhJ49Xc4dqq0B538wAAAAo"]
[Thu May 07 01:56:53.041164 2026] [:error] [pid 9653:tid 9717] [client 20.9.85.117:32590] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afuA5ahJ49Xc4dqq0B539gAAABM"]
[Thu May 07 01:56:53.426163 2026] [:error] [pid 9659:tid 9756] [client 20.9.85.117:32536] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "afuA5fwJnWjd8JHpBtu4qgAAANY"]
[Thu May 07 01:56:53.799764 2026] [:error] [pid 482:tid 486] [client 20.9.85.117:32472] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afuA5cxs8HOc_nWgOW6hrAAAAcI"]
[Thu May 07 01:56:54.176094 2026] [:error] [pid 9789:tid 9793] [client 20.9.85.117:32570] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afuA5j_YStPJSCHPkUXWIwAAAEI"]
[Thu May 07 01:56:54.550861 2026] [:error] [pid 482:tid 504] [client 20.9.85.117:32468] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afuA5sxs8HOc_nWgOW6hrQAAAdQ"]
[Thu May 07 01:56:54.925542 2026] [:error] [pid 13443:tid 13457] [client 20.9.85.117:32490] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file59.php"] [unique_id "afuA5gCyfZallDmsQre0vQAAAUw"]
[Thu May 07 01:56:55.314689 2026] [:error] [pid 482:tid 497] [client 20.9.85.117:32564] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afuA58xs8HOc_nWgOW6hsQAAAc0"]
[Thu May 07 01:56:55.692994 2026] [:error] [pid 63810:tid 63821] [client 20.9.85.117:32492] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afuA53pnbsN9Zf6i5IFS9QAAAYc"]
[Thu May 07 01:56:56.064872 2026] [:error] [pid 63810:tid 63838] [client 20.9.85.117:32460] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afuA6HpnbsN9Zf6i5IFS9wAAAZg"]
[Thu May 07 01:56:56.454443 2026] [:error] [pid 63810:tid 63825] [client 20.9.85.117:32503] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "afuA6HpnbsN9Zf6i5IFS-QAAAYs"]
[Thu May 07 01:56:56.831550 2026] [:error] [pid 63810:tid 63835] [client 20.9.85.117:32569] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "afuA6HpnbsN9Zf6i5IFS-gAAAZU"]
[Thu May 07 01:56:57.212906 2026] [:error] [pid 482:tid 502] [client 20.9.85.117:32514] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "afuA6cxs8HOc_nWgOW6htwAAAdI"]
[Thu May 07 01:56:57.584861 2026] [:error] [pid 13443:tid 13452] [client 20.9.85.117:32632] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "afuA6QCyfZallDmsQre0xgAAAUc"]
[Thu May 07 01:56:57.962208 2026] [:error] [pid 63810:tid 63834] [client 20.9.85.117:32554] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "afuA6XpnbsN9Zf6i5IFS_QAAAZQ"]
[Thu May 07 01:56:58.346825 2026] [:error] [pid 13414:tid 13419] [client 20.9.85.117:32533] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afuA6kuJQpWjVpJTu_k_EgAAAQM"]
[Thu May 07 01:56:58.722710 2026] [:error] [pid 9664:tid 9763] [client 20.9.85.117:32496] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afuA6gH4OZbrg1SjsBN6WQAAAIE"]
[Thu May 07 01:56:59.101362 2026] [:error] [pid 482:tid 507] [client 20.9.85.117:32463] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afuA68xs8HOc_nWgOW6hugAAAdU"]
[Thu May 07 01:56:59.478494 2026] [:error] [pid 9653:tid 9702] [client 20.9.85.117:32506] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "afuA66hJ49Xc4dqq0B54CgAAAAQ"]
[Thu May 07 01:56:59.854139 2026] [:error] [pid 482:tid 487] [client 20.9.85.117:32465] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "afuA68xs8HOc_nWgOW6hvAAAAcM"]
[Thu May 07 01:57:00.226015 2026] [:error] [pid 482:tid 489] [client 20.9.85.117:32462] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "afuA7Mxs8HOc_nWgOW6hwAAAAcU"]
[Thu May 07 01:57:00.596325 2026] [:error] [pid 592:tid 618] [client 20.9.85.117:32487] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "afuA7JiX28mb6xLi2PzJngAAApM"]
[Thu May 07 01:57:00.966794 2026] [:error] [pid 557:tid 576] [client 20.9.85.117:32464] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "afuA7DZjFR8Vd8ce80BBlAAAAlE"]
[Thu May 07 01:57:01.345120 2026] [:error] [pid 13414:tid 13427] [client 20.9.85.117:32459] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "afuA7UuJQpWjVpJTu_k_GQAAAQs"]
[Thu May 07 01:57:01.724083 2026] [:error] [pid 9659:tid 9750] [client 20.9.85.117:32393] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "afuA7fwJnWjd8JHpBtu4tgAAANA"]
[Thu May 07 01:57:02.099293 2026] [:error] [pid 9664:tid 9779] [client 20.9.85.117:32473] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "afuA7gH4OZbrg1SjsBN6XgAAAJE"]
[Thu May 07 01:57:02.477615 2026] [:error] [pid 482:tid 499] [client 20.9.85.117:32467] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "afuA7sxs8HOc_nWgOW6hxQAAAc8"]
[Thu May 07 01:57:02.855867 2026] [:error] [pid 482:tid 509] [client 20.9.85.117:32455] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afuA7sxs8HOc_nWgOW6hxwAAAdc"]
[Thu May 07 01:57:03.235392 2026] [:error] [pid 9653:tid 9698] [client 20.9.85.117:32485] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afuA76hJ49Xc4dqq0B54GgAAAAA"]
[Thu May 07 01:57:03.610487 2026] [:error] [pid 482:tid 503] [client 20.9.85.117:32390] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afuA78xs8HOc_nWgOW6hzQAAAdM"]
[Thu May 07 01:57:03.991580 2026] [:error] [pid 9664:tid 9770] [client 20.9.85.117:32598] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afuA7wH4OZbrg1SjsBN6YQAAAIg"]
[Thu May 07 01:57:04.363455 2026] [:error] [pid 9659:tid 9753] [client 20.9.85.117:32406] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "afuA8PwJnWjd8JHpBtu4twAAANM"]
[Thu May 07 01:57:04.741122 2026] [:error] [pid 557:tid 565] [client 20.9.85.117:32489] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "afuA8DZjFR8Vd8ce80BBlwAAAkY"]
[Thu May 07 01:57:05.113292 2026] [:error] [pid 592:tid 597] [client 20.9.85.117:32458] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "afuA8ZiX28mb6xLi2PzJoQAAAoE"]
[Thu May 07 01:57:05.495561 2026] [:error] [pid 592:tid 607] [client 20.9.85.117:32461] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "afuA8ZiX28mb6xLi2PzJpAAAAos"]
[Thu May 07 01:57:05.872001 2026] [:error] [pid 557:tid 575] [client 20.9.85.117:32386] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "afuA8TZjFR8Vd8ce80BBmQAAAlA"]
[Thu May 07 01:57:06.252180 2026] [:error] [pid 63810:tid 63823] [client 20.9.85.117:32412] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "afuA8npnbsN9Zf6i5IFTAwAAAYk"]
[Thu May 07 01:57:06.625066 2026] [:error] [pid 482:tid 486] [client 20.9.85.117:32517] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "afuA8sxs8HOc_nWgOW6h0wAAAcI"]
[Thu May 07 01:57:07.003156 2026] [:error] [pid 9653:tid 9700] [client 20.9.85.117:32399] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "afuA86hJ49Xc4dqq0B54HQAAAAI"]
[Thu May 07 01:57:07.380306 2026] [:error] [pid 9664:tid 9767] [client 20.9.85.117:32418] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afuA8wH4OZbrg1SjsBN6ZgAAAIU"]
[Thu May 07 01:57:07.763069 2026] [:error] [pid 9789:tid 9796] [client 20.9.85.117:32354] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afuA8z_YStPJSCHPkUXWLQAAAEU"]
[Thu May 07 01:57:08.134781 2026] [:error] [pid 482:tid 492] [client 20.9.85.117:32395] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afuA9Mxs8HOc_nWgOW6h1QAAAcg"]
[Thu May 07 01:57:08.513268 2026] [:error] [pid 9664:tid 9769] [client 20.9.85.117:32504] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "afuA9AH4OZbrg1SjsBN6aQAAAIc"]
[Thu May 07 01:57:08.893751 2026] [:error] [pid 9653:tid 9699] [client 20.9.85.117:32629] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afuA9KhJ49Xc4dqq0B54HwAAAAE"]
[Thu May 07 01:57:09.266533 2026] [:error] [pid 9653:tid 9721] [client 20.9.85.117:32384] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afuA9ahJ49Xc4dqq0B54IwAAABc"]
[Thu May 07 01:57:09.641100 2026] [:error] [pid 9653:tid 9704] [client 20.9.85.117:32477] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afuA9ahJ49Xc4dqq0B54JwAAAAY"]
[Thu May 07 01:57:10.017347 2026] [:error] [pid 592:tid 621] [client 20.9.85.117:32474] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "afuA9piX28mb6xLi2PzJqQAAApY"]
[Thu May 07 01:57:10.392011 2026] [:error] [pid 482:tid 500] [client 20.9.85.117:32505] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afuA9sxs8HOc_nWgOW6h1wAAAdA"]
[Thu May 07 01:57:10.772967 2026] [:error] [pid 592:tid 602] [client 20.9.85.117:32394] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "afuA9piX28mb6xLi2PzJrAAAAoY"]
[Thu May 07 01:57:11.165568 2026] [proxy_fcgi:error] [pid 63810:tid 63830] [client 20.9.85.117:32494] AH01071: Got error 'Primary script unknown'
[Thu May 07 01:57:11.358274 2026] [proxy_fcgi:error] [pid 63810:tid 63836] [client 20.9.85.117:32494] AH01071: Got error 'Primary script unknown'
[Thu May 07 02:29:28.644290 2026] [:error] [pid 482:tid 509] [client 43.159.152.187:38554] [client 43.159.152.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afuIiMxs8HOc_nWgOW6qpwAAAdc"]
[Thu May 07 03:46:59.166702 2026] [:error] [pid 26604:tid 26739] [client 51.91.253.126:41154] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afuasxHuEPH3IpJw7-95LQAAAJc"]
[Thu May 07 03:47:01.230842 2026] [:error] [pid 26771:tid 26797] [client 51.91.253.126:47576] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afuatQfCN9n48foZdMsu8wAAANg"]
[Thu May 07 03:47:04.369205 2026] [:error] [pid 26604:tid 26725] [client 51.91.253.126:46566] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afuauBHuEPH3IpJw7-95NAAAAIk"]
[Thu May 07 03:47:06.454514 2026] [:error] [pid 26771:tid 26786] [client 51.91.253.126:47578] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afuaugfCN9n48foZdMsvAQAAAM0"]
[Thu May 07 03:47:08.918575 2026] [:error] [pid 26604:tid 26734] [client 51.91.253.126:46582] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afuavBHuEPH3IpJw7-95QQAAAJI"]
[Thu May 07 03:47:10.886931 2026] [:error] [pid 26771:tid 26793] [client 51.91.253.126:46634] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afuavgfCN9n48foZdMsvDwAAANQ"]
[Thu May 07 03:47:13.338337 2026] [:error] [pid 26771:tid 26775] [client 51.91.253.126:48838] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afuawQfCN9n48foZdMsvGQAAAMI"]
[Thu May 07 03:47:15.799388 2026] [:error] [pid 26595:tid 26710] [client 51.91.253.126:48852] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afuaw9jgY8G-YlIWcWw7PgAAAFU"]
[Thu May 07 03:47:18.297705 2026] [:error] [pid 26604:tid 26723] [client 51.91.253.126:48862] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afuaxhHuEPH3IpJw7-95VQAAAIc"]
[Thu May 07 03:47:20.630630 2026] [:error] [pid 26595:tid 26704] [client 51.91.253.126:34174] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afuayNjgY8G-YlIWcWw7QgAAAE8"]
[Thu May 07 03:47:23.006964 2026] [:error] [pid 26771:tid 26787] [client 51.91.253.126:34188] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afuaywfCN9n48foZdMsvOwAAAM4"]
[Thu May 07 03:47:24.935616 2026] [:error] [pid 26604:tid 26739] [client 51.91.253.126:49870] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afuazBHuEPH3IpJw7-95XwAAAJc"]
[Thu May 07 03:47:27.461649 2026] [:error] [pid 26771:tid 26797] [client 51.91.253.126:34202] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afuazwfCN9n48foZdMsvUAAAANg"]
[Thu May 07 03:47:29.372252 2026] [:error] [pid 26604:tid 26735] [client 51.91.253.126:39600] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afua0RHuEPH3IpJw7-95aAAAAJM"]
[Thu May 07 03:47:31.818195 2026] [:error] [pid 26771:tid 26784] [client 51.91.253.126:59180] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afua0wfCN9n48foZdMsvWwAAAMs"]
[Thu May 07 03:47:33.689218 2026] [:error] [pid 26771:tid 26783] [client 51.91.253.126:39606] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afua1QfCN9n48foZdMsvYwAAAMo"]
[Thu May 07 03:47:36.220707 2026] [:error] [pid 26771:tid 26790] [client 51.91.253.126:59190] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afua2AfCN9n48foZdMsvewAAANE"]
[Thu May 07 03:47:38.125872 2026] [:error] [pid 26595:tid 26694] [client 51.91.253.126:39622] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afua2tjgY8G-YlIWcWw7XAAAAEU"]
[Thu May 07 03:47:40.519475 2026] [:error] [pid 26604:tid 26735] [client 51.91.253.126:55642] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afua3BHuEPH3IpJw7-95iwAAAJM"]
[Thu May 07 03:47:42.990501 2026] [:error] [pid 26771:tid 26790] [client 51.91.253.126:55650] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afua3gfCN9n48foZdMsvkgAAANE"]
[Thu May 07 03:47:45.374971 2026] [:error] [pid 26771:tid 26785] [client 51.91.253.126:55660] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afua4QfCN9n48foZdMsvmAAAAMw"]
[Thu May 07 03:47:47.781829 2026] [:error] [pid 26771:tid 26794] [client 51.91.253.126:55670] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afua4wfCN9n48foZdMsvnAAAANU"]
[Thu May 07 03:47:50.085451 2026] [:error] [pid 26590:tid 26682] [client 51.91.253.126:50162] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afua5m7twbroaPgOyQDE7QAAABU"]
[Thu May 07 03:47:52.072502 2026] [:error] [pid 26604:tid 26732] [client 51.91.253.126:36244] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afua6BHuEPH3IpJw7-95mgAAAJA"]
[Thu May 07 03:47:54.389701 2026] [:error] [pid 26771:tid 26790] [client 51.91.253.126:50164] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afua6gfCN9n48foZdMsvqwAAANE"]
[Thu May 07 03:47:56.705231 2026] [:error] [pid 26771:tid 26777] [client 51.91.253.126:50168] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afua7AfCN9n48foZdMsvrgAAAMQ"]
[Thu May 07 03:48:19.034147 2026] [:error] [pid 26771:tid 26778] [client 51.91.253.126:56298] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afubAwfCN9n48foZdMsv6gAAAMU"]
[Thu May 07 03:48:21.452647 2026] [:error] [pid 26590:tid 26671] [client 51.91.253.126:50558] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afubBW7twbroaPgOyQDFDQAAAAo"]
[Thu May 07 03:48:24.077993 2026] [:error] [pid 26771:tid 26774] [client 51.91.253.126:50570] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afubCAfCN9n48foZdMsv9wAAAME"]
[Thu May 07 03:48:26.567111 2026] [:error] [pid 26595:tid 26713] [client 51.91.253.126:50574] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afubCtjgY8G-YlIWcWw7eAAAAFg"]
[Thu May 07 03:48:29.084657 2026] [:error] [pid 26771:tid 26793] [client 51.91.253.126:50578] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afubDQfCN9n48foZdMsv-wAAANQ"]
[Thu May 07 03:48:31.164799 2026] [:error] [pid 26590:tid 26663] [client 51.91.253.126:58454] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afubD27twbroaPgOyQDFGAAAAAI"]
[Thu May 07 03:48:33.037231 2026] [:error] [pid 26771:tid 26779] [client 51.91.253.126:58464] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afubEQfCN9n48foZdMswBQAAAMY"]
[Thu May 07 03:48:34.850566 2026] [:error] [pid 26771:tid 26793] [client 51.91.253.126:58476] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afubEgfCN9n48foZdMswDAAAANQ"]
[Thu May 07 03:48:36.653225 2026] [:error] [pid 26771:tid 26791] [client 51.91.253.126:58488] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afubFAfCN9n48foZdMswEwAAANI"]
[Thu May 07 03:48:38.524750 2026] [:error] [pid 26595:tid 26691] [client 51.91.253.126:58502] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afubFtjgY8G-YlIWcWw7hwAAAEI"]
[Thu May 07 03:48:40.510924 2026] [:error] [pid 26590:tid 26668] [client 51.91.253.126:37482] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afubGG7twbroaPgOyQDFHgAAAAc"]
[Thu May 07 03:48:42.457923 2026] [:error] [pid 26590:tid 26676] [client 51.91.253.126:37498] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afubGm7twbroaPgOyQDFHwAAAA8"]
[Thu May 07 03:48:44.950954 2026] [:error] [pid 26595:tid 26713] [client 51.91.253.126:47722] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afubHNjgY8G-YlIWcWw7jQAAAFg"]
[Thu May 07 03:48:47.401002 2026] [:error] [pid 26590:tid 26664] [client 51.91.253.126:47738] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afubH27twbroaPgOyQDFIAAAAAM"]
[Thu May 07 03:48:49.692743 2026] [:error] [pid 26595:tid 26692] [client 51.91.253.126:47740] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afubIdjgY8G-YlIWcWw7mAAAAEM"]
[Thu May 07 03:48:52.046558 2026] [:error] [pid 26595:tid 26694] [client 51.91.253.126:38440] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afubJNjgY8G-YlIWcWw7mwAAAEU"]
[Thu May 07 03:48:54.141553 2026] [:error] [pid 26771:tid 26781] [client 51.91.253.126:35420] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afubJgfCN9n48foZdMswKwAAAMg"]
[Thu May 07 03:48:56.480692 2026] [:error] [pid 26590:tid 26678] [client 51.91.253.126:38444] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afubKG7twbroaPgOyQDFJQAAABE"]
[Thu May 07 03:48:58.463962 2026] [:error] [pid 26595:tid 26707] [client 51.91.253.126:35424] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afubKtjgY8G-YlIWcWw7oQAAAFI"]
[Thu May 07 03:49:00.727521 2026] [:error] [pid 26590:tid 26677] [client 51.91.253.126:39796] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afubLG7twbroaPgOyQDFKQAAABA"]
[Thu May 07 03:49:02.665564 2026] [:error] [pid 26590:tid 26662] [client 51.91.253.126:55784] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afubLm7twbroaPgOyQDFKgAAAAE"]
[Thu May 07 03:49:05.017440 2026] [:error] [pid 26771:tid 26795] [client 51.91.253.126:39802] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afubMQfCN9n48foZdMswQAAAANY"]
[Thu May 07 03:49:06.959485 2026] [:error] [pid 26771:tid 26792] [client 51.91.253.126:55798] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afubMgfCN9n48foZdMswRQAAANM"]
[Thu May 07 03:49:09.369869 2026] [:error] [pid 26771:tid 26773] [client 51.91.253.126:39808] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afubNQfCN9n48foZdMswSwAAAMA"]
[Thu May 07 03:49:11.713894 2026] [:error] [pid 26771:tid 26779] [client 51.91.253.126:37770] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afubNwfCN9n48foZdMswVAAAAMY"]
[Thu May 07 03:49:13.748527 2026] [:error] [pid 26771:tid 26789] [client 51.91.253.126:39844] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afubOQfCN9n48foZdMswXAAAANA"]
[Thu May 07 03:49:16.103794 2026] [:error] [pid 26595:tid 26707] [client 51.91.253.126:37780] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afubPNjgY8G-YlIWcWw7qwAAAFI"]
[Thu May 07 03:49:37.311110 2026] [:error] [pid 26590:tid 26680] [client 51.91.253.126:48150] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afubUW7twbroaPgOyQDFYAAAABM"]
[Thu May 07 03:49:39.244805 2026] [:error] [pid 26604:tid 26739] [client 51.91.253.126:33198] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afubUxHuEPH3IpJw7-96QwAAAJc"]
[Thu May 07 03:49:41.545318 2026] [:error] [pid 26595:tid 26707] [client 51.91.253.126:40364] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afubVdjgY8G-YlIWcWw73AAAAFI"]
[Thu May 07 03:49:43.899507 2026] [:error] [pid 26771:tid 26780] [client 51.91.253.126:40370] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afubVwfCN9n48foZdMswqAAAAMc"]
[Thu May 07 03:49:45.845007 2026] [:error] [pid 26771:tid 26790] [client 51.91.253.126:48312] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afubWQfCN9n48foZdMswsgAAANE"]
[Thu May 07 03:49:48.379544 2026] [:error] [pid 26590:tid 26664] [client 51.91.253.126:40380] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afubXG7twbroaPgOyQDFbgAAAAM"]
[Thu May 07 03:49:50.170026 2026] [:error] [pid 26604:tid 26723] [client 51.91.253.126:35208] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afubXhHuEPH3IpJw7-96gAAAAIc"]
[Thu May 07 03:49:52.532532 2026] [:error] [pid 26771:tid 26773] [client 51.91.253.126:42108] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afubYAfCN9n48foZdMswvgAAAMA"]
[Thu May 07 03:49:55.107830 2026] [:error] [pid 26771:tid 26778] [client 51.91.253.126:42116] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afubYwfCN9n48foZdMswwgAAAMU"]
[Thu May 07 03:49:56.904141 2026] [:error] [pid 26771:tid 26780] [client 51.91.253.126:35212] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afubZAfCN9n48foZdMswyAAAAMc"]
[Thu May 07 03:49:59.310648 2026] [:error] [pid 26771:tid 26796] [client 51.91.253.126:42120] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afubZwfCN9n48foZdMswygAAANc"]
[Thu May 07 03:50:01.389152 2026] [:error] [pid 26604:tid 26718] [client 51.91.253.126:34974] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afubaRHuEPH3IpJw7-96nAAAAII"]
[Thu May 07 03:50:03.325020 2026] [:error] [pid 26604:tid 26738] [client 51.91.253.126:34986] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afubaxHuEPH3IpJw7-96ogAAAJY"]
[Thu May 07 03:50:05.587751 2026] [:error] [pid 26595:tid 26703] [client 51.91.253.126:41444] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afubbdjgY8G-YlIWcWw7_wAAAE4"]
[Thu May 07 03:50:07.506830 2026] [:error] [pid 26590:tid 26662] [client 51.91.253.126:34994] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afubb27twbroaPgOyQDFdQAAAAE"]
[Thu May 07 03:50:10.106401 2026] [:error] [pid 26771:tid 26785] [client 51.91.253.126:47202] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afubcgfCN9n48foZdMsw5wAAAMw"]
[Thu May 07 03:50:12.100742 2026] [:error] [pid 26771:tid 26786] [client 51.91.253.126:44230] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afubdAfCN9n48foZdMsw8AAAAM0"]
[Thu May 07 03:50:14.697362 2026] [:error] [pid 26771:tid 26789] [client 51.91.253.126:47208] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afubdgfCN9n48foZdMsw_QAAANA"]
[Thu May 07 03:50:16.622479 2026] [:error] [pid 26771:tid 26785] [client 51.91.253.126:44232] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afubeAfCN9n48foZdMsxBQAAAMw"]
[Thu May 07 03:50:19.011125 2026] [:error] [pid 26771:tid 26794] [client 51.91.253.126:47212] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afubewfCN9n48foZdMsxFgAAANU"]
[Thu May 07 03:50:20.941484 2026] [:error] [pid 26604:tid 26717] [client 51.91.253.126:57942] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afubfBHuEPH3IpJw7-96wQAAAIE"]
[Thu May 07 03:50:23.351352 2026] [:error] [pid 26604:tid 26740] [client 51.91.253.126:56206] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afubfxHuEPH3IpJw7-96xwAAAJg"]
[Thu May 07 03:50:25.834762 2026] [:error] [pid 26771:tid 26773] [client 51.91.253.126:56222] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afubgQfCN9n48foZdMsxLAAAAMA"]
[Thu May 07 03:50:28.296970 2026] [:error] [pid 26771:tid 26778] [client 51.91.253.126:56224] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afubhAfCN9n48foZdMsxOwAAAMU"]
[Thu May 07 03:50:30.743829 2026] [:error] [pid 26604:tid 26722] [client 51.91.253.126:40610] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afubhhHuEPH3IpJw7-960gAAAIY"]
[Thu May 07 03:50:33.292252 2026] [:error] [pid 26604:tid 26718] [client 51.91.253.126:40624] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "afubiRHuEPH3IpJw7-961wAAAII"]
[Thu May 07 03:50:54.506436 2026] [:error] [pid 26771:tid 26773] [client 51.91.253.126:38520] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "afubngfCN9n48foZdMsxuwAAAMA"]
[Thu May 07 03:50:56.563759 2026] [:error] [pid 26604:tid 26728] [client 51.91.253.126:38530] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "afuboBHuEPH3IpJw7-97GwAAAIw"]
[Thu May 07 03:50:58.472487 2026] [:error] [pid 26604:tid 26721] [client 51.91.253.126:38544] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afubohHuEPH3IpJw7-97HwAAAIU"]
[Thu May 07 03:51:00.387220 2026] [:error] [pid 26604:tid 26716] [client 51.91.253.126:38190] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afubpBHuEPH3IpJw7-97JAAAAIA"]
[Thu May 07 03:51:02.510545 2026] [:error] [pid 26604:tid 26718] [client 51.91.253.126:38194] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afubphHuEPH3IpJw7-97KwAAAII"]
[Thu May 07 03:51:04.351117 2026] [:error] [pid 26604:tid 26724] [client 51.91.253.126:38200] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afubqBHuEPH3IpJw7-97NgAAAIg"]
[Thu May 07 03:51:06.277499 2026] [:error] [pid 26590:tid 26677] [client 51.91.253.126:38212] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afubqm7twbroaPgOyQDFvAAAABA"]
[Thu May 07 03:51:08.308435 2026] [:error] [pid 26604:tid 26722] [client 51.91.253.126:38222] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afubrBHuEPH3IpJw7-97PwAAAIY"]
[Thu May 07 03:51:10.111410 2026] [:error] [pid 26604:tid 26739] [client 51.91.253.126:45646] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afubrhHuEPH3IpJw7-97RAAAAJc"]
[Thu May 07 03:51:12.238833 2026] [:error] [pid 26771:tid 26788] [client 51.91.253.126:45652] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afubsAfCN9n48foZdMsx4wAAAM8"]
[Thu May 07 03:51:14.052566 2026] [:error] [pid 26771:tid 26788] [client 51.91.253.126:45662] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afubsgfCN9n48foZdMsx6wAAAM8"]
[Thu May 07 03:51:16.001445 2026] [:error] [pid 26771:tid 26792] [client 51.91.253.126:45674] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "afubswfCN9n48foZdMsx9QAAANM"]
[Thu May 07 03:51:18.144649 2026] [:error] [pid 26771:tid 26774] [client 51.91.253.126:45688] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "afubtgfCN9n48foZdMsyAAAAAME"]
[Thu May 07 03:51:20.034529 2026] [:error] [pid 26771:tid 26785] [client 51.91.253.126:39326] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "afubuAfCN9n48foZdMsyAgAAAMw"]
[Thu May 07 03:51:21.935836 2026] [:error] [pid 26604:tid 26729] [client 51.91.253.126:39336] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "afubuRHuEPH3IpJw7-97XQAAAI0"]
[Thu May 07 03:51:24.022978 2026] [:error] [pid 26604:tid 26738] [client 51.91.253.126:39346] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "afubvBHuEPH3IpJw7-97YgAAAJY"]
[Thu May 07 03:51:25.933507 2026] [:error] [pid 26595:tid 26709] [client 51.91.253.126:39352] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afubvdjgY8G-YlIWcWw8ewAAAFQ"]
[Thu May 07 03:51:27.839780 2026] [:error] [pid 26771:tid 26778] [client 51.91.253.126:39362] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afubvwfCN9n48foZdMsyEgAAAMU"]
[Thu May 07 03:51:29.762737 2026] [:error] [pid 26771:tid 26774] [client 51.91.253.126:47676] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afubwQfCN9n48foZdMsyFwAAAME"]
[Thu May 07 03:51:31.665575 2026] [:error] [pid 26771:tid 26777] [client 51.91.253.126:47684] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afubwwfCN9n48foZdMsyIgAAAMQ"]
[Thu May 07 03:51:33.619754 2026] [:error] [pid 26604:tid 26735] [client 51.91.253.126:47686] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "afubxRHuEPH3IpJw7-97dwAAAJM"]
[Thu May 07 03:51:35.373839 2026] [:error] [pid 26595:tid 26707] [client 51.91.253.126:47690] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afubx9jgY8G-YlIWcWw8gwAAAFI"]
[Thu May 07 03:51:37.329148 2026] [:error] [pid 26604:tid 26722] [client 51.91.253.126:47700] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afubyRHuEPH3IpJw7-97gAAAAIY"]
[Thu May 07 03:51:39.277638 2026] [:error] [pid 26771:tid 26794] [client 51.91.253.126:59072] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "afubywfCN9n48foZdMsyLgAAANU"]
[Thu May 07 03:51:41.232971 2026] [:error] [pid 26590:tid 26672] [client 51.91.253.126:59080] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "afubzW7twbroaPgOyQDF5gAAAAs"]
[Thu May 07 03:51:43.206049 2026] [:error] [pid 26771:tid 26797] [client 51.91.253.126:59096] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afubzwfCN9n48foZdMsyOQAAANg"]
[Thu May 07 03:51:45.270895 2026] [:error] [pid 26595:tid 26703] [client 51.91.253.126:59110] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "afub0djgY8G-YlIWcWw8pwAAAE4"]
[Thu May 07 03:51:47.129107 2026] [:error] [pid 26595:tid 26709] [client 51.91.253.126:59114] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "afub09jgY8G-YlIWcWw8qgAAAFQ"]
[Thu May 07 03:51:48.971646 2026] [:error] [pid 26771:tid 26793] [client 51.91.253.126:59126] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afub1AfCN9n48foZdMsyUAAAANQ"]
[Thu May 07 03:51:51.031646 2026] [:error] [pid 26604:tid 26737] [client 51.91.253.126:37000] [client 51.91.253.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afub1xHuEPH3IpJw7-97mQAAAJU"]
[Thu May 07 04:14:38.252809 2026] [:error] [pid 29606:tid 29646] [client 49.234.192.248:49600] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afuhLhR5HjZ1PlSAiKtIMAAAAEU"]
[Thu May 07 04:15:22.120563 2026] [proxy_fcgi:error] [pid 29605:tid 29619] [client 45.86.202.94:41541] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:33.773716 2026] [proxy_fcgi:error] [pid 29606:tid 29665] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:33.984861 2026] [proxy_fcgi:error] [pid 29606:tid 29664] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:34.194762 2026] [proxy_fcgi:error] [pid 29606:tid 29646] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:34.404602 2026] [proxy_fcgi:error] [pid 29606:tid 29658] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:34.614147 2026] [proxy_fcgi:error] [pid 29606:tid 29661] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:34.823468 2026] [proxy_fcgi:error] [pid 29606:tid 29662] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:35.032052 2026] [proxy_fcgi:error] [pid 29606:tid 29655] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:35.241389 2026] [proxy_fcgi:error] [pid 29606:tid 29644] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:35.451660 2026] [proxy_fcgi:error] [pid 29606:tid 29656] [client 4.206.17.23:58437] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:25:35.867241 2026] [:error] [pid 29606:tid 29642] [client 4.206.17.23:58437] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "afuxzxR5HjZ1PlSAiKtfowAAAEE"]
[Thu May 07 05:25:36.289544 2026] [:error] [pid 4539:tid 4559] [client 4.206.17.23:58385] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "afux0IPEZE1565sDGnwbngAAARI"]
[Thu May 07 05:25:36.703598 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:58461] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "afux0IPEZE1565sDGnwboAAAAQ4"]
[Thu May 07 05:25:37.116526 2026] [:error] [pid 29605:tid 29634] [client 4.206.17.23:58487] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/elp.php"] [unique_id "afux0YnxrTjETioEY0Tc9gAAABQ"]
[Thu May 07 05:25:37.535810 2026] [:error] [pid 29710:tid 29725] [client 4.206.17.23:58484] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "afux0f0atTQld9Y2ht_X3gAAAM0"]
[Thu May 07 05:25:37.948884 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:58458] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "afux0abP7TJOAh7WSUNjCwAAAI4"]
[Thu May 07 05:25:38.394572 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:58455] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "afux0v0atTQld9Y2ht_X4QAAAMk"]
[Thu May 07 05:25:38.811412 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:58370] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zc-243.php"] [unique_id "afux0oPEZE1565sDGnwbqQAAAQQ"]
[Thu May 07 05:25:39.230192 2026] [:error] [pid 4539:tid 4561] [client 4.206.17.23:58481] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "afux04PEZE1565sDGnwbrAAAARQ"]
[Thu May 07 05:25:39.645577 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:58383] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "afux04PEZE1565sDGnwbsQAAAQA"]
[Thu May 07 05:25:40.067038 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:58440] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "afux1IPEZE1565sDGnwbtAAAAQI"]
[Thu May 07 05:25:40.494356 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:58475] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bkyac.php"] [unique_id "afux1IPEZE1565sDGnwbtwAAAQk"]
[Thu May 07 05:25:40.910013 2026] [:error] [pid 29605:tid 29638] [client 4.206.17.23:58474] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "afux1InxrTjETioEY0Tc-QAAABg"]
[Thu May 07 05:25:41.329588 2026] [:error] [pid 29605:tid 29622] [client 4.206.17.23:58377] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "afux1YnxrTjETioEY0Tc_AAAAAg"]
[Thu May 07 05:25:41.742971 2026] [:error] [pid 29710:tid 29719] [client 4.206.17.23:58476] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "afux1f0atTQld9Y2ht_X5AAAAMc"]
[Thu May 07 05:25:42.153990 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:58312] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wziar1.php"] [unique_id "afux1v0atTQld9Y2ht_X5gAAAMI"]
[Thu May 07 05:25:42.583625 2026] [:error] [pid 29710:tid 29718] [client 4.206.17.23:58447] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afux1v0atTQld9Y2ht_X6AAAAMY"]
[Thu May 07 05:25:42.995772 2026] [:error] [pid 29710:tid 29727] [client 4.206.17.23:58375] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afux1v0atTQld9Y2ht_X6QAAAM8"]
[Thu May 07 05:25:43.410506 2026] [:error] [pid 29607:tid 29685] [client 4.206.17.23:58388] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afux16bP7TJOAh7WSUNjEAAAAJE"]
[Thu May 07 05:25:43.841826 2026] [:error] [pid 29710:tid 29723] [client 4.206.17.23:58380] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afux1_0atTQld9Y2ht_X7AAAAMs"]
[Thu May 07 05:25:44.264390 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:58444] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "afux2KbP7TJOAh7WSUNjFQAAAIw"]
[Thu May 07 05:25:44.691547 2026] [:error] [pid 29710:tid 29720] [client 4.206.17.23:58452] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "afux2P0atTQld9Y2ht_X7gAAAMg"]
[Thu May 07 05:25:45.107953 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:58462] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "afux2YPEZE1565sDGnwbxAAAAQ0"]
[Thu May 07 05:25:45.526816 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:58371] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7logs.php"] [unique_id "afux2f0atTQld9Y2ht_X8AAAANQ"]
[Thu May 07 05:25:45.938178 2026] [:error] [pid 29607:tid 29688] [client 4.206.17.23:58471] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afux2abP7TJOAh7WSUNjGgAAAJQ"]
[Thu May 07 05:25:46.353519 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:58477] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afux2v0atTQld9Y2ht_X8gAAANg"]
[Thu May 07 05:25:46.775533 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58456] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afux2oPEZE1565sDGnwbygAAARc"]
[Thu May 07 05:25:47.193210 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:58392] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afux24PEZE1565sDGnwbzgAAAQ0"]
[Thu May 07 05:25:47.607396 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:58472] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "afux26bP7TJOAh7WSUNjHQAAAI4"]
[Thu May 07 05:25:48.019466 2026] [:error] [pid 29710:tid 29726] [client 4.206.17.23:58494] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "afux3P0atTQld9Y2ht_X9AAAAM4"]
[Thu May 07 05:25:48.436950 2026] [:error] [pid 29710:tid 29735] [client 4.206.17.23:58483] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "afux3P0atTQld9Y2ht_X9wAAANc"]
[Thu May 07 05:25:48.849753 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:58486] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "afux3IPEZE1565sDGnwb1AAAAQA"]
[Thu May 07 05:25:49.264451 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:58470] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ctex1.php"] [unique_id "afux3YPEZE1565sDGnwb1gAAAQg"]
[Thu May 07 05:25:49.685024 2026] [:error] [pid 29606:tid 29645] [client 4.206.17.23:58467] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ctex1.php"] [unique_id "afux3RR5HjZ1PlSAiKtfpgAAAEQ"]
[Thu May 07 05:25:50.113163 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58386] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ctex1.php"] [unique_id "afux3oPEZE1565sDGnwb2QAAARc"]
[Thu May 07 05:25:50.526789 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:58488] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ctex1.php"] [unique_id "afux3oPEZE1565sDGnwb3AAAAQQ"]
[Thu May 07 05:25:50.938508 2026] [:error] [pid 29606:tid 29647] [client 4.206.17.23:58409] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "afux3hR5HjZ1PlSAiKtfpwAAAEY"]
[Thu May 07 05:25:51.362173 2026] [:error] [pid 29606:tid 29661] [client 4.206.17.23:58393] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "afux3xR5HjZ1PlSAiKtfqQAAAFQ"]
[Thu May 07 05:25:51.775607 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:58398] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "afux34PEZE1565sDGnwb3QAAAQ4"]
[Thu May 07 05:25:52.201640 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58372] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lb.php"] [unique_id "afux4IPEZE1565sDGnwb3gAAAQw"]
[Thu May 07 05:25:52.626404 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:58391] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afux4InxrTjETioEY0Tc_wAAAAU"]
[Thu May 07 05:25:53.038014 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:58434] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afux4YPEZE1565sDGnwb4gAAAQc"]
[Thu May 07 05:25:53.456577 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:58307] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afux4f0atTQld9Y2ht_YAgAAANQ"]
[Thu May 07 05:25:53.874914 2026] [:error] [pid 29710:tid 29729] [client 4.206.17.23:58403] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "afux4f0atTQld9Y2ht_YBAAAANE"]
[Thu May 07 05:25:54.301951 2026] [:error] [pid 29606:tid 29648] [client 4.206.17.23:58445] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "afux4hR5HjZ1PlSAiKtfrgAAAEc"]
[Thu May 07 05:25:54.716766 2026] [:error] [pid 29605:tid 29636] [client 4.206.17.23:58387] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "afux4onxrTjETioEY0TdAAAAABY"]
[Thu May 07 05:25:55.127582 2026] [:error] [pid 29606:tid 29654] [client 4.206.17.23:58435] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "afux4xR5HjZ1PlSAiKtfsQAAAE0"]
[Thu May 07 05:25:55.543230 2026] [:error] [pid 29606:tid 29650] [client 4.206.17.23:58369] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mh.php"] [unique_id "afux4xR5HjZ1PlSAiKtfswAAAEk"]
[Thu May 07 05:25:55.959323 2026] [:error] [pid 4539:tid 4561] [client 4.206.17.23:58432] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afux44PEZE1565sDGnwb7QAAARQ"]
[Thu May 07 05:25:56.383169 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58469] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afux5IPEZE1565sDGnwb8AAAAQs"]
[Thu May 07 05:25:56.803504 2026] [:error] [pid 29607:tid 29684] [client 4.206.17.23:58464] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afux5KbP7TJOAh7WSUNjHwAAAJA"]
[Thu May 07 05:25:57.217456 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:58478] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "afux5abP7TJOAh7WSUNjIAAAAIw"]
[Thu May 07 05:25:57.636250 2026] [:error] [pid 4539:tid 4559] [client 4.206.17.23:58400] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "afux5YPEZE1565sDGnwb-AAAARI"]
[Thu May 07 05:25:58.055885 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:58424] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "afux5oPEZE1565sDGnwb-gAAAQg"]
[Thu May 07 05:25:58.486695 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58433] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "afux5oPEZE1565sDGnwb_QAAAQw"]
[Thu May 07 05:25:58.900805 2026] [:error] [pid 29606:tid 29646] [client 4.206.17.23:58404] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auth.php"] [unique_id "afux5hR5HjZ1PlSAiKtfuQAAAEU"]
[Thu May 07 05:25:59.325443 2026] [:error] [pid 29605:tid 29627] [client 4.206.17.23:58451] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "afux54nxrTjETioEY0TdBAAAAA0"]
[Thu May 07 05:25:59.751003 2026] [:error] [pid 29605:tid 29637] [client 4.206.17.23:58465] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "afux54nxrTjETioEY0TdBwAAABc"]
[Thu May 07 05:26:00.164895 2026] [:error] [pid 29606:tid 29658] [client 4.206.17.23:58460] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "afux6BR5HjZ1PlSAiKtfugAAAFE"]
[Thu May 07 05:26:00.591293 2026] [:error] [pid 29606:tid 29660] [client 4.206.17.23:58406] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "afux6BR5HjZ1PlSAiKtfuwAAAFM"]
[Thu May 07 05:26:01.021509 2026] [:error] [pid 29606:tid 29655] [client 4.206.17.23:58402] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "afux6RR5HjZ1PlSAiKtfvQAAAE4"]
[Thu May 07 05:26:01.452217 2026] [:error] [pid 29605:tid 29626] [client 4.206.17.23:58399] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "afux6YnxrTjETioEY0TdDwAAAAw"]
[Thu May 07 05:26:01.863899 2026] [:error] [pid 29605:tid 29618] [client 4.206.17.23:58490] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "afux6YnxrTjETioEY0TdEAAAAAQ"]
[Thu May 07 05:26:02.281938 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:58442] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "afux6hR5HjZ1PlSAiKtfwAAAAEg"]
[Thu May 07 05:26:02.697418 2026] [:error] [pid 29605:tid 29629] [client 4.206.17.23:58468] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "afux6onxrTjETioEY0TdFAAAAA8"]
[Thu May 07 05:26:03.111026 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:58311] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "afux64nxrTjETioEY0TdFwAAAAU"]
[Thu May 07 05:26:03.522304 2026] [:error] [pid 29605:tid 29630] [client 4.206.17.23:58425] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "afux64nxrTjETioEY0TdGgAAABA"]
[Thu May 07 05:26:03.943020 2026] [:error] [pid 29607:tid 29689] [client 4.206.17.23:58407] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-png.php"] [unique_id "afux66bP7TJOAh7WSUNjKQAAAJU"]
[Thu May 07 05:26:04.356907 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:58453] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "afux7P0atTQld9Y2ht_YCQAAANg"]
[Thu May 07 05:26:04.769347 2026] [:error] [pid 29710:tid 29716] [client 4.206.17.23:58320] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "afux7P0atTQld9Y2ht_YCwAAAMQ"]
[Thu May 07 05:26:05.182149 2026] [:error] [pid 29605:tid 29627] [client 4.206.17.23:58426] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "afux7YnxrTjETioEY0TdHAAAAA0"]
[Thu May 07 05:26:05.607388 2026] [:error] [pid 29607:tid 29692] [client 4.206.17.23:58379] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "afux7abP7TJOAh7WSUNjLgAAAJg"]
[Thu May 07 05:26:06.029391 2026] [:error] [pid 29605:tid 29624] [client 4.206.17.23:58417] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afux7onxrTjETioEY0TdHQAAAAo"]
[Thu May 07 05:26:06.461093 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:58463] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afux7oPEZE1565sDGnwcCAAAAQg"]
[Thu May 07 05:26:06.881833 2026] [:error] [pid 29607:tid 29684] [client 4.206.17.23:58410] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afux7qbP7TJOAh7WSUNjMAAAAJA"]
[Thu May 07 05:26:07.335972 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:58459] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afux76bP7TJOAh7WSUNjMQAAAIw"]
[Thu May 07 05:26:07.750520 2026] [:error] [pid 29606:tid 29643] [client 4.206.17.23:58491] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afux7xR5HjZ1PlSAiKtf2QAAAEI"]
[Thu May 07 05:26:08.162755 2026] [:error] [pid 29607:tid 29675] [client 4.206.17.23:58405] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afux8KbP7TJOAh7WSUNjMgAAAIc"]
[Thu May 07 05:26:08.587690 2026] [:error] [pid 29607:tid 29683] [client 4.206.17.23:58408] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afux8KbP7TJOAh7WSUNjMwAAAI8"]
[Thu May 07 05:26:09.006312 2026] [:error] [pid 29606:tid 29642] [client 4.206.17.23:58493] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afux8RR5HjZ1PlSAiKtf6gAAAEE"]
[Thu May 07 05:26:09.423316 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58368] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "afux8YPEZE1565sDGnwcOwAAAQs"]
[Thu May 07 05:26:09.837508 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:58354] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "afux8YPEZE1565sDGnwcPQAAAQI"]
[Thu May 07 05:26:10.261561 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:58421] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "afux8oPEZE1565sDGnwcQAAAAQ0"]
[Thu May 07 05:26:10.679372 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:58382] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bfil.php"] [unique_id "afux8oPEZE1565sDGnwcQgAAAQ8"]
[Thu May 07 05:26:11.091809 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:58341] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "afux84PEZE1565sDGnwcQwAAARA"]
[Thu May 07 05:26:11.510441 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58374] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "afux84PEZE1565sDGnwcRwAAAQw"]
[Thu May 07 05:26:11.951402 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:58457] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "afux84PEZE1565sDGnwcSgAAAQg"]
[Thu May 07 05:26:12.390367 2026] [:error] [pid 4539:tid 4544] [client 4.206.17.23:58384] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abrand.php"] [unique_id "afux9IPEZE1565sDGnwcTQAAAQM"]
[Thu May 07 05:26:12.820133 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:58394] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "afux9KbP7TJOAh7WSUNjNAAAAI4"]
[Thu May 07 05:26:13.238895 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58419] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "afux9YPEZE1565sDGnwcUQAAAQw"]
[Thu May 07 05:26:13.680853 2026] [:error] [pid 29710:tid 29724] [client 4.206.17.23:58430] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "afux9f0atTQld9Y2ht_YHwAAAMw"]
[Thu May 07 05:26:14.092833 2026] [:error] [pid 29607:tid 29673] [client 4.206.17.23:58466] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "afux9qbP7TJOAh7WSUNjNgAAAIU"]
[Thu May 07 05:26:14.540022 2026] [:error] [pid 29605:tid 29614] [client 4.206.17.23:58353] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "afux9onxrTjETioEY0TdIgAAAAA"]
[Thu May 07 05:26:14.975340 2026] [:error] [pid 29607:tid 29685] [client 4.206.17.23:58259] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "afux9qbP7TJOAh7WSUNjOQAAAJE"]
[Thu May 07 05:26:15.386376 2026] [:error] [pid 29606:tid 29658] [client 4.206.17.23:58260] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "afux9xR5HjZ1PlSAiKtf7gAAAFE"]
[Thu May 07 05:26:15.811757 2026] [:error] [pid 29605:tid 29622] [client 4.206.17.23:58420] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amwxl.php"] [unique_id "afux94nxrTjETioEY0TdIwAAAAg"]
[Thu May 07 05:26:16.224680 2026] [:error] [pid 29606:tid 29656] [client 4.206.17.23:58395] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "afux-BR5HjZ1PlSAiKtf8AAAAE8"]
[Thu May 07 05:26:16.650333 2026] [:error] [pid 29606:tid 29642] [client 4.206.17.23:58415] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "afux-BR5HjZ1PlSAiKtf8wAAAEE"]
[Thu May 07 05:26:17.069427 2026] [:error] [pid 29607:tid 29668] [client 4.206.17.23:58443] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "afux-abP7TJOAh7WSUNjPQAAAIA"]
[Thu May 07 05:26:17.524685 2026] [:error] [pid 29606:tid 29665] [client 4.206.17.23:58318] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "afux-RR5HjZ1PlSAiKtf-AAAAFg"]
[Thu May 07 05:26:17.940539 2026] [:error] [pid 29607:tid 29683] [client 4.206.17.23:58335] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/userfuns.php"] [unique_id "afux-abP7TJOAh7WSUNjPwAAAI8"]
[Thu May 07 05:26:18.360750 2026] [:error] [pid 29605:tid 29617] [client 4.206.17.23:58366] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/userfuns.php"] [unique_id "afux-onxrTjETioEY0TdJwAAAAM"]
[Thu May 07 05:26:18.789601 2026] [:error] [pid 29606:tid 29663] [client 4.206.17.23:58304] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/userfuns.php"] [unique_id "afux-hR5HjZ1PlSAiKtf-wAAAFY"]
[Thu May 07 05:26:19.200320 2026] [:error] [pid 29710:tid 29727] [client 4.206.17.23:58485] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/userfuns.php"] [unique_id "afux-_0atTQld9Y2ht_YJAAAAM8"]
[Thu May 07 05:26:19.623631 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:58389] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "afux-4PEZE1565sDGnwcWAAAAQA"]
[Thu May 07 05:26:20.078170 2026] [:error] [pid 29606:tid 29643] [client 4.206.17.23:58428] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "afux_BR5HjZ1PlSAiKtf_QAAAEI"]
[Thu May 07 05:26:20.512117 2026] [:error] [pid 29607:tid 29670] [client 4.206.17.23:58275] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "afux_KbP7TJOAh7WSUNjQgAAAII"]
[Thu May 07 05:26:20.927905 2026] [:error] [pid 29607:tid 29676] [client 4.206.17.23:58285] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/menu.php"] [unique_id "afux_KbP7TJOAh7WSUNjQwAAAIg"]
[Thu May 07 05:26:21.407634 2026] [:error] [pid 29606:tid 29658] [client 4.206.17.23:58350] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afux_RR5HjZ1PlSAiKtgAwAAAFE"]
[Thu May 07 05:26:21.830453 2026] [:error] [pid 29710:tid 29731] [client 4.206.17.23:58448] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afux_f0atTQld9Y2ht_YJgAAANM"]
[Thu May 07 05:26:22.245125 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:58473] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afux_qbP7TJOAh7WSUNjRgAAAJc"]
[Thu May 07 05:26:22.683222 2026] [:error] [pid 29605:tid 29614] [client 4.206.17.23:58376] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "afux_onxrTjETioEY0TdMQAAAAA"]
[Thu May 07 05:26:23.111400 2026] [:error] [pid 29607:tid 29673] [client 4.206.17.23:58441] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "afux_6bP7TJOAh7WSUNjRwAAAIU"]
[Thu May 07 05:26:23.526177 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:58449] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "afux__0atTQld9Y2ht_YJwAAAME"]
[Thu May 07 05:26:23.939016 2026] [:error] [pid 29710:tid 29720] [client 4.206.17.23:58361] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "afux__0atTQld9Y2ht_YKQAAAMg"]
[Thu May 07 05:26:24.363157 2026] [:error] [pid 29606:tid 29658] [client 4.206.17.23:58329] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/saorix1.php"] [unique_id "afuyABR5HjZ1PlSAiKtgEAAAAFE"]
[Thu May 07 05:26:24.780969 2026] [:error] [pid 29607:tid 29684] [client 4.206.17.23:58401] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afuyAKbP7TJOAh7WSUNjSAAAAJA"]
[Thu May 07 05:26:25.200421 2026] [:error] [pid 29606:tid 29662] [client 4.206.17.23:58357] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afuyARR5HjZ1PlSAiKtgFQAAAFU"]
[Thu May 07 05:26:25.625282 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:58454] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afuyAYnxrTjETioEY0TdNQAAAAU"]
[Thu May 07 05:26:26.048667 2026] [:error] [pid 29607:tid 29683] [client 4.206.17.23:58446] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afuyAqbP7TJOAh7WSUNjSwAAAI8"]
[Thu May 07 05:26:26.462615 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:58356] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "afuyAoPEZE1565sDGnwcXAAAARA"]
[Thu May 07 05:26:26.882701 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58255] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "afuyAoPEZE1565sDGnwcXwAAAQw"]
[Thu May 07 05:26:27.301514 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58308] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "afuyA4PEZE1565sDGnwcYgAAARc"]
[Thu May 07 05:26:27.719055 2026] [:error] [pid 4539:tid 4563] [client 4.206.17.23:58319] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/rip.php"] [unique_id "afuyA4PEZE1565sDGnwcZAAAARY"]
[Thu May 07 05:26:28.139954 2026] [:error] [pid 29710:tid 29729] [client 4.206.17.23:58309] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afuyBP0atTQld9Y2ht_YLgAAANE"]
[Thu May 07 05:26:28.552466 2026] [:error] [pid 29606:tid 29663] [client 4.206.17.23:58321] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afuyBBR5HjZ1PlSAiKtgHQAAAFY"]
[Thu May 07 05:26:28.963722 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:58397] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afuyBInxrTjETioEY0TdOgAAAAc"]
[Thu May 07 05:26:29.383859 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58422] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gptsh.php"] [unique_id "afuyBYPEZE1565sDGnwcbwAAAQs"]
[Thu May 07 05:26:29.806303 2026] [:error] [pid 29606:tid 29645] [client 4.206.17.23:58450] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "afuyBRR5HjZ1PlSAiKtgIAAAAEQ"]
[Thu May 07 05:26:30.233546 2026] [:error] [pid 29605:tid 29626] [client 4.206.17.23:58418] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "afuyBonxrTjETioEY0TdPAAAAAw"]
[Thu May 07 05:26:30.682260 2026] [:error] [pid 29605:tid 29632] [client 4.206.17.23:58390] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "afuyBonxrTjETioEY0TdPgAAABI"]
[Thu May 07 05:26:31.150382 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:58364] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "afuyB4PEZE1565sDGnwccQAAAQk"]
[Thu May 07 05:26:31.590310 2026] [:error] [pid 29606:tid 29647] [client 4.206.17.23:58436] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "afuyBxR5HjZ1PlSAiKtgIgAAAEY"]
[Thu May 07 05:26:32.059506 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:58323] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "afuyCKbP7TJOAh7WSUNjUwAAAJc"]
[Thu May 07 05:26:32.508563 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:58423] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "afuyCIPEZE1565sDGnwcdQAAAQQ"]
[Thu May 07 05:26:33.032152 2026] [:error] [pid 4539:tid 4551] [client 4.206.17.23:58367] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bgymj.php"] [unique_id "afuyCYPEZE1565sDGnwceQAAAQo"]
[Thu May 07 05:26:33.587679 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58381] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "afuyCYPEZE1565sDGnwcfAAAAQs"]
[Thu May 07 05:26:34.037596 2026] [:error] [pid 29710:tid 29718] [client 4.206.17.23:58414] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "afuyCv0atTQld9Y2ht_YMAAAAMY"]
[Thu May 07 05:26:34.536537 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:58316] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "afuyCoPEZE1565sDGnwcggAAAQc"]
[Thu May 07 05:26:34.953405 2026] [:error] [pid 29710:tid 29733] [client 4.206.17.23:58492] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "afuyCv0atTQld9Y2ht_YMgAAANU"]
[Thu May 07 05:26:35.455485 2026] [proxy_fcgi:error] [pid 29607:tid 29678] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:35.663390 2026] [proxy_fcgi:error] [pid 29607:tid 29676] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:35.882939 2026] [proxy_fcgi:error] [pid 29607:tid 29682] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:36.091449 2026] [proxy_fcgi:error] [pid 29607:tid 29679] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:36.505495 2026] [proxy_fcgi:error] [pid 29607:tid 29672] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:36.726579 2026] [proxy_fcgi:error] [pid 29607:tid 29685] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:36.935788 2026] [proxy_fcgi:error] [pid 29607:tid 29684] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:37.144643 2026] [proxy_fcgi:error] [pid 29607:tid 29671] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:37.354637 2026] [proxy_fcgi:error] [pid 29607:tid 29692] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:37.562763 2026] [proxy_fcgi:error] [pid 29607:tid 29686] [client 4.206.17.23:58489] AH01071: Got error 'Primary script unknown'
[Thu May 07 05:26:37.767885 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:58489] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "afuyDabP7TJOAh7WSUNjbwAAAJM"]
[Thu May 07 05:26:38.201209 2026] [:error] [pid 29710:tid 29723] [client 4.206.17.23:58373] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "afuyDv0atTQld9Y2ht_YNQAAAMs"]
[Thu May 07 05:26:38.686703 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:58330] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "afuyDv0atTQld9Y2ht_YOAAAAMk"]
[Thu May 07 05:26:39.117789 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58317] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Cap.php"] [unique_id "afuyD4PEZE1565sDGnwcmwAAAQs"]
[Thu May 07 05:26:39.614817 2026] [:error] [pid 29607:tid 29673] [client 4.206.17.23:58336] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "afuyD6bP7TJOAh7WSUNjdAAAAIU"]
[Thu May 07 05:26:40.051648 2026] [:error] [pid 29606:tid 29651] [client 4.206.17.23:58412] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "afuyEBR5HjZ1PlSAiKtgNQAAAEo"]
[Thu May 07 05:26:40.506826 2026] [:error] [pid 29606:tid 29644] [client 4.206.17.23:58256] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "afuyEBR5HjZ1PlSAiKtgNwAAAEM"]
[Thu May 07 05:26:40.979223 2026] [:error] [pid 29607:tid 29671] [client 4.206.17.23:58331] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tfm.php"] [unique_id "afuyEKbP7TJOAh7WSUNjdwAAAIM"]
[Thu May 07 05:26:41.401621 2026] [:error] [pid 29606:tid 29663] [client 4.206.17.23:58480] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "afuyERR5HjZ1PlSAiKtgOgAAAFY"]
[Thu May 07 05:26:41.840357 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:58308] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "afuyEYnxrTjETioEY0TdRgAAAAc"]
[Thu May 07 05:26:42.269202 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:58347] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "afuyEqbP7TJOAh7WSUNjfAAAAI0"]
[Thu May 07 05:26:42.718869 2026] [:error] [pid 29607:tid 29683] [client 4.206.17.23:58338] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xper1.php"] [unique_id "afuyEqbP7TJOAh7WSUNjfgAAAI8"]
[Thu May 07 05:26:43.178534 2026] [:error] [pid 29607:tid 29678] [client 4.206.17.23:58327] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "afuyE6bP7TJOAh7WSUNjggAAAIo"]
[Thu May 07 05:26:43.649323 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:58250] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "afuyE_0atTQld9Y2ht_YOwAAAMo"]
[Thu May 07 05:26:44.130789 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:58278] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "afuyFIPEZE1565sDGnwcpwAAAQU"]
[Thu May 07 05:26:44.573633 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:58315] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t00l.php"] [unique_id "afuyFIPEZE1565sDGnwcqQAAAQk"]
[Thu May 07 05:26:45.042591 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:58303] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "afuyFYnxrTjETioEY0TdTAAAAAU"]
[Thu May 07 05:26:45.552153 2026] [:error] [pid 29605:tid 29631] [client 4.206.17.23:58411] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "afuyFYnxrTjETioEY0TdTgAAABE"]
[Thu May 07 05:26:45.992341 2026] [:error] [pid 29605:tid 29617] [client 4.206.17.23:58358] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "afuyFYnxrTjETioEY0TdUAAAAAM"]
[Thu May 07 05:26:46.435170 2026] [:error] [pid 29605:tid 29623] [client 4.206.17.23:58245] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp1.php"] [unique_id "afuyFonxrTjETioEY0TdVAAAAAk"]
[Thu May 07 05:26:46.909987 2026] [:error] [pid 4539:tid 4561] [client 4.206.17.23:58482] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "afuyFoPEZE1565sDGnwcsgAAARQ"]
[Thu May 07 05:26:47.335719 2026] [:error] [pid 4539:tid 4563] [client 4.206.17.23:58264] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "afuyF4PEZE1565sDGnwctgAAARY"]
[Thu May 07 05:26:47.783800 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:58201] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "afuyF4PEZE1565sDGnwctwAAAQU"]
[Thu May 07 05:26:48.196803 2026] [:error] [pid 29710:tid 29716] [client 4.206.17.23:58337] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acc.php"] [unique_id "afuyGP0atTQld9Y2ht_YQQAAAMQ"]
[Thu May 07 05:26:48.616040 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:58200] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "afuyGP0atTQld9Y2ht_YQwAAAMI"]
[Thu May 07 05:26:49.064559 2026] [:error] [pid 29710:tid 29726] [client 4.206.17.23:58412] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "afuyGf0atTQld9Y2ht_YRQAAAM4"]
[Thu May 07 05:26:49.505131 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:58248] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "afuyGYPEZE1565sDGnwcvwAAAQ4"]
[Thu May 07 05:26:49.951359 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:58253] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "afuyGabP7TJOAh7WSUNjiQAAAJM"]
[Thu May 07 05:26:50.374385 2026] [:error] [pid 29607:tid 29670] [client 4.206.17.23:58363] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "afuyGqbP7TJOAh7WSUNjiwAAAII"]
[Thu May 07 05:26:50.787882 2026] [:error] [pid 29607:tid 29676] [client 4.206.17.23:58495] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "afuyGqbP7TJOAh7WSUNjjQAAAIg"]
[Thu May 07 05:26:51.207587 2026] [:error] [pid 29607:tid 29688] [client 4.206.17.23:58416] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "afuyG6bP7TJOAh7WSUNjkQAAAJQ"]
[Thu May 07 05:26:51.619884 2026] [:error] [pid 29607:tid 29673] [client 4.206.17.23:58339] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "afuyG6bP7TJOAh7WSUNjlQAAAIU"]
[Thu May 07 05:26:52.047543 2026] [:error] [pid 29710:tid 29715] [client 4.206.17.23:58273] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "afuyHP0atTQld9Y2ht_YSAAAAMM"]
[Thu May 07 05:26:52.460273 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:58431] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "afuyHP0atTQld9Y2ht_YTAAAAME"]
[Thu May 07 05:26:52.885696 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:58252] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "afuyHP0atTQld9Y2ht_YUAAAAMA"]
[Thu May 07 05:26:53.309533 2026] [:error] [pid 4539:tid 4565] [client 4.206.17.23:58269] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/packsin1.php"] [unique_id "afuyHYPEZE1565sDGnwcyAAAARg"]
[Thu May 07 05:26:53.720366 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:58301] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "afuyHYPEZE1565sDGnwcyQAAAQ4"]
[Thu May 07 05:26:54.136002 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:58296] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "afuyHqbP7TJOAh7WSUNjmgAAAIw"]
[Thu May 07 05:26:54.549137 2026] [:error] [pid 29606:tid 29641] [client 4.206.17.23:58348] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "afuyHhR5HjZ1PlSAiKtgRQAAAEA"]
[Thu May 07 05:26:54.971042 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:58413] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "afuyHoPEZE1565sDGnwczQAAAQI"]
[Thu May 07 05:26:55.386249 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58360] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "afuyH4PEZE1565sDGnwczwAAAQs"]
[Thu May 07 05:26:55.797451 2026] [:error] [pid 4539:tid 4558] [client 4.206.17.23:58210] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "afuyH4PEZE1565sDGnwc0QAAARE"]
[Thu May 07 05:26:56.209418 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:58276] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "afuyIIPEZE1565sDGnwc0wAAAQc"]
[Thu May 07 05:26:56.630619 2026] [:error] [pid 4539:tid 4562] [client 4.206.17.23:58270] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws78.php"] [unique_id "afuyIIPEZE1565sDGnwc1gAAARU"]
[Thu May 07 05:26:57.048465 2026] [:error] [pid 29607:tid 29668] [client 4.206.17.23:58365] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "afuyIabP7TJOAh7WSUNjoQAAAIA"]
[Thu May 07 05:26:57.506364 2026] [:error] [pid 4539:tid 4544] [client 4.206.17.23:58355] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "afuyIYPEZE1565sDGnwc3QAAAQM"]
[Thu May 07 05:26:57.918619 2026] [:error] [pid 4539:tid 4551] [client 4.206.17.23:58249] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "afuyIYPEZE1565sDGnwc3wAAAQo"]
[Thu May 07 05:26:58.352513 2026] [:error] [pid 29607:tid 29674] [client 4.206.17.23:58332] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/motu.php"] [unique_id "afuyIqbP7TJOAh7WSUNjpAAAAIY"]
[Thu May 07 05:26:58.766359 2026] [:error] [pid 29607:tid 29671] [client 4.206.17.23:58241] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afuyIqbP7TJOAh7WSUNjpwAAAIM"]
[Thu May 07 05:26:59.181585 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:58305] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afuyI4PEZE1565sDGnwc4gAAARA"]
[Thu May 07 05:26:59.597495 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:58261] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afuyI4PEZE1565sDGnwc5AAAAQE"]
[Thu May 07 05:27:00.009765 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:58344] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afuyJBR5HjZ1PlSAiKtgSQAAAEg"]
[Thu May 07 05:27:00.428133 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:58194] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afuyJP0atTQld9Y2ht_YXQAAAMo"]
[Thu May 07 05:27:00.899984 2026] [:error] [pid 29605:tid 29620] [client 4.206.17.23:58284] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afuyJInxrTjETioEY0TdXgAAAAY"]
[Thu May 07 05:27:01.316552 2026] [:error] [pid 29606:tid 29648] [client 4.206.17.23:58281] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afuyJRR5HjZ1PlSAiKtgUAAAAEc"]
[Thu May 07 05:27:01.746068 2026] [:error] [pid 29606:tid 29662] [client 4.206.17.23:58333] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afuyJRR5HjZ1PlSAiKtgUQAAAFU"]
[Thu May 07 05:27:02.157811 2026] [:error] [pid 4539:tid 4559] [client 4.206.17.23:58306] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "afuyJoPEZE1565sDGnwc7QAAARI"]
[Thu May 07 05:27:02.604500 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:58267] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "afuyJoPEZE1565sDGnwc7wAAARA"]
[Thu May 07 05:27:03.019172 2026] [:error] [pid 29710:tid 29733] [client 4.206.17.23:58325] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "afuyJ_0atTQld9Y2ht_YYgAAANU"]
[Thu May 07 05:27:03.442475 2026] [:error] [pid 29605:tid 29623] [client 4.206.17.23:58427] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8573.php"] [unique_id "afuyJ4nxrTjETioEY0TdYAAAAAk"]
[Thu May 07 05:27:03.883186 2026] [:error] [pid 29710:tid 29730] [client 4.206.17.23:58322] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "afuyJ_0atTQld9Y2ht_YZgAAANI"]
[Thu May 07 05:27:04.309954 2026] [:error] [pid 29606:tid 29665] [client 4.206.17.23:58244] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "afuyKBR5HjZ1PlSAiKtgVQAAAFg"]
[Thu May 07 05:27:04.759281 2026] [:error] [pid 29710:tid 29726] [client 4.206.17.23:58351] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "afuyKP0atTQld9Y2ht_YagAAAM4"]
[Thu May 07 05:27:05.187820 2026] [:error] [pid 29710:tid 29723] [client 4.206.17.23:58176] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sadcut1.php"] [unique_id "afuyKf0atTQld9Y2ht_YcgAAAMs"]
[Thu May 07 05:27:05.618195 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:58396] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "afuyKabP7TJOAh7WSUNjuAAAAJI"]
[Thu May 07 05:27:06.050525 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:58429] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "afuyKv0atTQld9Y2ht_YegAAAMI"]
[Thu May 07 05:27:06.465798 2026] [:error] [pid 4539:tid 4547] [client 4.206.17.23:58324] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "afuyKoPEZE1565sDGnwdAQAAAQY"]
[Thu May 07 05:27:06.889712 2026] [:error] [pid 29606:tid 29642] [client 4.206.17.23:58349] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "afuyKhR5HjZ1PlSAiKtgVwAAAEE"]
[Thu May 07 05:27:07.302862 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:58326] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "afuyK4nxrTjETioEY0TdZQAAAAc"]
[Thu May 07 05:27:07.723788 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:58362] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "afuyKxR5HjZ1PlSAiKtgXAAAAEg"]
[Thu May 07 05:27:08.139535 2026] [:error] [pid 29605:tid 29625] [client 4.206.17.23:58258] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "afuyLInxrTjETioEY0TdZgAAAAs"]
[Thu May 07 05:27:08.563445 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:58283] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xwx1.php"] [unique_id "afuyLKbP7TJOAh7WSUNjuQAAAJc"]
[Thu May 07 05:27:08.984074 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:58271] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/prosellers8.php"] [unique_id "afuyLIPEZE1565sDGnwdCAAAAQQ"]
[Thu May 07 05:27:09.402110 2026] [:error] [pid 29710:tid 29734] [client 4.206.17.23:58268] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/prosellers8.php"] [unique_id "afuyLf0atTQld9Y2ht_YhgAAANY"]
[Thu May 07 05:27:09.819071 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:58314] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/prosellers8.php"] [unique_id "afuyLYPEZE1565sDGnwdDQAAAQk"]
[Thu May 07 05:27:10.232538 2026] [:error] [pid 29606:tid 29665] [client 4.206.17.23:58479] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/prosellers8.php"] [unique_id "afuyLhR5HjZ1PlSAiKtgYwAAAFg"]
[Thu May 07 05:27:10.651875 2026] [:error] [pid 29606:tid 29654] [client 4.206.17.23:58251] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop.php"] [unique_id "afuyLhR5HjZ1PlSAiKtgZQAAAE0"]
[Thu May 07 05:27:11.065031 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:58290] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop.php"] [unique_id "afuyL4PEZE1565sDGnwdFwAAAQQ"]
[Thu May 07 05:27:11.481481 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:58345] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop.php"] [unique_id "afuyL4PEZE1565sDGnwdGwAAAQU"]
[Thu May 07 05:27:11.892835 2026] [:error] [pid 4539:tid 4565] [client 4.206.17.23:58342] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shop.php"] [unique_id "afuyL4PEZE1565sDGnwdHgAAARg"]
[Thu May 07 05:27:12.311616 2026] [:error] [pid 29607:tid 29677] [client 4.206.17.23:58193] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "afuyMKbP7TJOAh7WSUNjvQAAAIk"]
[Thu May 07 05:27:12.725300 2026] [:error] [pid 29607:tid 29685] [client 4.206.17.23:58439] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "afuyMKbP7TJOAh7WSUNjvgAAAJE"]
[Thu May 07 05:27:13.149472 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58254] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "afuyMYPEZE1565sDGnwdIgAAARc"]
[Thu May 07 05:27:13.575692 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:58313] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ww.php"] [unique_id "afuyMabP7TJOAh7WSUNjwQAAAJI"]
[Thu May 07 05:27:13.988062 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:58262] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "afuyMYPEZE1565sDGnwdKAAAAQ8"]
[Thu May 07 05:27:14.399721 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:58334] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "afuyMoPEZE1565sDGnwdKwAAAQs"]
[Thu May 07 05:27:14.810650 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:58346] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "afuyMhR5HjZ1PlSAiKtgaQAAAEg"]
[Thu May 07 05:27:15.223945 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:58266] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fsjzs.php"] [unique_id "afuyM4PEZE1565sDGnwdMAAAARA"]
[Thu May 07 05:27:15.637403 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:58227] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "afuyM4PEZE1565sDGnwdMQAAAQg"]
[Thu May 07 05:27:16.053760 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58302] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "afuyNIPEZE1565sDGnwdMgAAARc"]
[Thu May 07 05:27:16.464178 2026] [:error] [pid 4539:tid 4558] [client 4.206.17.23:58191] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "afuyNIPEZE1565sDGnwdMwAAARE"]
[Thu May 07 05:27:16.884187 2026] [:error] [pid 29605:tid 29633] [client 4.206.17.23:58195] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cwclass.php"] [unique_id "afuyNInxrTjETioEY0TdbAAAABM"]
[Thu May 07 05:27:17.298389 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:58199] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "afuyNabP7TJOAh7WSUNjxgAAAI0"]
[Thu May 07 05:27:17.715133 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:58343] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "afuyNf0atTQld9Y2ht_YjgAAAMo"]
[Thu May 07 05:27:18.133374 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:58203] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "afuyNoPEZE1565sDGnwdOQAAAQE"]
[Thu May 07 05:27:18.552928 2026] [:error] [pid 29607:tid 29679] [client 4.206.17.23:58340] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit-tags.php"] [unique_id "afuyNqbP7TJOAh7WSUNjywAAAIs"]
[Thu May 07 05:27:18.970892 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:58179] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuyNoPEZE1565sDGnwdPAAAAQc"]
[Thu May 07 05:27:19.382463 2026] [:error] [pid 29710:tid 29733] [client 4.206.17.23:58328] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuyN_0atTQld9Y2ht_YjwAAANU"]
[Thu May 07 05:27:19.813306 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:58263] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuyN4PEZE1565sDGnwdPgAAARM"]
[Thu May 07 05:27:20.231784 2026] [:error] [pid 4539:tid 4551] [client 4.206.17.23:58289] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "afuyOIPEZE1565sDGnwdQQAAAQo"]
[Thu May 07 05:27:20.647067 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:58378] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "afuyOIPEZE1565sDGnwdQwAAAQI"]
[Thu May 07 05:27:21.071065 2026] [:error] [pid 29607:tid 29685] [client 4.206.17.23:58217] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "afuyOabP7TJOAh7WSUNjzgAAAJE"]
[Thu May 07 05:27:21.492678 2026] [:error] [pid 29607:tid 29689] [client 4.206.17.23:58243] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "afuyOabP7TJOAh7WSUNj0AAAAJU"]
[Thu May 07 05:27:21.916790 2026] [:error] [pid 29607:tid 29684] [client 4.206.17.23:58247] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "afuyOabP7TJOAh7WSUNj0gAAAJA"]
[Thu May 07 05:27:22.330019 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:58359] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afuyOqbP7TJOAh7WSUNj0wAAAJM"]
[Thu May 07 05:27:22.753570 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58198] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afuyOoPEZE1565sDGnwdSAAAARc"]
[Thu May 07 05:27:23.167937 2026] [:error] [pid 29606:tid 29663] [client 4.206.17.23:58287] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afuyOxR5HjZ1PlSAiKtgcQAAAFY"]
[Thu May 07 05:27:23.618431 2026] [:error] [pid 29605:tid 29634] [client 4.206.17.23:58298] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afuyO4nxrTjETioEY0TdeQAAABQ"]
[Thu May 07 05:27:24.044074 2026] [:error] [pid 29607:tid 29679] [client 4.206.17.23:58292] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "afuyPKbP7TJOAh7WSUNj2AAAAIs"]
[Thu May 07 05:27:24.463082 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:58294] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "afuyPIPEZE1565sDGnwdUwAAAQE"]
[Thu May 07 05:27:24.882059 2026] [:error] [pid 29606:tid 29657] [client 4.206.17.23:58240] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "afuyPBR5HjZ1PlSAiKtgdQAAAFA"]
[Thu May 07 05:27:25.300978 2026] [:error] [pid 29606:tid 29664] [client 4.206.17.23:58295] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ai.php"] [unique_id "afuyPRR5HjZ1PlSAiKtgdgAAAFc"]
[Thu May 07 05:27:25.732135 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:58177] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "afuyPYPEZE1565sDGnwdWAAAARc"]
[Thu May 07 05:27:26.160668 2026] [:error] [pid 29710:tid 29735] [client 4.206.17.23:58143] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "afuyPv0atTQld9Y2ht_YmAAAANc"]
[Thu May 07 05:27:26.586745 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:58114] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "afuyPonxrTjETioEY0TdewAAAAU"]
[Thu May 07 05:27:27.033209 2026] [:error] [pid 4539:tid 4563] [client 4.206.17.23:58180] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jga.php"] [unique_id "afuyP4PEZE1565sDGnwdXQAAARY"]
[Thu May 07 05:27:27.449764 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:58186] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "afuyP4PEZE1565sDGnwdYQAAAQE"]
[Thu May 07 05:27:27.890938 2026] [:error] [pid 4539:tid 4547] [client 4.206.17.23:58438] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "afuyP4PEZE1565sDGnwdYwAAAQY"]
[Thu May 07 05:27:28.341683 2026] [:error] [pid 4539:tid 4544] [client 4.206.17.23:58176] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "afuyQIPEZE1565sDGnwdZQAAAQM"]
[Thu May 07 05:27:28.764603 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:58226] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "afuyQP0atTQld9Y2ht_YnQAAAME"]
[Thu May 07 05:27:29.178081 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:58140] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "afuyQYPEZE1565sDGnwdaAAAAQw"]
[Thu May 07 05:27:29.587841 2026] [:error] [pid 29710:tid 29731] [client 4.206.17.23:58277] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "afuyQf0atTQld9Y2ht_YnwAAANM"]
[Thu May 07 05:27:30.012455 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:58113] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "afuyQoPEZE1565sDGnwdawAAAQA"]
[Thu May 07 05:27:30.431895 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:58129] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gk.php"] [unique_id "afuyQoPEZE1565sDGnwdbAAAAQ8"]
[Thu May 07 05:27:30.849039 2026] [:error] [pid 4539:tid 4561] [client 4.206.17.23:58219] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afuyQoPEZE1565sDGnwdbQAAARQ"]
[Thu May 07 05:27:31.265420 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:58265] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afuyQ_0atTQld9Y2ht_YpQAAANQ"]
[Thu May 07 05:27:31.678388 2026] [:error] [pid 29606:tid 29665] [client 4.206.17.23:58257] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afuyQxR5HjZ1PlSAiKtgegAAAFg"]
[Thu May 07 05:27:32.089895 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:58228] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afuyRKbP7TJOAh7WSUNj4QAAAI4"]
[Thu May 07 05:27:32.503971 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:58293] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "afuyRInxrTjETioEY0TdgQAAAAc"]
[Thu May 07 05:27:32.915370 2026] [:error] [pid 29606:tid 29663] [client 4.206.17.23:58215] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "afuyRBR5HjZ1PlSAiKtgfQAAAFY"]
[Thu May 07 05:27:33.349421 2026] [:error] [pid 29606:tid 29641] [client 4.206.17.23:58232] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "afuyRRR5HjZ1PlSAiKtgfwAAAEA"]
[Thu May 07 05:27:33.767533 2026] [:error] [pid 29710:tid 29723] [client 4.206.17.23:58222] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "afuyRf0atTQld9Y2ht_YqAAAAMs"]
[Thu May 07 06:25:08.882182 2026] [:error] [pid 29606:tid 29644] [client 31.223.9.175:55853] [client 31.223.9.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.9.175, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afu_xBR5HjZ1PlSAiKtuZwAAAEM"]
[Thu May 07 06:25:08.894906 2026] [proxy_fcgi:error] [pid 29606:tid 29644] [client 31.223.9.175:55853] AH01071: Got error 'Primary script unknown'
[Thu May 07 06:35:49.350209 2026] [:error] [pid 29606:tid 29651] [client 112.202.102.12:59714] [client 112.202.102.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.102.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afvCRRR5HjZ1PlSAiKtx9gAAAEo"]
[Thu May 07 06:35:49.363057 2026] [proxy_fcgi:error] [pid 29606:tid 29651] [client 112.202.102.12:59714] AH01071: Got error 'Primary script unknown'
[Thu May 07 06:36:47.454675 2026] [:error] [pid 29607:tid 29692] [client 112.202.102.12:60696] [client 112.202.102.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.102.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afvCf6bP7TJOAh7WSUN7mAAAAJg"]
[Thu May 07 06:36:47.469767 2026] [proxy_fcgi:error] [pid 29607:tid 29692] [client 112.202.102.12:60696] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:06:19.273487 2026] [:error] [pid 29607:tid 29692] [client 176.38.10.26:62485] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afvXe6bP7TJOAh7WSUObLQAAAJg"]
[Thu May 07 08:06:20.431877 2026] [:error] [pid 29606:tid 29661] [client 176.38.10.26:62498] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "afvXfBR5HjZ1PlSAiKuKaQAAAFQ"]
[Thu May 07 08:06:22.786506 2026] [:error] [pid 29710:tid 29713] [client 176.38.10.26:62550] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afvXfv0atTQld9Y2ht8ZXwAAAME"]
[Thu May 07 08:06:23.341463 2026] [:error] [pid 29607:tid 29668] [client 176.38.10.26:62559] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afvXf6bP7TJOAh7WSUObPQAAAIA"]
[Thu May 07 08:06:26.539065 2026] [:error] [pid 29607:tid 29688] [client 176.38.10.26:62597] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afvXgqbP7TJOAh7WSUObRAAAAJQ"]
[Thu May 07 08:06:27.651220 2026] [:error] [pid 29605:tid 29614] [client 176.38.10.26:62614] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "afvXg4nxrTjETioEY0QDSgAAAAA"]
[Thu May 07 08:06:30.225431 2026] [:error] [pid 29710:tid 29736] [client 176.38.10.26:62657] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afvXhv0atTQld9Y2ht8ZbQAAANg"]
[Thu May 07 08:06:30.782373 2026] [:error] [pid 29605:tid 29635] [client 176.38.10.26:62667] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afvXhonxrTjETioEY0QDTgAAABU"]
[Thu May 07 08:06:33.967204 2026] [:error] [pid 29607:tid 29672] [client 176.38.10.26:62710] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afvXiabP7TJOAh7WSUObTAAAAIQ"]
[Thu May 07 08:06:35.088332 2026] [:error] [pid 29710:tid 29721] [client 176.38.10.26:62734] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "afvXi_0atTQld9Y2ht8ZdAAAAMk"]
[Thu May 07 08:06:37.638167 2026] [:error] [pid 29605:tid 29631] [client 176.38.10.26:62791] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afvXjYnxrTjETioEY0QDXAAAABE"]
[Thu May 07 08:06:38.191291 2026] [:error] [pid 29605:tid 29628] [client 176.38.10.26:62798] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afvXjonxrTjETioEY0QDZAAAAA4"]
[Thu May 07 08:06:40.921516 2026] [:error] [pid 29607:tid 29676] [client 176.38.10.26:62839] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afvXkKbP7TJOAh7WSUObUgAAAIg"]
[Thu May 07 08:06:41.472249 2026] [:error] [pid 29607:tid 29685] [client 176.38.10.26:62841] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "afvXkabP7TJOAh7WSUObUwAAAJE"]
[Thu May 07 08:06:44.329761 2026] [:error] [pid 29606:tid 29663] [client 176.38.10.26:62878] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afvXlBR5HjZ1PlSAiKuKowAAAFY"]
[Thu May 07 08:06:45.449462 2026] [:error] [pid 4539:tid 4556] [client 176.38.10.26:62893] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afvXlYPEZE1565sDGnx9ZAAAAQ8"]
[Thu May 07 08:06:48.311416 2026] [:error] [pid 4539:tid 4542] [client 176.38.10.26:62931] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afvXmIPEZE1565sDGnx9awAAAQE"]
[Thu May 07 08:06:49.435741 2026] [:error] [pid 4539:tid 4562] [client 176.38.10.26:62941] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afvXmYPEZE1565sDGnx9bQAAARU"]
[Thu May 07 08:06:52.568768 2026] [:error] [pid 29710:tid 29719] [client 176.38.10.26:62978] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afvXnP0atTQld9Y2ht8ZjQAAAMc"]
[Thu May 07 08:06:53.671569 2026] [:error] [pid 29710:tid 29718] [client 176.38.10.26:62996] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afvXnf0atTQld9Y2ht8ZkQAAAMY"]
[Thu May 07 08:06:55.880307 2026] [:error] [pid 29710:tid 29728] [client 176.38.10.26:63027] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afvXn_0atTQld9Y2ht8ZmwAAANA"]
[Thu May 07 08:06:56.433554 2026] [:error] [pid 29710:tid 29714] [client 176.38.10.26:63034] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afvXoP0atTQld9Y2ht8ZoQAAAMI"]
[Thu May 07 08:06:59.270064 2026] [:error] [pid 29606:tid 29657] [client 176.38.10.26:63061] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afvXoxR5HjZ1PlSAiKuKrgAAAFA"]
[Thu May 07 08:07:00.384183 2026] [:error] [pid 29710:tid 29716] [client 176.38.10.26:63071] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afvXpP0atTQld9Y2ht8ZrwAAAMQ"]
[Thu May 07 08:07:02.453411 2026] [:error] [pid 29710:tid 29719] [client 176.38.10.26:63106] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afvXpv0atTQld9Y2ht8ZtQAAAMc"]
[Thu May 07 08:07:03.008877 2026] [:error] [pid 29605:tid 29614] [client 176.38.10.26:63110] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afvXp4nxrTjETioEY0QDiQAAAAA"]
[Thu May 07 08:07:05.460483 2026] [:error] [pid 29606:tid 29663] [client 176.38.10.26:63132] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afvXqRR5HjZ1PlSAiKuKuQAAAFY"]
[Thu May 07 08:07:06.010937 2026] [:error] [pid 29605:tid 29634] [client 176.38.10.26:63145] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afvXqonxrTjETioEY0QDkAAAABQ"]
[Thu May 07 08:07:08.408776 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:63172] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvXrIPEZE1565sDGnx9kgAAARQ"]
[Thu May 07 08:07:08.960515 2026] [:error] [pid 29710:tid 29718] [client 176.38.10.26:63175] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvXrP0atTQld9Y2ht8ZyAAAAMY"]
[Thu May 07 08:07:11.660478 2026] [:error] [pid 29710:tid 29734] [client 176.38.10.26:63202] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvXr_0atTQld9Y2ht8Z1wAAANY"]
[Thu May 07 08:07:12.772306 2026] [:error] [pid 29606:tid 29644] [client 176.38.10.26:63215] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvXsBR5HjZ1PlSAiKuKwAAAAEM"]
[Thu May 07 08:07:15.873150 2026] [:error] [pid 29605:tid 29638] [client 176.38.10.26:63236] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afvXs4nxrTjETioEY0QDnAAAABg"]
[Thu May 07 08:07:42.020118 2026] [:error] [pid 29710:tid 29722] [client 176.38.10.26:63475] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afvXzv0atTQld9Y2ht8agAAAAMo"]
[Thu May 07 08:07:43.139650 2026] [:error] [pid 29605:tid 29622] [client 176.38.10.26:63525] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afvXz4nxrTjETioEY0QDswAAAAg"]
[Thu May 07 08:07:44.256627 2026] [:error] [pid 29607:tid 29691] [client 176.38.10.26:63537] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afvX0KbP7TJOAh7WSUOb7AAAAJc"]
[Thu May 07 08:07:46.528022 2026] [:error] [pid 4539:tid 4546] [client 176.38.10.26:63559] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afvX0oPEZE1565sDGnx-HgAAAQU"]
[Thu May 07 08:07:47.081457 2026] [:error] [pid 4539:tid 4549] [client 176.38.10.26:63568] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afvX04PEZE1565sDGnx-IwAAAQg"]
[Thu May 07 08:07:49.931332 2026] [:error] [pid 29605:tid 29634] [client 176.38.10.26:63589] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afvX1YnxrTjETioEY0QDzQAAABQ"]
[Thu May 07 08:07:51.047188 2026] [:error] [pid 4539:tid 4545] [client 176.38.10.26:63600] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afvX14PEZE1565sDGnx-RAAAAQQ"]
[Thu May 07 08:07:53.902327 2026] [:error] [pid 4539:tid 4562] [client 176.38.10.26:63630] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afvX2YPEZE1565sDGnx-YgAAARU"]
[Thu May 07 08:07:55.024609 2026] [:error] [pid 29710:tid 29715] [client 176.38.10.26:63646] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afvX2_0atTQld9Y2ht8akwAAAMM"]
[Thu May 07 08:07:57.355365 2026] [:error] [pid 29606:tid 29651] [client 176.38.10.26:63666] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afvX3RR5HjZ1PlSAiKuLJwAAAEo"]
[Thu May 07 08:07:57.918473 2026] [:error] [pid 4539:tid 4543] [client 176.38.10.26:63670] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afvX3YPEZE1565sDGnx-fwAAAQI"]
[Thu May 07 08:08:00.629452 2026] [:error] [pid 4539:tid 4551] [client 176.38.10.26:63693] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afvX4IPEZE1565sDGnx-igAAAQo"]
[Thu May 07 08:08:01.740565 2026] [:error] [pid 4539:tid 4550] [client 176.38.10.26:63702] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "afvX4YPEZE1565sDGnx-jwAAAQk"]
[Thu May 07 08:08:04.577547 2026] [:error] [pid 29607:tid 29687] [client 176.38.10.26:63733] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afvX5KbP7TJOAh7WSUOcHAAAAJM"]
[Thu May 07 08:08:05.692765 2026] [:error] [pid 4539:tid 4555] [client 176.38.10.26:63740] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afvX5YPEZE1565sDGnx-pgAAAQ4"]
[Thu May 07 08:08:08.021274 2026] [:error] [pid 29710:tid 29720] [client 176.38.10.26:63765] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afvX6P0atTQld9Y2ht8azgAAAMg"]
[Thu May 07 08:08:08.580772 2026] [:error] [pid 29710:tid 29725] [client 176.38.10.26:63770] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afvX6P0atTQld9Y2ht8a0AAAAM0"]
[Thu May 07 08:08:11.484551 2026] [:error] [pid 29607:tid 29682] [client 176.38.10.26:63792] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afvX66bP7TJOAh7WSUOcMgAAAI4"]
[Thu May 07 08:08:12.622495 2026] [:error] [pid 4539:tid 4565] [client 176.38.10.26:63801] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "afvX7IPEZE1565sDGnx-xQAAARg"]
[Thu May 07 08:08:14.943774 2026] [:error] [pid 29606:tid 29665] [client 176.38.10.26:63822] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afvX7hR5HjZ1PlSAiKuLSwAAAFg"]
[Thu May 07 08:08:15.500815 2026] [:error] [pid 29607:tid 29685] [client 176.38.10.26:63826] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afvX76bP7TJOAh7WSUOcNwAAAJE"]
[Thu May 07 08:08:18.153529 2026] [:error] [pid 29607:tid 29682] [client 176.38.10.26:63839] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afvX8qbP7TJOAh7WSUOcQgAAAI4"]
[Thu May 07 08:08:19.264475 2026] [:error] [pid 29605:tid 29618] [client 176.38.10.26:63852] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "afvX84nxrTjETioEY0QEAQAAAAQ"]
[Thu May 07 08:08:22.130405 2026] [:error] [pid 29605:tid 29616] [client 176.38.10.26:63874] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afvX9onxrTjETioEY0QEBwAAAAI"]
[Thu May 07 08:08:23.238942 2026] [:error] [pid 29606:tid 29659] [client 176.38.10.26:63884] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afvX9xR5HjZ1PlSAiKuLYwAAAFI"]
[Thu May 07 08:08:26.260657 2026] [:error] [pid 4539:tid 4563] [client 176.38.10.26:63905] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afvX-oPEZE1565sDGnx-_wAAARY"]
[Thu May 07 08:08:27.403393 2026] [:error] [pid 4539:tid 4559] [client 176.38.10.26:63918] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afvX-4PEZE1565sDGnx_BAAAARI"]
[Thu May 07 08:08:30.320610 2026] [:error] [pid 4539:tid 4547] [client 176.38.10.26:63939] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afvX_oPEZE1565sDGnx_GwAAAQY"]
[Thu May 07 08:08:31.437972 2026] [:error] [pid 29710:tid 29736] [client 176.38.10.26:63945] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afvX__0atTQld9Y2ht8bBQAAANg"]
[Thu May 07 08:08:33.643535 2026] [:error] [pid 29605:tid 29618] [client 176.38.10.26:63965] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afvYAYnxrTjETioEY0QEFwAAAAQ"]
[Thu May 07 08:08:34.194854 2026] [:error] [pid 4539:tid 4550] [client 176.38.10.26:63971] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afvYAoPEZE1565sDGnx_JQAAAQk"]
[Thu May 07 08:08:37.409478 2026] [:error] [pid 29607:tid 29674] [client 176.38.10.26:63990] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afvYBabP7TJOAh7WSUOcYwAAAIY"]
[Thu May 07 08:08:38.524197 2026] [:error] [pid 29710:tid 29726] [client 176.38.10.26:64000] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afvYBv0atTQld9Y2ht8bNgAAAM4"]
[Thu May 07 08:09:05.683598 2026] [:error] [pid 4539:tid 4557] [client 176.38.10.26:64025] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afvYIYPEZE1565sDGnx_hAAAARA"]
[Thu May 07 08:09:06.244905 2026] [:error] [pid 29605:tid 29628] [client 176.38.10.26:64219] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afvYIonxrTjETioEY0QEUgAAAA4"]
[Thu May 07 08:09:06.797636 2026] [:error] [pid 4539:tid 4552] [client 176.38.10.26:64224] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afvYIoPEZE1565sDGnx_jgAAAQs"]
[Thu May 07 08:09:09.360364 2026] [:error] [pid 29607:tid 29685] [client 176.38.10.26:64245] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afvYJabP7TJOAh7WSUOckQAAAJE"]
[Thu May 07 08:09:09.917849 2026] [:error] [pid 29605:tid 29620] [client 176.38.10.26:64247] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afvYJYnxrTjETioEY0QEVQAAAAY"]
[Thu May 07 08:09:12.737019 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:64261] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afvYKIPEZE1565sDGnx_pgAAARQ"]
[Thu May 07 08:09:13.849217 2026] [:error] [pid 4539:tid 4548] [client 176.38.10.26:64268] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afvYKYPEZE1565sDGnx_rgAAAQc"]
[Thu May 07 08:09:16.091489 2026] [:error] [pid 29605:tid 29634] [client 176.38.10.26:64287] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afvYLInxrTjETioEY0QEWgAAABQ"]
[Thu May 07 08:09:16.646099 2026] [:error] [pid 29605:tid 29627] [client 176.38.10.26:64293] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afvYLInxrTjETioEY0QEYQAAAA0"]
[Thu May 07 08:09:19.119045 2026] [:error] [pid 4539:tid 4559] [client 176.38.10.26:64308] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afvYL4PEZE1565sDGnx_vAAAARI"]
[Thu May 07 08:09:19.673804 2026] [:error] [pid 4539:tid 4542] [client 176.38.10.26:64313] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afvYL4PEZE1565sDGnx_vgAAAQE"]
[Thu May 07 08:09:22.525452 2026] [:error] [pid 4539:tid 4562] [client 176.38.10.26:64326] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afvYMoPEZE1565sDGnx_wQAAARU"]
[Thu May 07 08:09:23.649131 2026] [:error] [pid 29607:tid 29680] [client 176.38.10.26:64333] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afvYM6bP7TJOAh7WSUOcpgAAAIw"]
[Thu May 07 08:09:25.998730 2026] [:error] [pid 29607:tid 29676] [client 176.38.10.26:64350] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afvYNabP7TJOAh7WSUOcpwAAAIg"]
[Thu May 07 08:09:26.554830 2026] [:error] [pid 29606:tid 29646] [client 176.38.10.26:64356] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afvYNhR5HjZ1PlSAiKuLtQAAAEU"]
[Thu May 07 08:09:29.311417 2026] [:error] [pid 29607:tid 29673] [client 176.38.10.26:64374] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afvYOabP7TJOAh7WSUOcqQAAAIU"]
[Thu May 07 08:09:30.423655 2026] [:error] [pid 4539:tid 4555] [client 176.38.10.26:64380] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afvYOoPEZE1565sDGnx_1AAAAQ4"]
[Thu May 07 08:09:32.605611 2026] [:error] [pid 29710:tid 29722] [client 176.38.10.26:64404] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afvYPP0atTQld9Y2ht8bwQAAAMo"]
[Thu May 07 08:09:33.162883 2026] [:error] [pid 29710:tid 29724] [client 176.38.10.26:64408] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afvYPf0atTQld9Y2ht8bxQAAAMw"]
[Thu May 07 08:09:36.135541 2026] [:error] [pid 29710:tid 29735] [client 176.38.10.26:64422] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afvYQP0atTQld9Y2ht8b7gAAANc"]
[Thu May 07 08:09:37.245634 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:64431] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afvYQYPEZE1565sDGnx_5AAAARQ"]
[Thu May 07 08:09:39.644656 2026] [:error] [pid 4539:tid 4541] [client 176.38.10.26:64449] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afvYQ4PEZE1565sDGnx_6wAAAQA"]
[Thu May 07 08:09:40.197801 2026] [:error] [pid 29607:tid 29669] [client 176.38.10.26:64454] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afvYRKbP7TJOAh7WSUOcywAAAIE"]
[Thu May 07 08:09:42.295114 2026] [:error] [pid 29607:tid 29678] [client 176.38.10.26:64471] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afvYRqbP7TJOAh7WSUOc2QAAAIo"]
[Thu May 07 08:09:42.843712 2026] [:error] [pid 29710:tid 29713] [client 176.38.10.26:64475] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afvYRv0atTQld9Y2ht8cUQAAAME"]
[Thu May 07 08:09:45.886246 2026] [:error] [pid 4539:tid 4554] [client 176.38.10.26:64489] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afvYSYPEZE1565sDGnyAIAAAAQ0"]
[Thu May 07 08:09:47.006451 2026] [:error] [pid 29607:tid 29676] [client 176.38.10.26:64498] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afvYS6bP7TJOAh7WSUOc3wAAAIg"]
[Thu May 07 08:09:49.486523 2026] [:error] [pid 29605:tid 29616] [client 176.38.10.26:64524] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afvYTYnxrTjETioEY0QEegAAAAI"]
[Thu May 07 08:09:50.043432 2026] [:error] [pid 4539:tid 4550] [client 176.38.10.26:64527] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afvYToPEZE1565sDGnyAMwAAAQk"]
[Thu May 07 08:09:52.490399 2026] [:error] [pid 29607:tid 29681] [client 176.38.10.26:64544] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afvYUKbP7TJOAh7WSUOc7gAAAI0"]
[Thu May 07 08:09:53.063094 2026] [:error] [pid 4539:tid 4547] [client 176.38.10.26:64550] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afvYUYPEZE1565sDGnyAPwAAAQY"]
[Thu May 07 08:09:55.867896 2026] [:error] [pid 29605:tid 29637] [client 176.38.10.26:64564] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afvYU4nxrTjETioEY0QEfwAAABc"]
[Thu May 07 08:09:56.978034 2026] [:error] [pid 29710:tid 29734] [client 176.38.10.26:64570] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afvYVP0atTQld9Y2ht8cyQAAANY"]
[Thu May 07 08:09:59.207904 2026] [:error] [pid 29606:tid 29664] [client 176.38.10.26:64583] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afvYVxR5HjZ1PlSAiKuL7wAAAFc"]
[Thu May 07 08:09:59.762151 2026] [:error] [pid 29605:tid 29629] [client 176.38.10.26:64588] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afvYV4nxrTjETioEY0QEhAAAAA8"]
[Thu May 07 08:10:02.830764 2026] [:error] [pid 4539:tid 4560] [client 176.38.10.26:64604] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afvYWoPEZE1565sDGnyAWgAAARM"]
[Thu May 07 08:10:26.933849 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:64719] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afvYcoPEZE1565sDGnyAlgAAARQ"]
[Thu May 07 08:10:27.494815 2026] [:error] [pid 4539:tid 4559] [client 176.38.10.26:64748] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afvYc4PEZE1565sDGnyAlwAAARI"]
[Thu May 07 08:10:28.046701 2026] [:error] [pid 29606:tid 29665] [client 176.38.10.26:64749] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afvYdBR5HjZ1PlSAiKuMCQAAAFg"]
[Thu May 07 08:10:30.519796 2026] [:error] [pid 4539:tid 4558] [client 176.38.10.26:64765] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afvYdoPEZE1565sDGnyAnQAAARE"]
[Thu May 07 08:10:31.072662 2026] [:error] [pid 29710:tid 29718] [client 176.38.10.26:64769] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afvYd_0atTQld9Y2ht8c_gAAAMY"]
[Thu May 07 08:10:33.609864 2026] [:error] [pid 4539:tid 4552] [client 176.38.10.26:64786] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afvYeYPEZE1565sDGnyAqwAAAQs"]
[Thu May 07 08:10:34.159509 2026] [:error] [pid 4539:tid 4560] [client 176.38.10.26:64788] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afvYeoPEZE1565sDGnyAxQAAARM"]
[Thu May 07 08:10:36.796207 2026] [:error] [pid 4539:tid 4556] [client 176.38.10.26:64806] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afvYfIPEZE1565sDGnyBFgAAAQ8"]
[Thu May 07 08:10:37.355651 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:64810] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afvYfYPEZE1565sDGnyBHgAAARQ"]
[Thu May 07 08:10:39.817837 2026] [:error] [pid 4539:tid 4557] [client 176.38.10.26:64821] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afvYf4PEZE1565sDGnyBNAAAARA"]
[Thu May 07 08:10:40.370622 2026] [:error] [pid 29605:tid 29623] [client 176.38.10.26:64827] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afvYgInxrTjETioEY0QE1gAAAAk"]
[Thu May 07 08:10:42.636378 2026] [:error] [pid 4539:tid 4561] [client 176.38.10.26:64842] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afvYgoPEZE1565sDGnyBQQAAARQ"]
[Thu May 07 08:10:43.187612 2026] [:error] [pid 4539:tid 4544] [client 176.38.10.26:64845] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afvYg4PEZE1565sDGnyBRQAAAQM"]
[Thu May 07 08:10:45.617035 2026] [:error] [pid 29710:tid 29736] [client 176.38.10.26:64856] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afvYhf0atTQld9Y2ht8dJwAAANg"]
[Thu May 07 08:10:46.172451 2026] [:error] [pid 29710:tid 29726] [client 176.38.10.26:64857] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afvYhv0atTQld9Y2ht8dKQAAAM4"]
[Thu May 07 08:10:48.638969 2026] [:error] [pid 29607:tid 29691] [client 176.38.10.26:64876] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afvYiKbP7TJOAh7WSUOdKgAAAJc"]
[Thu May 07 08:10:49.191527 2026] [:error] [pid 4539:tid 4559] [client 176.38.10.26:64880] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afvYiYPEZE1565sDGnyBVgAAARI"]
[Thu May 07 08:10:51.635194 2026] [:error] [pid 4539:tid 4556] [client 176.38.10.26:64894] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afvYi4PEZE1565sDGnyBXwAAAQ8"]
[Thu May 07 08:10:52.185823 2026] [:error] [pid 4539:tid 4554] [client 176.38.10.26:64898] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afvYjIPEZE1565sDGnyBYwAAAQ0"]
[Thu May 07 08:10:54.487482 2026] [:error] [pid 29605:tid 29633] [client 176.38.10.26:64910] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afvYjonxrTjETioEY0QE4wAAABM"]
[Thu May 07 08:10:55.042581 2026] [:error] [pid 29607:tid 29687] [client 176.38.10.26:64912] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afvYj6bP7TJOAh7WSUOdLQAAAJM"]
[Thu May 07 08:10:57.346877 2026] [:error] [pid 29710:tid 29730] [client 176.38.10.26:64925] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afvYkf0atTQld9Y2ht8dXAAAANI"]
[Thu May 07 08:10:57.901597 2026] [:error] [pid 29605:tid 29623] [client 176.38.10.26:64929] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afvYkYnxrTjETioEY0QE6QAAAAk"]
[Thu May 07 08:11:00.221693 2026] [:error] [pid 29606:tid 29655] [client 176.38.10.26:64942] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afvYlBR5HjZ1PlSAiKuMGgAAAE4"]
[Thu May 07 08:11:00.775556 2026] [:error] [pid 29710:tid 29732] [client 176.38.10.26:64946] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afvYlP0atTQld9Y2ht8dbAAAANQ"]
[Thu May 07 08:11:02.998300 2026] [:error] [pid 4539:tid 4544] [client 176.38.10.26:64959] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afvYloPEZE1565sDGnyBeAAAAQM"]
[Thu May 07 08:11:03.547044 2026] [:error] [pid 29710:tid 29722] [client 176.38.10.26:64962] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afvYl_0atTQld9Y2ht8ddgAAAMo"]
[Thu May 07 08:11:05.857690 2026] [:error] [pid 29607:tid 29669] [client 176.38.10.26:64975] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afvYmabP7TJOAh7WSUOdQAAAAIE"]
[Thu May 07 08:11:06.411816 2026] [:error] [pid 4539:tid 4558] [client 176.38.10.26:64981] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afvYmoPEZE1565sDGnyBfAAAARE"]
[Thu May 07 08:11:08.738808 2026] [:error] [pid 29710:tid 29722] [client 176.38.10.26:64995] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afvYnP0atTQld9Y2ht8dhQAAAMo"]
[Thu May 07 08:11:09.289942 2026] [:error] [pid 29607:tid 29683] [client 176.38.10.26:65002] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afvYnabP7TJOAh7WSUOdXgAAAI8"]
[Thu May 07 08:11:11.799899 2026] [:error] [pid 29710:tid 29721] [client 176.38.10.26:65013] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afvYn_0atTQld9Y2ht8dkAAAAMk"]
[Thu May 07 08:11:12.355725 2026] [:error] [pid 29710:tid 29722] [client 176.38.10.26:65017] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afvYoP0atTQld9Y2ht8dlAAAAMo"]
[Thu May 07 08:11:14.799867 2026] [:error] [pid 4539:tid 4548] [client 176.38.10.26:65032] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afvYooPEZE1565sDGnyBrgAAAQc"]
[Thu May 07 08:11:15.375544 2026] [:error] [pid 29710:tid 29714] [client 176.38.10.26:65036] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afvYo_0atTQld9Y2ht8dnwAAAMI"]
[Thu May 07 08:11:17.739222 2026] [:error] [pid 29710:tid 29729] [client 176.38.10.26:65047] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afvYpf0atTQld9Y2ht8dpQAAANE"]
[Thu May 07 08:11:18.295233 2026] [:error] [pid 29710:tid 29728] [client 176.38.10.26:65051] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afvYpv0atTQld9Y2ht8dqQAAANA"]
[Thu May 07 08:11:20.762048 2026] [:error] [pid 29710:tid 29725] [client 176.38.10.26:65064] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvYqP0atTQld9Y2ht8drQAAAM0"]
[Thu May 07 08:11:21.321510 2026] [:error] [pid 29607:tid 29677] [client 176.38.10.26:65066] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "afvYqabP7TJOAh7WSUOdbwAAAIk"]
[Thu May 07 08:11:23.849152 2026] [:error] [pid 4539:tid 4563] [client 176.38.10.26:65079] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afvYq4PEZE1565sDGnyBwAAAARY"]
[Thu May 07 08:11:48.577545 2026] [:error] [pid 29606:tid 29664] [client 176.38.10.26:65084] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afvYxBR5HjZ1PlSAiKuMZQAAAFc"]
[Thu May 07 08:11:49.138142 2026] [:error] [pid 29607:tid 29681] [client 176.38.10.26:65197] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afvYxabP7TJOAh7WSUOdiQAAAI0"]
[Thu May 07 08:11:49.692348 2026] [:error] [pid 29710:tid 29724] [client 176.38.10.26:65199] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "afvYxf0atTQld9Y2ht8dzQAAAMw"]
[Thu May 07 08:11:52.178780 2026] [:error] [pid 29710:tid 29727] [client 176.38.10.26:65213] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afvYyP0atTQld9Y2ht8d1QAAAM8"]
[Thu May 07 08:11:52.731672 2026] [:error] [pid 29710:tid 29723] [client 176.38.10.26:65217] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "afvYyP0atTQld9Y2ht8d1wAAAMs"]
[Thu May 07 08:11:54.946948 2026] [:error] [pid 4539:tid 4542] [client 176.38.10.26:65228] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afvYyoPEZE1565sDGnyB2AAAAQE"]
[Thu May 07 08:11:55.505252 2026] [:error] [pid 29605:tid 29630] [client 176.38.10.26:65231] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afvYy4nxrTjETioEY0QFFgAAABA"]
[Thu May 07 08:11:57.940185 2026] [:error] [pid 29607:tid 29692] [client 176.38.10.26:65244] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afvYzabP7TJOAh7WSUOdlQAAAJg"]
[Thu May 07 08:11:58.493831 2026] [:error] [pid 4539:tid 4557] [client 176.38.10.26:65248] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afvYzoPEZE1565sDGnyB4gAAARA"]
[Thu May 07 08:12:00.887761 2026] [:error] [pid 4539:tid 4562] [client 176.38.10.26:65257] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afvY0IPEZE1565sDGnyB7AAAARU"]
[Thu May 07 08:12:01.453541 2026] [:error] [pid 4539:tid 4549] [client 176.38.10.26:65262] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afvY0YPEZE1565sDGnyB7gAAAQg"]
[Thu May 07 08:12:03.877521 2026] [:error] [pid 29607:tid 29686] [client 176.38.10.26:65274] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afvY06bP7TJOAh7WSUOdmgAAAJI"]
[Thu May 07 08:12:04.429045 2026] [:error] [pid 4539:tid 4565] [client 176.38.10.26:65279] [client 176.38.10.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afvY1IPEZE1565sDGnyB_wAAARg"]
[Thu May 07 08:19:30.153377 2026] [proxy_fcgi:error] [pid 29607:tid 29673] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:30.383611 2026] [proxy_fcgi:error] [pid 29607:tid 29688] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:30.595026 2026] [proxy_fcgi:error] [pid 29607:tid 29691] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:30.804892 2026] [proxy_fcgi:error] [pid 29607:tid 29690] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:31.021745 2026] [proxy_fcgi:error] [pid 29607:tid 29681] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:31.231659 2026] [proxy_fcgi:error] [pid 29607:tid 29679] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:31.447325 2026] [proxy_fcgi:error] [pid 29607:tid 29686] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:31.660658 2026] [proxy_fcgi:error] [pid 29607:tid 29669] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:31.869995 2026] [proxy_fcgi:error] [pid 29607:tid 29671] [client 52.138.31.126:16381] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:19:32.285502 2026] [:error] [pid 29607:tid 29689] [client 52.138.31.126:16381] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvalKbP7TJOAh7WSUOfsgAAAJU"]
[Thu May 07 08:19:32.707557 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16355] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvalKbP7TJOAh7WSUOftAAAAIQ"]
[Thu May 07 08:19:33.122931 2026] [:error] [pid 29710:tid 29724] [client 52.138.31.126:16265] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvalf0atTQld9Y2ht8hhAAAAMw"]
[Thu May 07 08:19:33.548173 2026] [:error] [pid 29605:tid 29618] [client 52.138.31.126:16373] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvalYnxrTjETioEY0QHCQAAAAQ"]
[Thu May 07 08:19:33.971573 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16331] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links.php"] [unique_id "afvalf0atTQld9Y2ht8hhwAAANg"]
[Thu May 07 08:19:34.421185 2026] [:error] [pid 29606:tid 29648] [client 52.138.31.126:16371] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links.php"] [unique_id "afvalhR5HjZ1PlSAiKuOugAAAEc"]
[Thu May 07 08:19:34.851584 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:16328] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links.php"] [unique_id "afvalhR5HjZ1PlSAiKuOuwAAAEk"]
[Thu May 07 08:19:35.294576 2026] [:error] [pid 29605:tid 29622] [client 52.138.31.126:16383] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links.php"] [unique_id "afval4nxrTjETioEY0QHDQAAAAg"]
[Thu May 07 08:19:35.711846 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16334] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "afval4nxrTjETioEY0QHDgAAAAI"]
[Thu May 07 08:19:36.158818 2026] [:error] [pid 29606:tid 29661] [client 52.138.31.126:16326] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "afvamBR5HjZ1PlSAiKuOwAAAAFQ"]
[Thu May 07 08:19:36.574654 2026] [:error] [pid 29606:tid 29664] [client 52.138.31.126:16260] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "afvamBR5HjZ1PlSAiKuOxQAAAFc"]
[Thu May 07 08:19:36.995681 2026] [:error] [pid 29606:tid 29659] [client 52.138.31.126:16367] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/wp-info.php"] [unique_id "afvamBR5HjZ1PlSAiKuOyQAAAFI"]
[Thu May 07 08:19:37.442956 2026] [:error] [pid 29607:tid 29685] [client 52.138.31.126:16369] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colour.php"] [unique_id "afvamabP7TJOAh7WSUOftwAAAJE"]
[Thu May 07 08:19:37.857165 2026] [:error] [pid 29606:tid 29646] [client 52.138.31.126:16363] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colour.php"] [unique_id "afvamRR5HjZ1PlSAiKuOzAAAAEU"]
[Thu May 07 08:19:38.273845 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16300] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colour.php"] [unique_id "afvamoPEZE1565sDGnyFRgAAAQM"]
[Thu May 07 08:19:38.695740 2026] [:error] [pid 29606:tid 29647] [client 52.138.31.126:16341] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colour.php"] [unique_id "afvamhR5HjZ1PlSAiKuOzgAAAEY"]
[Thu May 07 08:19:39.120986 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16256] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/half.php"] [unique_id "afvam4PEZE1565sDGnyFTAAAARM"]
[Thu May 07 08:19:39.557641 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:16358] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/half.php"] [unique_id "afvam4PEZE1565sDGnyFTgAAAQk"]
[Thu May 07 08:19:39.994350 2026] [:error] [pid 29605:tid 29626] [client 52.138.31.126:16346] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/half.php"] [unique_id "afvam4nxrTjETioEY0QHSwAAAAw"]
[Thu May 07 08:19:40.409642 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16327] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/half.php"] [unique_id "afvanP0atTQld9Y2ht8hkgAAANc"]
[Thu May 07 08:19:40.846231 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16329] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2P.php"] [unique_id "afvanIPEZE1565sDGnyFUwAAARQ"]
[Thu May 07 08:19:41.265056 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16376] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2P.php"] [unique_id "afvanYPEZE1565sDGnyFVQAAAQY"]
[Thu May 07 08:19:41.696931 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:16349] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2P.php"] [unique_id "afvanabP7TJOAh7WSUOfwAAAAIA"]
[Thu May 07 08:19:42.116782 2026] [:error] [pid 4539:tid 4546] [client 52.138.31.126:16295] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2P.php"] [unique_id "afvanoPEZE1565sDGnyFXQAAAQU"]
[Thu May 07 08:19:42.532004 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:16264] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afvanhR5HjZ1PlSAiKuO0QAAAEk"]
[Thu May 07 08:19:42.951750 2026] [:error] [pid 4539:tid 4562] [client 52.138.31.126:16354] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afvanoPEZE1565sDGnyFZQAAARU"]
[Thu May 07 08:19:43.373706 2026] [:error] [pid 29606:tid 29653] [client 52.138.31.126:16365] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afvanxR5HjZ1PlSAiKuO0gAAAEw"]
[Thu May 07 08:19:43.812757 2026] [:error] [pid 29607:tid 29682] [client 52.138.31.126:16357] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "afvan6bP7TJOAh7WSUOfwgAAAI4"]
[Thu May 07 08:19:44.230704 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16266] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afvaoKbP7TJOAh7WSUOfxQAAAIQ"]
[Thu May 07 08:19:44.663558 2026] [:error] [pid 29607:tid 29677] [client 52.138.31.126:16339] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afvaoKbP7TJOAh7WSUOfyAAAAIk"]
[Thu May 07 08:19:45.097081 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16375] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afvaof0atTQld9Y2ht8hnQAAAMg"]
[Thu May 07 08:19:45.524601 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16351] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "afvaof0atTQld9Y2ht8hoQAAANc"]
[Thu May 07 08:19:45.944008 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16207] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afvaof0atTQld9Y2ht8howAAANA"]
[Thu May 07 08:19:46.364788 2026] [:error] [pid 29710:tid 29726] [client 52.138.31.126:16274] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afvaov0atTQld9Y2ht8hpAAAAM4"]
[Thu May 07 08:19:46.914945 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:16338] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afvaov0atTQld9Y2ht8hqQAAANQ"]
[Thu May 07 08:19:47.332378 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16267] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afvao_0atTQld9Y2ht8hrAAAAMg"]
[Thu May 07 08:19:47.757958 2026] [:error] [pid 29710:tid 29722] [client 52.138.31.126:16273] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afvao_0atTQld9Y2ht8hrwAAAMo"]
[Thu May 07 08:19:48.187682 2026] [:error] [pid 29607:tid 29678] [client 52.138.31.126:16325] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afvapKbP7TJOAh7WSUOfygAAAIo"]
[Thu May 07 08:19:48.606405 2026] [:error] [pid 29606:tid 29641] [client 52.138.31.126:16340] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afvapBR5HjZ1PlSAiKuO1QAAAEA"]
[Thu May 07 08:19:49.044883 2026] [:error] [pid 4539:tid 4546] [client 52.138.31.126:16281] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-block.php"] [unique_id "afvapYPEZE1565sDGnyFcAAAAQU"]
[Thu May 07 08:19:49.466054 2026] [:error] [pid 29607:tid 29692] [client 52.138.31.126:16345] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "afvapabP7TJOAh7WSUOfzgAAAJg"]
[Thu May 07 08:19:49.908092 2026] [:error] [pid 29606:tid 29654] [client 52.138.31.126:16350] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "afvapRR5HjZ1PlSAiKuO2gAAAE0"]
[Thu May 07 08:19:50.332468 2026] [:error] [pid 29710:tid 29726] [client 52.138.31.126:16352] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "afvapv0atTQld9Y2ht8htAAAAM4"]
[Thu May 07 08:19:50.759936 2026] [:error] [pid 4539:tid 4553] [client 52.138.31.126:16330] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "afvapoPEZE1565sDGnyFcwAAAQw"]
[Thu May 07 08:19:51.191373 2026] [:error] [pid 4539:tid 4542] [client 52.138.31.126:16263] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/olik.php"] [unique_id "afvap4PEZE1565sDGnyFeAAAAQE"]
[Thu May 07 08:19:51.619134 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16280] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/olik.php"] [unique_id "afvap4PEZE1565sDGnyFeQAAARQ"]
[Thu May 07 08:19:52.056945 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16379] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/olik.php"] [unique_id "afvaqP0atTQld9Y2ht8huAAAAMs"]
[Thu May 07 08:19:52.518463 2026] [:error] [pid 29606:tid 29656] [client 52.138.31.126:16292] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/olik.php"] [unique_id "afvaqBR5HjZ1PlSAiKuO3QAAAE8"]
[Thu May 07 08:19:52.956366 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16343] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h.php"] [unique_id "afvaqP0atTQld9Y2ht8huwAAAMg"]
[Thu May 07 08:19:53.381839 2026] [:error] [pid 29710:tid 29716] [client 52.138.31.126:16304] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h.php"] [unique_id "afvaqf0atTQld9Y2ht8hvAAAAMQ"]
[Thu May 07 08:19:53.810541 2026] [:error] [pid 29605:tid 29628] [client 52.138.31.126:16284] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h.php"] [unique_id "afvaqYnxrTjETioEY0QHUAAAAA4"]
[Thu May 07 08:19:54.259006 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16258] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h.php"] [unique_id "afvaqoPEZE1565sDGnyFfgAAAQM"]
[Thu May 07 08:19:54.670330 2026] [:error] [pid 29606:tid 29648] [client 52.138.31.126:16378] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "afvaqhR5HjZ1PlSAiKuO4QAAAEc"]
[Thu May 07 08:19:55.100892 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16269] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "afvaq4nxrTjETioEY0QHUgAAAAI"]
[Thu May 07 08:19:55.524502 2026] [:error] [pid 29605:tid 29634] [client 52.138.31.126:16286] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "afvaq4nxrTjETioEY0QHVAAAABQ"]
[Thu May 07 08:19:55.946463 2026] [:error] [pid 29605:tid 29637] [client 52.138.31.126:16270] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "afvaq4nxrTjETioEY0QHVwAAABc"]
[Thu May 07 08:19:56.393849 2026] [:error] [pid 29605:tid 29627] [client 52.138.31.126:16294] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "afvarInxrTjETioEY0QHWgAAAA0"]
[Thu May 07 08:19:56.811429 2026] [:error] [pid 29710:tid 29714] [client 52.138.31.126:16278] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "afvarP0atTQld9Y2ht8hwAAAAMI"]
[Thu May 07 08:19:57.256074 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16382] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "afvarf0atTQld9Y2ht8hwQAAANg"]
[Thu May 07 08:19:57.682679 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16344] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "afvarf0atTQld9Y2ht8hwwAAANc"]
[Thu May 07 08:19:58.098578 2026] [:error] [pid 29710:tid 29717] [client 52.138.31.126:16298] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "afvarv0atTQld9Y2ht8hxgAAAMU"]
[Thu May 07 08:19:58.513815 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16372] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxl.php"] [unique_id "afvaroPEZE1565sDGnyFgwAAARM"]
[Thu May 07 08:19:58.928854 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:16347] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxl.php"] [unique_id "afvaroPEZE1565sDGnyFhgAAAQk"]
[Thu May 07 08:19:59.375347 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16348] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxl.php"] [unique_id "afvar4PEZE1565sDGnyFjAAAARQ"]
[Thu May 07 08:19:59.802674 2026] [:error] [pid 4539:tid 4551] [client 52.138.31.126:16288] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "afvar4PEZE1565sDGnyFjgAAAQo"]
[Thu May 07 08:20:00.231663 2026] [:error] [pid 29606:tid 29665] [client 52.138.31.126:16337] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "afvasBR5HjZ1PlSAiKuO5wAAAFg"]
[Thu May 07 08:20:00.663310 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16275] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "afvasKbP7TJOAh7WSUOf1wAAAIQ"]
[Thu May 07 08:20:01.081366 2026] [:error] [pid 29606:tid 29641] [client 52.138.31.126:16291] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "afvasRR5HjZ1PlSAiKuO6gAAAEA"]
[Thu May 07 08:20:01.537083 2026] [:error] [pid 4539:tid 4552] [client 52.138.31.126:16296] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "afvasYPEZE1565sDGnyFlAAAAQs"]
[Thu May 07 08:20:01.987418 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:16200] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "afvasf0atTQld9Y2ht8hywAAANQ"]
[Thu May 07 08:20:02.406810 2026] [:error] [pid 29606:tid 29654] [client 52.138.31.126:16370] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "afvashR5HjZ1PlSAiKuO7QAAAE0"]
[Thu May 07 08:20:02.820725 2026] [:error] [pid 29607:tid 29677] [client 52.138.31.126:16287] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "afvasqbP7TJOAh7WSUOf2QAAAIk"]
[Thu May 07 08:20:03.234100 2026] [:error] [pid 29606:tid 29644] [client 52.138.31.126:16261] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afvasxR5HjZ1PlSAiKuO7wAAAEM"]
[Thu May 07 08:20:03.657046 2026] [:error] [pid 29605:tid 29618] [client 52.138.31.126:16271] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afvas4nxrTjETioEY0QHXwAAAAQ"]
[Thu May 07 08:20:04.087263 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16226] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afvatP0atTQld9Y2ht8hzAAAAMg"]
[Thu May 07 08:20:04.516278 2026] [:error] [pid 29710:tid 29724] [client 52.138.31.126:16336] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "afvatP0atTQld9Y2ht8hzwAAAMw"]
[Thu May 07 08:20:04.934188 2026] [:error] [pid 29710:tid 29713] [client 52.138.31.126:16302] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afvatP0atTQld9Y2ht8h0QAAAME"]
[Thu May 07 08:20:05.354591 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16342] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afvatf0atTQld9Y2ht8h0wAAANg"]
[Thu May 07 08:20:05.773092 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16361] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afvatf0atTQld9Y2ht8h1QAAANc"]
[Thu May 07 08:20:06.202324 2026] [:error] [pid 29607:tid 29685] [client 52.138.31.126:16225] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "afvatqbP7TJOAh7WSUOf3QAAAJE"]
[Thu May 07 08:20:06.631705 2026] [:error] [pid 29710:tid 29721] [client 52.138.31.126:16313] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afvatv0atTQld9Y2ht8h2QAAAMk"]
[Thu May 07 08:20:07.058738 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16366] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afvat6bP7TJOAh7WSUOf4AAAAIg"]
[Thu May 07 08:20:07.487876 2026] [:error] [pid 29607:tid 29675] [client 52.138.31.126:16312] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afvat6bP7TJOAh7WSUOf4gAAAIc"]
[Thu May 07 08:20:07.912630 2026] [:error] [pid 29710:tid 29712] [client 52.138.31.126:16319] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "afvat_0atTQld9Y2ht8h3QAAAMA"]
[Thu May 07 08:20:08.329862 2026] [:error] [pid 29607:tid 29686] [client 52.138.31.126:16227] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "afvauKbP7TJOAh7WSUOf5gAAAJI"]
[Thu May 07 08:20:08.783216 2026] [:error] [pid 29710:tid 29727] [client 52.138.31.126:16293] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "afvauP0atTQld9Y2ht8h4AAAAM8"]
[Thu May 07 08:20:09.194913 2026] [:error] [pid 29606:tid 29645] [client 52.138.31.126:16262] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "afvauRR5HjZ1PlSAiKuO9wAAAEQ"]
[Thu May 07 08:20:09.650005 2026] [:error] [pid 29710:tid 29724] [client 52.138.31.126:16223] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "afvauf0atTQld9Y2ht8h4wAAAMw"]
[Thu May 07 08:20:10.074538 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:16282] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afvauonxrTjETioEY0QHZQAAABM"]
[Thu May 07 08:20:10.493069 2026] [:error] [pid 29607:tid 29671] [client 52.138.31.126:16268] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afvauqbP7TJOAh7WSUOf6AAAAIM"]
[Thu May 07 08:20:10.944223 2026] [:error] [pid 29607:tid 29682] [client 52.138.31.126:16333] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afvauqbP7TJOAh7WSUOf6QAAAI4"]
[Thu May 07 08:20:11.359672 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16320] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afvau6bP7TJOAh7WSUOf6wAAAIQ"]
[Thu May 07 08:20:11.780619 2026] [:error] [pid 29710:tid 29713] [client 52.138.31.126:16254] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/configuration.php"] [unique_id "afvau_0atTQld9Y2ht8h5QAAAME"]
[Thu May 07 08:20:12.193334 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16315] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/configuration.php"] [unique_id "afvavP0atTQld9Y2ht8h6AAAAMY"]
[Thu May 07 08:20:12.606246 2026] [:error] [pid 4539:tid 4563] [client 52.138.31.126:16237] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/configuration.php"] [unique_id "afvavIPEZE1565sDGnyFrAAAARY"]
[Thu May 07 08:20:13.071758 2026] [:error] [pid 29607:tid 29687] [client 52.138.31.126:16196] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/configuration.php"] [unique_id "afvavabP7TJOAh7WSUOf7wAAAJM"]
[Thu May 07 08:20:13.505287 2026] [:error] [pid 29605:tid 29625] [client 52.138.31.126:16218] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvavYnxrTjETioEY0QHawAAAAs"]
[Thu May 07 08:20:13.918005 2026] [:error] [pid 29605:tid 29629] [client 52.138.31.126:16356] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvavYnxrTjETioEY0QHbQAAAA8"]
[Thu May 07 08:20:14.369762 2026] [:error] [pid 29606:tid 29651] [client 52.138.31.126:16299] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvavhR5HjZ1PlSAiKuPAQAAAEo"]
[Thu May 07 08:20:14.786102 2026] [:error] [pid 4539:tid 4541] [client 52.138.31.126:16306] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "afvavoPEZE1565sDGnyFsgAAAQA"]
[Thu May 07 08:20:15.222633 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16305] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "afvav4PEZE1565sDGnyFtgAAARQ"]
[Thu May 07 08:20:15.669441 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16316] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "afvav4PEZE1565sDGnyFuwAAAQM"]
[Thu May 07 08:20:16.129966 2026] [:error] [pid 4539:tid 4554] [client 52.138.31.126:16272] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "afvawIPEZE1565sDGnyFvwAAAQ0"]
[Thu May 07 08:20:16.567073 2026] [:error] [pid 29605:tid 29618] [client 52.138.31.126:16203] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "afvawInxrTjETioEY0QHcAAAAAQ"]
[Thu May 07 08:20:16.995813 2026] [:error] [pid 29606:tid 29646] [client 52.138.31.126:16245] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "afvawBR5HjZ1PlSAiKuPBgAAAEU"]
[Thu May 07 08:20:17.470567 2026] [:error] [pid 29710:tid 29733] [client 52.138.31.126:16211] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "afvawf0atTQld9Y2ht8h7gAAANU"]
[Thu May 07 08:20:17.900848 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16323] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "afvawYnxrTjETioEY0QHdAAAAAI"]
[Thu May 07 08:20:18.351737 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:16204] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "afvawonxrTjETioEY0QHdwAAABM"]
[Thu May 07 08:20:18.785075 2026] [:error] [pid 29605:tid 29620] [client 52.138.31.126:16217] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "afvawonxrTjETioEY0QHegAAAAY"]
[Thu May 07 08:20:19.214982 2026] [:error] [pid 29606:tid 29645] [client 52.138.31.126:16309] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "afvawxR5HjZ1PlSAiKuPCgAAAEQ"]
[Thu May 07 08:20:19.650225 2026] [:error] [pid 29606:tid 29653] [client 52.138.31.126:16303] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "afvawxR5HjZ1PlSAiKuPDAAAAEw"]
[Thu May 07 08:20:20.109689 2026] [:error] [pid 29607:tid 29674] [client 52.138.31.126:16216] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "afvaxKbP7TJOAh7WSUOf-QAAAIY"]
[Thu May 07 08:20:20.564858 2026] [:error] [pid 29606:tid 29662] [client 52.138.31.126:16310] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/geforce.php"] [unique_id "afvaxBR5HjZ1PlSAiKuPEgAAAFU"]
[Thu May 07 08:20:20.989359 2026] [:error] [pid 29605:tid 29617] [client 52.138.31.126:16322] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/geforce.php"] [unique_id "afvaxInxrTjETioEY0QHgQAAAAM"]
[Thu May 07 08:20:21.414045 2026] [:error] [pid 29606:tid 29651] [client 52.138.31.126:16244] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/geforce.php"] [unique_id "afvaxRR5HjZ1PlSAiKuPFQAAAEo"]
[Thu May 07 08:20:21.837655 2026] [:error] [pid 29605:tid 29624] [client 52.138.31.126:16193] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/geforce.php"] [unique_id "afvaxYnxrTjETioEY0QHgwAAAAo"]
[Thu May 07 08:20:22.250928 2026] [:error] [pid 29605:tid 29628] [client 52.138.31.126:16219] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "afvaxonxrTjETioEY0QHhwAAAA4"]
[Thu May 07 08:20:22.716854 2026] [:error] [pid 29607:tid 29670] [client 52.138.31.126:16198] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "afvaxqbP7TJOAh7WSUOf_QAAAII"]
[Thu May 07 08:20:23.135222 2026] [:error] [pid 29606:tid 29649] [client 52.138.31.126:16360] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "afvaxxR5HjZ1PlSAiKuPFwAAAEg"]
[Thu May 07 08:20:23.554500 2026] [:error] [pid 29607:tid 29687] [client 52.138.31.126:16308] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "afvax6bP7TJOAh7WSUOf_wAAAJM"]
[Thu May 07 08:20:23.994944 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16374] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afvax_0atTQld9Y2ht8h8QAAANA"]
[Thu May 07 08:20:24.413699 2026] [:error] [pid 29607:tid 29685] [client 52.138.31.126:16359] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afvayKbP7TJOAh7WSUOgAAAAAJE"]
[Thu May 07 08:20:24.851430 2026] [:error] [pid 29710:tid 29727] [client 52.138.31.126:16220] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afvayP0atTQld9Y2ht8h9QAAAM8"]
[Thu May 07 08:20:25.276703 2026] [:error] [pid 29605:tid 29615] [client 52.138.31.126:16152] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byypas.php"] [unique_id "afvayYnxrTjETioEY0QHjwAAAAE"]
[Thu May 07 08:20:25.771663 2026] [:error] [pid 29607:tid 29684] [client 52.138.31.126:16147] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.sghb.php"] [unique_id "afvayabP7TJOAh7WSUOgAgAAAJA"]
[Thu May 07 08:20:26.186742 2026] [:error] [pid 29607:tid 29689] [client 52.138.31.126:16240] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.sghb.php"] [unique_id "afvayqbP7TJOAh7WSUOgAwAAAJU"]
[Thu May 07 08:20:26.619423 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:16248] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.sghb.php"] [unique_id "afvayoPEZE1565sDGnyFywAAAQg"]
[Thu May 07 08:20:27.036323 2026] [:error] [pid 29607:tid 29688] [client 52.138.31.126:16377] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.sghb.php"] [unique_id "afvay6bP7TJOAh7WSUOgCwAAAJQ"]
[Thu May 07 08:20:27.480690 2026] [:error] [pid 29606:tid 29642] [client 52.138.31.126:16154] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afvayxR5HjZ1PlSAiKuPHgAAAEE"]
[Thu May 07 08:20:27.912914 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16285] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afvay4PEZE1565sDGnyFzwAAARc"]
[Thu May 07 08:20:28.341201 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16230] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afvazIPEZE1565sDGnyF0gAAARg"]
[Thu May 07 08:20:28.801071 2026] [:error] [pid 29607:tid 29677] [client 52.138.31.126:16072] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoko.php"] [unique_id "afvazKbP7TJOAh7WSUOgEwAAAIk"]
[Thu May 07 08:20:29.228597 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16318] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class892.php"] [unique_id "afvazf0atTQld9Y2ht8h_QAAAMY"]
[Thu May 07 08:20:29.711108 2026] [:error] [pid 29607:tid 29692] [client 52.138.31.126:16209] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class892.php"] [unique_id "afvazabP7TJOAh7WSUOgGAAAAJg"]
[Thu May 07 08:20:30.157786 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:16199] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class892.php"] [unique_id "afvazoPEZE1565sDGnyF1gAAARI"]
[Thu May 07 08:20:30.583693 2026] [:error] [pid 4539:tid 4545] [client 52.138.31.126:16206] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class892.php"] [unique_id "afvazoPEZE1565sDGnyF2wAAAQQ"]
[Thu May 07 08:20:31.089116 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16234] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afvaz4PEZE1565sDGnyF3wAAARQ"]
[Thu May 07 08:20:31.505253 2026] [:error] [pid 29607:tid 29679] [client 52.138.31.126:16332] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afvaz6bP7TJOAh7WSUOgHAAAAIs"]
[Thu May 07 08:20:31.955791 2026] [:error] [pid 29607:tid 29686] [client 52.138.31.126:16362] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/locales.php"] [unique_id "afvaz6bP7TJOAh7WSUOgHQAAAJI"]
[Thu May 07 08:20:32.406283 2026] [proxy_fcgi:error] [pid 29606:tid 29641] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:32.617516 2026] [proxy_fcgi:error] [pid 29606:tid 29657] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:32.836777 2026] [proxy_fcgi:error] [pid 29606:tid 29644] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:33.916649 2026] [proxy_fcgi:error] [pid 29606:tid 29647] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:34.130716 2026] [proxy_fcgi:error] [pid 29606:tid 29646] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:34.342016 2026] [proxy_fcgi:error] [pid 29606:tid 29655] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:34.552849 2026] [proxy_fcgi:error] [pid 29606:tid 29645] [client 52.138.31.126:16210] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:20:34.759763 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:16210] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "afva0hR5HjZ1PlSAiKuPLgAAAEk"]
[Thu May 07 08:20:35.183192 2026] [:error] [pid 29605:tid 29614] [client 52.138.31.126:16250] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "afva04nxrTjETioEY0QHlQAAAAA"]
[Thu May 07 08:20:35.607033 2026] [:error] [pid 29605:tid 29622] [client 52.138.31.126:16214] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "afva04nxrTjETioEY0QHlwAAAAg"]
[Thu May 07 08:20:36.173873 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16222] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "afva1InxrTjETioEY0QHmgAAAAI"]
[Thu May 07 08:20:36.601746 2026] [:error] [pid 29605:tid 29637] [client 52.138.31.126:16368] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afva1InxrTjETioEY0QHnAAAABc"]
[Thu May 07 08:20:37.090778 2026] [:error] [pid 29605:tid 29627] [client 52.138.31.126:16224] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afva1YnxrTjETioEY0QHoAAAAA0"]
[Thu May 07 08:20:37.513578 2026] [:error] [pid 29607:tid 29677] [client 52.138.31.126:16289] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afva1abP7TJOAh7WSUOgKAAAAIk"]
[Thu May 07 08:20:37.967101 2026] [:error] [pid 29605:tid 29636] [client 52.138.31.126:16160] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afva1YnxrTjETioEY0QHowAAABY"]
[Thu May 07 08:20:38.399451 2026] [:error] [pid 4539:tid 4541] [client 52.138.31.126:16202] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afva1oPEZE1565sDGnyF6wAAAQA"]
[Thu May 07 08:20:38.857071 2026] [:error] [pid 29710:tid 29712] [client 52.138.31.126:16255] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afva1v0atTQld9Y2ht8iAwAAAMA"]
[Thu May 07 08:20:39.319756 2026] [:error] [pid 29607:tid 29669] [client 52.138.31.126:16205] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afva16bP7TJOAh7WSUOgLQAAAIE"]
[Thu May 07 08:20:39.831251 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16297] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afva14PEZE1565sDGnyF8gAAAQM"]
[Thu May 07 08:20:40.344498 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16277] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afva2KbP7TJOAh7WSUOgMgAAAIg"]
[Thu May 07 08:20:40.825263 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16307] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afva2IPEZE1565sDGnyF8wAAARg"]
[Thu May 07 08:20:41.504429 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16201] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afva2YPEZE1565sDGnyF9gAAAQI"]
[Thu May 07 08:20:41.923169 2026] [:error] [pid 29710:tid 29734] [client 52.138.31.126:16252] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "afva2f0atTQld9Y2ht8iBwAAANY"]
[Thu May 07 08:20:42.352085 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:16257] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "afva2oPEZE1565sDGnyF-AAAAQc"]
[Thu May 07 08:20:42.789756 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:16156] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "afva2v0atTQld9Y2ht8iCgAAANE"]
[Thu May 07 08:20:43.273082 2026] [:error] [pid 4539:tid 4541] [client 52.138.31.126:16139] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "afva24PEZE1565sDGnyF-gAAAQA"]
[Thu May 07 08:20:43.802123 2026] [:error] [pid 4539:tid 4556] [client 52.138.31.126:16132] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-xme.php"] [unique_id "afva24PEZE1565sDGnyF_AAAAQ8"]
[Thu May 07 08:20:44.225790 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16364] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "afva3IPEZE1565sDGnyF_gAAAQM"]
[Thu May 07 08:20:44.693585 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:16324] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "afva3BR5HjZ1PlSAiKuPMwAAAEI"]
[Thu May 07 08:20:45.125831 2026] [:error] [pid 4539:tid 4558] [client 52.138.31.126:16148] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "afva3YPEZE1565sDGnyGBAAAARE"]
[Thu May 07 08:20:45.653587 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:16129] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminer.php"] [unique_id "afva3YPEZE1565sDGnyGBwAAAQg"]
[Thu May 07 08:20:46.143561 2026] [:error] [pid 4539:tid 4546] [client 52.138.31.126:16253] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "afva3oPEZE1565sDGnyGDAAAAQU"]
[Thu May 07 08:20:46.584535 2026] [:error] [pid 29710:tid 29716] [client 52.138.31.126:16279] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "afva3v0atTQld9Y2ht8iDQAAAMQ"]
[Thu May 07 08:20:47.009537 2026] [:error] [pid 4539:tid 4556] [client 52.138.31.126:16134] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "afva34PEZE1565sDGnyGDwAAAQ8"]
[Thu May 07 08:20:47.462094 2026] [:error] [pid 29605:tid 29614] [client 52.138.31.126:16084] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ktfow.php"] [unique_id "afva34nxrTjETioEY0QHpwAAAAA"]
[Thu May 07 08:20:47.899456 2026] [:error] [pid 4539:tid 4555] [client 52.138.31.126:16311] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "afva34PEZE1565sDGnyGEQAAAQ4"]
[Thu May 07 08:20:48.370058 2026] [:error] [pid 4539:tid 4553] [client 52.138.31.126:16353] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "afva4IPEZE1565sDGnyGEwAAAQw"]
[Thu May 07 08:20:48.862583 2026] [:error] [pid 29710:tid 29717] [client 52.138.31.126:16194] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "afva4P0atTQld9Y2ht8iEgAAAMU"]
[Thu May 07 08:20:49.351256 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:16208] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "afva4abP7TJOAh7WSUOgNQAAAIA"]
[Thu May 07 08:20:49.810633 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16221] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "afva4f0atTQld9Y2ht8iFgAAAMs"]
[Thu May 07 08:20:50.233732 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16175] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "afva4v0atTQld9Y2ht8iGAAAANA"]
[Thu May 07 08:20:50.716650 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16229] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "afva4oPEZE1565sDGnyGFAAAARM"]
[Thu May 07 08:20:51.185666 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:16301] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2468.php"] [unique_id "afva4_0atTQld9Y2ht8iHAAAANE"]
[Thu May 07 08:20:51.716100 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16236] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "afva4_0atTQld9Y2ht8iHwAAANg"]
[Thu May 07 08:20:52.161846 2026] [:error] [pid 29710:tid 29714] [client 52.138.31.126:16243] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "afva5P0atTQld9Y2ht8iIAAAAMI"]
[Thu May 07 08:20:52.580754 2026] [:error] [pid 29710:tid 29726] [client 52.138.31.126:16276] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "afva5P0atTQld9Y2ht8iIQAAAM4"]
[Thu May 07 08:20:53.020480 2026] [:error] [pid 29607:tid 29680] [client 52.138.31.126:16159] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "afva5abP7TJOAh7WSUOgOwAAAIw"]
[Thu May 07 08:20:53.448264 2026] [:error] [pid 29607:tid 29690] [client 52.138.31.126:16290] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva5abP7TJOAh7WSUOgPQAAAJY"]
[Thu May 07 08:20:53.900046 2026] [:error] [pid 29605:tid 29635] [client 52.138.31.126:16144] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva5YnxrTjETioEY0QHqAAAABU"]
[Thu May 07 08:20:54.329830 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16259] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva5oPEZE1565sDGnyGHAAAAQM"]
[Thu May 07 08:20:54.785721 2026] [:error] [pid 29710:tid 29733] [client 52.138.31.126:16246] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva5v0atTQld9Y2ht8iIgAAANU"]
[Thu May 07 08:20:55.281819 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:16190] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "afva54PEZE1565sDGnyGIQAAAQk"]
[Thu May 07 08:20:55.695022 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16283] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "afva54PEZE1565sDGnyGIgAAAQI"]
[Thu May 07 08:20:56.153709 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16239] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "afva6IPEZE1565sDGnyGJAAAARM"]
[Thu May 07 08:20:56.578917 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:16164] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amdin.php"] [unique_id "afva6IPEZE1565sDGnyGJgAAAQg"]
[Thu May 07 08:20:57.096298 2026] [:error] [pid 29607:tid 29679] [client 52.138.31.126:16197] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afva6abP7TJOAh7WSUOgPwAAAIs"]
[Thu May 07 08:20:57.580968 2026] [:error] [pid 4539:tid 4551] [client 52.138.31.126:16317] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afva6YPEZE1565sDGnyGKgAAAQo"]
[Thu May 07 08:20:58.171828 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16380] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afva6v0atTQld9Y2ht8iJwAAAMg"]
[Thu May 07 08:20:58.627102 2026] [:error] [pid 29605:tid 29637] [client 52.138.31.126:16238] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/huya.php"] [unique_id "afva6onxrTjETioEY0QHqwAAABc"]
[Thu May 07 08:20:59.172902 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:16179] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "afva64nxrTjETioEY0QHrQAAABM"]
[Thu May 07 08:20:59.603600 2026] [:error] [pid 29607:tid 29688] [client 52.138.31.126:16254] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "afva66bP7TJOAh7WSUOgQAAAAJQ"]
[Thu May 07 08:21:00.099771 2026] [:error] [pid 29710:tid 29734] [client 52.138.31.126:16242] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "afva7P0atTQld9Y2ht8iKwAAANY"]
[Thu May 07 08:21:00.591492 2026] [:error] [pid 29605:tid 29620] [client 52.138.31.126:16135] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "afva7InxrTjETioEY0QHsAAAAAY"]
[Thu May 07 08:21:01.191029 2026] [:error] [pid 29607:tid 29674] [client 52.138.31.126:16191] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afva7abP7TJOAh7WSUOgQwAAAIY"]
[Thu May 07 08:21:01.639191 2026] [:error] [pid 4539:tid 4557] [client 52.138.31.126:16088] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afva7YPEZE1565sDGnyGLQAAARA"]
[Thu May 07 08:21:02.065923 2026] [:error] [pid 29607:tid 29689] [client 52.138.31.126:16133] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afva7qbP7TJOAh7WSUOgRwAAAJU"]
[Thu May 07 08:21:02.520898 2026] [:error] [pid 4539:tid 4553] [client 52.138.31.126:16095] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "afva7oPEZE1565sDGnyGLgAAAQw"]
[Thu May 07 08:21:02.970808 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16131] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afva7v0atTQld9Y2ht8iLwAAANg"]
[Thu May 07 08:21:03.404378 2026] [:error] [pid 29607:tid 29675] [client 52.138.31.126:16231] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afva76bP7TJOAh7WSUOgSAAAAIc"]
[Thu May 07 08:21:03.830935 2026] [:error] [pid 29710:tid 29713] [client 52.138.31.126:16145] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afva7_0atTQld9Y2ht8iMgAAAME"]
[Thu May 07 08:21:04.326288 2026] [:error] [pid 29607:tid 29681] [client 52.138.31.126:16314] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ewp.php"] [unique_id "afva8KbP7TJOAh7WSUOgSgAAAI0"]
[Thu May 07 08:21:04.770045 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16138] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva8IPEZE1565sDGnyGMwAAAQI"]
[Thu May 07 08:21:05.234667 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:16192] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva8YPEZE1565sDGnyGNAAAARQ"]
[Thu May 07 08:21:05.689000 2026] [:error] [pid 4539:tid 4554] [client 52.138.31.126:16099] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva8YPEZE1565sDGnyGNwAAAQ0"]
[Thu May 07 08:21:06.136451 2026] [:error] [pid 4539:tid 4551] [client 52.138.31.126:16149] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "afva8oPEZE1565sDGnyGOgAAAQo"]
[Thu May 07 08:21:06.591687 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16016] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "afva8oPEZE1565sDGnyGPAAAARg"]
[Thu May 07 08:21:07.011961 2026] [:error] [pid 29606:tid 29658] [client 52.138.31.126:16130] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "afva8xR5HjZ1PlSAiKuPOgAAAFE"]
[Thu May 07 08:21:07.431749 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16184] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "afva84PEZE1565sDGnyGQQAAAQM"]
[Thu May 07 08:21:07.856055 2026] [:error] [pid 29606:tid 29646] [client 52.138.31.126:16249] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xff.php"] [unique_id "afva8xR5HjZ1PlSAiKuPPAAAAEU"]
[Thu May 07 08:21:08.285681 2026] [:error] [pid 29606:tid 29655] [client 52.138.31.126:16183] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "afva9BR5HjZ1PlSAiKuPPQAAAE4"]
[Thu May 07 08:21:08.713822 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16185] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "afva9P0atTQld9Y2ht8iNAAAAMs"]
[Thu May 07 08:21:09.145567 2026] [:error] [pid 4539:tid 4542] [client 52.138.31.126:16254] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "afva9YPEZE1565sDGnyGRwAAAQE"]
[Thu May 07 08:21:09.579716 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16235] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lupo.php"] [unique_id "afva9YPEZE1565sDGnyGSAAAAQI"]
[Thu May 07 08:21:09.997215 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:16157] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "afva9YPEZE1565sDGnyGSgAAARI"]
[Thu May 07 08:21:10.451244 2026] [:error] [pid 4539:tid 4555] [client 52.138.31.126:16213] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "afva9oPEZE1565sDGnyGSwAAAQ4"]
[Thu May 07 08:21:10.876094 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16181] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "afva9oPEZE1565sDGnyGTQAAARg"]
[Thu May 07 08:21:11.347005 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16141] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/awa.php"] [unique_id "afva94PEZE1565sDGnyGUgAAAQY"]
[Thu May 07 08:21:11.806763 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16087] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afva94PEZE1565sDGnyGUwAAARc"]
[Thu May 07 08:21:12.243861 2026] [:error] [pid 29710:tid 29731] [client 52.138.31.126:16251] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afva-P0atTQld9Y2ht8iNQAAANM"]
[Thu May 07 08:21:12.687008 2026] [:error] [pid 29607:tid 29690] [client 52.138.31.126:16177] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afva-KbP7TJOAh7WSUOgTgAAAJY"]
[Thu May 07 08:21:13.113703 2026] [:error] [pid 29607:tid 29682] [client 52.138.31.126:16137] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/popo.php"] [unique_id "afva-abP7TJOAh7WSUOgTwAAAI4"]
[Thu May 07 08:21:13.575605 2026] [:error] [pid 29607:tid 29671] [client 52.138.31.126:16178] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "afva-abP7TJOAh7WSUOgUAAAAIM"]
[Thu May 07 08:21:14.016271 2026] [:error] [pid 29607:tid 29669] [client 52.138.31.126:16189] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "afva-qbP7TJOAh7WSUOgUQAAAIE"]
[Thu May 07 08:21:14.460058 2026] [:error] [pid 29605:tid 29618] [client 52.138.31.126:16146] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "afva-onxrTjETioEY0QHswAAAAQ"]
[Thu May 07 08:21:14.900854 2026] [:error] [pid 29606:tid 29663] [client 52.138.31.126:16163] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/13.php"] [unique_id "afva-hR5HjZ1PlSAiKuPPwAAAFY"]
[Thu May 07 08:21:15.402220 2026] [:error] [pid 29607:tid 29688] [client 52.138.31.126:16109] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tews.php"] [unique_id "afva-6bP7TJOAh7WSUOgUwAAAJQ"]
[Thu May 07 08:21:15.909011 2026] [:error] [pid 29606:tid 29665] [client 52.138.31.126:16143] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tews.php"] [unique_id "afva-xR5HjZ1PlSAiKuPQAAAAFg"]
[Thu May 07 08:21:16.380840 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16172] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tews.php"] [unique_id "afva_KbP7TJOAh7WSUOgVgAAAIg"]
[Thu May 07 08:21:16.849876 2026] [:error] [pid 29606:tid 29662] [client 52.138.31.126:16180] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tews.php"] [unique_id "afva_BR5HjZ1PlSAiKuPQgAAAFU"]
[Thu May 07 08:21:17.327638 2026] [:error] [pid 29710:tid 29734] [client 52.138.31.126:16166] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "afva_f0atTQld9Y2ht8iOAAAANY"]
[Thu May 07 08:21:17.825146 2026] [:error] [pid 29710:tid 29730] [client 52.138.31.126:16158] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "afva_f0atTQld9Y2ht8iOgAAANI"]
[Thu May 07 08:21:18.254436 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:16215] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "afva_v0atTQld9Y2ht8iOwAAANE"]
[Thu May 07 08:21:18.731954 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16142] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "afva_v0atTQld9Y2ht8iPQAAAMY"]
[Thu May 07 08:21:19.194865 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16195] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "afva_4PEZE1565sDGnyGYgAAARM"]
[Thu May 07 08:21:19.690473 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:16155] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "afva_4PEZE1565sDGnyGYwAAARI"]
[Thu May 07 08:21:20.184714 2026] [:error] [pid 29607:tid 29675] [client 52.138.31.126:16233] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "afvbAKbP7TJOAh7WSUOgWgAAAIc"]
[Thu May 07 08:21:20.625338 2026] [:error] [pid 29607:tid 29681] [client 52.138.31.126:16188] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "afvbAKbP7TJOAh7WSUOgXAAAAI0"]
[Thu May 07 08:21:21.108576 2026] [:error] [pid 29605:tid 29617] [client 52.138.31.126:16096] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afvbAYnxrTjETioEY0QHtgAAAAM"]
[Thu May 07 08:21:21.554591 2026] [:error] [pid 29607:tid 29684] [client 52.138.31.126:16161] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afvbAabP7TJOAh7WSUOgXQAAAJA"]
[Thu May 07 08:21:22.092338 2026] [:error] [pid 4539:tid 4557] [client 52.138.31.126:16228] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afvbAoPEZE1565sDGnyGawAAARA"]
[Thu May 07 08:21:22.606093 2026] [:error] [pid 4539:tid 4545] [client 52.138.31.126:16186] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/p.php"] [unique_id "afvbAoPEZE1565sDGnyGbAAAAQQ"]
[Thu May 07 08:21:23.137286 2026] [:error] [pid 29710:tid 29734] [client 52.138.31.126:16071] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afvbA_0atTQld9Y2ht8iSwAAANY"]
[Thu May 07 08:21:23.566802 2026] [:error] [pid 29606:tid 29658] [client 52.138.31.126:16108] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afvbAxR5HjZ1PlSAiKuPSwAAAFE"]
[Thu May 07 08:21:23.996032 2026] [:error] [pid 29710:tid 29722] [client 52.138.31.126:16077] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afvbA_0atTQld9Y2ht8iTQAAAMo"]
[Thu May 07 08:21:24.428200 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:16107] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/"] [unique_id "afvbBP0atTQld9Y2ht8iTgAAANE"]
[Thu May 07 08:21:24.899538 2026] [:error] [pid 29607:tid 29671] [client 52.138.31.126:16074] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afvbBKbP7TJOAh7WSUOgYgAAAIM"]
[Thu May 07 08:21:25.338784 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16140] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afvbBYPEZE1565sDGnyGcQAAARc"]
[Thu May 07 08:21:25.779708 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:16187] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afvbBYPEZE1565sDGnyGcwAAARM"]
[Thu May 07 08:21:26.204309 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16075] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "afvbBqbP7TJOAh7WSUOgZQAAAIQ"]
[Thu May 07 08:21:26.649872 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16076] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "afvbBonxrTjETioEY0QHuQAAAAI"]
[Thu May 07 08:21:27.083635 2026] [:error] [pid 29606:tid 29665] [client 52.138.31.126:16174] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "afvbBxR5HjZ1PlSAiKuPUAAAAFg"]
[Thu May 07 08:21:27.536960 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:16173] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "afvbB4nxrTjETioEY0QHvAAAABM"]
[Thu May 07 08:21:27.948940 2026] [:error] [pid 29607:tid 29675] [client 52.138.31.126:16086] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "afvbB6bP7TJOAh7WSUOgaAAAAIc"]
[Thu May 07 08:21:28.380598 2026] [:error] [pid 29607:tid 29684] [client 52.138.31.126:16116] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "afvbCKbP7TJOAh7WSUOgaQAAAJA"]
[Thu May 07 08:21:28.804302 2026] [:error] [pid 29607:tid 29680] [client 52.138.31.126:16241] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "afvbCKbP7TJOAh7WSUOgagAAAIw"]
[Thu May 07 08:21:29.227721 2026] [:error] [pid 29605:tid 29615] [client 52.138.31.126:16019] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "afvbCYnxrTjETioEY0QHwgAAAAE"]
[Thu May 07 08:21:29.644635 2026] [:error] [pid 29605:tid 29636] [client 52.138.31.126:16005] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/seo.php"] [unique_id "afvbCYnxrTjETioEY0QHxAAAABY"]
[Thu May 07 08:21:30.073271 2026] [:error] [pid 29605:tid 29617] [client 52.138.31.126:16026] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "afvbConxrTjETioEY0QHyAAAAAM"]
[Thu May 07 08:21:30.499172 2026] [:error] [pid 29605:tid 29623] [client 52.138.31.126:16105] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "afvbConxrTjETioEY0QHzQAAAAk"]
[Thu May 07 08:21:30.922429 2026] [:error] [pid 4539:tid 4554] [client 52.138.31.126:16165] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "afvbCoPEZE1565sDGnyGdQAAAQ0"]
[Thu May 07 08:21:31.385516 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:16171] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/7.php"] [unique_id "afvbCxR5HjZ1PlSAiKuPUwAAAEI"]
[Thu May 07 08:21:31.805891 2026] [:error] [pid 29605:tid 29615] [client 52.138.31.126:16092] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afvbC4nxrTjETioEY0QH1QAAAAE"]
[Thu May 07 08:21:32.234305 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:16090] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afvbDIPEZE1565sDGnyGdgAAAQg"]
[Thu May 07 08:21:32.664448 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:16112] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afvbDP0atTQld9Y2ht8iXgAAANE"]
[Thu May 07 08:21:33.086272 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16068] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "afvbDf0atTQld9Y2ht8iXwAAAMY"]
[Thu May 07 08:21:33.542638 2026] [:error] [pid 29606:tid 29659] [client 52.138.31.126:16093] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "afvbDRR5HjZ1PlSAiKuPVgAAAFI"]
[Thu May 07 08:21:33.986148 2026] [:error] [pid 29606:tid 29648] [client 52.138.31.126:16136] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1.php"] [unique_id "afvbDRR5HjZ1PlSAiKuPWAAAAEc"]
[Thu May 07 08:21:34.409617 2026] [proxy_fcgi:error] [pid 4539:tid 4542] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:34.618400 2026] [proxy_fcgi:error] [pid 4539:tid 4543] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:34.828162 2026] [proxy_fcgi:error] [pid 4539:tid 4550] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:35.040629 2026] [proxy_fcgi:error] [pid 4539:tid 4564] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:35.249448 2026] [proxy_fcgi:error] [pid 4539:tid 4560] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:35.459118 2026] [proxy_fcgi:error] [pid 4539:tid 4559] [client 52.138.31.126:16123] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:35.665050 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16123] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/nss.php"] [unique_id "afvbD4PEZE1565sDGnyGhwAAAQM"]
[Thu May 07 08:21:36.091882 2026] [proxy_fcgi:error] [pid 4539:tid 4546] [client 52.138.31.126:16017] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:36.304688 2026] [proxy_fcgi:error] [pid 4539:tid 4555] [client 52.138.31.126:16017] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:36.516037 2026] [proxy_fcgi:error] [pid 4539:tid 4552] [client 52.138.31.126:16017] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:36.729517 2026] [proxy_fcgi:error] [pid 4539:tid 4553] [client 52.138.31.126:16017] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:36.943975 2026] [proxy_fcgi:error] [pid 4539:tid 4541] [client 52.138.31.126:16017] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:21:37.152245 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16017] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afvbEYPEZE1565sDGnyGjgAAAQY"]
[Thu May 07 08:21:37.567750 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16015] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afvbEabP7TJOAh7WSUOgdAAAAIg"]
[Thu May 07 08:21:37.983336 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16018] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afvbEYPEZE1565sDGnyGkQAAARg"]
[Thu May 07 08:21:38.395829 2026] [:error] [pid 29607:tid 29691] [client 52.138.31.126:16100] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hplfuns.php"] [unique_id "afvbEqbP7TJOAh7WSUOgdgAAAJc"]
[Thu May 07 08:21:38.838518 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16070] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afvbEv0atTQld9Y2ht8iaQAAANA"]
[Thu May 07 08:21:39.261024 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16004] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afvbE4PEZE1565sDGnyGkwAAAQI"]
[Thu May 07 08:21:39.703113 2026] [:error] [pid 29710:tid 29733] [client 52.138.31.126:16124] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afvbE_0atTQld9Y2ht8ibgAAANU"]
[Thu May 07 08:21:40.127192 2026] [:error] [pid 4539:tid 4563] [client 52.138.31.126:16122] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "afvbFIPEZE1565sDGnyGlgAAARY"]
[Thu May 07 08:21:40.547492 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:16232] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "afvbFP0atTQld9Y2ht8ibwAAANQ"]
[Thu May 07 08:21:40.981702 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:16089] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "afvbFInxrTjETioEY0QH_AAAABM"]
[Thu May 07 08:21:41.396163 2026] [:error] [pid 29606:tid 29645] [client 52.138.31.126:16091] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "afvbFRR5HjZ1PlSAiKuPWwAAAEQ"]
[Thu May 07 08:21:41.819923 2026] [:error] [pid 29606:tid 29653] [client 52.138.31.126:16153] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "afvbFRR5HjZ1PlSAiKuPXAAAAEw"]
[Thu May 07 08:21:42.237743 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:16053] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "afvbFqbP7TJOAh7WSUOgeQAAAIA"]
[Thu May 07 08:21:42.670769 2026] [:error] [pid 29710:tid 29724] [client 52.138.31.126:16083] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "afvbFv0atTQld9Y2ht8icwAAAMw"]
[Thu May 07 08:21:43.105799 2026] [:error] [pid 29607:tid 29692] [client 52.138.31.126:16151] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "afvbF6bP7TJOAh7WSUOgfQAAAJg"]
[Thu May 07 08:21:43.520831 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:16098] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inege.php"] [unique_id "afvbF_0atTQld9Y2ht8idgAAANg"]
[Thu May 07 08:21:43.951016 2026] [:error] [pid 4539:tid 4554] [client 52.138.31.126:16085] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afvbF4PEZE1565sDGnyGmgAAAQ0"]
[Thu May 07 08:21:44.377104 2026] [:error] [pid 29605:tid 29617] [client 52.138.31.126:16151] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afvbGInxrTjETioEY0QICwAAAAM"]
[Thu May 07 08:21:44.811677 2026] [:error] [pid 29607:tid 29689] [client 52.138.31.126:16073] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afvbGKbP7TJOAh7WSUOggAAAAJU"]
[Thu May 07 08:21:45.235282 2026] [:error] [pid 29607:tid 29669] [client 52.138.31.126:16034] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afvbGabP7TJOAh7WSUOghQAAAIE"]
[Thu May 07 08:21:45.648712 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16013] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "afvbGabP7TJOAh7WSUOghwAAAIQ"]
[Thu May 07 08:21:46.080922 2026] [:error] [pid 29605:tid 29624] [client 52.138.31.126:16069] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "afvbGonxrTjETioEY0QIDQAAAAo"]
[Thu May 07 08:21:46.496464 2026] [:error] [pid 29605:tid 29632] [client 52.138.31.126:16065] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "afvbGonxrTjETioEY0QIDgAAABI"]
[Thu May 07 08:21:46.909708 2026] [:error] [pid 29605:tid 29631] [client 52.138.31.126:16002] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/no1.php"] [unique_id "afvbGonxrTjETioEY0QIEQAAABE"]
[Thu May 07 08:21:47.330272 2026] [:error] [pid 4539:tid 4551] [client 52.138.31.126:16247] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "afvbG4PEZE1565sDGnyGnwAAAQo"]
[Thu May 07 08:21:47.756093 2026] [:error] [pid 29607:tid 29686] [client 52.138.31.126:16121] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "afvbG6bP7TJOAh7WSUOgiwAAAJI"]
[Thu May 07 08:21:48.188809 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:16082] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "afvbHKbP7TJOAh7WSUOgjQAAAIA"]
[Thu May 07 08:21:48.603080 2026] [:error] [pid 29607:tid 29675] [client 52.138.31.126:16025] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w2025.php"] [unique_id "afvbHKbP7TJOAh7WSUOgkQAAAIc"]
[Thu May 07 08:21:49.035491 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16014] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "afvbHYPEZE1565sDGnyGoAAAARg"]
[Thu May 07 08:21:49.493933 2026] [:error] [pid 29607:tid 29689] [client 52.138.31.126:16120] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "afvbHabP7TJOAh7WSUOgkwAAAJU"]
[Thu May 07 08:21:49.911486 2026] [:error] [pid 29605:tid 29636] [client 52.138.31.126:16078] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "afvbHYnxrTjETioEY0QIHQAAABY"]
[Thu May 07 08:21:50.326275 2026] [:error] [pid 29605:tid 29620] [client 52.138.31.126:16126] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fvvff.php"] [unique_id "afvbHonxrTjETioEY0QIIAAAAAY"]
[Thu May 07 08:21:50.760397 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16167] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afvbHv0atTQld9Y2ht8iewAAANA"]
[Thu May 07 08:21:51.209560 2026] [:error] [pid 29710:tid 29721] [client 52.138.31.126:16067] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afvbH_0atTQld9Y2ht8ifAAAAMk"]
[Thu May 07 08:21:51.655221 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16104] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afvbH_0atTQld9Y2ht8ifQAAAMs"]
[Thu May 07 08:21:52.089163 2026] [:error] [pid 4539:tid 4558] [client 52.138.31.126:16045] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "afvbIIPEZE1565sDGnyGpAAAARE"]
[Thu May 07 08:21:52.509737 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16113] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afvbIIPEZE1565sDGnyGpgAAARc"]
[Thu May 07 08:21:52.939967 2026] [:error] [pid 29606:tid 29662] [client 52.138.31.126:15978] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afvbIBR5HjZ1PlSAiKuPXgAAAFU"]
[Thu May 07 08:21:53.390943 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:16150] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afvbIYPEZE1565sDGnyGrAAAAQk"]
[Thu May 07 08:21:53.808103 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:16168] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "afvbIf0atTQld9Y2ht8igAAAANQ"]
[Thu May 07 08:21:54.225113 2026] [:error] [pid 4539:tid 4552] [client 52.138.31.126:16000] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbIoPEZE1565sDGnyGsAAAAQs"]
[Thu May 07 08:21:54.637692 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16010] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbIv0atTQld9Y2ht8iggAAAMY"]
[Thu May 07 08:21:55.050063 2026] [:error] [pid 29710:tid 29720] [client 52.138.31.126:16335] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbI_0atTQld9Y2ht8igwAAAMg"]
[Thu May 07 08:21:55.501791 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16051] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbI4PEZE1565sDGnyGsgAAAQY"]
[Thu May 07 08:21:55.938111 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16043] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afvbI4PEZE1565sDGnyGtAAAARg"]
[Thu May 07 08:21:56.365948 2026] [:error] [pid 4539:tid 4557] [client 52.138.31.126:16009] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afvbJIPEZE1565sDGnyGtQAAARA"]
[Thu May 07 08:21:56.825523 2026] [:error] [pid 4539:tid 4545] [client 52.138.31.126:16182] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afvbJIPEZE1565sDGnyGtgAAAQQ"]
[Thu May 07 08:21:57.301109 2026] [:error] [pid 4539:tid 4558] [client 52.138.31.126:15944] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "afvbJYPEZE1565sDGnyGtwAAARE"]
[Thu May 07 08:21:57.749549 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16028] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "afvbJf0atTQld9Y2ht8ikgAAANA"]
[Thu May 07 08:21:58.173031 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16061] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "afvbJv0atTQld9Y2ht8ilAAAAMs"]
[Thu May 07 08:21:58.611130 2026] [:error] [pid 29710:tid 29725] [client 52.138.31.126:16115] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "afvbJv0atTQld9Y2ht8ilgAAAM0"]
[Thu May 07 08:21:59.057118 2026] [:error] [pid 29605:tid 29629] [client 52.138.31.126:16027] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f6.php"] [unique_id "afvbJ4nxrTjETioEY0QINQAAAA8"]
[Thu May 07 08:21:59.476360 2026] [:error] [pid 4539:tid 4556] [client 52.138.31.126:16321] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "afvbJ4PEZE1565sDGnyGvgAAAQ8"]
[Thu May 07 08:21:59.952607 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:16169] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "afvbJ4PEZE1565sDGnyGwQAAAQc"]
[Thu May 07 08:22:00.368853 2026] [:error] [pid 4539:tid 4555] [client 52.138.31.126:16110] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "afvbKIPEZE1565sDGnyGwwAAAQ4"]
[Thu May 07 08:22:00.835139 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16101] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "afvbKIPEZE1565sDGnyGxgAAAQY"]
[Thu May 07 08:22:01.256335 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:16117] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afvbKf0atTQld9Y2ht8imAAAANQ"]
[Thu May 07 08:22:01.705543 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16030] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afvbKYPEZE1565sDGnyGywAAARc"]
[Thu May 07 08:22:02.126063 2026] [:error] [pid 29710:tid 29724] [client 52.138.31.126:16106] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afvbKv0atTQld9Y2ht8imgAAAMw"]
[Thu May 07 08:22:02.576535 2026] [:error] [pid 4539:tid 4563] [client 52.138.31.126:16021] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "afvbKoPEZE1565sDGnyGzQAAARY"]
[Thu May 07 08:22:03.005184 2026] [:error] [pid 29710:tid 29714] [client 52.138.31.126:16162] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "afvbK_0atTQld9Y2ht8ingAAAMI"]
[Thu May 07 08:22:03.419171 2026] [:error] [pid 29606:tid 29641] [client 52.138.31.126:16059] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "afvbKxR5HjZ1PlSAiKuPYQAAAEA"]
[Thu May 07 08:22:03.892466 2026] [:error] [pid 29606:tid 29642] [client 52.138.31.126:16035] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "afvbKxR5HjZ1PlSAiKuPYwAAAEE"]
[Thu May 07 08:22:04.343225 2026] [:error] [pid 4539:tid 4552] [client 52.138.31.126:16007] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/bolt.php"] [unique_id "afvbLIPEZE1565sDGnyG0wAAAQs"]
[Thu May 07 08:22:04.776634 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:16020] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afvbLIPEZE1565sDGnyG1gAAAQI"]
[Thu May 07 08:22:05.209712 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16176] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afvbLYPEZE1565sDGnyG2QAAARg"]
[Thu May 07 08:22:05.628218 2026] [:error] [pid 29605:tid 29623] [client 52.138.31.126:16022] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afvbLYnxrTjETioEY0QIOwAAAAk"]
[Thu May 07 08:22:06.072239 2026] [:error] [pid 29605:tid 29626] [client 52.138.31.126:16064] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-act.php"] [unique_id "afvbLonxrTjETioEY0QIPQAAAAw"]
[Thu May 07 08:22:06.500496 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:15942] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "afvbLonxrTjETioEY0QIQAAAABM"]
[Thu May 07 08:22:06.937524 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:16107] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "afvbLoPEZE1565sDGnyG3AAAAQk"]
[Thu May 07 08:22:07.355423 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16029] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "afvbL_0atTQld9Y2ht8ioQAAANc"]
[Thu May 07 08:22:07.792293 2026] [:error] [pid 29710:tid 29726] [client 52.138.31.126:16066] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/classwithtostring.php"] [unique_id "afvbL_0atTQld9Y2ht8iogAAAM4"]
[Thu May 07 08:22:08.208264 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:15967] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "afvbMIPEZE1565sDGnyG4wAAAQc"]
[Thu May 07 08:22:08.625123 2026] [:error] [pid 29605:tid 29636] [client 52.138.31.126:15945] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "afvbMInxrTjETioEY0QIQgAAABY"]
[Thu May 07 08:22:09.050304 2026] [:error] [pid 29606:tid 29657] [client 52.138.31.126:15966] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "afvbMRR5HjZ1PlSAiKuPZQAAAFA"]
[Thu May 07 08:22:09.475340 2026] [:error] [pid 29710:tid 29734] [client 52.138.31.126:15951] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "afvbMf0atTQld9Y2ht8ipQAAANY"]
[Thu May 07 08:22:09.890040 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:16162] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afvbMYPEZE1565sDGnyG6QAAAQY"]
[Thu May 07 08:22:10.351753 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:15964] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afvbMv0atTQld9Y2ht8ipwAAANQ"]
[Thu May 07 08:22:10.776023 2026] [:error] [pid 29606:tid 29659] [client 52.138.31.126:15990] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afvbMhR5HjZ1PlSAiKuPZwAAAFI"]
[Thu May 07 08:22:11.239709 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:15939] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "afvbM4PEZE1565sDGnyG7AAAARI"]
[Thu May 07 08:22:11.667163 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:16001] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "afvbM_0atTQld9Y2ht8iqQAAAMY"]
[Thu May 07 08:22:12.095088 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16055] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "afvbNIPEZE1565sDGnyG7QAAARc"]
[Thu May 07 08:22:12.514505 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:15959] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "afvbNIPEZE1565sDGnyG8QAAAQg"]
[Thu May 07 08:22:12.934548 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:16044] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "afvbNIPEZE1565sDGnyG9QAAAQc"]
[Thu May 07 08:22:13.362310 2026] [:error] [pid 29607:tid 29678] [client 52.138.31.126:15977] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afvbNabP7TJOAh7WSUOgmQAAAIo"]
[Thu May 07 08:22:13.802576 2026] [:error] [pid 29607:tid 29670] [client 52.138.31.126:16054] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afvbNabP7TJOAh7WSUOgnQAAAII"]
[Thu May 07 08:22:14.234466 2026] [:error] [pid 29607:tid 29680] [client 52.138.31.126:16102] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afvbNqbP7TJOAh7WSUOgoAAAAIw"]
[Thu May 07 08:22:14.649034 2026] [:error] [pid 4539:tid 4546] [client 52.138.31.126:15973] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "afvbNoPEZE1565sDGnyG-QAAAQU"]
[Thu May 07 08:22:15.079178 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:15949] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbN4PEZE1565sDGnyG-wAAAQY"]
[Thu May 07 08:22:15.508156 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16080] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbN4PEZE1565sDGnyG_AAAARg"]
[Thu May 07 08:22:15.936750 2026] [:error] [pid 29710:tid 29731] [client 52.138.31.126:16125] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbN_0atTQld9Y2ht8iqwAAANM"]
[Thu May 07 08:22:16.376457 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:16032] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "afvbOIPEZE1565sDGnyG_wAAARc"]
[Thu May 07 08:22:16.797755 2026] [:error] [pid 29607:tid 29685] [client 52.138.31.126:16128] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afvbOKbP7TJOAh7WSUOgpQAAAJE"]
[Thu May 07 08:22:17.218890 2026] [:error] [pid 4539:tid 4555] [client 52.138.31.126:15941] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afvbOYPEZE1565sDGnyHAAAAAQ4"]
[Thu May 07 08:22:17.652487 2026] [:error] [pid 29607:tid 29669] [client 52.138.31.126:15975] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afvbOabP7TJOAh7WSUOgpgAAAIE"]
[Thu May 07 08:22:18.070645 2026] [:error] [pid 29606:tid 29655] [client 52.138.31.126:16212] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "afvbOhR5HjZ1PlSAiKuPbAAAAE4"]
[Thu May 07 08:22:18.508994 2026] [:error] [pid 29606:tid 29646] [client 52.138.31.126:16003] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afvbOhR5HjZ1PlSAiKuPbQAAAEU"]
[Thu May 07 08:22:18.959924 2026] [:error] [pid 29605:tid 29616] [client 52.138.31.126:16060] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afvbOonxrTjETioEY0QIRgAAAAI"]
[Thu May 07 08:22:19.381041 2026] [:error] [pid 29607:tid 29682] [client 52.138.31.126:16041] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afvbO6bP7TJOAh7WSUOgpwAAAI4"]
[Thu May 07 08:22:19.865125 2026] [:error] [pid 29606:tid 29652] [client 52.138.31.126:16024] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "afvbOxR5HjZ1PlSAiKuPbgAAAEs"]
[Thu May 07 08:22:20.291063 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:16057] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "afvbPBR5HjZ1PlSAiKuPbwAAAEk"]
[Thu May 07 08:22:20.768737 2026] [:error] [pid 29606:tid 29663] [client 52.138.31.126:16037] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "afvbPBR5HjZ1PlSAiKuPcAAAAFY"]
[Thu May 07 08:22:21.223374 2026] [:error] [pid 29606:tid 29665] [client 52.138.31.126:16114] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "afvbPRR5HjZ1PlSAiKuPcQAAAFg"]
[Thu May 07 08:22:21.659057 2026] [:error] [pid 29606:tid 29662] [client 52.138.31.126:16008] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "afvbPRR5HjZ1PlSAiKuPcgAAAFU"]
[Thu May 07 08:22:22.127153 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:15984] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "afvbPhR5HjZ1PlSAiKuPdQAAAEI"]
[Thu May 07 08:22:22.701288 2026] [:error] [pid 29606:tid 29642] [client 52.138.31.126:16058] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "afvbPhR5HjZ1PlSAiKuPdwAAAEE"]
[Thu May 07 08:22:23.144890 2026] [:error] [pid 29710:tid 29716] [client 52.138.31.126:15998] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "afvbP_0atTQld9Y2ht8isQAAAMQ"]
[Thu May 07 08:22:23.620467 2026] [:error] [pid 29710:tid 29728] [client 52.138.31.126:16097] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "afvbP_0atTQld9Y2ht8iswAAANA"]
[Thu May 07 08:22:24.153928 2026] [:error] [pid 29606:tid 29659] [client 52.138.31.126:16056] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "afvbQBR5HjZ1PlSAiKuPeAAAAFI"]
[Thu May 07 08:22:24.696056 2026] [:error] [pid 29606:tid 29644] [client 52.138.31.126:16118] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "afvbQBR5HjZ1PlSAiKuPeQAAAEM"]
[Thu May 07 08:22:25.193630 2026] [:error] [pid 29606:tid 29656] [client 52.138.31.126:16050] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "afvbQRR5HjZ1PlSAiKuPewAAAE8"]
[Thu May 07 08:22:25.642214 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:16127] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "afvbQf0atTQld9Y2ht8itgAAAMs"]
[Thu May 07 08:22:26.103753 2026] [:error] [pid 29710:tid 29725] [client 52.138.31.126:15905] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "afvbQv0atTQld9Y2ht8iuAAAAM0"]
[Thu May 07 08:22:26.542050 2026] [:error] [pid 29710:tid 29733] [client 52.138.31.126:15903] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "afvbQv0atTQld9Y2ht8iuQAAANU"]
[Thu May 07 08:22:26.982607 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:15958] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "afvbQv0atTQld9Y2ht8iugAAANQ"]
[Thu May 07 08:22:27.418166 2026] [:error] [pid 29710:tid 29731] [client 52.138.31.126:15979] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fff.php"] [unique_id "afvbQ_0atTQld9Y2ht8ivAAAANM"]
[Thu May 07 08:22:27.892325 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:16012] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "afvbQ4PEZE1565sDGnyHAQAAAQc"]
[Thu May 07 08:22:28.431568 2026] [:error] [pid 4539:tid 4561] [client 52.138.31.126:15992] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "afvbRIPEZE1565sDGnyHAwAAARQ"]
[Thu May 07 08:22:28.858440 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:15988] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "afvbRIPEZE1565sDGnyHBgAAARM"]
[Thu May 07 08:22:29.314138 2026] [:error] [pid 4539:tid 4562] [client 52.138.31.126:16080] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/makeasmtp.php"] [unique_id "afvbRYPEZE1565sDGnyHBwAAARU"]
[Thu May 07 08:22:29.756199 2026] [:error] [pid 29605:tid 29626] [client 52.138.31.126:15997] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pwnd.php"] [unique_id "afvbRYnxrTjETioEY0QIZgAAAAw"]
[Thu May 07 08:22:30.289519 2026] [:error] [pid 29710:tid 29731] [client 52.138.31.126:15998] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pwnd.php"] [unique_id "afvbRv0atTQld9Y2ht8izAAAANM"]
[Thu May 07 08:22:30.741946 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:15996] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pwnd.php"] [unique_id "afvbRoPEZE1565sDGnyHDQAAARI"]
[Thu May 07 08:22:31.234025 2026] [:error] [pid 4539:tid 4563] [client 52.138.31.126:15983] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pwnd.php"] [unique_id "afvbR4PEZE1565sDGnyHEQAAARY"]
[Thu May 07 08:22:31.687592 2026] [:error] [pid 29605:tid 29632] [client 52.138.31.126:15960] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "afvbR4nxrTjETioEY0QIbAAAABI"]
[Thu May 07 08:22:32.156884 2026] [:error] [pid 29607:tid 29680] [client 52.138.31.126:16042] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "afvbSKbP7TJOAh7WSUOgrQAAAIw"]
[Thu May 07 08:22:32.613484 2026] [:error] [pid 29606:tid 29645] [client 52.138.31.126:15913] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "afvbSBR5HjZ1PlSAiKuPfQAAAEQ"]
[Thu May 07 08:22:33.058118 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:15972] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "afvbSRR5HjZ1PlSAiKuPfwAAAEk"]
[Thu May 07 08:22:33.492247 2026] [:error] [pid 29606:tid 29663] [client 52.138.31.126:15936] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "afvbSRR5HjZ1PlSAiKuPgAAAAFY"]
[Thu May 07 08:22:33.925973 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:16081] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "afvbSRR5HjZ1PlSAiKuPggAAAEI"]
[Thu May 07 08:22:34.426537 2026] [:error] [pid 29607:tid 29681] [client 52.138.31.126:15961] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "afvbSqbP7TJOAh7WSUOgsgAAAI0"]
[Thu May 07 08:22:34.879739 2026] [:error] [pid 29607:tid 29683] [client 52.138.31.126:15883] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "afvbSqbP7TJOAh7WSUOguQAAAI8"]
[Thu May 07 08:22:35.321747 2026] [:error] [pid 29607:tid 29688] [client 52.138.31.126:15943] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "afvbS6bP7TJOAh7WSUOgugAAAJQ"]
[Thu May 07 08:22:35.812536 2026] [:error] [pid 29605:tid 29619] [client 52.138.31.126:16023] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "afvbS4nxrTjETioEY0QIewAAAAU"]
[Thu May 07 08:22:36.715649 2026] [proxy_fcgi:error] [pid 29605:tid 29615] [client 52.138.31.126:16036] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:37.149988 2026] [proxy_fcgi:error] [pid 29605:tid 29624] [client 52.138.31.126:16036] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:37.569948 2026] [proxy_fcgi:error] [pid 29605:tid 29620] [client 52.138.31.126:16036] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:37.779703 2026] [proxy_fcgi:error] [pid 29605:tid 29631] [client 52.138.31.126:16036] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:37.989997 2026] [proxy_fcgi:error] [pid 29605:tid 29617] [client 52.138.31.126:16036] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:38.406884 2026] [:error] [pid 29605:tid 29628] [client 52.138.31.126:16036] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afvbTonxrTjETioEY0QIiAAAAA4"]
[Thu May 07 08:22:38.835385 2026] [proxy_fcgi:error] [pid 29710:tid 29729] [client 52.138.31.126:15888] AH01071: Got error 'Primary script unknown'
[Thu May 07 08:22:39.042735 2026] [:error] [pid 29710:tid 29736] [client 52.138.31.126:15888] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "afvbT_0atTQld9Y2ht8i4wAAANg"]
[Thu May 07 08:22:39.484032 2026] [:error] [pid 29606:tid 29644] [client 52.138.31.126:16048] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "afvbTxR5HjZ1PlSAiKuPigAAAEM"]
[Thu May 07 08:22:39.907090 2026] [:error] [pid 29710:tid 29713] [client 52.138.31.126:15940] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "afvbT_0atTQld9Y2ht8i5wAAAME"]
[Thu May 07 08:22:40.341717 2026] [:error] [pid 4539:tid 4548] [client 52.138.31.126:16063] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "afvbUIPEZE1565sDGnyHFQAAAQc"]
[Thu May 07 08:22:40.803830 2026] [:error] [pid 29606:tid 29660] [client 52.138.31.126:16046] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "afvbUBR5HjZ1PlSAiKuPjQAAAFM"]
[Thu May 07 08:22:41.225794 2026] [:error] [pid 29605:tid 29634] [client 52.138.31.126:15893] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "afvbUYnxrTjETioEY0QIiwAAABQ"]
[Thu May 07 08:22:41.644668 2026] [:error] [pid 29606:tid 29649] [client 52.138.31.126:15897] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "afvbURR5HjZ1PlSAiKuPjwAAAEg"]
[Thu May 07 08:22:42.078211 2026] [:error] [pid 29605:tid 29623] [client 52.138.31.126:15919] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/"] [unique_id "afvbUonxrTjETioEY0QIjAAAAAk"]
[Thu May 07 08:22:42.496665 2026] [:error] [pid 29607:tid 29692] [client 52.138.31.126:16166] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "afvbUqbP7TJOAh7WSUOgxAAAAJg"]
[Thu May 07 08:22:42.912254 2026] [:error] [pid 4539:tid 4541] [client 52.138.31.126:16052] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "afvbUoPEZE1565sDGnyHGAAAAQA"]
[Thu May 07 08:22:43.325069 2026] [:error] [pid 29605:tid 29619] [client 52.138.31.126:15985] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "afvbU4nxrTjETioEY0QIjwAAAAU"]
[Thu May 07 08:22:43.801167 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16040] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "afvbU6bP7TJOAh7WSUOgxgAAAIg"]
[Thu May 07 08:22:44.213551 2026] [:error] [pid 29605:tid 29638] [client 52.138.31.126:16094] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "afvbVInxrTjETioEY0QIkAAAABg"]
[Thu May 07 08:22:44.676768 2026] [:error] [pid 29605:tid 29622] [client 52.138.31.126:15991] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "afvbVInxrTjETioEY0QIkwAAAAg"]
[Thu May 07 08:22:45.092784 2026] [:error] [pid 29605:tid 29624] [client 52.138.31.126:15917] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "afvbVYnxrTjETioEY0QIlAAAAAo"]
[Thu May 07 08:22:45.517299 2026] [:error] [pid 29606:tid 29652] [client 52.138.31.126:15878] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/in.php"] [unique_id "afvbVRR5HjZ1PlSAiKuPkQAAAEs"]
[Thu May 07 08:22:45.929864 2026] [:error] [pid 29606:tid 29650] [client 52.138.31.126:15874] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "afvbVRR5HjZ1PlSAiKuPkgAAAEk"]
[Thu May 07 08:22:46.344962 2026] [:error] [pid 29605:tid 29631] [client 52.138.31.126:15956] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "afvbVonxrTjETioEY0QIlwAAABE"]
[Thu May 07 08:22:46.815073 2026] [:error] [pid 29607:tid 29671] [client 52.138.31.126:15947] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "afvbVqbP7TJOAh7WSUOgyQAAAIM"]
[Thu May 07 08:22:47.238310 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:16047] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-widgets.php"] [unique_id "afvbV6bP7TJOAh7WSUOgygAAAIQ"]
[Thu May 07 08:22:47.665369 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:16033] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "afvbVxR5HjZ1PlSAiKuPlQAAAEI"]
[Thu May 07 08:22:48.112673 2026] [:error] [pid 4539:tid 4560] [client 52.138.31.126:15976] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "afvbWIPEZE1565sDGnyHGQAAARM"]
[Thu May 07 08:22:48.539021 2026] [:error] [pid 29710:tid 29716] [client 52.138.31.126:15873] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "afvbWP0atTQld9Y2ht8i7wAAAMQ"]
[Thu May 07 08:22:48.981516 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:15968] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/admin.php"] [unique_id "afvbWP0atTQld9Y2ht8i8gAAANE"]
[Thu May 07 08:22:49.405028 2026] [:error] [pid 29606:tid 29662] [client 52.138.31.126:15887] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afvbWRR5HjZ1PlSAiKuPlwAAAFU"]
[Thu May 07 08:22:49.827703 2026] [:error] [pid 29606:tid 29642] [client 52.138.31.126:15946] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afvbWRR5HjZ1PlSAiKuPmAAAAEE"]
[Thu May 07 08:22:50.254812 2026] [:error] [pid 4539:tid 4565] [client 52.138.31.126:16006] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afvbWoPEZE1565sDGnyHIAAAARg"]
[Thu May 07 08:22:50.675760 2026] [:error] [pid 29606:tid 29657] [client 52.138.31.126:15999] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bs1.php"] [unique_id "afvbWhR5HjZ1PlSAiKuPmQAAAFA"]
[Thu May 07 08:22:51.163492 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:15963] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afvbW6bP7TJOAh7WSUOgzgAAAIA"]
[Thu May 07 08:22:51.585935 2026] [:error] [pid 29607:tid 29679] [client 52.138.31.126:15904] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afvbW6bP7TJOAh7WSUOg0AAAAIs"]
[Thu May 07 08:22:52.030892 2026] [:error] [pid 29607:tid 29691] [client 52.138.31.126:15954] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afvbXKbP7TJOAh7WSUOg0gAAAJc"]
[Thu May 07 08:22:52.464941 2026] [:error] [pid 29606:tid 29661] [client 52.138.31.126:15962] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afvbXBR5HjZ1PlSAiKuPmwAAAFQ"]
[Thu May 07 08:22:52.908527 2026] [:error] [pid 29607:tid 29673] [client 52.138.31.126:15877] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afvbXKbP7TJOAh7WSUOg1AAAAIU"]
[Thu May 07 08:22:53.369482 2026] [:error] [pid 29605:tid 29621] [client 52.138.31.126:15879] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afvbXYnxrTjETioEY0QImgAAAAc"]
[Thu May 07 08:22:53.801284 2026] [:error] [pid 29607:tid 29692] [client 52.138.31.126:16079] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afvbXabP7TJOAh7WSUOg2AAAAJg"]
[Thu May 07 08:22:54.323146 2026] [:error] [pid 29607:tid 29676] [client 52.138.31.126:16049] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gettest.php"] [unique_id "afvbXqbP7TJOAh7WSUOg2wAAAIg"]
[Thu May 07 08:22:54.747977 2026] [:error] [pid 4539:tid 4564] [client 52.138.31.126:15895] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/BypassBest.php"] [unique_id "afvbXoPEZE1565sDGnyHIgAAARc"]
[Thu May 07 08:22:55.216505 2026] [:error] [pid 4539:tid 4555] [client 52.138.31.126:15981] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/BypassBest.php"] [unique_id "afvbX4PEZE1565sDGnyHJAAAAQ4"]
[Thu May 07 08:22:55.667503 2026] [:error] [pid 29605:tid 29635] [client 52.138.31.126:15937] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/BypassBest.php"] [unique_id "afvbX4nxrTjETioEY0QInAAAABU"]
[Thu May 07 08:22:56.095483 2026] [:error] [pid 4539:tid 4545] [client 52.138.31.126:15938] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/BypassBest.php"] [unique_id "afvbYIPEZE1565sDGnyHKAAAAQQ"]
[Thu May 07 08:22:56.523441 2026] [:error] [pid 4539:tid 4541] [client 52.138.31.126:15934] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "afvbYIPEZE1565sDGnyHKgAAAQA"]
[Thu May 07 08:22:56.938794 2026] [:error] [pid 29606:tid 29660] [client 52.138.31.126:15971] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "afvbYBR5HjZ1PlSAiKuPoAAAAFM"]
[Thu May 07 08:22:57.401465 2026] [:error] [pid 29605:tid 29634] [client 52.138.31.126:15812] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "afvbYYnxrTjETioEY0QInQAAABQ"]
[Thu May 07 08:22:57.823837 2026] [:error] [pid 4539:tid 4542] [client 52.138.31.126:16038] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "afvbYYPEZE1565sDGnyHLAAAAQE"]
[Thu May 07 08:22:58.276863 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:16062] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "afvbYv0atTQld9Y2ht8i9QAAANc"]
[Thu May 07 08:22:58.696658 2026] [:error] [pid 4539:tid 4546] [client 52.138.31.126:16031] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "afvbYoPEZE1565sDGnyHLgAAAQU"]
[Thu May 07 08:22:59.146101 2026] [:error] [pid 29710:tid 29712] [client 52.138.31.126:16103] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "afvbY_0atTQld9Y2ht8i9gAAAMA"]
[Thu May 07 08:22:59.596106 2026] [:error] [pid 29606:tid 29654] [client 52.138.31.126:15880] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "afvbYxR5HjZ1PlSAiKuPrgAAAE0"]
[Thu May 07 08:23:00.021104 2026] [:error] [pid 4539:tid 4544] [client 52.138.31.126:16302] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "afvbZIPEZE1565sDGnyHMQAAAQM"]
[Thu May 07 08:23:00.473769 2026] [:error] [pid 4539:tid 4550] [client 52.138.31.126:15970] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "afvbZIPEZE1565sDGnyHMwAAAQk"]
[Thu May 07 08:23:00.917057 2026] [:error] [pid 29605:tid 29633] [client 52.138.31.126:15901] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "afvbZInxrTjETioEY0QIoAAAABM"]
[Thu May 07 08:23:01.368897 2026] [:error] [pid 29710:tid 29733] [client 52.138.31.126:15811] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "afvbZf0atTQld9Y2ht8i-AAAANU"]
[Thu May 07 08:23:01.830948 2026] [:error] [pid 29605:tid 29624] [client 52.138.31.126:15838] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "afvbZYnxrTjETioEY0QIpgAAAAo"]
[Thu May 07 08:23:02.262925 2026] [:error] [pid 29710:tid 29732] [client 52.138.31.126:15882] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "afvbZv0atTQld9Y2ht8i-QAAANQ"]
[Thu May 07 08:23:02.690431 2026] [:error] [pid 29710:tid 29723] [client 52.138.31.126:15896] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "afvbZv0atTQld9Y2ht8i-wAAAMs"]
[Thu May 07 08:23:03.121231 2026] [:error] [pid 4539:tid 4543] [client 52.138.31.126:15875] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "afvbZ4PEZE1565sDGnyHNgAAAQI"]
[Thu May 07 08:23:03.579424 2026] [:error] [pid 29710:tid 29722] [client 52.138.31.126:15920] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "afvbZ_0atTQld9Y2ht8i_QAAAMo"]
[Thu May 07 08:23:04.034396 2026] [:error] [pid 29710:tid 29727] [client 52.138.31.126:15982] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "afvbaP0atTQld9Y2ht8jAAAAAM8"]
[Thu May 07 08:23:04.465742 2026] [:error] [pid 29710:tid 29714] [client 52.138.31.126:15965] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "afvbaP0atTQld9Y2ht8jAQAAAMI"]
[Thu May 07 08:23:04.922844 2026] [:error] [pid 29710:tid 29716] [client 52.138.31.126:15957] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "afvbaP0atTQld9Y2ht8jAwAAAMQ"]
[Thu May 07 08:23:05.352986 2026] [:error] [pid 29606:tid 29647] [client 52.138.31.126:15849] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "afvbaRR5HjZ1PlSAiKuPzgAAAEY"]
[Thu May 07 08:23:05.804124 2026] [:error] [pid 29606:tid 29643] [client 52.138.31.126:15923] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "afvbaRR5HjZ1PlSAiKuP0wAAAEI"]
[Thu May 07 08:23:06.249551 2026] [:error] [pid 29607:tid 29673] [client 52.138.31.126:16068] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "afvbaqbP7TJOAh7WSUOg4wAAAIU"]
[Thu May 07 08:23:06.731936 2026] [:error] [pid 29605:tid 29617] [client 52.138.31.126:15922] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "afvbaonxrTjETioEY0QIqwAAAAM"]
[Thu May 07 08:23:07.210372 2026] [:error] [pid 29607:tid 29674] [client 52.138.31.126:15899] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afvba6bP7TJOAh7WSUOg5QAAAIY"]
[Thu May 07 08:23:07.630824 2026] [:error] [pid 29607:tid 29688] [client 52.138.31.126:16039] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afvba6bP7TJOAh7WSUOg5gAAAJQ"]
[Thu May 07 08:23:08.055640 2026] [:error] [pid 29607:tid 29690] [client 52.138.31.126:15884] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afvbbKbP7TJOAh7WSUOg6AAAAJY"]
[Thu May 07 08:23:08.471164 2026] [:error] [pid 29607:tid 29680] [client 52.138.31.126:15889] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afvbbKbP7TJOAh7WSUOg6wAAAIw"]
[Thu May 07 08:23:08.899673 2026] [:error] [pid 29607:tid 29672] [client 52.138.31.126:15872] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "afvbbKbP7TJOAh7WSUOg7gAAAIQ"]
[Thu May 07 08:23:09.349907 2026] [:error] [pid 29606:tid 29652] [client 52.138.31.126:15842] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "afvbbRR5HjZ1PlSAiKuP4wAAAEs"]
[Thu May 07 08:23:09.777490 2026] [:error] [pid 29607:tid 29668] [client 52.138.31.126:15911] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "afvbbabP7TJOAh7WSUOg7wAAAIA"]
[Thu May 07 08:23:10.207290 2026] [:error] [pid 29710:tid 29729] [client 52.138.31.126:15989] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "afvbbv0atTQld9Y2ht8jBAAAANE"]
[Thu May 07 08:23:10.625427 2026] [:error] [pid 4539:tid 4547] [client 52.138.31.126:15906] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mws.php"] [unique_id "afvbboPEZE1565sDGnyHQAAAAQY"]
[Thu May 07 08:23:11.042327 2026] [:error] [pid 29710:tid 29718] [client 52.138.31.126:15918] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mws.php"] [unique_id "afvbb_0atTQld9Y2ht8jBQAAAMY"]
[Thu May 07 08:23:11.471760 2026] [:error] [pid 4539:tid 4551] [client 52.138.31.126:15808] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mws.php"] [unique_id "afvbb4PEZE1565sDGnyHQgAAAQo"]
[Thu May 07 08:23:11.946767 2026] [:error] [pid 4539:tid 4559] [client 52.138.31.126:15881] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mws.php"] [unique_id "afvbb4PEZE1565sDGnyHRAAAARI"]
[Thu May 07 08:23:12.363472 2026] [:error] [pid 29607:tid 29687] [client 52.138.31.126:15815] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "afvbcKbP7TJOAh7WSUOg9AAAAJM"]
[Thu May 07 08:23:12.797010 2026] [:error] [pid 4539:tid 4549] [client 52.138.31.126:15955] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "afvbcIPEZE1565sDGnyHRgAAAQg"]
[Thu May 07 08:23:13.218682 2026] [:error] [pid 29710:tid 29735] [client 52.138.31.126:15876] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "afvbcf0atTQld9Y2ht8jCAAAANc"]
[Thu May 07 08:23:13.640423 2026] [:error] [pid 29606:tid 29649] [client 52.138.31.126:15931] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "afvbcRR5HjZ1PlSAiKuP-gAAAEg"]
[Thu May 07 08:50:52.436207 2026] [:error] [pid 56065:tid 56110] [client 170.106.197.109:40674] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afvh7HdV4hYThdnhfxCu8wAAAI4"]
[Thu May 07 10:12:01.089619 2026] [:error] [pid 56064:tid 56076] [client 43.166.136.153:59518] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afv08SsGkZZUEf_7QCMSEQAAAAc"]
[Thu May 07 14:06:42.057884 2026] [:error] [pid 56056:tid 56189] [client 51.77.216.81:54926] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "afwr8gMt_VAuBmZ2nR9--QAAAVc"]
[Thu May 07 14:06:44.130269 2026] [:error] [pid 56065:tid 56116] [client 51.77.216.81:59306] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "afwr9HdV4hYThdnhfxDrcAAAAJQ"]
[Thu May 07 14:06:45.985024 2026] [:error] [pid 56066:tid 56143] [client 51.77.216.81:59308] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "afwr9UYS8DGwDvklLv7G5wAAANQ"]
[Thu May 07 14:06:47.909200 2026] [:error] [pid 56056:tid 56061] [client 51.77.216.81:59310] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "afwr9wMt_VAuBmZ2nR9_BwAAAUM"]
[Thu May 07 14:06:50.072427 2026] [:error] [pid 56056:tid 56149] [client 51.77.216.81:42374] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afwr-gMt_VAuBmZ2nR9_CwAAAUo"]
[Thu May 07 14:06:52.066490 2026] [:error] [pid 1143:tid 1148] [client 51.77.216.81:42380] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "afwr_Jb7qeI8X5VYRr6ciAAAAQM"]
[Thu May 07 14:06:53.936791 2026] [:error] [pid 1143:tid 1157] [client 51.77.216.81:42386] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "afwr_Zb7qeI8X5VYRr6ciQAAAQw"]
[Thu May 07 14:06:55.912169 2026] [:error] [pid 56150:tid 56161] [client 51.77.216.81:42392] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "afwr_9u4duXJJeTigXRVzwAAAEk"]
[Thu May 07 14:06:58.045051 2026] [:error] [pid 56150:tid 56154] [client 51.77.216.81:42394] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afwsAtu4duXJJeTigXRV0wAAAEI"]
[Thu May 07 14:06:59.973922 2026] [:error] [pid 56150:tid 56167] [client 51.77.216.81:43752] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "afwsA9u4duXJJeTigXRV2AAAAE8"]
[Thu May 07 14:07:02.281668 2026] [:error] [pid 56150:tid 56172] [client 51.77.216.81:43766] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afwsBtu4duXJJeTigXRV2gAAAFQ"]
[Thu May 07 14:07:04.172592 2026] [:error] [pid 56066:tid 56146] [client 51.77.216.81:43782] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afwsCEYS8DGwDvklLv7HBAAAANc"]
[Thu May 07 14:07:06.228700 2026] [:error] [pid 56056:tid 56182] [client 51.77.216.81:43788] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afwsCgMt_VAuBmZ2nR9_JwAAAVA"]
[Thu May 07 14:07:08.139494 2026] [:error] [pid 56066:tid 56126] [client 51.77.216.81:43804] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afwsDEYS8DGwDvklLv7HCAAAAMM"]
[Thu May 07 14:07:10.068875 2026] [:error] [pid 56056:tid 56182] [client 51.77.216.81:52488] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afwsDgMt_VAuBmZ2nR9_MwAAAVA"]
[Thu May 07 14:07:12.062212 2026] [:error] [pid 56065:tid 56102] [client 51.77.216.81:52490] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "afwsEHdV4hYThdnhfxDrmwAAAIY"]
[Thu May 07 14:07:14.250027 2026] [:error] [pid 1143:tid 1153] [client 51.77.216.81:52500] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "afwsEpb7qeI8X5VYRr6clwAAAQg"]
[Thu May 07 14:07:16.646118 2026] [:error] [pid 1143:tid 1163] [client 51.77.216.81:52510] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afwsFJb7qeI8X5VYRr6cnAAAARI"]
[Thu May 07 14:07:18.695186 2026] [:error] [pid 56056:tid 56178] [client 51.77.216.81:52514] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afwsFgMt_VAuBmZ2nR9_NQAAAUw"]
[Thu May 07 14:07:20.712196 2026] [:error] [pid 56056:tid 56059] [client 51.77.216.81:58892] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afwsGAMt_VAuBmZ2nR9_OQAAAUE"]
[Thu May 07 14:07:22.707280 2026] [:error] [pid 1143:tid 1166] [client 51.77.216.81:58908] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afwsGpb7qeI8X5VYRr6cnwAAARU"]
[Thu May 07 14:07:24.576659 2026] [:error] [pid 56056:tid 56187] [client 51.77.216.81:58912] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afwsHAMt_VAuBmZ2nR9_QQAAAVU"]
[Thu May 07 14:07:26.504686 2026] [:error] [pid 1143:tid 1149] [client 51.77.216.81:58914] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "afwsHpb7qeI8X5VYRr6cpQAAAQQ"]
[Thu May 07 14:07:28.462367 2026] [:error] [pid 56150:tid 56170] [client 51.77.216.81:58920] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "afwsINu4duXJJeTigXRV5gAAAFI"]
[Thu May 07 14:07:30.345197 2026] [:error] [pid 56065:tid 56097] [client 51.77.216.81:51050] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "afwsIndV4hYThdnhfxDrpQAAAIE"]
[Thu May 07 14:07:32.412223 2026] [:error] [pid 56056:tid 56190] [client 51.77.216.81:51060] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "afwsJAMt_VAuBmZ2nR9_SgAAAVg"]
[Thu May 07 14:07:34.456470 2026] [:error] [pid 56065:tid 56113] [client 51.77.216.81:51066] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "afwsJndV4hYThdnhfxDrpgAAAJE"]
[Thu May 07 14:07:36.399593 2026] [:error] [pid 56056:tid 56063] [client 51.77.216.81:51070] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afwsKAMt_VAuBmZ2nR9_UQAAAUU"]
[Thu May 07 14:07:39.198980 2026] [:error] [pid 56056:tid 56182] [client 51.77.216.81:32800] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afwsKwMt_VAuBmZ2nR9_WwAAAVA"]
[Thu May 07 14:08:02.584471 2026] [:error] [pid 56064:tid 56080] [client 51.77.216.81:32814] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "afwsQisGkZZUEf_7QCM0SQAAAAs"]
[Thu May 07 14:08:04.647976 2026] [:error] [pid 1143:tid 1166] [client 51.77.216.81:46306] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "afwsRJb7qeI8X5VYRr6ctgAAARU"]
[Thu May 07 14:08:06.837002 2026] [:error] [pid 56065:tid 56106] [client 51.77.216.81:46316] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "afwsRndV4hYThdnhfxDrtwAAAIo"]
[Thu May 07 14:40:41.544348 2026] [:error] [pid 15629:tid 15655] [client 54.37.86.223:56036] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "afwz6frIJCALdUrO43lOxgAAABY"]
[Thu May 07 14:40:43.520186 2026] [:error] [pid 15715:tid 15738] [client 54.37.86.223:55182] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "afwz6yY4dZsLOttMkcdLBAAAARI"]
[Thu May 07 14:40:45.560804 2026] [:error] [pid 15631:tid 15710] [client 54.37.86.223:55194] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "afwz7XvP1GkPUuuLfqX_dgAAANc"]
[Thu May 07 14:40:47.303749 2026] [:error] [pid 15715:tid 15742] [client 54.37.86.223:55204] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "afwz7yY4dZsLOttMkcdLDwAAARY"]
[Thu May 07 14:40:49.213386 2026] [:error] [pid 15630:tid 15664] [client 54.37.86.223:55208] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afwz8XTithRAi4821quGOwAAAIQ"]
[Thu May 07 14:40:51.252331 2026] [:error] [pid 15630:tid 15662] [client 54.37.86.223:60956] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afwz83TithRAi4821quGPwAAAII"]
[Thu May 07 14:40:53.125437 2026] [:error] [pid 15631:tid 15701] [client 54.37.86.223:60972] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "afwz9XvP1GkPUuuLfqX_eAAAAM4"]
[Thu May 07 14:40:55.151157 2026] [:error] [pid 15629:tid 15651] [client 54.37.86.223:60982] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "afwz9_rIJCALdUrO43lO1gAAABI"]
[Thu May 07 14:40:57.174936 2026] [:error] [pid 15715:tid 15739] [client 54.37.86.223:60986] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afwz-SY4dZsLOttMkcdLKQAAARM"]
[Thu May 07 14:40:59.197890 2026] [:error] [pid 15715:tid 15718] [client 54.37.86.223:60996] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afwz-yY4dZsLOttMkcdLNQAAAQE"]
[Thu May 07 14:41:01.198982 2026] [:error] [pid 15715:tid 15742] [client 54.37.86.223:40988] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afwz_SY4dZsLOttMkcdLQQAAARY"]
[Thu May 07 14:41:03.072141 2026] [:error] [pid 15715:tid 15734] [client 54.37.86.223:41002] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afwz_yY4dZsLOttMkcdLTQAAAQ4"]
[Thu May 07 14:41:05.088990 2026] [:error] [pid 15715:tid 15741] [client 54.37.86.223:41018] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afw0ASY4dZsLOttMkcdLVwAAARU"]
[Thu May 07 14:41:07.102310 2026] [:error] [pid 15715:tid 15731] [client 54.37.86.223:41026] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afw0AyY4dZsLOttMkcdLXQAAAQs"]
[Thu May 07 14:41:09.111172 2026] [:error] [pid 15630:tid 15667] [client 54.37.86.223:41040] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "afw0BXTithRAi4821quGUQAAAIc"]
[Thu May 07 14:41:11.108648 2026] [:error] [pid 15715:tid 15739] [client 54.37.86.223:48372] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "afw0ByY4dZsLOttMkcdLZQAAARM"]
[Thu May 07 14:41:13.115652 2026] [:error] [pid 15630:tid 15668] [client 54.37.86.223:48380] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afw0CXTithRAi4821quGVwAAAIg"]
[Thu May 07 14:41:15.147586 2026] [:error] [pid 15631:tid 15707] [client 54.37.86.223:48396] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "afw0C3vP1GkPUuuLfqX_jgAAANQ"]
[Thu May 07 14:41:17.014602 2026] [:error] [pid 15629:tid 15637] [client 54.37.86.223:48410] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afw0DfrIJCALdUrO43lO4gAAAAQ"]
[Thu May 07 14:41:19.047210 2026] [:error] [pid 15631:tid 15699] [client 54.37.86.223:48414] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afw0D3vP1GkPUuuLfqX_lwAAAMw"]
[Thu May 07 14:41:21.063137 2026] [:error] [pid 15715:tid 15743] [client 54.37.86.223:37504] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afw0ESY4dZsLOttMkcdLhwAAARc"]
[Thu May 07 14:41:23.099310 2026] [:error] [pid 15629:tid 15634] [client 54.37.86.223:37512] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "afw0E_rIJCALdUrO43lO6gAAAAE"]
[Thu May 07 14:41:24.849025 2026] [:error] [pid 15630:tid 15660] [client 54.37.86.223:37516] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afw0FHTithRAi4821quGaQAAAIA"]
[Thu May 07 14:41:26.850457 2026] [:error] [pid 15715:tid 15725] [client 54.37.86.223:37530] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "afw0FiY4dZsLOttMkcdLoQAAAQg"]
[Thu May 07 14:41:28.871378 2026] [:error] [pid 15715:tid 15721] [client 54.37.86.223:37540] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "afw0GCY4dZsLOttMkcdLpQAAAQQ"]
[Thu May 07 14:41:30.892812 2026] [:error] [pid 15630:tid 15683] [client 54.37.86.223:34502] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "afw0GnTithRAi4821quGcgAAAJc"]
[Thu May 07 16:13:02.975890 2026] [:error] [pid 28098:tid 28101] [client 43.156.232.190:35358] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afxJjsvhwfljlt8trSqbqAAAAEE"]
[Thu May 07 17:34:20.664588 2026] [:error] [pid 28098:tid 28100] [client 43.131.23.154:56430] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afxcnMvhwfljlt8trSq3YwAAAEA"]
[Thu May 07 23:14:44.595487 2026] [:error] [pid 15715:tid 15735] [client 43.153.102.138:51916] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "afysZCY4dZsLOttMkcfSUAAAAQ8"]
[Thu May 07 23:25:57.293018 2026] [:error] [pid 15630:tid 15671] [client 194.34.232.253:52444] [client 194.34.232.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.34.232.253, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afyvBXTithRAi4821qvWagAAAIs"]
[Thu May 07 23:25:57.303668 2026] [proxy_fcgi:error] [pid 15630:tid 15671] [client 194.34.232.253:52444] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:25:59.692907 2026] [:error] [pid 15715:tid 15733] [client 194.34.232.253:52448] [client 194.34.232.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.34.232.253, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "afyvByY4dZsLOttMkcfWRQAAAQ0"]
[Thu May 07 23:25:59.696389 2026] [proxy_fcgi:error] [pid 15715:tid 15733] [client 194.34.232.253:52448] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.228592 2026] [proxy_fcgi:error] [pid 12374:tid 12381] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.321810 2026] [proxy_fcgi:error] [pid 12374:tid 12399] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.416456 2026] [proxy_fcgi:error] [pid 12374:tid 12386] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.509554 2026] [proxy_fcgi:error] [pid 12374:tid 12390] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.602088 2026] [proxy_fcgi:error] [pid 12374:tid 12400] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.695274 2026] [proxy_fcgi:error] [pid 12374:tid 12394] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.790643 2026] [proxy_fcgi:error] [pid 12374:tid 12396] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.885441 2026] [proxy_fcgi:error] [pid 12374:tid 12387] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:41.978584 2026] [proxy_fcgi:error] [pid 12374:tid 12380] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:42.165869 2026] [proxy_fcgi:error] [pid 12374:tid 12402] [client 4.193.137.131:11018] AH01071: Got error 'Primary script unknown'
[Thu May 07 23:36:42.255321 2026] [:error] [pid 12374:tid 12378] [client 4.193.137.131:11018] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "afyxiho3QnNcFDMfKt18NgAAAYA"]
[Thu May 07 23:36:42.610868 2026] [:error] [pid 15629:tid 15643] [client 4.193.137.131:11033] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "afyxivrIJCALdUrO43mVswAAAAo"]
[Thu May 07 23:36:42.968780 2026] [:error] [pid 28098:tid 28105] [client 4.193.137.131:11031] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "afyxisvhwfljlt8trSo3oQAAAEU"]
[Thu May 07 23:36:43.352978 2026] [:error] [pid 15631:tid 15694] [client 4.193.137.131:11030] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa.php"] [unique_id "afyxi3vP1GkPUuuLfqVm9wAAAMc"]
[Fri May 08 00:08:06.496605 2026] [:error] [pid 15631:tid 15703] [client 178.150.14.250:40468] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "afy45nvP1GkPUuuLfqVruwAAANA"]
[Fri May 08 00:08:08.078381 2026] [:error] [pid 15715:tid 15721] [client 178.150.14.250:48880] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afy46CY4dZsLOttMkcfjfwAAAQQ"]
[Fri May 08 00:08:10.644028 2026] [:error] [pid 15629:tid 15641] [client 178.150.14.250:36858] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "afy46vrIJCALdUrO43mZMAAAAAg"]
[Fri May 08 00:08:12.743077 2026] [:error] [pid 15631:tid 15701] [client 178.150.14.250:55736] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "afy47HvP1GkPUuuLfqVrvQAAAM4"]
[Fri May 08 00:08:15.369411 2026] [:error] [pid 15715:tid 15722] [client 178.150.14.250:36866] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "afy47yY4dZsLOttMkcfjjAAAAQU"]
[Fri May 08 00:08:17.477012 2026] [:error] [pid 28098:tid 28113] [client 178.150.14.250:48688] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afy48cvhwfljlt8trSo6NQAAAE0"]
[Fri May 08 00:08:20.048673 2026] [:error] [pid 15715:tid 15741] [client 178.150.14.250:42078] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "afy49CY4dZsLOttMkcfjoAAAARU"]
[Fri May 08 00:08:22.544860 2026] [:error] [pid 15715:tid 15730] [client 178.150.14.250:42080] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "afy49iY4dZsLOttMkcfjqAAAAQo"]
[Fri May 08 00:08:25.044592 2026] [:error] [pid 12323:tid 12330] [client 178.150.14.250:42092] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "afy4-ddhHMnGFpc7MDxCWgAAAUM"]
[Fri May 08 00:08:27.599087 2026] [:error] [pid 12374:tid 12390] [client 178.150.14.250:57038] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "afy4-xo3QnNcFDMfKt1-mgAAAYw"]
[Fri May 08 00:08:30.123172 2026] [:error] [pid 15630:tid 15661] [client 178.150.14.250:57040] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "afy4_nTithRAi4821qvfugAAAIE"]
[Fri May 08 00:08:32.201089 2026] [:error] [pid 12374:tid 12388] [client 178.150.14.250:60294] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afy5ABo3QnNcFDMfKt1-oAAAAYo"]
[Fri May 08 00:08:34.817295 2026] [:error] [pid 12323:tid 12340] [client 178.150.14.250:57054] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "afy5AtdhHMnGFpc7MDxCXwAAAU0"]
[Fri May 08 00:08:36.901302 2026] [:error] [pid 12323:tid 12334] [client 178.150.14.250:49806] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afy5BNdhHMnGFpc7MDxCYwAAAUc"]
[Fri May 08 00:08:39.468010 2026] [:error] [pid 15715:tid 15724] [client 178.150.14.250:44500] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "afy5ByY4dZsLOttMkcfj2QAAAQc"]
[Fri May 08 00:08:41.412919 2026] [:error] [pid 15631:tid 15705] [client 178.150.14.250:49822] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afy5CXvP1GkPUuuLfqVr4gAAANI"]
[Fri May 08 00:08:43.981840 2026] [:error] [pid 15629:tid 15645] [client 178.150.14.250:44504] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "afy5C_rIJCALdUrO43mZTwAAAAw"]
[Fri May 08 00:08:45.915864 2026] [:error] [pid 15715:tid 15719] [client 178.150.14.250:43538] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afy5DSY4dZsLOttMkcfj9QAAAQI"]
[Fri May 08 00:08:48.553386 2026] [:error] [pid 15715:tid 15738] [client 178.150.14.250:43732] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "afy5ECY4dZsLOttMkcfj-gAAARI"]
[Fri May 08 00:08:51.031293 2026] [:error] [pid 15630:tid 15682] [client 178.150.14.250:43738] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "afy5E3TithRAi4821qvf1QAAAJY"]
[Fri May 08 00:08:53.480166 2026] [:error] [pid 15629:tid 15651] [client 178.150.14.250:43740] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "afy5FfrIJCALdUrO43mZWAAAABI"]
[Fri May 08 00:08:56.026562 2026] [:error] [pid 15715:tid 15720] [client 178.150.14.250:57280] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "afy5GCY4dZsLOttMkcfkGgAAAQM"]
[Fri May 08 00:08:58.626900 2026] [:error] [pid 15630:tid 15666] [client 178.150.14.250:57288] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "afy5GnTithRAi4821qvf5QAAAIY"]
[Fri May 08 00:09:00.756480 2026] [:error] [pid 15715:tid 15732] [client 178.150.14.250:51260] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afy5HCY4dZsLOttMkcfkKgAAAQw"]
[Fri May 08 00:09:03.335850 2026] [:error] [pid 15715:tid 15740] [client 178.150.14.250:57292] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "afy5HyY4dZsLOttMkcfkNQAAARQ"]
[Fri May 08 00:09:25.000770 2026] [:error] [pid 15715:tid 15743] [client 178.150.14.250:58490] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "afy5NCY4dZsLOttMkcfkVwAAARc"]
[Fri May 08 00:09:26.750142 2026] [:error] [pid 15631:tid 15697] [client 178.150.14.250:52776] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "afy5NnvP1GkPUuuLfqVsGQAAAMo"]
[Fri May 08 00:09:29.329853 2026] [:error] [pid 15715:tid 15732] [client 178.150.14.250:36138] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "afy5OSY4dZsLOttMkcfkYwAAAQw"]
[Fri May 08 00:09:31.959737 2026] [:error] [pid 15631:tid 15693] [client 178.150.14.250:36140] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "afy5O3vP1GkPUuuLfqVsHgAAAMY"]
[Fri May 08 00:09:34.641405 2026] [:error] [pid 28098:tid 28124] [client 178.150.14.250:36154] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "afy5Psvhwfljlt8trSo6XQAAAFg"]
[Fri May 08 00:09:37.151001 2026] [:error] [pid 15630:tid 15666] [client 178.150.14.250:51216] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "afy5QXTithRAi4821qvf8AAAAIY"]
[Fri May 08 00:09:39.178797 2026] [:error] [pid 15629:tid 15650] [client 178.150.14.250:56682] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "afy5Q_rIJCALdUrO43mZawAAABE"]
[Fri May 08 00:09:41.071516 2026] [:error] [pid 15715:tid 15720] [client 178.150.14.250:56686] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "afy5RSY4dZsLOttMkcfkcAAAAQM"]
[Fri May 08 00:09:42.953603 2026] [:error] [pid 28098:tid 28102] [client 178.150.14.250:56690] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "afy5Rsvhwfljlt8trSo6YAAAAEI"]
[Fri May 08 00:09:44.994817 2026] [:error] [pid 28098:tid 28117] [client 178.150.14.250:56748] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "afy5SMvhwfljlt8trSo6ZwAAAFE"]
[Fri May 08 00:09:46.869553 2026] [:error] [pid 12323:tid 12338] [client 178.150.14.250:56750] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "afy5StdhHMnGFpc7MDxCfgAAAUs"]
[Fri May 08 00:09:48.877789 2026] [:error] [pid 15631:tid 15699] [client 178.150.14.250:56756] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "afy5THvP1GkPUuuLfqVsMwAAAMw"]
[Fri May 08 00:09:50.899324 2026] [:error] [pid 15631:tid 15709] [client 178.150.14.250:56762] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "afy5TnvP1GkPUuuLfqVsOAAAANY"]
[Fri May 08 00:09:53.391377 2026] [:error] [pid 15631:tid 15704] [client 178.150.14.250:56342] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "afy5UXvP1GkPUuuLfqVsOQAAANE"]
[Fri May 08 00:09:56.074789 2026] [:error] [pid 15629:tid 15648] [client 178.150.14.250:56346] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "afy5VPrIJCALdUrO43mZeQAAAA8"]
[Fri May 08 00:09:58.719354 2026] [:error] [pid 15630:tid 15664] [client 178.150.14.250:56350] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "afy5VnTithRAi4821qvgBwAAAIQ"]
[Fri May 08 00:10:01.261938 2026] [:error] [pid 28098:tid 28114] [client 178.150.14.250:56366] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "afy5Wcvhwfljlt8trSo6cgAAAE4"]
[Fri May 08 00:10:03.093858 2026] [:error] [pid 15630:tid 15682] [client 178.150.14.250:55278] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "afy5W3TithRAi4821qvgGAAAAJY"]
[Fri May 08 00:10:05.682226 2026] [:error] [pid 15631:tid 15697] [client 178.150.14.250:50042] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "afy5XXvP1GkPUuuLfqVsTQAAAMo"]
[Fri May 08 00:10:07.827582 2026] [:error] [pid 15715:tid 15723] [client 178.150.14.250:45126] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afy5XyY4dZsLOttMkcfkhgAAAQY"]
[Fri May 08 00:10:10.444744 2026] [:error] [pid 28098:tid 28100] [client 178.150.14.250:50052] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "afy5Ysvhwfljlt8trSo6egAAAEA"]
[Fri May 08 00:10:12.558123 2026] [:error] [pid 15629:tid 15646] [client 178.150.14.250:45132] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "afy5ZPrIJCALdUrO43mZnwAAAA0"]
[Fri May 08 00:10:15.034903 2026] [:error] [pid 15715:tid 15737] [client 178.150.14.250:50060] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "afy5ZyY4dZsLOttMkcfkkQAAARE"]
[Fri May 08 00:10:16.953811 2026] [:error] [pid 15629:tid 15639] [client 178.150.14.250:40240] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afy5aPrIJCALdUrO43mZqgAAAAY"]
[Fri May 08 00:10:19.486040 2026] [:error] [pid 15629:tid 15638] [client 178.150.14.250:38360] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "afy5a_rIJCALdUrO43mZtAAAAAU"]
[Fri May 08 00:10:22.047218 2026] [:error] [pid 15629:tid 15646] [client 178.150.14.250:38366] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "afy5bvrIJCALdUrO43mZuwAAAA0"]
[Fri May 08 00:10:43.164059 2026] [:error] [pid 15630:tid 15676] [client 178.150.14.250:44862] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "afy5g3TithRAi4821qvgQwAAAJA"]
[Fri May 08 00:10:45.713752 2026] [:error] [pid 15629:tid 15638] [client 178.150.14.250:60692] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "afy5hfrIJCALdUrO43mZ2wAAAAU"]
[Fri May 08 00:10:48.200333 2026] [:error] [pid 12323:tid 12341] [client 178.150.14.250:60704] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "afy5iNdhHMnGFpc7MDxCjwAAAU4"]
[Fri May 08 00:10:50.300975 2026] [:error] [pid 15630:tid 15674] [client 178.150.14.250:56358] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afy5inTithRAi4821qvgUAAAAI4"]
[Fri May 08 00:10:52.721736 2026] [:error] [pid 15631:tid 15697] [client 178.150.14.250:60718] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "afy5jHvP1GkPUuuLfqVsWQAAAMo"]
[Fri May 08 00:10:55.363761 2026] [:error] [pid 15631:tid 15700] [client 178.150.14.250:39900] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "afy5j3vP1GkPUuuLfqVsXAAAAM0"]
[Fri May 08 00:10:57.188578 2026] [:error] [pid 15630:tid 15681] [client 178.150.14.250:37520] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afy5kXTithRAi4821qvgWQAAAJU"]
[Fri May 08 00:10:59.625147 2026] [:error] [pid 15715:tid 15718] [client 178.150.14.250:39902] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "afy5kyY4dZsLOttMkcfkzwAAAQE"]
[Fri May 08 00:11:01.710735 2026] [:error] [pid 15715:tid 15731] [client 178.150.14.250:37536] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afy5lSY4dZsLOttMkcfk0AAAAQs"]
[Fri May 08 00:11:04.292026 2026] [:error] [pid 28098:tid 28104] [client 178.150.14.250:39910] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "afy5mMvhwfljlt8trSo6iAAAAEQ"]
[Fri May 08 00:11:06.911261 2026] [:error] [pid 28098:tid 28103] [client 178.150.14.250:50574] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "afy5msvhwfljlt8trSo6igAAAEM"]
[Fri May 08 00:11:08.877613 2026] [:error] [pid 15631:tid 15705] [client 178.150.14.250:60996] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afy5nHvP1GkPUuuLfqVsYwAAANI"]
[Fri May 08 00:11:11.455748 2026] [:error] [pid 15630:tid 15683] [client 178.150.14.250:50590] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "afy5n3TithRAi4821qvgXgAAAJc"]
[Fri May 08 00:11:13.422089 2026] [:error] [pid 15630:tid 15680] [client 178.150.14.250:32778] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "afy5oXTithRAi4821qvgZgAAAJQ"]
[Fri May 08 00:11:15.421461 2026] [:error] [pid 15715:tid 15738] [client 178.150.14.250:44282] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "afy5oyY4dZsLOttMkcfk2QAAARI"]
[Fri May 08 00:11:17.847967 2026] [:error] [pid 12323:tid 12340] [client 178.150.14.250:59830] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "afy5pddhHMnGFpc7MDxClgAAAU0"]
[Fri May 08 00:11:19.809878 2026] [:error] [pid 15629:tid 15643] [client 178.150.14.250:44290] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afy5p_rIJCALdUrO43mZ8wAAAAo"]
[Fri May 08 00:11:22.415868 2026] [:error] [pid 15629:tid 15651] [client 178.150.14.250:59840] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "afy5qvrIJCALdUrO43mZ9wAAABI"]
[Fri May 08 00:11:24.521677 2026] [:error] [pid 12323:tid 12334] [client 178.150.14.250:44304] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afy5rNdhHMnGFpc7MDxCmQAAAUc"]
[Fri May 08 00:11:27.108535 2026] [:error] [pid 28098:tid 28110] [client 178.150.14.250:48566] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "afy5r8vhwfljlt8trSo6kAAAAEo"]
[Fri May 08 00:11:29.210256 2026] [:error] [pid 15629:tid 15642] [client 178.150.14.250:37586] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afy5sfrIJCALdUrO43maBQAAAAk"]
[Fri May 08 00:11:31.671533 2026] [:error] [pid 15715:tid 15720] [client 178.150.14.250:48568] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "afy5syY4dZsLOttMkcfk7wAAAQM"]
[Fri May 08 00:11:33.777412 2026] [:error] [pid 28098:tid 28104] [client 178.150.14.250:37588] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afy5tcvhwfljlt8trSo6lgAAAEQ"]
[Fri May 08 00:11:36.317449 2026] [:error] [pid 28098:tid 28118] [client 178.150.14.250:54850] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "afy5uMvhwfljlt8trSo6nAAAAFI"]
[Fri May 08 00:11:38.788535 2026] [:error] [pid 12374:tid 12401] [client 178.150.14.250:54860] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "afy5uho3QnNcFDMfKt1-zQAAAZc"]
[Fri May 08 00:11:59.672301 2026] [:error] [pid 15630:tid 15676] [client 178.150.14.250:54872] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "afy5z3TithRAi4821qvghgAAAJA"]
[Fri May 08 00:12:02.770604 2026] [:error] [pid 12374:tid 12397] [client 178.150.14.250:41738] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afy50ho3QnNcFDMfKt1-2wAAAZM"]
[Fri May 08 00:12:06.482316 2026] [:error] [pid 15631:tid 15698] [client 178.150.14.250:50972] [client 178.150.14.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "afy51nvP1GkPUuuLfqVshgAAAMs"]
[Fri May 08 00:18:23.591995 2026] [:error] [pid 12374:tid 12385] [client 101.32.52.164:48864] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "afy7Txo3QnNcFDMfKt1_TwAAAYc"]
[Fri May 08 01:45:09.633925 2026] [:error] [pid 15631:tid 15689] [client 197.47.199.191:61981] [client 197.47.199.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.47.199.191, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "afzPpXvP1GkPUuuLfqV7lAAAAMI"]
[Fri May 08 01:45:09.645524 2026] [proxy_fcgi:error] [pid 15631:tid 15689] [client 197.47.199.191:61981] AH01071: Got error 'Primary script unknown'
[Fri May 08 02:13:32.246466 2026] [:error] [pid 15715:tid 15718] [client 34.93.65.251:44708] [client 34.93.65.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "afzWTCY4dZsLOttMkccGcgAAAQE"]
[Fri May 08 05:29:39.489598 2026] [:error] [pid 51113:tid 51116] [client 162.14.109.170:44198] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "af0EQ0Qfs7sWtqkpQIcIIAAAAME"]
[Fri May 08 05:35:38.568542 2026] [:error] [pid 34318:tid 34335] [client 34.93.134.246:54814] [client 34.93.134.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "af0Fqsr3guirgJiKhzBSBgAAAQ8"]
[Fri May 08 06:23:08.987494 2026] [:error] [pid 34318:tid 34331] [client 34.102.102.230:51794] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "af0QzMr3guirgJiKhzB5lAAAAQs"]
[Fri May 08 06:23:09.041515 2026] [:error] [pid 51113:tid 51122] [client 34.102.102.230:51788] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.local"] [unique_id "af0QzUQfs7sWtqkpQIcoOQAAAMc"]
[Fri May 08 06:23:09.397945 2026] [:error] [pid 34318:tid 34343] [client 34.102.102.230:51810] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/admin/.env"] [unique_id "af0Qzcr3guirgJiKhzB5lgAAARc"]
[Fri May 08 06:23:09.415440 2026] [:error] [pid 34318:tid 34323] [client 34.102.102.230:51826] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env"] [unique_id "af0Qzcr3guirgJiKhzB5lwAAAQM"]
[Fri May 08 06:23:09.417833 2026] [:error] [pid 34318:tid 34326] [client 34.102.102.230:51838] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/api/.env"] [unique_id "af0Qzcr3guirgJiKhzB5mAAAAQY"]
[Fri May 08 06:23:09.602479 2026] [:error] [pid 34318:tid 34332] [client 34.102.102.230:51852] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.docker"] [unique_id "af0Qzcr3guirgJiKhzB5mgAAAQw"]
[Fri May 08 06:23:09.660497 2026] [:error] [pid 34318:tid 34336] [client 34.102.102.230:51862] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.dev.local"] [unique_id "af0Qzcr3guirgJiKhzB5mwAAARA"]
[Fri May 08 06:23:09.672934 2026] [:error] [pid 34318:tid 34321] [client 34.102.102.230:51864] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.development.local"] [unique_id "af0Qzcr3guirgJiKhzB5nAAAAQE"]
[Fri May 08 06:23:09.698704 2026] [:error] [pid 34318:tid 34344] [client 34.102.102.230:51866] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env.local"] [unique_id "af0Qzcr3guirgJiKhzB5nQAAARg"]
[Fri May 08 06:23:09.821449 2026] [:error] [pid 34318:tid 34341] [client 34.102.102.230:51878] [client 34.102.102.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.dev"] [unique_id "af0Qzcr3guirgJiKhzB5ngAAARU"]
[Fri May 08 06:54:12.897370 2026] [:error] [pid 61356:tid 61412] [client 35.197.73.60:59364] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env.local"] [unique_id "af0YFIx3vpB8oWhUq2N38gAAAdg"]
[Fri May 08 06:54:12.911037 2026] [:error] [pid 51008:tid 51050] [client 35.197.73.60:59366] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/app/.env"] [unique_id "af0YFHB58C2Y1tgLtuIkrgAAAEE"]
[Fri May 08 06:54:13.006309 2026] [:error] [pid 61356:tid 61393] [client 35.197.73.60:59368] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.dev.local"] [unique_id "af0YFYx3vpB8oWhUq2N38wAAAcU"]
[Fri May 08 06:54:13.049990 2026] [:error] [pid 61356:tid 61400] [client 35.197.73.60:59370] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.development.local"] [unique_id "af0YFYx3vpB8oWhUq2N39AAAAcw"]
[Fri May 08 06:54:13.064112 2026] [:error] [pid 61356:tid 61389] [client 35.197.73.60:59380] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/admin/.env"] [unique_id "af0YFYx3vpB8oWhUq2N39QAAAcE"]
[Fri May 08 06:54:13.067790 2026] [:error] [pid 61356:tid 61390] [client 35.197.73.60:59388] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/api/.env"] [unique_id "af0YFYx3vpB8oWhUq2N39gAAAcI"]
[Fri May 08 06:54:13.151579 2026] [:error] [pid 61356:tid 61404] [client 35.197.73.60:59404] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.docker"] [unique_id "af0YFYx3vpB8oWhUq2N3-AAAAdA"]
[Fri May 08 06:54:13.184926 2026] [:error] [pid 61356:tid 61410] [client 35.197.73.60:59412] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "af0YFYx3vpB8oWhUq2N3-QAAAdY"]
[Fri May 08 06:54:13.224797 2026] [:error] [pid 61356:tid 61391] [client 35.197.73.60:59410] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.dev"] [unique_id "af0YFYx3vpB8oWhUq2N3-gAAAcM"]
[Fri May 08 06:54:13.547103 2026] [:error] [pid 61356:tid 61411] [client 35.197.73.60:59426] [client 35.197.73.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env.local"] [unique_id "af0YFYx3vpB8oWhUq2N3_QAAAdc"]
[Fri May 08 08:11:52.836067 2026] [:error] [pid 61356:tid 61401] [client 88.88.156.124:39374] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af0qSIx3vpB8oWhUq2OdnwAAAc0"]
[Fri May 08 08:11:54.786298 2026] [:error] [pid 61317:tid 61327] [client 88.88.156.124:58306] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af0qSs-fFk_CedOCOYtEZgAAAUc"]
[Fri May 08 08:11:56.774946 2026] [:error] [pid 61355:tid 61373] [client 88.88.156.124:58926] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af0qTPkhJTi30CBXmMnfFwAAAYw"]
[Fri May 08 08:11:58.773863 2026] [:error] [pid 61355:tid 61371] [client 88.88.156.124:58928] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af0qTvkhJTi30CBXmMnfGQAAAYo"]
[Fri May 08 08:12:00.803403 2026] [:error] [pid 61355:tid 61382] [client 88.88.156.124:58940] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af0qUPkhJTi30CBXmMnfHAAAAZU"]
[Fri May 08 08:12:02.657393 2026] [:error] [pid 61356:tid 61397] [client 88.88.156.124:58942] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af0qUox3vpB8oWhUq2OdvwAAAck"]
[Fri May 08 08:12:04.685082 2026] [:error] [pid 34318:tid 34322] [client 88.88.156.124:58954] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af0qVMr3guirgJiKhzCQQgAAAQI"]
[Fri May 08 08:12:07.292395 2026] [:error] [pid 61317:tid 61338] [client 88.88.156.124:52828] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af0qV8-fFk_CedOCOYtEcQAAAVI"]
[Fri May 08 08:12:09.288859 2026] [:error] [pid 61355:tid 61373] [client 88.88.156.124:52832] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af0qWfkhJTi30CBXmMnfLAAAAYw"]
[Fri May 08 08:12:11.273006 2026] [:error] [pid 51008:tid 51060] [client 88.88.156.124:52838] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af0qW3B58C2Y1tgLtuI0XAAAAEs"]
[Fri May 08 08:12:13.102600 2026] [:error] [pid 51113:tid 51134] [client 88.88.156.124:52846] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af0qXUQfs7sWtqkpQIc44QAAANM"]
[Fri May 08 08:12:15.078181 2026] [:error] [pid 61356:tid 61392] [client 88.88.156.124:52862] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af0qX4x3vpB8oWhUq2Od3AAAAcQ"]
[Fri May 08 08:12:17.057208 2026] [:error] [pid 61355:tid 61369] [client 88.88.156.124:53052] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af0qYfkhJTi30CBXmMnfNQAAAYg"]
[Fri May 08 08:12:19.033569 2026] [:error] [pid 51008:tid 51068] [client 88.88.156.124:53060] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af0qY3B58C2Y1tgLtuI0agAAAFM"]
[Fri May 08 08:12:21.010028 2026] [:error] [pid 61355:tid 61361] [client 88.88.156.124:53062] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af0qZfkhJTi30CBXmMnfUAAAAYA"]
[Fri May 08 08:12:23.004867 2026] [:error] [pid 51007:tid 51040] [client 88.88.156.124:53070] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "af0qZ1MagSGstWKyzzWUVQAAABI"]
[Fri May 08 08:12:24.987954 2026] [:error] [pid 61355:tid 61363] [client 88.88.156.124:53074] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af0qaPkhJTi30CBXmMnfYwAAAYI"]
[Fri May 08 08:12:26.993649 2026] [:error] [pid 61317:tid 61335] [client 88.88.156.124:38100] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af0qas-fFk_CedOCOYtEgwAAAU8"]
[Fri May 08 08:12:28.979157 2026] [:error] [pid 51008:tid 51056] [client 88.88.156.124:38102] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af0qbHB58C2Y1tgLtuI0dwAAAEc"]
[Fri May 08 08:12:30.974429 2026] [:error] [pid 51008:tid 51051] [client 88.88.156.124:38104] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af0qbnB58C2Y1tgLtuI0gQAAAEI"]
[Fri May 08 08:12:32.961811 2026] [:error] [pid 61355:tid 61375] [client 88.88.156.124:38120] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af0qcPkhJTi30CBXmMnfawAAAY4"]
[Fri May 08 08:12:34.950575 2026] [:error] [pid 61356:tid 61409] [client 88.88.156.124:38122] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af0qcox3vpB8oWhUq2OeBQAAAdU"]
[Fri May 08 08:12:36.933370 2026] [:error] [pid 61356:tid 61401] [client 88.88.156.124:54078] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "af0qdIx3vpB8oWhUq2OeEwAAAc0"]
[Fri May 08 08:12:38.930013 2026] [:error] [pid 51008:tid 51072] [client 88.88.156.124:54088] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af0qdnB58C2Y1tgLtuI0jgAAAFc"]
[Fri May 08 08:12:40.929821 2026] [:error] [pid 61355:tid 61374] [client 88.88.156.124:54100] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af0qePkhJTi30CBXmMnfiwAAAY0"]
[Fri May 08 08:12:43.920894 2026] [:error] [pid 61356:tid 61412] [client 88.88.156.124:54108] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af0qe4x3vpB8oWhUq2OeOQAAAdg"]
[Fri May 08 08:12:45.839039 2026] [:error] [pid 34318:tid 34328] [client 88.88.156.124:54118] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "af0qfcr3guirgJiKhzCQjgAAAQg"]
[Fri May 08 08:12:47.812473 2026] [:error] [pid 61355:tid 61380] [client 88.88.156.124:38692] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "af0qf_khJTi30CBXmMnfqgAAAZM"]
[Fri May 08 08:12:49.024905 2026] [:error] [pid 51113:tid 51115] [client 88.88.156.124:38704] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "af0qgUQfs7sWtqkpQIc46gAAAMA"]
[Fri May 08 08:13:11.529008 2026] [:error] [pid 61355:tid 61384] [client 88.88.156.124:38712] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af0ql_khJTi30CBXmMnf_wAAAZc"]
[Fri May 08 08:13:13.470951 2026] [:error] [pid 51113:tid 51126] [client 88.88.156.124:50272] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af0qmUQfs7sWtqkpQIc4-AAAAMs"]
[Fri May 08 08:13:15.323959 2026] [:error] [pid 61317:tid 61328] [client 88.88.156.124:50280] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af0qm8-fFk_CedOCOYtErQAAAUg"]
[Fri May 08 08:30:53.204945 2026] [:error] [pid 61356:tid 61408] [client 145.239.65.133:46030] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "af0uvYx3vpB8oWhUq2OmpgAAAdQ"]
[Fri May 08 08:30:55.057532 2026] [:error] [pid 61355:tid 61382] [client 145.239.65.133:34864] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "af0uv_khJTi30CBXmMnmKQAAAZU"]
[Fri May 08 08:30:57.028561 2026] [:error] [pid 61356:tid 61409] [client 145.239.65.133:47514] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "af0uwYx3vpB8oWhUq2OmsgAAAdU"]
[Fri May 08 08:30:59.084289 2026] [:error] [pid 61317:tid 61324] [client 145.239.65.133:47520] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af0uw8-fFk_CedOCOYtHyAAAAUQ"]
[Fri May 08 08:31:01.001623 2026] [:error] [pid 61317:tid 61328] [client 145.239.65.133:47522] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "af0uxc-fFk_CedOCOYtHzQAAAUg"]
[Fri May 08 08:31:03.020911 2026] [:error] [pid 61355:tid 61373] [client 145.239.65.133:47536] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "af0ux_khJTi30CBXmMnmPQAAAYw"]
[Fri May 08 08:31:04.895799 2026] [:error] [pid 51009:tid 51082] [client 145.239.65.133:47542] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "af0uyOB0GbUWhxgzX9W8igAAAIY"]
[Fri May 08 08:31:06.616766 2026] [:error] [pid 34318:tid 34331] [client 145.239.65.133:55168] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "af0uysr3guirgJiKhzCSjgAAAQs"]
[Fri May 08 08:31:08.439581 2026] [:error] [pid 61355:tid 61362] [client 145.239.65.133:55184] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "af0uzPkhJTi30CBXmMnmTAAAAYE"]
[Fri May 08 08:31:10.317738 2026] [:error] [pid 61317:tid 61329] [client 145.239.65.133:55188] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "af0uzs-fFk_CedOCOYtH0QAAAUk"]
[Fri May 08 08:31:12.246138 2026] [:error] [pid 61355:tid 61363] [client 145.239.65.133:55198] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af0u0PkhJTi30CBXmMnmVwAAAYI"]
[Fri May 08 08:31:14.152622 2026] [:error] [pid 61356:tid 61408] [client 145.239.65.133:55210] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "af0u0ox3vpB8oWhUq2Om3QAAAdQ"]
[Fri May 08 08:31:16.156941 2026] [:error] [pid 61356:tid 61404] [client 145.239.65.133:56046] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "af0u1Ix3vpB8oWhUq2Om5AAAAdA"]
[Fri May 08 08:31:18.171799 2026] [:error] [pid 61356:tid 61408] [client 145.239.65.133:56054] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "af0u1ox3vpB8oWhUq2Om7gAAAdQ"]
[Fri May 08 08:31:20.285730 2026] [:error] [pid 61356:tid 61407] [client 145.239.65.133:56058] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "af0u2Ix3vpB8oWhUq2Om_QAAAdM"]
[Fri May 08 08:31:22.311961 2026] [:error] [pid 51007:tid 51046] [client 145.239.65.133:56062] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af0u2lMagSGstWKyzzWWuwAAABg"]
[Fri May 08 08:31:24.184834 2026] [:error] [pid 61317:tid 61323] [client 145.239.65.133:56064] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "af0u3M-fFk_CedOCOYtH1gAAAUM"]
[Fri May 08 08:31:26.214315 2026] [:error] [pid 61317:tid 61344] [client 145.239.65.133:60016] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "af0u3s-fFk_CedOCOYtH2wAAAVg"]
[Fri May 08 08:31:28.203709 2026] [:error] [pid 51009:tid 51084] [client 145.239.65.133:60026] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "af0u4OB0GbUWhxgzX9W8jQAAAIg"]
[Fri May 08 08:31:30.234290 2026] [:error] [pid 61356:tid 61395] [client 145.239.65.133:60030] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "af0u4ox3vpB8oWhUq2OnDgAAAcc"]
[Fri May 08 08:31:32.127365 2026] [:error] [pid 61356:tid 61399] [client 145.239.65.133:60042] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "af0u5Ix3vpB8oWhUq2OnEgAAAcs"]
[Fri May 08 08:31:34.008871 2026] [:error] [pid 61355:tid 61381] [client 145.239.65.133:60052] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "af0u5vkhJTi30CBXmMnmeQAAAZQ"]
[Fri May 08 08:31:36.025132 2026] [:error] [pid 61355:tid 61384] [client 145.239.65.133:33618] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "af0u6PkhJTi30CBXmMnmhAAAAZc"]
[Fri May 08 08:31:37.929530 2026] [:error] [pid 61355:tid 61374] [client 145.239.65.133:33630] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "af0u6fkhJTi30CBXmMnmjgAAAY0"]
[Fri May 08 08:31:39.836105 2026] [:error] [pid 51008:tid 51056] [client 145.239.65.133:33632] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "af0u63B58C2Y1tgLtuI5CgAAAEc"]
[Fri May 08 08:31:41.867090 2026] [:error] [pid 51113:tid 51116] [client 145.239.65.133:33642] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "af0u7UQfs7sWtqkpQIc7CgAAAME"]
[Fri May 08 08:48:09.859275 2026] [:error] [pid 61317:tid 61326] [client 172.71.124.57:10313] [client 172.71.124.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "af0yyc-fFk_CedOCOYtMIAAAAUY"]
[Fri May 08 08:48:09.859287 2026] [:error] [pid 61317:tid 61332] [client 172.69.176.144:9498] [client 172.69.176.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env"] [unique_id "af0yyc-fFk_CedOCOYtMHwAAAUw"], referer: https://www.google.com/search?q=www.switchcreative.net
[Fri May 08 08:48:35.335170 2026] [:error] [pid 61317:tid 61326] [client 43.153.48.240:43962] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af0y48-fFk_CedOCOYtMNQAAAUY"]
[Fri May 08 11:29:48.683521 2026] [proxy_fcgi:error] [pid 61317:tid 61330] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:48.990440 2026] [proxy_fcgi:error] [pid 61317:tid 61341] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:49.149877 2026] [proxy_fcgi:error] [pid 61317:tid 61323] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:49.311951 2026] [proxy_fcgi:error] [pid 61317:tid 61329] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:49.618399 2026] [proxy_fcgi:error] [pid 61317:tid 61326] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:49.924777 2026] [proxy_fcgi:error] [pid 61317:tid 61342] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:50.090369 2026] [proxy_fcgi:error] [pid 61317:tid 61328] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:50.275067 2026] [proxy_fcgi:error] [pid 61317:tid 61340] [client 20.41.97.162:13279] AH01071: Got error 'Primary script unknown'
[Fri May 08 11:29:50.424706 2026] [:error] [pid 61317:tid 61344] [client 20.41.97.162:13279] [client 20.41.97.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "af1Yrs-fFk_CedOCOYtvtAAAAVg"]
[Fri May 08 11:29:51.716764 2026] [:error] [pid 61355:tid 61368] [client 20.41.97.162:20202] [client 20.41.97.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "af1Yr_khJTi30CBXmMklhgAAAYc"]
[Fri May 08 11:29:52.656906 2026] [:error] [pid 61317:tid 61337] [client 20.41.97.162:4664] [client 20.41.97.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "af1YsM-fFk_CedOCOYtvtQAAAVE"]
[Fri May 08 11:29:53.319635 2026] [:error] [pid 61317:tid 61325] [client 20.41.97.162:20222] [client 20.41.97.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "af1Ysc-fFk_CedOCOYtvtgAAAUU"]
[Fri May 08 14:58:43.315888 2026] [:error] [pid 34318:tid 34321] [client 43.166.136.24:51982] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "af2Jo8r3guirgJiKhzC5qAAAAQE"]
[Fri May 08 15:28:56.787660 2026] [:error] [pid 61355:tid 61374] [client 34.122.144.100:55825] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "af2QuPkhJTi30CBXmMlenAAAAY0"]
[Fri May 08 17:35:08.102420 2026] [:error] [pid 61356:tid 61405] [client 175.178.110.121:59458] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af2uTIx3vpB8oWhUq2NcuAAAAdE"]
[Fri May 08 17:46:10.275298 2026] [:error] [pid 51009:tid 51093] [client 103.166.103.129:52327] [client 103.166.103.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.166.103.129, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "af2w4uB0GbUWhxgzX9UQ5AAAAJE"]
[Fri May 08 17:46:10.286260 2026] [proxy_fcgi:error] [pid 51009:tid 51093] [client 103.166.103.129:52327] AH01071: Got error 'Primary script unknown'
[Fri May 08 17:53:57.640025 2026] [:error] [pid 61317:tid 61326] [client 95.91.110.210:49716] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "af2ytc-fFk_CedOCOYupYwAAAUY"]
[Fri May 08 17:53:59.185697 2026] [:error] [pid 51113:tid 51117] [client 95.91.110.210:24910] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "af2yt0Qfs7sWtqkpQIdn7gAAAMI"]
[Fri May 08 17:54:01.625019 2026] [:error] [pid 51113:tid 51118] [client 95.91.110.210:34818] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "af2yuUQfs7sWtqkpQIdn7wAAAMM"]
[Fri May 08 17:54:03.538701 2026] [:error] [pid 61356:tid 61411] [client 95.91.110.210:21188] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "af2yu4x3vpB8oWhUq2NjQwAAAdc"]
[Fri May 08 17:54:06.302000 2026] [:error] [pid 61356:tid 61398] [client 95.91.110.210:63266] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "af2yvox3vpB8oWhUq2NjRwAAAco"]
[Fri May 08 17:54:10.303884 2026] [:error] [pid 61355:tid 61369] [client 95.91.110.210:18718] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "af2ywvkhJTi30CBXmMl_yAAAAYg"]
[Fri May 08 17:54:17.196561 2026] [:error] [pid 51009:tid 51092] [client 95.91.110.210:30084] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "af2yyeB0GbUWhxgzX9US9gAAAJA"]
[Fri May 08 17:54:19.637830 2026] [:error] [pid 61356:tid 61394] [client 95.91.110.210:30086] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "af2yy4x3vpB8oWhUq2NjZwAAAcY"]
[Fri May 08 17:54:21.985321 2026] [:error] [pid 51113:tid 51115] [client 95.91.110.210:30102] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "af2yzUQfs7sWtqkpQIdn9AAAAMA"]
[Fri May 08 17:54:24.491210 2026] [:error] [pid 61356:tid 61394] [client 95.91.110.210:30114] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "af2y0Ix3vpB8oWhUq2NjdAAAAcY"]
[Fri May 08 17:54:26.893977 2026] [:error] [pid 34318:tid 34320] [client 95.91.110.210:13734] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "af2y0sr3guirgJiKhzDHmQAAAQA"]
[Fri May 08 17:54:28.846294 2026] [:error] [pid 34318:tid 34331] [client 95.91.110.210:37104] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "af2y1Mr3guirgJiKhzDHmwAAAQs"]
[Fri May 08 17:54:31.368293 2026] [:error] [pid 34318:tid 34344] [client 95.91.110.210:13744] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "af2y18r3guirgJiKhzDHnwAAARg"]
[Fri May 08 17:54:33.276545 2026] [:error] [pid 51007:tid 51032] [client 95.91.110.210:37108] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "af2y2VMagSGstWKyzzXWEwAAAAo"]
[Fri May 08 17:54:35.751849 2026] [:error] [pid 51113:tid 51131] [client 95.91.110.210:13352] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "af2y20Qfs7sWtqkpQIdn-AAAANA"]
[Fri May 08 17:54:37.646653 2026] [:error] [pid 34318:tid 34337] [client 95.91.110.210:24274] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "af2y3cr3guirgJiKhzDHpQAAARE"]
[Fri May 08 17:54:40.160481 2026] [:error] [pid 61356:tid 61391] [client 95.91.110.210:13356] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "af2y4Ix3vpB8oWhUq2NjggAAAcM"]
[Fri May 08 17:54:42.074341 2026] [:error] [pid 34318:tid 34327] [client 95.91.110.210:24288] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "af2y4sr3guirgJiKhzDHqgAAAQc"]
[Fri May 08 17:54:44.543988 2026] [:error] [pid 51009:tid 51100] [client 95.91.110.210:13364] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "af2y5OB0GbUWhxgzX9UTEAAAAJg"]
[Fri May 08 17:54:47.056594 2026] [:error] [pid 61317:tid 61343] [client 95.91.110.210:20598] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "af2y58-fFk_CedOCOYupdAAAAVc"]
[Fri May 08 17:54:49.495034 2026] [:error] [pid 51009:tid 51088] [client 95.91.110.210:20614] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "af2y6eB0GbUWhxgzX9UTGQAAAIw"]
[Fri May 08 17:54:52.000497 2026] [:error] [pid 61356:tid 61393] [client 95.91.110.210:20620] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "af2y64x3vpB8oWhUq2NjiAAAAcU"]
[Fri May 08 17:54:54.443620 2026] [:error] [pid 61355:tid 61361] [client 95.91.110.210:20624] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "af2y7vkhJTi30CBXmMl_4QAAAYA"]
[Fri May 08 17:55:15.966499 2026] [:error] [pid 61355:tid 61367] [client 95.91.110.210:30882] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af2zA_khJTi30CBXmMmAFwAAAYY"]
[Fri May 08 17:55:28.138165 2026] [:error] [pid 61355:tid 61378] [client 95.91.110.210:15772] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af2zEPkhJTi30CBXmMmAMQAAAZE"]
[Fri May 08 17:55:30.120107 2026] [:error] [pid 61355:tid 61362] [client 95.91.110.210:8572] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "af2zEvkhJTi30CBXmMmANgAAAYE"]
[Fri May 08 17:55:32.586011 2026] [:error] [pid 51009:tid 51087] [client 95.91.110.210:12068] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "af2zFOB0GbUWhxgzX9UTPgAAAIs"]
[Fri May 08 17:55:35.010789 2026] [:error] [pid 51008:tid 51071] [client 95.91.110.210:12072] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af2zF3B58C2Y1tgLtuKGLwAAAFY"]
[Fri May 08 17:55:37.510887 2026] [:error] [pid 51009:tid 51099] [client 95.91.110.210:16348] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "af2zGeB0GbUWhxgzX9UTSAAAAJc"]
[Fri May 08 17:55:39.922684 2026] [:error] [pid 51009:tid 51096] [client 95.91.110.210:16358] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "af2zG-B0GbUWhxgzX9UTTwAAAJQ"]
[Fri May 08 17:55:42.340848 2026] [:error] [pid 51009:tid 51087] [client 95.91.110.210:16362] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af2zHuB0GbUWhxgzX9UTWAAAAIs"]
[Fri May 08 17:55:44.309864 2026] [:error] [pid 51113:tid 51132] [client 95.91.110.210:58158] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "af2zIEQfs7sWtqkpQIdoCQAAANE"]
[Fri May 08 17:55:46.271980 2026] [:error] [pid 61356:tid 61410] [client 95.91.110.210:11192] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af2zIox3vpB8oWhUq2Nj4AAAAdY"]
[Fri May 08 17:55:48.244134 2026] [:error] [pid 61355:tid 61378] [client 95.91.110.210:11204] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "af2zJPkhJTi30CBXmMmARwAAAZE"]
[Fri May 08 17:55:50.249677 2026] [:error] [pid 51008:tid 51052] [client 95.91.110.210:11212] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "af2zJnB58C2Y1tgLtuKGOgAAAEM"]
[Fri May 08 17:55:52.108316 2026] [:error] [pid 61355:tid 61372] [client 95.91.110.210:11226] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "af2zKPkhJTi30CBXmMmATgAAAYs"]
[Fri May 08 17:55:53.985710 2026] [:error] [pid 61355:tid 61371] [client 95.91.110.210:11232] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "af2zKfkhJTi30CBXmMmAWQAAAYo"]
[Fri May 08 17:55:55.945855 2026] [:error] [pid 61355:tid 61365] [client 95.91.110.210:34918] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "af2zK_khJTi30CBXmMmAYgAAAYQ"]
[Fri May 08 17:55:58.419555 2026] [:error] [pid 51009:tid 51084] [client 95.91.110.210:42002] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "af2zLuB0GbUWhxgzX9UTcQAAAIg"]
[Fri May 08 17:56:00.714417 2026] [:error] [pid 61355:tid 61365] [client 95.91.110.210:42014] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "af2zMPkhJTi30CBXmMmAmwAAAYQ"]
[Fri May 08 17:56:03.090217 2026] [:error] [pid 34318:tid 34331] [client 95.91.110.210:42022] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af2zM8r3guirgJiKhzDHwwAAAQs"]
[Fri May 08 17:56:05.500425 2026] [:error] [pid 51008:tid 51067] [client 95.91.110.210:42036] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "af2zNXB58C2Y1tgLtuKGSgAAAFI"]
[Fri May 08 17:56:07.418311 2026] [:error] [pid 51008:tid 51049] [client 95.91.110.210:24076] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "af2zN3B58C2Y1tgLtuKGSwAAAEA"]
[Fri May 08 17:56:09.894452 2026] [:error] [pid 61317:tid 61334] [client 95.91.110.210:56640] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af2zOc-fFk_CedOCOYupvAAAAU4"]
[Fri May 08 17:56:11.858004 2026] [:error] [pid 61356:tid 61412] [client 95.91.110.210:24080] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "af2zO4x3vpB8oWhUq2NkDAAAAdg"]
[Fri May 08 17:56:47.349657 2026] [:error] [pid 61356:tid 61388] [client 95.91.110.210:64564] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af2zX4x3vpB8oWhUq2NkPwAAAcA"]
[Fri May 08 17:56:48.897202 2026] [:error] [pid 61356:tid 61410] [client 95.91.110.210:42868] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "af2zYIx3vpB8oWhUq2NkQQAAAdY"]
[Fri May 08 17:56:51.400606 2026] [:error] [pid 51113:tid 51119] [client 95.91.110.210:4854] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "af2zY0Qfs7sWtqkpQIdoGgAAAMQ"]
[Fri May 08 17:56:53.382060 2026] [:error] [pid 61355:tid 61380] [client 95.91.110.210:65406] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "af2zZfkhJTi30CBXmMmA0AAAAZM"]
[Fri May 08 17:56:56.002736 2026] [:error] [pid 61355:tid 61377] [client 95.91.110.210:53626] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "af2zaPkhJTi30CBXmMmA1gAAAZA"]
[Fri May 08 17:56:58.424603 2026] [:error] [pid 51009:tid 51084] [client 95.91.110.210:53640] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af2zauB0GbUWhxgzX9UTuAAAAIg"]
[Fri May 08 17:57:00.959388 2026] [:error] [pid 51008:tid 51062] [client 95.91.110.210:53642] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "af2zbHB58C2Y1tgLtuKGbQAAAE0"]
[Fri May 08 17:57:03.607540 2026] [:error] [pid 51009:tid 51093] [client 95.91.110.210:53652] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "af2zb-B0GbUWhxgzX9UTvgAAAJE"]
[Fri May 08 17:57:05.443571 2026] [:error] [pid 61317:tid 61329] [client 95.91.110.210:46406] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "af2zcc-fFk_CedOCOYup4gAAAUk"]
[Fri May 08 17:57:07.825531 2026] [:error] [pid 51113:tid 51133] [client 95.91.110.210:57158] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "af2zc0Qfs7sWtqkpQIdoLQAAANI"]
[Fri May 08 17:57:10.336260 2026] [:error] [pid 61355:tid 61382] [client 95.91.110.210:57168] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af2zdvkhJTi30CBXmMmA4AAAAZU"]
[Fri May 08 17:57:12.224559 2026] [:error] [pid 61317:tid 61327] [client 95.91.110.210:46408] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "af2zeM-fFk_CedOCOYup6gAAAUc"]
[Fri May 08 17:57:14.801643 2026] [:error] [pid 61356:tid 61397] [client 95.91.110.210:57172] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "af2zeox3vpB8oWhUq2NkUwAAAck"]
[Fri May 08 17:57:16.715567 2026] [:error] [pid 61355:tid 61384] [client 95.91.110.210:39352] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "af2zfPkhJTi30CBXmMmA6QAAAZc"]
[Fri May 08 17:57:19.161882 2026] [:error] [pid 61356:tid 61406] [client 95.91.110.210:32448] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "af2zf4x3vpB8oWhUq2NkWwAAAdI"]
[Fri May 08 17:57:21.513653 2026] [:error] [pid 61355:tid 61381] [client 95.91.110.210:32450] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af2zgfkhJTi30CBXmMmA9QAAAZQ"]
[Fri May 08 17:57:23.373552 2026] [:error] [pid 51009:tid 51084] [client 95.91.110.210:39368] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "af2zg-B0GbUWhxgzX9UTxwAAAIg"]
[Fri May 08 17:57:25.770796 2026] [:error] [pid 61356:tid 61393] [client 95.91.110.210:20190] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "af2zhYx3vpB8oWhUq2NkaQAAAcU"]
[Fri May 08 17:57:27.793316 2026] [:error] [pid 51008:tid 51057] [client 95.91.110.210:34216] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "af2zh3B58C2Y1tgLtuKGcgAAAEg"]
[Fri May 08 17:57:29.709961 2026] [:error] [pid 61355:tid 61382] [client 95.91.110.210:34226] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "af2zifkhJTi30CBXmMmA_wAAAZU"]
[Fri May 08 17:57:32.398744 2026] [:error] [pid 61356:tid 61390] [client 95.91.110.210:20194] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "af2zjIx3vpB8oWhUq2NkcwAAAcI"]
[Fri May 08 17:57:34.262889 2026] [:error] [pid 61355:tid 61371] [client 95.91.110.210:34240] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "af2zjvkhJTi30CBXmMmBDwAAAYo"]
[Fri May 08 17:57:36.738941 2026] [:error] [pid 61355:tid 61364] [client 95.91.110.210:33354] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "af2zkPkhJTi30CBXmMmBGQAAAYM"]
[Fri May 08 17:57:38.621092 2026] [:error] [pid 61317:tid 61332] [client 95.91.110.210:24236] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "af2zks-fFk_CedOCOYup-wAAAUw"]
[Fri May 08 17:58:11.898381 2026] [:error] [pid 34318:tid 34342] [client 95.91.110.210:33366] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "af2zs8r3guirgJiKhzDIBAAAARY"]
[Fri May 08 17:58:14.446087 2026] [:error] [pid 51007:tid 51022] [client 95.91.110.210:6014] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "af2ztlMagSGstWKyzzXWbAAAAAA"]
[Fri May 08 17:58:16.934493 2026] [:error] [pid 51007:tid 51042] [client 95.91.110.210:36854] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af2zuFMagSGstWKyzzXWbwAAABQ"]
[Fri May 08 17:58:19.469148 2026] [:error] [pid 51008:tid 51064] [client 95.91.110.210:36864] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af2zu3B58C2Y1tgLtuKGqQAAAE8"]
[Fri May 08 17:58:21.860401 2026] [:error] [pid 61317:tid 61328] [client 95.91.110.210:36876] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af2zvc-fFk_CedOCOYuqIwAAAUg"]
[Fri May 08 17:58:24.205305 2026] [:error] [pid 61317:tid 61340] [client 95.91.110.210:36892] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "af2zwM-fFk_CedOCOYuqJgAAAVQ"]
[Fri May 08 17:58:26.727016 2026] [:error] [pid 61355:tid 61365] [client 95.91.110.210:49394] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "af2zwvkhJTi30CBXmMmBRQAAAYQ"]
[Fri May 08 17:58:28.075252 2026] [:error] [pid 51007:tid 51038] [client 95.91.110.210:12960] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "af2zxFMagSGstWKyzzXWdQAAABA"]
[Fri May 08 17:58:31.896816 2026] [:error] [pid 51007:tid 51025] [client 95.91.110.210:12970] [client 95.91.110.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "af2zx1MagSGstWKyzzXWeAAAAAM"]
[Fri May 08 21:12:28.166094 2026] [proxy_fcgi:error] [pid 61355:tid 61371] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:28.387369 2026] [proxy_fcgi:error] [pid 61355:tid 61376] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:28.615940 2026] [proxy_fcgi:error] [pid 61355:tid 61364] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:28.808315 2026] [proxy_fcgi:error] [pid 61355:tid 61385] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:29.000064 2026] [proxy_fcgi:error] [pid 61355:tid 61363] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:29.192494 2026] [proxy_fcgi:error] [pid 61355:tid 61380] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:29.386064 2026] [proxy_fcgi:error] [pid 61355:tid 61379] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:29.620539 2026] [proxy_fcgi:error] [pid 61355:tid 61372] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:29.813462 2026] [proxy_fcgi:error] [pid 61355:tid 61384] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:30.267910 2026] [proxy_fcgi:error] [pid 61355:tid 61365] [client 20.12.217.215:42818] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:12:30.461995 2026] [:error] [pid 61355:tid 61371] [client 20.12.217.215:42818] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "af3hPvkhJTi30CBXmMm-bQAAAYo"]
[Fri May 08 21:12:30.988223 2026] [:error] [pid 61355:tid 61376] [client 20.12.217.215:42930] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "af3hPvkhJTi30CBXmMm-bwAAAY8"]
[Fri May 08 21:12:31.570025 2026] [:error] [pid 51007:tid 51026] [client 20.12.217.215:42846] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "af3hP1MagSGstWKyzzXzbQAAAAQ"]
[Fri May 08 21:12:32.740465 2026] [:error] [pid 51113:tid 51127] [client 20.12.217.215:42842] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "af3hQEQfs7sWtqkpQId-aQAAAMw"]
[Fri May 08 21:12:34.130768 2026] [:error] [pid 61355:tid 61376] [client 20.12.217.215:42904] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "af3hQvkhJTi30CBXmMm-eAAAAY8"]
[Fri May 08 21:12:34.809703 2026] [:error] [pid 51008:tid 51066] [client 20.12.217.215:42888] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "af3hQnB58C2Y1tgLtuKpqgAAAFE"]
[Fri May 08 21:12:35.883995 2026] [:error] [pid 51008:tid 51061] [client 20.12.217.215:42829] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "af3hQ3B58C2Y1tgLtuKprQAAAEw"]
[Fri May 08 21:12:36.600410 2026] [:error] [pid 61317:tid 61331] [client 20.12.217.215:42837] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbhu.php"] [unique_id "af3hRM-fFk_CedOCOYvQ1AAAAUs"]
[Fri May 08 21:12:37.276433 2026] [:error] [pid 61317:tid 61333] [client 20.12.217.215:42887] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "af3hRc-fFk_CedOCOYvQ2AAAAU0"]
[Fri May 08 21:12:37.712204 2026] [:error] [pid 61317:tid 61334] [client 20.12.217.215:42827] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "af3hRc-fFk_CedOCOYvQ2gAAAU4"]
[Fri May 08 21:12:39.250216 2026] [:error] [pid 51113:tid 51121] [client 20.12.217.215:42881] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "af3hR0Qfs7sWtqkpQId-cwAAAMY"]
[Fri May 08 21:12:39.803972 2026] [:error] [pid 51007:tid 51041] [client 20.12.217.215:42847] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "af3hR1MagSGstWKyzzXzdAAAABM"]
[Fri May 08 21:12:40.426475 2026] [:error] [pid 61355:tid 61382] [client 20.12.217.215:42863] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "af3hSPkhJTi30CBXmMm-fQAAAZU"]
[Fri May 08 21:12:40.975838 2026] [:error] [pid 51008:tid 51050] [client 20.12.217.215:42916] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "af3hSHB58C2Y1tgLtuKpsAAAAEE"]
[Fri May 08 21:12:41.846388 2026] [:error] [pid 61355:tid 61375] [client 20.12.217.215:42879] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "af3hSfkhJTi30CBXmMm-gAAAAY4"]
[Fri May 08 21:12:42.396879 2026] [:error] [pid 34318:tid 34344] [client 20.12.217.215:42926] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "af3hSsr3guirgJiKhzDf8gAAARg"]
[Fri May 08 21:12:43.299022 2026] [:error] [pid 51007:tid 51046] [client 20.12.217.215:42835] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "af3hS1MagSGstWKyzzXzegAAABg"]
[Fri May 08 21:12:44.741487 2026] [:error] [pid 61356:tid 61412] [client 20.12.217.215:42884] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "af3hTIx3vpB8oWhUq2O-owAAAdg"]
[Fri May 08 21:12:45.238928 2026] [:error] [pid 51008:tid 51056] [client 20.12.217.215:42874] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "af3hTXB58C2Y1tgLtuKptAAAAEc"]
[Fri May 08 21:12:46.042636 2026] [:error] [pid 51007:tid 51029] [client 20.12.217.215:42831] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "af3hTlMagSGstWKyzzXzgAAAAAc"]
[Fri May 08 21:12:46.993436 2026] [:error] [pid 61355:tid 61370] [client 20.12.217.215:42942] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "af3hTvkhJTi30CBXmMm-jQAAAYk"]
[Fri May 08 21:12:47.999859 2026] [:error] [pid 61356:tid 61404] [client 20.12.217.215:23521] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "af3hT4x3vpB8oWhUq2O-pgAAAdA"]
[Fri May 08 21:12:49.768533 2026] [:error] [pid 61356:tid 61400] [client 20.12.217.215:23509] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "af3hUYx3vpB8oWhUq2O-qwAAAcw"]
[Fri May 08 21:12:50.475811 2026] [:error] [pid 34318:tid 34332] [client 20.12.217.215:42936] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "af3hUsr3guirgJiKhzDf8wAAAQw"]
[Fri May 08 21:12:51.856577 2026] [:error] [pid 51008:tid 51070] [client 20.12.217.215:42883] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "af3hU3B58C2Y1tgLtuKpvwAAAFU"]
[Fri May 08 21:12:52.531658 2026] [:error] [pid 61356:tid 61397] [client 20.12.217.215:42880] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "af3hVIx3vpB8oWhUq2O-rwAAAck"]
[Fri May 08 21:12:53.157600 2026] [:error] [pid 34318:tid 34325] [client 20.12.217.215:42857] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "af3hVcr3guirgJiKhzDf9QAAAQU"]
[Fri May 08 21:12:54.201915 2026] [:error] [pid 61356:tid 61411] [client 20.12.217.215:42918] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "af3hVox3vpB8oWhUq2O-uQAAAdc"]
[Fri May 08 21:12:55.668123 2026] [:error] [pid 61356:tid 61399] [client 20.12.217.215:42822] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "af3hV4x3vpB8oWhUq2O-vwAAAcs"]
[Fri May 08 21:12:57.061512 2026] [:error] [pid 51007:tid 51036] [client 20.12.217.215:42899] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "af3hWVMagSGstWKyzzXziAAAAA4"]
[Fri May 08 21:12:57.837529 2026] [:error] [pid 51007:tid 51039] [client 20.12.217.215:42909] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "af3hWVMagSGstWKyzzXziQAAABE"]
[Fri May 08 21:12:58.835649 2026] [:error] [pid 61355:tid 61375] [client 20.12.217.215:42841] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "af3hWvkhJTi30CBXmMm-ogAAAY4"]
[Fri May 08 21:12:59.674347 2026] [:error] [pid 61317:tid 61325] [client 20.12.217.215:42922] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "af3hW8-fFk_CedOCOYvQ5wAAAUU"]
[Fri May 08 21:13:00.481746 2026] [:error] [pid 51009:tid 51100] [client 20.12.217.215:42937] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "af3hXOB0GbUWhxgzX9VKHQAAAJg"]
[Fri May 08 21:13:01.210548 2026] [:error] [pid 51009:tid 51082] [client 20.12.217.215:42895] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "af3hXeB0GbUWhxgzX9VKIQAAAIY"]
[Fri May 08 21:13:01.994191 2026] [:error] [pid 34318:tid 34329] [client 20.12.217.215:42914] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "af3hXcr3guirgJiKhzDf_QAAAQk"]
[Fri May 08 21:13:02.662843 2026] [:error] [pid 51009:tid 51087] [client 20.12.217.215:42860] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "af3hXuB0GbUWhxgzX9VKJAAAAIs"]
[Fri May 08 21:13:03.109183 2026] [:error] [pid 51007:tid 51045] [client 20.12.217.215:42894] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "af3hX1MagSGstWKyzzXzkAAAABc"]
[Fri May 08 21:13:04.477900 2026] [:error] [pid 51008:tid 51054] [client 20.12.217.215:42920] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "af3hYHB58C2Y1tgLtuKp1wAAAEU"]
[Fri May 08 21:13:05.436200 2026] [:error] [pid 34318:tid 34328] [client 20.12.217.215:42840] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "af3hYcr3guirgJiKhzDgBAAAAQg"]
[Fri May 08 21:13:06.404723 2026] [:error] [pid 61355:tid 61378] [client 20.12.217.215:42886] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "af3hYvkhJTi30CBXmMm-sQAAAZE"]
[Fri May 08 21:13:07.124197 2026] [:error] [pid 61356:tid 61407] [client 20.12.217.215:42832] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "af3hY4x3vpB8oWhUq2O-zAAAAdM"]
[Fri May 08 21:13:07.763578 2026] [:error] [pid 51009:tid 51085] [client 20.12.217.215:42823] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "af3hY-B0GbUWhxgzX9VKKAAAAIk"]
[Fri May 08 21:13:08.311470 2026] [:error] [pid 51007:tid 51036] [client 20.12.217.215:42889] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "af3hZFMagSGstWKyzzXzkwAAAA4"]
[Fri May 08 21:13:09.099859 2026] [:error] [pid 61356:tid 61389] [client 20.12.217.215:42915] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "af3hZYx3vpB8oWhUq2O-zwAAAcE"]
[Fri May 08 21:13:09.763160 2026] [:error] [pid 61356:tid 61408] [client 20.12.217.215:42907] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "af3hZYx3vpB8oWhUq2O-0gAAAdQ"]
[Fri May 08 21:13:10.367827 2026] [:error] [pid 61356:tid 61400] [client 20.12.217.215:42935] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "af3hZox3vpB8oWhUq2O-1AAAAcw"]
[Fri May 08 21:13:11.132065 2026] [:error] [pid 51008:tid 51055] [client 20.12.217.215:42912] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "af3hZ3B58C2Y1tgLtuKp5wAAAEY"]
[Fri May 08 21:13:11.741530 2026] [:error] [pid 61317:tid 61339] [client 20.12.217.215:23495] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "af3hZ8-fFk_CedOCOYvQ6QAAAVM"]
[Fri May 08 21:13:12.195696 2026] [:error] [pid 51009:tid 51079] [client 20.12.217.215:42885] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "af3haOB0GbUWhxgzX9VKKgAAAIM"]
[Fri May 08 21:13:12.792513 2026] [:error] [pid 61356:tid 61411] [client 20.12.217.215:42851] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "af3haIx3vpB8oWhUq2O-2AAAAdc"]
[Fri May 08 21:13:13.412303 2026] [:error] [pid 51009:tid 51095] [client 20.12.217.215:42856] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "af3haeB0GbUWhxgzX9VKLAAAAJM"]
[Fri May 08 21:13:13.939483 2026] [:error] [pid 61355:tid 61381] [client 20.12.217.215:42925] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "af3hafkhJTi30CBXmMm-vwAAAZQ"]
[Fri May 08 21:13:14.555185 2026] [:error] [pid 61355:tid 61364] [client 20.12.217.215:42905] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "af3havkhJTi30CBXmMm-wwAAAYM"]
[Fri May 08 21:13:15.539344 2026] [:error] [pid 61355:tid 61384] [client 20.12.217.215:42821] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "af3ha_khJTi30CBXmMm-xgAAAZc"]
[Fri May 08 21:13:16.137751 2026] [:error] [pid 51009:tid 51082] [client 20.12.217.215:42833] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "af3hbOB0GbUWhxgzX9VKMAAAAIY"]
[Fri May 08 21:13:16.748316 2026] [:error] [pid 61355:tid 61373] [client 20.12.217.215:42826] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "af3hbPkhJTi30CBXmMm-yAAAAYw"]
[Fri May 08 21:13:17.534560 2026] [:error] [pid 61355:tid 61378] [client 20.12.217.215:42858] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "af3hbfkhJTi30CBXmMm-zAAAAZE"]
[Fri May 08 21:13:18.150831 2026] [:error] [pid 61317:tid 61341] [client 20.12.217.215:42864] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "af3hbs-fFk_CedOCOYvQ7wAAAVU"]
[Fri May 08 21:13:18.932998 2026] [:error] [pid 61317:tid 61331] [client 20.12.217.215:23507] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "af3hbs-fFk_CedOCOYvQ8wAAAUs"]
[Fri May 08 21:13:20.083746 2026] [:error] [pid 61355:tid 61385] [client 20.12.217.215:42869] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "af3hcPkhJTi30CBXmMm-zwAAAZg"]
[Fri May 08 21:13:20.776750 2026] [:error] [pid 51007:tid 51026] [client 20.12.217.215:23525] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "af3hcFMagSGstWKyzzXzlwAAAAQ"]
[Fri May 08 21:13:21.314578 2026] [:error] [pid 51008:tid 51049] [client 20.12.217.215:23456] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "af3hcXB58C2Y1tgLtuKp_AAAAEA"]
[Fri May 08 21:13:21.845162 2026] [:error] [pid 51007:tid 51043] [client 20.12.217.215:42893] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "af3hcVMagSGstWKyzzXzmQAAABU"]
[Fri May 08 21:13:22.646150 2026] [:error] [pid 61317:tid 61329] [client 20.12.217.215:42942] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "af3hcs-fFk_CedOCOYvQ-AAAAUk"]
[Fri May 08 21:13:23.299401 2026] [:error] [pid 61356:tid 61404] [client 20.12.217.215:42834] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "af3hc4x3vpB8oWhUq2O-3QAAAdA"]
[Fri May 08 21:13:23.804157 2026] [:error] [pid 61356:tid 61401] [client 20.12.217.215:42917] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "af3hc4x3vpB8oWhUq2O-3gAAAc0"]
[Fri May 08 21:13:24.464991 2026] [:error] [pid 51113:tid 51125] [client 20.12.217.215:42932] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "af3hdEQfs7sWtqkpQId-mgAAAMo"]
[Fri May 08 21:13:24.958289 2026] [:error] [pid 34318:tid 34321] [client 20.12.217.215:42896] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "af3hdMr3guirgJiKhzDgDwAAAQE"]
[Fri May 08 21:13:25.436001 2026] [:error] [pid 34318:tid 34340] [client 20.12.217.215:23530] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "af3hdcr3guirgJiKhzDgEAAAARQ"]
[Fri May 08 21:13:26.075966 2026] [:error] [pid 61356:tid 61390] [client 20.12.217.215:42820] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "af3hdox3vpB8oWhUq2O-4QAAAcI"]
[Fri May 08 21:13:26.595469 2026] [:error] [pid 61356:tid 61405] [client 20.12.217.215:42839] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "af3hdox3vpB8oWhUq2O-4wAAAdE"]
[Fri May 08 21:13:27.100283 2026] [:error] [pid 51007:tid 51039] [client 20.12.217.215:42836] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "af3hd1MagSGstWKyzzXznwAAABE"]
[Fri May 08 21:13:27.791320 2026] [:error] [pid 61356:tid 61397] [client 20.12.217.215:42819] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "af3hd4x3vpB8oWhUq2O-6QAAAck"]
[Fri May 08 21:13:28.548295 2026] [:error] [pid 51008:tid 51052] [client 20.12.217.215:23491] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "af3heHB58C2Y1tgLtuKqEwAAAEM"]
[Fri May 08 21:13:29.126944 2026] [:error] [pid 51008:tid 51062] [client 20.12.217.215:42938] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "af3heXB58C2Y1tgLtuKqFQAAAE0"]
[Fri May 08 21:13:29.777682 2026] [:error] [pid 61317:tid 61323] [client 20.12.217.215:42877] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "af3hec-fFk_CedOCOYvRBQAAAUM"]
[Fri May 08 21:13:30.264418 2026] [proxy_fcgi:error] [pid 61317:tid 61321] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:30.471683 2026] [proxy_fcgi:error] [pid 61317:tid 61320] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:30.715306 2026] [proxy_fcgi:error] [pid 61317:tid 61328] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:31.147885 2026] [proxy_fcgi:error] [pid 61317:tid 61332] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:31.548411 2026] [proxy_fcgi:error] [pid 61317:tid 61324] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:31.740817 2026] [proxy_fcgi:error] [pid 61317:tid 61338] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:31.941473 2026] [proxy_fcgi:error] [pid 61317:tid 61333] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:32.139167 2026] [proxy_fcgi:error] [pid 61317:tid 61326] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:32.330933 2026] [proxy_fcgi:error] [pid 61317:tid 61337] [client 20.12.217.215:42910] AH01071: Got error 'Primary script unknown'
[Fri May 08 21:13:32.529134 2026] [:error] [pid 61317:tid 61334] [client 20.12.217.215:42910] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "af3hfM-fFk_CedOCOYvREwAAAU4"]
[Fri May 08 21:13:33.388222 2026] [:error] [pid 51007:tid 51022] [client 20.12.217.215:23506] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "af3hfVMagSGstWKyzzXzogAAAAA"]
[Fri May 08 21:13:34.300901 2026] [:error] [pid 51007:tid 51044] [client 20.12.217.215:42844] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "af3hflMagSGstWKyzzXzpQAAABY"]
[Fri May 08 21:13:35.439803 2026] [:error] [pid 51009:tid 51093] [client 20.12.217.215:42933] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "af3hf-B0GbUWhxgzX9VKOgAAAJE"]
[Fri May 08 21:13:35.961660 2026] [:error] [pid 61317:tid 61344] [client 20.12.217.215:42862] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "af3hf8-fFk_CedOCOYvRFwAAAVg"]
[Fri May 08 21:13:36.443555 2026] [:error] [pid 61317:tid 61338] [client 20.12.217.215:23501] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "af3hgM-fFk_CedOCOYvRGAAAAVI"]
[Fri May 08 21:13:37.477752 2026] [:error] [pid 51007:tid 51038] [client 20.12.217.215:42927] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "af3hgVMagSGstWKyzzXzqAAAABA"]
[Fri May 08 21:13:38.232136 2026] [:error] [pid 51113:tid 51129] [client 20.12.217.215:42934] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "af3hgkQfs7sWtqkpQId-oAAAAM4"]
[Fri May 08 21:13:38.985600 2026] [:error] [pid 61317:tid 61321] [client 20.12.217.215:42928] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "af3hgs-fFk_CedOCOYvRHAAAAUE"]
[Fri May 08 21:13:39.778867 2026] [:error] [pid 51009:tid 51091] [client 20.12.217.215:42875] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "af3hg-B0GbUWhxgzX9VKQwAAAI8"]
[Fri May 08 21:13:40.458182 2026] [:error] [pid 34318:tid 34333] [client 20.12.217.215:23510] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "af3hhMr3guirgJiKhzDgFwAAAQ0"]
[Fri May 08 21:13:41.270121 2026] [:error] [pid 61355:tid 61378] [client 20.12.217.215:42939] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "af3hhfkhJTi30CBXmMm-2wAAAZE"]
[Fri May 08 21:13:42.310607 2026] [:error] [pid 61356:tid 61404] [client 20.12.217.215:42901] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "af3hhox3vpB8oWhUq2O-8wAAAdA"]
[Fri May 08 21:13:42.935033 2026] [:error] [pid 51007:tid 51027] [client 20.12.217.215:42816] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "af3hhlMagSGstWKyzzXzsgAAAAU"]
[Fri May 08 21:13:43.580499 2026] [:error] [pid 61356:tid 61411] [client 20.12.217.215:23535] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "af3hh4x3vpB8oWhUq2O-9gAAAdc"]
[Fri May 08 21:13:44.291651 2026] [:error] [pid 34318:tid 34328] [client 20.12.217.215:23469] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "af3hiMr3guirgJiKhzDgGwAAAQg"]
[Fri May 08 21:13:44.755132 2026] [:error] [pid 34318:tid 34335] [client 20.12.217.215:42913] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "af3hiMr3guirgJiKhzDgHQAAAQ8"]
[Fri May 08 21:13:45.267666 2026] [:error] [pid 61356:tid 61393] [client 20.12.217.215:42824] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "af3hiYx3vpB8oWhUq2O--AAAAcU"]
[Fri May 08 21:13:46.122413 2026] [:error] [pid 61317:tid 61325] [client 20.12.217.215:23527] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "af3his-fFk_CedOCOYvRMAAAAUU"]
[Fri May 08 21:13:46.696060 2026] [:error] [pid 51008:tid 51071] [client 20.12.217.215:42838] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "af3hinB58C2Y1tgLtuKqOgAAAFY"]
[Fri May 08 21:13:47.181764 2026] [:error] [pid 61317:tid 61320] [client 20.12.217.215:42861] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "af3hi8-fFk_CedOCOYvRMQAAAUA"]
[Fri May 08 21:13:47.861318 2026] [:error] [pid 61356:tid 61406] [client 20.12.217.215:42850] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "af3hi4x3vpB8oWhUq2O_AQAAAdI"]
[Fri May 08 21:13:49.498805 2026] [:error] [pid 51009:tid 51077] [client 20.12.217.215:42919] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "af3hjeB0GbUWhxgzX9VKSgAAAIE"]
[Fri May 08 21:13:50.462930 2026] [:error] [pid 61356:tid 61395] [client 20.12.217.215:42845] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "af3hjox3vpB8oWhUq2O_BgAAAcc"]
[Fri May 08 21:13:51.150465 2026] [:error] [pid 51007:tid 51039] [client 20.12.217.215:42931] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "af3hj1MagSGstWKyzzXztAAAABE"]
[Fri May 08 21:13:51.828032 2026] [:error] [pid 61317:tid 61327] [client 20.12.217.215:23522] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "af3hj8-fFk_CedOCOYvRNwAAAUc"]
[Fri May 08 21:13:52.636848 2026] [:error] [pid 51008:tid 51056] [client 20.12.217.215:23523] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "af3hkHB58C2Y1tgLtuKqPgAAAEc"]
[Fri May 08 21:13:53.420733 2026] [:error] [pid 51113:tid 51131] [client 20.12.217.215:23515] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "af3hkUQfs7sWtqkpQId-pAAAANA"]
[Fri May 08 21:13:54.458540 2026] [:error] [pid 61355:tid 61374] [client 20.12.217.215:42817] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "af3hkvkhJTi30CBXmMm-4QAAAY0"]
[Fri May 08 21:13:54.975724 2026] [:error] [pid 61355:tid 61373] [client 20.12.217.215:23493] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "af3hkvkhJTi30CBXmMm-4wAAAYw"]
[Fri May 08 21:13:55.870965 2026] [:error] [pid 61317:tid 61342] [client 20.12.217.215:42902] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "af3hk8-fFk_CedOCOYvROgAAAVY"]
[Fri May 08 21:13:57.249018 2026] [:error] [pid 61355:tid 61368] [client 20.12.217.215:23528] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/z.php"] [unique_id "af3hlfkhJTi30CBXmMm-5QAAAYc"]
[Fri May 08 21:13:57.907041 2026] [:error] [pid 51007:tid 51037] [client 20.12.217.215:23504] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "af3hlVMagSGstWKyzzXzuQAAAA8"]
[Fri May 08 21:13:58.657866 2026] [:error] [pid 61356:tid 61399] [client 20.12.217.215:23537] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "af3hlox3vpB8oWhUq2O_EgAAAcs"]
[Fri May 08 21:13:59.651176 2026] [:error] [pid 61356:tid 61411] [client 20.12.217.215:42882] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "af3hl4x3vpB8oWhUq2O_FwAAAdc"]
[Fri May 08 21:14:00.295432 2026] [:error] [pid 61356:tid 61393] [client 20.12.217.215:23360] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "af3hmIx3vpB8oWhUq2O_HAAAAcU"]
[Fri May 08 21:14:01.429279 2026] [:error] [pid 51113:tid 51134] [client 20.12.217.215:23496] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "af3hmUQfs7sWtqkpQId-qQAAANM"]
[Fri May 08 21:14:03.070928 2026] [:error] [pid 51007:tid 51041] [client 20.12.217.215:23543] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "af3hm1MagSGstWKyzzXzugAAABM"]
[Fri May 08 21:14:04.022976 2026] [:error] [pid 51007:tid 51043] [client 20.12.217.215:23433] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "af3hnFMagSGstWKyzzXzuwAAABU"]
[Fri May 08 21:14:05.172203 2026] [:error] [pid 61317:tid 61333] [client 20.12.217.215:42900] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ok.php"] [unique_id "af3hnc-fFk_CedOCOYvRRAAAAU0"]
[Fri May 08 21:14:06.206986 2026] [:error] [pid 51113:tid 51136] [client 20.12.217.215:23519] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "af3hnkQfs7sWtqkpQId-swAAANU"]
[Fri May 08 21:14:06.901591 2026] [:error] [pid 51007:tid 51029] [client 20.12.217.215:23533] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "af3hnlMagSGstWKyzzXzvgAAAAc"]
[Fri May 08 21:14:07.595789 2026] [:error] [pid 61356:tid 61400] [client 20.12.217.215:42871] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "af3hn4x3vpB8oWhUq2O_MwAAAcw"]
[Fri May 08 21:14:08.532524 2026] [:error] [pid 61317:tid 61332] [client 20.12.217.215:42898] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "af3hoM-fFk_CedOCOYvRSAAAAUw"]
[Fri May 08 21:14:09.457941 2026] [:error] [pid 34318:tid 34333] [client 20.12.217.215:42878] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "af3hocr3guirgJiKhzDgKQAAAQ0"]
[Fri May 08 21:14:10.105289 2026] [:error] [pid 51113:tid 51115] [client 20.12.217.215:42943] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "af3hokQfs7sWtqkpQId-xgAAAMA"]
[Fri May 08 21:14:10.910817 2026] [:error] [pid 61356:tid 61409] [client 20.12.217.215:23499] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "af3hoox3vpB8oWhUq2O_PwAAAdU"]
[Fri May 08 21:14:12.070954 2026] [:error] [pid 61356:tid 61391] [client 20.12.217.215:42830] [client 20.12.217.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "af3hpIx3vpB8oWhUq2O_RAAAAcM"]
[Fri May 08 21:40:46.924592 2026] [:error] [pid 51007:tid 51034] [client 154.251.255.234:63168] [client 154.251.255.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.251.255.234, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "af3n3lMagSGstWKyzzX3fAAAAAw"]
[Fri May 08 21:40:46.937785 2026] [proxy_fcgi:error] [pid 51007:tid 51034] [client 154.251.255.234:63168] AH01071: Got error 'Primary script unknown'
[Fri May 08 22:02:50.519719 2026] [:error] [pid 61355:tid 61371] [client 179.109.122.255:33545] [client 179.109.122.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.109.122.255, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "af3tCvkhJTi30CBXmMnMhgAAAYo"]
[Fri May 08 22:02:50.520102 2026] [:error] [pid 61317:tid 61329] [client 179.109.122.255:35067] [client 179.109.122.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.109.122.255, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "af3tCs-fFk_CedOCOYvaNQAAAUk"]
[Fri May 08 22:02:50.530811 2026] [proxy_fcgi:error] [pid 61355:tid 61371] [client 179.109.122.255:33545] AH01071: Got error 'Primary script unknown'
[Fri May 08 22:02:50.531371 2026] [proxy_fcgi:error] [pid 61317:tid 61329] [client 179.109.122.255:35067] AH01071: Got error 'Primary script unknown'
[Fri May 08 23:07:17.040911 2026] [:error] [pid 61355:tid 61369] [client 34.94.220.170:60546] [client 34.94.220.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "af38JfkhJTi30CBXmMnlTgAAAYg"]
[Fri May 08 23:11:23.358326 2026] [:error] [pid 51008:tid 51068] [client 119.28.89.249:59260] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af39G3B58C2Y1tgLtuK-LAAAAFM"]
[Sat May 09 01:47:51.574483 2026] [:error] [pid 51008:tid 51054] [client 51.83.101.126:56382] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "af4hx3B58C2Y1tgLtuLfOQAAAEU"]
[Sat May 09 01:47:52.428299 2026] [:error] [pid 61317:tid 61344] [client 51.83.101.126:56376] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "af4hyM-fFk_CedOCOYsRsgAAAVg"]
[Sat May 09 01:47:53.416840 2026] [:error] [pid 51007:tid 51024] [client 51.83.101.126:55772] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "af4hyVMagSGstWKyzzUegQAAAAI"]
[Sat May 09 01:47:54.276402 2026] [:error] [pid 61317:tid 61333] [client 51.83.101.126:55780] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "af4hys-fFk_CedOCOYsRvgAAAU0"]
[Sat May 09 01:47:55.469785 2026] [:error] [pid 61355:tid 61372] [client 51.83.101.126:55784] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "af4hy_khJTi30CBXmMlAYAAAAYs"]
[Sat May 09 01:47:56.325358 2026] [:error] [pid 51009:tid 51087] [client 51.83.101.126:37756] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "af4hzOB0GbUWhxgzX9WZ6wAAAIs"]
[Sat May 09 01:47:57.276336 2026] [:error] [pid 34318:tid 34342] [client 51.83.101.126:37760] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "af4hzcr3guirgJiKhzAHDAAAARY"]
[Sat May 09 01:47:58.255927 2026] [:error] [pid 61355:tid 61373] [client 51.83.101.126:37772] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "af4hzvkhJTi30CBXmMlAZwAAAYw"]
[Sat May 09 01:47:59.180584 2026] [:error] [pid 61356:tid 61402] [client 51.83.101.126:37780] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "af4hz4x3vpB8oWhUq2Mw9QAAAc4"]
[Sat May 09 01:48:00.155519 2026] [:error] [pid 61356:tid 61390] [client 51.83.101.126:37784] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af4h0Ix3vpB8oWhUq2Mw-AAAAcI"]
[Sat May 09 01:48:01.217439 2026] [:error] [pid 61356:tid 61396] [client 51.83.101.126:37788] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "af4h0Yx3vpB8oWhUq2Mw_AAAAcg"]
[Sat May 09 01:48:02.000034 2026] [:error] [pid 61356:tid 61399] [client 51.83.101.126:37800] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af4h0Yx3vpB8oWhUq2MxAQAAAcs"]
[Sat May 09 01:48:03.157331 2026] [:error] [pid 61355:tid 61381] [client 51.83.101.126:37806] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "af4h0_khJTi30CBXmMlAdgAAAZQ"]
[Sat May 09 01:48:04.105303 2026] [:error] [pid 51113:tid 51131] [client 51.83.101.126:37814] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af4h1EQfs7sWtqkpQIedyQAAANA"]
[Sat May 09 01:48:05.136709 2026] [:error] [pid 51007:tid 51042] [client 51.83.101.126:37824] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af4h1VMagSGstWKyzzUekgAAABQ"]
[Sat May 09 01:48:06.228003 2026] [:error] [pid 51009:tid 51076] [client 51.83.101.126:41828] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af4h1uB0GbUWhxgzX9WZ8gAAAIA"]
[Sat May 09 01:48:07.019999 2026] [:error] [pid 61355:tid 61383] [client 51.83.101.126:41838] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af4h1_khJTi30CBXmMlAhwAAAZY"]
[Sat May 09 01:48:08.137013 2026] [:error] [pid 51009:tid 51085] [client 51.83.101.126:41840] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af4h2OB0GbUWhxgzX9WZ9QAAAIk"]
[Sat May 09 01:48:09.083582 2026] [:error] [pid 51007:tid 51043] [client 51.83.101.126:41848] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af4h2VMagSGstWKyzzUelQAAABU"]
[Sat May 09 01:48:10.030846 2026] [:error] [pid 61355:tid 61384] [client 51.83.101.126:41860] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af4h2vkhJTi30CBXmMlAlgAAAZc"]
[Sat May 09 01:48:10.973900 2026] [:error] [pid 61355:tid 61364] [client 51.83.101.126:41866] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af4h2vkhJTi30CBXmMlAnAAAAYM"]
[Sat May 09 01:48:12.074707 2026] [:error] [pid 61355:tid 61376] [client 51.83.101.126:41874] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af4h3PkhJTi30CBXmMlAqQAAAY8"]
[Sat May 09 01:48:12.943415 2026] [:error] [pid 61355:tid 61362] [client 51.83.101.126:41884] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af4h3PkhJTi30CBXmMlAsQAAAYE"]
[Sat May 09 01:48:14.063960 2026] [:error] [pid 61317:tid 61329] [client 51.83.101.126:41898] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af4h3s-fFk_CedOCOYsSAgAAAUk"]
[Sat May 09 01:48:14.847170 2026] [:error] [pid 61355:tid 61380] [client 51.83.101.126:41904] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af4h3vkhJTi30CBXmMlAvwAAAZM"]
[Sat May 09 01:48:15.952497 2026] [:error] [pid 61356:tid 61393] [client 51.83.101.126:41912] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af4h34x3vpB8oWhUq2MxLgAAAcU"]
[Sat May 09 01:48:16.779639 2026] [:error] [pid 61356:tid 61399] [client 51.83.101.126:55796] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af4h4Ix3vpB8oWhUq2MxOQAAAcs"]
[Sat May 09 01:48:17.885859 2026] [:error] [pid 61356:tid 61407] [client 51.83.101.126:55812] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af4h4Yx3vpB8oWhUq2MxRgAAAdM"]
[Sat May 09 01:48:18.775495 2026] [:error] [pid 51007:tid 51044] [client 51.83.101.126:55818] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af4h4lMagSGstWKyzzUemgAAABY"]
[Sat May 09 01:48:19.911856 2026] [:error] [pid 61317:tid 61323] [client 51.83.101.126:55832] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af4h48-fFk_CedOCOYsSIQAAAUM"]
[Sat May 09 01:48:20.832003 2026] [:error] [pid 51113:tid 51133] [client 51.83.101.126:55838] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af4h5EQfs7sWtqkpQIed0gAAANI"]
[Sat May 09 01:48:21.842271 2026] [:error] [pid 61355:tid 61374] [client 51.83.101.126:55846] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af4h5fkhJTi30CBXmMlA6AAAAY0"]
[Sat May 09 01:48:22.781107 2026] [:error] [pid 61355:tid 61368] [client 51.83.101.126:55850] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af4h5vkhJTi30CBXmMlA8AAAAYc"]
[Sat May 09 01:48:23.751295 2026] [:error] [pid 61356:tid 61402] [client 51.83.101.126:55854] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af4h54x3vpB8oWhUq2MxYAAAAc4"]
[Sat May 09 01:48:24.806564 2026] [:error] [pid 61317:tid 61339] [client 51.83.101.126:55858] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af4h6M-fFk_CedOCOYsSNgAAAVM"]
[Sat May 09 01:48:25.607899 2026] [:error] [pid 61355:tid 61377] [client 51.83.101.126:55870] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af4h6fkhJTi30CBXmMlA-QAAAZA"]
[Sat May 09 01:48:26.773139 2026] [:error] [pid 61356:tid 61408] [client 51.83.101.126:59288] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af4h6ox3vpB8oWhUq2MxbQAAAdQ"]
[Sat May 09 01:48:27.689097 2026] [:error] [pid 34318:tid 34335] [client 51.83.101.126:59298] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af4h68r3guirgJiKhzAHHQAAAQ8"]
[Sat May 09 01:48:28.853132 2026] [:error] [pid 61355:tid 61363] [client 51.83.101.126:59306] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af4h7PkhJTi30CBXmMlBDAAAAYI"]
[Sat May 09 01:48:29.596308 2026] [:error] [pid 61355:tid 61382] [client 51.83.101.126:59310] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "af4h7fkhJTi30CBXmMlBFQAAAZU"]
[Sat May 09 01:48:30.615693 2026] [:error] [pid 61356:tid 61404] [client 51.83.101.126:59320] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af4h7ox3vpB8oWhUq2MxeQAAAdA"]
[Sat May 09 01:48:31.531500 2026] [:error] [pid 34318:tid 34321] [client 51.83.101.126:59326] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af4h78r3guirgJiKhzAHHgAAAQE"]
[Sat May 09 01:48:32.595999 2026] [:error] [pid 61355:tid 61363] [client 51.83.101.126:59340] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af4h8PkhJTi30CBXmMlBKwAAAYI"]
[Sat May 09 01:48:33.488190 2026] [:error] [pid 61355:tid 61375] [client 51.83.101.126:59354] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af4h8fkhJTi30CBXmMlBMQAAAY4"]
[Sat May 09 01:48:34.634583 2026] [:error] [pid 61355:tid 61362] [client 51.83.101.126:59358] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "af4h8vkhJTi30CBXmMlBNwAAAYE"]
[Sat May 09 01:48:35.530603 2026] [:error] [pid 61355:tid 61370] [client 51.83.101.126:59372] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af4h8_khJTi30CBXmMlBPQAAAYk"]
[Sat May 09 01:48:36.585691 2026] [:error] [pid 61356:tid 61390] [client 51.83.101.126:56060] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af4h9Ix3vpB8oWhUq2MxhQAAAcI"]
[Sat May 09 01:48:37.656741 2026] [:error] [pid 61356:tid 61399] [client 51.83.101.126:56068] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af4h9Yx3vpB8oWhUq2MxigAAAcs"]
[Sat May 09 01:48:37.681816 2026] [:error] [pid 61356:tid 61404] [client 13.203.26.197:57486] [client 13.203.26.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "af4h9Yx3vpB8oWhUq2MxiwAAAdA"]
[Sat May 09 01:48:38.485270 2026] [:error] [pid 61356:tid 61393] [client 13.203.26.197:57502] [client 13.203.26.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4h9ox3vpB8oWhUq2MxkgAAAcU"]
[Sat May 09 01:48:38.654036 2026] [:error] [pid 61355:tid 61374] [client 51.83.101.126:56078] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af4h9vkhJTi30CBXmMlBTgAAAY0"]
[Sat May 09 01:48:39.136460 2026] [proxy_fcgi:error] [pid 61355:tid 61373] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:39.302224 2026] [proxy_fcgi:error] [pid 61355:tid 61378] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:39.465407 2026] [proxy_fcgi:error] [pid 61355:tid 61365] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:39.566651 2026] [:error] [pid 61355:tid 61370] [client 51.83.101.126:56080] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af4h9_khJTi30CBXmMlBWwAAAYk"]
[Sat May 09 01:48:39.627953 2026] [proxy_fcgi:error] [pid 61355:tid 61367] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:39.790039 2026] [proxy_fcgi:error] [pid 61355:tid 61376] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:39.954185 2026] [proxy_fcgi:error] [pid 61355:tid 61379] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:40.116798 2026] [proxy_fcgi:error] [pid 61355:tid 61374] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:40.443216 2026] [proxy_fcgi:error] [pid 61355:tid 61366] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:40.558066 2026] [:error] [pid 61355:tid 61378] [client 51.83.101.126:56094] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af4h-PkhJTi30CBXmMlBZgAAAZE"]
[Sat May 09 01:48:40.604892 2026] [proxy_fcgi:error] [pid 61355:tid 61371] [client 13.203.26.197:57508] AH01071: Got error 'Primary script unknown'
[Sat May 09 01:48:40.928021 2026] [:error] [pid 61355:tid 61370] [client 13.203.26.197:57508] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/phpinfo.php"] [unique_id "af4h-PkhJTi30CBXmMlBagAAAYk"]
[Sat May 09 01:48:41.557738 2026] [:error] [pid 61355:tid 61376] [client 51.83.101.126:56098] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af4h-fkhJTi30CBXmMlBbQAAAY8"]
[Sat May 09 01:48:41.564158 2026] [:error] [pid 61355:tid 61367] [client 13.203.26.197:45468] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dev/phpinfo.php"] [unique_id "af4h-fkhJTi30CBXmMlBbwAAAYY"]
[Sat May 09 01:48:42.204974 2026] [:error] [pid 51008:tid 51050] [client 13.203.26.197:45476] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/old/phpinfo.php"] [unique_id "af4h-nB58C2Y1tgLtuLfcwAAAEE"]
[Sat May 09 01:48:42.475901 2026] [:error] [pid 51113:tid 51118] [client 51.83.101.126:56100] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af4h-kQfs7sWtqkpQIed2gAAAMM"]
[Sat May 09 01:48:42.840201 2026] [:error] [pid 61355:tid 61385] [client 13.203.26.197:45492] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tmp/phpinfo.php"] [unique_id "af4h-vkhJTi30CBXmMlBdwAAAZg"]
[Sat May 09 01:48:43.476337 2026] [:error] [pid 51009:tid 51097] [client 13.203.26.197:45508] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public/phpinfo.php"] [unique_id "af4h--B0GbUWhxgzX9WaRgAAAJU"]
[Sat May 09 01:48:43.700708 2026] [:error] [pid 61356:tid 61409] [client 51.83.101.126:56114] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "af4h-4x3vpB8oWhUq2MxqgAAAdU"]
[Sat May 09 01:48:44.113596 2026] [:error] [pid 61356:tid 61410] [client 13.203.26.197:45512] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info"] [unique_id "af4h_Ix3vpB8oWhUq2MxrgAAAdY"]
[Sat May 09 01:48:44.493883 2026] [:error] [pid 61356:tid 61390] [client 51.83.101.126:56120] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af4h_Ix3vpB8oWhUq2MxtAAAAcI"]
[Sat May 09 01:48:44.749075 2026] [:error] [pid 61356:tid 61389] [client 13.203.26.197:45522] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/php-info.php"] [unique_id "af4h_Ix3vpB8oWhUq2MxtgAAAcE"]
[Sat May 09 01:48:45.384134 2026] [:error] [pid 34318:tid 34333] [client 13.203.26.197:45538] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpversion.php"] [unique_id "af4h_cr3guirgJiKhzAHIQAAAQ0"]
[Sat May 09 01:48:45.605015 2026] [:error] [pid 51007:tid 51022] [client 51.83.101.126:56122] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af4h_VMagSGstWKyzzUeoQAAAAA"]
[Sat May 09 01:48:46.020276 2026] [:error] [pid 51007:tid 51025] [client 13.203.26.197:45554] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/_phpinfo.php"] [unique_id "af4h_lMagSGstWKyzzUeogAAAAM"]
[Sat May 09 01:48:46.460672 2026] [:error] [pid 61355:tid 61374] [client 51.83.101.126:45174] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af4h_vkhJTi30CBXmMlBhAAAAY0"]
[Sat May 09 01:48:46.657308 2026] [:error] [pid 61356:tid 61392] [client 13.203.26.197:45560] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/old_phpinfo.php"] [unique_id "af4h_ox3vpB8oWhUq2MxwQAAAcQ"]
[Sat May 09 01:48:47.296564 2026] [:error] [pid 61356:tid 61397] [client 13.203.26.197:45570] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/server-info.php"] [unique_id "af4h_4x3vpB8oWhUq2MxyQAAAck"]
[Sat May 09 01:48:47.823425 2026] [:error] [pid 61355:tid 61370] [client 51.83.101.126:45184] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af4h__khJTi30CBXmMlBjQAAAYk"]
[Sat May 09 01:48:47.926198 2026] [:error] [pid 61355:tid 61369] [client 13.203.26.197:45580] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/server-status.php"] [unique_id "af4h__khJTi30CBXmMlBjwAAAYg"]
[Sat May 09 01:48:48.490802 2026] [:error] [pid 61317:tid 61332] [client 51.83.101.126:45196] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "af4iAM-fFk_CedOCOYsSQwAAAUw"]
[Sat May 09 01:48:48.555281 2026] [:error] [pid 61317:tid 61325] [client 13.203.26.197:45588] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/_profiler/phpinfo"] [unique_id "af4iAM-fFk_CedOCOYsSRAAAAUU"]
[Sat May 09 01:48:49.190256 2026] [:error] [pid 51007:tid 51030] [client 13.203.26.197:45594] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/_environment"] [unique_id "af4iAVMagSGstWKyzzUepQAAAAg"]
[Sat May 09 01:48:49.760052 2026] [:error] [pid 51009:tid 51080] [client 51.83.101.126:45212] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af4iAeB0GbUWhxgzX9WaYAAAAIQ"]
[Sat May 09 01:48:49.818099 2026] [:error] [pid 51009:tid 51085] [client 13.203.26.197:45608] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webroot/index.php/_environment"] [unique_id "af4iAeB0GbUWhxgzX9WaYgAAAIk"]
[Sat May 09 01:48:50.453059 2026] [:error] [pid 34318:tid 34325] [client 13.203.26.197:46572] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mail/phpinfo.php"] [unique_id "af4iAsr3guirgJiKhzAHJAAAAQU"]
[Sat May 09 01:48:51.091710 2026] [:error] [pid 51113:tid 51128] [client 13.203.26.197:46578] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cpanel/phpinfo.php"] [unique_id "af4iA0Qfs7sWtqkpQIed3QAAAM0"]
[Sat May 09 01:48:51.727811 2026] [:error] [pid 61317:tid 61343] [client 13.203.26.197:46594] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hosting/phpinfo.php"] [unique_id "af4iA8-fFk_CedOCOYsSRgAAAVc"]
[Sat May 09 01:48:52.366785 2026] [:error] [pid 61356:tid 61391] [client 13.203.26.197:46600] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/webmail/phpinfo.php"] [unique_id "af4iBIx3vpB8oWhUq2Mx8wAAAcM"]
[Sat May 09 01:48:52.993485 2026] [:error] [pid 34318:tid 34331] [client 13.203.26.197:46610] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/smtp/phpinfo.php"] [unique_id "af4iBMr3guirgJiKhzAHKAAAAQs"]
[Sat May 09 01:48:53.626730 2026] [:error] [pid 51113:tid 51117] [client 13.203.26.197:46620] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpinfo.php.bak"] [unique_id "af4iBUQfs7sWtqkpQIed4QAAAMI"]
[Sat May 09 01:48:54.255981 2026] [:error] [pid 34318:tid 34329] [client 13.203.26.197:46630] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpinfo.php.old"] [unique_id "af4iBsr3guirgJiKhzAHKgAAAQk"]
[Sat May 09 01:48:54.884715 2026] [:error] [pid 61356:tid 61409] [client 13.203.26.197:46646] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpinfo.php~"] [unique_id "af4iBox3vpB8oWhUq2Mx9gAAAdU"]
[Sat May 09 01:48:55.521555 2026] [:error] [pid 51009:tid 51079] [client 13.203.26.197:46650] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/info.php.bak"] [unique_id "af4iB-B0GbUWhxgzX9WagAAAAIM"]
[Sat May 09 01:48:56.147012 2026] [:error] [pid 51113:tid 51133] [client 13.203.26.197:46658] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/phpinfo.php.save"] [unique_id "af4iCEQfs7sWtqkpQIed4gAAANI"]
[Sat May 09 01:48:56.777156 2026] [:error] [pid 61355:tid 61379] [client 13.203.26.197:46664] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/staging/phpinfo.php"] [unique_id "af4iCPkhJTi30CBXmMlBygAAAZI"]
[Sat May 09 01:48:57.415303 2026] [:error] [pid 61355:tid 61361] [client 13.203.26.197:46670] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/beta/phpinfo.php"] [unique_id "af4iCfkhJTi30CBXmMlB0wAAAYA"]
[Sat May 09 01:48:58.050949 2026] [:error] [pid 61356:tid 61392] [client 13.203.26.197:46680] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uat/phpinfo.php"] [unique_id "af4iCox3vpB8oWhUq2MyAQAAAcQ"]
[Sat May 09 01:48:58.681918 2026] [:error] [pid 61355:tid 61373] [client 13.203.26.197:46694] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/qa/phpinfo.php"] [unique_id "af4iCvkhJTi30CBXmMlB3AAAAYw"]
[Sat May 09 01:48:59.307721 2026] [:error] [pid 61356:tid 61405] [client 13.203.26.197:46696] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/preview/phpinfo.php"] [unique_id "af4iC4x3vpB8oWhUq2MyBQAAAdE"]
[Sat May 09 01:48:59.940208 2026] [:error] [pid 61355:tid 61364] [client 13.203.26.197:46698] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www/phpinfo.php"] [unique_id "af4iC_khJTi30CBXmMlB6gAAAYM"]
[Sat May 09 01:49:00.200828 2026] [:error] [pid 61355:tid 61373] [client 51.83.101.126:42124] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/168%20slot.aspx"] [unique_id "af4iDPkhJTi30CBXmMlB7gAAAYw"]
[Sat May 09 01:49:00.577032 2026] [:error] [pid 61355:tid 61381] [client 13.203.26.197:58394] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/htdocs/phpinfo.php"] [unique_id "af4iDPkhJTi30CBXmMlB8wAAAZQ"]
[Sat May 09 01:49:00.793726 2026] [:error] [pid 51008:tid 51056] [client 51.83.101.126:45236] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af4iDHB58C2Y1tgLtuLfgQAAAEc"]
[Sat May 09 01:49:01.216143 2026] [:error] [pid 51009:tid 51081] [client 13.203.26.197:58410] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/public_html/phpinfo.php"] [unique_id "af4iDeB0GbUWhxgzX9WakgAAAIU"]
[Sat May 09 01:49:01.882570 2026] [:error] [pid 61355:tid 61362] [client 13.203.26.197:58422] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/phpinfo.php"] [unique_id "af4iDfkhJTi30CBXmMlB_AAAAYE"]
[Sat May 09 01:49:02.205741 2026] [:error] [pid 34318:tid 34341] [client 51.83.101.126:42132] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/24th%20slot.aspx"] [unique_id "af4iDsr3guirgJiKhzAHLAAAARU"]
[Sat May 09 01:49:02.522223 2026] [:error] [pid 51007:tid 51023] [client 13.203.26.197:58428] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/docs/phpinfo.php"] [unique_id "af4iDlMagSGstWKyzzUerwAAAAE"]
[Sat May 09 01:49:02.750951 2026] [:error] [pid 61356:tid 61394] [client 51.83.101.126:42134] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af4iDox3vpB8oWhUq2MyDwAAAcY"]
[Sat May 09 01:49:03.162969 2026] [:error] [pid 51009:tid 51093] [client 13.203.26.197:58434] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4iD-B0GbUWhxgzX9WamwAAAJE"]
[Sat May 09 01:49:03.796947 2026] [:error] [pid 61356:tid 61409] [client 13.203.26.197:58444] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/administrator/phpinfo.php"] [unique_id "af4iD4x3vpB8oWhUq2MyFAAAAdU"]
[Sat May 09 01:49:03.951812 2026] [:error] [pid 61355:tid 61378] [client 51.83.101.126:42150] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af4iD_khJTi30CBXmMlCCQAAAZE"]
[Sat May 09 01:49:04.426109 2026] [:error] [pid 51007:tid 51025] [client 13.203.26.197:58450] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/core/phpinfo.php"] [unique_id "af4iEFMagSGstWKyzzUetAAAAAM"]
[Sat May 09 01:49:04.698964 2026] [:error] [pid 61355:tid 61366] [client 51.83.101.126:42156] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "af4iEPkhJTi30CBXmMlCEQAAAYU"]
[Sat May 09 01:49:05.051222 2026] [:error] [pid 61355:tid 61384] [client 13.203.26.197:58466] [client 13.203.26.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/includes/phpinfo.php"] [unique_id "af4iEfkhJTi30CBXmMlCFQAAAZc"]
[Sat May 09 01:49:05.862768 2026] [:error] [pid 61355:tid 61364] [client 51.83.101.126:42160] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af4iEfkhJTi30CBXmMlCHAAAAYM"]
[Sat May 09 01:49:06.519146 2026] [:error] [pid 51009:tid 51087] [client 51.83.101.126:60938] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "af4iEuB0GbUWhxgzX9WaogAAAIs"]
[Sat May 09 01:49:07.610332 2026] [:error] [pid 51007:tid 51045] [client 51.83.101.126:60950] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "af4iE1MagSGstWKyzzUeuwAAABc"]
[Sat May 09 01:49:08.508143 2026] [:error] [pid 51008:tid 51051] [client 51.83.101.126:60962] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af4iFHB58C2Y1tgLtuLfjAAAAEI"]
[Sat May 09 01:49:09.592117 2026] [:error] [pid 51008:tid 51069] [client 51.83.101.126:60976] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "af4iFXB58C2Y1tgLtuLfkQAAAFQ"]
[Sat May 09 01:49:10.516827 2026] [:error] [pid 61356:tid 61395] [client 51.83.101.126:60990] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "af4iFox3vpB8oWhUq2MyNwAAAcc"]
[Sat May 09 01:49:11.687550 2026] [:error] [pid 61355:tid 61362] [client 51.83.101.126:32770] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af4iF_khJTi30CBXmMlCWgAAAYE"]
[Sat May 09 01:49:12.295893 2026] [:error] [pid 61355:tid 61364] [client 51.83.101.126:32786] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af4iGPkhJTi30CBXmMlCYgAAAYM"]
[Sat May 09 01:49:13.699762 2026] [:error] [pid 51007:tid 51031] [client 51.83.101.126:32800] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "af4iGVMagSGstWKyzzUe7QAAAAk"]
[Sat May 09 01:49:14.435356 2026] [:error] [pid 61355:tid 61375] [client 51.83.101.126:32816] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af4iGvkhJTi30CBXmMlCgAAAAY4"]
[Sat May 09 01:49:15.659137 2026] [:error] [pid 61317:tid 61339] [client 51.83.101.126:32826] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af4iG8-fFk_CedOCOYsSXgAAAVM"]
[Sat May 09 01:49:16.389636 2026] [:error] [pid 61355:tid 61380] [client 51.83.101.126:36110] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af4iHPkhJTi30CBXmMlCmQAAAZM"]
[Sat May 09 01:49:17.644348 2026] [:error] [pid 61317:tid 61334] [client 51.83.101.126:36118] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af4iHc-fFk_CedOCOYsSYwAAAU4"]
[Sat May 09 01:49:18.725198 2026] [:error] [pid 51008:tid 51064] [client 51.83.101.126:36124] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af4iHnB58C2Y1tgLtuLfnAAAAE8"]
[Sat May 09 01:49:19.778857 2026] [:error] [pid 61317:tid 61340] [client 51.83.101.126:36132] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af4iH8-fFk_CedOCOYsSZgAAAVQ"]
[Sat May 09 01:49:20.695595 2026] [:error] [pid 61317:tid 61322] [client 51.83.101.126:36142] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af4iIM-fFk_CedOCOYsSbQAAAUI"]
[Sat May 09 01:49:22.186467 2026] [:error] [pid 51113:tid 51129] [client 51.83.101.126:36148] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af4iIkQfs7sWtqkpQIed-AAAAM4"]
[Sat May 09 01:49:24.221193 2026] [:error] [pid 51008:tid 51068] [client 51.83.101.126:36162] [client 51.83.101.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af4iJHB58C2Y1tgLtuLfogAAAFM"]
[Sat May 09 02:02:39.623737 2026] [:error] [pid 51008:tid 51066] [client 34.255.98.220:49860] [client 34.255.98.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "af4lP3B58C2Y1tgLtuLj2AAAAFE"]
[Sat May 09 02:02:40.937531 2026] [:error] [pid 61355:tid 61381] [client 34.255.98.220:49866] [client 34.255.98.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4lQPkhJTi30CBXmMlLSgAAAZQ"]
[Sat May 09 02:02:41.980040 2026] [proxy_fcgi:error] [pid 51009:tid 51092] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:42.608274 2026] [proxy_fcgi:error] [pid 51009:tid 51083] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:42.870601 2026] [proxy_fcgi:error] [pid 51009:tid 51097] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:43.138957 2026] [proxy_fcgi:error] [pid 51009:tid 51093] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:43.400376 2026] [proxy_fcgi:error] [pid 51009:tid 51088] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:43.661700 2026] [proxy_fcgi:error] [pid 51009:tid 51094] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:43.924564 2026] [proxy_fcgi:error] [pid 51009:tid 51082] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:44.447622 2026] [proxy_fcgi:error] [pid 51009:tid 51100] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:44.710269 2026] [proxy_fcgi:error] [pid 51009:tid 51087] [client 34.255.98.220:49882] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:02:45.234030 2026] [:error] [pid 51009:tid 51086] [client 34.255.98.220:49882] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/test/phpinfo.php"] [unique_id "af4lReB0GbUWhxgzX9Wf-QAAAIo"]
[Sat May 09 02:02:46.648481 2026] [:error] [pid 51009:tid 51078] [client 34.255.98.220:49888] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dev/phpinfo.php"] [unique_id "af4lRuB0GbUWhxgzX9Wf_wAAAII"]
[Sat May 09 02:02:47.676922 2026] [:error] [pid 61355:tid 61385] [client 34.255.98.220:51260] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/old/phpinfo.php"] [unique_id "af4lR_khJTi30CBXmMlLZwAAAZg"]
[Sat May 09 02:02:48.708543 2026] [:error] [pid 61355:tid 61381] [client 34.255.98.220:51272] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/tmp/phpinfo.php"] [unique_id "af4lSPkhJTi30CBXmMlLbwAAAZQ"]
[Sat May 09 02:02:49.731834 2026] [:error] [pid 61356:tid 61397] [client 34.255.98.220:51286] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/public/phpinfo.php"] [unique_id "af4lSYx3vpB8oWhUq2M5QAAAAck"]
[Sat May 09 02:02:50.758115 2026] [:error] [pid 61355:tid 61371] [client 34.255.98.220:51294] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/info"] [unique_id "af4lSvkhJTi30CBXmMlLegAAAYo"]
[Sat May 09 02:02:51.799407 2026] [:error] [pid 61355:tid 61363] [client 34.255.98.220:51310] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/php-info.php"] [unique_id "af4lS_khJTi30CBXmMlLggAAAYI"]
[Sat May 09 02:02:52.827478 2026] [:error] [pid 61356:tid 61406] [client 34.255.98.220:51316] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/phpversion.php"] [unique_id "af4lTIx3vpB8oWhUq2M5WgAAAdI"]
[Sat May 09 02:02:53.854891 2026] [:error] [pid 51009:tid 51099] [client 34.255.98.220:51324] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/_phpinfo.php"] [unique_id "af4lTeB0GbUWhxgzX9WgCgAAAJc"]
[Sat May 09 02:02:54.883757 2026] [:error] [pid 51007:tid 51042] [client 34.255.98.220:51334] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/old_phpinfo.php"] [unique_id "af4lTlMagSGstWKyzzUhxgAAABQ"]
[Sat May 09 02:02:55.913492 2026] [:error] [pid 51008:tid 51063] [client 34.255.98.220:51342] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/server-info.php"] [unique_id "af4lT3B58C2Y1tgLtuLj5gAAAE4"]
[Sat May 09 02:02:56.947338 2026] [:error] [pid 61356:tid 61411] [client 34.255.98.220:47556] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/server-status.php"] [unique_id "af4lUIx3vpB8oWhUq2M5ZwAAAdc"]
[Sat May 09 02:02:57.984536 2026] [:error] [pid 51007:tid 51033] [client 34.255.98.220:47562] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/_profiler/phpinfo"] [unique_id "af4lUVMagSGstWKyzzUhzQAAAAs"]
[Sat May 09 02:02:59.028551 2026] [:error] [pid 51007:tid 51043] [client 34.255.98.220:47564] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/_environment"] [unique_id "af4lU1MagSGstWKyzzUh0QAAABU"]
[Sat May 09 02:03:00.061937 2026] [:error] [pid 61355:tid 61381] [client 34.255.98.220:47568] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/webroot/index.php/_environment"] [unique_id "af4lVPkhJTi30CBXmMlLnAAAAZQ"]
[Sat May 09 02:03:01.089887 2026] [:error] [pid 51009:tid 51098] [client 34.255.98.220:47578] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mail/phpinfo.php"] [unique_id "af4lVeB0GbUWhxgzX9WgFQAAAJY"]
[Sat May 09 02:03:02.133612 2026] [:error] [pid 61356:tid 61392] [client 34.255.98.220:47586] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/cpanel/phpinfo.php"] [unique_id "af4lVox3vpB8oWhUq2M5dgAAAcQ"]
[Sat May 09 02:03:03.182107 2026] [:error] [pid 34318:tid 34322] [client 34.255.98.220:47588] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/hosting/phpinfo.php"] [unique_id "af4lV8r3guirgJiKhzAJjAAAAQI"]
[Sat May 09 02:03:04.211063 2026] [:error] [pid 61356:tid 61404] [client 34.255.98.220:47590] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/webmail/phpinfo.php"] [unique_id "af4lWIx3vpB8oWhUq2M5fwAAAdA"]
[Sat May 09 02:03:05.237404 2026] [:error] [pid 51007:tid 51046] [client 34.255.98.220:47606] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/smtp/phpinfo.php"] [unique_id "af4lWVMagSGstWKyzzUh4QAAABg"]
[Sat May 09 02:03:06.276411 2026] [:error] [pid 61356:tid 61397] [client 34.255.98.220:47622] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/phpinfo.php.bak"] [unique_id "af4lWox3vpB8oWhUq2M5hAAAAck"]
[Sat May 09 02:03:07.321652 2026] [:error] [pid 51007:tid 51046] [client 34.255.98.220:56804] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/phpinfo.php.old"] [unique_id "af4lW1MagSGstWKyzzUh-AAAABg"]
[Sat May 09 02:03:08.356997 2026] [:error] [pid 61355:tid 61383] [client 34.255.98.220:56806] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/phpinfo.php~"] [unique_id "af4lXPkhJTi30CBXmMlLowAAAZY"]
[Sat May 09 02:03:09.390497 2026] [:error] [pid 61317:tid 61323] [client 34.255.98.220:56816] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/info.php.bak"] [unique_id "af4lXc-fFk_CedOCOYsWYQAAAUM"]
[Sat May 09 02:03:10.415972 2026] [:error] [pid 34318:tid 34326] [client 34.255.98.220:56818] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/phpinfo.php.save"] [unique_id "af4lXsr3guirgJiKhzAJmAAAAQY"]
[Sat May 09 02:03:11.444493 2026] [:error] [pid 51009:tid 51082] [client 34.255.98.220:56828] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/staging/phpinfo.php"] [unique_id "af4lX-B0GbUWhxgzX9WgLwAAAIY"]
[Sat May 09 02:03:12.472909 2026] [:error] [pid 51009:tid 51094] [client 34.255.98.220:56836] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/beta/phpinfo.php"] [unique_id "af4lYOB0GbUWhxgzX9WgNAAAAJI"]
[Sat May 09 02:03:13.508779 2026] [:error] [pid 51113:tid 51123] [client 34.255.98.220:56852] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/uat/phpinfo.php"] [unique_id "af4lYUQfs7sWtqkpQIefsQAAAMg"]
[Sat May 09 02:03:14.543568 2026] [:error] [pid 34318:tid 34344] [client 34.255.98.220:56854] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/qa/phpinfo.php"] [unique_id "af4lYsr3guirgJiKhzAJnQAAARg"]
[Sat May 09 02:03:15.568713 2026] [:error] [pid 51008:tid 51073] [client 34.255.98.220:56868] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/preview/phpinfo.php"] [unique_id "af4lY3B58C2Y1tgLtuLj_gAAAFg"]
[Sat May 09 02:03:16.589128 2026] [:error] [pid 61356:tid 61406] [client 34.255.98.220:56870] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www/phpinfo.php"] [unique_id "af4lZIx3vpB8oWhUq2M5rgAAAdI"]
[Sat May 09 02:03:17.616927 2026] [:error] [pid 61356:tid 61397] [client 34.255.98.220:52568] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/htdocs/phpinfo.php"] [unique_id "af4lZYx3vpB8oWhUq2M5tQAAAck"]
[Sat May 09 02:03:18.669132 2026] [:error] [pid 34318:tid 34340] [client 34.255.98.220:52584] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/public_html/phpinfo.php"] [unique_id "af4lZsr3guirgJiKhzAJpAAAARQ"]
[Sat May 09 02:03:19.701472 2026] [:error] [pid 61355:tid 61372] [client 34.255.98.220:52590] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/site/phpinfo.php"] [unique_id "af4lZ_khJTi30CBXmMlLtgAAAYs"]
[Sat May 09 02:03:20.726103 2026] [:error] [pid 51113:tid 51121] [client 34.255.98.220:52592] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/docs/phpinfo.php"] [unique_id "af4laEQfs7sWtqkpQIefvwAAAMY"]
[Sat May 09 02:03:21.748644 2026] [:error] [pid 51009:tid 51082] [client 34.255.98.220:52602] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4laeB0GbUWhxgzX9WgPwAAAIY"]
[Sat May 09 02:03:22.772045 2026] [:error] [pid 34318:tid 34333] [client 34.255.98.220:52612] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/administrator/phpinfo.php"] [unique_id "af4lasr3guirgJiKhzAJqgAAAQ0"]
[Sat May 09 02:03:23.805385 2026] [:error] [pid 61355:tid 61379] [client 34.255.98.220:52626] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/core/phpinfo.php"] [unique_id "af4la_khJTi30CBXmMlLzAAAAZI"]
[Sat May 09 02:03:24.842832 2026] [:error] [pid 51009:tid 51089] [client 34.255.98.220:52632] [client 34.255.98.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/includes/phpinfo.php"] [unique_id "af4lbOB0GbUWhxgzX9WgTAAAAI0"]
[Sat May 09 02:58:23.895895 2026] [proxy_fcgi:error] [pid 51009:tid 51099] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:24.107861 2026] [proxy_fcgi:error] [pid 51009:tid 51083] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:24.532684 2026] [proxy_fcgi:error] [pid 51009:tid 51093] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:24.745787 2026] [proxy_fcgi:error] [pid 51009:tid 51095] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:25.167582 2026] [proxy_fcgi:error] [pid 51009:tid 51079] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:25.379189 2026] [proxy_fcgi:error] [pid 51009:tid 51078] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:25.590123 2026] [proxy_fcgi:error] [pid 51009:tid 51092] [client 20.220.146.147:12096] AH01071: Got error 'Primary script unknown'
[Sat May 09 02:58:26.028796 2026] [:error] [pid 51009:tid 51088] [client 20.220.146.147:12096] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "af4yUuB0GbUWhxgzX9WzpQAAAIw"]
[Sat May 09 02:58:26.859879 2026] [:error] [pid 34318:tid 34326] [client 20.220.146.147:12136] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "af4yUsr3guirgJiKhzAUHQAAAQY"]
[Sat May 09 02:58:27.689867 2026] [:error] [pid 51009:tid 51090] [client 20.220.146.147:12144] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "af4yU-B0GbUWhxgzX9WzqwAAAI4"]
[Sat May 09 02:58:28.513874 2026] [:error] [pid 34318:tid 34340] [client 20.220.146.147:12032] [client 20.220.146.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "af4yVMr3guirgJiKhzAUHgAAARQ"]
[Sat May 09 04:00:18.640395 2026] [:error] [pid 9293:tid 9302] [client 45.130.83.103:30329] [client 45.130.83.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.103, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "af5A0pR__qEzV5O6Z2OGBwAAAMU"]
[Sat May 09 04:00:18.651304 2026] [proxy_fcgi:error] [pid 9293:tid 9302] [client 45.130.83.103:30329] AH01071: Got error 'Primary script unknown'
[Sat May 09 10:19:45.962587 2026] [:error] [pid 9833:tid 9847] [client 20.151.175.120:23854] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "af6ZwSM9JmxIS0KGZUBZEgAAAYk"]
[Sat May 09 10:19:46.824459 2026] [:error] [pid 9833:tid 9854] [client 20.151.175.120:23823] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "af6ZwiM9JmxIS0KGZUBZJAAAAZA"]
[Sat May 09 10:19:47.946014 2026] [:error] [pid 9663:tid 9679] [client 20.151.175.120:23888] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "af6Zw5cWIu01SCxbjwv_SwAAAQ0"]
[Sat May 09 10:19:48.802349 2026] [:error] [pid 9293:tid 9300] [client 20.151.175.120:23842] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "af6ZxJR__qEzV5O6Z2M6XwAAAMM"]
[Sat May 09 11:20:12.164124 2026] [:error] [pid 9663:tid 9674] [client 43.135.144.81:35182] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af6n7JcWIu01SCxbjwsLMQAAAQg"]
[Sat May 09 11:27:17.875294 2026] [:error] [pid 9187:tid 9261] [client 147.135.252.182:57740] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "af6plRC7An6gkXsRsaFMOAAAAIg"]
[Sat May 09 11:27:19.692697 2026] [:error] [pid 9293:tid 9320] [client 147.135.252.182:49704] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "af6pl5R__qEzV5O6Z2NZ5AAAANc"]
[Sat May 09 11:27:21.795269 2026] [:error] [pid 9184:tid 9216] [client 147.135.252.182:57756] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "af6pmYjfODqb_i0Fm999_AAAABM"]
[Sat May 09 11:27:24.542937 2026] [:error] [pid 9187:tid 9276] [client 147.135.252.182:51830] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "af6pnBC7An6gkXsRsaFMUQAAAJc"]
[Sat May 09 11:27:26.462484 2026] [:error] [pid 9760:tid 9781] [client 147.135.252.182:57766] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "af6pnmIkCp-C_fh0s7Is0gAAAU8"]
[Sat May 09 11:27:29.263295 2026] [:error] [pid 9187:tid 9275] [client 147.135.252.182:33090] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "af6poRC7An6gkXsRsaFMWQAAAJY"]
[Sat May 09 11:27:32.058566 2026] [:error] [pid 9293:tid 9321] [client 147.135.252.182:33092] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "af6ppJR__qEzV5O6Z2NaFAAAANg"]
[Sat May 09 11:27:35.077020 2026] [:error] [pid 9920:tid 9946] [client 147.135.252.182:33108] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "af6pp0xitGYhlzgZb5avRAAAAdg"]
[Sat May 09 11:27:38.147743 2026] [:error] [pid 9187:tid 9273] [client 147.135.252.182:57096] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "af6pqhC7An6gkXsRsaFMaAAAAJQ"]
[Sat May 09 11:27:40.862066 2026] [:error] [pid 9760:tid 9789] [client 147.135.252.182:57108] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "af6prGIkCp-C_fh0s7Is4QAAAVc"]
[Sat May 09 11:27:43.226832 2026] [:error] [pid 9293:tid 9318] [client 147.135.252.182:35782] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "af6pr5R__qEzV5O6Z2NaKwAAANU"]
[Sat May 09 11:27:46.145614 2026] [:error] [pid 9186:tid 9239] [client 147.135.252.182:57114] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "af6pshW4eFOEw1mKOgKwLQAAAE0"]
[Sat May 09 11:27:48.789560 2026] [:error] [pid 9186:tid 9239] [client 147.135.252.182:55836] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "af6ptBW4eFOEw1mKOgKwQAAAAE0"]
[Sat May 09 11:27:52.113403 2026] [:error] [pid 9663:tid 9688] [client 147.135.252.182:36110] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "af6puJcWIu01SCxbjwsNsQAAARY"]
[Sat May 09 11:27:54.507692 2026] [:error] [pid 9184:tid 9205] [client 147.135.252.182:55844] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "af6puojfODqb_i0Fm99-HQAAAAg"]
[Sat May 09 11:27:57.739379 2026] [:error] [pid 9920:tid 9943] [client 147.135.252.182:48888] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "af6pvUxitGYhlzgZb5avWQAAAdU"]
[Sat May 09 11:28:00.412325 2026] [:error] [pid 9184:tid 9210] [client 147.135.252.182:46542] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "af6pwIjfODqb_i0Fm99-JwAAAA0"]
[Sat May 09 11:28:03.318497 2026] [:error] [pid 9920:tid 9927] [client 147.135.252.182:48896] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "af6pw0xitGYhlzgZb5avZgAAAcU"]
[Sat May 09 11:28:06.229119 2026] [:error] [pid 9663:tid 9675] [client 147.135.252.182:48900] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "af6pxpcWIu01SCxbjwsNxgAAAQk"]
[Sat May 09 11:28:08.637992 2026] [:error] [pid 9186:tid 9235] [client 147.135.252.182:44242] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "af6pyBW4eFOEw1mKOgKwYgAAAEk"]
[Sat May 09 11:28:11.738674 2026] [:error] [pid 9187:tid 9262] [client 147.135.252.182:44250] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "af6pyxC7An6gkXsRsaFMngAAAIk"]
[Sat May 09 11:28:36.525319 2026] [:error] [pid 9184:tid 9212] [client 147.135.252.182:44252] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "af6p5IjfODqb_i0Fm99-OwAAAA8"]
[Sat May 09 11:28:39.170456 2026] [:error] [pid 9293:tid 9312] [client 147.135.252.182:33540] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af6p55R__qEzV5O6Z2NaiQAAAM8"]
[Sat May 09 11:28:42.175249 2026] [:error] [pid 9833:tid 9846] [client 147.135.252.182:33554] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af6p6iM9JmxIS0KGZUBjuQAAAYg"]
[Sat May 09 11:28:44.416569 2026] [:error] [pid 9186:tid 9235] [client 147.135.252.182:39952] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "af6p7BW4eFOEw1mKOgKwjQAAAEk"]
[Sat May 09 11:28:46.924683 2026] [:error] [pid 9833:tid 9843] [client 147.135.252.182:33564] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "af6p7iM9JmxIS0KGZUBjugAAAYU"]
[Sat May 09 11:28:50.065744 2026] [:error] [pid 9187:tid 9268] [client 147.135.252.182:58636] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af6p8hC7An6gkXsRsaFNAAAAAI8"]
[Sat May 09 11:28:52.668990 2026] [:error] [pid 9920:tid 9934] [client 147.135.252.182:58646] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "af6p9ExitGYhlzgZb5avrwAAAcw"]
[Sat May 09 11:28:55.334797 2026] [:error] [pid 9293:tid 9304] [client 147.135.252.182:58660] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "af6p95R__qEzV5O6Z2NapgAAAMc"]
[Sat May 09 11:28:58.179225 2026] [:error] [pid 9293:tid 9305] [client 147.135.252.182:39956] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af6p-pR__qEzV5O6Z2NatAAAAMg"]
[Sat May 09 11:29:00.387006 2026] [:error] [pid 9920:tid 9940] [client 147.135.252.182:34368] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "af6p_ExitGYhlzgZb5avswAAAdI"]
[Sat May 09 11:29:02.498410 2026] [:error] [pid 9920:tid 9946] [client 147.135.252.182:34382] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af6p_kxitGYhlzgZb5avuAAAAdg"]
[Sat May 09 11:29:04.460357 2026] [:error] [pid 9833:tid 9852] [client 147.135.252.182:34384] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "af6qACM9JmxIS0KGZUBjwAAAAY4"]
[Sat May 09 11:29:06.565813 2026] [:error] [pid 9920:tid 9939] [client 147.135.252.182:34398] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "af6qAkxitGYhlzgZb5avwAAAAdE"]
[Sat May 09 11:29:08.552964 2026] [:error] [pid 9184:tid 9220] [client 147.135.252.182:38432] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "af6qBIjfODqb_i0Fm99-VAAAABc"]
[Sat May 09 11:29:10.610583 2026] [:error] [pid 9186:tid 9227] [client 147.135.252.182:38446] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "af6qBhW4eFOEw1mKOgKwmAAAAEE"]
[Sat May 09 11:29:12.784344 2026] [:error] [pid 9833:tid 9843] [client 147.135.252.182:38448] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "af6qCCM9JmxIS0KGZUBjxAAAAYU"]
[Sat May 09 11:29:15.651620 2026] [:error] [pid 9920:tid 9930] [client 147.135.252.182:52198] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "af6qC0xitGYhlzgZb5avwwAAAcg"]
[Sat May 09 11:29:18.111968 2026] [:error] [pid 9663:tid 9682] [client 147.135.252.182:48504] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "af6qDpcWIu01SCxbjwsORAAAARA"]
[Sat May 09 11:29:20.568477 2026] [:error] [pid 9186:tid 9243] [client 147.135.252.182:48518] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af6qEBW4eFOEw1mKOgKwowAAAFE"]
[Sat May 09 11:29:23.164854 2026] [:error] [pid 9187:tid 9253] [client 147.135.252.182:48526] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "af6qExC7An6gkXsRsaFNGQAAAIA"]
[Sat May 09 11:29:25.310494 2026] [:error] [pid 9184:tid 9197] [client 147.135.252.182:39202] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "af6qFYjfODqb_i0Fm99-WwAAAAA"]
[Sat May 09 11:29:27.881311 2026] [:error] [pid 9187:tid 9259] [client 147.135.252.182:40098] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af6qFxC7An6gkXsRsaFNLAAAAIY"]
[Sat May 09 11:29:29.959330 2026] [:error] [pid 9663:tid 9673] [client 147.135.252.182:38206] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "af6qGZcWIu01SCxbjwsOTgAAAQc"]
[Sat May 09 11:29:32.519752 2026] [:error] [pid 9833:tid 9862] [client 147.135.252.182:40104] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "af6qHCM9JmxIS0KGZUBjzQAAAZg"]
[Sat May 09 11:29:54.420140 2026] [:error] [pid 9184:tid 9200] [client 147.135.252.182:40118] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af6qMojfODqb_i0Fm99-ZgAAAAM"]
[Sat May 09 11:29:56.479007 2026] [:error] [pid 9184:tid 9209] [client 147.135.252.182:45418] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "af6qNIjfODqb_i0Fm99-ZwAAAAw"]
[Sat May 09 11:29:59.080183 2026] [:error] [pid 9920:tid 9945] [client 147.135.252.182:49288] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "af6qN0xitGYhlzgZb5av4gAAAdc"]
[Sat May 09 11:30:00.955914 2026] [:error] [pid 9186:tid 9242] [client 147.135.252.182:34464] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "af6qOBW4eFOEw1mKOgKwwQAAAFA"]
[Sat May 09 11:30:03.287651 2026] [:error] [pid 9293:tid 9301] [client 147.135.252.182:49304] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "af6qO5R__qEzV5O6Z2Na5AAAAMQ"]
[Sat May 09 11:30:05.735852 2026] [:error] [pid 9186:tid 9239] [client 147.135.252.182:49308] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af6qPRW4eFOEw1mKOgKwwwAAAE0"]
[Sat May 09 11:30:08.261200 2026] [:error] [pid 9920:tid 9930] [client 147.135.252.182:43812] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "af6qQExitGYhlzgZb5av6AAAAcg"]
[Sat May 09 11:30:10.750988 2026] [:error] [pid 9293:tid 9315] [client 147.135.252.182:43822] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "af6qQpR__qEzV5O6Z2Na7gAAANI"]
[Sat May 09 11:30:12.785324 2026] [:error] [pid 9293:tid 9318] [client 147.135.252.182:40066] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "af6qRJR__qEzV5O6Z2Na8wAAANU"]
[Sat May 09 11:30:15.195492 2026] [:error] [pid 9184:tid 9220] [client 147.135.252.182:43824] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "af6qR4jfODqb_i0Fm99-bAAAABc"]
[Sat May 09 11:30:17.684561 2026] [:error] [pid 9187:tid 9256] [client 147.135.252.182:59518] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af6qSRC7An6gkXsRsaFNeAAAAIM"]
[Sat May 09 11:30:19.761077 2026] [:error] [pid 9293:tid 9305] [client 147.135.252.182:45716] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "af6qS5R__qEzV5O6Z2NbEQAAAMg"]
[Sat May 09 11:30:22.379907 2026] [:error] [pid 9760:tid 9779] [client 147.135.252.182:59526] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "af6qTmIkCp-C_fh0s7IteQAAAU0"]
[Sat May 09 11:30:24.421613 2026] [:error] [pid 9293:tid 9308] [client 147.135.252.182:45726] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "af6qUJR__qEzV5O6Z2NbHQAAAMs"]
[Sat May 09 11:30:26.821893 2026] [:error] [pid 9293:tid 9316] [client 147.135.252.182:59540] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "af6qUpR__qEzV5O6Z2NbJwAAANM"]
[Sat May 09 11:30:29.293099 2026] [:error] [pid 9920:tid 9939] [client 147.135.252.182:48018] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af6qVUxitGYhlzgZb5av_gAAAdE"]
[Sat May 09 11:30:31.268590 2026] [:error] [pid 9186:tid 9242] [client 147.135.252.182:57006] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "af6qVxW4eFOEw1mKOgKw0wAAAFA"]
[Sat May 09 11:30:33.639742 2026] [:error] [pid 9833:tid 9844] [client 147.135.252.182:48032] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "af6qWSM9JmxIS0KGZUBj7AAAAYY"]
[Sat May 09 11:30:35.768973 2026] [:error] [pid 9920:tid 9922] [client 147.135.252.182:57020] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "af6qW0xitGYhlzgZb5awAgAAAcA"]
[Sat May 09 11:30:37.576089 2026] [:error] [pid 9184:tid 9198] [client 147.135.252.182:38488] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "af6qXYjfODqb_i0Fm99-bwAAAAE"]
[Sat May 09 11:30:40.120804 2026] [:error] [pid 9293:tid 9307] [client 147.135.252.182:48874] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "af6qYJR__qEzV5O6Z2NbMAAAAMo"]
[Sat May 09 11:30:42.031551 2026] [:error] [pid 9186:tid 9242] [client 147.135.252.182:38496] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "af6qYhW4eFOEw1mKOgKw2gAAAFA"]
[Sat May 09 11:30:44.568492 2026] [:error] [pid 9184:tid 9200] [client 147.135.252.182:48878] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "af6qZIjfODqb_i0Fm99-cQAAAAM"]
[Sat May 09 11:30:46.539079 2026] [:error] [pid 9187:tid 9253] [client 147.135.252.182:38504] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "af6qZhC7An6gkXsRsaFNkAAAAIA"]
[Sat May 09 11:30:49.039549 2026] [:error] [pid 9920:tid 9938] [client 147.135.252.182:46466] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "af6qaUxitGYhlzgZb5awCwAAAdA"]
[Sat May 09 11:30:50.972985 2026] [:error] [pid 9187:tid 9274] [client 147.135.252.182:46142] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "af6qahC7An6gkXsRsaFNmgAAAJU"]
[Sat May 09 11:31:13.935581 2026] [:error] [pid 9293:tid 9313] [client 147.135.252.182:46470] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af6qgZR__qEzV5O6Z2NbfAAAANA"]
[Sat May 09 11:31:16.522775 2026] [:error] [pid 9186:tid 9239] [client 147.135.252.182:33016] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af6qhBW4eFOEw1mKOgKw4wAAAE0"]
[Sat May 09 11:31:19.198539 2026] [:error] [pid 9920:tid 9923] [client 147.135.252.182:48850] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af6qh0xitGYhlzgZb5awEwAAAcE"]
[Sat May 09 11:31:21.879667 2026] [:error] [pid 9663:tid 9676] [client 147.135.252.182:48862] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "af6qiZcWIu01SCxbjwsOgAAAAQo"]
[Sat May 09 11:31:24.326990 2026] [:error] [pid 9663:tid 9685] [client 147.135.252.182:48876] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "af6qjJcWIu01SCxbjwsOggAAARM"]
[Sat May 09 11:31:27.265575 2026] [:error] [pid 9293:tid 9306] [client 147.135.252.182:44810] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "af6qj5R__qEzV5O6Z2NbgAAAAMk"]
[Sat May 09 11:31:31.013896 2026] [:error] [pid 9293:tid 9298] [client 147.135.252.182:44826] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "af6qk5R__qEzV5O6Z2NblAAAAME"]
[Sat May 09 13:46:57.805726 2026] [:error] [pid 9760:tid 9787] [client 51.77.216.81:41246] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "af7KUWIkCp-C_fh0s7I6PAAAAVU"]
[Sat May 09 13:47:00.093993 2026] [:error] [pid 9663:tid 9682] [client 51.77.216.81:42126] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "af7KVJcWIu01SCxbjwsmCwAAARA"]
[Sat May 09 13:47:02.122605 2026] [:error] [pid 9187:tid 9253] [client 51.77.216.81:42140] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "af7KVhC7An6gkXsRsaF1tgAAAIA"]
[Sat May 09 13:47:04.821276 2026] [:error] [pid 9920:tid 9934] [client 51.77.216.81:36984] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af7KWExitGYhlzgZb5bNBQAAAcw"]
[Sat May 09 13:47:07.020664 2026] [:error] [pid 9187:tid 9272] [client 51.77.216.81:42150] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "af7KWxC7An6gkXsRsaF1wQAAAJM"]
[Sat May 09 13:47:09.438013 2026] [:error] [pid 9293:tid 9313] [client 51.77.216.81:33392] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "af7KXZR__qEzV5O6Z2OCvwAAANA"]
[Sat May 09 13:47:12.065571 2026] [:error] [pid 9186:tid 9248] [client 51.77.216.81:53924] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "af7KYBW4eFOEw1mKOgLCoAAAAFY"]
[Sat May 09 13:47:14.226333 2026] [:error] [pid 9293:tid 9304] [client 51.77.216.81:33394] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af7KYpR__qEzV5O6Z2OCxgAAAMc"]
[Sat May 09 13:47:17.150391 2026] [:error] [pid 9293:tid 9309] [client 51.77.216.81:53938] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af7KZZR__qEzV5O6Z2OCyQAAAMw"]
[Sat May 09 13:47:19.440929 2026] [:error] [pid 9833:tid 9852] [client 51.77.216.81:35900] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "af7KZyM9JmxIS0KGZUBzVwAAAY4"]
[Sat May 09 13:47:22.108981 2026] [:error] [pid 9920:tid 9944] [client 51.77.216.81:42046] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "af7KakxitGYhlzgZb5bNHQAAAdY"]
[Sat May 09 13:47:24.074159 2026] [:error] [pid 9920:tid 9927] [client 51.77.216.81:35910] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "af7KbExitGYhlzgZb5bNKAAAAcU"]
[Sat May 09 13:47:26.337184 2026] [:error] [pid 9760:tid 9780] [client 51.77.216.81:35922] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "af7KbmIkCp-C_fh0s7I6RQAAAU4"]
[Sat May 09 13:47:29.211539 2026] [:error] [pid 9186:tid 9243] [client 51.77.216.81:42048] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "af7KcRW4eFOEw1mKOgLCsQAAAFE"]
[Sat May 09 13:47:31.262115 2026] [:error] [pid 9663:tid 9686] [client 51.77.216.81:58082] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "af7Kc5cWIu01SCxbjwsmDgAAARQ"]
[Sat May 09 13:47:33.265754 2026] [:error] [pid 9760:tid 9779] [client 51.77.216.81:58088] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "af7KdWIkCp-C_fh0s7I6TAAAAU0"]
[Sat May 09 13:47:36.317682 2026] [:error] [pid 9663:tid 9678] [client 51.77.216.81:47772] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af7KeJcWIu01SCxbjwsmEQAAAQw"]
[Sat May 09 13:47:38.474064 2026] [:error] [pid 9187:tid 9256] [client 51.77.216.81:58098] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af7KehC7An6gkXsRsaF14wAAAIM"]
[Sat May 09 13:47:41.088891 2026] [:error] [pid 9187:tid 9273] [client 51.77.216.81:60414] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af7KfRC7An6gkXsRsaF16gAAAJQ"]
[Sat May 09 13:47:43.197310 2026] [:error] [pid 9833:tid 9857] [client 51.77.216.81:33604] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "af7KfyM9JmxIS0KGZUBzawAAAZM"]
[Sat May 09 13:47:45.247783 2026] [:error] [pid 9293:tid 9297] [client 51.77.216.81:33608] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "af7KgZR__qEzV5O6Z2OC2wAAAMA"]
[Sat May 09 13:47:47.434920 2026] [:error] [pid 9187:tid 9260] [client 51.77.216.81:33618] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "af7KgxC7An6gkXsRsaF18QAAAIc"]
[Sat May 09 13:47:49.466926 2026] [:error] [pid 9920:tid 9937] [client 51.77.216.81:41986] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "af7KhUxitGYhlzgZb5bNPQAAAc8"]
[Sat May 09 13:47:51.521368 2026] [:error] [pid 9920:tid 9946] [client 51.77.216.81:41990] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "af7Kh0xitGYhlzgZb5bNPgAAAdg"]
[Sat May 09 13:47:53.740024 2026] [:error] [pid 9293:tid 9308] [client 51.77.216.81:42000] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "af7KiZR__qEzV5O6Z2OC5QAAAMs"]
[Sat May 09 13:48:18.204072 2026] [:error] [pid 9187:tid 9266] [client 51.77.216.81:33252] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "af7KohC7An6gkXsRsaF2DwAAAI0"]
[Sat May 09 13:48:20.626818 2026] [:error] [pid 9293:tid 9299] [client 51.77.216.81:57530] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "af7KpJR__qEzV5O6Z2ODBgAAAMI"]
[Sat May 09 13:48:23.181589 2026] [:error] [pid 9187:tid 9270] [client 51.77.216.81:57542] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "af7KpxC7An6gkXsRsaF2FwAAAJE"]
[Sat May 09 13:48:25.426724 2026] [:error] [pid 9293:tid 9300] [client 51.77.216.81:57548] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "af7KqZR__qEzV5O6Z2ODGAAAAMM"]
[Sat May 09 13:48:27.478395 2026] [:error] [pid 9293:tid 9301] [client 51.77.216.81:57554] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "af7Kq5R__qEzV5O6Z2ODIgAAAMQ"]
[Sat May 09 13:48:29.812677 2026] [:error] [pid 9760:tid 9776] [client 51.77.216.81:33732] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af7KrWIkCp-C_fh0s7I6YAAAAUo"]
[Sat May 09 13:48:32.127479 2026] [:error] [pid 9833:tid 9853] [client 51.77.216.81:33742] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "af7KsCM9JmxIS0KGZUBzhQAAAY8"]
[Sat May 09 13:48:34.234017 2026] [:error] [pid 9186:tid 9238] [client 51.77.216.81:33746] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "af7KshW4eFOEw1mKOgLC7wAAAEw"]
[Sat May 09 13:48:36.853560 2026] [:error] [pid 9187:tid 9273] [client 51.77.216.81:33748] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af7KtBC7An6gkXsRsaF2LgAAAJQ"]
[Sat May 09 13:48:39.374010 2026] [:error] [pid 9187:tid 9256] [client 51.77.216.81:52500] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "af7KtxC7An6gkXsRsaF2OAAAAIM"]
[Sat May 09 13:48:41.396297 2026] [:error] [pid 9833:tid 9856] [client 51.77.216.81:52516] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "af7KuSM9JmxIS0KGZUBziwAAAZI"]
[Sat May 09 13:48:43.492746 2026] [:error] [pid 9293:tid 9317] [client 51.77.216.81:52532] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "af7Ku5R__qEzV5O6Z2ODLQAAANQ"]
[Sat May 09 13:48:45.691365 2026] [:error] [pid 9184:tid 9200] [client 51.77.216.81:52548] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af7KvYjfODqb_i0Fm9-KeAAAAAM"]
[Sat May 09 13:48:47.888550 2026] [:error] [pid 9187:tid 9276] [client 51.77.216.81:52560] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "af7KvxC7An6gkXsRsaF2PgAAAJc"]
[Sat May 09 13:48:50.373249 2026] [:error] [pid 9187:tid 9275] [client 51.77.216.81:38088] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "af7KwhC7An6gkXsRsaF2QwAAAJY"]
[Sat May 09 13:48:52.565071 2026] [:error] [pid 9187:tid 9272] [client 51.77.216.81:38100] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "af7KxBC7An6gkXsRsaF2SQAAAJM"]
[Sat May 09 13:48:55.118768 2026] [:error] [pid 9920:tid 9943] [client 51.77.216.81:38112] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "af7Kx0xitGYhlzgZb5bNbAAAAdU"]
[Sat May 09 13:48:57.009554 2026] [:error] [pid 9920:tid 9937] [client 51.77.216.81:38124] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "af7KyUxitGYhlzgZb5bNcwAAAc8"]
[Sat May 09 13:48:59.332927 2026] [:error] [pid 9187:tid 9260] [client 51.77.216.81:57276] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "af7KyxC7An6gkXsRsaF2TwAAAIc"]
[Sat May 09 13:49:01.702283 2026] [:error] [pid 9293:tid 9307] [client 51.77.216.81:57278] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "af7KzZR__qEzV5O6Z2ODSAAAAMo"]
[Sat May 09 13:49:04.074587 2026] [:error] [pid 9187:tid 9271] [client 51.77.216.81:57288] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af7K0BC7An6gkXsRsaF2WQAAAJI"]
[Sat May 09 13:49:06.135421 2026] [:error] [pid 9187:tid 9257] [client 51.77.216.81:57296] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "af7K0hC7An6gkXsRsaF2XgAAAIQ"]
[Sat May 09 13:49:08.367156 2026] [:error] [pid 9293:tid 9302] [client 51.77.216.81:57298] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "af7K1JR__qEzV5O6Z2ODUAAAAMU"]
[Sat May 09 13:49:10.664478 2026] [:error] [pid 9187:tid 9275] [client 51.77.216.81:36502] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "af7K1hC7An6gkXsRsaF2bQAAAJY"]
[Sat May 09 13:49:13.059739 2026] [:error] [pid 9293:tid 9297] [client 51.77.216.81:36510] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "af7K2ZR__qEzV5O6Z2ODXQAAAMA"]
[Sat May 09 13:49:15.314646 2026] [:error] [pid 9920:tid 9929] [client 51.77.216.81:36520] [client 51.77.216.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af7K20xitGYhlzgZb5bNfAAAAcc"]
[Sat May 09 16:12:53.614680 2026] [:error] [pid 9184:tid 9203] [client 147.135.253.47:55544] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "af7shYjfODqb_i0Fm9-WoAAAAAY"]
[Sat May 09 16:12:55.426370 2026] [:error] [pid 9187:tid 9255] [client 147.135.253.47:57906] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "af7shxC7An6gkXsRsaGqAwAAAII"]
[Sat May 09 16:12:57.758947 2026] [:error] [pid 9293:tid 9315] [client 147.135.253.47:46438] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "af7siZR__qEzV5O6Z2OtIwAAANI"]
[Sat May 09 16:12:59.783221 2026] [:error] [pid 9293:tid 9305] [client 147.135.253.47:48636] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "af7si5R__qEzV5O6Z2OtJwAAAMg"]
[Sat May 09 16:13:02.169157 2026] [:error] [pid 9187:tid 9258] [client 147.135.253.47:46444] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "af7sjhC7An6gkXsRsaGqBgAAAIU"]
[Sat May 09 16:13:04.208255 2026] [:error] [pid 9663:tid 9686] [client 147.135.253.47:48640] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "af7skJcWIu01SCxbjws88gAAARQ"]
[Sat May 09 16:13:06.124028 2026] [:error] [pid 9293:tid 9320] [client 147.135.253.47:48648] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "af7skpR__qEzV5O6Z2OtMQAAANc"]
[Sat May 09 16:13:08.396364 2026] [:error] [pid 9293:tid 9306] [client 147.135.253.47:40000] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af7slJR__qEzV5O6Z2OtNgAAAMk"]
[Sat May 09 16:13:10.935292 2026] [:error] [pid 9920:tid 9945] [client 147.135.253.47:40004] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af7slkxitGYhlzgZb5brSAAAAdc"]
[Sat May 09 16:13:13.467711 2026] [:error] [pid 9920:tid 9931] [client 147.135.253.47:40020] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "af7smUxitGYhlzgZb5brTwAAAck"]
[Sat May 09 16:13:15.365821 2026] [:error] [pid 9920:tid 9937] [client 147.135.253.47:56828] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "af7sm0xitGYhlzgZb5brUgAAAc8"]
[Sat May 09 16:13:17.767028 2026] [:error] [pid 9760:tid 9777] [client 147.135.253.47:51368] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af7snWIkCp-C_fh0s7JIwAAAAUs"]
[Sat May 09 16:13:19.806387 2026] [:error] [pid 9663:tid 9675] [client 147.135.253.47:48306] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "af7sn5cWIu01SCxbjws89AAAAQk"]
[Sat May 09 16:13:21.706109 2026] [:error] [pid 9293:tid 9309] [client 147.135.253.47:48314] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "af7soZR__qEzV5O6Z2OtRwAAAMw"]
[Sat May 09 16:13:23.627363 2026] [:error] [pid 9920:tid 9929] [client 147.135.253.47:48328] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "af7so0xitGYhlzgZb5brZgAAAcc"]
[Sat May 09 16:13:26.172966 2026] [:error] [pid 9920:tid 9936] [client 147.135.253.47:51372] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "af7spkxitGYhlzgZb5brbQAAAc4"]
[Sat May 09 16:13:28.548925 2026] [:error] [pid 9663:tid 9678] [client 147.135.253.47:58344] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af7sqJcWIu01SCxbjws8_AAAAQw"]
[Sat May 09 16:13:31.098768 2026] [:error] [pid 9187:tid 9269] [client 147.135.253.47:58358] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af7sqxC7An6gkXsRsaGqFgAAAJA"]
[Sat May 09 16:13:33.492606 2026] [:error] [pid 9187:tid 9260] [client 147.135.253.47:58366] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "af7srRC7An6gkXsRsaGqGwAAAIc"]
[Sat May 09 16:13:35.539615 2026] [:error] [pid 9293:tid 9303] [client 147.135.253.47:38582] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "af7sr5R__qEzV5O6Z2OtZwAAAMY"]
[Sat May 09 16:13:37.928462 2026] [:error] [pid 9187:tid 9266] [client 147.135.253.47:50996] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "af7ssRC7An6gkXsRsaGqIQAAAI0"]
[Sat May 09 16:13:40.484211 2026] [:error] [pid 9187:tid 9254] [client 147.135.253.47:50998] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af7stBC7An6gkXsRsaGqJAAAAIE"]
[Sat May 09 16:13:43.016168 2026] [:error] [pid 9920:tid 9930] [client 147.135.253.47:51000] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "af7st0xitGYhlzgZb5brfwAAAcg"]
[Sat May 09 16:13:45.399745 2026] [:error] [pid 9920:tid 9933] [client 147.135.253.47:51004] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "af7suUxitGYhlzgZb5brhAAAAcs"]
[Sat May 09 16:13:47.446098 2026] [:error] [pid 9920:tid 9922] [client 147.135.253.47:55734] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "af7su0xitGYhlzgZb5brhwAAAcA"]
[Sat May 09 16:13:49.992210 2026] [:error] [pid 9187:tid 9271] [client 147.135.253.47:44058] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "af7svRC7An6gkXsRsaGqJgAAAJI"]
[Sat May 09 16:14:13.132300 2026] [:error] [pid 9920:tid 9942] [client 147.135.253.47:44070] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af7s1UxitGYhlzgZb5brrgAAAdQ"]
[Sat May 09 16:14:15.429476 2026] [:error] [pid 9186:tid 9238] [client 147.135.253.47:51056] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "af7s1xW4eFOEw1mKOgLYjAAAAEw"]
[Sat May 09 16:14:17.928520 2026] [:error] [pid 9186:tid 9233] [client 147.135.253.47:36506] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "af7s2RW4eFOEw1mKOgLYjQAAAEc"]
[Sat May 09 16:14:19.797043 2026] [:error] [pid 9187:tid 9253] [client 147.135.253.47:49912] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "af7s2xC7An6gkXsRsaGqOAAAAIA"]
[Sat May 09 16:14:22.162892 2026] [:error] [pid 9186:tid 9227] [client 147.135.253.47:36522] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "af7s3hW4eFOEw1mKOgLYjgAAAEE"]
[Sat May 09 16:14:24.178300 2026] [:error] [pid 9184:tid 9210] [client 147.135.253.47:49916] [client 147.135.253.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "af7s4IjfODqb_i0Fm9-WtwAAAA0"]
[Sat May 09 18:19:08.285738 2026] [:error] [pid 9293:tid 9313] [client 43.156.156.96:51528] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "af8KHJR__qEzV5O6Z2PPoAAAANA"]
[Sat May 09 19:12:20.633548 2026] [:error] [pid 9186:tid 9248] [client 146.56.199.139:37356] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af8WlBW4eFOEw1mKOgLu6wAAAFY"]
[Sat May 09 19:34:39.637283 2026] [:error] [pid 9293:tid 9302] [client 43.130.31.17:45596] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af8bz5R__qEzV5O6Z2PjjAAAAMU"]
[Sat May 09 20:16:32.396450 2026] [:error] [pid 55186:tid 55272] [client 191.5.48.88:30587] [client 191.5.48.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.5.48.88, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "af8loJPIspqZdXg7QQuftQAAAFc"]
[Sat May 09 20:16:32.407420 2026] [proxy_fcgi:error] [pid 55186:tid 55272] [client 191.5.48.88:30587] AH01071: Got error 'Primary script unknown'
[Sun May 10 03:13:43.479715 2026] [:error] [pid 55182:tid 55234] [client 49.51.233.95:51032] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "af-HZzaxmP-S8ASrqQkC4QAAANY"]
[Sun May 10 03:55:41.061415 2026] [:error] [pid 62801:tid 62818] [client 104.234.53.159:65433] [client 104.234.53.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.159, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "af-RPRMFDul6kZmcchAgpQAAAAg"]
[Sun May 10 03:55:41.077387 2026] [proxy_fcgi:error] [pid 62801:tid 62818] [client 104.234.53.159:65433] AH01071: Got error 'Primary script unknown'
[Sun May 10 05:09:49.756685 2026] [:error] [pid 62910:tid 62919] [client 49.51.50.147:48394] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "af-ind5YAy_h5VqgWqhTUQAAAMc"]
[Sun May 10 08:44:39.756223 2026] [:error] [pid 46417:tid 46427] [client 175.27.171.245:43414] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "af_U92Inm7mhwgbe48ZrsgAAAQg"]
[Sun May 10 09:16:28.251017 2026] [:error] [pid 46330:tid 46381] [client 62.84.185.69:13434] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "af_cbIztrhd3evDQvs8-OAAAAEg"]
[Sun May 10 09:16:30.856489 2026] [:error] [pid 46417:tid 46430] [client 62.84.185.69:13448] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "af_cbmInm7mhwgbe48ZyYQAAAQs"]
[Sun May 10 09:16:33.460675 2026] [:error] [pid 46417:tid 46429] [client 62.84.185.69:13454] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "af_ccWInm7mhwgbe48ZyYgAAAQo"]
[Sun May 10 09:16:35.946747 2026] [:error] [pid 46417:tid 46421] [client 62.84.185.69:19254] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "af_cc2Inm7mhwgbe48ZyZQAAAQI"]
[Sun May 10 09:32:39.332874 2026] [:error] [pid 46331:tid 46388] [client 51.83.6.238:59530] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "af_gNwP02hpYETwsZpgaawAAAI4"]
[Sun May 10 09:32:41.000291 2026] [:error] [pid 52634:tid 52638] [client 51.83.6.238:48538] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "af_gONwp8XoWCwFb54CjkwAAAMA"]
[Sun May 10 09:32:43.312251 2026] [:error] [pid 52634:tid 52661] [client 51.83.6.238:44844] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "af_gO9wp8XoWCwFb54CjlwAAANc"]
[Sun May 10 09:32:45.348628 2026] [:error] [pid 46417:tid 46437] [client 51.83.6.238:49244] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "af_gPWInm7mhwgbe48Z1LgAAARI"]
[Sun May 10 09:32:47.734068 2026] [:error] [pid 46331:tid 46372] [client 51.83.6.238:44854] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "af_gPwP02hpYETwsZpgabgAAAIc"]
[Sun May 10 09:32:49.754862 2026] [:error] [pid 46417:tid 46426] [client 51.83.6.238:39940] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "af_gQWInm7mhwgbe48Z1MQAAAQc"]
[Sun May 10 09:32:51.666451 2026] [:error] [pid 46417:tid 46436] [client 51.83.6.238:39948] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "af_gQ2Inm7mhwgbe48Z1NAAAARE"]
[Sun May 10 09:32:54.028205 2026] [:error] [pid 46330:tid 46411] [client 51.83.6.238:60784] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af_gRoztrhd3evDQvs9A2QAAAFc"]
[Sun May 10 09:32:56.530401 2026] [:error] [pid 46329:tid 46338] [client 51.83.6.238:60794] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af_gSOFo7Z2I88d0gPJWzAAAAAU"]
[Sun May 10 09:32:59.016912 2026] [:error] [pid 46330:tid 46409] [client 51.83.6.238:60808] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "af_gS4ztrhd3evDQvs9A3QAAAFU"]
[Sun May 10 09:33:01.040299 2026] [:error] [pid 46329:tid 46341] [client 51.83.6.238:48134] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "af_gTeFo7Z2I88d0gPJW0QAAAAg"]
[Sun May 10 09:33:03.577487 2026] [:error] [pid 52634:tid 52661] [client 51.83.6.238:50704] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af_gT9wp8XoWCwFb54CjwAAAANc"]
[Sun May 10 09:33:05.585924 2026] [:error] [pid 46417:tid 46427] [client 51.83.6.238:48142] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "af_gUWInm7mhwgbe48Z1PQAAAQg"]
[Sun May 10 09:33:07.455619 2026] [:error] [pid 46330:tid 46376] [client 51.83.6.238:48152] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "af_gU4ztrhd3evDQvs9A4wAAAEU"]
[Sun May 10 09:33:09.486344 2026] [:error] [pid 52634:tid 52658] [client 51.83.6.238:46914] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "af_gVdwp8XoWCwFb54CjxgAAANQ"]
[Sun May 10 09:33:11.848018 2026] [:error] [pid 46330:tid 46412] [client 51.83.6.238:57270] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "af_gV4ztrhd3evDQvs9A5gAAAFg"]
[Sun May 10 09:33:14.343488 2026] [:error] [pid 46329:tid 46346] [client 51.83.6.238:57278] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af_gWuFo7Z2I88d0gPJW3QAAAA0"]
[Sun May 10 09:33:16.833701 2026] [:error] [pid 46331:tid 46403] [client 51.83.6.238:57290] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af_gXAP02hpYETwsZpgafQAAAJY"]
[Sun May 10 09:33:19.349226 2026] [:error] [pid 46329:tid 46340] [client 51.83.6.238:57302] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "af_gX-Fo7Z2I88d0gPJW3wAAAAc"]
[Sun May 10 09:33:21.349070 2026] [:error] [pid 52634:tid 52644] [client 51.83.6.238:38322] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "af_gYdwp8XoWCwFb54Cj2wAAAMY"]
[Sun May 10 09:33:23.847438 2026] [:error] [pid 46330:tid 46400] [client 51.83.6.238:49964] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "af_gY4ztrhd3evDQvs9A6QAAAFE"]
[Sun May 10 09:33:26.343136 2026] [:error] [pid 46417:tid 46430] [client 51.83.6.238:49968] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "af_gZmInm7mhwgbe48Z1SwAAAQs"]
[Sun May 10 09:33:28.662368 2026] [:error] [pid 46330:tid 46409] [client 51.83.6.238:49980] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "af_gaIztrhd3evDQvs9A7AAAAFU"]
[Sun May 10 09:33:31.158614 2026] [:error] [pid 46417:tid 46423] [client 51.83.6.238:34062] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "af_ga2Inm7mhwgbe48Z1VgAAAQQ"]
[Sun May 10 09:33:32.991616 2026] [:error] [pid 52634:tid 52652] [client 51.83.6.238:54714] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "af_gbNwp8XoWCwFb54Cj5QAAAM4"]
[Sun May 10 09:33:35.492567 2026] [:error] [pid 46329:tid 46348] [client 51.83.6.238:34064] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "af_gb-Fo7Z2I88d0gPJW5wAAAA8"]
[Sun May 10 09:33:58.667811 2026] [:error] [pid 52634:tid 52656] [client 51.83.6.238:53756] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af_ghtwp8XoWCwFb54CkEgAAANI"]
[Sun May 10 09:34:01.097198 2026] [:error] [pid 46331:tid 46375] [client 51.83.6.238:34782] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "af_giQP02hpYETwsZpgahwAAAIg"]
[Sun May 10 09:34:03.598069 2026] [:error] [pid 46329:tid 46346] [client 51.83.6.238:34792] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "af_gi-Fo7Z2I88d0gPJW-AAAAA0"]
[Sun May 10 09:34:05.579643 2026] [:error] [pid 46331:tid 46399] [client 51.83.6.238:49580] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "af_gjQP02hpYETwsZpgakAAAAJQ"]
[Sun May 10 09:34:08.071066 2026] [:error] [pid 46331:tid 46385] [client 51.83.6.238:34808] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "af_gkAP02hpYETwsZpgakQAAAIw"]
[Sun May 10 09:34:09.905718 2026] [:error] [pid 46331:tid 46367] [client 51.83.6.238:44476] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "af_gkQP02hpYETwsZpgalAAAAIU"]
[Sun May 10 10:36:23.951304 2026] [:error] [pid 52634:tid 52642] [client 62.84.185.60:56346] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af_vJ9wp8XoWCwFb54C1YQAAAMQ"]
[Sun May 10 10:36:26.171175 2026] [:error] [pid 46417:tid 46435] [client 62.84.185.60:56360] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af_vKmInm7mhwgbe48aB2QAAARA"]
[Sun May 10 10:36:28.216854 2026] [:error] [pid 46331:tid 46386] [client 62.84.185.60:56366] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af_vLAP02hpYETwsZpgh4AAAAI0"]
[Sun May 10 10:36:30.065500 2026] [:error] [pid 52634:tid 52639] [client 62.84.185.60:56380] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af_vLtwp8XoWCwFb54C1dAAAAME"]
[Sun May 10 10:36:32.110533 2026] [:error] [pid 46331:tid 46405] [client 62.84.185.60:21264] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af_vMAP02hpYETwsZpgh4wAAAJc"]
[Sun May 10 10:36:34.145763 2026] [:error] [pid 52634:tid 52638] [client 62.84.185.60:21266] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af_vMtwp8XoWCwFb54C1ewAAAMA"]
[Sun May 10 10:36:36.160933 2026] [:error] [pid 52634:tid 52649] [client 62.84.185.60:21268] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af_vNNwp8XoWCwFb54C1gAAAAMs"]
[Sun May 10 10:36:38.374907 2026] [:error] [pid 52634:tid 52660] [client 62.84.185.60:21284] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af_vNtwp8XoWCwFb54C1iAAAANY"]
[Sun May 10 10:36:40.657694 2026] [:error] [pid 46329:tid 46334] [client 62.84.185.60:21300] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af_vOOFo7Z2I88d0gPJd3wAAAAE"]
[Sun May 10 10:36:42.868380 2026] [:error] [pid 46329:tid 46344] [client 62.84.185.60:1644] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af_vOuFo7Z2I88d0gPJd4QAAAAs"]
[Sun May 10 10:36:44.951489 2026] [:error] [pid 46329:tid 46351] [client 62.84.185.60:1656] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af_vPOFo7Z2I88d0gPJd5gAAABI"]
[Sun May 10 10:36:46.998740 2026] [:error] [pid 52634:tid 52649] [client 62.84.185.60:1672] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af_vPtwp8XoWCwFb54C1mQAAAMs"]
[Sun May 10 10:36:49.100841 2026] [:error] [pid 52634:tid 52655] [client 62.84.185.60:1676] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af_vQdwp8XoWCwFb54C1ngAAANE"]
[Sun May 10 10:36:51.182200 2026] [:error] [pid 46329:tid 46336] [client 62.84.185.60:65258] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af_vQ-Fo7Z2I88d0gPJd5wAAAAM"]
[Sun May 10 10:36:53.310780 2026] [:error] [pid 52634:tid 52638] [client 62.84.185.60:65272] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af_vRdwp8XoWCwFb54C1zQAAAMA"]
[Sun May 10 10:36:55.559515 2026] [:error] [pid 46417:tid 46424] [client 62.84.185.60:65288] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "af_vR2Inm7mhwgbe48aB_wAAAQU"]
[Sun May 10 10:36:57.620691 2026] [:error] [pid 46329:tid 46353] [client 62.84.185.60:65292] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af_vSeFo7Z2I88d0gPJd6QAAABQ"]
[Sun May 10 10:36:59.705563 2026] [:error] [pid 46417:tid 46422] [client 62.84.185.60:65304] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af_vS2Inm7mhwgbe48aCBQAAAQM"]
[Sun May 10 10:37:01.786080 2026] [:error] [pid 46330:tid 46376] [client 62.84.185.60:55106] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af_vTYztrhd3evDQvs9LkgAAAEU"]
[Sun May 10 10:37:04.035542 2026] [:error] [pid 52634:tid 52653] [client 62.84.185.60:55118] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af_vUNwp8XoWCwFb54C14AAAAM8"]
[Sun May 10 10:37:06.127070 2026] [:error] [pid 46417:tid 46440] [client 62.84.185.60:55128] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af_vUmInm7mhwgbe48aCDgAAARU"]
[Sun May 10 10:37:08.271319 2026] [:error] [pid 52634:tid 52648] [client 62.84.185.60:55144] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af_vVNwp8XoWCwFb54C15AAAAMo"]
[Sun May 10 10:37:10.286510 2026] [:error] [pid 46330:tid 46389] [client 62.84.185.60:55154] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "af_vVoztrhd3evDQvs9LmgAAAEw"]
[Sun May 10 10:37:12.343806 2026] [:error] [pid 46331:tid 46395] [client 62.84.185.60:24976] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af_vWAP02hpYETwsZpgiDwAAAJI"]
[Sun May 10 10:37:14.461862 2026] [:error] [pid 46331:tid 46380] [client 62.84.185.60:24986] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af_vWgP02hpYETwsZpgiEQAAAIo"]
[Sun May 10 10:37:16.651133 2026] [:error] [pid 46417:tid 46424] [client 62.84.185.60:24988] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af_vXGInm7mhwgbe48aCFQAAAQU"]
[Sun May 10 10:37:18.692484 2026] [:error] [pid 46330:tid 46412] [client 62.84.185.60:24992] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "af_vXoztrhd3evDQvs9LoAAAAFg"]
[Sun May 10 10:37:20.846548 2026] [:error] [pid 52634:tid 52650] [client 62.84.185.60:25002] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "af_vYNwp8XoWCwFb54C18AAAAMw"]
[Sun May 10 10:37:45.105207 2026] [:error] [pid 46331:tid 46367] [client 62.84.185.60:34134] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af_veQP02hpYETwsZpgiJAAAAIU"]
[Sun May 10 10:37:47.237974 2026] [:error] [pid 46330:tid 46369] [client 62.84.185.60:34146] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af_ve4ztrhd3evDQvs9LsgAAAEE"]
[Sun May 10 10:37:49.253885 2026] [:error] [pid 46417:tid 46443] [client 62.84.185.60:34156] [client 62.84.185.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af_vfWInm7mhwgbe48aCJAAAARg"]
[Sun May 10 11:17:43.528718 2026] [:error] [pid 52634:tid 52645] [client 62.171.179.32:42362] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "af_419wp8XoWCwFb54C_OwAAAMc"]
[Sun May 10 11:17:45.705983 2026] [:error] [pid 46329:tid 46344] [client 62.171.179.32:44772] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "af_42eFo7Z2I88d0gPJhKwAAAAs"]
[Sun May 10 11:17:47.839028 2026] [:error] [pid 46417:tid 46433] [client 62.171.179.32:44788] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "af_422Inm7mhwgbe48aIuAAAAQ4"]
[Sun May 10 11:17:49.960734 2026] [:error] [pid 46417:tid 46430] [client 62.171.179.32:44796] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "af_43WInm7mhwgbe48aIvAAAAQs"]
[Sun May 10 11:17:52.163247 2026] [:error] [pid 46331:tid 46363] [client 62.171.179.32:44800] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "af_44AP02hpYETwsZpglzwAAAII"]
[Sun May 10 11:17:54.381523 2026] [:error] [pid 46417:tid 46437] [client 62.171.179.32:56172] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "af_44mInm7mhwgbe48aIxQAAARI"]
[Sun May 10 11:17:56.539188 2026] [:error] [pid 52634:tid 52650] [client 62.171.179.32:56176] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "af_45Nwp8XoWCwFb54C_pgAAAMw"]
[Sun May 10 11:17:58.495730 2026] [:error] [pid 46329:tid 46350] [client 62.171.179.32:56178] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "af_45uFo7Z2I88d0gPJhMQAAABE"]
[Sun May 10 11:18:00.668351 2026] [:error] [pid 46417:tid 46438] [client 62.171.179.32:56194] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "af_46GInm7mhwgbe48aIzwAAARM"]
[Sun May 10 11:18:02.903864 2026] [:error] [pid 52634:tid 52649] [client 62.171.179.32:56210] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "af_46twp8XoWCwFb54C_uwAAAMs"]
[Sun May 10 11:18:05.279570 2026] [:error] [pid 46330:tid 46379] [client 62.171.179.32:39230] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "af_47Yztrhd3evDQvs9RjAAAAEc"]
[Sun May 10 11:18:07.603567 2026] [:error] [pid 52634:tid 52645] [client 62.171.179.32:39234] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "af_479wp8XoWCwFb54C_xwAAAMc"]
[Sun May 10 11:18:09.647779 2026] [:error] [pid 46417:tid 46420] [client 62.171.179.32:39250] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "af_48WInm7mhwgbe48aI2QAAAQE"]
[Sun May 10 11:18:11.686302 2026] [:error] [pid 52634:tid 52655] [client 62.171.179.32:39258] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "af_489wp8XoWCwFb54C_zgAAANE"]
[Sun May 10 11:18:13.864295 2026] [:error] [pid 46331:tid 46370] [client 62.171.179.32:33368] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "af_49QP02hpYETwsZpgl4QAAAIY"]
[Sun May 10 11:18:15.964433 2026] [:error] [pid 46330:tid 46391] [client 62.171.179.32:33370] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "af_494ztrhd3evDQvs9RoAAAAE0"]
[Sun May 10 11:18:18.191122 2026] [:error] [pid 46330:tid 46402] [client 62.171.179.32:33384] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "af_4-oztrhd3evDQvs9RogAAAFI"]
[Sun May 10 11:18:20.233724 2026] [:error] [pid 46417:tid 46435] [client 62.171.179.32:33398] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "af_4_GInm7mhwgbe48aI4wAAARA"]
[Sun May 10 11:18:22.319297 2026] [:error] [pid 46417:tid 46430] [client 62.171.179.32:33414] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "af_4_mInm7mhwgbe48aI6QAAAQs"]
[Sun May 10 11:18:24.346541 2026] [:error] [pid 52634:tid 52654] [client 62.171.179.32:47112] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "af_5ANwp8XoWCwFb54C_4wAAANA"]
[Sun May 10 11:18:26.400446 2026] [:error] [pid 46331:tid 46401] [client 62.171.179.32:47120] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "af_5AgP02hpYETwsZpgl6AAAAJU"]
[Sun May 10 11:18:28.432209 2026] [:error] [pid 46329:tid 46356] [client 62.171.179.32:47128] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af_5BOFo7Z2I88d0gPJhOQAAABc"]
[Sun May 10 11:18:30.422586 2026] [:error] [pid 52634:tid 52658] [client 62.171.179.32:47136] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "af_5Btwp8XoWCwFb54C_9gAAANQ"]
[Sun May 10 11:18:32.457595 2026] [:error] [pid 46331:tid 46385] [client 62.171.179.32:47138] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "af_5CAP02hpYETwsZpgl7wAAAIw"]
[Sun May 10 11:18:34.572369 2026] [:error] [pid 52634:tid 52642] [client 62.171.179.32:46948] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "af_5Ctwp8XoWCwFb54C_9wAAAMQ"]
[Sun May 10 11:18:36.598319 2026] [:error] [pid 46330:tid 46404] [client 62.171.179.32:46964] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "af_5DIztrhd3evDQvs9RwAAAAFM"]
[Sun May 10 11:18:38.583250 2026] [:error] [pid 52634:tid 52656] [client 62.171.179.32:46974] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "af_5Dtwp8XoWCwFb54C__wAAANI"]
[Sun May 10 11:18:40.488363 2026] [:error] [pid 46329:tid 46345] [client 62.171.179.32:46986] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "af_5EOFo7Z2I88d0gPJhQgAAAAw"]
[Sun May 10 11:19:00.817378 2026] [:error] [pid 46330:tid 46376] [client 62.171.179.32:46994] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "af_5JIztrhd3evDQvs9R6QAAAEU"]
[Sun May 10 11:19:02.863720 2026] [:error] [pid 46330:tid 46378] [client 62.171.179.32:37668] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "af_5Joztrhd3evDQvs9R6wAAAEY"]
[Sun May 10 11:19:05.059711 2026] [:error] [pid 46331:tid 46372] [client 62.171.179.32:53708] [client 62.171.179.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "af_5KQP02hpYETwsZpgmHAAAAIc"]
[Sun May 10 13:45:48.356610 2026] [:error] [pid 46331:tid 46407] [client 43.167.157.80:38220] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agAbjAP02hpYETwsZpg2lAAAAJg"]
[Sun May 10 15:09:20.120679 2026] [:error] [pid 46331:tid 46372] [client 180.153.236.60:63731] [client 180.153.236.60] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agAvIAP02hpYETwsZphAUAAAAIc"], referer: http://switchcreative.net/
[Sun May 10 16:04:06.792965 2026] [:error] [pid 52634:tid 52662] [client 51.83.6.238:55174] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agA79twp8XoWCwFb54AMAwAAANg"]
[Sun May 10 16:04:08.815584 2026] [:error] [pid 14779:tid 14792] [client 51.83.6.238:46686] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agA7-FXzPaW9Hap8yc8OBQAAAUs"]
[Sun May 10 16:04:10.602834 2026] [:error] [pid 46331:tid 46401] [client 51.83.6.238:48876] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agA7-gP02hpYETwsZphFMwAAAJU"]
[Sun May 10 16:04:12.677632 2026] [:error] [pid 52634:tid 52652] [client 51.83.6.238:48878] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agA7_Nwp8XoWCwFb54AMEAAAAM4"]
[Sun May 10 16:04:14.457074 2026] [:error] [pid 52634:tid 52657] [client 51.83.6.238:48880] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agA7_twp8XoWCwFb54AMEwAAANM"]
[Sun May 10 16:04:16.359545 2026] [:error] [pid 46329:tid 46350] [client 51.83.6.238:48892] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agA8AOFo7Z2I88d0gPKBMwAAABE"]
[Sun May 10 16:04:18.273391 2026] [:error] [pid 46417:tid 46421] [client 51.83.6.238:48898] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agA8AmInm7mhwgbe48a5oQAAAQI"]
[Sun May 10 16:04:20.146867 2026] [:error] [pid 52634:tid 52659] [client 51.83.6.238:33128] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agA8BNwp8XoWCwFb54AMFwAAANU"]
[Sun May 10 16:04:22.162879 2026] [:error] [pid 52634:tid 52651] [client 51.83.6.238:33144] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agA8Btwp8XoWCwFb54AMGgAAAM0"]
[Sun May 10 16:04:24.198733 2026] [:error] [pid 46329:tid 46342] [client 51.83.6.238:33146] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agA8COFo7Z2I88d0gPKBOQAAAAk"]
[Sun May 10 16:04:26.073951 2026] [:error] [pid 46330:tid 46404] [client 51.83.6.238:33158] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agA8Coztrhd3evDQvs96QAAAAFM"]
[Sun May 10 16:04:28.094868 2026] [:error] [pid 46331:tid 46407] [client 51.83.6.238:33168] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agA8DAP02hpYETwsZphFOAAAAJg"]
[Sun May 10 16:04:30.121643 2026] [:error] [pid 52634:tid 52660] [client 51.83.6.238:58428] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agA8Dtwp8XoWCwFb54AMHgAAANY"]
[Sun May 10 16:04:31.978930 2026] [:error] [pid 46331:tid 46397] [client 51.83.6.238:58444] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agA8DwP02hpYETwsZphFOgAAAJM"]
[Sun May 10 16:04:34.019653 2026] [:error] [pid 46329:tid 46350] [client 51.83.6.238:58450] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agA8EuFo7Z2I88d0gPKBPQAAABE"]
[Sun May 10 16:04:35.880470 2026] [:error] [pid 46330:tid 46391] [client 51.83.6.238:58454] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agA8E4ztrhd3evDQvs96YgAAAE0"]
[Sun May 10 16:04:37.884272 2026] [:error] [pid 46329:tid 46353] [client 51.83.6.238:58466] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agA8FeFo7Z2I88d0gPKBRgAAABQ"]
[Sun May 10 16:04:39.907355 2026] [:error] [pid 46417:tid 46433] [client 51.83.6.238:48534] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agA8F2Inm7mhwgbe48a5pQAAAQ4"]
[Sun May 10 16:04:41.915531 2026] [:error] [pid 46329:tid 46347] [client 51.83.6.238:48544] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agA8GeFo7Z2I88d0gPKBVgAAAA4"]
[Sun May 10 16:04:43.933776 2026] [:error] [pid 14779:tid 14787] [client 51.83.6.238:48558] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agA8G1XzPaW9Hap8yc8OGQAAAUY"]
[Sun May 10 16:04:45.804159 2026] [:error] [pid 52634:tid 52642] [client 51.83.6.238:48568] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agA8Hdwp8XoWCwFb54AMNwAAAMQ"]
[Sun May 10 16:04:47.835955 2026] [:error] [pid 46417:tid 46423] [client 51.83.6.238:48578] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agA8H2Inm7mhwgbe48a5rQAAAQQ"]
[Sun May 10 16:04:49.844094 2026] [:error] [pid 46331:tid 46397] [client 51.83.6.238:50806] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agA8IQP02hpYETwsZphFSAAAAJM"]
[Sun May 10 16:04:51.897681 2026] [:error] [pid 46417:tid 46439] [client 51.83.6.238:50810] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agA8I2Inm7mhwgbe48a5sAAAARQ"]
[Sun May 10 16:04:53.938151 2026] [:error] [pid 14779:tid 14805] [client 51.83.6.238:50816] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agA8JVXzPaW9Hap8yc8OHgAAAVg"]
[Sun May 10 16:04:55.820309 2026] [:error] [pid 52634:tid 52646] [client 51.83.6.238:50826] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agA8J9wp8XoWCwFb54AMQwAAAMg"]
[Sun May 10 17:39:52.201640 2026] [:error] [pid 64849:tid 64916] [client 180.153.236.133:21489] [client 180.153.236.133] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agBSaCwKPL8ac5iCS0C_GwAAAEc"], referer: http://www.switchcreative.net/
[Sun May 10 19:56:42.048568 2026] [:error] [pid 16038:tid 16069] [client 177.91.2.12:54967] [client 177.91.2.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.91.2.12, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agByek4hf5Tcsfa2scJTDwAAAYE"]
[Sun May 10 19:56:42.060038 2026] [proxy_fcgi:error] [pid 16038:tid 16069] [client 177.91.2.12:54967] AH01071: Got error 'Primary script unknown'
[Sun May 10 20:17:02.748195 2026] [:error] [pid 16096:tid 16122] [client 140.213.187.231:10043] [client 140.213.187.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 140.213.187.231, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agB3Pq8wyxcrT50p9kvUGwAAAFU"]
[Sun May 10 20:17:02.758925 2026] [proxy_fcgi:error] [pid 16096:tid 16122] [client 140.213.187.231:10043] AH01071: Got error 'Primary script unknown'
[Sun May 10 21:35:55.905488 2026] [autoindex:error] [pid 37030:tid 37034] [client 20.5.8.136:53079] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 10 22:21:45.109162 2026] [:error] [pid 16038:tid 16079] [client 80.124.54.14:55586] [client 80.124.54.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/include.php"] [unique_id "agCUeU4hf5Tcsfa2scJh5AAAAYs"]
[Sun May 10 22:21:46.107713 2026] [:error] [pid 16136:tid 16146] [client 80.124.54.14:55611] [client 80.124.54.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/include.php"] [unique_id "agCUekOBGdmCMnPX0McK6QAAAIg"]
[Sun May 10 22:21:47.283519 2026] [:error] [pid 37030:tid 37033] [client 80.124.54.14:55651] [client 80.124.54.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/include.php"] [unique_id "agCUe5rBzfXWwKkDkda4GgAAAME"]
[Sun May 10 22:21:48.491908 2026] [:error] [pid 16038:tid 16090] [client 80.124.54.14:55677] [client 80.124.54.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/include.php"] [unique_id "agCUfE4hf5Tcsfa2scJh5wAAAZY"]
[Sun May 10 22:45:05.668933 2026] [:error] [pid 16096:tid 16101] [client 116.240.149.7:64747] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agCZ8a8wyxcrT50p9kvm6AAAAEA"]
[Sun May 10 22:45:08.959645 2026] [:error] [pid 37030:tid 37032] [client 116.240.149.7:59800] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agCZ9JrBzfXWwKkDkda-HQAAAMA"]
[Sun May 10 22:45:13.289852 2026] [:error] [pid 16136:tid 16147] [client 116.240.149.7:62048] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agCZ-UOBGdmCMnPX0McO6wAAAIk"]
[Sun May 10 22:45:26.713878 2026] [:error] [pid 37030:tid 37035] [client 116.240.149.7:61935] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agCaBprBzfXWwKkDkda-IgAAAMM"]
[Sun May 10 22:45:29.802837 2026] [:error] [pid 16038:tid 16080] [client 116.240.149.7:64712] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agCaCU4hf5Tcsfa2scJkSAAAAYw"]
[Sun May 10 22:45:35.962450 2026] [:error] [pid 37030:tid 37052] [client 116.240.149.7:61417] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agCaD5rBzfXWwKkDkda-PQAAANQ"]
[Sun May 10 22:45:38.553054 2026] [:error] [pid 37030:tid 37042] [client 116.240.149.7:63785] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agCaEprBzfXWwKkDkda-SAAAAMo"]
[Sun May 10 22:45:52.915980 2026] [:error] [pid 37030:tid 37037] [client 116.240.149.7:62623] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agCaIJrBzfXWwKkDkda-iwAAAMU"]
[Sun May 10 22:45:56.811493 2026] [:error] [pid 16037:tid 16048] [client 116.240.149.7:64769] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agCaJHzjLQfyYTkAdSSI6wAAAAc"]
[Sun May 10 22:46:50.186446 2026] [:error] [pid 16136:tid 16140] [client 116.240.149.7:62446] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agCaWkOBGdmCMnPX0McPGQAAAII"]
[Sun May 10 22:46:56.269308 2026] [:error] [pid 37030:tid 37051] [client 116.240.149.7:60402] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agCaYJrBzfXWwKkDkda-yAAAANM"]
[Sun May 10 22:46:58.773289 2026] [:error] [pid 37030:tid 37046] [client 116.240.149.7:63391] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agCaYprBzfXWwKkDkda-0wAAAM4"]
[Sun May 10 22:47:02.875245 2026] [:error] [pid 37030:tid 37052] [client 116.240.149.7:64143] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agCaZprBzfXWwKkDkda--gAAANQ"]
[Sun May 10 22:47:06.011922 2026] [:error] [pid 37030:tid 37039] [client 116.240.149.7:61050] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agCaaprBzfXWwKkDkda_DQAAAMc"]
[Sun May 10 22:47:08.255775 2026] [:error] [pid 16136:tid 16158] [client 116.240.149.7:60448] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agCabEOBGdmCMnPX0McPHQAAAJQ"]
[Sun May 10 22:47:10.748983 2026] [:error] [pid 37030:tid 37056] [client 116.240.149.7:59239] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agCabprBzfXWwKkDkda_EgAAANg"]
[Sun May 10 22:47:13.320805 2026] [:error] [pid 37030:tid 37047] [client 116.240.149.7:61928] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agCacZrBzfXWwKkDkda_FwAAAM8"]
[Sun May 10 22:47:15.967913 2026] [:error] [pid 16037:tid 16048] [client 116.240.149.7:59387] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agCac3zjLQfyYTkAdSSJAAAAAAc"]
[Sun May 10 22:47:18.636759 2026] [:error] [pid 16038:tid 16069] [client 116.240.149.7:60906] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agCadk4hf5Tcsfa2scJkawAAAYE"]
[Sun May 10 22:47:22.167353 2026] [:error] [pid 16096:tid 16106] [client 116.240.149.7:59821] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agCaeq8wyxcrT50p9kvnOQAAAEU"]
[Sun May 10 22:47:25.519457 2026] [:error] [pid 16037:tid 16047] [client 116.240.149.7:61473] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agCafXzjLQfyYTkAdSSJAwAAAAY"]
[Sun May 10 22:47:28.522097 2026] [:error] [pid 16038:tid 16071] [client 116.240.149.7:59512] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agCagE4hf5Tcsfa2scJkbwAAAYM"]
[Sun May 10 22:47:31.654277 2026] [:error] [pid 37030:tid 37039] [client 116.240.149.7:60951] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agCag5rBzfXWwKkDkda_LgAAAMc"]
[Sun May 10 22:47:33.833651 2026] [:error] [pid 16038:tid 16077] [client 116.240.149.7:62080] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agCahU4hf5Tcsfa2scJkcAAAAYk"]
[Sun May 10 22:47:37.231920 2026] [:error] [pid 16037:tid 16044] [client 116.240.149.7:63751] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agCaiXzjLQfyYTkAdSSJCAAAAAM"]
[Sun May 10 22:47:39.832023 2026] [:error] [pid 16038:tid 16076] [client 116.240.149.7:60626] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agCai04hf5Tcsfa2scJkdAAAAYg"]
[Sun May 10 22:47:42.835952 2026] [:error] [pid 16037:tid 16041] [client 116.240.149.7:59411] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agCajnzjLQfyYTkAdSSJCQAAAAA"]
[Sun May 10 22:47:45.998795 2026] [:error] [pid 16096:tid 16106] [client 116.240.149.7:62801] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agCaka8wyxcrT50p9kvnRQAAAEU"]
[Sun May 10 22:48:26.539366 2026] [:error] [pid 16038:tid 16069] [client 116.240.149.7:63454] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agCauk4hf5Tcsfa2scJklAAAAYE"]
[Sun May 10 22:48:29.507270 2026] [:error] [pid 16136:tid 16161] [client 116.240.149.7:60052] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agCavUOBGdmCMnPX0McPUQAAAJc"]
[Sun May 10 22:48:32.039673 2026] [:error] [pid 16136:tid 16156] [client 116.240.149.7:64108] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agCawEOBGdmCMnPX0McPWAAAAJI"]
[Sun May 10 22:48:35.094643 2026] [:error] [pid 37030:tid 37046] [client 116.240.149.7:59206] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agCaw5rBzfXWwKkDkda_cwAAAM4"]
[Sun May 10 22:48:37.467800 2026] [:error] [pid 37030:tid 37043] [client 116.240.149.7:60259] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agCaxZrBzfXWwKkDkda_fQAAAMs"]
[Sun May 10 22:48:40.886054 2026] [:error] [pid 16038:tid 16077] [client 116.240.149.7:64827] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agCayE4hf5Tcsfa2scJkmgAAAYk"]
[Sun May 10 22:48:43.865940 2026] [:error] [pid 16136:tid 16155] [client 116.240.149.7:60888] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agCay0OBGdmCMnPX0McPZQAAAJE"]
[Sun May 10 22:48:46.962646 2026] [:error] [pid 37030:tid 37040] [client 116.240.149.7:62956] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agCazprBzfXWwKkDkda_iQAAAMg"]
[Sun May 10 22:48:50.238951 2026] [:error] [pid 16037:tid 16054] [client 116.240.149.7:62091] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agCa0nzjLQfyYTkAdSSJJgAAAA0"]
[Sun May 10 22:48:54.386884 2026] [:error] [pid 16037:tid 16058] [client 116.240.149.7:61218] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agCa1nzjLQfyYTkAdSSJKwAAABE"]
[Sun May 10 22:48:58.280707 2026] [:error] [pid 16038:tid 16080] [client 116.240.149.7:61333] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agCa2k4hf5Tcsfa2scJksQAAAYw"]
[Sun May 10 22:49:00.249304 2026] [:error] [pid 16136:tid 16150] [client 116.240.149.7:62169] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agCa3EOBGdmCMnPX0McPcQAAAIw"]
[Sun May 10 22:49:04.413249 2026] [:error] [pid 16096:tid 16122] [client 116.240.149.7:63312] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agCa4K8wyxcrT50p9kvnjwAAAFU"]
[Mon May 11 00:37:38.624591 2026] [:error] [pid 16037:tid 16052] [client 147.135.214.95:46166] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agC0UnzjLQfyYTkAdSSTtgAAAAs"]
[Mon May 11 00:37:40.994979 2026] [:error] [pid 16136:tid 16150] [client 147.135.214.95:44718] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agC0VEOBGdmCMnPX0Mcb8QAAAIw"]
[Mon May 11 00:37:43.410855 2026] [:error] [pid 16136:tid 16156] [client 147.135.214.95:44722] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agC0V0OBGdmCMnPX0Mcb9QAAAJI"]
[Mon May 11 00:37:45.866768 2026] [:error] [pid 9842:tid 9864] [client 147.135.214.95:44738] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agC0WUKCvgYKKAjiZbJkPgAAARM"]
[Mon May 11 00:37:48.272184 2026] [:error] [pid 16136:tid 16158] [client 147.135.214.95:44742] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agC0XEOBGdmCMnPX0Mcb9wAAAJQ"]
[Mon May 11 00:37:50.817729 2026] [:error] [pid 16038:tid 16080] [client 147.135.214.95:44750] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agC0Xk4hf5Tcsfa2scJuSwAAAYw"]
[Mon May 11 00:37:53.204539 2026] [:error] [pid 16096:tid 16105] [client 147.135.214.95:33148] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agC0Ya8wyxcrT50p9kvxhwAAAEQ"]
[Mon May 11 00:37:55.732693 2026] [:error] [pid 9842:tid 9858] [client 147.135.214.95:33150] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agC0Y0KCvgYKKAjiZbJkQgAAAQ0"]
[Mon May 11 00:37:56.687682 2026] [:error] [pid 16037:tid 16042] [client 147.135.214.95:35438] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0ZHzjLQfyYTkAdSSTuAAAAAE"]
[Mon May 11 00:38:00.589597 2026] [:error] [pid 16096:tid 16110] [client 147.135.214.95:42840] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0aK8wyxcrT50p9kvxigAAAEk"]
[Mon May 11 00:38:03.596270 2026] [:error] [pid 9842:tid 9869] [client 147.135.214.95:38534] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agC0a0KCvgYKKAjiZbJkSgAAARg"]
[Mon May 11 00:38:06.527868 2026] [:error] [pid 16037:tid 16064] [client 147.135.214.95:38542] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agC0bnzjLQfyYTkAdSSTygAAABc"]
[Mon May 11 00:38:09.428367 2026] [:error] [pid 9842:tid 9846] [client 147.135.214.95:38548] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agC0cUKCvgYKKAjiZbJkUAAAAQE"]
[Mon May 11 00:38:12.148961 2026] [:error] [pid 16096:tid 16121] [client 147.135.214.95:45830] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agC0dK8wyxcrT50p9kvxlAAAAFQ"]
[Mon May 11 00:38:15.096325 2026] [:error] [pid 16038:tid 16079] [client 147.135.214.95:45834] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agC0d04hf5Tcsfa2scJuUwAAAYs"]
[Mon May 11 00:38:17.394871 2026] [:error] [pid 16096:tid 16108] [client 147.135.214.95:45848] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agC0ea8wyxcrT50p9kvxlwAAAEc"]
[Mon May 11 00:38:20.687524 2026] [:error] [pid 37030:tid 37044] [client 147.135.214.95:45860] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agC0fJrBzfXWwKkDkdbQRAAAAMw"]
[Mon May 11 00:38:23.146448 2026] [:error] [pid 16038:tid 16069] [client 147.135.214.95:52810] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agC0f04hf5Tcsfa2scJuVgAAAYE"]
[Mon May 11 00:38:25.339032 2026] [:error] [pid 9842:tid 9859] [client 147.135.214.95:52816] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0gUKCvgYKKAjiZbJkWgAAAQ4"]
[Mon May 11 00:38:25.536222 2026] [:error] [pid 9842:tid 9854] [client 147.135.214.95:52818] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agC0gUKCvgYKKAjiZbJkWwAAAQk"]
[Mon May 11 00:38:28.376094 2026] [:error] [pid 16037:tid 16051] [client 147.135.214.95:52830] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agC0hHzjLQfyYTkAdSST4AAAAAo"]
[Mon May 11 00:38:29.580566 2026] [:error] [pid 16037:tid 16050] [client 147.135.214.95:52836] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0hXzjLQfyYTkAdSST4gAAAAk"]
[Mon May 11 00:38:31.281340 2026] [:error] [pid 9842:tid 9845] [client 147.135.214.95:41350] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agC0h0KCvgYKKAjiZbJkYAAAAQA"]
[Mon May 11 00:38:34.213137 2026] [:error] [pid 16038:tid 16081] [client 147.135.214.95:41362] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agC0ik4hf5Tcsfa2scJuXAAAAY0"]
[Mon May 11 00:38:36.586444 2026] [:error] [pid 16038:tid 16072] [client 147.135.214.95:41366] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agC0jE4hf5Tcsfa2scJuXQAAAYQ"]
[Mon May 11 00:38:49.849385 2026] [:error] [pid 9842:tid 9866] [client 147.135.214.95:47482] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agC0mUKCvgYKKAjiZbJkeAAAARU"]
[Mon May 11 00:38:51.697580 2026] [:error] [pid 9842:tid 9867] [client 147.135.214.95:41374] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agC0m0KCvgYKKAjiZbJkgAAAARY"]
[Mon May 11 00:38:52.913424 2026] [:error] [pid 16038:tid 16082] [client 147.135.214.95:52596] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agC0nE4hf5Tcsfa2scJuagAAAY4"]
[Mon May 11 00:38:54.660193 2026] [:error] [pid 9842:tid 9854] [client 147.135.214.95:41800] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agC0nkKCvgYKKAjiZbJkhQAAAQk"]
[Mon May 11 00:38:54.987360 2026] [:error] [pid 16096:tid 16105] [client 147.135.214.95:52606] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agC0nq8wyxcrT50p9kvxrgAAAEQ"]
[Mon May 11 00:38:57.112975 2026] [:error] [pid 16096:tid 16120] [client 147.135.214.95:41812] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agC0oa8wyxcrT50p9kvxsAAAAFM"]
[Mon May 11 00:38:58.393127 2026] [:error] [pid 9842:tid 9862] [client 147.135.214.95:52610] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agC0okKCvgYKKAjiZbJkiwAAARE"]
[Mon May 11 00:39:00.095262 2026] [:error] [pid 9842:tid 9869] [client 147.135.214.95:41816] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agC0pEKCvgYKKAjiZbJkjQAAARg"]
[Mon May 11 00:39:00.916079 2026] [:error] [pid 16038:tid 16085] [client 147.135.214.95:54070] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agC0pE4hf5Tcsfa2scJubQAAAZE"]
[Mon May 11 00:39:03.145629 2026] [:error] [pid 16096:tid 16118] [client 147.135.214.95:55334] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agC0p68wyxcrT50p9kvxsgAAAFE"]
[Mon May 11 00:39:03.322603 2026] [:error] [pid 9842:tid 9864] [client 147.135.214.95:54074] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agC0p0KCvgYKKAjiZbJkkgAAARM"]
[Mon May 11 00:39:06.392906 2026] [:error] [pid 16038:tid 16080] [client 147.135.214.95:55346] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agC0qk4hf5Tcsfa2scJucAAAAYw"]
[Mon May 11 00:39:06.979730 2026] [:error] [pid 37030:tid 37038] [client 147.135.214.95:54088] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "agC0qprBzfXWwKkDkdbQVgAAAMY"]
[Mon May 11 00:39:09.422903 2026] [:error] [pid 16037:tid 16045] [client 147.135.214.95:55348] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agC0rXzjLQfyYTkAdSST-wAAAAQ"]
[Mon May 11 00:39:09.482975 2026] [:error] [pid 16037:tid 16059] [client 147.135.214.95:54094] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agC0rXzjLQfyYTkAdSST_QAAABI"]
[Mon May 11 00:39:11.900860 2026] [:error] [pid 16037:tid 16042] [client 147.135.214.95:43678] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agC0r3zjLQfyYTkAdSSUBAAAAAE"]
[Mon May 11 00:39:12.300139 2026] [:error] [pid 16038:tid 16072] [client 147.135.214.95:48552] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agC0sE4hf5Tcsfa2scJucwAAAYQ"]
[Mon May 11 00:39:14.482642 2026] [:error] [pid 16037:tid 16064] [client 147.135.214.95:43692] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agC0snzjLQfyYTkAdSSUEAAAABc"]
[Mon May 11 00:39:15.294653 2026] [:error] [pid 16136:tid 16155] [client 147.135.214.95:48564] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agC0s0OBGdmCMnPX0MccKQAAAJE"]
[Mon May 11 00:39:17.079642 2026] [:error] [pid 9842:tid 9866] [client 147.135.214.95:43694] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agC0tUKCvgYKKAjiZbJknAAAARU"]
[Mon May 11 00:39:17.729771 2026] [:error] [pid 9842:tid 9845] [client 147.135.214.95:48574] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agC0tUKCvgYKKAjiZbJknwAAAQA"]
[Mon May 11 00:39:19.614154 2026] [:error] [pid 16136:tid 16139] [client 147.135.214.95:43706] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agC0t0OBGdmCMnPX0MccKwAAAIE"]
[Mon May 11 00:39:20.222998 2026] [:error] [pid 16136:tid 16138] [client 147.135.214.95:48590] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agC0uEOBGdmCMnPX0MccLAAAAIA"]
[Mon May 11 00:39:22.486979 2026] [:error] [pid 16037:tid 16061] [client 147.135.214.95:41164] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agC0unzjLQfyYTkAdSSUFAAAABQ"]
[Mon May 11 00:39:22.526496 2026] [:error] [pid 9842:tid 9855] [client 147.135.214.95:50950] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agC0ukKCvgYKKAjiZbJkpgAAAQo"]
[Mon May 11 00:39:25.046868 2026] [:error] [pid 16096:tid 16121] [client 147.135.214.95:50962] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agC0va8wyxcrT50p9kvxxgAAAFQ"]
[Mon May 11 00:39:25.169899 2026] [:error] [pid 16136:tid 16140] [client 147.135.214.95:50976] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0vUOBGdmCMnPX0MccMQAAAII"]
[Mon May 11 00:39:27.585019 2026] [:error] [pid 16038:tid 16090] [client 147.135.214.95:50986] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agC0v04hf5Tcsfa2scJuewAAAZY"]
[Mon May 11 00:39:28.870671 2026] [:error] [pid 16037:tid 16048] [client 147.135.214.95:50998] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0wHzjLQfyYTkAdSSUFgAAAAc"]
[Mon May 11 00:39:29.647456 2026] [:error] [pid 9842:tid 9859] [client 147.135.214.95:51008] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agC0wUKCvgYKKAjiZbJkrAAAAQ4"]
[Mon May 11 00:39:32.209588 2026] [:error] [pid 16096:tid 16118] [client 147.135.214.95:58470] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agC0xK8wyxcrT50p9kvxzgAAAFE"]
[Mon May 11 00:39:34.638276 2026] [:error] [pid 37030:tid 37036] [client 147.135.214.95:58480] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agC0xprBzfXWwKkDkdbQaQAAAMQ"]
[Mon May 11 00:39:36.892165 2026] [:error] [pid 16037:tid 16050] [client 147.135.214.95:58482] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agC0yHzjLQfyYTkAdSSUHwAAAAk"]
[Mon May 11 00:39:40.734083 2026] [:error] [pid 37030:tid 37042] [client 147.135.214.95:33828] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agC0zJrBzfXWwKkDkdbQbAAAAMo"]
[Mon May 11 00:39:44.557425 2026] [:error] [pid 37030:tid 37051] [client 147.135.214.95:33832] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agC00JrBzfXWwKkDkdbQdQAAANM"]
[Mon May 11 02:09:31.708289 2026] [:error] [pid 9842:tid 9864] [client 159.195.29.0:41408] [client 159.195.29.0] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "switchcreative.net"] [uri "/"] [unique_id "agDJ2UKCvgYKKAjiZbJ03wAAARM"]
[Mon May 11 02:37:25.773202 2026] [:error] [pid 16037:tid 16057] [client 146.19.215.244:56144] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agDQZXzjLQfyYTkAdSSqBAAAABA"]
[Mon May 11 02:37:27.357459 2026] [:error] [pid 16038:tid 16078] [client 146.19.215.244:38786] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agDQZ04hf5Tcsfa2scKJXgAAAYo"]
[Mon May 11 02:37:29.754954 2026] [:error] [pid 16038:tid 16074] [client 146.19.215.244:56148] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agDQaU4hf5Tcsfa2scKJYQAAAYY"]
[Mon May 11 02:37:31.707507 2026] [:error] [pid 9842:tid 9866] [client 146.19.215.244:48552] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agDQa0KCvgYKKAjiZbJ3fAAAARU"]
[Mon May 11 02:37:34.178305 2026] [:error] [pid 16038:tid 16092] [client 146.19.215.244:39900] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agDQbk4hf5Tcsfa2scKJZQAAAZg"]
[Mon May 11 02:37:36.148017 2026] [:error] [pid 16038:tid 16087] [client 146.19.215.244:47178] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agDQcE4hf5Tcsfa2scKJawAAAZM"]
[Mon May 11 02:37:38.124077 2026] [:error] [pid 16038:tid 16086] [client 146.19.215.244:47190] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agDQck4hf5Tcsfa2scKJcAAAAZI"]
[Mon May 11 02:37:40.596754 2026] [:error] [pid 16038:tid 16082] [client 146.19.215.244:39910] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agDQdE4hf5Tcsfa2scKJcwAAAY4"]
[Mon May 11 02:37:43.019835 2026] [:error] [pid 16038:tid 16084] [client 146.19.215.244:39922] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agDQd04hf5Tcsfa2scKJdAAAAZA"]
[Mon May 11 02:37:45.344164 2026] [:error] [pid 37030:tid 37048] [client 146.19.215.244:42272] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agDQeZrBzfXWwKkDkdbd8wAAANA"]
[Mon May 11 02:37:47.332428 2026] [:error] [pid 16096:tid 16104] [client 146.19.215.244:55338] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agDQe68wyxcrT50p9kv6oQAAAEM"]
[Mon May 11 02:37:49.663043 2026] [:error] [pid 16038:tid 16092] [client 146.19.215.244:42282] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agDQfU4hf5Tcsfa2scKJfAAAAZg"]
[Mon May 11 02:37:51.671551 2026] [:error] [pid 16038:tid 16081] [client 146.19.215.244:55352] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agDQf04hf5Tcsfa2scKJgQAAAY0"]
[Mon May 11 02:37:53.650982 2026] [:error] [pid 16038:tid 16077] [client 146.19.215.244:60360] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agDQgU4hf5Tcsfa2scKJgwAAAYk"]
[Mon May 11 02:37:55.643127 2026] [:error] [pid 37030:tid 37045] [client 146.19.215.244:60364] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agDQg5rBzfXWwKkDkdbd-wAAAM0"]
[Mon May 11 02:37:57.997022 2026] [:error] [pid 37030:tid 37054] [client 146.19.215.244:43150] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agDQhZrBzfXWwKkDkdbd_gAAANY"]
[Mon May 11 02:38:00.488100 2026] [:error] [pid 16038:tid 16070] [client 146.19.215.244:43162] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agDQiE4hf5Tcsfa2scKJhwAAAYI"]
[Mon May 11 02:38:02.882704 2026] [:error] [pid 16037:tid 16051] [client 146.19.215.244:43174] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agDQinzjLQfyYTkAdSSqKwAAAAo"]
[Mon May 11 02:38:05.240274 2026] [:error] [pid 37030:tid 37032] [client 146.19.215.244:38938] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agDQjZrBzfXWwKkDkdbeBgAAAMA"]
[Mon May 11 02:38:07.054424 2026] [:error] [pid 37030:tid 37050] [client 146.19.215.244:36500] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agDQj5rBzfXWwKkDkdbeBwAAANI"]
[Mon May 11 02:38:09.528931 2026] [:error] [pid 16037:tid 16059] [client 146.19.215.244:38944] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agDQkXzjLQfyYTkAdSSqMQAAABI"]
[Mon May 11 02:38:11.967144 2026] [:error] [pid 16038:tid 16070] [client 146.19.215.244:38956] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agDQk04hf5Tcsfa2scKJkwAAAYI"]
[Mon May 11 02:38:14.254994 2026] [:error] [pid 16038:tid 16083] [client 146.19.215.244:44396] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agDQlk4hf5Tcsfa2scKJlwAAAY8"]
[Mon May 11 02:38:16.688337 2026] [:error] [pid 9842:tid 9860] [client 146.19.215.244:44400] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agDQmEKCvgYKKAjiZbJ3hQAAAQ8"]
[Mon May 11 02:38:18.659025 2026] [:error] [pid 37030:tid 37048] [client 146.19.215.244:50872] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agDQmprBzfXWwKkDkdbeDQAAANA"]
[Mon May 11 02:38:20.996419 2026] [:error] [pid 16038:tid 16092] [client 146.19.215.244:44406] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agDQnE4hf5Tcsfa2scKJmgAAAZg"]
[Mon May 11 02:38:22.994337 2026] [:error] [pid 37030:tid 37053] [client 146.19.215.244:50886] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agDQnprBzfXWwKkDkdbeDwAAANU"]
[Mon May 11 02:38:45.978477 2026] [:error] [pid 9842:tid 9866] [client 146.19.215.244:48440] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agDQtUKCvgYKKAjiZbJ3lQAAARU"]
[Mon May 11 02:38:48.398526 2026] [:error] [pid 16037:tid 16048] [client 146.19.215.244:33496] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agDQuHzjLQfyYTkAdSSqSgAAAAc"]
[Mon May 11 02:38:50.345205 2026] [:error] [pid 16096:tid 16120] [client 146.19.215.244:57394] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agDQuq8wyxcrT50p9kv6rgAAAFM"]
[Mon May 11 02:38:52.829139 2026] [:error] [pid 16037:tid 16057] [client 146.19.215.244:33504] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agDQvHzjLQfyYTkAdSSqTwAAABA"]
[Mon May 11 02:38:54.789567 2026] [:error] [pid 16096:tid 16106] [client 146.19.215.244:43094] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agDQvq8wyxcrT50p9kv6rwAAAEU"]
[Mon May 11 04:25:36.052780 2026] [:error] [pid 65259:tid 65280] [client 52.161.59.96:23875] [client 52.161.59.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.161.59.96, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/wp/xmlrpc.php"] [unique_id "agDpwAPsXLnMa32ma5BHzgAAAAw"]
[Mon May 11 04:54:49.557627 2026] [:error] [pid 65261:tid 65345] [client 62.84.185.55:25478] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agDwmZu_9uQJeFrcOsssXQAAAJY"]
[Mon May 11 04:54:52.176552 2026] [:error] [pid 65366:tid 65392] [client 62.84.185.55:25480] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agDwnKhVGdYzapDtv-HgiQAAANc"]
[Mon May 11 04:54:54.677713 2026] [:error] [pid 65261:tid 65334] [client 62.84.185.55:25486] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agDwnpu_9uQJeFrcOsssYgAAAIs"]
[Mon May 11 04:54:58.290862 2026] [:error] [pid 65260:tid 65303] [client 62.84.185.55:16838] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agDwojqbzwIHjP6Y_3Fr6AAAAEc"]
[Mon May 11 04:55:00.695554 2026] [:error] [pid 65259:tid 65287] [client 62.84.185.55:16840] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agDwpAPsXLnMa32ma5BLmAAAABM"]
[Mon May 11 04:55:03.578710 2026] [:error] [pid 65259:tid 65281] [client 62.84.185.55:16844] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agDwpwPsXLnMa32ma5BLmgAAAA0"]
[Mon May 11 04:55:06.618649 2026] [:error] [pid 65366:tid 65391] [client 62.84.185.55:16860] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agDwqqhVGdYzapDtv-HgpgAAANY"]
[Mon May 11 04:55:12.666315 2026] [:error] [pid 65366:tid 65387] [client 62.84.185.55:13354] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agDwsKhVGdYzapDtv-HgsQAAANI"]
[Mon May 11 04:55:17.216793 2026] [:error] [pid 65366:tid 65381] [client 62.84.185.55:11028] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agDwtahVGdYzapDtv-HguwAAAMw"]
[Mon May 11 04:55:25.410381 2026] [:error] [pid 65261:tid 65336] [client 62.84.185.55:11036] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agDwvZu_9uQJeFrcOssscAAAAI0"]
[Mon May 11 04:55:33.267295 2026] [:error] [pid 65259:tid 65272] [client 62.84.185.55:45504] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agDwxQPsXLnMa32ma5BLpQAAAAQ"]
[Mon May 11 04:55:37.982592 2026] [:error] [pid 65261:tid 65334] [client 62.84.185.55:2162] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agDwyZu_9uQJeFrcOsssgQAAAIs"]
[Mon May 11 04:55:41.591695 2026] [:error] [pid 65261:tid 65329] [client 62.84.185.55:2172] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agDwzZu_9uQJeFrcOsssigAAAIY"]
[Mon May 11 04:56:37.080490 2026] [:error] [pid 65261:tid 65344] [client 62.84.185.55:61738] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agDxBZu_9uQJeFrcOssszwAAAJU"]
[Mon May 11 04:56:43.459550 2026] [:error] [pid 65261:tid 65323] [client 62.84.185.55:61742] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agDxC5u_9uQJeFrcOsss3AAAAIA"]
[Mon May 11 04:56:48.997684 2026] [:error] [pid 65366:tid 65393] [client 62.84.185.55:11826] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agDxEKhVGdYzapDtv-HhPQAAANg"]
[Mon May 11 04:56:54.766200 2026] [:error] [pid 65366:tid 65393] [client 62.84.185.55:11838] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agDxFqhVGdYzapDtv-HhSAAAANg"]
[Mon May 11 04:57:00.721719 2026] [:error] [pid 65261:tid 65329] [client 62.84.185.55:38918] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agDxHJu_9uQJeFrcOsss7wAAAIY"]
[Mon May 11 04:57:08.206294 2026] [:error] [pid 65260:tid 65312] [client 62.84.185.55:40264] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agDxJDqbzwIHjP6Y_3FsXgAAAFA"]
[Mon May 11 05:06:34.679684 2026] [:error] [pid 65261:tid 65336] [client 34.17.77.228:35480] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "agDzWpu_9uQJeFrcOssu7wAAAI0"]
[Mon May 11 05:06:34.681818 2026] [:error] [pid 65366:tid 65371] [client 34.17.77.228:35494] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "agDzWqhVGdYzapDtv-HjQwAAAMM"]
[Mon May 11 05:06:34.692905 2026] [:error] [pid 65366:tid 65383] [client 34.17.77.228:35508] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "agDzWqhVGdYzapDtv-HjRAAAAM4"]
[Mon May 11 05:06:34.975136 2026] [:error] [pid 65259:tid 65285] [client 34.17.77.228:35512] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev.local"] [unique_id "agDzWgPsXLnMa32ma5BM3QAAABE"]
[Mon May 11 05:06:34.981301 2026] [:error] [pid 65261:tid 65333] [client 34.17.77.228:35522] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/admin/.env"] [unique_id "agDzWpu_9uQJeFrcOssu8AAAAIo"]
[Mon May 11 05:06:34.996641 2026] [:error] [pid 65366:tid 65386] [client 34.17.77.228:35524] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "agDzWqhVGdYzapDtv-HjRQAAANE"]
[Mon May 11 05:06:35.024771 2026] [:error] [pid 65261:tid 65335] [client 34.17.77.228:35538] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "agDzW5u_9uQJeFrcOssu8QAAAIw"]
[Mon May 11 05:06:35.265164 2026] [:error] [pid 65366:tid 65380] [client 34.17.77.228:35554] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "agDzW6hVGdYzapDtv-HjRgAAAMs"]
[Mon May 11 05:06:35.287788 2026] [:error] [pid 65261:tid 65327] [client 34.17.77.228:35556] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development.local"] [unique_id "agDzW5u_9uQJeFrcOssu8wAAAIQ"]
[Mon May 11 05:06:35.323397 2026] [:error] [pid 65366:tid 65389] [client 34.17.77.228:35558] [client 34.17.77.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env.local"] [unique_id "agDzW6hVGdYzapDtv-HjRwAAANQ"]
[Mon May 11 08:34:06.945581 2026] [:error] [pid 35052:tid 35061] [client 43.165.197.116:51730] [client 43.165.197.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agEj_uHjpNNnFJrMXu2bLAAAAUY"]
[Mon May 11 09:33:32.343551 2026] [:error] [pid 65366:tid 65388] [client 65.108.2.171:30792] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agEx7KhVGdYzapDtv-ENggAAANM"]
[Mon May 11 09:33:34.451798 2026] [:error] [pid 9335:tid 9341] [client 65.108.2.171:22078] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agEx7nmXqumINT8bKRFEwQAAAQQ"]
[Mon May 11 09:33:36.394999 2026] [:error] [pid 65259:tid 65268] [client 65.108.2.171:22092] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agEx8APsXLnMa32ma5BjygAAAAA"]
[Mon May 11 09:33:38.361519 2026] [:error] [pid 65366:tid 65391] [client 65.108.2.171:22096] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agEx8qhVGdYzapDtv-ENhAAAANY"]
[Mon May 11 09:33:40.296092 2026] [:error] [pid 65259:tid 65290] [client 65.108.2.171:22112] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agEx9APsXLnMa32ma5BjzQAAABY"]
[Mon May 11 09:33:42.297604 2026] [:error] [pid 65259:tid 65289] [client 65.108.2.171:22126] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agEx9gPsXLnMa32ma5Bj0AAAABU"]
[Mon May 11 09:33:44.322440 2026] [:error] [pid 65259:tid 65273] [client 65.108.2.171:32692] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agEx-APsXLnMa32ma5Bj0wAAAAU"]
[Mon May 11 09:33:46.271053 2026] [:error] [pid 35052:tid 35066] [client 65.108.2.171:32696] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agEx-uHjpNNnFJrMXu2pXAAAAUs"]
[Mon May 11 09:33:48.202350 2026] [:error] [pid 65260:tid 65306] [client 65.108.2.171:32700] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agEx_DqbzwIHjP6Y_3GH4QAAAEo"]
[Mon May 11 09:33:50.105386 2026] [:error] [pid 65366:tid 65381] [client 65.108.2.171:32706] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agEx_qhVGdYzapDtv-ENiQAAAMw"]
[Mon May 11 09:33:52.243774 2026] [:error] [pid 9335:tid 9356] [client 65.108.2.171:32712] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agEyAHmXqumINT8bKRFEyQAAARM"]
[Mon May 11 09:33:54.336934 2026] [:error] [pid 65366:tid 65388] [client 65.108.2.171:10422] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agEyAqhVGdYzapDtv-ENjAAAANM"]
[Mon May 11 09:33:56.295180 2026] [:error] [pid 65260:tid 65314] [client 65.108.2.171:10426] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agEyBDqbzwIHjP6Y_3GH5QAAAFI"]
[Mon May 11 09:33:58.355158 2026] [:error] [pid 65260:tid 65317] [client 65.108.2.171:10428] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agEyBjqbzwIHjP6Y_3GH6AAAAFU"]
[Mon May 11 09:34:00.458660 2026] [:error] [pid 65259:tid 65292] [client 65.108.2.171:10444] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agEyCAPsXLnMa32ma5Bj1wAAABg"]
[Mon May 11 09:34:02.400923 2026] [:error] [pid 65260:tid 65302] [client 65.108.2.171:10452] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agEyCjqbzwIHjP6Y_3GH6gAAAEY"]
[Mon May 11 09:34:04.474988 2026] [:error] [pid 9335:tid 9347] [client 65.108.2.171:42796] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agEyDHmXqumINT8bKRFE0gAAAQo"]
[Mon May 11 09:34:06.446019 2026] [:error] [pid 35052:tid 35078] [client 65.108.2.171:42800] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agEyDuHjpNNnFJrMXu2pbgAAAVc"]
[Mon May 11 09:34:08.492281 2026] [:error] [pid 65261:tid 65344] [client 65.108.2.171:42810] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agEyEJu_9uQJeFrcOstPygAAAJU"]
[Mon May 11 09:34:10.504149 2026] [:error] [pid 9335:tid 9337] [client 65.108.2.171:42818] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agEyEnmXqumINT8bKRFE2QAAAQA"]
[Mon May 11 09:34:12.574377 2026] [:error] [pid 65261:tid 65334] [client 65.108.2.171:42826] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agEyFJu_9uQJeFrcOstPzgAAAIs"]
[Mon May 11 09:34:14.546306 2026] [:error] [pid 9335:tid 9342] [client 65.108.2.171:21628] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agEyFnmXqumINT8bKRFE3AAAAQU"]
[Mon May 11 09:34:16.609412 2026] [:error] [pid 9335:tid 9348] [client 65.108.2.171:21632] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agEyGHmXqumINT8bKRFE3gAAAQs"]
[Mon May 11 09:34:18.579035 2026] [:error] [pid 35052:tid 35055] [client 65.108.2.171:21646] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agEyGuHjpNNnFJrMXu2pegAAAUA"]
[Mon May 11 09:34:20.590331 2026] [:error] [pid 35052:tid 35068] [client 65.108.2.171:21650] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agEyHOHjpNNnFJrMXu2pfgAAAU0"]
[Mon May 11 09:34:22.740276 2026] [:error] [pid 65260:tid 65306] [client 65.108.2.171:21658] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agEyHjqbzwIHjP6Y_3GH7QAAAEo"]
[Mon May 11 16:26:28.722198 2026] [:error] [pid 4645:tid 4653] [client 54.37.252.137:41972] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agGStHy4dxn8-Cx5vOWSmQAAAEU"]
[Mon May 11 16:26:30.453140 2026] [:error] [pid 58750:tid 58772] [client 54.37.252.137:60610] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agGStjBVaNG3wJtPBU-bGwAAAVQ"]
[Mon May 11 16:26:32.779959 2026] [:error] [pid 4685:tid 4692] [client 54.37.252.137:55638] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agGSuHwrjbU4NZilCZ_CUAAAAQQ"]
[Mon May 11 16:26:35.285320 2026] [:error] [pid 58615:tid 58622] [client 54.37.252.137:55652] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agGSu1K28yH055J8TSrLSgAAAAM"]
[Mon May 11 16:26:37.810342 2026] [:error] [pid 4685:tid 4708] [client 54.37.252.137:42014] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agGSvXwrjbU4NZilCZ_CVwAAARQ"]
[Mon May 11 16:26:40.333280 2026] [:error] [pid 4645:tid 4661] [client 54.37.252.137:42018] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agGSwHy4dxn8-Cx5vOWSoQAAAE0"]
[Mon May 11 16:26:42.843331 2026] [:error] [pid 4645:tid 4663] [client 54.37.252.137:42022] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agGSwny4dxn8-Cx5vOWSogAAAE8"]
[Mon May 11 16:26:44.762476 2026] [:error] [pid 58677:tid 58690] [client 54.37.252.137:48198] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agGSxBasRhyteIXf1RVFrwAAAII"]
[Mon May 11 16:26:47.285903 2026] [:error] [pid 58615:tid 58639] [client 54.37.252.137:58292] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agGSx1K28yH055J8TSrLVgAAABQ"]
[Mon May 11 16:26:49.304657 2026] [:error] [pid 58615:tid 58629] [client 54.37.252.137:58654] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agGSyVK28yH055J8TSrLWAAAAAo"]
[Mon May 11 16:26:51.346315 2026] [:error] [pid 58677:tid 58691] [client 54.37.252.137:58658] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agGSyxasRhyteIXf1RVFsAAAAIM"]
[Mon May 11 16:26:53.698909 2026] [:error] [pid 58750:tid 58760] [client 54.37.252.137:58302] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agGSzTBVaNG3wJtPBU-bPQAAAUg"]
[Mon May 11 16:26:55.707650 2026] [:error] [pid 58750:tid 58754] [client 54.37.252.137:47442] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agGSzzBVaNG3wJtPBU-bQQAAAUI"]
[Mon May 11 16:26:58.224154 2026] [:error] [pid 58616:tid 58652] [client 54.37.252.137:48764] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agGS0tnsbeF5ioCAecjZNAAAAMY"]
[Mon May 11 16:27:00.739964 2026] [:error] [pid 4645:tid 4671] [client 54.37.252.137:48776] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agGS1Hy4dxn8-Cx5vOWSuAAAAFc"]
[Mon May 11 16:27:03.247846 2026] [:error] [pid 4645:tid 4668] [client 54.37.252.137:48784] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agGS13y4dxn8-Cx5vOWSvwAAAFQ"]
[Mon May 11 16:27:05.596342 2026] [:error] [pid 58750:tid 58765] [client 54.37.252.137:48800] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agGS2TBVaNG3wJtPBU-bUgAAAU0"]
[Mon May 11 16:27:08.097987 2026] [:error] [pid 4685:tid 4689] [client 54.37.252.137:48252] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agGS3HwrjbU4NZilCZ_CbQAAAQE"]
[Mon May 11 16:27:10.100971 2026] [:error] [pid 58677:tid 58699] [client 54.37.252.137:54308] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agGS3hasRhyteIXf1RVFxQAAAIs"]
[Mon May 11 16:27:12.606435 2026] [:error] [pid 58677:tid 58705] [client 54.37.252.137:48260] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agGS4BasRhyteIXf1RVFyAAAAJE"]
[Mon May 11 16:27:14.624300 2026] [:error] [pid 4645:tid 4667] [client 54.37.252.137:54324] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agGS4ny4dxn8-Cx5vOWSwwAAAFM"]
[Mon May 11 16:27:16.632590 2026] [:error] [pid 58750:tid 58762] [client 54.37.252.137:53532] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agGS5DBVaNG3wJtPBU-bVAAAAUo"]
[Mon May 11 16:27:18.654099 2026] [:error] [pid 4685:tid 4701] [client 54.37.252.137:53546] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agGS5nwrjbU4NZilCZ_CeQAAAQ0"]
[Mon May 11 16:27:20.680004 2026] [:error] [pid 58677:tid 58693] [client 54.37.252.137:53554] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agGS6BasRhyteIXf1RVFzgAAAIU"]
[Mon May 11 16:27:23.197717 2026] [:error] [pid 58677:tid 58702] [client 54.37.252.137:43124] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agGS6xasRhyteIXf1RVF3QAAAI4"]
[Mon May 11 16:27:25.170848 2026] [:error] [pid 58616:tid 58653] [client 54.37.252.137:53570] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agGS7dnsbeF5ioCAecjZQAAAAMc"]
[Mon May 11 16:27:46.367321 2026] [:error] [pid 58615:tid 58630] [client 54.37.252.137:33906] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agGTAlK28yH055J8TSrLqwAAAAs"]
[Mon May 11 16:27:48.144176 2026] [:error] [pid 58677:tid 58694] [client 54.37.252.137:33704] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agGTBBasRhyteIXf1RVF9wAAAIY"]
[Mon May 11 16:27:50.146907 2026] [:error] [pid 58677:tid 58697] [client 54.37.252.137:33718] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agGTBhasRhyteIXf1RVF-AAAAIk"]
[Mon May 11 16:27:52.145117 2026] [:error] [pid 58677:tid 58693] [client 54.37.252.137:33720] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agGTCBasRhyteIXf1RVF-QAAAIU"]
[Mon May 11 16:27:54.641717 2026] [:error] [pid 58750:tid 58773] [client 54.37.252.137:56806] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agGTCjBVaNG3wJtPBU-baAAAAVU"]
[Mon May 11 16:27:56.621373 2026] [:error] [pid 58677:tid 58690] [client 54.37.252.137:39052] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agGTDBasRhyteIXf1RVF_QAAAII"]
[Mon May 11 16:27:58.621458 2026] [:error] [pid 4685:tid 4706] [client 54.37.252.137:39066] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agGTDnwrjbU4NZilCZ_CiAAAARI"]
[Mon May 11 16:28:01.098843 2026] [:error] [pid 4685:tid 4705] [client 54.37.252.137:57340] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agGTEXwrjbU4NZilCZ_CjAAAARE"]
[Mon May 11 16:28:03.071583 2026] [:error] [pid 58750:tid 58770] [client 54.37.252.137:39078] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agGTEzBVaNG3wJtPBU-bagAAAVI"]
[Mon May 11 16:28:05.394339 2026] [:error] [pid 58750:tid 58762] [client 54.37.252.137:57354] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agGTFTBVaNG3wJtPBU-bbQAAAUo"]
[Mon May 11 16:28:07.214064 2026] [:error] [pid 58615:tid 58619] [client 54.37.252.137:48574] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agGTF1K28yH055J8TSrLuAAAAAA"]
[Mon May 11 16:28:09.212038 2026] [:error] [pid 4685:tid 4709] [client 54.37.252.137:48576] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agGTGXwrjbU4NZilCZ_ClwAAARU"]
[Mon May 11 16:28:11.691045 2026] [:error] [pid 4645:tid 4670] [client 54.37.252.137:40532] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agGTG3y4dxn8-Cx5vOWS4gAAAFY"]
[Mon May 11 16:28:13.537641 2026] [:error] [pid 4645:tid 4672] [client 54.37.252.137:48592] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agGTHXy4dxn8-Cx5vOWS5AAAAFg"]
[Mon May 11 16:28:15.526867 2026] [:error] [pid 4645:tid 4649] [client 54.37.252.137:60130] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agGTH3y4dxn8-Cx5vOWS5gAAAEE"]
[Mon May 11 16:28:17.533307 2026] [:error] [pid 4645:tid 4667] [client 54.37.252.137:60132] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agGTIXy4dxn8-Cx5vOWS6AAAAFM"]
[Mon May 11 16:28:19.538756 2026] [:error] [pid 58677:tid 58693] [client 54.37.252.137:60138] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agGTIxasRhyteIXf1RVGEAAAAIU"]
[Mon May 11 16:28:21.537765 2026] [:error] [pid 58677:tid 58711] [client 54.37.252.137:60154] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agGTJRasRhyteIXf1RVGFAAAAJc"]
[Mon May 11 16:28:23.533413 2026] [:error] [pid 58677:tid 58702] [client 54.37.252.137:60160] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agGTJxasRhyteIXf1RVGFwAAAI4"]
[Mon May 11 16:28:25.544670 2026] [:error] [pid 58616:tid 58657] [client 54.37.252.137:41658] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agGTKdnsbeF5ioCAecjZZwAAAMs"]
[Mon May 11 16:28:28.015564 2026] [:error] [pid 58677:tid 58694] [client 54.37.252.137:43932] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agGTLBasRhyteIXf1RVGGwAAAIY"]
[Mon May 11 16:28:30.480015 2026] [:error] [pid 4645:tid 4669] [client 54.37.252.137:43942] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agGTLny4dxn8-Cx5vOWS8QAAAFU"]
[Mon May 11 16:28:32.770131 2026] [:error] [pid 4645:tid 4668] [client 54.37.252.137:43944] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agGTMHy4dxn8-Cx5vOWS9AAAAFQ"]
[Mon May 11 16:28:35.076919 2026] [:error] [pid 4645:tid 4661] [client 54.37.252.137:43946] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agGTM3y4dxn8-Cx5vOWS-QAAAE0"]
[Mon May 11 16:28:37.545541 2026] [:error] [pid 58616:tid 58652] [client 54.37.252.137:48372] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agGTNdnsbeF5ioCAecjZawAAAMY"]
[Mon May 11 16:28:41.301876 2026] [:error] [pid 4685:tid 4696] [client 54.37.252.137:48388] [client 54.37.252.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agGTOXwrjbU4NZilCZ_C4QAAAQg"]
[Mon May 11 16:32:30.216855 2026] [:error] [pid 58616:tid 58656] [client 43.133.66.51:51722] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agGUHtnsbeF5ioCAecjZvQAAAMo"]
[Mon May 11 18:06:41.299075 2026] [:error] [pid 58750:tid 58768] [client 51.75.118.97:39912] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agGqMTBVaNG3wJtPBU-jHAAAAVA"]
[Mon May 11 18:06:43.970959 2026] [:error] [pid 4645:tid 4667] [client 51.75.118.97:53462] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agGqM3y4dxn8-Cx5vOWhOQAAAFM"]
[Mon May 11 18:06:46.660152 2026] [:error] [pid 58615:tid 58625] [client 51.75.118.97:50674] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agGqNlK28yH055J8TSrT5QAAAAY"]
[Mon May 11 18:06:49.416736 2026] [:error] [pid 58615:tid 58638] [client 51.75.118.97:50684] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agGqOVK28yH055J8TSrT5gAAABM"]
[Mon May 11 18:06:52.268451 2026] [:error] [pid 58750:tid 58755] [client 51.75.118.97:50692] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agGqPDBVaNG3wJtPBU-jHgAAAUM"]
[Mon May 11 18:06:54.937197 2026] [:error] [pid 58677:tid 58689] [client 51.75.118.97:43778] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agGqPhasRhyteIXf1RVTBgAAAIE"]
[Mon May 11 18:06:57.567721 2026] [:error] [pid 58750:tid 58754] [client 51.75.118.97:43788] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agGqQTBVaNG3wJtPBU-jHwAAAUI"]
[Mon May 11 18:07:00.527563 2026] [:error] [pid 58677:tid 58698] [client 51.75.118.97:43798] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agGqRBasRhyteIXf1RVTDgAAAIo"]
[Mon May 11 18:07:01.427799 2026] [:error] [pid 4685:tid 4690] [client 51.75.118.97:53700] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agGqRXwrjbU4NZilCZ_ZnQAAAQI"]
[Mon May 11 18:07:05.335723 2026] [:error] [pid 4645:tid 4664] [client 51.75.118.97:41420] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agGqSXy4dxn8-Cx5vOWhOgAAAFA"]
[Mon May 11 18:07:08.624866 2026] [:error] [pid 58677:tid 58708] [client 51.75.118.97:43238] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agGqTBasRhyteIXf1RVTFAAAAJQ"]
[Mon May 11 18:07:11.826616 2026] [:error] [pid 4645:tid 4656] [client 51.75.118.97:43244] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agGqT3y4dxn8-Cx5vOWhRgAAAEg"]
[Mon May 11 18:07:14.808812 2026] [:error] [pid 4685:tid 4710] [client 51.75.118.97:58288] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agGqUnwrjbU4NZilCZ_ZoAAAARY"]
[Mon May 11 18:07:17.916003 2026] [:error] [pid 4645:tid 4660] [client 51.75.118.97:58292] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agGqVXy4dxn8-Cx5vOWhUQAAAEw"]
[Mon May 11 18:07:21.211546 2026] [:error] [pid 4685:tid 4701] [client 51.75.118.97:58302] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agGqWXwrjbU4NZilCZ_ZqQAAAQ0"]
[Mon May 11 18:07:24.176614 2026] [:error] [pid 58616:tid 58670] [client 51.75.118.97:58308] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agGqXNnsbeF5ioCAecjf8gAAANg"]
[Mon May 11 18:07:28.326637 2026] [:error] [pid 58616:tid 58648] [client 51.75.118.97:50338] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agGqYNnsbeF5ioCAecjf9QAAAMI"]
[Mon May 11 18:07:30.966334 2026] [:error] [pid 58677:tid 58704] [client 51.75.118.97:50342] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agGqYhasRhyteIXf1RVTRgAAAJA"]
[Mon May 11 18:07:33.862966 2026] [:error] [pid 4645:tid 4667] [client 51.75.118.97:50354] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agGqZXy4dxn8-Cx5vOWhWQAAAFM"]
[Mon May 11 18:07:36.705792 2026] [:error] [pid 58615:tid 58626] [client 51.75.118.97:59606] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agGqaFK28yH055J8TSrT8wAAAAc"]
[Mon May 11 18:08:04.749169 2026] [:error] [pid 58615:tid 58626] [client 51.75.118.97:59614] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agGqhFK28yH055J8TSrUFQAAAAc"]
[Mon May 11 18:08:08.488099 2026] [:error] [pid 58677:tid 58709] [client 51.75.118.97:38876] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agGqiBasRhyteIXf1RVTUwAAAJU"]
[Mon May 11 18:08:12.134022 2026] [:error] [pid 58677:tid 58699] [client 51.75.118.97:38882] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agGqjBasRhyteIXf1RVTVAAAAIs"]
[Mon May 11 18:08:16.116030 2026] [:error] [pid 58677:tid 58695] [client 51.75.118.97:49030] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agGqkBasRhyteIXf1RVTVgAAAIc"]
[Mon May 11 18:08:19.748158 2026] [:error] [pid 4685:tid 4703] [client 51.75.118.97:49032] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agGqk3wrjbU4NZilCZ_Z1gAAAQ8"]
[Mon May 11 18:08:23.079988 2026] [:error] [pid 4685:tid 4689] [client 51.75.118.97:49044] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agGql3wrjbU4NZilCZ_Z2QAAAQE"]
[Mon May 11 18:08:26.565968 2026] [:error] [pid 58615:tid 58631] [client 51.75.118.97:56808] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agGqmlK28yH055J8TSrUGwAAAAw"]
[Mon May 11 18:08:29.928114 2026] [:error] [pid 58677:tid 58696] [client 51.75.118.97:56812] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agGqnRasRhyteIXf1RVTVwAAAIg"]
[Mon May 11 18:08:32.953161 2026] [:error] [pid 58616:tid 58649] [client 51.75.118.97:56818] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agGqoNnsbeF5ioCAecjgDAAAAMM"]
[Mon May 11 18:08:36.050401 2026] [:error] [pid 4645:tid 4667] [client 51.75.118.97:55964] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agGqpHy4dxn8-Cx5vOWhfgAAAFM"]
[Mon May 11 18:08:38.023265 2026] [:error] [pid 4645:tid 4654] [client 51.75.118.97:57980] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agGqpny4dxn8-Cx5vOWhfwAAAEY"]
[Mon May 11 18:08:42.059881 2026] [:error] [pid 58677:tid 58705] [client 51.75.118.97:57984] [client 51.75.118.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agGqqhasRhyteIXf1RVTZwAAAJE"]
[Mon May 11 19:59:35.051005 2026] [:error] [pid 58677:tid 58700] [client 61.238.27.209:33291] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agHEpxasRhyteIXf1RVj6AAAAIw"]
[Mon May 11 19:59:36.895460 2026] [:error] [pid 58616:tid 58669] [client 61.238.27.209:43359] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agHEqNnsbeF5ioCAecjpQAAAANc"]
[Mon May 11 19:59:38.914168 2026] [:error] [pid 4685:tid 4696] [client 61.238.27.209:5528] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agHEqnwrjbU4NZilCZ_5LgAAAQg"]
[Mon May 11 19:59:41.095858 2026] [:error] [pid 58750:tid 58756] [client 61.238.27.209:61584] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agHErTBVaNG3wJtPBU-t9wAAAUQ"]
[Mon May 11 19:59:43.397082 2026] [:error] [pid 58677:tid 58695] [client 61.238.27.209:57515] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agHErxasRhyteIXf1RVj7gAAAIc"]
[Mon May 11 19:59:45.655543 2026] [:error] [pid 4685:tid 4692] [client 61.238.27.209:35919] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agHEsXwrjbU4NZilCZ_5MwAAAQQ"]
[Mon May 11 19:59:47.873562 2026] [:error] [pid 4685:tid 4704] [client 61.238.27.209:38401] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agHEs3wrjbU4NZilCZ_5OAAAARA"]
[Mon May 11 19:59:50.305734 2026] [:error] [pid 58677:tid 58706] [client 61.238.27.209:61869] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agHEthasRhyteIXf1RVj8wAAAJI"]
[Mon May 11 19:59:52.820546 2026] [:error] [pid 4685:tid 4691] [client 61.238.27.209:37006] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agHEuHwrjbU4NZilCZ_5PgAAAQM"]
[Mon May 11 19:59:55.146368 2026] [:error] [pid 4685:tid 4706] [client 61.238.27.209:9641] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agHEu3wrjbU4NZilCZ_5RQAAARI"]
[Mon May 11 19:59:57.143526 2026] [:error] [pid 58616:tid 58665] [client 61.238.27.209:28635] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agHEvdnsbeF5ioCAecjpRQAAANM"]
[Mon May 11 19:59:59.317846 2026] [:error] [pid 4685:tid 4689] [client 61.238.27.209:24093] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agHEv3wrjbU4NZilCZ_5SgAAAQE"]
[Mon May 11 20:00:01.402658 2026] [:error] [pid 58750:tid 58765] [client 61.238.27.209:38006] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agHEwTBVaNG3wJtPBU-t_AAAAU0"]
[Mon May 11 20:00:03.661724 2026] [:error] [pid 4685:tid 4697] [client 61.238.27.209:55684] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agHEw3wrjbU4NZilCZ_5TAAAAQk"]
[Mon May 11 20:00:05.677524 2026] [:error] [pid 58677:tid 58696] [client 61.238.27.209:43958] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agHExRasRhyteIXf1RVj-wAAAIg"]
[Mon May 11 20:00:07.964306 2026] [:error] [pid 4685:tid 4711] [client 61.238.27.209:3413] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agHEx3wrjbU4NZilCZ_5UAAAARc"]
[Mon May 11 20:00:09.883559 2026] [:error] [pid 4685:tid 4690] [client 61.238.27.209:5776] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agHEyXwrjbU4NZilCZ_5UgAAAQI"]
[Mon May 11 20:00:12.199467 2026] [:error] [pid 58677:tid 58689] [client 61.238.27.209:62506] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agHEzBasRhyteIXf1RVkAAAAAIE"]
[Mon May 11 20:00:14.610106 2026] [:error] [pid 58677:tid 58695] [client 61.238.27.209:6308] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agHEzhasRhyteIXf1RVkAwAAAIc"]
[Mon May 11 20:00:17.181851 2026] [:error] [pid 4645:tid 4662] [client 61.238.27.209:64835] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agHE0Xy4dxn8-Cx5vOW1agAAAE4"]
[Mon May 11 20:00:19.397033 2026] [:error] [pid 4645:tid 4661] [client 61.238.27.209:50769] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agHE03y4dxn8-Cx5vOW1bQAAAE0"]
[Mon May 11 20:00:21.725537 2026] [:error] [pid 58677:tid 58710] [client 61.238.27.209:13592] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agHE1RasRhyteIXf1RVkBQAAAJY"]
[Mon May 11 20:00:23.987091 2026] [:error] [pid 4685:tid 4709] [client 61.238.27.209:1780] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agHE13wrjbU4NZilCZ_5WgAAARU"]
[Mon May 11 20:00:26.088205 2026] [:error] [pid 4645:tid 4660] [client 61.238.27.209:49473] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agHE2ny4dxn8-Cx5vOW1bgAAAEw"]
[Mon May 11 20:00:28.074499 2026] [:error] [pid 4645:tid 4671] [client 61.238.27.209:21547] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agHE3Hy4dxn8-Cx5vOW1cQAAAFc"]
[Mon May 11 20:00:30.299683 2026] [:error] [pid 58616:tid 58663] [client 61.238.27.209:17416] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agHE3tnsbeF5ioCAecjpUAAAANE"]
[Mon May 11 20:00:53.196331 2026] [:error] [pid 4685:tid 4699] [client 61.238.27.209:27655] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agHE9XwrjbU4NZilCZ_5hwAAAQs"]
[Mon May 11 20:00:55.330025 2026] [:error] [pid 4685:tid 4701] [client 61.238.27.209:48361] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agHE93wrjbU4NZilCZ_5jAAAAQ0"]
[Mon May 11 20:00:57.357963 2026] [:error] [pid 58677:tid 58702] [client 61.238.27.209:7660] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agHE-RasRhyteIXf1RVkEwAAAI4"]
[Mon May 11 20:00:59.586124 2026] [:error] [pid 58677:tid 58704] [client 61.238.27.209:44370] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agHE-xasRhyteIXf1RVkFQAAAJA"]
[Mon May 11 20:01:01.555291 2026] [:error] [pid 4685:tid 4699] [client 61.238.27.209:35689] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agHE_XwrjbU4NZilCZ_5lQAAAQs"]
[Mon May 11 20:01:03.621928 2026] [:error] [pid 58616:tid 58666] [client 61.238.27.209:35115] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agHE_9nsbeF5ioCAecjpWgAAANQ"]
[Mon May 11 20:01:05.616048 2026] [:error] [pid 58616:tid 58669] [client 61.238.27.209:16287] [client 61.238.27.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agHFAdnsbeF5ioCAecjpXQAAANc"]
[Mon May 11 21:21:16.004564 2026] [:error] [pid 4645:tid 4666] [client 62.84.185.52:36280] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agHXzHy4dxn8-Cx5vOXD7gAAAFI"]
[Mon May 11 21:21:18.593205 2026] [:error] [pid 58750:tid 58756] [client 62.84.185.52:36284] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agHXzjBVaNG3wJtPBU-0WQAAAUQ"]
[Mon May 11 21:21:21.323923 2026] [:error] [pid 58750:tid 58754] [client 62.84.185.52:45848] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agHX0TBVaNG3wJtPBU-0WgAAAUI"]
[Mon May 11 21:21:23.952842 2026] [:error] [pid 4645:tid 4650] [client 62.84.185.52:45854] [client 62.84.185.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agHX03y4dxn8-Cx5vOXD8gAAAEI"]
[Mon May 11 21:58:21.420224 2026] [:error] [pid 58750:tid 58753] [client 43.131.23.154:56052] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agHgfTBVaNG3wJtPBU-3WAAAAUE"]
[Mon May 11 22:43:30.128607 2026] [:error] [pid 58750:tid 58775] [client 43.156.232.134:57034] [client 43.156.232.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agHrEjBVaNG3wJtPBU-7hQAAAVc"]
[Mon May 11 23:05:49.420228 2026] [:error] [pid 58615:tid 58638] [client 62.84.185.69:36104] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agHwTVK28yH055J8TSrzRQAAABM"]
[Mon May 11 23:05:51.429162 2026] [:error] [pid 4685:tid 4695] [client 62.84.185.69:36108] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agHwT3wrjbU4NZilCZ8kMQAAAQc"]
[Mon May 11 23:05:53.441056 2026] [:error] [pid 4685:tid 4704] [client 62.84.185.69:36120] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agHwUXwrjbU4NZilCZ8kMwAAARA"]
[Mon May 11 23:05:55.447961 2026] [:error] [pid 58616:tid 58646] [client 62.84.185.69:11902] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agHwU9nsbeF5ioCAecj4LAAAAMA"]
[Mon May 11 23:05:57.456518 2026] [:error] [pid 58750:tid 58753] [client 62.84.185.69:11908] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agHwVTBVaNG3wJtPBU--0gAAAUE"]
[Mon May 11 23:05:59.477687 2026] [:error] [pid 58750:tid 58776] [client 62.84.185.69:11920] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agHwVzBVaNG3wJtPBU--0wAAAVg"]
[Mon May 11 23:06:01.381277 2026] [:error] [pid 4645:tid 4653] [client 62.84.185.69:11924] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agHwWXy4dxn8-Cx5vOXU-wAAAEU"]
[Mon May 11 23:06:03.459070 2026] [:error] [pid 58616:tid 58668] [client 62.84.185.69:11928] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agHwW9nsbeF5ioCAecj4NAAAANY"]
[Mon May 11 23:06:05.333603 2026] [:error] [pid 4645:tid 4670] [client 62.84.185.69:63466] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agHwXXy4dxn8-Cx5vOXU_QAAAFY"]
[Mon May 11 23:06:07.257455 2026] [:error] [pid 58615:tid 58636] [client 62.84.185.69:63468] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agHwX1K28yH055J8TSrzSgAAABE"]
[Mon May 11 23:06:09.266924 2026] [:error] [pid 4685:tid 4689] [client 62.84.185.69:63470] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agHwYXwrjbU4NZilCZ8kNQAAAQE"]
[Mon May 11 23:06:11.180330 2026] [:error] [pid 58677:tid 58708] [client 62.84.185.69:63478] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agHwYxasRhyteIXf1RV8ygAAAJQ"]
[Mon May 11 23:06:13.179583 2026] [:error] [pid 58677:tid 58699] [client 62.84.185.69:63486] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agHwZRasRhyteIXf1RV8ywAAAIs"]
[Mon May 11 23:06:15.120496 2026] [:error] [pid 4685:tid 4694] [client 62.84.185.69:63496] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agHwZ3wrjbU4NZilCZ8kQAAAAQY"]
[Mon May 11 23:06:17.169878 2026] [:error] [pid 58615:tid 58629] [client 62.84.185.69:25486] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agHwaVK28yH055J8TSrzSwAAAAo"]
[Mon May 11 23:06:19.057598 2026] [:error] [pid 4685:tid 4706] [client 62.84.185.69:25498] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agHwa3wrjbU4NZilCZ8kRAAAARI"]
[Mon May 11 23:06:21.074261 2026] [:error] [pid 58615:tid 58637] [client 62.84.185.69:25510] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agHwbVK28yH055J8TSrzTgAAABI"]
[Mon May 11 23:06:23.103935 2026] [:error] [pid 4685:tid 4703] [client 62.84.185.69:25512] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agHwb3wrjbU4NZilCZ8kTwAAAQ8"]
[Mon May 11 23:06:25.128111 2026] [:error] [pid 58677:tid 58701] [client 62.84.185.69:25514] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agHwcRasRhyteIXf1RV81QAAAI0"]
[Mon May 11 23:06:27.180202 2026] [:error] [pid 4645:tid 4648] [client 62.84.185.69:55470] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agHwc3y4dxn8-Cx5vOXVCQAAAEA"]
[Mon May 11 23:06:29.252824 2026] [:error] [pid 58615:tid 58619] [client 62.84.185.69:55486] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agHwdVK28yH055J8TSrzWgAAAAA"]
[Mon May 11 23:06:31.282219 2026] [:error] [pid 58615:tid 58641] [client 62.84.185.69:55502] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agHwd1K28yH055J8TSrzWwAAABY"]
[Mon May 11 23:06:33.240556 2026] [:error] [pid 58615:tid 58643] [client 62.84.185.69:55514] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agHweVK28yH055J8TSrzXQAAABg"]
[Mon May 11 23:06:35.302223 2026] [:error] [pid 4685:tid 4704] [client 62.84.185.69:45102] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agHwe3wrjbU4NZilCZ8kbQAAARA"]
[Mon May 11 23:06:37.186737 2026] [:error] [pid 58677:tid 58706] [client 62.84.185.69:45112] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agHwfRasRhyteIXf1RV83AAAAJI"]
[Mon May 11 23:06:39.294800 2026] [:error] [pid 58677:tid 58707] [client 62.84.185.69:45116] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agHwfxasRhyteIXf1RV83wAAAJM"]
[Mon May 11 23:06:41.308035 2026] [:error] [pid 58677:tid 58688] [client 62.84.185.69:45120] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agHwgRasRhyteIXf1RV85wAAAIA"]
[Mon May 11 23:06:43.351945 2026] [:error] [pid 4685:tid 4696] [client 62.84.185.69:45126] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agHwg3wrjbU4NZilCZ8kewAAAQg"]
[Mon May 11 23:06:45.214923 2026] [:error] [pid 4685:tid 4697] [client 62.84.185.69:45136] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agHwhXwrjbU4NZilCZ8kgAAAAQk"]
[Mon May 11 23:07:10.519352 2026] [:error] [pid 58616:tid 58653] [client 62.84.185.69:34606] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "agHwntnsbeF5ioCAecj4SAAAAMc"]
[Mon May 11 23:07:12.549562 2026] [:error] [pid 58616:tid 58646] [client 62.84.185.69:34608] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agHwoNnsbeF5ioCAecj4SgAAAMA"]
[Mon May 11 23:07:14.584571 2026] [:error] [pid 4645:tid 4670] [client 62.84.185.69:34610] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agHwony4dxn8-Cx5vOXVQwAAAFY"]
[Tue May 12 03:09:54.030378 2026] [:error] [pid 58677:tid 58709] [client 37.187.27.125:54560] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agIpghasRhyteIXf1RWWDwAAAJU"]
[Tue May 12 03:09:57.837287 2026] [:error] [pid 4685:tid 4698] [client 37.187.27.125:58486] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agIphXwrjbU4NZilCZ9RAQAAAQo"]
[Tue May 12 03:10:00.487839 2026] [:error] [pid 4685:tid 4704] [client 37.187.27.125:59050] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agIpiHwrjbU4NZilCZ9RBAAAARA"]
[Tue May 12 03:10:03.314024 2026] [:error] [pid 58615:tid 58626] [client 37.187.27.125:59490] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agIpi1K28yH055J8TSoJWQAAAAc"]
[Tue May 12 03:10:06.757129 2026] [:error] [pid 4685:tid 4701] [client 37.187.27.125:60232] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agIpjnwrjbU4NZilCZ9RFQAAAQ0"]
[Tue May 12 03:10:09.859908 2026] [:error] [pid 4685:tid 4700] [client 37.187.27.125:60868] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agIpkXwrjbU4NZilCZ9RGgAAAQw"]
[Tue May 12 03:10:13.348621 2026] [:error] [pid 4645:tid 4665] [client 37.187.27.125:33544] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agIplXy4dxn8-Cx5vOX1hgAAAFE"]
[Tue May 12 03:10:16.436077 2026] [:error] [pid 58750:tid 58752] [client 37.187.27.125:34200] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agIpmDBVaNG3wJtPBU_RFAAAAUA"]
[Tue May 12 03:10:19.492612 2026] [:error] [pid 4685:tid 4712] [client 37.187.27.125:34846] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agIpm3wrjbU4NZilCZ9RLQAAARg"]
[Tue May 12 03:10:22.316446 2026] [:error] [pid 58616:tid 58647] [client 37.187.27.125:35320] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agIpntnsbeF5ioCAecgI3wAAAME"]
[Tue May 12 03:10:25.485207 2026] [:error] [pid 4685:tid 4691] [client 37.187.27.125:35882] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agIpoXwrjbU4NZilCZ9RNAAAAQM"]
[Tue May 12 03:10:28.598748 2026] [:error] [pid 58677:tid 58695] [client 37.187.27.125:36504] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agIppBasRhyteIXf1RWWKwAAAIc"]
[Tue May 12 03:10:31.702819 2026] [:error] [pid 58615:tid 58629] [client 37.187.27.125:37020] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agIpp1K28yH055J8TSoJYAAAAAo"]
[Tue May 12 03:10:34.497957 2026] [:error] [pid 4685:tid 4691] [client 37.187.27.125:37538] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agIpqnwrjbU4NZilCZ9RQQAAAQM"]
[Tue May 12 03:10:37.883987 2026] [:error] [pid 4645:tid 4668] [client 37.187.27.125:38162] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agIprXy4dxn8-Cx5vOX1owAAAFQ"]
[Tue May 12 03:10:40.107540 2026] [:error] [pid 58615:tid 58625] [client 37.187.27.125:38540] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agIpsFK28yH055J8TSoJZwAAAAY"]
[Tue May 12 03:10:43.210160 2026] [:error] [pid 4645:tid 4650] [client 37.187.27.125:39058] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agIps3y4dxn8-Cx5vOX1qwAAAEI"]
[Tue May 12 03:10:45.679577 2026] [:error] [pid 58677:tid 58699] [client 37.187.27.125:39458] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agIptRasRhyteIXf1RWWMgAAAIs"]
[Tue May 12 03:10:48.900188 2026] [:error] [pid 58750:tid 58773] [client 37.187.27.125:39968] [client 37.187.27.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agIpuDBVaNG3wJtPBU_RHQAAAVU"]
[Tue May 12 03:17:08.067250 2026] [:error] [pid 36979:tid 37077] [client 43.133.69.37:36184] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agIrNFtFL3jRxlgG6lSBnAAAAJU"]
[Tue May 12 03:29:26.998710 2026] [:error] [pid 39958:tid 40034] [client 94.247.172.129:15955] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agIuFuVI9FVDxXB2XxgZAQAAAI8"]
[Tue May 12 04:17:35.362897 2026] [:error] [pid 39957:tid 39993] [client 43.153.15.51:34748] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agI5X-AfHHyq0DBh5BLu9wAAAEE"]
[Tue May 12 08:01:41.255666 2026] [:error] [pid 40061:tid 40078] [client 34.155.115.227:39396] [client 34.155.115.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "agJt5bycIKt8hxHMBYuXewAAAM8"]
[Tue May 12 08:26:37.178881 2026] [:error] [pid 39958:tid 40031] [client 43.162.109.249:50396] [client 43.162.109.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agJzveVI9FVDxXB2Xxg7_wAAAIw"]
[Tue May 12 11:31:34.423063 2026] [:error] [pid 40061:tid 40075] [client 147.135.128.94:47460] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agKfFrycIKt8hxHMBYu58wAAAMw"]
[Tue May 12 11:31:37.024846 2026] [:error] [pid 55559:tid 55644] [client 147.135.128.94:43220] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agKfGdj0hVMLJAOI_fx_JAAAARc"]
[Tue May 12 11:31:38.788828 2026] [:error] [pid 55559:tid 55637] [client 147.135.128.94:59298] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agKfGtj0hVMLJAOI_fx_KwAAARE"]
[Tue May 12 11:31:40.718864 2026] [:error] [pid 39958:tid 40027] [client 147.135.128.94:59306] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agKfHOVI9FVDxXB2XxhPXAAAAIg"]
[Tue May 12 11:31:43.116951 2026] [:error] [pid 55559:tid 55624] [client 147.135.128.94:41184] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agKfH9j0hVMLJAOI_fx_LgAAAQY"]
[Tue May 12 11:31:45.032765 2026] [:error] [pid 40061:tid 40076] [client 147.135.128.94:59318] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agKfIbycIKt8hxHMBYu59wAAAM0"]
[Tue May 12 11:31:47.467977 2026] [:error] [pid 55559:tid 55630] [client 147.135.128.94:41190] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agKfI9j0hVMLJAOI_fx_MgAAAQw"]
[Tue May 12 11:31:49.345780 2026] [:error] [pid 39958:tid 40031] [client 147.135.128.94:58352] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agKfJeVI9FVDxXB2XxhPYAAAAIw"]
[Tue May 12 11:31:51.284651 2026] [:error] [pid 42143:tid 42155] [client 147.135.128.94:58360] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agKfJ0S2WmK92iCO2L2joQAAAUg"]
[Tue May 12 11:31:53.028884 2026] [:error] [pid 40061:tid 40066] [client 147.135.128.94:58372] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agKfKbycIKt8hxHMBYu5-QAAAMM"]
[Tue May 12 11:31:54.959410 2026] [:error] [pid 39957:tid 40015] [client 147.135.128.94:58386] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agKfKuAfHHyq0DBh5BIndAAAAFc"]
[Tue May 12 11:31:56.885929 2026] [:error] [pid 40061:tid 40069] [client 147.135.128.94:58398] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agKfLLycIKt8hxHMBYu5_QAAAMY"]
[Tue May 12 11:31:58.791879 2026] [:error] [pid 39957:tid 40011] [client 147.135.128.94:48508] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agKfLuAfHHyq0DBh5BIneQAAAFM"]
[Tue May 12 11:32:01.161031 2026] [:error] [pid 42143:tid 42152] [client 147.135.128.94:44640] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agKfMUS2WmK92iCO2L2jqwAAAUU"]
[Tue May 12 11:32:03.840229 2026] [:error] [pid 39958:tid 40032] [client 147.135.128.94:48514] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agKfM-VI9FVDxXB2XxhPagAAAI0"]
[Tue May 12 11:32:07.625835 2026] [:error] [pid 42143:tid 42162] [client 147.135.128.94:45860] [client 147.135.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agKfN0S2WmK92iCO2L2jswAAAU8"]
[Tue May 12 12:14:29.312105 2026] [proxy_fcgi:error] [pid 39958:tid 40026] [client 66.249.79.36:40889] AH01071: Got error 'Primary script unknown'
[Tue May 12 12:17:19.755966 2026] [:error] [pid 39957:tid 40015] [client 119.91.20.139:40602] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agKpz-AfHHyq0DBh5BIwZQAAAFc"]
[Tue May 12 13:11:57.109050 2026] [:error] [pid 42143:tid 42151] [client 43.158.91.71:58654] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agK2nUS2WmK92iCO2L3DBQAAAUQ"]
[Tue May 12 14:03:06.761641 2026] [:error] [pid 21242:tid 21259] [client 43.157.181.189:57194] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agLCmszeh8JWZob6PnKZNgAAAY0"]
[Tue May 12 15:08:21.231794 2026] [:error] [pid 40061:tid 40071] [client 135.181.213.219:64242] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agLR5bycIKt8hxHMBYvbyQAAAMg"]
[Tue May 12 15:08:23.707085 2026] [:error] [pid 42143:tid 42159] [client 135.181.213.219:64246] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agLR50S2WmK92iCO2L3hvwAAAUw"]
[Tue May 12 15:08:26.275776 2026] [:error] [pid 21242:tid 21246] [client 135.181.213.219:64258] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agLR6szeh8JWZob6PnKpzwAAAYA"]
[Tue May 12 15:08:28.961366 2026] [:error] [pid 42143:tid 42164] [client 135.181.213.219:64262] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agLR7ES2WmK92iCO2L3hwwAAAVE"]
[Tue May 12 15:08:31.459938 2026] [:error] [pid 55559:tid 55629] [client 135.181.213.219:45798] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agLR79j0hVMLJAOI_fyZrwAAAQs"]
[Tue May 12 15:08:34.027702 2026] [:error] [pid 39957:tid 39998] [client 135.181.213.219:45810] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agLR8uAfHHyq0DBh5BJSAgAAAEY"]
[Tue May 12 15:08:36.472583 2026] [:error] [pid 39956:tid 39967] [client 135.181.213.219:45824] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agLR9I2K3wZDsNji3Mz3ggAAAAI"]
[Tue May 12 15:08:38.963033 2026] [:error] [pid 42143:tid 42166] [client 135.181.213.219:45830] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agLR9kS2WmK92iCO2L3h0AAAAVM"]
[Tue May 12 15:08:41.419732 2026] [:error] [pid 42143:tid 42167] [client 135.181.213.219:29760] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agLR-US2WmK92iCO2L3h3QAAAVQ"]
[Tue May 12 15:08:43.891923 2026] [:error] [pid 21242:tid 21270] [client 135.181.213.219:29766] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agLR-8zeh8JWZob6PnKp3gAAAZg"]
[Tue May 12 15:08:46.494661 2026] [:error] [pid 39957:tid 40008] [client 135.181.213.219:29768] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agLR_uAfHHyq0DBh5BJSFQAAAFA"]
[Tue May 12 15:08:48.973321 2026] [:error] [pid 39956:tid 39971] [client 135.181.213.219:29774] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agLSAI2K3wZDsNji3Mz3mAAAAAY"]
[Tue May 12 15:08:51.424145 2026] [:error] [pid 21242:tid 21246] [client 135.181.213.219:1264] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agLSA8zeh8JWZob6PnKp6gAAAYA"]
[Tue May 12 15:08:53.734329 2026] [:error] [pid 39957:tid 39995] [client 135.181.213.219:1266] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agLSBeAfHHyq0DBh5BJSIgAAAEM"]
[Tue May 12 15:09:03.202459 2026] [:error] [pid 21242:tid 21263] [client 135.181.213.219:38678] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agLSD8zeh8JWZob6PnKp_wAAAZE"]
[Tue May 12 15:09:05.508777 2026] [:error] [pid 39957:tid 40007] [client 135.181.213.219:38684] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agLSEeAfHHyq0DBh5BJSLQAAAE8"]
[Tue May 12 15:09:08.121983 2026] [:error] [pid 21242:tid 21251] [client 135.181.213.219:38690] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agLSFMzeh8JWZob6PnKqAgAAAYU"]
[Tue May 12 15:09:10.587611 2026] [:error] [pid 39957:tid 40010] [client 135.181.213.219:32888] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agLSFuAfHHyq0DBh5BJSMgAAAFI"]
[Tue May 12 15:09:13.061180 2026] [:error] [pid 21242:tid 21254] [client 135.181.213.219:32892] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agLSGczeh8JWZob6PnKqCgAAAYg"]
[Tue May 12 15:09:15.370678 2026] [:error] [pid 40061:tid 40081] [client 135.181.213.219:32920] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agLSG7ycIKt8hxHMBYvb6gAAANI"]
[Tue May 12 15:09:17.839462 2026] [:error] [pid 39957:tid 40000] [client 135.181.213.219:32926] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agLSHeAfHHyq0DBh5BJSQgAAAEg"]
[Tue May 12 15:09:47.522892 2026] [:error] [pid 40061:tid 40079] [client 135.181.213.219:57260] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agLSO7ycIKt8hxHMBYvcAAAAANA"]
[Tue May 12 15:09:50.022523 2026] [:error] [pid 42143:tid 42170] [client 135.181.213.219:57272] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agLSPkS2WmK92iCO2L3iGwAAAVc"]
[Tue May 12 15:09:52.602907 2026] [:error] [pid 40061:tid 40077] [client 135.181.213.219:45966] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agLSQLycIKt8hxHMBYvcBQAAAM4"]
[Tue May 12 15:09:55.121207 2026] [:error] [pid 21242:tid 21249] [client 135.181.213.219:45974] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agLSQ8zeh8JWZob6PnKqRAAAAYM"]
[Tue May 12 15:09:57.621933 2026] [:error] [pid 42143:tid 42150] [client 135.181.213.219:45986] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agLSRUS2WmK92iCO2L3iMQAAAUM"]
[Tue May 12 15:10:00.085350 2026] [:error] [pid 21242:tid 21252] [client 135.181.213.219:46000] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agLSSMzeh8JWZob6PnKqWgAAAYY"]
[Tue May 12 15:10:02.609430 2026] [:error] [pid 21242:tid 21266] [client 135.181.213.219:37726] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agLSSszeh8JWZob6PnKqXgAAAZQ"]
[Tue May 12 15:10:04.936853 2026] [:error] [pid 42143:tid 42169] [client 135.181.213.219:37738] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agLSTES2WmK92iCO2L3iTQAAAVY"]
[Tue May 12 16:10:57.855807 2026] [:error] [pid 39957:tid 39997] [client 51.77.217.11:42866] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agLgkeAfHHyq0DBh5BJazAAAAEU"]
[Tue May 12 16:11:00.169602 2026] [:error] [pid 42143:tid 42167] [client 51.77.217.11:50650] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agLglES2WmK92iCO2L3vdgAAAVQ"]
[Tue May 12 16:11:02.404420 2026] [:error] [pid 21242:tid 21269] [client 51.77.217.11:50656] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agLglszeh8JWZob6PnK7xAAAAZc"]
[Tue May 12 16:11:04.692420 2026] [:error] [pid 21242:tid 21253] [client 51.77.217.11:50666] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agLgmMzeh8JWZob6PnK7xQAAAYc"]
[Tue May 12 16:11:07.231705 2026] [:error] [pid 40061:tid 40086] [client 51.77.217.11:50676] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agLgm7ycIKt8hxHMBYviagAAANc"]
[Tue May 12 16:11:09.501315 2026] [:error] [pid 39956:tid 39982] [client 51.77.217.11:37416] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agLgnY2K3wZDsNji3Mz74gAAABE"]
[Tue May 12 16:11:11.893931 2026] [:error] [pid 55559:tid 55633] [client 51.77.217.11:37420] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agLgn9j0hVMLJAOI_fyergAAAQ4"]
[Tue May 12 16:11:14.140157 2026] [:error] [pid 21242:tid 21248] [client 51.77.217.11:37428] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agLgoszeh8JWZob6PnK74wAAAYI"]
[Tue May 12 16:11:16.518490 2026] [:error] [pid 40061:tid 40083] [client 51.77.217.11:37444] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agLgpLycIKt8hxHMBYvibwAAANQ"]
[Tue May 12 16:11:18.914724 2026] [:error] [pid 21242:tid 21249] [client 51.77.217.11:47730] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agLgpszeh8JWZob6PnK77AAAAYM"]
[Tue May 12 16:11:21.452138 2026] [:error] [pid 42143:tid 42148] [client 51.77.217.11:47744] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agLgqUS2WmK92iCO2L3vgwAAAUE"]
[Tue May 12 16:11:23.845590 2026] [:error] [pid 55559:tid 55640] [client 51.77.217.11:47760] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agLgq9j0hVMLJAOI_fyetwAAARM"]
[Tue May 12 16:11:26.225705 2026] [:error] [pid 42143:tid 42160] [client 51.77.217.11:47766] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agLgrkS2WmK92iCO2L3viwAAAU0"]
[Tue May 12 16:11:28.629247 2026] [:error] [pid 40061:tid 40072] [client 51.77.217.11:47774] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agLgsLycIKt8hxHMBYvifAAAAMk"]
[Tue May 12 16:11:31.164648 2026] [:error] [pid 40061:tid 40076] [client 51.77.217.11:55282] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agLgs7ycIKt8hxHMBYvifQAAAM0"]
[Tue May 12 16:11:33.597315 2026] [:error] [pid 39956:tid 39973] [client 51.77.217.11:55298] [client 51.77.217.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agLgtY2K3wZDsNji3Mz78gAAAAg"]
[Tue May 12 16:42:46.398925 2026] [:error] [pid 55559:tid 55621] [client 84.32.50.19:43530] [client 84.32.50.19] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=text/css"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agLoBtj0hVMLJAOI_fyhTwAAAQM"]
[Tue May 12 16:59:23.392540 2026] [:error] [pid 42143:tid 42161] [client 147.135.212.202:52152] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agLr60S2WmK92iCO2L34bgAAAU4"]
[Tue May 12 16:59:25.338844 2026] [:error] [pid 21242:tid 21265] [client 147.135.212.202:60714] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agLr7czeh8JWZob6PnLGmAAAAZM"]
[Tue May 12 16:59:27.335765 2026] [:error] [pid 21242:tid 21262] [client 147.135.212.202:60718] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agLr78zeh8JWZob6PnLGnQAAAZA"]
[Tue May 12 16:59:29.199445 2026] [:error] [pid 40061:tid 40066] [client 147.135.212.202:60732] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agLr8bycIKt8hxHMBYvmpAAAAMM"]
[Tue May 12 16:59:31.215898 2026] [:error] [pid 42143:tid 42167] [client 147.135.212.202:60746] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agLr80S2WmK92iCO2L34cwAAAVQ"]
[Tue May 12 16:59:33.225229 2026] [:error] [pid 55559:tid 55629] [client 147.135.212.202:60750] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agLr9dj0hVMLJAOI_fyiTwAAAQs"]
[Tue May 12 16:59:35.220120 2026] [:error] [pid 21242:tid 21258] [client 147.135.212.202:54940] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agLr98zeh8JWZob6PnLGqQAAAYw"]
[Tue May 12 16:59:37.224272 2026] [:error] [pid 42143:tid 42151] [client 147.135.212.202:54944] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agLr-US2WmK92iCO2L34ewAAAUQ"]
[Tue May 12 16:59:40.478003 2026] [:error] [pid 42143:tid 42149] [client 147.135.212.202:54950] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agLr_ES2WmK92iCO2L34gwAAAUI"]
[Tue May 12 16:59:44.367647 2026] [:error] [pid 39957:tid 39997] [client 147.135.212.202:54960] [client 147.135.212.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agLsAOAfHHyq0DBh5BJgpQAAAEU"]
[Tue May 12 17:24:28.896221 2026] [:error] [pid 21242:tid 21261] [client 93.158.213.25:60376] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agLxzMzeh8JWZob6PnLNIQAAAY8"]
[Tue May 12 17:24:31.451354 2026] [:error] [pid 42143:tid 42167] [client 93.158.213.25:52776] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agLxz0S2WmK92iCO2L380gAAAVQ"]
[Tue May 12 17:24:33.564881 2026] [:error] [pid 39957:tid 39994] [client 93.158.213.25:52782] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agLx0eAfHHyq0DBh5BJkSgAAAEI"]
[Tue May 12 17:24:35.606773 2026] [:error] [pid 42143:tid 42148] [client 93.158.213.25:33762] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agLx00S2WmK92iCO2L386QAAAUE"]
[Tue May 12 17:24:37.923017 2026] [:error] [pid 39956:tid 39972] [client 93.158.213.25:33774] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agLx1Y2K3wZDsNji3MwAZwAAAAc"]
[Tue May 12 17:24:39.887949 2026] [:error] [pid 42143:tid 42165] [client 93.158.213.25:33782] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agLx10S2WmK92iCO2L387wAAAVI"]
[Tue May 12 17:24:42.104906 2026] [:error] [pid 21242:tid 21270] [client 93.158.213.25:33798] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agLx2szeh8JWZob6PnLNOwAAAZg"]
[Tue May 12 17:24:47.568243 2026] [:error] [pid 40061:tid 40079] [client 93.158.213.25:56330] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agLx37ycIKt8hxHMBYvo_wAAANA"]
[Tue May 12 17:24:49.761473 2026] [:error] [pid 42143:tid 42152] [client 93.158.213.25:56342] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agLx4US2WmK92iCO2L389QAAAUU"]
[Tue May 12 17:24:52.133665 2026] [:error] [pid 39958:tid 40036] [client 93.158.213.25:56346] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agLx5OVI9FVDxXB2XxhwfwAAAJE"]
[Tue May 12 17:24:55.819127 2026] [:error] [pid 39957:tid 40014] [client 93.158.213.25:43110] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agLx5-AfHHyq0DBh5BJkbAAAAFY"]
[Tue May 12 17:25:00.011306 2026] [:error] [pid 55559:tid 55622] [client 93.158.213.25:43120] [client 93.158.213.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agLx7Nj0hVMLJAOI_fyk9QAAAQQ"]
[Tue May 12 18:08:52.282087 2026] [:error] [pid 21242:tid 21270] [client 43.166.136.153:49326] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agL8NMzeh8JWZob6PnLXeQAAAZg"]
[Tue May 12 18:57:45.715621 2026] [:error] [pid 21242:tid 21247] [client 43.134.98.88:56924] [client 43.134.98.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agMHqczeh8JWZob6PnLlzwAAAYE"]
[Tue May 12 21:23:19.133588 2026] [:error] [pid 39958:tid 40031] [client 91.92.241.188:52232] [client 91.92.241.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agMpx-VI9FVDxXB2XxiEiwAAAIw"]
[Tue May 12 21:27:12.096394 2026] [:error] [pid 21242:tid 21258] [client 147.135.213.9:50948] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agMqsMzeh8JWZob6PnISxAAAAYw"]
[Tue May 12 21:27:14.573824 2026] [:error] [pid 21242:tid 21247] [client 147.135.213.9:54412] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agMqsszeh8JWZob6PnISyQAAAYE"]
[Tue May 12 21:27:17.096958 2026] [:error] [pid 42143:tid 42158] [client 147.135.213.9:49076] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agMqtUS2WmK92iCO2L0sPwAAAUs"]
[Tue May 12 21:27:19.452178 2026] [:error] [pid 39958:tid 40029] [client 147.135.213.9:49084] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agMqt-VI9FVDxXB2XxiE7wAAAIo"]
[Tue May 12 21:27:21.960469 2026] [:error] [pid 55559:tid 55640] [client 147.135.213.9:49100] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agMqudj0hVMLJAOI_fy9kgAAARM"]
[Tue May 12 21:27:24.529304 2026] [:error] [pid 55559:tid 55638] [client 147.135.213.9:49108] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agMqvNj0hVMLJAOI_fy9lgAAARI"]
[Tue May 12 21:27:26.504308 2026] [:error] [pid 21242:tid 21264] [client 147.135.213.9:55806] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agMqvszeh8JWZob6PnIS6QAAAZI"]
[Tue May 12 21:27:28.955638 2026] [:error] [pid 39957:tid 40016] [client 147.135.213.9:35878] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agMqwOAfHHyq0DBh5BKKxQAAAFg"]
[Tue May 12 21:27:30.973336 2026] [:error] [pid 42143:tid 42167] [client 147.135.213.9:55814] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agMqwkS2WmK92iCO2L0sQwAAAVQ"]
[Tue May 12 21:27:32.841694 2026] [:error] [pid 39957:tid 39999] [client 147.135.213.9:55816] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agMqxOAfHHyq0DBh5BKKyAAAAEc"]
[Tue May 12 21:27:34.707683 2026] [:error] [pid 21242:tid 21260] [client 147.135.213.9:55824] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agMqxszeh8JWZob6PnIS8AAAAY4"]
[Tue May 12 21:27:36.550938 2026] [:error] [pid 21242:tid 21252] [client 147.135.213.9:45934] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agMqyMzeh8JWZob6PnIS9AAAAYY"]
[Tue May 12 21:27:39.103966 2026] [:error] [pid 39956:tid 39985] [client 147.135.213.9:40612] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agMqy42K3wZDsNji3MwRiwAAABQ"]
[Tue May 12 21:27:41.180346 2026] [:error] [pid 21242:tid 21258] [client 147.135.213.9:45950] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agMqzczeh8JWZob6PnIS-gAAAYw"]
[Tue May 12 21:27:43.075907 2026] [:error] [pid 21242:tid 21267] [client 147.135.213.9:45956] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agMqz8zeh8JWZob6PnIS_AAAAZU"]
[Tue May 12 21:27:45.061128 2026] [:error] [pid 39957:tid 40000] [client 147.135.213.9:45972] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agMq0eAfHHyq0DBh5BKK0QAAAEg"]
[Tue May 12 21:27:47.354478 2026] [:error] [pid 55559:tid 55620] [client 147.135.213.9:48554] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agMq09j0hVMLJAOI_fy9owAAAQI"]
[Tue May 12 21:27:49.432392 2026] [:error] [pid 39957:tid 39996] [client 147.135.213.9:48556] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agMq1eAfHHyq0DBh5BKK1QAAAEQ"]
[Tue May 12 21:27:51.402737 2026] [:error] [pid 21242:tid 21265] [client 147.135.213.9:48562] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agMq18zeh8JWZob6PnITBQAAAZM"]
[Tue May 12 21:27:53.376066 2026] [:error] [pid 42143:tid 42149] [client 147.135.213.9:48578] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agMq2US2WmK92iCO2L0sSQAAAUI"]
[Tue May 12 21:27:55.845784 2026] [:error] [pid 21242:tid 21252] [client 147.135.213.9:39476] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agMq28zeh8JWZob6PnITDAAAAYY"]
[Tue May 12 21:27:57.792530 2026] [:error] [pid 21242:tid 21254] [client 147.135.213.9:43784] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agMq3czeh8JWZob6PnITEAAAAYg"]
[Tue May 12 21:28:00.254477 2026] [:error] [pid 39957:tid 40000] [client 147.135.213.9:45928] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agMq4OAfHHyq0DBh5BKK4gAAAEg"]
[Tue May 12 21:28:02.211370 2026] [:error] [pid 21242:tid 21257] [client 147.135.213.9:43788] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agMq4szeh8JWZob6PnITFwAAAYs"]
[Tue May 12 21:28:04.271330 2026] [:error] [pid 39957:tid 40015] [client 147.135.213.9:43800] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agMq5OAfHHyq0DBh5BKK5QAAAFc"]
[Tue May 12 21:28:06.220348 2026] [:error] [pid 55559:tid 55641] [client 147.135.213.9:47826] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agMq5tj0hVMLJAOI_fy9qQAAARQ"]
[Tue May 12 21:28:30.193701 2026] [:error] [pid 42143:tid 42163] [client 147.135.213.9:36224] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agMq_kS2WmK92iCO2L0sVwAAAVA"]
[Tue May 12 21:28:31.942659 2026] [:error] [pid 42143:tid 42165] [client 147.135.213.9:47840] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agMq_0S2WmK92iCO2L0sXgAAAVI"]
[Tue May 12 21:28:33.913153 2026] [:error] [pid 39957:tid 40010] [client 147.135.213.9:38752] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agMrAeAfHHyq0DBh5BKK9QAAAFI"]
[Tue May 12 21:28:35.860228 2026] [:error] [pid 42143:tid 42150] [client 147.135.213.9:38756] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agMrA0S2WmK92iCO2L0sZgAAAUM"]
[Tue May 12 21:28:37.971227 2026] [:error] [pid 42143:tid 42158] [client 147.135.213.9:55776] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agMrBUS2WmK92iCO2L0saQAAAUs"]
[Tue May 12 21:28:40.071532 2026] [:error] [pid 39957:tid 40013] [client 147.135.213.9:55788] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agMrCOAfHHyq0DBh5BKK9wAAAFU"]
[Tue May 12 21:28:41.946445 2026] [:error] [pid 40061:tid 40064] [client 147.135.213.9:55798] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agMrCbycIKt8hxHMBYsHFgAAAME"]
[Tue May 12 21:28:44.177101 2026] [:error] [pid 39957:tid 39996] [client 147.135.213.9:55814] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agMrDOAfHHyq0DBh5BKLAAAAAEQ"]
[Tue May 12 21:28:46.803037 2026] [:error] [pid 55559:tid 55643] [client 147.135.213.9:44528] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agMrDtj0hVMLJAOI_fy9rwAAARY"]
[Tue May 12 21:28:50.293132 2026] [:error] [pid 42143:tid 42147] [client 147.135.213.9:44530] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agMrEkS2WmK92iCO2L0sbQAAAUA"]
[Tue May 12 21:28:52.994056 2026] [:error] [pid 42143:tid 42153] [client 147.135.213.9:44542] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agMrFES2WmK92iCO2L0scAAAAUY"]
[Tue May 12 21:28:55.694621 2026] [:error] [pid 39957:tid 39997] [client 147.135.213.9:44548] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agMrF-AfHHyq0DBh5BKLBAAAAEU"]
[Tue May 12 21:28:58.437289 2026] [:error] [pid 40061:tid 40074] [client 147.135.213.9:41680] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agMrGrycIKt8hxHMBYsHJAAAAMs"]
[Tue May 12 21:29:02.197108 2026] [:error] [pid 21242:tid 21261] [client 147.135.213.9:41692] [client 147.135.213.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agMrHszeh8JWZob6PnITRgAAAY8"]
[Tue May 12 23:46:44.029976 2026] [:error] [pid 39958:tid 40024] [client 101.33.81.73:38646] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agNLZOVI9FVDxXB2XxiOpgAAAIU"]
[Wed May 13 01:00:23.694127 2026] [:error] [pid 21242:tid 21267] [client 5.129.213.170:43228] [client 5.129.213.170] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agNcp8zeh8JWZob6PnI7_AAAAZU"]
[Wed May 13 01:00:23.695158 2026] [:error] [pid 21242:tid 21267] [client 5.129.213.170:43228] [client 5.129.213.170] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.switchcreative.net|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agNcp8zeh8JWZob6PnI7_AAAAZU"]
[Wed May 13 01:00:23.695217 2026] [:error] [pid 21242:tid 21267] [client 5.129.213.170:43228] [client 5.129.213.170] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agNcp8zeh8JWZob6PnI7_AAAAZU"]
[Wed May 13 01:00:37.652504 2026] [:error] [pid 21242:tid 21264] [client 81.167.26.57:15255] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agNctczeh8JWZob6PnI8CwAAAZI"]
[Wed May 13 01:00:39.600149 2026] [:error] [pid 39957:tid 40013] [client 81.167.26.57:21025] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agNct-AfHHyq0DBh5BKjiwAAAFU"]
[Wed May 13 01:00:41.593429 2026] [:error] [pid 21242:tid 21258] [client 81.167.26.57:4737] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agNcuczeh8JWZob6PnI8DQAAAYw"]
[Wed May 13 01:00:43.440299 2026] [:error] [pid 39957:tid 39996] [client 81.167.26.57:14117] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agNcu-AfHHyq0DBh5BKjjgAAAEQ"]
[Wed May 13 01:00:45.405518 2026] [:error] [pid 55559:tid 55637] [client 81.167.26.57:20108] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agNcvdj0hVMLJAOI_fzPHwAAARE"]
[Wed May 13 01:00:47.376903 2026] [:error] [pid 42143:tid 42171] [client 81.167.26.57:12078] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agNcv0S2WmK92iCO2L1KrAAAAVg"]
[Wed May 13 01:00:49.369052 2026] [:error] [pid 39957:tid 40009] [client 81.167.26.57:46860] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agNcweAfHHyq0DBh5BKjlgAAAFE"]
[Wed May 13 01:00:51.388444 2026] [:error] [pid 39957:tid 39996] [client 81.167.26.57:23954] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agNcw-AfHHyq0DBh5BKjmgAAAEQ"]
[Wed May 13 01:00:53.507771 2026] [:error] [pid 40061:tid 40063] [client 81.167.26.57:35669] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agNcxbycIKt8hxHMBYsb0gAAAMA"]
[Wed May 13 01:00:55.626824 2026] [:error] [pid 42143:tid 42161] [client 81.167.26.57:41262] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agNcx0S2WmK92iCO2L1KrQAAAU4"]
[Wed May 13 01:00:57.597581 2026] [:error] [pid 21242:tid 21250] [client 81.167.26.57:38577] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agNcyczeh8JWZob6PnI8IAAAAYQ"]
[Wed May 13 01:00:59.570590 2026] [:error] [pid 39957:tid 40003] [client 81.167.26.57:36892] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agNcy-AfHHyq0DBh5BKjnQAAAEs"]
[Wed May 13 01:01:01.550859 2026] [:error] [pid 39956:tid 39983] [client 81.167.26.57:30929] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agNczY2K3wZDsNji3MwecQAAABI"]
[Wed May 13 01:01:03.533487 2026] [:error] [pid 42143:tid 42155] [client 81.167.26.57:16462] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agNcz0S2WmK92iCO2L1KugAAAUg"]
[Wed May 13 01:01:05.371844 2026] [:error] [pid 21242:tid 21246] [client 81.167.26.57:22007] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agNc0czeh8JWZob6PnI8IgAAAYA"]
[Wed May 13 01:01:07.354014 2026] [:error] [pid 42143:tid 42167] [client 81.167.26.57:20942] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agNc00S2WmK92iCO2L1KxgAAAVQ"]
[Wed May 13 01:01:09.323534 2026] [:error] [pid 39957:tid 40003] [client 81.167.26.57:17787] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agNc1eAfHHyq0DBh5BKjqAAAAEs"]
[Wed May 13 01:01:11.300703 2026] [:error] [pid 39957:tid 40011] [client 81.167.26.57:33779] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agNc1-AfHHyq0DBh5BKjrQAAAFM"]
[Wed May 13 01:01:14.305811 2026] [:error] [pid 40061:tid 40072] [client 81.167.26.57:15806] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agNc2rycIKt8hxHMBYsb2QAAAMk"]
[Wed May 13 01:01:16.349787 2026] [:error] [pid 42143:tid 42167] [client 81.167.26.57:53734] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agNc3ES2WmK92iCO2L1KyQAAAVQ"]
[Wed May 13 01:01:18.337907 2026] [:error] [pid 40061:tid 40075] [client 81.167.26.57:49556] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agNc3rycIKt8hxHMBYsb3AAAAMw"]
[Wed May 13 01:01:20.325869 2026] [:error] [pid 42143:tid 42166] [client 81.167.26.57:36107] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agNc4ES2WmK92iCO2L1KzAAAAVM"]
[Wed May 13 01:01:22.295044 2026] [:error] [pid 39957:tid 40014] [client 81.167.26.57:55200] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agNc4uAfHHyq0DBh5BKjsQAAAFY"]
[Wed May 13 01:01:24.146399 2026] [:error] [pid 39957:tid 39999] [client 81.167.26.57:57466] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agNc5OAfHHyq0DBh5BKjtAAAAEc"]
[Wed May 13 01:01:26.122991 2026] [:error] [pid 40061:tid 40073] [client 81.167.26.57:10861] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agNc5rycIKt8hxHMBYsb4wAAAMo"]
[Wed May 13 01:01:27.947680 2026] [:error] [pid 39958:tid 40032] [client 81.167.26.57:1579] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agNc5-VI9FVDxXB2XxiSygAAAI0"]
[Wed May 13 01:11:08.458502 2026] [:error] [pid 21242:tid 21262] [client 34.94.86.8:43748] [client 34.94.86.8] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agNfLMzeh8JWZob6PnI-zgAAAZA"]
[Wed May 13 01:30:29.763866 2026] [:error] [pid 55559:tid 55632] [client 35.246.43.2:43244] [client 35.246.43.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agNjtdj0hVMLJAOI_fzR-QAAAQ0"]
[Wed May 13 01:32:02.840293 2026] [:error] [pid 39958:tid 40042] [client 162.14.66.219:60732] [client 162.14.66.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agNkEuVI9FVDxXB2XxiVFAAAAJc"]
[Wed May 13 02:46:03.019731 2026] [autoindex:error] [pid 21242:tid 21248] [client 141.98.11.120:58126] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed May 13 02:49:11.887025 2026] [:error] [pid 55559:tid 55621] [client 195.63.19.5:57974] [client 195.63.19.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.63.19.5, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "agN2J9j0hVMLJAOI_fzbOgAAAQM"]
[Wed May 13 02:49:11.897467 2026] [proxy_fcgi:error] [pid 55559:tid 55621] [client 195.63.19.5:57974] AH01071: Got error 'Primary script unknown'
[Wed May 13 02:49:12.792832 2026] [:error] [pid 55559:tid 55632] [client 217.181.84.78:48980] [client 217.181.84.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.181.84.78, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "agN2KNj0hVMLJAOI_fzbPQAAAQ0"]
[Wed May 13 02:49:12.796953 2026] [proxy_fcgi:error] [pid 55559:tid 55632] [client 217.181.84.78:48980] AH01071: Got error 'Primary script unknown'
[Wed May 13 02:49:13.702414 2026] [:error] [pid 42143:tid 42168] [client 195.63.19.241:22466] [client 195.63.19.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.63.19.241, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "agN2KUS2WmK92iCO2L1g4wAAAVU"]
[Wed May 13 02:49:13.706475 2026] [proxy_fcgi:error] [pid 42143:tid 42168] [client 195.63.19.241:22466] AH01071: Got error 'Primary script unknown'
[Wed May 13 03:25:26.814783 2026] [:error] [pid 55559:tid 55626] [client 110.89.5.128:19883] [client 110.89.5.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agN-ptj0hVMLJAOI_fzf7AAAAQg"], referer: http://switchcreative.net/
[Wed May 13 04:21:08.397612 2026] [:error] [pid 23887:tid 23916] [client 43.153.7.191:51010] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agOLtNSKmvZJZkXBFDDZAQAAANU"]
[Wed May 13 05:00:35.595126 2026] [:error] [pid 23780:tid 23806] [client 147.135.252.177:48290] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agOU83XgOibPjrXgeTA45QAAAAw"]
[Wed May 13 05:00:37.440298 2026] [:error] [pid 23782:tid 23833] [client 147.135.252.177:38428] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agOU9SBrKFYHXUGnR-prqgAAAEw"]
[Wed May 13 05:00:39.539858 2026] [:error] [pid 23787:tid 23859] [client 147.135.252.177:47898] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agOU9x1cs5wE7VT6wiqR3QAAAIs"]
[Wed May 13 05:00:41.496515 2026] [:error] [pid 3259:tid 3285] [client 147.135.252.177:47912] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agOU-eWJB4YwcPVLeApqWwAAARg"]
[Wed May 13 05:00:43.989297 2026] [:error] [pid 23787:tid 23849] [client 147.135.252.177:41540] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agOU-x1cs5wE7VT6wiqR4QAAAIE"]
[Wed May 13 05:00:46.192661 2026] [:error] [pid 23787:tid 23864] [client 147.135.252.177:41862] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agOU_h1cs5wE7VT6wiqR4gAAAJA"]
[Wed May 13 05:00:48.555545 2026] [:error] [pid 23887:tid 23895] [client 147.135.252.177:41544] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agOVANSKmvZJZkXBFDDhxQAAAMA"]
[Wed May 13 05:00:50.570863 2026] [:error] [pid 23887:tid 23897] [client 147.135.252.177:41876] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agOVAtSKmvZJZkXBFDDhywAAAMI"]
[Wed May 13 05:00:52.398440 2026] [:error] [pid 23782:tid 23827] [client 147.135.252.177:41888] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agOVBCBrKFYHXUGnR-prsgAAAEY"]
[Wed May 13 05:00:54.214814 2026] [:error] [pid 3259:tid 3278] [client 147.135.252.177:37212] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agOVBuWJB4YwcPVLeApqcgAAARE"]
[Wed May 13 05:00:56.031118 2026] [:error] [pid 3259:tid 3276] [client 147.135.252.177:37220] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agOVCOWJB4YwcPVLeApqdwAAAQ8"]
[Wed May 13 05:00:58.021989 2026] [:error] [pid 3259:tid 3265] [client 147.135.252.177:37228] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agOVCuWJB4YwcPVLeApqfgAAAQQ"]
[Wed May 13 05:01:00.185622 2026] [:error] [pid 23780:tid 23802] [client 147.135.252.177:37238] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agOVDHXgOibPjrXgeTA47gAAAAg"]
[Wed May 13 05:01:02.605220 2026] [:error] [pid 23782:tid 23825] [client 147.135.252.177:36416] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agOVDiBrKFYHXUGnR-prswAAAEQ"]
[Wed May 13 05:01:05.944052 2026] [:error] [pid 3259:tid 3268] [client 147.135.252.177:43714] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agOVEeWJB4YwcPVLeApqiQAAAQc"]
[Wed May 13 05:01:09.857276 2026] [:error] [pid 23787:tid 23870] [client 147.135.252.177:43718] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agOVFR1cs5wE7VT6wiqR8wAAAJY"]
[Wed May 13 06:49:47.338404 2026] [:error] [pid 23782:tid 23832] [client 149.22.83.52:39532] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agOuiyBrKFYHXUGnR-p5WAAAAEs"]
[Wed May 13 06:49:52.077822 2026] [:error] [pid 23780:tid 23806] [client 149.22.83.52:41574] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agOukHXgOibPjrXgeTBEAwAAAAw"]
[Wed May 13 06:49:54.418435 2026] [:error] [pid 3259:tid 3267] [client 149.22.83.52:41578] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agOukuWJB4YwcPVLeAqMFgAAAQY"]
[Wed May 13 06:49:57.600922 2026] [:error] [pid 3259:tid 3274] [client 149.22.83.52:49952] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agOuleWJB4YwcPVLeAqMHgAAAQ0"]
[Wed May 13 06:49:59.797912 2026] [:error] [pid 3259:tid 3282] [client 149.22.83.52:41580] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agOul-WJB4YwcPVLeAqMJAAAARU"]
[Wed May 13 06:50:02.250601 2026] [:error] [pid 3259:tid 3265] [client 149.22.83.52:38088] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agOumuWJB4YwcPVLeAqMKgAAAQQ"]
[Wed May 13 06:50:04.510806 2026] [:error] [pid 3259:tid 3271] [client 149.22.83.52:38090] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agOunOWJB4YwcPVLeAqMLAAAAQo"]
[Wed May 13 06:50:07.012969 2026] [:error] [pid 3259:tid 3284] [client 149.22.83.52:38102] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agOun-WJB4YwcPVLeAqMLwAAARc"]
[Wed May 13 06:50:09.398793 2026] [:error] [pid 23787:tid 23868] [client 149.22.83.52:38116] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agOuoR1cs5wE7VT6wiqhzAAAAJQ"]
[Wed May 13 06:50:11.632955 2026] [:error] [pid 23780:tid 23817] [client 149.22.83.52:56392] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agOuo3XgOibPjrXgeTBECwAAABc"]
[Wed May 13 06:50:13.971483 2026] [:error] [pid 23787:tid 23850] [client 149.22.83.52:56396] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agOupR1cs5wE7VT6wiqh0wAAAII"]
[Wed May 13 06:50:16.177460 2026] [:error] [pid 3259:tid 3270] [client 149.22.83.52:56406] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agOuqOWJB4YwcPVLeAqMOQAAAQk"]
[Wed May 13 06:50:18.514319 2026] [:error] [pid 23782:tid 23841] [client 149.22.83.52:56422] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agOuqiBrKFYHXUGnR-p5aQAAAFQ"]
[Wed May 13 06:50:21.583472 2026] [:error] [pid 3259:tid 3283] [client 149.22.83.52:56956] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agOureWJB4YwcPVLeAqMUAAAARY"]
[Wed May 13 06:50:24.115292 2026] [:error] [pid 23787:tid 23870] [client 149.22.83.52:37558] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agOusB1cs5wE7VT6wiqh2AAAAJY"]
[Wed May 13 06:50:26.276795 2026] [:error] [pid 23887:tid 23911] [client 149.22.83.52:37562] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agOustSKmvZJZkXBFDD43gAAANA"]
[Wed May 13 06:50:29.497521 2026] [:error] [pid 23780:tid 23794] [client 149.22.83.52:56958] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agOutXXgOibPjrXgeTBEFQAAAAA"]
[Wed May 13 06:50:31.790042 2026] [:error] [pid 23887:tid 23895] [client 149.22.83.52:40646] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agOut9SKmvZJZkXBFDD5LgAAAMA"]
[Wed May 13 06:50:34.027027 2026] [:error] [pid 3259:tid 3283] [client 149.22.83.52:40656] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agOuuuWJB4YwcPVLeAqMjgAAARY"]
[Wed May 13 06:50:36.684450 2026] [:error] [pid 23887:tid 23919] [client 149.22.83.52:40668] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agOuvNSKmvZJZkXBFDD5NAAAANg"]
[Wed May 13 06:51:06.285963 2026] [:error] [pid 3259:tid 3266] [client 149.22.83.52:57450] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agOu2uWJB4YwcPVLeAqMzwAAAQU"]
[Wed May 13 06:51:08.599496 2026] [:error] [pid 23782:tid 23829] [client 149.22.83.52:57460] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agOu3CBrKFYHXUGnR-p5zQAAAEg"]
[Wed May 13 06:51:11.119912 2026] [:error] [pid 23887:tid 23913] [client 149.22.83.52:58440] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agOu39SKmvZJZkXBFDD5eAAAANI"]
[Wed May 13 06:51:13.373485 2026] [:error] [pid 3259:tid 3278] [client 149.22.83.52:58448] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agOu4eWJB4YwcPVLeAqM1gAAARE"]
[Wed May 13 06:51:15.848387 2026] [:error] [pid 3259:tid 3266] [client 149.22.83.52:58460] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agOu4-WJB4YwcPVLeAqM3AAAAQU"]
[Wed May 13 06:51:18.408600 2026] [:error] [pid 3259:tid 3285] [client 149.22.83.52:58464] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agOu5uWJB4YwcPVLeAqM5wAAARg"]
[Wed May 13 06:51:21.895060 2026] [:error] [pid 23782:tid 23825] [client 149.22.83.52:39980] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agOu6SBrKFYHXUGnR-p51QAAAEQ"]
[Wed May 13 06:51:24.191578 2026] [:error] [pid 23787:tid 23867] [client 149.22.83.52:39994] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agOu7B1cs5wE7VT6wiqiLgAAAJM"]
[Wed May 13 06:51:26.319823 2026] [:error] [pid 23887:tid 23919] [client 149.22.83.52:40002] [client 149.22.83.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agOu7tSKmvZJZkXBFDD5igAAANg"]
[Wed May 13 08:49:21.243763 2026] [:error] [pid 23780:tid 23801] [client 147.135.253.34:54724] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agPKkXXgOibPjrXgeTBROwAAAAc"]
[Wed May 13 08:49:27.758663 2026] [:error] [pid 23887:tid 23913] [client 147.135.253.34:38376] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agPKl9SKmvZJZkXBFDAfPQAAANI"]
[Wed May 13 08:49:34.631937 2026] [:error] [pid 3259:tid 3274] [client 147.135.253.34:34378] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agPKnuWJB4YwcPVLeAqp3wAAAQ0"]
[Wed May 13 08:49:43.573104 2026] [:error] [pid 3259:tid 3263] [client 147.135.253.34:49378] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agPKp-WJB4YwcPVLeAqp5gAAAQI"]
[Wed May 13 08:49:49.386056 2026] [:error] [pid 23787:tid 23868] [client 147.135.253.34:49384] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agPKrR1cs5wE7VT6wiq33gAAAJQ"]
[Wed May 13 08:49:55.457662 2026] [:error] [pid 23780:tid 23807] [client 147.135.253.34:45358] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agPKs3XgOibPjrXgeTBRUAAAAA0"]
[Wed May 13 08:50:01.329500 2026] [:error] [pid 23887:tid 23899] [client 147.135.253.34:38242] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agPKudSKmvZJZkXBFDAfagAAAMQ"]
[Wed May 13 08:50:06.174944 2026] [:error] [pid 23787:tid 23856] [client 147.135.253.34:38246] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agPKvh1cs5wE7VT6wiq35AAAAIg"]
[Wed May 13 08:50:11.817771 2026] [:error] [pid 3259:tid 3262] [client 147.135.253.34:38026] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agPKw-WJB4YwcPVLeAqp_AAAAQE"]
[Wed May 13 08:51:39.428932 2026] [:error] [pid 23887:tid 23908] [client 147.135.253.34:32956] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agPLG9SKmvZJZkXBFDAgSwAAAM0"]
[Wed May 13 08:51:44.204766 2026] [:error] [pid 23887:tid 23905] [client 147.135.253.34:32960] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agPLINSKmvZJZkXBFDAgWgAAAMo"]
[Wed May 13 08:51:48.814249 2026] [:error] [pid 3259:tid 3271] [client 147.135.253.34:53300] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agPLJOWJB4YwcPVLeAqqhgAAAQo"]
[Wed May 13 08:51:53.782546 2026] [:error] [pid 23787:tid 23863] [client 147.135.253.34:53306] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agPLKR1cs5wE7VT6wiq4gQAAAI8"]
[Wed May 13 08:51:58.819296 2026] [:error] [pid 23787:tid 23854] [client 147.135.253.34:53310] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agPLLh1cs5wE7VT6wiq4jgAAAIY"]
[Wed May 13 08:52:05.450001 2026] [:error] [pid 23887:tid 23912] [client 147.135.253.34:40568] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agPLNdSKmvZJZkXBFDAgfAAAANE"]
[Wed May 13 08:52:10.911023 2026] [:error] [pid 23887:tid 23908] [client 147.135.253.34:35908] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agPLOtSKmvZJZkXBFDAghwAAAM0"]
[Wed May 13 08:52:17.957059 2026] [:error] [pid 23787:tid 23853] [client 147.135.253.34:35914] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agPLQR1cs5wE7VT6wiq4mAAAAIU"]
[Wed May 13 08:52:22.340694 2026] [:error] [pid 23787:tid 23848] [client 147.135.253.34:36534] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agPLRh1cs5wE7VT6wiq4pAAAAIA"]
[Wed May 13 08:52:26.546819 2026] [:error] [pid 23782:tid 23838] [client 147.135.253.34:36548] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agPLSiBrKFYHXUGnR-qNCwAAAFE"]
[Wed May 13 08:52:31.646815 2026] [:error] [pid 23887:tid 23905] [client 147.135.253.34:40880] [client 147.135.253.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agPLT9SKmvZJZkXBFDAgowAAAMo"]
[Wed May 13 09:21:45.097101 2026] [:error] [pid 23787:tid 23855] [client 51.77.216.62:37938] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "agPSKR1cs5wE7VT6wiq-xAAAAIc"]
[Wed May 13 09:21:46.928259 2026] [:error] [pid 23782:tid 23834] [client 51.77.216.62:37922] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agPSKiBrKFYHXUGnR-qRhgAAAE0"]
[Wed May 13 09:21:47.730458 2026] [:error] [pid 3259:tid 3280] [client 51.77.216.62:33384] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "agPSK-WJB4YwcPVLeAqxogAAARM"]
[Wed May 13 09:21:49.481154 2026] [:error] [pid 23887:tid 23916] [client 51.77.216.62:33388] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agPSLdSKmvZJZkXBFDAqHAAAANU"]
[Wed May 13 09:21:50.306208 2026] [:error] [pid 3259:tid 3269] [client 51.77.216.62:33398] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agPSLuWJB4YwcPVLeAqxpAAAAQg"]
[Wed May 13 09:21:52.304335 2026] [:error] [pid 3259:tid 3267] [client 51.77.216.62:33404] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agPSMOWJB4YwcPVLeAqxpgAAAQY"]
[Wed May 13 09:21:52.790924 2026] [:error] [pid 23887:tid 23899] [client 51.77.216.62:58388] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agPSMNSKmvZJZkXBFDAqJQAAAMQ"]
[Wed May 13 09:21:55.075556 2026] [:error] [pid 23887:tid 23916] [client 51.77.216.62:58398] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agPSM9SKmvZJZkXBFDAqLgAAANU"]
[Wed May 13 09:21:55.365092 2026] [:error] [pid 3259:tid 3273] [client 51.77.216.62:58402] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agPSM-WJB4YwcPVLeAqxqQAAAQw"]
[Wed May 13 09:21:57.764833 2026] [:error] [pid 23787:tid 23861] [client 51.77.216.62:58410] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agPSNR1cs5wE7VT6wiq-yQAAAI0"]
[Wed May 13 09:21:58.181524 2026] [:error] [pid 23787:tid 23856] [client 51.77.216.62:58414] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agPSNh1cs5wE7VT6wiq-ywAAAIg"]
[Wed May 13 09:22:01.108079 2026] [:error] [pid 3259:tid 3281] [client 51.77.216.62:58424] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agPSOeWJB4YwcPVLeAqxrAAAARQ"]
[Wed May 13 09:22:01.237788 2026] [:error] [pid 3259:tid 3265] [client 51.77.216.62:58432] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agPSOeWJB4YwcPVLeAqxrQAAAQQ"]
[Wed May 13 09:22:03.458592 2026] [:error] [pid 23782:tid 23829] [client 51.77.216.62:39006] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agPSOyBrKFYHXUGnR-qRlQAAAEg"]
[Wed May 13 09:22:03.604969 2026] [:error] [pid 23887:tid 23909] [client 51.77.216.62:39008] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agPSO9SKmvZJZkXBFDAqMgAAAM4"]
[Wed May 13 09:22:05.859046 2026] [:error] [pid 3259:tid 3264] [client 51.77.216.62:39024] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agPSPeWJB4YwcPVLeAqxsAAAAQM"]
[Wed May 13 09:22:07.179475 2026] [:error] [pid 23780:tid 23800] [client 51.77.216.62:39026] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agPSP3XgOibPjrXgeTBVAgAAAAY"]
[Wed May 13 09:22:08.915456 2026] [:error] [pid 23887:tid 23918] [client 51.77.216.62:39028] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agPSQNSKmvZJZkXBFDAqOQAAANc"]
[Wed May 13 09:22:09.867262 2026] [:error] [pid 23787:tid 23856] [client 51.77.216.62:39032] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agPSQR1cs5wE7VT6wiq-1QAAAIg"]
[Wed May 13 09:22:11.513189 2026] [:error] [pid 23887:tid 23900] [client 51.77.216.62:39036] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agPSQ9SKmvZJZkXBFDAqQAAAAMU"]
[Wed May 13 09:22:12.342137 2026] [:error] [pid 3259:tid 3276] [client 51.77.216.62:39040] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agPSROWJB4YwcPVLeAqxtgAAAQ8"]
[Wed May 13 09:22:14.432202 2026] [:error] [pid 23887:tid 23908] [client 51.77.216.62:60188] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agPSRtSKmvZJZkXBFDAqQwAAAM0"]
[Wed May 13 09:22:15.208771 2026] [:error] [pid 23887:tid 23912] [client 51.77.216.62:60194] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agPSR9SKmvZJZkXBFDAqRwAAANE"]
[Wed May 13 09:22:16.883342 2026] [:error] [pid 23887:tid 23896] [client 51.77.216.62:60204] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agPSSNSKmvZJZkXBFDAqSQAAAME"]
[Wed May 13 09:22:18.234589 2026] [:error] [pid 23887:tid 23906] [client 51.77.216.62:60218] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agPSStSKmvZJZkXBFDAqSwAAAMs"]
[Wed May 13 09:22:19.664441 2026] [:error] [pid 23887:tid 23895] [client 51.77.216.62:60224] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agPSS9SKmvZJZkXBFDAqTgAAAMA"]
[Wed May 13 09:22:20.823496 2026] [:error] [pid 23787:tid 23865] [client 51.77.216.62:60230] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agPSTB1cs5wE7VT6wiq-3AAAAJE"]
[Wed May 13 09:22:22.138606 2026] [:error] [pid 23887:tid 23912] [client 51.77.216.62:60234] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agPSTtSKmvZJZkXBFDAqVQAAANE"]
[Wed May 13 09:22:23.184083 2026] [:error] [pid 3259:tid 3285] [client 51.77.216.62:39330] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agPST-WJB4YwcPVLeAqxwQAAARg"]
[Wed May 13 09:22:24.673594 2026] [:error] [pid 3259:tid 3263] [client 51.77.216.62:39340] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agPSUOWJB4YwcPVLeAqxxQAAAQI"]
[Wed May 13 09:22:25.475389 2026] [:error] [pid 23887:tid 23914] [client 51.77.216.62:39356] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agPSUdSKmvZJZkXBFDAqWwAAANM"]
[Wed May 13 09:22:28.038406 2026] [:error] [pid 23780:tid 23799] [client 51.77.216.62:39360] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agPSVHXgOibPjrXgeTBVCAAAAAU"]
[Wed May 13 09:22:28.173097 2026] [:error] [pid 23782:tid 23841] [client 51.77.216.62:39364] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agPSVCBrKFYHXUGnR-qRogAAAFQ"]
[Wed May 13 09:22:30.486883 2026] [:error] [pid 23887:tid 23916] [client 51.77.216.62:39368] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agPSVtSKmvZJZkXBFDAqYAAAANU"]
[Wed May 13 09:22:30.743606 2026] [:error] [pid 3259:tid 3268] [client 51.77.216.62:39376] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agPSVuWJB4YwcPVLeAqxygAAAQc"]
[Wed May 13 09:22:33.515463 2026] [:error] [pid 23887:tid 23896] [client 51.77.216.62:34318] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agPSWdSKmvZJZkXBFDAqaAAAAME"]
[Wed May 13 09:22:33.656607 2026] [:error] [pid 23782:tid 23821] [client 51.77.216.62:34322] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agPSWSBrKFYHXUGnR-qRpwAAAEA"]
[Wed May 13 09:22:36.089106 2026] [:error] [pid 23887:tid 23917] [client 51.77.216.62:34324] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agPSXNSKmvZJZkXBFDAqmAAAANY"]
[Wed May 13 09:22:36.198309 2026] [:error] [pid 23887:tid 23916] [client 51.77.216.62:34338] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agPSXNSKmvZJZkXBFDAqmwAAANU"]
[Wed May 13 09:22:38.586712 2026] [:error] [pid 23782:tid 23845] [client 51.77.216.62:34344] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agPSXiBrKFYHXUGnR-qRqQAAAFg"]
[Wed May 13 09:22:38.784723 2026] [:error] [pid 23780:tid 23808] [client 51.77.216.62:34354] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agPSXnXgOibPjrXgeTBVEQAAAA4"]
[Wed May 13 09:22:41.381861 2026] [:error] [pid 23887:tid 23906] [client 51.77.216.62:34368] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agPSYdSKmvZJZkXBFDAqtAAAAMs"]
[Wed May 13 09:22:43.987359 2026] [:error] [pid 23887:tid 23900] [client 51.77.216.62:53082] [client 51.77.216.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agPSY9SKmvZJZkXBFDAqtwAAAMU"]
[Wed May 13 09:45:54.965433 2026] [:error] [pid 23887:tid 23902] [client 43.134.57.179:42322] [client 43.134.57.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agPX0tSKmvZJZkXBFDAyrwAAAMc"]
[Wed May 13 10:49:20.423476 2026] [:error] [pid 23782:tid 23839] [client 43.133.139.6:32998] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agPmsCBrKFYHXUGnR-qfqwAAAFI"]
[Wed May 13 11:27:13.020634 2026] [:error] [pid 23787:tid 23862] [client 176.231.151.242:53262] [client 176.231.151.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.231.151.242, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agPvkR1cs5wE7VT6wirYfwAAAI4"]
[Wed May 13 11:27:13.034947 2026] [proxy_fcgi:error] [pid 23787:tid 23862] [client 176.231.151.242:53262] AH01071: Got error 'Primary script unknown'
[Wed May 13 11:46:20.852778 2026] [:error] [pid 23887:tid 23898] [client 62.84.185.69:42356] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agP0DNSKmvZJZkXBFDBgggAAAMM"]
[Wed May 13 11:46:22.887921 2026] [:error] [pid 23887:tid 23908] [client 62.84.185.69:42368] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agP0DtSKmvZJZkXBFDBghgAAAM0"]
[Wed May 13 11:46:24.883522 2026] [:error] [pid 23887:tid 23903] [client 62.84.185.69:42380] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agP0ENSKmvZJZkXBFDBgiwAAAMg"]
[Wed May 13 11:46:26.881997 2026] [:error] [pid 3259:tid 3270] [client 62.84.185.69:43716] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agP0EuWJB4YwcPVLeArV7gAAAQk"]
[Wed May 13 11:46:28.879181 2026] [:error] [pid 23782:tid 23829] [client 62.84.185.69:43728] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agP0FCBrKFYHXUGnR-qpWwAAAEg"]
[Wed May 13 11:46:30.871733 2026] [:error] [pid 3259:tid 3274] [client 62.84.185.69:43730] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agP0FuWJB4YwcPVLeArV7wAAAQ0"]
[Wed May 13 11:46:32.868294 2026] [:error] [pid 3259:tid 3278] [client 62.84.185.69:43732] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agP0GOWJB4YwcPVLeArV8AAAARE"]
[Wed May 13 11:46:34.843793 2026] [:error] [pid 23782:tid 23823] [client 62.84.185.69:43734] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agP0GiBrKFYHXUGnR-qpYwAAAEI"]
[Wed May 13 11:46:36.702311 2026] [:error] [pid 23887:tid 23915] [client 62.84.185.69:41264] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agP0HNSKmvZJZkXBFDBgmwAAANQ"]
[Wed May 13 11:46:40.574298 2026] [:error] [pid 23782:tid 23842] [client 62.84.185.69:41272] [client 62.84.185.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agP0ICBrKFYHXUGnR-qpZwAAAFU"]
[Wed May 13 11:57:55.774283 2026] [:error] [pid 23787:tid 23863] [client 1.197.186.34:17151] [client 1.197.186.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agP2wx1cs5wE7VT6wirgHgAAAI8"], referer: http://www.switchcreative.net/
[Wed May 13 12:47:15.361038 2026] [:error] [pid 23782:tid 23831] [client 34.91.71.176:57390] [client 34.91.71.176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agQCUyBrKFYHXUGnR-q4PQAAAEo"]
[Wed May 13 14:06:56.427492 2026] [:error] [pid 23780:tid 23810] [client 139.155.126.16:36578] [client 139.155.126.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agQVAHXgOibPjrXgeTB6TQAAABA"]
[Wed May 13 14:47:56.544737 2026] [:error] [pid 23782:tid 23831] [client 109.230.98.126:61320] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "agQenCBrKFYHXUGnR-rHNgAAAEo"]
[Wed May 13 14:47:58.960906 2026] [:error] [pid 27332:tid 27351] [client 109.230.98.126:62789] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agQeno6Y5F_V9bmyC4auoQAAAVE"]
[Wed May 13 14:48:01.664770 2026] [:error] [pid 23782:tid 23828] [client 109.230.98.126:64895] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agQeoSBrKFYHXUGnR-rHOAAAAEc"]
[Wed May 13 14:48:03.706089 2026] [:error] [pid 27332:tid 27341] [client 109.230.98.126:63490] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agQeo46Y5F_V9bmyC4auqwAAAUc"]
[Wed May 13 14:48:06.375076 2026] [:error] [pid 23887:tid 23915] [client 109.230.98.126:63568] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agQeptSKmvZJZkXBFDCPsAAAANQ"]
[Wed May 13 14:48:08.859454 2026] [:error] [pid 27332:tid 27334] [client 109.230.98.126:65082] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agQeqI6Y5F_V9bmyC4auswAAAUA"]
[Wed May 13 14:48:10.913368 2026] [:error] [pid 27332:tid 27350] [client 109.230.98.126:62880] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agQeqo6Y5F_V9bmyC4autgAAAVA"]
[Wed May 13 14:48:13.620457 2026] [:error] [pid 23887:tid 23912] [client 109.230.98.126:62188] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agQerdSKmvZJZkXBFDCPwAAAANE"]
[Wed May 13 14:48:16.428142 2026] [:error] [pid 23780:tid 23797] [client 109.230.98.126:62821] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agQesHXgOibPjrXgeTB_hgAAAAM"]
[Wed May 13 14:48:19.043569 2026] [:error] [pid 3259:tid 3280] [client 109.230.98.126:64141] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agQes-WJB4YwcPVLeAoRNwAAARM"]
[Wed May 13 14:48:21.179966 2026] [:error] [pid 23782:tid 23825] [client 109.230.98.126:64016] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agQetSBrKFYHXUGnR-rHQgAAAEQ"]
[Wed May 13 14:48:23.788792 2026] [:error] [pid 3259:tid 3264] [client 109.230.98.126:64930] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agQet-WJB4YwcPVLeAoRQwAAAQM"]
[Wed May 13 14:48:25.965447 2026] [:error] [pid 27332:tid 27343] [client 109.230.98.126:60936] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agQeuY6Y5F_V9bmyC4auzQAAAUk"]
[Wed May 13 14:48:28.185948 2026] [:error] [pid 27332:tid 27340] [client 109.230.98.126:60720] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agQevI6Y5F_V9bmyC4au2AAAAUY"]
[Wed May 13 14:48:30.848012 2026] [:error] [pid 23782:tid 23832] [client 109.230.98.126:60252] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agQeviBrKFYHXUGnR-rHTwAAAEs"]
[Wed May 13 14:48:33.072928 2026] [:error] [pid 23780:tid 23818] [client 109.230.98.126:64754] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agQewXXgOibPjrXgeTB_lgAAABg"]
[Wed May 13 14:48:35.876670 2026] [:error] [pid 27332:tid 27350] [client 109.230.98.126:60002] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agQew46Y5F_V9bmyC4au6gAAAVA"]
[Wed May 13 14:48:37.915623 2026] [:error] [pid 27332:tid 27358] [client 109.230.98.126:62983] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agQexY6Y5F_V9bmyC4au7QAAAVg"]
[Wed May 13 14:48:40.489894 2026] [:error] [pid 23787:tid 23867] [client 109.230.98.126:59785] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agQeyB1cs5wE7VT6wioCOwAAAJM"]
[Wed May 13 14:48:42.958821 2026] [:error] [pid 23780:tid 23806] [client 109.230.98.126:60346] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agQeynXgOibPjrXgeTB_mgAAAAw"]
[Wed May 13 14:48:45.663378 2026] [:error] [pid 23787:tid 23850] [client 109.230.98.126:59305] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agQezR1cs5wE7VT6wioCPwAAAII"]
[Wed May 13 14:48:47.761149 2026] [:error] [pid 23780:tid 23816] [client 109.230.98.126:62944] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agQez3XgOibPjrXgeTB_ngAAABY"]
[Wed May 13 14:48:50.306326 2026] [:error] [pid 27332:tid 27352] [client 109.230.98.126:60123] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agQe0o6Y5F_V9bmyC4au9wAAAVI"]
[Wed May 13 14:48:52.605406 2026] [:error] [pid 3259:tid 3261] [client 109.230.98.126:60792] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agQe1OWJB4YwcPVLeAoRVgAAAQA"]
[Wed May 13 14:49:18.070995 2026] [:error] [pid 27332:tid 27337] [client 109.230.98.126:64985] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agQe7o6Y5F_V9bmyC4avMwAAAUM"]
[Wed May 13 14:49:20.242928 2026] [:error] [pid 3259:tid 3272] [client 109.230.98.126:64969] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agQe8OWJB4YwcPVLeAoRegAAAQs"]
[Wed May 13 14:49:22.702037 2026] [:error] [pid 3259:tid 3281] [client 109.230.98.126:65001] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agQe8uWJB4YwcPVLeAoRggAAARQ"]
[Wed May 13 14:49:24.755560 2026] [:error] [pid 27332:tid 27355] [client 109.230.98.126:64479] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agQe9I6Y5F_V9bmyC4avOQAAAVU"]
[Wed May 13 14:49:26.764091 2026] [:error] [pid 27332:tid 27357] [client 109.230.98.126:62174] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agQe9o6Y5F_V9bmyC4avQQAAAVc"]
[Wed May 13 14:49:28.908985 2026] [:error] [pid 23782:tid 23821] [client 109.230.98.126:63863] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agQe-CBrKFYHXUGnR-rHXQAAAEA"]
[Wed May 13 14:49:31.025467 2026] [:error] [pid 27332:tid 27358] [client 109.230.98.126:62771] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agQe-46Y5F_V9bmyC4avSgAAAVg"]
[Wed May 13 14:49:33.891312 2026] [:error] [pid 23782:tid 23834] [client 109.230.98.126:61969] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agQe_SBrKFYHXUGnR-rHYgAAAE0"]
[Wed May 13 14:49:36.027326 2026] [:error] [pid 23780:tid 23794] [client 109.230.98.126:60575] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agQfAHXgOibPjrXgeTB_wwAAAAA"]
[Wed May 13 14:49:38.043750 2026] [:error] [pid 3259:tid 3274] [client 109.230.98.126:64649] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agQfAuWJB4YwcPVLeAoRxAAAAQ0"]
[Wed May 13 14:49:48.102494 2026] [:error] [pid 3259:tid 3284] [client 109.230.98.126:65112] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agQfDOWJB4YwcPVLeAoR0gAAARc"]
[Wed May 13 14:49:50.179683 2026] [:error] [pid 23782:tid 23834] [client 109.230.98.126:60303] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agQfDiBrKFYHXUGnR-rHdwAAAE0"]
[Wed May 13 14:49:52.525526 2026] [:error] [pid 3259:tid 3282] [client 109.230.98.126:60965] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agQfEOWJB4YwcPVLeAoR2QAAARU"]
[Wed May 13 14:49:54.724998 2026] [:error] [pid 23787:tid 23853] [client 109.230.98.126:64001] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agQfEh1cs5wE7VT6wioCXwAAAIU"]
[Wed May 13 14:49:57.048191 2026] [:error] [pid 23787:tid 23871] [client 109.230.98.126:59142] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agQfFR1cs5wE7VT6wioCYAAAAJc"]
[Wed May 13 14:49:59.046199 2026] [:error] [pid 23887:tid 23896] [client 109.230.98.126:59526] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agQfF9SKmvZJZkXBFDCQMwAAAME"]
[Wed May 13 14:50:01.555520 2026] [:error] [pid 23782:tid 23833] [client 109.230.98.126:61724] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agQfGSBrKFYHXUGnR-rHegAAAEw"]
[Wed May 13 14:50:04.423310 2026] [:error] [pid 23787:tid 23856] [client 109.230.98.126:60948] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agQfHB1cs5wE7VT6wioCZgAAAIg"]
[Wed May 13 14:50:06.725111 2026] [:error] [pid 27332:tid 27358] [client 109.230.98.126:63084] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agQfHo6Y5F_V9bmyC4avaAAAAVg"]
[Wed May 13 14:50:09.657080 2026] [:error] [pid 27332:tid 27357] [client 109.230.98.126:65055] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agQfIY6Y5F_V9bmyC4avbQAAAVc"]
[Wed May 13 14:50:12.172976 2026] [:error] [pid 3259:tid 3268] [client 109.230.98.126:63374] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agQfJOWJB4YwcPVLeAoR-AAAAQc"]
[Wed May 13 14:50:14.749739 2026] [:error] [pid 23887:tid 23912] [client 109.230.98.126:60435] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agQfJtSKmvZJZkXBFDCQQQAAANE"]
[Wed May 13 14:50:45.660161 2026] [:error] [pid 23787:tid 23856] [client 109.230.98.126:59892] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agQfRR1cs5wE7VT6wioCiQAAAIg"]
[Wed May 13 14:50:47.579830 2026] [:error] [pid 23780:tid 23816] [client 109.230.98.126:63129] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agQfR3XgOibPjrXgeTB_8wAAABY"]
[Wed May 13 14:50:49.888088 2026] [:error] [pid 23887:tid 23919] [client 109.230.98.126:61684] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agQfSdSKmvZJZkXBFDCQWQAAANg"]
[Wed May 13 14:50:51.901319 2026] [:error] [pid 27332:tid 27338] [client 109.230.98.126:64163] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agQfS46Y5F_V9bmyC4avoAAAAUQ"]
[Wed May 13 14:50:54.303437 2026] [:error] [pid 23887:tid 23904] [client 109.230.98.126:60393] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agQfTtSKmvZJZkXBFDCQXQAAAMk"]
[Wed May 13 14:50:56.515242 2026] [:error] [pid 23782:tid 23822] [client 109.230.98.126:65030] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agQfUCBrKFYHXUGnR-rHmwAAAEE"]
[Wed May 13 14:50:58.733483 2026] [:error] [pid 23887:tid 23895] [client 109.230.98.126:61559] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agQfUtSKmvZJZkXBFDCQYgAAAMA"]
[Wed May 13 14:51:01.133629 2026] [:error] [pid 27332:tid 27354] [client 109.230.98.126:64073] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agQfVY6Y5F_V9bmyC4avpAAAAVQ"]
[Wed May 13 14:51:04.045998 2026] [:error] [pid 27332:tid 27350] [client 109.230.98.126:63680] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agQfWI6Y5F_V9bmyC4avqwAAAVA"]
[Wed May 13 14:51:07.029436 2026] [:error] [pid 3259:tid 3282] [client 109.230.98.126:61633] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agQfW-WJB4YwcPVLeAoSHwAAARU"]
[Wed May 13 14:51:09.749770 2026] [:error] [pid 23887:tid 23917] [client 109.230.98.126:62546] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agQfXdSKmvZJZkXBFDCQaAAAANY"]
[Wed May 13 14:51:12.468547 2026] [:error] [pid 23782:tid 23837] [client 109.230.98.126:60714] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agQfYCBrKFYHXUGnR-rHoQAAAFA"]
[Wed May 13 14:51:14.828913 2026] [:error] [pid 27332:tid 27334] [client 109.230.98.126:59104] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agQfYo6Y5F_V9bmyC4avuwAAAUA"]
[Wed May 13 14:51:18.875069 2026] [:error] [pid 23780:tid 23815] [client 109.230.98.126:59979] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agQfZnXgOibPjrXgeTB_-gAAABU"]
[Wed May 13 15:06:08.744753 2026] [:error] [pid 23780:tid 23807] [client 43.131.243.61:46930] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agQi4HXgOibPjrXgeTCBWgAAAA0"]
[Wed May 13 15:56:58.665625 2026] [:error] [pid 23787:tid 23852] [client 49.51.253.26:52066] [client 49.51.253.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agQuyh1cs5wE7VT6wioNmwAAAIQ"]
[Wed May 13 18:36:31.156276 2026] [:error] [pid 55745:tid 55789] [client 65.108.125.120:3496] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agRULwzqD9WDZdTELeIRVQAAAs4"]
[Wed May 13 18:36:33.159957 2026] [:error] [pid 23780:tid 23804] [client 65.108.125.120:3522] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agRUMXXgOibPjrXgeTCPfgAAAAo"]
[Wed May 13 18:36:35.101456 2026] [:error] [pid 55745:tid 55792] [client 65.108.125.120:3544] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agRUMwzqD9WDZdTELeIRWAAAAtE"]
[Wed May 13 18:36:36.942548 2026] [:error] [pid 45289:tid 45310] [client 65.108.125.120:3560] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agRUNIOEpVhwFIe0NzgjHAAAAZE"]
[Wed May 13 18:36:39.016626 2026] [:error] [pid 55744:tid 55768] [client 65.108.125.120:23762] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agRUNwwbbCCudzl3BmmjxwAAApQ"]
[Wed May 13 18:36:41.092947 2026] [:error] [pid 55745:tid 55795] [client 65.108.125.120:23774] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agRUOQzqD9WDZdTELeIRXQAAAtQ"]
[Wed May 13 18:36:43.022537 2026] [:error] [pid 23782:tid 23843] [client 65.108.125.120:23776] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agRUOyBrKFYHXUGnR-r3PAAAAFY"]
[Wed May 13 18:36:45.104879 2026] [:error] [pid 23782:tid 23839] [client 65.108.125.120:23792] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agRUPSBrKFYHXUGnR-r3PgAAAFI"]
[Wed May 13 18:36:46.989568 2026] [:error] [pid 45289:tid 45297] [client 65.108.125.120:23802] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agRUPoOEpVhwFIe0NzgjKgAAAYQ"]
[Wed May 13 18:36:49.040001 2026] [:error] [pid 55679:tid 55693] [client 65.108.125.120:1586] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agRUQavvigowSOGkp44XLQAAAgw"]
[Wed May 13 18:36:50.961028 2026] [:error] [pid 55744:tid 55757] [client 65.108.125.120:1590] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agRUQgwbbCCudzl3BmmjyAAAAok"]
[Wed May 13 18:36:52.891089 2026] [:error] [pid 55644:tid 55657] [client 65.108.125.120:1598] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agRURCL_V0N1iPYYj0-pEgAAAcs"]
[Wed May 13 18:36:54.976717 2026] [:error] [pid 27332:tid 27339] [client 65.108.125.120:1600] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agRURo6Y5F_V9bmyC4biZgAAAUU"]
[Wed May 13 18:36:56.973592 2026] [:error] [pid 23780:tid 23816] [client 65.108.125.120:1608] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agRUSHXgOibPjrXgeTCPgAAAABY"]
[Wed May 13 18:36:59.059452 2026] [:error] [pid 45289:tid 45293] [client 65.108.125.120:52070] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agRUS4OEpVhwFIe0NzgjLwAAAYA"]
[Wed May 13 18:37:00.999164 2026] [:error] [pid 23782:tid 23843] [client 65.108.125.120:52076] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agRUTCBrKFYHXUGnR-r3TAAAAFY"]
[Wed May 13 18:37:02.924716 2026] [:error] [pid 45289:tid 45313] [client 65.108.125.120:52088] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agRUToOEpVhwFIe0NzgjMwAAAZQ"]
[Wed May 13 18:37:04.969162 2026] [:error] [pid 45289:tid 45307] [client 65.108.125.120:52094] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agRUUIOEpVhwFIe0NzgjNAAAAY4"]
[Wed May 13 18:37:06.993678 2026] [:error] [pid 27332:tid 27343] [client 65.108.125.120:52102] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agRUUo6Y5F_V9bmyC4biagAAAUk"]
[Wed May 13 18:37:09.040386 2026] [:error] [pid 55644:tid 55667] [client 65.108.125.120:35350] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agRUVSL_V0N1iPYYj0-pGgAAAdU"]
[Wed May 13 18:37:10.942780 2026] [:error] [pid 55644:tid 55659] [client 65.108.125.120:35366] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agRUViL_V0N1iPYYj0-pHAAAAc0"]
[Wed May 13 18:37:12.840765 2026] [:error] [pid 3259:tid 3264] [client 65.108.125.120:35380] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agRUWOWJB4YwcPVLeAouBgAAAQM"]
[Wed May 13 18:37:14.905984 2026] [:error] [pid 45289:tid 45304] [client 65.108.125.120:35386] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agRUWoOEpVhwFIe0NzgjOgAAAYs"]
[Wed May 13 18:37:17.008691 2026] [:error] [pid 55745:tid 55792] [client 65.108.125.120:35396] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agRUXQzqD9WDZdTELeIRZAAAAtE"]
[Wed May 13 18:37:19.049385 2026] [:error] [pid 55745:tid 55784] [client 65.108.125.120:44352] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agRUXwzqD9WDZdTELeIRZgAAAsk"]
[Wed May 13 18:37:21.091852 2026] [:error] [pid 27332:tid 27358] [client 65.108.125.120:44360] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agRUYY6Y5F_V9bmyC4bicgAAAVg"]
[Wed May 13 20:11:27.482579 2026] [:error] [pid 55644:tid 55661] [client 101.32.49.171:41986] [client 101.32.49.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agRqbyL_V0N1iPYYj0-t6gAAAc8"]
[Wed May 13 20:52:10.148957 2026] [:error] [pid 12340:tid 12411] [client 209.50.166.95:60629] [client 209.50.166.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.svn/wc.db"] [unique_id "agRz-srxSPfvmN7BQjJkBgAAAI8"]
[Wed May 13 21:04:33.277788 2026] [:error] [pid 12426:tid 12444] [client 49.51.243.95:59598] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agR24bPw24RslX3LIcYcSwAAANA"]
[Wed May 13 22:42:55.282614 2026] [:error] [pid 12426:tid 12445] [client 109.230.98.126:61456] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agSN77Pw24RslX3LIcY_0QAAANE"]
[Wed May 13 22:42:57.062409 2026] [:error] [pid 12340:tid 12410] [client 109.230.98.126:62052] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agSN8crxSPfvmN7BQjJ_nQAAAI4"]
[Wed May 13 22:42:59.456515 2026] [:error] [pid 12426:tid 12440] [client 109.230.98.126:59604] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agSN87Pw24RslX3LIcY_3AAAAMw"]
[Wed May 13 22:43:01.531162 2026] [:error] [pid 12340:tid 12411] [client 109.230.98.126:61784] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agSN9crxSPfvmN7BQjJ_ngAAAI8"]
[Wed May 13 22:43:03.468988 2026] [:error] [pid 12426:tid 12452] [client 109.230.98.126:62943] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agSN97Pw24RslX3LIcY_5AAAANg"]
[Wed May 13 22:43:05.507295 2026] [:error] [pid 12340:tid 12407] [client 109.230.98.126:62148] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agSN-crxSPfvmN7BQjJ_qAAAAIs"]
[Wed May 13 22:43:07.458523 2026] [:error] [pid 12426:tid 12432] [client 109.230.98.126:61835] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agSN-7Pw24RslX3LIcY_5wAAAMQ"]
[Wed May 13 22:43:09.366545 2026] [:error] [pid 12338:tid 12373] [client 109.230.98.126:64987] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agSN_cUJ87l42ffPr4wUrQAAAEQ"]
[Wed May 13 22:43:11.395642 2026] [:error] [pid 12338:tid 12376] [client 109.230.98.126:61972] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agSN_8UJ87l42ffPr4wUrgAAAEc"]
[Wed May 13 22:43:22.809532 2026] [:error] [pid 12426:tid 12452] [client 109.230.98.126:64265] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agSOCrPw24RslX3LIcY_-QAAANg"]
[Wed May 13 22:43:24.747468 2026] [:error] [pid 12337:tid 12348] [client 109.230.98.126:63172] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agSODA9W0E4_X4qzYUFsgwAAAAY"]
[Wed May 13 22:43:28.524199 2026] [:error] [pid 12340:tid 12401] [client 109.230.98.126:64701] [client 109.230.98.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agSOEMrxSPfvmN7BQjJ_ugAAAIU"]
[Wed May 13 23:46:10.056762 2026] [proxy_fcgi:error] [pid 17873:tid 17887] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:10.374300 2026] [proxy_fcgi:error] [pid 17873:tid 17891] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:10.693488 2026] [proxy_fcgi:error] [pid 17873:tid 17893] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:11.008661 2026] [proxy_fcgi:error] [pid 17873:tid 17892] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:11.325642 2026] [proxy_fcgi:error] [pid 17873:tid 17885] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:11.640900 2026] [proxy_fcgi:error] [pid 17873:tid 17904] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:11.956511 2026] [proxy_fcgi:error] [pid 17873:tid 17875] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:12.590083 2026] [proxy_fcgi:error] [pid 17873:tid 17883] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:12.905422 2026] [proxy_fcgi:error] [pid 17873:tid 17886] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:13.221270 2026] [proxy_fcgi:error] [pid 17873:tid 17876] [client 191.235.100.20:2849] AH01071: Got error 'Primary script unknown'
[Wed May 13 23:46:13.533082 2026] [:error] [pid 17873:tid 17882] [client 191.235.100.20:2849] [client 191.235.100.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agScxfEqBQQrkyEyu_oQbQAAAQc"]
[Wed May 13 23:46:14.807907 2026] [:error] [pid 12426:tid 12430] [client 191.235.100.20:2646] [client 191.235.100.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agScxrPw24RslX3LIcZRzgAAAMI"]
[Wed May 13 23:46:16.066626 2026] [:error] [pid 12426:tid 12443] [client 191.235.100.20:12992] [client 191.235.100.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agScyLPw24RslX3LIcZR1gAAAM8"]
[Wed May 13 23:46:17.371896 2026] [:error] [pid 12426:tid 12442] [client 191.235.100.20:13455] [client 191.235.100.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agScybPw24RslX3LIcZR2gAAAM4"]
[Thu May 14 00:37:56.757127 2026] [:error] [pid 17873:tid 17881] [client 135.181.180.59:51820] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agSo5PEqBQQrkyEyu_ocbAAAAQY"]
[Thu May 14 00:37:58.762728 2026] [:error] [pid 17873:tid 17890] [client 135.181.180.59:51824] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agSo5vEqBQQrkyEyu_ocbwAAAQ8"]
[Thu May 14 00:38:01.348480 2026] [:error] [pid 17873:tid 17896] [client 135.181.180.59:24862] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agSo6fEqBQQrkyEyu_occgAAARQ"]
[Thu May 14 00:38:03.355107 2026] [:error] [pid 12426:tid 12452] [client 135.181.180.59:51826] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agSo67Pw24RslX3LIcZaMgAAANg"]
[Thu May 14 00:38:05.437543 2026] [:error] [pid 12340:tid 12413] [client 135.181.180.59:28552] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agSo7crxSPfvmN7BQjKclwAAAJE"]
[Thu May 14 00:38:07.469033 2026] [:error] [pid 12338:tid 12381] [client 135.181.180.59:28560] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agSo78UJ87l42ffPr4wk_gAAAEw"]
[Thu May 14 00:38:09.485244 2026] [:error] [pid 12426:tid 12433] [client 135.181.180.59:28574] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agSo8bPw24RslX3LIcZaOgAAAMU"]
[Thu May 14 00:38:11.667012 2026] [:error] [pid 17873:tid 17887] [client 135.181.180.59:28580] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agSo8_EqBQQrkyEyu_ocfAAAAQw"]
[Thu May 14 00:38:13.583504 2026] [:error] [pid 17873:tid 17886] [client 135.181.180.59:28596] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agSo9fEqBQQrkyEyu_ochAAAAQs"]
[Thu May 14 00:38:15.537875 2026] [:error] [pid 17873:tid 17877] [client 135.181.180.59:13994] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agSo9_EqBQQrkyEyu_ociQAAAQI"]
[Thu May 14 00:38:17.597819 2026] [:error] [pid 12340:tid 12407] [client 135.181.180.59:14004] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agSo-crxSPfvmN7BQjKcqgAAAIs"]
[Thu May 14 00:38:19.645511 2026] [:error] [pid 12338:tid 12391] [client 135.181.180.59:14006] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agSo-8UJ87l42ffPr4wlBQAAAFY"]
[Thu May 14 00:38:22.256309 2026] [:error] [pid 12426:tid 12442] [client 135.181.180.59:36808] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agSo_rPw24RslX3LIcZaSQAAAM4"]
[Thu May 14 00:38:24.084802 2026] [:error] [pid 17873:tid 17875] [client 135.181.180.59:14008] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agSpAPEqBQQrkyEyu_ockgAAAQA"]
[Thu May 14 00:38:25.994722 2026] [:error] [pid 12340:tid 12417] [client 135.181.180.59:50846] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agSpAcrxSPfvmN7BQjKcqwAAAJU"]
[Thu May 14 00:38:28.561618 2026] [:error] [pid 12340:tid 12400] [client 135.181.180.59:44190] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agSpBMrxSPfvmN7BQjKcrAAAAIQ"]
[Thu May 14 00:38:30.461824 2026] [:error] [pid 17873:tid 17881] [client 135.181.180.59:50856] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agSpBvEqBQQrkyEyu_ocmQAAAQY"]
[Thu May 14 00:38:32.399998 2026] [:error] [pid 12340:tid 12413] [client 135.181.180.59:50862] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agSpCMrxSPfvmN7BQjKcrwAAAJE"]
[Thu May 14 00:38:34.311544 2026] [:error] [pid 12338:tid 12389] [client 135.181.180.59:50864] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agSpCsUJ87l42ffPr4wlDAAAAFQ"]
[Thu May 14 00:38:36.328912 2026] [:error] [pid 12426:tid 12445] [client 135.181.180.59:39880] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agSpDLPw24RslX3LIcZaTAAAANE"]
[Thu May 14 00:38:38.432754 2026] [:error] [pid 12340:tid 12419] [client 135.181.180.59:39888] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agSpDsrxSPfvmN7BQjKctQAAAJc"]
[Thu May 14 00:38:40.359565 2026] [:error] [pid 12340:tid 12404] [client 135.181.180.59:39902] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agSpEMrxSPfvmN7BQjKcuAAAAIg"]
[Thu May 14 00:38:42.270516 2026] [:error] [pid 17873:tid 17892] [client 135.181.180.59:39914] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agSpEvEqBQQrkyEyu_ocoAAAARE"]
[Thu May 14 00:38:44.858742 2026] [:error] [pid 12340:tid 12396] [client 135.181.180.59:24010] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agSpFMrxSPfvmN7BQjKcvQAAAIA"]
[Thu May 14 00:38:46.735297 2026] [:error] [pid 12337:tid 12354] [client 135.181.180.59:59678] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agSpFg9W0E4_X4qzYUF55QAAAAw"]
[Thu May 14 00:38:48.805126 2026] [:error] [pid 17873:tid 17885] [client 135.181.180.59:59694] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agSpGPEqBQQrkyEyu_ocqgAAAQo"]
[Thu May 14 00:38:51.380926 2026] [:error] [pid 12338:tid 12380] [client 135.181.180.59:62852] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agSpG8UJ87l42ffPr4wlEQAAAEs"]
[Thu May 14 00:38:53.938747 2026] [:error] [pid 12337:tid 12345] [client 135.181.180.59:62864] [client 135.181.180.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agSpHQ9W0E4_X4qzYUF55gAAAAM"]
[Thu May 14 02:48:27.389124 2026] [:error] [pid 12426:tid 12434] [client 5.255.127.166:40394] [client 5.255.127.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "agTHe7Pw24RslX3LIcZ0kQAAAMY"]
[Thu May 14 02:48:27.393098 2026] [:error] [pid 12337:tid 12344] [client 5.255.127.166:40378] [client 5.255.127.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agTHew9W0E4_X4qzYUGKiwAAAAI"]
[Thu May 14 03:26:44.101788 2026] [:error] [pid 12337:tid 12345] [client 139.155.134.17:32862] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agTQdA9W0E4_X4qzYUGOqQAAAAM"]
[Thu May 14 03:38:15.927055 2026] [:error] [pid 8203:tid 8224] [client 120.208.39.68:9841] [client 120.208.39.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agTTJ23YM_UDNwFJPi71VwAAANM"], referer: http://www.switchcreative.net/
[Thu May 14 05:14:04.315186 2026] [:error] [pid 11690:tid 11707] [client 183.52.139.113:33052] [client 183.52.139.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agTpnCnxWuLN8Hptw8llqwAAAMg"], referer: http://switchcreative.net/
[Thu May 14 05:22:18.070130 2026] [:error] [pid 11588:tid 11672] [client 147.135.212.217:56308] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agTritUr21rOixkeGKYAUQAAAJQ"]
[Thu May 14 05:22:20.605068 2026] [:error] [pid 63033:tid 63059] [client 147.135.212.217:54134] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agTrjFMY49UWn5BpqVZAigAAARg"]
[Thu May 14 05:22:22.977556 2026] [:error] [pid 63033:tid 63043] [client 147.135.212.217:54138] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agTrjlMY49UWn5BpqVZAkAAAAQg"]
[Thu May 14 05:22:25.674097 2026] [:error] [pid 11588:tid 11659] [client 147.135.212.217:54142] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agTrkdUr21rOixkeGKYAZAAAAIc"]
[Thu May 14 05:22:29.835343 2026] [:error] [pid 11581:tid 11604] [client 147.135.212.217:54964] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agTrlf0vF48FbzpvQMWDagAAAAc"]
[Thu May 14 05:22:32.246507 2026] [:error] [pid 63033:tid 63059] [client 147.135.212.217:54974] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agTrmFMY49UWn5BpqVZAnAAAARg"]
[Thu May 14 05:22:38.630669 2026] [:error] [pid 63033:tid 63040] [client 147.135.212.217:59574] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agTrnlMY49UWn5BpqVZAoQAAAQU"]
[Thu May 14 05:22:43.142524 2026] [:error] [pid 63033:tid 63036] [client 147.135.212.217:59582] [client 147.135.212.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agTro1MY49UWn5BpqVZAowAAAQE"]
[Thu May 14 06:48:49.237968 2026] [:error] [pid 11582:tid 11644] [client 154.244.15.49:20820] [client 154.244.15.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.244.15.49, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agT_0fuw2cmFDpGcKhDgZgAAAFM"]
[Thu May 14 06:48:49.253685 2026] [proxy_fcgi:error] [pid 11582:tid 11644] [client 154.244.15.49:20820] AH01071: Got error 'Primary script unknown'
[Thu May 14 08:00:58.305386 2026] [:error] [pid 47721:tid 47738] [client 43.164.0.96:58038] [client 43.164.0.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agUQunEmh7_G0hfOa6s13QAAAY8"]
[Thu May 14 10:53:03.883869 2026] [:error] [pid 47721:tid 47746] [client 62.84.185.56:29734] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agU5D3Emh7_G0hfOa6tkrgAAAZc"]
[Thu May 14 10:53:09.091719 2026] [:error] [pid 63033:tid 63051] [client 62.84.185.56:47068] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agU5FVMY49UWn5BpqVamTwAAARA"]
[Thu May 14 10:53:12.091858 2026] [:error] [pid 47721:tid 47733] [client 62.84.185.56:47084] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agU5GHEmh7_G0hfOa6tktwAAAYo"]
[Thu May 14 10:53:17.067061 2026] [:error] [pid 11588:tid 11675] [client 62.84.185.56:47094] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agU5HdUr21rOixkeGKY0twAAAJc"]
[Thu May 14 10:54:55.877982 2026] [:error] [pid 11588:tid 11663] [client 62.84.185.56:29224] [client 62.84.185.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agU5f9Ur21rOixkeGKY09AAAAIs"]
[Thu May 14 11:02:26.566835 2026] [:error] [pid 11582:tid 11631] [client 65.108.2.171:42550] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agU7Qvuw2cmFDpGcKhD6aAAAAEY"]
[Thu May 14 11:02:30.463286 2026] [:error] [pid 11582:tid 11636] [client 65.108.2.171:42560] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agU7Rvuw2cmFDpGcKhD6aQAAAEs"]
[Thu May 14 11:02:33.910854 2026] [:error] [pid 11588:tid 11676] [client 65.108.2.171:34392] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agU7SdUr21rOixkeGKY2LQAAAJg"]
[Thu May 14 11:02:38.276855 2026] [:error] [pid 11690:tid 11706] [client 65.108.2.171:7132] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agU7TinxWuLN8Hptw8nNkwAAAMc"]
[Thu May 14 12:16:02.279554 2026] [:error] [pid 11588:tid 11668] [client 43.130.31.17:32976] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agVMgtUr21rOixkeGKY-1gAAAJA"]
[Thu May 14 13:11:06.221162 2026] [:error] [pid 47721:tid 47732] [client 43.153.96.233:46882] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agVZanEmh7_G0hfOa6uSJgAAAYk"]
[Thu May 14 16:38:14.510077 2026] [:error] [pid 11581:tid 11615] [client 51.75.119.168:53406] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agWJ9v0vF48FbzpvQMXVOAAAABI"]
[Thu May 14 16:38:16.176509 2026] [:error] [pid 11581:tid 11612] [client 51.75.119.168:53788] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agWJ-P0vF48FbzpvQMXVOwAAAA8"]
[Thu May 14 16:38:18.041534 2026] [:error] [pid 11581:tid 11607] [client 51.75.119.168:37908] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agWJ-v0vF48FbzpvQMXVPQAAAAo"]
[Thu May 14 16:38:19.860854 2026] [:error] [pid 11581:tid 11613] [client 51.75.119.168:37914] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agWJ-_0vF48FbzpvQMXVQAAAABA"]
[Thu May 14 16:38:22.339326 2026] [:error] [pid 11581:tid 11614] [client 51.75.119.168:38324] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agWJ_v0vF48FbzpvQMXVQwAAABE"]
[Thu May 14 16:38:24.244484 2026] [:error] [pid 47721:tid 47743] [client 51.75.119.168:37930] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agWKAHEmh7_G0hfOa6vojgAAAZQ"]
[Thu May 14 16:38:26.559511 2026] [:error] [pid 11690:tid 11718] [client 51.75.119.168:38340] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agWKAinxWuLN8Hptw8kVBQAAANM"]
[Thu May 14 16:38:28.445278 2026] [:error] [pid 47673:tid 47685] [client 51.75.119.168:48270] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agWKBPCGe4cIn3sh5k0VDwAAAUo"]
[Thu May 14 16:38:30.382052 2026] [:error] [pid 63033:tid 63040] [client 51.75.119.168:48282] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agWKBlMY49UWn5BpqVbmlQAAAQU"]
[Thu May 14 16:38:32.272820 2026] [:error] [pid 11582:tid 11629] [client 51.75.119.168:48294] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agWKCPuw2cmFDpGcKhAmBQAAAEQ"]
[Thu May 14 16:38:34.256662 2026] [:error] [pid 47673:tid 47689] [client 51.75.119.168:48308] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agWKCvCGe4cIn3sh5k0VEAAAAU4"]
[Thu May 14 16:38:36.175279 2026] [:error] [pid 47673:tid 47693] [client 51.75.119.168:48322] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agWKDPCGe4cIn3sh5k0VEwAAAVI"]
[Thu May 14 16:38:38.090542 2026] [:error] [pid 11581:tid 11608] [client 51.75.119.168:39216] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agWKDv0vF48FbzpvQMXVSgAAAAs"]
[Thu May 14 16:38:40.482336 2026] [:error] [pid 11588:tid 11671] [client 51.75.119.168:39196] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agWKENUr21rOixkeGKaJqAAAAJM"]
[Thu May 14 16:38:42.675911 2026] [:error] [pid 11690:tid 11711] [client 51.75.119.168:39222] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agWKEinxWuLN8Hptw8kVDAAAAMw"]
[Thu May 14 16:38:46.388143 2026] [:error] [pid 11690:tid 11713] [client 51.75.119.168:39232] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agWKFinxWuLN8Hptw8kVDgAAAM4"]
[Thu May 14 17:18:20.761911 2026] [:error] [pid 11582:tid 11641] [client 43.134.111.142:45018] [client 43.134.111.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agWTXPuw2cmFDpGcKhAoWAAAAFA"]
[Thu May 14 18:04:58.407942 2026] [:error] [pid 11690:tid 11722] [client 43.153.113.127:48086] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agWeSinxWuLN8Hptw8kdxwAAANc"]
[Thu May 14 18:26:06.702723 2026] [:error] [pid 11582:tid 11632] [client 152.53.187.237:48996] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agWjPvuw2cmFDpGcKhAtAwAAAEc"]
[Thu May 14 18:26:09.287855 2026] [:error] [pid 47721:tid 47727] [client 152.53.187.237:43296] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agWjQXEmh7_G0hfOa6v-QgAAAYQ"]
[Thu May 14 18:26:12.487799 2026] [:error] [pid 11581:tid 11615] [client 152.53.187.237:56688] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agWjRP0vF48FbzpvQMX3ZgAAABI"]
[Thu May 14 18:26:27.485154 2026] [:error] [pid 47673:tid 47697] [client 152.53.187.237:39538] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agWjU_CGe4cIn3sh5k0eEQAAAVY"]
[Thu May 14 18:26:30.063788 2026] [:error] [pid 11588:tid 11654] [client 152.53.187.237:39540] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agWjVtUr21rOixkeGKaa0AAAAII"]
[Thu May 14 18:26:32.621753 2026] [:error] [pid 11690:tid 11718] [client 152.53.187.237:41818] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agWjWCnxWuLN8Hptw8kiqQAAANM"]
[Thu May 14 18:26:35.129892 2026] [:error] [pid 11588:tid 11654] [client 152.53.187.237:41826] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agWjW9Ur21rOixkeGKaa3gAAAII"]
[Thu May 14 18:26:37.697125 2026] [:error] [pid 47721:tid 47736] [client 152.53.187.237:41840] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agWjXXEmh7_G0hfOa6v-SgAAAY0"]
[Thu May 14 18:26:40.332303 2026] [:error] [pid 11582:tid 11634] [client 152.53.187.237:41850] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agWjYPuw2cmFDpGcKhAtCQAAAEk"]
[Thu May 14 18:26:42.871839 2026] [:error] [pid 47673:tid 47688] [client 152.53.187.237:37266] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agWjYvCGe4cIn3sh5k0eIAAAAU0"]
[Thu May 14 18:26:45.438415 2026] [:error] [pid 11588:tid 11675] [client 152.53.187.237:37272] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agWjZdUr21rOixkeGKaa6gAAAJc"]
[Thu May 14 18:26:48.053617 2026] [:error] [pid 11690:tid 11720] [client 152.53.187.237:37284] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agWjaCnxWuLN8Hptw8kisgAAANU"]
[Thu May 14 18:26:50.743453 2026] [:error] [pid 63033:tid 63058] [client 152.53.187.237:37294] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agWjalMY49UWn5BpqVbwegAAARc"]
[Thu May 14 18:26:53.471450 2026] [:error] [pid 11690:tid 11714] [client 152.53.187.237:48778] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agWjbSnxWuLN8Hptw8kitQAAAM8"]
[Thu May 14 18:26:56.129441 2026] [:error] [pid 11690:tid 11701] [client 152.53.187.237:48780] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agWjcCnxWuLN8Hptw8kitgAAAMI"]
[Thu May 14 18:26:58.677706 2026] [:error] [pid 11588:tid 11653] [client 152.53.187.237:48792] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agWjctUr21rOixkeGKabFAAAAIE"]
[Thu May 14 18:27:01.189814 2026] [:error] [pid 11588:tid 11675] [client 152.53.187.237:59872] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agWjddUr21rOixkeGKabFQAAAJc"]
[Thu May 14 18:27:03.771088 2026] [:error] [pid 11690:tid 11710] [client 152.53.187.237:59874] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agWjdynxWuLN8Hptw8kiuQAAAMs"]
[Thu May 14 18:27:38.558988 2026] [:error] [pid 11582:tid 11646] [client 152.53.187.237:38650] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agWjmvuw2cmFDpGcKhAtOQAAAFU"]
[Thu May 14 18:27:41.289477 2026] [:error] [pid 63033:tid 63051] [client 152.53.187.237:39460] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agWjnVMY49UWn5BpqVbwvAAAARA"]
[Thu May 14 18:27:43.806419 2026] [:error] [pid 11690:tid 11721] [client 152.53.187.237:39472] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agWjnynxWuLN8Hptw8ki0QAAANY"]
[Thu May 14 18:27:46.393286 2026] [:error] [pid 47721:tid 47740] [client 152.53.187.237:39480] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agWjonEmh7_G0hfOa6v-jgAAAZE"]
[Thu May 14 18:27:49.006754 2026] [:error] [pid 63033:tid 63059] [client 152.53.187.237:39488] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agWjpVMY49UWn5BpqVbwvwAAARg"]
[Thu May 14 18:27:51.518143 2026] [:error] [pid 11690:tid 11710] [client 152.53.187.237:48908] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agWjpynxWuLN8Hptw8ki0gAAAMs"]
[Thu May 14 18:27:54.191905 2026] [:error] [pid 63033:tid 63039] [client 152.53.187.237:48912] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agWjqlMY49UWn5BpqVbwwQAAAQQ"]
[Thu May 14 18:27:56.797529 2026] [:error] [pid 11582:tid 11635] [client 152.53.187.237:48920] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agWjrPuw2cmFDpGcKhAtPQAAAEo"]
[Thu May 14 18:27:59.399665 2026] [:error] [pid 47721:tid 47726] [client 152.53.187.237:48928] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agWjr3Emh7_G0hfOa6v-kQAAAYM"]
[Thu May 14 18:28:02.031141 2026] [:error] [pid 47721:tid 47733] [client 152.53.187.237:45602] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agWjsnEmh7_G0hfOa6v-kgAAAYo"]
[Thu May 14 18:28:04.489919 2026] [:error] [pid 11581:tid 11607] [client 152.53.187.237:45614] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agWjtP0vF48FbzpvQMX4JgAAAAo"]
[Thu May 14 19:32:30.153994 2026] [:error] [pid 47673:tid 47681] [client 65.108.2.171:21002] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agWyzvCGe4cIn3sh5k0lQQAAAUY"]
[Thu May 14 19:32:32.242953 2026] [:error] [pid 11581:tid 11615] [client 65.108.2.171:21008] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agWy0P0vF48FbzpvQMUPBQAAABI"]
[Thu May 14 19:32:34.703616 2026] [:error] [pid 11581:tid 11606] [client 65.108.2.171:24028] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agWy0v0vF48FbzpvQMUPDAAAAAk"]
[Thu May 14 19:32:37.172653 2026] [:error] [pid 63033:tid 63046] [client 65.108.2.171:18188] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agWy1VMY49UWn5BpqVb43wAAAQs"]
[Thu May 14 19:32:39.267335 2026] [:error] [pid 47673:tid 47682] [client 65.108.2.171:11778] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agWy1_CGe4cIn3sh5k0lRQAAAUc"]
[Thu May 14 19:32:41.844588 2026] [:error] [pid 11690:tid 11704] [client 65.108.2.171:18202] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agWy2SnxWuLN8Hptw8ktMQAAAMU"]
[Thu May 14 19:32:43.724133 2026] [:error] [pid 11581:tid 11603] [client 65.108.2.171:11792] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agWy2_0vF48FbzpvQMUPGwAAAAY"]
[Thu May 14 19:32:46.289903 2026] [:error] [pid 11581:tid 11621] [client 65.108.2.171:57474] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agWy3v0vF48FbzpvQMUPKAAAABg"]
[Thu May 14 19:32:48.309504 2026] [:error] [pid 11690:tid 11699] [client 65.108.2.171:16308] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agWy4CnxWuLN8Hptw8ktXAAAAMA"]
[Thu May 14 19:32:50.256352 2026] [:error] [pid 47673:tid 47683] [client 65.108.2.171:16314] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agWy4vCGe4cIn3sh5k0lVQAAAUg"]
[Thu May 14 19:32:52.952155 2026] [:error] [pid 11581:tid 11599] [client 65.108.2.171:57482] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agWy5P0vF48FbzpvQMUPRwAAAAI"]
[Thu May 14 19:32:55.555598 2026] [:error] [pid 11588:tid 11659] [client 65.108.2.171:53666] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agWy59Ur21rOixkeGKannAAAAIc"]
[Thu May 14 19:32:57.664471 2026] [:error] [pid 47721:tid 47727] [client 65.108.2.171:49350] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agWy6XEmh7_G0hfOa6sPlgAAAYQ"]
[Thu May 14 19:33:00.279867 2026] [:error] [pid 11588:tid 11662] [client 65.108.2.171:53682] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agWy7NUr21rOixkeGKannQAAAIo"]
[Thu May 14 19:33:02.719065 2026] [:error] [pid 11588:tid 11661] [client 65.108.2.171:53686] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agWy7tUr21rOixkeGKannwAAAIk"]
[Thu May 14 19:33:05.234151 2026] [:error] [pid 11690:tid 11703] [client 65.108.2.171:9124] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agWy8SnxWuLN8Hptw8ktcAAAAMQ"]
[Thu May 14 19:33:07.200934 2026] [:error] [pid 11581:tid 11601] [client 65.108.2.171:15644] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agWy8_0vF48FbzpvQMUPTwAAAAQ"]
[Thu May 14 19:33:09.691504 2026] [:error] [pid 11581:tid 11609] [client 65.108.2.171:9126] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agWy9f0vF48FbzpvQMUPUgAAAAw"]
[Thu May 14 19:33:11.731313 2026] [:error] [pid 47721:tid 47737] [client 65.108.2.171:15654] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agWy93Emh7_G0hfOa6sPmgAAAY4"]
[Thu May 14 19:33:14.268552 2026] [:error] [pid 47721:tid 47739] [client 65.108.2.171:9130] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agWy-nEmh7_G0hfOa6sPnAAAAZA"]
[Thu May 14 19:33:16.165915 2026] [:error] [pid 11581:tid 11611] [client 65.108.2.171:15638] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agWy_P0vF48FbzpvQMUPWAAAAA4"]
[Thu May 14 19:33:18.672845 2026] [:error] [pid 11588:tid 11667] [client 65.108.2.171:15026] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agWy_tUr21rOixkeGKanpgAAAI8"]
[Thu May 14 19:33:21.274514 2026] [:error] [pid 47721:tid 47735] [client 65.108.2.171:15040] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agWzAXEmh7_G0hfOa6sPogAAAYw"]
[Thu May 14 19:33:24.024356 2026] [:error] [pid 11588:tid 11658] [client 65.108.2.171:15046] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agWzBNUr21rOixkeGKanqAAAAIY"]
[Thu May 14 19:33:26.569522 2026] [:error] [pid 11581:tid 11602] [client 65.108.2.171:50698] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agWzBv0vF48FbzpvQMUPZgAAAAU"]
[Thu May 14 19:33:55.009379 2026] [:error] [pid 11582:tid 11638] [client 65.108.2.171:21830] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agWzI_uw2cmFDpGcKhAybwAAAE0"]
[Thu May 14 19:33:57.007429 2026] [:error] [pid 11588:tid 11676] [client 65.108.2.171:12618] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agWzJdUr21rOixkeGKanugAAAJg"]
[Thu May 14 19:33:59.535676 2026] [:error] [pid 11588:tid 11653] [client 65.108.2.171:21856] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agWzJ9Ur21rOixkeGKanvAAAAIE"]
[Thu May 14 19:34:02.168171 2026] [:error] [pid 47721:tid 47733] [client 65.108.2.171:21864] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agWzKnEmh7_G0hfOa6sPtwAAAYo"]
[Thu May 14 19:34:04.170619 2026] [:error] [pid 63033:tid 63040] [client 65.108.2.171:12620] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agWzLFMY49UWn5BpqVb5AgAAAQU"]
[Thu May 14 19:34:06.165336 2026] [:error] [pid 11581:tid 11607] [client 65.108.2.171:39990] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agWzLv0vF48FbzpvQMUPegAAAAo"]
[Thu May 14 19:34:08.797213 2026] [:error] [pid 11581:tid 11602] [client 65.108.2.171:16588] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agWzMP0vF48FbzpvQMUPfgAAAAU"]
[Thu May 14 19:34:10.776001 2026] [:error] [pid 11582:tid 11647] [client 65.108.2.171:40006] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agWzMvuw2cmFDpGcKhAycQAAAFY"]
[Thu May 14 19:34:12.816351 2026] [:error] [pid 11581:tid 11597] [client 65.108.2.171:40016] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agWzNP0vF48FbzpvQMUPhwAAAAA"]
[Thu May 14 19:34:14.870403 2026] [:error] [pid 11581:tid 11605] [client 65.108.2.171:10770] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agWzNv0vF48FbzpvQMUPqgAAAAg"]
[Thu May 14 19:34:16.911854 2026] [:error] [pid 11582:tid 11634] [client 65.108.2.171:10776] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agWzOPuw2cmFDpGcKhAydQAAAEk"]
[Thu May 14 19:34:18.903971 2026] [:error] [pid 11588:tid 11663] [client 65.108.2.171:10784] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agWzOtUr21rOixkeGKanyAAAAIs"]
[Thu May 14 19:34:20.886563 2026] [:error] [pid 11690:tid 11701] [client 65.108.2.171:10794] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agWzPCnxWuLN8Hptw8ktjAAAAMI"]
[Thu May 14 19:34:22.927012 2026] [:error] [pid 11588:tid 11664] [client 65.108.2.171:10806] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agWzPtUr21rOixkeGKanzgAAAIw"]
[Thu May 14 19:34:25.470687 2026] [:error] [pid 47721:tid 47733] [client 65.108.2.171:1808] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agWzQXEmh7_G0hfOa6sP6gAAAYo"]
[Thu May 14 19:34:27.508069 2026] [:error] [pid 47673:tid 47691] [client 65.108.2.171:54288] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agWzQ_CGe4cIn3sh5k0legAAAVA"]
[Thu May 14 19:34:29.573193 2026] [:error] [pid 47721:tid 47741] [client 65.108.2.171:54304] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agWzRXEmh7_G0hfOa6sP7QAAAZI"]
[Thu May 14 19:34:31.973764 2026] [:error] [pid 11581:tid 11598] [client 65.108.2.171:1816] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agWzR_0vF48FbzpvQMUPuAAAAAE"]
[Thu May 14 19:34:34.464393 2026] [:error] [pid 11588:tid 11664] [client 65.108.2.171:1828] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agWzStUr21rOixkeGKan2wAAAIw"]
[Thu May 14 19:34:36.935137 2026] [:error] [pid 11581:tid 11600] [client 65.108.2.171:29182] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agWzTP0vF48FbzpvQMUPuwAAAAM"]
[Thu May 14 19:34:39.523358 2026] [:error] [pid 47673:tid 47678] [client 65.108.2.171:29192] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agWzT_CGe4cIn3sh5k0lfwAAAUM"]
[Thu May 14 19:34:41.172530 2026] [:error] [pid 11581:tid 11618] [client 65.108.2.171:16062] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agWzUf0vF48FbzpvQMUPwwAAABU"]
[Thu May 14 19:34:45.121200 2026] [:error] [pid 11582:tid 11637] [client 65.108.2.171:52490] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agWzVfuw2cmFDpGcKhAyfwAAAEw"]
[Thu May 14 22:02:10.844987 2026] [:error] [pid 47673:tid 47689] [client 43.156.71.177:42756] [client 43.156.71.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agXV4vCGe4cIn3sh5k0xPgAAAU4"]
[Thu May 14 22:51:50.704498 2026] [:error] [pid 11581:tid 11604] [client 129.226.146.134:49510] [client 129.226.146.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agXhhv0vF48FbzpvQMVF7wAAAAc"]
[Thu May 14 23:00:03.795560 2026] [:error] [pid 11690:tid 11722] [client 217.182.194.25:41794] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agXjcynxWuLN8Hptw8lEPwAAANc"]
[Thu May 14 23:00:05.914209 2026] [:error] [pid 47721:tid 47734] [client 217.182.194.25:39316] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agXjdXEmh7_G0hfOa6s1tAAAAYs"]
[Thu May 14 23:00:07.733541 2026] [:error] [pid 11582:tid 11637] [client 217.182.194.25:54344] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agXjd_uw2cmFDpGcKhBALQAAAEw"]
[Thu May 14 23:00:09.844129 2026] [:error] [pid 47721:tid 47726] [client 217.182.194.25:54348] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agXjeXEmh7_G0hfOa6s1tQAAAYM"]
[Thu May 14 23:00:12.517631 2026] [:error] [pid 47721:tid 47737] [client 217.182.194.25:54364] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agXjfHEmh7_G0hfOa6s1uQAAAY4"]
[Thu May 14 23:00:14.754544 2026] [:error] [pid 47721:tid 47736] [client 217.182.194.25:54376] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agXjfnEmh7_G0hfOa6s1vAAAAY0"]
[Thu May 14 23:00:16.808323 2026] [:error] [pid 11588:tid 11676] [client 217.182.194.25:54378] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agXjgNUr21rOixkeGKbDywAAAJg"]
[Thu May 14 23:00:19.116153 2026] [:error] [pid 11581:tid 11607] [client 217.182.194.25:58564] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agXjg_0vF48FbzpvQMVIYgAAAAo"]
[Thu May 14 23:00:21.217123 2026] [:error] [pid 47721:tid 47726] [client 217.182.194.25:58568] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agXjhXEmh7_G0hfOa6s1wwAAAYM"]
[Thu May 14 23:00:25.112143 2026] [:error] [pid 47721:tid 47740] [client 217.182.194.25:58578] [client 217.182.194.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agXjiXEmh7_G0hfOa6s1xwAAAZE"]
[Fri May 15 00:09:35.337082 2026] [:error] [pid 11582:tid 11641] [client 20.220.221.224:13688] [client 20.220.221.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "agXzv_uw2cmFDpGcKhBEKgAAAFA"]
[Fri May 15 00:09:36.179555 2026] [:error] [pid 47721:tid 47742] [client 20.220.221.224:13632] [client 20.220.221.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "agXzwHEmh7_G0hfOa6s_uQAAAZM"]
[Fri May 15 00:09:37.011697 2026] [:error] [pid 47721:tid 47724] [client 20.220.221.224:13378] [client 20.220.221.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "agXzwXEmh7_G0hfOa6s_vQAAAYE"]
[Fri May 15 00:09:37.862894 2026] [:error] [pid 11690:tid 11717] [client 20.220.221.224:13426] [client 20.220.221.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wk/index.php"] [unique_id "agXzwSnxWuLN8Hptw8lK-wAAANI"]
[Fri May 15 02:40:55.818118 2026] [:error] [pid 11690:tid 11711] [client 81.167.26.57:10732] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agYXNynxWuLN8Hptw8lY7wAAAMw"]
[Fri May 15 02:40:57.780695 2026] [:error] [pid 11582:tid 11648] [client 81.167.26.57:3952] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agYXOfuw2cmFDpGcKhBMxQAAAFc"]
[Fri May 15 02:41:00.337739 2026] [:error] [pid 11582:tid 11642] [client 81.167.26.57:33056] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agYXPPuw2cmFDpGcKhBMyAAAAFE"]
[Fri May 15 02:41:02.341697 2026] [:error] [pid 11581:tid 11605] [client 81.167.26.57:33716] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agYXPv0vF48FbzpvQMV4hQAAAAg"]
[Fri May 15 02:41:04.319181 2026] [:error] [pid 11581:tid 11600] [client 81.167.26.57:56683] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agYXQP0vF48FbzpvQMV4hgAAAAM"]
[Fri May 15 02:41:06.307352 2026] [:error] [pid 11581:tid 11607] [client 81.167.26.57:64912] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agYXQv0vF48FbzpvQMV4iQAAAAo"]
[Fri May 15 02:41:08.150383 2026] [:error] [pid 11581:tid 11599] [client 81.167.26.57:41005] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agYXRP0vF48FbzpvQMV4jgAAAAI"]
[Fri May 15 02:41:10.114335 2026] [:error] [pid 63033:tid 63050] [client 81.167.26.57:51495] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agYXRlMY49UWn5BpqVYdCAAAAQ8"]
[Fri May 15 02:41:11.965072 2026] [:error] [pid 47721:tid 47747] [client 81.167.26.57:56501] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agYXR3Emh7_G0hfOa6tV0QAAAZg"]
[Fri May 15 02:41:13.940485 2026] [:error] [pid 47721:tid 47741] [client 81.167.26.57:3232] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agYXSXEmh7_G0hfOa6tV0wAAAZI"]
[Fri May 15 02:41:16.378821 2026] [:error] [pid 11690:tid 11707] [client 81.167.26.57:53564] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agYXTCnxWuLN8Hptw8lY8gAAAMg"]
[Fri May 15 02:41:18.369543 2026] [:error] [pid 63033:tid 63043] [client 81.167.26.57:8872] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agYXTlMY49UWn5BpqVYdCQAAAQg"]
[Fri May 15 02:41:20.343543 2026] [:error] [pid 63033:tid 63051] [client 81.167.26.57:48800] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agYXUFMY49UWn5BpqVYdCgAAARA"]
[Fri May 15 02:41:22.332100 2026] [:error] [pid 63033:tid 63035] [client 81.167.26.57:24499] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agYXUlMY49UWn5BpqVYdCwAAAQA"]
[Fri May 15 02:41:24.312722 2026] [:error] [pid 47673:tid 47680] [client 81.167.26.57:14648] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agYXVPCGe4cIn3sh5k1FuAAAAUU"]
[Fri May 15 02:41:26.289686 2026] [:error] [pid 11581:tid 11609] [client 81.167.26.57:43263] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agYXVv0vF48FbzpvQMV4kAAAAAw"]
[Fri May 15 02:41:28.267808 2026] [:error] [pid 63033:tid 63059] [client 81.167.26.57:65528] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agYXWFMY49UWn5BpqVYdDwAAARg"]
[Fri May 15 02:41:30.246023 2026] [:error] [pid 11582:tid 11637] [client 81.167.26.57:30129] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agYXWvuw2cmFDpGcKhBMzgAAAEw"]
[Fri May 15 02:41:32.235497 2026] [:error] [pid 63033:tid 63038] [client 81.167.26.57:61815] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agYXXFMY49UWn5BpqVYdEwAAAQM"]
[Fri May 15 02:41:34.227059 2026] [:error] [pid 47721:tid 47723] [client 81.167.26.57:45364] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agYXXnEmh7_G0hfOa6tV3wAAAYA"]
[Fri May 15 02:41:36.216520 2026] [:error] [pid 63033:tid 63041] [client 81.167.26.57:24597] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agYXYFMY49UWn5BpqVYdFAAAAQY"]
[Fri May 15 02:41:38.331349 2026] [:error] [pid 47721:tid 47727] [client 81.167.26.57:62014] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agYXYnEmh7_G0hfOa6tV4wAAAYQ"]
[Fri May 15 02:41:42.031330 2026] [:error] [pid 11588:tid 11668] [client 81.167.26.57:16395] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agYXZtUr21rOixkeGKbdZQAAAJA"]
[Fri May 15 02:41:44.108500 2026] [:error] [pid 47673:tid 47693] [client 81.167.26.57:11710] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agYXaPCGe4cIn3sh5k1FwgAAAVI"]
[Fri May 15 02:41:46.102804 2026] [:error] [pid 47721:tid 47747] [client 81.167.26.57:22862] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agYXanEmh7_G0hfOa6tV5wAAAZg"]
[Fri May 15 02:41:48.665237 2026] [:error] [pid 47721:tid 47741] [client 81.167.26.57:40115] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agYXbHEmh7_G0hfOa6tV6AAAAZI"]
[Fri May 15 02:41:50.648648 2026] [:error] [pid 11581:tid 11604] [client 81.167.26.57:58309] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agYXbv0vF48FbzpvQMV4lAAAAAc"]
[Fri May 15 02:41:52.683478 2026] [:error] [pid 47721:tid 47724] [client 81.167.26.57:35866] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agYXcHEmh7_G0hfOa6tV6gAAAYE"]
[Fri May 15 02:42:13.881201 2026] [:error] [pid 47721:tid 47735] [client 81.167.26.57:7590] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agYXhXEmh7_G0hfOa6tV9QAAAYw"]
[Fri May 15 02:42:16.623592 2026] [:error] [pid 11581:tid 11605] [client 81.167.26.57:22825] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agYXiP0vF48FbzpvQMV4tAAAAAg"]
[Fri May 15 02:42:18.600138 2026] [:error] [pid 11581:tid 11602] [client 81.167.26.57:63937] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agYXiv0vF48FbzpvQMV4tQAAAAU"]
[Fri May 15 02:42:20.582736 2026] [:error] [pid 11588:tid 11652] [client 81.167.26.57:36799] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agYXjNUr21rOixkeGKbdbAAAAIA"]
[Fri May 15 02:42:22.566412 2026] [:error] [pid 47721:tid 47732] [client 81.167.26.57:13177] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agYXjnEmh7_G0hfOa6tV9wAAAYk"]
[Fri May 15 02:42:24.400014 2026] [:error] [pid 11581:tid 11611] [client 81.167.26.57:9830] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agYXkP0vF48FbzpvQMV4vAAAAA4"]
[Fri May 15 02:42:26.390852 2026] [:error] [pid 11582:tid 11641] [client 81.167.26.57:13316] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agYXkvuw2cmFDpGcKhBM2AAAAFA"]
[Fri May 15 02:42:28.360717 2026] [:error] [pid 47721:tid 47734] [client 81.167.26.57:2494] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agYXlHEmh7_G0hfOa6tV-wAAAYs"]
[Fri May 15 02:42:30.353075 2026] [:error] [pid 11588:tid 11665] [client 81.167.26.57:52822] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agYXltUr21rOixkeGKbdcwAAAI0"]
[Fri May 15 02:42:32.326907 2026] [:error] [pid 47721:tid 47725] [client 81.167.26.57:39039] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agYXmHEmh7_G0hfOa6tWAQAAAYI"]
[Fri May 15 02:42:35.322153 2026] [:error] [pid 11582:tid 11637] [client 81.167.26.57:33722] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agYXm_uw2cmFDpGcKhBM2QAAAEw"]
[Fri May 15 02:42:37.383006 2026] [:error] [pid 47721:tid 47735] [client 81.167.26.57:49804] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agYXnXEmh7_G0hfOa6tWAgAAAYw"]
[Fri May 15 02:42:39.220537 2026] [:error] [pid 63033:tid 63056] [client 81.167.26.57:45327] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agYXn1MY49UWn5BpqVYdHwAAARU"]
[Fri May 15 02:42:41.186489 2026] [:error] [pid 47721:tid 47732] [client 81.167.26.57:10816] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agYXoXEmh7_G0hfOa6tWBQAAAYk"]
[Fri May 15 02:42:43.184775 2026] [:error] [pid 11581:tid 11612] [client 81.167.26.57:27375] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agYXo_0vF48FbzpvQMV4wAAAAA8"]
[Fri May 15 02:42:45.149300 2026] [:error] [pid 11581:tid 11607] [client 81.167.26.57:34249] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agYXpf0vF48FbzpvQMV4xAAAAAo"]
[Fri May 15 02:42:47.137777 2026] [:error] [pid 11581:tid 11619] [client 81.167.26.57:28944] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agYXp_0vF48FbzpvQMV4yAAAABY"]
[Fri May 15 02:42:49.110834 2026] [:error] [pid 63033:tid 63036] [client 81.167.26.57:54186] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agYXqVMY49UWn5BpqVYdIAAAAQE"]
[Fri May 15 02:42:51.088130 2026] [:error] [pid 47721:tid 47742] [client 81.167.26.57:27339] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agYXq3Emh7_G0hfOa6tWCQAAAZM"]
[Fri May 15 02:42:53.100464 2026] [:error] [pid 47673:tid 47697] [client 81.167.26.57:38729] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agYXrfCGe4cIn3sh5k1FxgAAAVY"]
[Fri May 15 02:42:55.083855 2026] [:error] [pid 47673:tid 47699] [client 81.167.26.57:7310] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agYXr_CGe4cIn3sh5k1FyAAAAVg"]
[Fri May 15 02:42:56.923360 2026] [:error] [pid 47721:tid 47728] [client 81.167.26.57:53438] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agYXsHEmh7_G0hfOa6tWCwAAAYU"]
[Fri May 15 02:42:58.900710 2026] [:error] [pid 11690:tid 11704] [client 81.167.26.57:25411] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agYXsinxWuLN8Hptw8lZAQAAAMU"]
[Fri May 15 02:43:00.914696 2026] [:error] [pid 47721:tid 47743] [client 81.167.26.57:1530] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agYXtHEmh7_G0hfOa6tWDwAAAZQ"]
[Fri May 15 02:43:02.914910 2026] [:error] [pid 11588:tid 11657] [client 81.167.26.57:51469] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agYXttUr21rOixkeGKbdgAAAAIU"]
[Fri May 15 02:43:04.746980 2026] [:error] [pid 11690:tid 11706] [client 81.167.26.57:7452] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agYXuCnxWuLN8Hptw8lZAwAAAMc"]
[Fri May 15 02:43:06.754864 2026] [:error] [pid 11581:tid 11601] [client 81.167.26.57:17481] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agYXuv0vF48FbzpvQMV4zgAAAAQ"]
[Fri May 15 02:43:08.742901 2026] [:error] [pid 11690:tid 11699] [client 81.167.26.57:43892] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agYXvCnxWuLN8Hptw8lZCAAAAMA"]
[Fri May 15 02:43:10.594398 2026] [:error] [pid 11581:tid 11600] [client 81.167.26.57:49426] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agYXvv0vF48FbzpvQMV40AAAAAM"]
[Fri May 15 03:31:41.522353 2026] [:error] [pid 63033:tid 63059] [client 202.47.36.212:60598] [client 202.47.36.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.47.36.212, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agYjHVMY49UWn5BpqVYg6AAAARg"]
[Fri May 15 03:31:41.533721 2026] [proxy_fcgi:error] [pid 63033:tid 63059] [client 202.47.36.212:60598] AH01071: Got error 'Primary script unknown'
[Fri May 15 04:19:57.639776 2026] [:error] [pid 1189:tid 1227] [client 183.199.82.79:1374] [client 183.199.82.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agYubQe36qIGegR4kck86QAAAEI"], referer: http://www.switchcreative.net/
[Fri May 15 04:28:42.807922 2026] [:error] [pid 1295:tid 1320] [client 95.217.109.26:7952] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agYwetmMhqLvs0GYixnHBQAAANY"]
[Fri May 15 04:28:45.553395 2026] [:error] [pid 1295:tid 1310] [client 95.217.109.26:2762] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agYwfdmMhqLvs0GYixnHBwAAAMw"]
[Fri May 15 04:28:48.215826 2026] [:error] [pid 1295:tid 1317] [client 95.217.109.26:23934] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agYwgNmMhqLvs0GYixnHCAAAANM"]
[Fri May 15 04:28:50.891428 2026] [:error] [pid 1295:tid 1300] [client 95.217.109.26:23950] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agYwgtmMhqLvs0GYixnHDAAAAMI"]
[Fri May 15 04:28:53.496083 2026] [:error] [pid 1295:tid 1305] [client 95.217.109.26:23966] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agYwhdmMhqLvs0GYixnHDwAAAMc"]
[Fri May 15 04:28:56.240006 2026] [:error] [pid 1295:tid 1319] [client 95.217.109.26:23982] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agYwiNmMhqLvs0GYixnHEQAAANU"]
[Fri May 15 04:28:58.397719 2026] [:error] [pid 1188:tid 1202] [client 95.217.109.26:25230] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agYwitY68iW8yuNkNzPCggAAAAU"]
[Fri May 15 04:29:01.122352 2026] [:error] [pid 1295:tid 1320] [client 95.217.109.26:52582] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agYwjdmMhqLvs0GYixnHEgAAANY"]
[Fri May 15 04:29:03.238033 2026] [:error] [pid 1188:tid 1199] [client 95.217.109.26:25244] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agYwj9Y68iW8yuNkNzPChAAAAAI"]
[Fri May 15 04:29:05.227305 2026] [:error] [pid 1295:tid 1311] [client 95.217.109.26:25254] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agYwkdmMhqLvs0GYixnHFAAAAM0"]
[Fri May 15 04:29:07.797506 2026] [:error] [pid 1295:tid 1310] [client 95.217.109.26:40844] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agYwk9mMhqLvs0GYixnHFQAAAMw"]
[Fri May 15 04:29:09.961277 2026] [:error] [pid 1188:tid 1212] [client 95.217.109.26:55782] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agYwldY68iW8yuNkNzPCjQAAAA8"]
[Fri May 15 04:29:12.529532 2026] [:error] [pid 1295:tid 1306] [client 95.217.109.26:40860] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agYwmNmMhqLvs0GYixnHGgAAAMg"]
[Fri May 15 04:29:23.011293 2026] [:error] [pid 1188:tid 1210] [client 95.217.109.26:29450] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agYwo9Y68iW8yuNkNzPCngAAAA0"]
[Fri May 15 04:29:25.664635 2026] [:error] [pid 1188:tid 1197] [client 95.217.109.26:29466] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agYwpdY68iW8yuNkNzPCpAAAAAA"]
[Fri May 15 04:29:28.252677 2026] [:error] [pid 1295:tid 1299] [client 95.217.109.26:50468] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agYwqNmMhqLvs0GYixnHKAAAAME"]
[Fri May 15 04:29:30.300222 2026] [:error] [pid 1189:tid 1238] [client 95.217.109.26:34832] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agYwqge36qIGegR4kck_QwAAAE0"]
[Fri May 15 04:29:32.319212 2026] [:error] [pid 1190:tid 1255] [client 95.217.109.26:34834] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agYwrNqiXrD7hne4gFaNTQAAAIM"]
[Fri May 15 04:29:34.375559 2026] [:error] [pid 1295:tid 1305] [client 95.217.109.26:34836] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agYwrtmMhqLvs0GYixnHLgAAAMc"]
[Fri May 15 04:30:04.844362 2026] [:error] [pid 1295:tid 1312] [client 95.217.109.26:28234] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agYwzNmMhqLvs0GYixnHRgAAAM4"]
[Fri May 15 04:30:07.446768 2026] [:error] [pid 1189:tid 1242] [client 95.217.109.26:26454] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agYwzwe36qIGegR4kck_UwAAAFE"]
[Fri May 15 04:30:09.636988 2026] [:error] [pid 1295:tid 1322] [client 95.217.109.26:18854] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agYw0dmMhqLvs0GYixnHSAAAANg"]
[Fri May 15 04:30:11.654506 2026] [:error] [pid 1188:tid 1209] [client 95.217.109.26:18864] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agYw09Y68iW8yuNkNzPCtQAAAAw"]
[Fri May 15 04:30:14.347167 2026] [:error] [pid 1190:tid 1261] [client 95.217.109.26:26462] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agYw1tqiXrD7hne4gFaNXAAAAIk"]
[Fri May 15 04:30:16.902163 2026] [:error] [pid 1295:tid 1299] [client 95.217.109.26:51006] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agYw2NmMhqLvs0GYixnHTAAAAME"]
[Fri May 15 04:30:19.493403 2026] [:error] [pid 1190:tid 1260] [client 95.217.109.26:51020] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agYw29qiXrD7hne4gFaNZwAAAIg"]
[Fri May 15 04:30:23.764456 2026] [:error] [pid 1295:tid 1312] [client 95.217.109.26:47306] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agYw39mMhqLvs0GYixnHUgAAAM4"]
[Fri May 15 04:30:27.823320 2026] [:error] [pid 1295:tid 1309] [client 95.217.109.26:25804] [client 95.217.109.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agYw49mMhqLvs0GYixnHWAAAAMs"]
[Fri May 15 04:51:59.755931 2026] [:error] [pid 1295:tid 1305] [client 51.75.128.94:60946] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agY179mMhqLvs0GYixnMiAAAAMc"]
[Fri May 15 04:52:01.647271 2026] [:error] [pid 1295:tid 1307] [client 51.75.128.94:55040] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agY18dmMhqLvs0GYixnMjAAAAMk"]
[Fri May 15 04:52:03.832959 2026] [:error] [pid 1190:tid 1252] [client 51.75.128.94:55044] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agY189qiXrD7hne4gFaRawAAAIA"]
[Fri May 15 04:52:06.401743 2026] [:error] [pid 1190:tid 1272] [client 51.75.128.94:58888] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agY19tqiXrD7hne4gFaRcAAAAJQ"]
[Fri May 15 04:52:08.793729 2026] [:error] [pid 1295:tid 1311] [client 51.75.128.94:58898] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agY1-NmMhqLvs0GYixnMowAAAM0"]
[Fri May 15 04:52:11.002610 2026] [:error] [pid 1189:tid 1237] [client 51.75.128.94:58910] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agY1-we36qIGegR4kclCqAAAAEw"]
[Fri May 15 04:52:13.025840 2026] [:error] [pid 1295:tid 1299] [client 51.75.128.94:58920] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agY1_dmMhqLvs0GYixnMrQAAAME"]
[Fri May 15 04:52:14.877106 2026] [:error] [pid 1295:tid 1307] [client 51.75.128.94:58934] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agY1_tmMhqLvs0GYixnMsgAAAMk"]
[Fri May 15 04:52:16.820577 2026] [:error] [pid 1295:tid 1321] [client 51.75.128.94:38936] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agY2ANmMhqLvs0GYixnMtgAAANc"]
[Fri May 15 04:52:18.827779 2026] [:error] [pid 1189:tid 1225] [client 51.75.128.94:38950] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agY2Age36qIGegR4kclCrQAAAEA"]
[Fri May 15 04:52:20.791762 2026] [:error] [pid 1295:tid 1308] [client 51.75.128.94:38954] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agY2BNmMhqLvs0GYixnMwAAAAMo"]
[Fri May 15 04:52:22.727894 2026] [:error] [pid 1188:tid 1213] [client 51.75.128.94:38970] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agY2BtY68iW8yuNkNzPF5QAAABA"]
[Fri May 15 04:52:24.608172 2026] [:error] [pid 1189:tid 1237] [client 51.75.128.94:38972] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agY2CAe36qIGegR4kclCuwAAAEw"]
[Fri May 15 04:52:26.523739 2026] [:error] [pid 1188:tid 1208] [client 51.75.128.94:40432] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agY2CtY68iW8yuNkNzPF5wAAAAs"]
[Fri May 15 04:52:28.540456 2026] [:error] [pid 1188:tid 1219] [client 51.75.128.94:40434] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agY2DNY68iW8yuNkNzPF6AAAABY"]
[Fri May 15 04:52:30.514874 2026] [:error] [pid 1190:tid 1266] [client 51.75.128.94:40436] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agY2DtqiXrD7hne4gFaRqgAAAI4"]
[Fri May 15 04:52:32.408155 2026] [:error] [pid 1189:tid 1243] [client 51.75.128.94:40442] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agY2EAe36qIGegR4kclCvgAAAFI"]
[Fri May 15 04:52:34.231602 2026] [:error] [pid 1190:tid 1254] [client 51.75.128.94:40446] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agY2EtqiXrD7hne4gFaRuQAAAII"]
[Fri May 15 04:52:36.054987 2026] [:error] [pid 50531:tid 50534] [client 51.75.128.94:40450] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agY2FB3WbFwE6voqGzqRHgAAAQE"]
[Fri May 15 04:52:37.906207 2026] [:error] [pid 50531:tid 50545] [client 51.75.128.94:49348] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agY2FR3WbFwE6voqGzqRIAAAAQw"]
[Fri May 15 04:52:39.749857 2026] [:error] [pid 50531:tid 50554] [client 51.75.128.94:49356] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agY2Fx3WbFwE6voqGzqRJQAAARU"]
[Fri May 15 04:52:41.587993 2026] [:error] [pid 50531:tid 50541] [client 51.75.128.94:49372] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agY2GR3WbFwE6voqGzqRJwAAAQg"]
[Fri May 15 09:00:07.319601 2026] [:error] [pid 1188:tid 1214] [client 43.153.123.3:34988] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agZwF9Y68iW8yuNkNzPq7gAAABE"]
[Fri May 15 10:50:01.265923 2026] [:error] [pid 1188:tid 1211] [client 147.135.213.153:46690] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agaJ2dY68iW8yuNkNzP1jgAAAA4"]
[Fri May 15 10:50:02.939594 2026] [:error] [pid 50531:tid 50534] [client 147.135.213.153:46206] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agaJ2h3WbFwE6voqGzrqGgAAAQE"]
[Fri May 15 10:50:04.852550 2026] [:error] [pid 1189:tid 1242] [client 147.135.213.153:49234] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agaJ3Ae36qIGegR4kcmL_QAAAFE"]
[Fri May 15 10:50:07.319030 2026] [:error] [pid 50531:tid 50550] [client 147.135.213.153:44936] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agaJ3x3WbFwE6voqGzrqHAAAARE"]
[Fri May 15 10:50:09.242744 2026] [:error] [pid 1190:tid 1265] [client 147.135.213.153:59304] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agaJ4dqiXrD7hne4gFbPDwAAAI0"]
[Fri May 15 10:50:11.718470 2026] [:error] [pid 1190:tid 1276] [client 147.135.213.153:47934] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agaJ49qiXrD7hne4gFbPEAAAAJg"]
[Fri May 15 10:50:13.703495 2026] [:error] [pid 1188:tid 1204] [client 147.135.213.153:59310] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agaJ5dY68iW8yuNkNzP1kQAAAAc"]
[Fri May 15 10:50:15.544505 2026] [:error] [pid 51234:tid 51237] [client 147.135.213.153:59322] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agaJ5972N9CbeiqcqgPlhAAAAUE"]
[Fri May 15 10:50:17.557293 2026] [:error] [pid 1295:tid 1307] [client 147.135.213.153:37264] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agaJ6dmMhqLvs0GYixkkTgAAAMk"]
[Fri May 15 10:50:19.566781 2026] [:error] [pid 1190:tid 1258] [client 147.135.213.153:37280] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agaJ69qiXrD7hne4gFbPFQAAAIY"]
[Fri May 15 10:50:21.572448 2026] [:error] [pid 50531:tid 50538] [client 147.135.213.153:37296] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agaJ7R3WbFwE6voqGzrqJwAAAQU"]
[Fri May 15 10:50:23.454162 2026] [:error] [pid 50531:tid 50549] [client 147.135.213.153:37312] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agaJ7x3WbFwE6voqGzrqKQAAARA"]
[Fri May 15 10:50:25.953594 2026] [:error] [pid 1295:tid 1311] [client 147.135.213.153:39274] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agaJ8dmMhqLvs0GYixkkVAAAAM0"]
[Fri May 15 10:50:28.100355 2026] [:error] [pid 1295:tid 1321] [client 147.135.213.153:39054] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agaJ9NmMhqLvs0GYixkkVQAAANc"]
[Fri May 15 10:50:31.950735 2026] [:error] [pid 1189:tid 1240] [client 147.135.213.153:39058] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agaJ9we36qIGegR4kcmL_gAAAE8"]
[Fri May 15 11:29:21.324974 2026] [:error] [pid 1295:tid 1300] [client 147.135.212.200:50900] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agaTEdmMhqLvs0GYixkrIAAAAMI"]
[Fri May 15 11:29:23.292296 2026] [:error] [pid 1189:tid 1243] [client 147.135.212.200:50914] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agaTEwe36qIGegR4kcmV6AAAAFI"]
[Fri May 15 11:29:25.683380 2026] [:error] [pid 51234:tid 51245] [client 147.135.212.200:54746] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agaTFd72N9CbeiqcqgPz7AAAAUk"]
[Fri May 15 11:29:28.011249 2026] [:error] [pid 51234:tid 51255] [client 147.135.212.200:51808] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agaTGN72N9CbeiqcqgPz9AAAAVM"]
[Fri May 15 11:29:30.016468 2026] [:error] [pid 51234:tid 51238] [client 147.135.212.200:49412] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agaTGt72N9CbeiqcqgPz_wAAAUI"]
[Fri May 15 11:29:32.530846 2026] [:error] [pid 50531:tid 50546] [client 147.135.212.200:51824] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agaTHB3WbFwE6voqGzrv6QAAAQ0"]
[Fri May 15 11:29:34.514925 2026] [:error] [pid 51234:tid 51249] [client 147.135.212.200:49422] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agaTHt72N9CbeiqcqgP0BQAAAU0"]
[Fri May 15 11:29:37.004906 2026] [:error] [pid 1189:tid 1244] [client 147.135.212.200:38468] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agaTIQe36qIGegR4kcmV9AAAAFM"]
[Fri May 15 11:29:38.880909 2026] [:error] [pid 1189:tid 1248] [client 147.135.212.200:59554] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agaTIge36qIGegR4kcmV9gAAAFc"]
[Fri May 15 11:29:40.890488 2026] [:error] [pid 51234:tid 51241] [client 147.135.212.200:59558] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agaTJN72N9CbeiqcqgP0CgAAAUU"]
[Fri May 15 11:29:43.385743 2026] [:error] [pid 1190:tid 1271] [client 147.135.212.200:38484] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agaTJ9qiXrD7hne4gFbUlAAAAJM"]
[Fri May 15 11:29:45.865568 2026] [:error] [pid 1189:tid 1247] [client 147.135.212.200:38488] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agaTKQe36qIGegR4kcmV_AAAAFY"]
[Fri May 15 11:29:47.701121 2026] [:error] [pid 51234:tid 51239] [client 147.135.212.200:42000] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agaTK972N9CbeiqcqgP0DAAAAUM"]
[Fri May 15 11:29:50.228514 2026] [:error] [pid 1190:tid 1258] [client 147.135.212.200:34624] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agaTLtqiXrD7hne4gFbUlQAAAIY"]
[Fri May 15 11:29:52.727571 2026] [:error] [pid 1189:tid 1243] [client 147.135.212.200:34632] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agaTMAe36qIGegR4kcmWAwAAAFI"]
[Fri May 15 11:29:55.218820 2026] [:error] [pid 1295:tid 1299] [client 147.135.212.200:34636] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agaTM9mMhqLvs0GYixkrTQAAAME"]
[Fri May 15 11:29:57.053262 2026] [:error] [pid 1190:tid 1276] [client 147.135.212.200:55002] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agaTNdqiXrD7hne4gFbUmQAAAJg"]
[Fri May 15 11:29:59.571954 2026] [:error] [pid 1188:tid 1217] [client 147.135.212.200:39070] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agaTN9Y68iW8yuNkNzP6fgAAABQ"]
[Fri May 15 11:30:01.551315 2026] [:error] [pid 1295:tid 1321] [client 147.135.212.200:55004] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agaTOdmMhqLvs0GYixkrVQAAANc"]
[Fri May 15 11:30:04.045546 2026] [:error] [pid 1190:tid 1275] [client 147.135.212.200:39084] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agaTPNqiXrD7hne4gFbUnQAAAJc"]
[Fri May 15 11:30:05.998282 2026] [:error] [pid 1295:tid 1304] [client 147.135.212.200:55006] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agaTPdmMhqLvs0GYixkrWwAAAMY"]
[Fri May 15 11:30:08.515656 2026] [:error] [pid 1295:tid 1319] [client 147.135.212.200:33150] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agaTQNmMhqLvs0GYixkrXAAAANU"]
[Fri May 15 11:30:11.020414 2026] [:error] [pid 1295:tid 1315] [client 147.135.212.200:33152] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agaTQ9mMhqLvs0GYixkrXgAAANE"]
[Fri May 15 11:30:13.488665 2026] [:error] [pid 1295:tid 1303] [client 147.135.212.200:33164] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agaTRdmMhqLvs0GYixkrXwAAAMU"]
[Fri May 15 11:30:15.955601 2026] [:error] [pid 1295:tid 1302] [client 147.135.212.200:33172] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agaTR9mMhqLvs0GYixkrYQAAAMQ"]
[Fri May 15 11:30:17.940342 2026] [:error] [pid 51234:tid 51250] [client 147.135.212.200:55512] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agaTSd72N9CbeiqcqgP0LAAAAU4"]
[Fri May 15 11:30:39.004968 2026] [:error] [pid 1295:tid 1310] [client 147.135.212.200:57652] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agaTX9mMhqLvs0GYixkrcgAAAMw"]
[Fri May 15 11:30:40.727203 2026] [:error] [pid 1190:tid 1255] [client 147.135.212.200:52840] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agaTYNqiXrD7hne4gFbUqAAAAIM"]
[Fri May 15 11:30:43.160597 2026] [:error] [pid 50531:tid 50533] [client 147.135.212.200:52052] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agaTYx3WbFwE6voqGzrwAAAAAQA"]
[Fri May 15 11:30:45.152245 2026] [:error] [pid 1189:tid 1233] [client 147.135.212.200:54678] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agaTZQe36qIGegR4kcmWEwAAAEg"]
[Fri May 15 11:30:47.002979 2026] [:error] [pid 1189:tid 1225] [client 147.135.212.200:35832] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agaTZwe36qIGegR4kcmWFAAAAEA"]
[Fri May 15 11:30:49.513348 2026] [:error] [pid 51234:tid 51248] [client 147.135.212.200:47750] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agaTad72N9CbeiqcqgP0UgAAAUw"]
[Fri May 15 11:30:51.492061 2026] [:error] [pid 1188:tid 1214] [client 147.135.212.200:35836] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agaTa9Y68iW8yuNkNzP6hQAAABE"]
[Fri May 15 11:30:53.498326 2026] [:error] [pid 1188:tid 1208] [client 147.135.212.200:35846] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agaTbdY68iW8yuNkNzP6hwAAAAs"]
[Fri May 15 11:30:55.509480 2026] [:error] [pid 1189:tid 1243] [client 147.135.212.200:35862] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agaTbwe36qIGegR4kcmWHgAAAFI"]
[Fri May 15 11:30:57.362173 2026] [:error] [pid 51234:tid 51236] [client 147.135.212.200:38784] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agaTcd72N9CbeiqcqgP0XQAAAUA"]
[Fri May 15 11:30:59.359002 2026] [:error] [pid 51234:tid 51237] [client 147.135.212.200:38800] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agaTc972N9CbeiqcqgP0YQAAAUE"]
[Fri May 15 11:31:01.366026 2026] [:error] [pid 1189:tid 1228] [client 147.135.212.200:38812] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agaTdQe36qIGegR4kcmWJwAAAEM"]
[Fri May 15 11:31:03.370444 2026] [:error] [pid 51234:tid 51253] [client 147.135.212.200:38818] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agaTd972N9CbeiqcqgP0ZgAAAVE"]
[Fri May 15 11:31:05.855433 2026] [:error] [pid 51234:tid 51252] [client 147.135.212.200:56390] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agaTed72N9CbeiqcqgP0aQAAAVA"]
[Fri May 15 11:31:07.822812 2026] [:error] [pid 1295:tid 1318] [client 147.135.212.200:33064] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agaTe9mMhqLvs0GYixkrgAAAANQ"]
[Fri May 15 11:31:09.816182 2026] [:error] [pid 1295:tid 1298] [client 147.135.212.200:33076] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agaTfdmMhqLvs0GYixkrggAAAMA"]
[Fri May 15 11:31:12.314830 2026] [:error] [pid 1295:tid 1302] [client 147.135.212.200:58408] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agaTgNmMhqLvs0GYixkrhAAAAMQ"]
[Fri May 15 11:31:14.794144 2026] [:error] [pid 51234:tid 51248] [client 147.135.212.200:58414] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agaTgt72N9CbeiqcqgP0dgAAAUw"]
[Fri May 15 11:31:17.263483 2026] [:error] [pid 1190:tid 1261] [client 147.135.212.200:35228] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agaThdqiXrD7hne4gFbUtwAAAIk"]
[Fri May 15 11:31:19.709374 2026] [:error] [pid 1188:tid 1200] [client 147.135.212.200:35230] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agaTh9Y68iW8yuNkNzP6iwAAAAM"]
[Fri May 15 11:31:22.772436 2026] [:error] [pid 51234:tid 51241] [client 147.135.212.200:37518] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agaTit72N9CbeiqcqgP0fAAAAUU"]
[Fri May 15 11:31:26.463962 2026] [:error] [pid 51234:tid 51253] [client 147.135.212.200:45382] [client 147.135.212.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agaTjt72N9CbeiqcqgP0hwAAAVE"]
[Fri May 15 14:16:30.391292 2026] [:error] [pid 30272:tid 30276] [client 150.109.12.46:57052] [client 150.109.12.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aga6Pnvc_jSFaQ_7_weYqwAAAYI"]
[Fri May 15 14:57:01.651165 2026] [proxy_fcgi:error] [pid 30272:tid 30289] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:01.863811 2026] [proxy_fcgi:error] [pid 30272:tid 30274] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:02.076475 2026] [proxy_fcgi:error] [pid 30272:tid 30291] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:02.303648 2026] [proxy_fcgi:error] [pid 30272:tid 30292] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:02.523509 2026] [proxy_fcgi:error] [pid 30272:tid 30296] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:02.780764 2026] [proxy_fcgi:error] [pid 30272:tid 30290] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:03.021529 2026] [proxy_fcgi:error] [pid 30272:tid 30297] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:03.353399 2026] [proxy_fcgi:error] [pid 30272:tid 30275] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:03.584009 2026] [proxy_fcgi:error] [pid 30272:tid 30274] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:03.797602 2026] [proxy_fcgi:error] [pid 30272:tid 30287] [client 20.151.255.144:4368] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:57:04.015972 2026] [:error] [pid 30272:tid 30276] [client 20.151.255.144:4368] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "agbDwHvc_jSFaQ_7_wejZwAAAYI"]
[Fri May 15 14:57:06.865862 2026] [:error] [pid 9392:tid 9408] [client 20.151.255.144:4478] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "agbDwtBWJIjH1U9zGfahoAAAAQ4"]
[Fri May 15 14:57:11.869017 2026] [:error] [pid 30272:tid 30285] [client 20.151.255.144:4432] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "agbDx3vc_jSFaQ_7_wejkQAAAYs"]
[Fri May 15 14:57:15.497649 2026] [:error] [pid 30208:tid 30234] [client 20.151.255.144:52511] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "agbDy5mLMCJujX-JTvgXZgAAAJg"]
[Fri May 15 14:57:18.064157 2026] [:error] [pid 30240:tid 30253] [client 20.151.255.144:4387] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "agbDzq8ckHvaA6bpews_ugAAAUs"]
[Fri May 15 14:57:19.235357 2026] [:error] [pid 30240:tid 30243] [client 20.151.255.144:52501] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "agbDz68ckHvaA6bpews_uwAAAUE"]
[Fri May 15 14:57:20.955105 2026] [:error] [pid 30240:tid 30248] [client 20.151.255.144:46080] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "agbD0K8ckHvaA6bpews_vgAAAUY"]
[Fri May 15 14:57:21.718657 2026] [:error] [pid 9307:tid 9385] [client 20.151.255.144:4415] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "agbD0SC43jY1IRzK5VY_9wAAANQ"]
[Fri May 15 14:57:26.366414 2026] [:error] [pid 30240:tid 30255] [client 20.151.255.144:4422] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "agbD1q8ckHvaA6bpews_vwAAAU0"]
[Fri May 15 14:57:28.897155 2026] [:error] [pid 30272:tid 30292] [client 20.151.255.144:4361] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "agbD2Hvc_jSFaQ_7_wejogAAAZI"]
[Fri May 15 14:57:30.315343 2026] [:error] [pid 30240:tid 30263] [client 20.151.255.144:52486] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "agbD2q8ckHvaA6bpews_wgAAAVU"]
[Fri May 15 14:57:33.297669 2026] [:error] [pid 9304:tid 9310] [client 20.151.255.144:52505] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "agbD3dzcINh7UFIbVoGH0AAAAAA"]
[Fri May 15 14:57:35.321702 2026] [:error] [pid 30272:tid 30278] [client 20.151.255.144:52520] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "agbD33vc_jSFaQ_7_wejrgAAAYQ"]
[Fri May 15 14:57:36.804379 2026] [:error] [pid 9304:tid 9329] [client 20.151.255.144:4414] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "agbD4NzcINh7UFIbVoGH0gAAABM"]
[Fri May 15 14:57:38.186138 2026] [:error] [pid 30240:tid 30256] [client 20.151.255.144:4474] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "agbD4q8ckHvaA6bpews_xwAAAU4"]
[Fri May 15 14:57:39.494685 2026] [:error] [pid 9392:tid 9395] [client 20.151.255.144:52508] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws81.php"] [unique_id "agbD49BWJIjH1U9zGfahvgAAAQE"]
[Fri May 15 14:57:41.069165 2026] [:error] [pid 30208:tid 30231] [client 20.151.255.144:4409] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "agbD5ZmLMCJujX-JTvgXbgAAAJU"]
[Fri May 15 14:57:42.925056 2026] [:error] [pid 30240:tid 30248] [client 20.151.255.144:4374] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "agbD5q8ckHvaA6bpews_zQAAAUY"]
[Fri May 15 14:57:43.863695 2026] [:error] [pid 30272:tid 30283] [client 20.151.255.144:4391] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "agbD53vc_jSFaQ_7_wejsgAAAYk"]
[Fri May 15 14:57:44.588635 2026] [:error] [pid 9304:tid 9334] [client 20.151.255.144:4418] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "agbD6NzcINh7UFIbVoGH1QAAABg"]
[Fri May 15 14:57:45.967824 2026] [:error] [pid 30208:tid 30212] [client 20.151.255.144:4378] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "agbD6ZmLMCJujX-JTvgXcgAAAII"]
[Fri May 15 14:57:49.412974 2026] [:error] [pid 30240:tid 30265] [client 20.151.255.144:4394] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "agbD7a8ckHvaA6bpews_0QAAAVc"]
[Fri May 15 14:57:57.779483 2026] [:error] [pid 9392:tid 9402] [client 20.151.255.144:4471] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "agbD9dBWJIjH1U9zGfahzQAAAQg"]
[Fri May 15 14:57:58.824672 2026] [:error] [pid 30272:tid 30290] [client 20.151.255.144:52499] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "agbD9nvc_jSFaQ_7_wejugAAAZA"]
[Fri May 15 14:58:01.854622 2026] [:error] [pid 30272:tid 30285] [client 20.151.255.144:4353] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "agbD-Xvc_jSFaQ_7_wejwQAAAYs"]
[Fri May 15 14:58:03.949831 2026] [proxy_fcgi:error] [pid 30272:tid 30297] [client 20.151.255.144:4472] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:04.224504 2026] [proxy_fcgi:error] [pid 30272:tid 30278] [client 20.151.255.144:4472] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:04.484712 2026] [proxy_fcgi:error] [pid 30272:tid 30291] [client 20.151.255.144:4472] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:04.756942 2026] [proxy_fcgi:error] [pid 30272:tid 30290] [client 20.151.255.144:4472] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:05.014329 2026] [proxy_fcgi:error] [pid 30272:tid 30295] [client 20.151.255.144:4472] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:05.267973 2026] [:error] [pid 30272:tid 30281] [client 20.151.255.144:4472] [client 20.151.255.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "agbD_Xvc_jSFaQ_7_wejygAAAYc"]
[Fri May 15 14:58:09.302146 2026] [proxy_fcgi:error] [pid 30272:tid 30282] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:09.560888 2026] [proxy_fcgi:error] [pid 30272:tid 30298] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:09.770516 2026] [proxy_fcgi:error] [pid 30272:tid 30297] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:10.365731 2026] [proxy_fcgi:error] [pid 30272:tid 30278] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:10.580408 2026] [proxy_fcgi:error] [pid 30272:tid 30287] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:10.811999 2026] [proxy_fcgi:error] [pid 30272:tid 30291] [client 20.151.255.144:4358] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:58:11.023051 2026] [:error] [pid 30272:tid 30277] [client 20.151.255.144:4358] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "agbEA3vc_jSFaQ_7_wej0wAAAYM"]
[Fri May 15 14:58:13.494398 2026] [:error] [pid 30208:tid 30232] [client 20.151.255.144:52460] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "agbEBZmLMCJujX-JTvgXfgAAAJY"]
[Fri May 15 14:58:17.986654 2026] [:error] [pid 30208:tid 30217] [client 20.151.255.144:52506] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "agbECZmLMCJujX-JTvgXgAAAAIc"]
[Fri May 15 14:58:18.866045 2026] [:error] [pid 9392:tid 9416] [client 20.151.255.144:4426] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "agbECtBWJIjH1U9zGfah2gAAARY"]
[Fri May 15 14:58:22.490477 2026] [:error] [pid 9392:tid 9418] [client 20.151.255.144:52438] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "agbEDtBWJIjH1U9zGfah4AAAARg"]
[Fri May 15 14:58:24.935286 2026] [:error] [pid 30272:tid 30296] [client 20.151.255.144:4441] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "agbEEHvc_jSFaQ_7_wej1gAAAZY"]
[Fri May 15 14:58:25.858762 2026] [:error] [pid 30208:tid 30215] [client 20.151.255.144:4457] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "agbEEZmLMCJujX-JTvgXhAAAAIU"]
[Fri May 15 14:58:34.492662 2026] [:error] [pid 9305:tid 9354] [client 20.151.255.144:52496] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "agbEGt5FZyBmdCM8GsF5zwAAAFA"]
[Fri May 15 14:58:35.809481 2026] [:error] [pid 9392:tid 9411] [client 20.151.255.144:4419] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "agbEG9BWJIjH1U9zGfah4QAAARE"]
[Fri May 15 14:58:41.541450 2026] [:error] [pid 30208:tid 30223] [client 20.151.255.144:52416] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "agbEIZmLMCJujX-JTvgXjwAAAI0"]
[Fri May 15 14:58:43.236769 2026] [:error] [pid 9305:tid 9340] [client 20.151.255.144:4397] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "agbEI95FZyBmdCM8GsF50AAAAEI"]
[Fri May 15 14:58:46.083036 2026] [:error] [pid 30272:tid 30298] [client 20.151.255.144:4465] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "agbEJnvc_jSFaQ_7_wej4gAAAZg"]
[Fri May 15 14:58:52.547913 2026] [:error] [pid 30272:tid 30287] [client 20.151.255.144:4372] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "agbELHvc_jSFaQ_7_wej5gAAAY0"]
[Fri May 15 14:58:54.400770 2026] [:error] [pid 30240:tid 30246] [client 20.151.255.144:52518] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "agbELq8ckHvaA6bpews_5QAAAUQ"]
[Fri May 15 14:58:55.403608 2026] [:error] [pid 9307:tid 9383] [client 20.151.255.144:4377] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "agbELyC43jY1IRzK5VZAJQAAANI"]
[Fri May 15 14:59:02.976064 2026] [:error] [pid 30208:tid 30214] [client 20.151.255.144:4435] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "agbENpmLMCJujX-JTvgXnAAAAIQ"]
[Fri May 15 14:59:14.696421 2026] [proxy_fcgi:error] [pid 9305:tid 9339] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:14.940199 2026] [proxy_fcgi:error] [pid 9305:tid 9353] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:15.183465 2026] [proxy_fcgi:error] [pid 9305:tid 9349] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:15.428460 2026] [proxy_fcgi:error] [pid 9305:tid 9361] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:15.751089 2026] [proxy_fcgi:error] [pid 9305:tid 9338] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:15.995956 2026] [proxy_fcgi:error] [pid 9305:tid 9350] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:16.237917 2026] [proxy_fcgi:error] [pid 9305:tid 9358] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:16.486217 2026] [proxy_fcgi:error] [pid 9305:tid 9342] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:16.736226 2026] [proxy_fcgi:error] [pid 9305:tid 9355] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:17.069607 2026] [proxy_fcgi:error] [pid 9305:tid 9344] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:17.413218 2026] [proxy_fcgi:error] [pid 9305:tid 9340] [client 20.151.255.144:46088] AH01071: Got error 'Primary script unknown'
[Fri May 15 14:59:17.660603 2026] [:error] [pid 9305:tid 9359] [client 20.151.255.144:46088] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agbERd5FZyBmdCM8GsF57wAAAFU"]
[Fri May 15 14:59:19.151079 2026] [:error] [pid 30208:tid 30216] [client 20.151.255.144:4370] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agbER5mLMCJujX-JTvgXpQAAAIY"]
[Fri May 15 14:59:20.455528 2026] [:error] [pid 9392:tid 9416] [client 20.151.255.144:52537] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agbESNBWJIjH1U9zGfah9QAAARY"]
[Fri May 15 14:59:22.708169 2026] [:error] [pid 9305:tid 9361] [client 20.151.255.144:4393] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agbESt5FZyBmdCM8GsF59QAAAFc"]
[Fri May 15 14:59:23.658738 2026] [:error] [pid 30240:tid 30251] [client 20.151.255.144:4475] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "agbES68ckHvaA6bpews_8QAAAUk"]
[Fri May 15 14:59:25.916700 2026] [:error] [pid 30208:tid 30218] [client 20.151.255.144:52528] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "agbETZmLMCJujX-JTvgXrgAAAIg"]
[Fri May 15 14:59:27.724902 2026] [:error] [pid 30240:tid 30256] [client 20.151.255.144:4400] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "agbET68ckHvaA6bpews_-QAAAU4"]
[Fri May 15 14:59:30.586532 2026] [:error] [pid 30208:tid 30226] [client 20.151.255.144:4367] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "agbEUpmLMCJujX-JTvgXtwAAAJA"]
[Fri May 15 14:59:32.431941 2026] [:error] [pid 30208:tid 30225] [client 20.151.255.144:4416] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "agbEVJmLMCJujX-JTvgXuQAAAI8"]
[Fri May 15 14:59:34.783615 2026] [:error] [pid 30208:tid 30219] [client 20.151.255.144:52493] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "agbEVpmLMCJujX-JTvgXugAAAIk"]
[Fri May 15 14:59:37.536457 2026] [:error] [pid 9305:tid 9361] [client 20.151.255.144:52510] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "agbEWd5FZyBmdCM8GsF5_gAAAFc"]
[Fri May 15 14:59:38.720801 2026] [:error] [pid 30208:tid 30232] [client 20.151.255.144:52483] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "agbEWpmLMCJujX-JTvgXwgAAAJY"]
[Fri May 15 14:59:39.613982 2026] [:error] [pid 30240:tid 30257] [client 20.151.255.144:52497] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "agbEW68ckHvaA6bpewtAAgAAAU8"]
[Fri May 15 14:59:43.163044 2026] [:error] [pid 9305:tid 9359] [client 20.151.255.144:46137] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "agbEX95FZyBmdCM8GsF6BgAAAFU"]
[Fri May 15 14:59:44.486494 2026] [:error] [pid 30272:tid 30285] [client 20.151.255.144:4446] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "agbEYHvc_jSFaQ_7_wej_gAAAYs"]
[Fri May 15 14:59:51.517233 2026] [:error] [pid 30272:tid 30275] [client 20.151.255.144:4390] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "agbEZ3vc_jSFaQ_7_wekDgAAAYE"]
[Fri May 15 15:00:00.390739 2026] [:error] [pid 9392:tid 9400] [client 20.151.255.144:52502] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "agbEcNBWJIjH1U9zGfaiCgAAAQY"]
[Fri May 15 15:00:06.946539 2026] [:error] [pid 9392:tid 9403] [client 20.151.255.144:52452] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "agbEdtBWJIjH1U9zGfaiCwAAAQk"]
[Fri May 15 15:00:10.356931 2026] [:error] [pid 30240:tid 30260] [client 20.151.255.144:52488] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "agbEeq8ckHvaA6bpewtACAAAAVI"]
[Fri May 15 15:00:15.875459 2026] [:error] [pid 9307:tid 9374] [client 20.151.255.144:4408] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "agbEfyC43jY1IRzK5VZATwAAAMk"]
[Fri May 15 15:00:19.452089 2026] [proxy_fcgi:error] [pid 30240:tid 30251] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:19.709945 2026] [proxy_fcgi:error] [pid 30240:tid 30266] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:20.007904 2026] [proxy_fcgi:error] [pid 30240:tid 30246] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:20.266248 2026] [proxy_fcgi:error] [pid 30240:tid 30253] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:20.689915 2026] [proxy_fcgi:error] [pid 30240:tid 30243] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:20.949573 2026] [proxy_fcgi:error] [pid 30240:tid 30250] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:21.208656 2026] [proxy_fcgi:error] [pid 30240:tid 30259] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:21.467517 2026] [proxy_fcgi:error] [pid 30240:tid 30260] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:22.048949 2026] [proxy_fcgi:error] [pid 30240:tid 30248] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:22.468107 2026] [proxy_fcgi:error] [pid 30240:tid 30242] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:22.725455 2026] [proxy_fcgi:error] [pid 30240:tid 30254] [client 20.151.255.144:52507] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:00:22.978961 2026] [:error] [pid 30240:tid 30261] [client 20.151.255.144:52507] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "agbEhq8ckHvaA6bpewtAIgAAAVM"]
[Fri May 15 15:00:24.207481 2026] [:error] [pid 30272:tid 30294] [client 20.151.255.144:4444] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "agbEiHvc_jSFaQ_7_wekVQAAAZQ"]
[Fri May 15 15:00:30.908414 2026] [:error] [pid 30272:tid 30277] [client 20.151.255.144:4479] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "agbEjnvc_jSFaQ_7_wekWQAAAYM"]
[Fri May 15 15:00:36.959802 2026] [:error] [pid 30240:tid 30264] [client 20.151.255.144:4356] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "agbElK8ckHvaA6bpewtAJgAAAVY"]
[Fri May 15 15:00:40.503508 2026] [:error] [pid 9392:tid 9407] [client 20.151.255.144:52463] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "agbEmNBWJIjH1U9zGfaiKQAAAQ0"]
[Fri May 15 15:00:44.091068 2026] [:error] [pid 30272:tid 30279] [client 20.151.255.144:52529] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "agbEnHvc_jSFaQ_7_wekYAAAAYU"]
[Fri May 15 15:00:46.052363 2026] [:error] [pid 30272:tid 30284] [client 20.151.255.144:46142] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "agbEnnvc_jSFaQ_7_wekbAAAAYo"]
[Fri May 15 15:00:49.261792 2026] [:error] [pid 9392:tid 9405] [client 20.151.255.144:52482] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "agbEodBWJIjH1U9zGfaiLgAAAQs"]
[Fri May 15 15:00:52.503041 2026] [:error] [pid 30272:tid 30283] [client 20.151.255.144:4470] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "agbEpHvc_jSFaQ_7_wekeQAAAYk"]
[Fri May 15 15:00:56.988722 2026] [:error] [pid 30208:tid 30228] [client 20.151.255.144:4454] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "agbEqJmLMCJujX-JTvgX5QAAAJI"]
[Fri May 15 15:00:57.984257 2026] [:error] [pid 30208:tid 30222] [client 20.151.255.144:4440] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "agbEqZmLMCJujX-JTvgX6QAAAIw"]
[Fri May 15 15:01:07.593355 2026] [:error] [pid 9392:tid 9412] [client 20.151.255.144:52533] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "agbEs9BWJIjH1U9zGfaiVQAAARI"]
[Fri May 15 15:01:11.408586 2026] [:error] [pid 30272:tid 30281] [client 20.151.255.144:52525] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "agbEt3vc_jSFaQ_7_weksgAAAYc"]
[Fri May 15 15:01:15.018993 2026] [:error] [pid 30272:tid 30279] [client 20.151.255.144:4421] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/press.php"] [unique_id "agbEu3vc_jSFaQ_7_wektwAAAYU"]
[Fri May 15 15:01:56.769317 2026] [proxy_fcgi:error] [pid 9307:tid 9387] [client 20.151.255.144:4405] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:58.187809 2026] [proxy_fcgi:error] [pid 9304:tid 9321] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:58.401171 2026] [proxy_fcgi:error] [pid 9304:tid 9331] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:58.625898 2026] [proxy_fcgi:error] [pid 9304:tid 9312] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:58.836066 2026] [proxy_fcgi:error] [pid 9304:tid 9323] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:59.257917 2026] [proxy_fcgi:error] [pid 9304:tid 9317] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:59.469009 2026] [proxy_fcgi:error] [pid 9304:tid 9311] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:01:59.795166 2026] [proxy_fcgi:error] [pid 9304:tid 9329] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:02:00.058221 2026] [proxy_fcgi:error] [pid 9304:tid 9324] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:02:00.269744 2026] [proxy_fcgi:error] [pid 9304:tid 9326] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:02:00.477855 2026] [proxy_fcgi:error] [pid 9304:tid 9316] [client 20.151.255.144:4421] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:02:00.684164 2026] [:error] [pid 9304:tid 9332] [client 20.151.255.144:4421] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "agbE6NzcINh7UFIbVoGIYwAAABY"]
[Fri May 15 15:02:03.708114 2026] [:error] [pid 9392:tid 9400] [client 20.151.255.144:4407] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "agbE69BWJIjH1U9zGfaiaQAAAQY"]
[Fri May 15 15:02:04.787151 2026] [:error] [pid 30272:tid 30295] [client 20.151.255.144:4399] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "agbE7Hvc_jSFaQ_7_wek0gAAAZU"]
[Fri May 15 15:02:09.999308 2026] [:error] [pid 30240:tid 30266] [client 20.151.255.144:4402] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "agbE8a8ckHvaA6bpewtAgwAAAVg"]
[Fri May 15 15:02:20.568709 2026] [:error] [pid 30240:tid 30249] [client 20.151.255.144:4437] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "agbE_K8ckHvaA6bpewtAiwAAAUc"]
[Fri May 15 15:02:21.937072 2026] [:error] [pid 30272:tid 30284] [client 20.151.255.144:52530] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "agbE_Xvc_jSFaQ_7_wek3wAAAYo"]
[Fri May 15 15:02:24.126313 2026] [:error] [pid 9304:tid 9313] [client 20.151.255.144:4413] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "agbFANzcINh7UFIbVoGIagAAAAM"]
[Fri May 15 15:02:25.370522 2026] [:error] [pid 30272:tid 30290] [client 20.151.255.144:52504] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "agbFAXvc_jSFaQ_7_wek5AAAAZA"]
[Fri May 15 15:02:30.321319 2026] [:error] [pid 30272:tid 30279] [client 20.151.255.144:4389] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "agbFBnvc_jSFaQ_7_wek6gAAAYU"]
[Fri May 15 15:02:44.115953 2026] [:error] [pid 30240:tid 30265] [client 20.151.255.144:52417] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "agbFFK8ckHvaA6bpewtAlQAAAVc"]
[Fri May 15 15:02:45.531679 2026] [:error] [pid 30208:tid 30225] [client 20.151.255.144:52484] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "agbFFZmLMCJujX-JTvgYhwAAAI8"]
[Fri May 15 15:02:46.872793 2026] [:error] [pid 30272:tid 30290] [client 20.151.255.144:4411] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "agbFFnvc_jSFaQ_7_wek9AAAAZA"]
[Fri May 15 15:02:48.802149 2026] [:error] [pid 30240:tid 30264] [client 20.151.255.144:52486] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "agbFGK8ckHvaA6bpewtAlwAAAVY"]
[Fri May 15 15:02:54.197149 2026] [:error] [pid 9392:tid 9401] [client 20.151.255.144:46100] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "agbFHtBWJIjH1U9zGfaihwAAAQc"]
[Fri May 15 15:02:55.196861 2026] [:error] [pid 30208:tid 30228] [client 20.151.255.144:52489] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "agbFH5mLMCJujX-JTvgYiAAAAJI"]
[Fri May 15 15:02:56.145228 2026] [:error] [pid 9307:tid 9383] [client 20.151.255.144:4373] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "agbFICC43jY1IRzK5VZAjgAAANI"]
[Fri May 15 15:03:03.225089 2026] [:error] [pid 30272:tid 30296] [client 129.226.146.42:48520] [client 129.226.146.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agbFJ3vc_jSFaQ_7_wek_wAAAZY"]
[Fri May 15 15:03:03.320905 2026] [proxy_fcgi:error] [pid 30208:tid 30214] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:03.536797 2026] [proxy_fcgi:error] [pid 30208:tid 30220] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:03.762319 2026] [proxy_fcgi:error] [pid 30208:tid 30234] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:03.979463 2026] [proxy_fcgi:error] [pid 30208:tid 30213] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:04.190655 2026] [proxy_fcgi:error] [pid 30208:tid 30227] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:04.401166 2026] [proxy_fcgi:error] [pid 30208:tid 30232] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:04.650656 2026] [proxy_fcgi:error] [pid 30208:tid 30217] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:05.043076 2026] [proxy_fcgi:error] [pid 30208:tid 30229] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:05.263037 2026] [proxy_fcgi:error] [pid 30208:tid 30231] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:05.565899 2026] [proxy_fcgi:error] [pid 30208:tid 30226] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:05.790350 2026] [proxy_fcgi:error] [pid 30208:tid 30215] [client 20.151.255.144:52509] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:03:05.996651 2026] [:error] [pid 30208:tid 30233] [client 20.151.255.144:52509] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agbFKZmLMCJujX-JTvgYlwAAAJc"]
[Fri May 15 15:03:09.343795 2026] [:error] [pid 30208:tid 30218] [client 20.151.255.144:4463] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agbFLZmLMCJujX-JTvgYmwAAAIg"]
[Fri May 15 15:03:16.681016 2026] [:error] [pid 30240:tid 30262] [client 20.151.255.144:4474] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agbFNK8ckHvaA6bpewtAngAAAVQ"]
[Fri May 15 15:03:21.049929 2026] [:error] [pid 30240:tid 30265] [client 20.151.255.144:4353] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agbFOa8ckHvaA6bpewtAogAAAVc"]
[Fri May 15 15:03:21.454317 2026] [:error] [pid 30272:tid 30287] [client 20.151.255.144:4419] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "agbFOXvc_jSFaQ_7_welBQAAAY0"]
[Fri May 15 15:03:23.685056 2026] [:error] [pid 30272:tid 30277] [client 20.151.255.144:4447] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "agbFO3vc_jSFaQ_7_welBgAAAYM"]
[Fri May 15 15:03:26.484164 2026] [:error] [pid 30240:tid 30244] [client 20.151.255.144:4448] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "agbFPq8ckHvaA6bpewtAqwAAAUI"]
[Fri May 15 15:03:30.747833 2026] [:error] [pid 9392:tid 9408] [client 20.151.255.144:4371] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "agbFQtBWJIjH1U9zGfaimAAAAQ4"]
[Fri May 15 15:03:36.708493 2026] [:error] [pid 9392:tid 9416] [client 20.151.255.144:52437] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "agbFSNBWJIjH1U9zGfaimgAAARY"]
[Fri May 15 15:03:39.313570 2026] [:error] [pid 9305:tid 9347] [client 20.151.255.144:4449] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "agbFS95FZyBmdCM8GsF6OgAAAEk"]
[Fri May 15 15:03:43.562643 2026] [:error] [pid 30208:tid 30226] [client 20.151.255.144:4379] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "agbFT5mLMCJujX-JTvgYogAAAJA"]
[Fri May 15 15:03:56.966645 2026] [:error] [pid 9392:tid 9405] [client 20.151.255.144:4370] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "agbFXNBWJIjH1U9zGfaipAAAAQs"]
[Fri May 15 15:03:58.736053 2026] [:error] [pid 9307:tid 9369] [client 20.151.255.144:4388] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "agbFXiC43jY1IRzK5VZAnAAAAMQ"]
[Fri May 15 15:04:00.344722 2026] [:error] [pid 9305:tid 9338] [client 20.151.255.144:4453] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "agbFYN5FZyBmdCM8GsF6PgAAAEA"]
[Fri May 15 15:04:01.673772 2026] [:error] [pid 30272:tid 30291] [client 20.151.255.144:52416] [client 20.151.255.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "agbFYXvc_jSFaQ_7_welEwAAAZE"]
[Fri May 15 15:04:05.395587 2026] [proxy_fcgi:error] [pid 9392:tid 9416] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:04:05.607658 2026] [proxy_fcgi:error] [pid 9392:tid 9418] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:04:05.836019 2026] [proxy_fcgi:error] [pid 9392:tid 9399] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:04:06.046700 2026] [proxy_fcgi:error] [pid 9392:tid 9400] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:04:06.261024 2026] [proxy_fcgi:error] [pid 9392:tid 9406] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 15:04:06.805082 2026] [proxy_fcgi:error] [pid 9392:tid 9398] [client 20.151.255.144:4416] AH01071: Got error 'Primary script unknown'
[Fri May 15 16:31:04.677927 2026] [:error] [pid 30272:tid 30282] [client 51.77.218.191:56604] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agbZyHvc_jSFaQ_7_we-swAAAYg"]
[Fri May 15 16:31:06.603747 2026] [:error] [pid 9392:tid 9403] [client 51.77.218.191:56280] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agbZytBWJIjH1U9zGfa1ygAAAQk"]
[Fri May 15 16:31:08.624513 2026] [:error] [pid 30272:tid 30281] [client 51.77.218.191:56294] [client 51.77.218.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agbZzHvc_jSFaQ_7_we-tQAAAYc"]
[Fri May 15 18:39:47.670018 2026] [:error] [pid 30240:tid 30259] [client 129.211.172.249:34434] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agb3868ckHvaA6bpewtcSgAAAVE"]
[Fri May 15 19:50:15.932058 2026] [:error] [pid 9307:tid 9372] [client 43.159.139.164:53288] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agcIdyC43jY1IRzK5VZXnAAAAMc"]
[Fri May 15 22:07:06.329542 2026] [:error] [pid 30272:tid 30277] [client 118.45.231.52:40386] [client 118.45.231.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.45.231.52, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "agcoinvc_jSFaQ_7_wcAaAAAAYM"]
[Fri May 15 22:07:06.340064 2026] [proxy_fcgi:error] [pid 30272:tid 30277] [client 118.45.231.52:40386] AH01071: Got error 'Primary script unknown'
[Fri May 15 22:07:07.526698 2026] [proxy_fcgi:error] [pid 30272:tid 30297] [client 118.45.231.52:40390] AH01071: Got error 'Primary script unknown'
[Fri May 15 22:41:45.089102 2026] [:error] [pid 30208:tid 30227] [client 145.239.71.147:34122] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agcwqZmLMCJujX-JTvhAzgAAAJE"]
[Fri May 15 22:41:46.915296 2026] [:error] [pid 9307:tid 9383] [client 145.239.71.147:35410] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agcwqiC43jY1IRzK5VZigAAAANI"]
[Fri May 15 22:41:48.930041 2026] [:error] [pid 9305:tid 9354] [client 145.239.71.147:35418] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agcwrN5FZyBmdCM8GsGWsQAAAFA"]
[Fri May 15 22:41:50.885809 2026] [:error] [pid 30208:tid 30222] [client 145.239.71.147:35430] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agcwrpmLMCJujX-JTvhA1QAAAIw"]
[Fri May 15 22:41:52.752875 2026] [:error] [pid 9305:tid 9361] [client 145.239.71.147:35438] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agcwsN5FZyBmdCM8GsGWtQAAAFc"]
[Fri May 15 22:41:54.811576 2026] [:error] [pid 9307:tid 9376] [client 145.239.71.147:35450] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agcwsiC43jY1IRzK5VZigQAAAMs"]
[Fri May 15 22:41:56.668781 2026] [:error] [pid 30208:tid 30230] [client 145.239.71.147:56732] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agcwtJmLMCJujX-JTvhA2QAAAJQ"]
[Fri May 15 22:41:58.691276 2026] [:error] [pid 9305:tid 9351] [client 145.239.71.147:56744] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agcwtt5FZyBmdCM8GsGWvwAAAE0"]
[Fri May 15 22:42:00.707145 2026] [:error] [pid 9304:tid 9310] [client 145.239.71.147:56750] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agcwuNzcINh7UFIbVoGh0AAAAAA"]
[Fri May 15 22:42:02.572531 2026] [:error] [pid 9305:tid 9339] [client 145.239.71.147:56756] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agcwut5FZyBmdCM8GsGWwgAAAEE"]
[Fri May 15 22:42:04.585215 2026] [:error] [pid 30240:tid 30265] [client 145.239.71.147:56768] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agcwvK8ckHvaA6bpewt0IgAAAVc"]
[Fri May 15 22:42:06.592219 2026] [:error] [pid 30208:tid 30224] [client 145.239.71.147:56776] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agcwvpmLMCJujX-JTvhA3QAAAI4"]
[Fri May 15 22:42:08.594112 2026] [:error] [pid 30208:tid 30211] [client 145.239.71.147:44434] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agcwwJmLMCJujX-JTvhA4gAAAIE"]
[Fri May 15 22:42:10.586106 2026] [:error] [pid 9307:tid 9375] [client 145.239.71.147:44444] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agcwwiC43jY1IRzK5VZigwAAAMo"]
[Fri May 15 22:42:12.570562 2026] [:error] [pid 30208:tid 30226] [client 145.239.71.147:44458] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agcwxJmLMCJujX-JTvhA5gAAAJA"]
[Fri May 15 22:42:14.433304 2026] [:error] [pid 30272:tid 30285] [client 145.239.71.147:44470] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agcwxnvc_jSFaQ_7_wcG8gAAAYs"]
[Fri May 15 22:42:16.452931 2026] [:error] [pid 9392:tid 9394] [client 145.239.71.147:44474] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agcwyNBWJIjH1U9zGfbnmQAAAQA"]
[Fri May 15 22:42:18.453171 2026] [:error] [pid 9305:tid 9339] [client 145.239.71.147:48400] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agcwyt5FZyBmdCM8GsGW5AAAAEE"]
[Fri May 15 22:42:20.458990 2026] [:error] [pid 30208:tid 30229] [client 145.239.71.147:48410] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agcwzJmLMCJujX-JTvhA6wAAAJM"]
[Fri May 15 22:42:22.448004 2026] [:error] [pid 9307:tid 9384] [client 145.239.71.147:48426] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agcwziC43jY1IRzK5VZiiAAAANM"]
[Fri May 15 22:42:24.439611 2026] [:error] [pid 9392:tid 9410] [client 145.239.71.147:48438] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agcw0NBWJIjH1U9zGfbnnwAAARA"]
[Fri May 15 22:42:26.451324 2026] [:error] [pid 9392:tid 9396] [client 145.239.71.147:48452] [client 145.239.71.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agcw0tBWJIjH1U9zGfbnpQAAAQI"]
[Fri May 15 23:18:48.455988 2026] [proxy_fcgi:error] [pid 9392:tid 9418] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:48.668412 2026] [proxy_fcgi:error] [pid 9392:tid 9399] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:49.104115 2026] [proxy_fcgi:error] [pid 9392:tid 9409] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:49.328422 2026] [proxy_fcgi:error] [pid 9392:tid 9402] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:49.754442 2026] [proxy_fcgi:error] [pid 9392:tid 9397] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:49.967032 2026] [proxy_fcgi:error] [pid 9392:tid 9415] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:50.179610 2026] [proxy_fcgi:error] [pid 9392:tid 9406] [client 20.104.221.52:24997] AH01071: Got error 'Primary script unknown'
[Fri May 15 23:18:50.600771 2026] [:error] [pid 9392:tid 9410] [client 20.104.221.52:24997] [client 20.104.221.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agc5WtBWJIjH1U9zGfbsOwAAARA"]
[Fri May 15 23:18:51.445044 2026] [:error] [pid 9305:tid 9340] [client 20.104.221.52:10381] [client 20.104.221.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agc5W95FZyBmdCM8GsGZMwAAAEI"]
[Fri May 15 23:18:52.307199 2026] [:error] [pid 30208:tid 30220] [client 20.104.221.52:25799] [client 20.104.221.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agc5XJmLMCJujX-JTvhD-gAAAIo"]
[Fri May 15 23:18:53.158422 2026] [:error] [pid 9304:tid 9317] [client 20.104.221.52:28342] [client 20.104.221.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agc5XdzcINh7UFIbVoGjrQAAAAc"]
[Fri May 15 23:36:35.442923 2026] [:error] [pid 30240:tid 30259] [client 195.201.199.99:55450] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agc9g68ckHvaA6bpewt6eQAAAVE"]
[Fri May 15 23:36:38.447658 2026] [:error] [pid 30240:tid 30256] [client 195.201.199.99:54424] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agc9hq8ckHvaA6bpewt6egAAAU4"]
[Fri May 15 23:36:41.913730 2026] [:error] [pid 30240:tid 30247] [client 195.201.199.99:55650] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agc9ia8ckHvaA6bpewt6fQAAAUU"]
[Fri May 15 23:36:46.196570 2026] [:error] [pid 9392:tid 9407] [client 195.201.199.99:57186] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agc9jtBWJIjH1U9zGfbv_QAAAQ0"]
[Fri May 15 23:36:50.042929 2026] [:error] [pid 9304:tid 9333] [client 195.201.199.99:58826] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agc9ktzcINh7UFIbVoGkZwAAABc"]
[Fri May 15 23:36:53.833901 2026] [:error] [pid 9392:tid 9413] [client 195.201.199.99:60282] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agc9ldBWJIjH1U9zGfbwAwAAARM"]
[Fri May 15 23:36:57.095740 2026] [:error] [pid 9392:tid 9404] [client 195.201.199.99:35618] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agc9mdBWJIjH1U9zGfbwCgAAAQo"]
[Fri May 15 23:37:01.006287 2026] [:error] [pid 30240:tid 30251] [client 195.201.199.99:34952] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agc9na8ckHvaA6bpewt6gQAAAUk"]
[Fri May 15 23:37:04.430040 2026] [:error] [pid 9392:tid 9402] [client 195.201.199.99:38448] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agc9oNBWJIjH1U9zGfbwDQAAAQg"]
[Fri May 15 23:37:07.721377 2026] [:error] [pid 30240:tid 30264] [client 195.201.199.99:39738] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agc9o68ckHvaA6bpewt6hQAAAVY"]
[Fri May 15 23:37:11.578115 2026] [:error] [pid 9392:tid 9404] [client 195.201.199.99:38880] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agc9p9BWJIjH1U9zGfbwEwAAAQo"]
[Fri May 15 23:37:14.792770 2026] [:error] [pid 30272:tid 30283] [client 195.201.199.99:42306] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agc9qnvc_jSFaQ_7_wcRiAAAAYk"]
[Fri May 15 23:37:18.171062 2026] [:error] [pid 9392:tid 9402] [client 195.201.199.99:41314] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agc9rtBWJIjH1U9zGfbwGAAAAQg"]
[Fri May 15 23:37:21.786817 2026] [:error] [pid 30272:tid 30296] [client 195.201.199.99:42524] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agc9sXvc_jSFaQ_7_wcRjgAAAZY"]
[Fri May 15 23:37:25.125530 2026] [:error] [pid 30208:tid 30214] [client 195.201.199.99:43754] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agc9tZmLMCJujX-JTvhFsQAAAIQ"]
[Fri May 15 23:37:28.291023 2026] [:error] [pid 30240:tid 30255] [client 195.201.199.99:44770] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agc9uK8ckHvaA6bpewt6hwAAAU0"]
[Fri May 15 23:38:02.131224 2026] [:error] [pid 30208:tid 30226] [client 195.201.199.99:58460] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agc92pmLMCJujX-JTvhFygAAAJA"]
[Fri May 15 23:38:04.790168 2026] [:error] [pid 9307:tid 9372] [client 195.201.199.99:60242] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agc93CC43jY1IRzK5VZm9QAAAMc"]
[Fri May 15 23:38:08.094680 2026] [:error] [pid 30272:tid 30277] [client 195.201.199.99:33184] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agc94Hvc_jSFaQ_7_wcRrwAAAYM"]
[Fri May 15 23:38:10.471603 2026] [:error] [pid 30272:tid 30285] [client 195.201.199.99:33940] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agc94nvc_jSFaQ_7_wcRtAAAAYs"]
[Fri May 15 23:38:13.015999 2026] [:error] [pid 9304:tid 9311] [client 195.201.199.99:60958] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agc95dzcINh7UFIbVoGkdgAAAAE"]
[Fri May 15 23:38:15.428146 2026] [:error] [pid 9304:tid 9318] [client 195.201.199.99:35680] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agc959zcINh7UFIbVoGkeAAAAAg"]
[Fri May 15 23:38:17.942748 2026] [:error] [pid 9307:tid 9385] [client 195.201.199.99:36532] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agc96SC43jY1IRzK5VZm-gAAANQ"]
[Fri May 15 23:38:21.598417 2026] [:error] [pid 30272:tid 30285] [client 195.201.199.99:35538] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agc97Xvc_jSFaQ_7_wcRwgAAAYs"]
[Fri May 15 23:38:24.583909 2026] [:error] [pid 9304:tid 9312] [client 195.201.199.99:36522] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agc98NzcINh7UFIbVoGkhAAAAAI"]
[Fri May 15 23:38:27.708864 2026] [:error] [pid 9304:tid 9322] [client 195.201.199.99:37552] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agc989zcINh7UFIbVoGkigAAAAw"]
[Fri May 15 23:38:34.476097 2026] [:error] [pid 9307:tid 9387] [client 195.201.199.99:41898] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agc9-iC43jY1IRzK5VZnAAAAANY"]
[Fri May 15 23:38:38.383108 2026] [:error] [pid 9305:tid 9358] [client 195.201.199.99:43196] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agc9_t5FZyBmdCM8GsGa2QAAAFQ"]
[Fri May 15 23:43:14.436763 2026] [:error] [pid 30272:tid 30283] [client 129.226.217.17:49572] [client 129.226.217.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agc_Envc_jSFaQ_7_wcSuQAAAYk"]
[Sat May 16 00:25:59.730323 2026] [:error] [pid 9305:tid 9362] [client 49.51.233.95:59208] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agdJF95FZyBmdCM8GsGemQAAAFg"]
[Sat May 16 00:47:32.794137 2026] [:error] [pid 9304:tid 9326] [client 40.65.144.153:1773] [client 40.65.144.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "agdOJNzcINh7UFIbVoGpTAAAABA"]
[Sat May 16 00:47:33.157130 2026] [:error] [pid 9305:tid 9362] [client 40.65.144.153:1753] [client 40.65.144.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "agdOJd5FZyBmdCM8GsGflwAAAFg"]
[Sat May 16 00:47:33.573067 2026] [:error] [pid 30272:tid 30276] [client 40.65.144.153:1215] [client 40.65.144.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "agdOJXvc_jSFaQ_7_wcf5wAAAYI"]
[Sat May 16 00:47:33.996657 2026] [:error] [pid 30272:tid 30274] [client 40.65.144.153:1185] [client 40.65.144.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "agdOJXvc_jSFaQ_7_wcf6AAAAYA"]
[Sat May 16 01:59:22.767609 2026] [:error] [pid 30272:tid 30296] [client 158.173.67.46:42535] [client 158.173.67.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.46, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agde-nvc_jSFaQ_7_wcvTQAAAZY"]
[Sat May 16 01:59:22.777457 2026] [proxy_fcgi:error] [pid 30272:tid 30296] [client 158.173.67.46:42535] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:26.421295 2026] [proxy_fcgi:error] [pid 30208:tid 30219] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:26.736388 2026] [proxy_fcgi:error] [pid 30208:tid 30223] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:27.363470 2026] [proxy_fcgi:error] [pid 30208:tid 30228] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:27.677288 2026] [proxy_fcgi:error] [pid 30208:tid 30216] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:28.303405 2026] [proxy_fcgi:error] [pid 30208:tid 30215] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:28.615987 2026] [proxy_fcgi:error] [pid 30208:tid 30214] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:28.928939 2026] [proxy_fcgi:error] [pid 30208:tid 30218] [client 20.206.123.16:13640] AH01071: Got error 'Primary script unknown'
[Sat May 16 02:25:29.561055 2026] [:error] [pid 30208:tid 30230] [client 20.206.123.16:13640] [client 20.206.123.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agdlGZmLMCJujX-JTvhVuAAAAJQ"]
[Sat May 16 02:25:30.838311 2026] [:error] [pid 59202:tid 59236] [client 20.206.123.16:13450] [client 20.206.123.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agdlGkORbjeqf1CKQ2KEEgAAAhg"]
[Sat May 16 02:25:32.123713 2026] [:error] [pid 59311:tid 59326] [client 20.206.123.16:13505] [client 20.206.123.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agdlHLGBV7OkryAk5AOa2QAAAos"]
[Sat May 16 02:25:33.429025 2026] [:error] [pid 59453:tid 59480] [client 20.206.123.16:13451] [client 20.206.123.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "agdlHXnXIIDivY9RkF0rXQAAA1E"]
[Sat May 16 02:45:24.110983 2026] [proxy_fcgi:error] [pid 59517:tid 59545] [client 91.92.241.188:40156] AH01071: Got error 'Primary script unknown'
[Sat May 16 04:54:13.045137 2026] [:error] [pid 24874:tid 24952] [client 93.123.109.79:62136] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ageH9ciii6x3XidYGHGQkQAAAJE"]
[Sat May 16 04:54:14.016118 2026] [:error] [pid 24979:tid 24984] [client 93.123.109.79:62136] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/HEAD"] [unique_id "ageH9rvSFUQiwLaOL2oczgAAAMM"]
[Sat May 16 06:51:13.712969 2026] [:error] [pid 5602:tid 5613] [client 42.200.231.39:13727] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agejYdzTTsu77r3UIsnJugAAAQk"]
[Sat May 16 06:51:19.938556 2026] [:error] [pid 24869:tid 24908] [client 42.200.231.39:41141] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agejZ-xo3FMprMltYl4ENwAAAEA"]
[Sat May 16 06:51:23.989062 2026] [:error] [pid 24867:tid 24884] [client 42.200.231.39:63442] [client 42.200.231.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agejayDgFLCgyKq-zmbwIwAAAAM"]
[Sat May 16 06:58:03.231219 2026] [:error] [pid 5602:tid 5619] [client 54.37.252.131:35980] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agek-9zTTsu77r3UIsnLywAAAQ8"]
[Sat May 16 06:58:05.005803 2026] [:error] [pid 24869:tid 24916] [client 54.37.252.131:36138] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agek_exo3FMprMltYl4FWwAAAEg"]
[Sat May 16 06:58:06.829474 2026] [:error] [pid 24869:tid 24909] [client 54.37.252.131:36150] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agek_uxo3FMprMltYl4FYQAAAEE"]
[Sat May 16 06:58:09.250159 2026] [:error] [pid 5602:tid 5613] [client 54.37.252.131:36338] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agelAdzTTsu77r3UIsnL4AAAAQk"]
[Sat May 16 06:58:11.775644 2026] [:error] [pid 24867:tid 24882] [client 54.37.252.131:36352] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agelAyDgFLCgyKq-zmbxDgAAAAE"]
[Sat May 16 06:58:13.680576 2026] [:error] [pid 5602:tid 5606] [client 54.37.252.131:36166] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agelBdzTTsu77r3UIsnL5AAAAQI"]
[Sat May 16 06:58:16.099411 2026] [:error] [pid 24979:tid 24994] [client 54.37.252.131:39366] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agelCLvSFUQiwLaOL2o1JgAAAM0"]
[Sat May 16 06:58:18.132797 2026] [:error] [pid 5602:tid 5621] [client 54.37.252.131:33858] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agelCtzTTsu77r3UIsnL8AAAARE"]
[Sat May 16 06:58:20.537296 2026] [:error] [pid 24874:tid 24945] [client 54.37.252.131:39380] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agelDMiii6x3XidYGHGjSgAAAIo"]
[Sat May 16 06:58:22.425111 2026] [:error] [pid 24979:tid 24992] [client 54.37.252.131:33860] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agelDrvSFUQiwLaOL2o1OgAAAMs"]
[Sat May 16 06:58:24.975701 2026] [:error] [pid 24979:tid 24985] [client 54.37.252.131:39390] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agelELvSFUQiwLaOL2o1RgAAAMQ"]
[Sat May 16 06:58:27.477751 2026] [:error] [pid 5602:tid 5619] [client 54.37.252.131:39690] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agelE9zTTsu77r3UIsnL_QAAAQ8"]
[Sat May 16 06:58:29.921496 2026] [:error] [pid 5602:tid 5609] [client 54.37.252.131:39702] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agelFdzTTsu77r3UIsnMBQAAAQU"]
[Sat May 16 06:58:32.287939 2026] [:error] [pid 24869:tid 24908] [client 54.37.252.131:39712] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agelGOxo3FMprMltYl4FfwAAAEA"]
[Sat May 16 06:58:34.684155 2026] [:error] [pid 24867:tid 24902] [client 54.37.252.131:39722] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agelGiDgFLCgyKq-zmbxIgAAABU"]
[Sat May 16 06:58:36.525594 2026] [:error] [pid 24874:tid 24935] [client 54.37.252.131:36832] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agelHMiii6x3XidYGHGjXgAAAIA"]
[Sat May 16 06:58:39.134580 2026] [:error] [pid 5602:tid 5615] [client 54.37.252.131:52636] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agelH9zTTsu77r3UIsnMGQAAAQs"]
[Sat May 16 06:58:41.678743 2026] [:error] [pid 5602:tid 5627] [client 54.37.252.131:52638] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agelIdzTTsu77r3UIsnMHgAAARc"]
[Sat May 16 06:58:44.072906 2026] [:error] [pid 24874:tid 24952] [client 54.37.252.131:52654] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agelJMiii6x3XidYGHGjaQAAAJE"]
[Sat May 16 06:58:46.622156 2026] [:error] [pid 24874:tid 24948] [client 54.37.252.131:52290] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agelJsiii6x3XidYGHGjbwAAAI0"]
[Sat May 16 06:58:49.136280 2026] [:error] [pid 5602:tid 5615] [client 54.37.252.131:52292] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agelKdzTTsu77r3UIsnMMQAAAQs"]
[Sat May 16 06:58:51.553345 2026] [:error] [pid 24867:tid 24895] [client 54.37.252.131:52296] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agelKyDgFLCgyKq-zmbxMgAAAA4"]
[Sat May 16 06:58:53.467859 2026] [:error] [pid 5602:tid 5615] [client 54.37.252.131:45352] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agelLdzTTsu77r3UIsnMOAAAAQs"]
[Sat May 16 06:58:55.968807 2026] [:error] [pid 5602:tid 5606] [client 54.37.252.131:34866] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agelL9zTTsu77r3UIsnMQAAAAQI"]
[Sat May 16 06:58:58.494530 2026] [:error] [pid 24869:tid 24913] [client 54.37.252.131:34868] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agelMuxo3FMprMltYl4FoQAAAEU"]
[Sat May 16 06:59:21.557908 2026] [:error] [pid 24979:tid 25003] [client 54.37.252.131:39438] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agelSbvSFUQiwLaOL2o1ogAAANY"]
[Sat May 16 06:59:24.008284 2026] [:error] [pid 24867:tid 24891] [client 54.37.252.131:40906] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agelTCDgFLCgyKq-zmbxSgAAAAo"]
[Sat May 16 06:59:26.530981 2026] [:error] [pid 24979:tid 25002] [client 54.37.252.131:42152] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agelTrvSFUQiwLaOL2o1tQAAANU"]
[Sat May 16 06:59:28.570425 2026] [:error] [pid 24979:tid 25003] [client 54.37.252.131:58798] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agelULvSFUQiwLaOL2o1uQAAANY"]
[Sat May 16 06:59:31.100206 2026] [:error] [pid 24874:tid 24945] [client 54.37.252.131:42158] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agelU8iii6x3XidYGHGjlwAAAIo"]
[Sat May 16 06:59:32.956545 2026] [:error] [pid 5602:tid 5610] [client 54.37.252.131:58814] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agelVNzTTsu77r3UIsnMdwAAAQY"]
[Sat May 16 06:59:35.489937 2026] [:error] [pid 24869:tid 24931] [client 54.37.252.131:48766] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agelV-xo3FMprMltYl4FxQAAAFc"]
[Sat May 16 06:59:37.991828 2026] [:error] [pid 5602:tid 5625] [client 54.37.252.131:48776] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agelWdzTTsu77r3UIsnMggAAARU"]
[Sat May 16 06:59:40.544366 2026] [:error] [pid 24867:tid 24900] [client 54.37.252.131:48782] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agelXCDgFLCgyKq-zmbxTgAAABM"]
[Sat May 16 06:59:42.557620 2026] [:error] [pid 5602:tid 5626] [client 54.37.252.131:39394] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agelXtzTTsu77r3UIsnMiAAAARY"]
[Sat May 16 06:59:45.056356 2026] [:error] [pid 24869:tid 24917] [client 54.37.252.131:48784] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agelYexo3FMprMltYl4F0wAAAEk"]
[Sat May 16 06:59:47.051953 2026] [:error] [pid 24979:tid 24995] [client 54.37.252.131:33136] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agelY7vSFUQiwLaOL2o1zAAAAM4"]
[Sat May 16 06:59:49.547370 2026] [:error] [pid 24874:tid 24946] [client 54.37.252.131:33110] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agelZciii6x3XidYGHGjrwAAAIs"]
[Sat May 16 06:59:51.558658 2026] [:error] [pid 5602:tid 5621] [client 54.37.252.131:33142] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agelZ9zTTsu77r3UIsnMnQAAARE"]
[Sat May 16 06:59:54.062469 2026] [:error] [pid 5602:tid 5624] [client 54.37.252.131:33120] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agelatzTTsu77r3UIsnMpgAAARQ"]
[Sat May 16 06:59:56.095287 2026] [:error] [pid 5602:tid 5622] [client 54.37.252.131:37076] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agelbNzTTsu77r3UIsnMsAAAARI"]
[Sat May 16 06:59:58.610056 2026] [:error] [pid 24979:tid 25002] [client 54.37.252.131:39308] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agelbrvSFUQiwLaOL2o11AAAANU"]
[Sat May 16 07:00:00.596093 2026] [:error] [pid 5602:tid 5617] [client 54.37.252.131:37082] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agelcNzTTsu77r3UIsnMvQAAAQ0"]
[Sat May 16 07:00:03.128945 2026] [:error] [pid 5602:tid 5609] [client 54.37.252.131:39314] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agelc9zTTsu77r3UIsnMwgAAAQU"]
[Sat May 16 07:00:05.003031 2026] [:error] [pid 24979:tid 24993] [client 54.37.252.131:47376] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ageldbvSFUQiwLaOL2o13gAAAMw"]
[Sat May 16 07:00:07.495559 2026] [:error] [pid 24874:tid 24944] [client 54.37.252.131:57486] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ageld8iii6x3XidYGHGjuQAAAIk"]
[Sat May 16 07:00:09.495823 2026] [:error] [pid 5602:tid 5624] [client 54.37.252.131:47386] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ageledzTTsu77r3UIsnMzwAAARQ"]
[Sat May 16 07:00:12.009562 2026] [:error] [pid 24874:tid 24950] [client 54.37.252.131:57502] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agelfMiii6x3XidYGHGjwAAAAI8"]
[Sat May 16 07:00:14.487673 2026] [:error] [pid 24869:tid 24912] [client 54.37.252.131:57506] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agelfuxo3FMprMltYl4F4gAAAEQ"]
[Sat May 16 07:00:16.845997 2026] [:error] [pid 24869:tid 24911] [client 54.37.252.131:50388] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agelgOxo3FMprMltYl4F6AAAAEM"]
[Sat May 16 07:00:38.385230 2026] [:error] [pid 24874:tid 24941] [client 54.37.252.131:50396] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agellsiii6x3XidYGHGkDQAAAIY"]
[Sat May 16 07:00:40.830133 2026] [:error] [pid 24874:tid 24945] [client 54.37.252.131:45446] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agelmMiii6x3XidYGHGkEwAAAIo"]
[Sat May 16 07:00:43.308159 2026] [:error] [pid 24979:tid 25005] [client 54.37.252.131:45456] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agelm7vSFUQiwLaOL2o2EgAAANg"]
[Sat May 16 07:00:45.626405 2026] [:error] [pid 5602:tid 5606] [client 54.37.252.131:37276] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agelndzTTsu77r3UIsnNIgAAAQI"]
[Sat May 16 07:00:48.129696 2026] [:error] [pid 24869:tid 24920] [client 54.37.252.131:37280] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ageloOxo3FMprMltYl4GGwAAAEw"]
[Sat May 16 07:00:49.966532 2026] [:error] [pid 24874:tid 24955] [client 54.37.252.131:56402] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agelociii6x3XidYGHGkHAAAAJQ"]
[Sat May 16 07:00:52.475492 2026] [:error] [pid 24869:tid 24912] [client 54.37.252.131:37294] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agelpOxo3FMprMltYl4GHQAAAEQ"]
[Sat May 16 07:00:54.926278 2026] [:error] [pid 24874:tid 24940] [client 54.37.252.131:37308] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agelpsiii6x3XidYGHGkJwAAAIU"]
[Sat May 16 07:00:57.406397 2026] [:error] [pid 24874:tid 24959] [client 54.37.252.131:50930] [client 54.37.252.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agelqciii6x3XidYGHGkLwAAAJg"]
[Sat May 16 07:12:30.544824 2026] [autoindex:error] [pid 5602:tid 5619] [client 40.81.226.252:63898] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat May 16 08:44:44.091530 2026] [:error] [pid 24869:tid 24931] [client 129.226.151.24:59612] [client 129.226.151.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "age9_Oxo3FMprMltYl4TigAAAFc"]
[Sat May 16 08:49:03.575116 2026] [:error] [pid 24874:tid 24938] [client 51.75.119.161:36806] [client 51.75.119.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "age-_8iii6x3XidYGHG3LAAAAIM"]
[Sat May 16 08:49:05.880672 2026] [:error] [pid 24867:tid 24899] [client 51.75.119.161:52314] [client 51.75.119.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "age_ASDgFLCgyKq-zmb-bgAAABI"]
[Sat May 16 09:44:55.602843 2026] [:error] [pid 24874:tid 24952] [client 157.10.109.70:50220] [client 157.10.109.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "agfMF8iii6x3XidYGHHALgAAAJE"]
[Sat May 16 09:44:55.848938 2026] [:error] [pid 24869:tid 24911] [client 157.10.109.70:60285] [client 157.10.109.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "agfMF-xo3FMprMltYl4cZwAAAEM"], referer: http://switchcreative.net
[Sat May 16 10:00:44.983741 2026] [:error] [pid 24979:tid 24994] [client 51.77.43.170:34926] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agfPzLvSFUQiwLaOL2pbZQAAAM0"]
[Sat May 16 10:00:46.156443 2026] [:error] [pid 24867:tid 24890] [client 51.77.43.170:34914] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agfPziDgFLCgyKq-zmYF9AAAAAk"]
[Sat May 16 10:00:46.628894 2026] [:error] [pid 24979:tid 25003] [client 51.77.43.170:34940] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agfPzrvSFUQiwLaOL2pbbAAAANY"]
[Sat May 16 10:00:47.236866 2026] [:error] [pid 24869:tid 24932] [client 51.77.43.170:60946] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agfPz-xo3FMprMltYl4dzwAAAFg"]
[Sat May 16 10:00:49.084702 2026] [:error] [pid 5602:tid 5624] [client 51.77.43.170:60950] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agfP0dzTTsu77r3UIskE3wAAARQ"]
[Sat May 16 10:00:49.546697 2026] [:error] [pid 24874:tid 24948] [client 51.77.43.170:60966] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agfP0ciii6x3XidYGHHB3AAAAI0"]
[Sat May 16 10:00:50.361333 2026] [:error] [pid 24874:tid 24936] [client 51.77.43.170:60974] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agfP0siii6x3XidYGHHB3gAAAIE"]
[Sat May 16 10:00:51.050494 2026] [:error] [pid 24867:tid 24900] [client 51.77.43.170:60982] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agfP0yDgFLCgyKq-zmYF9gAAABM"]
[Sat May 16 10:00:51.639788 2026] [:error] [pid 24869:tid 24922] [client 51.77.43.170:60996] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agfP0-xo3FMprMltYl4d0gAAAE4"]
[Sat May 16 10:00:52.968294 2026] [:error] [pid 5602:tid 5614] [client 51.77.43.170:32768] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agfP1NzTTsu77r3UIskE4gAAAQo"]
[Sat May 16 10:00:53.627183 2026] [:error] [pid 5602:tid 5610] [client 51.77.43.170:32780] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agfP1dzTTsu77r3UIskE4wAAAQY"]
[Sat May 16 10:00:53.852145 2026] [:error] [pid 5602:tid 5622] [client 51.77.43.170:32794] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agfP1dzTTsu77r3UIskE5AAAARI"]
[Sat May 16 10:00:54.870795 2026] [:error] [pid 24867:tid 24893] [client 51.77.43.170:32798] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agfP1iDgFLCgyKq-zmYF-QAAAAw"]
[Sat May 16 10:00:55.827216 2026] [:error] [pid 5602:tid 5625] [client 51.77.43.170:32800] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agfP19zTTsu77r3UIskE6AAAARU"]
[Sat May 16 10:00:56.349778 2026] [:error] [pid 5602:tid 5616] [client 51.77.43.170:32810] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agfP2NzTTsu77r3UIskE6QAAAQw"]
[Sat May 16 10:00:57.031789 2026] [:error] [pid 24869:tid 24919] [client 51.77.43.170:37926] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agfP2exo3FMprMltYl4d1QAAAEs"]
[Sat May 16 10:00:57.896258 2026] [:error] [pid 24867:tid 24894] [client 51.77.43.170:37934] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agfP2SDgFLCgyKq-zmYF_AAAAA0"]
[Sat May 16 10:00:58.782434 2026] [:error] [pid 24979:tid 25000] [client 51.77.43.170:37936] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agfP2rvSFUQiwLaOL2pbfAAAANM"]
[Sat May 16 10:00:59.095543 2026] [:error] [pid 24979:tid 24989] [client 51.77.43.170:37946] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agfP27vSFUQiwLaOL2pbfgAAAMg"]
[Sat May 16 10:00:59.930878 2026] [:error] [pid 5602:tid 5621] [client 51.77.43.170:37962] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agfP29zTTsu77r3UIskE7QAAARE"]
[Sat May 16 10:01:01.000919 2026] [:error] [pid 5602:tid 5605] [client 51.77.43.170:37970] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agfP3NzTTsu77r3UIskE7wAAAQE"]
[Sat May 16 10:01:01.243431 2026] [:error] [pid 24869:tid 24926] [client 51.77.43.170:37974] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agfP3exo3FMprMltYl4d2AAAAFI"]
[Sat May 16 10:01:01.917637 2026] [:error] [pid 24869:tid 24913] [client 51.77.43.170:37976] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agfP3exo3FMprMltYl4d2QAAAEU"]
[Sat May 16 10:01:03.566199 2026] [:error] [pid 24869:tid 24927] [client 51.77.43.170:37986] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agfP3-xo3FMprMltYl4d2gAAAFM"]
[Sat May 16 10:01:03.801248 2026] [:error] [pid 24869:tid 24932] [client 51.77.43.170:37996] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agfP3-xo3FMprMltYl4d2wAAAFg"]
[Sat May 16 10:01:04.162858 2026] [:error] [pid 24869:tid 24916] [client 51.77.43.170:38004] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agfP4Oxo3FMprMltYl4d3AAAAEg"]
[Sat May 16 10:01:06.110925 2026] [:error] [pid 24874:tid 24954] [client 51.77.43.170:38018] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agfP4siii6x3XidYGHHB4gAAAJM"]
[Sat May 16 10:01:06.181400 2026] [:error] [pid 5602:tid 5609] [client 51.77.43.170:38030] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agfP4tzTTsu77r3UIskE9QAAAQU"]
[Sat May 16 10:01:06.382088 2026] [:error] [pid 24979:tid 25004] [client 51.77.43.170:38042] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agfP4rvSFUQiwLaOL2pbiwAAANc"]
[Sat May 16 10:01:08.009038 2026] [:error] [pid 24869:tid 24912] [client 51.77.43.170:42324] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agfP5Oxo3FMprMltYl4d4wAAAEQ"]
[Sat May 16 10:01:08.261140 2026] [:error] [pid 24874:tid 24953] [client 51.77.43.170:42328] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agfP5Miii6x3XidYGHHB5AAAAJI"]
[Sat May 16 10:01:08.749945 2026] [:error] [pid 24874:tid 24955] [client 51.77.43.170:42344] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agfP5Miii6x3XidYGHHB5QAAAJQ"]
[Sat May 16 10:01:10.003074 2026] [:error] [pid 24979:tid 25000] [client 51.77.43.170:42350] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agfP5rvSFUQiwLaOL2pbjwAAANM"]
[Sat May 16 10:01:10.885787 2026] [:error] [pid 24867:tid 24897] [client 51.77.43.170:42362] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agfP5iDgFLCgyKq-zmYGAQAAABA"]
[Sat May 16 10:01:12.767514 2026] [:error] [pid 24979:tid 25001] [client 51.77.43.170:42372] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agfP6LvSFUQiwLaOL2pbkwAAANQ"]
[Sat May 16 10:01:12.911596 2026] [:error] [pid 24979:tid 24997] [client 51.77.43.170:42388] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agfP6LvSFUQiwLaOL2pblAAAANA"]
[Sat May 16 10:01:13.518291 2026] [:error] [pid 24979:tid 24992] [client 51.77.43.170:42402] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agfP6bvSFUQiwLaOL2pblgAAAMs"]
[Sat May 16 10:01:14.924406 2026] [:error] [pid 24867:tid 24903] [client 51.77.43.170:42408] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agfP6iDgFLCgyKq-zmYGBQAAABY"]
[Sat May 16 10:01:15.835738 2026] [:error] [pid 24867:tid 24902] [client 51.77.43.170:42420] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agfP6yDgFLCgyKq-zmYGBwAAABU"]
[Sat May 16 10:01:15.926839 2026] [:error] [pid 24979:tid 24991] [client 51.77.43.170:42426] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agfP67vSFUQiwLaOL2pbnAAAAMo"]
[Sat May 16 10:01:18.000957 2026] [:error] [pid 5602:tid 5621] [client 51.77.43.170:50912] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agfP7dzTTsu77r3UIskE-QAAARE"]
[Sat May 16 10:01:18.008073 2026] [:error] [pid 5602:tid 5605] [client 51.77.43.170:50910] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agfP7tzTTsu77r3UIskE-gAAAQE"]
[Sat May 16 10:01:18.168723 2026] [:error] [pid 24869:tid 24911] [client 51.77.43.170:50926] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agfP7uxo3FMprMltYl4d6AAAAEM"]
[Sat May 16 10:01:20.510007 2026] [:error] [pid 24869:tid 24915] [client 51.77.43.170:50932] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agfP8Oxo3FMprMltYl4d8AAAAEc"]
[Sat May 16 10:01:20.724714 2026] [:error] [pid 24867:tid 24887] [client 51.77.43.170:50946] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP8CDgFLCgyKq-zmYGCgAAAAY"]
[Sat May 16 10:01:20.782953 2026] [:error] [pid 24869:tid 24924] [client 51.77.43.170:50940] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agfP8Oxo3FMprMltYl4d8QAAAFA"]
[Sat May 16 10:01:21.845676 2026] [:error] [pid 5602:tid 5607] [client 51.77.43.170:50954] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP8dzTTsu77r3UIskE-wAAAQM"]
[Sat May 16 10:01:23.467930 2026] [:error] [pid 24979:tid 24992] [client 51.77.43.170:50962] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agfP87vSFUQiwLaOL2pbqgAAAMs"]
[Sat May 16 10:01:25.321833 2026] [:error] [pid 24869:tid 24917] [client 51.77.43.170:50978] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP9exo3FMprMltYl4d-AAAAEk"]
[Sat May 16 10:01:25.748527 2026] [:error] [pid 24979:tid 24998] [client 51.77.43.170:50980] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP9bvSFUQiwLaOL2pbsAAAANE"]
[Sat May 16 10:01:25.795464 2026] [:error] [pid 24979:tid 24988] [client 51.77.43.170:50992] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP9bvSFUQiwLaOL2pbsQAAAMc"]
[Sat May 16 10:01:30.786362 2026] [:error] [pid 24867:tid 24881] [client 51.77.43.170:55912] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfP-iDgFLCgyKq-zmYGDAAAAAA"]
[Sat May 16 10:02:29.764201 2026] [:error] [pid 5602:tid 5616] [client 51.77.43.170:40296] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agfQNdzTTsu77r3UIskFKAAAAQw"]
[Sat May 16 10:02:33.404745 2026] [:error] [pid 5602:tid 5618] [client 51.77.43.170:43558] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agfQOdzTTsu77r3UIskFKQAAAQ4"]
[Sat May 16 10:02:36.673447 2026] [:error] [pid 24874:tid 24953] [client 51.77.43.170:43574] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agfQPMiii6x3XidYGHHCFgAAAJI"]
[Sat May 16 10:02:39.286352 2026] [:error] [pid 5602:tid 5606] [client 51.77.43.170:60068] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agfQP9zTTsu77r3UIskFKgAAAQI"]
[Sat May 16 10:02:41.559538 2026] [:error] [pid 24874:tid 24946] [client 51.77.43.170:60084] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agfQQciii6x3XidYGHHCGgAAAIs"]
[Sat May 16 10:02:45.516930 2026] [:error] [pid 5602:tid 5610] [client 51.77.43.170:60086] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agfQRdzTTsu77r3UIskFMQAAAQY"]
[Sat May 16 10:02:48.761638 2026] [:error] [pid 5602:tid 5622] [client 51.77.43.170:41092] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agfQSNzTTsu77r3UIskFMwAAARI"]
[Sat May 16 10:02:52.003786 2026] [:error] [pid 24867:tid 24883] [client 51.77.43.170:41106] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agfQTCDgFLCgyKq-zmYGJQAAAAI"]
[Sat May 16 10:02:53.356343 2026] [:error] [pid 24867:tid 24889] [client 51.77.43.170:41114] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfQTSDgFLCgyKq-zmYGJgAAAAg"]
[Sat May 16 10:02:57.309551 2026] [:error] [pid 24867:tid 24890] [client 51.77.43.170:58700] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfQUSDgFLCgyKq-zmYGJwAAAAk"]
[Sat May 16 10:17:52.861977 2026] [:error] [pid 24874:tid 24944] [client 51.77.43.170:42974] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agfT0Miii6x3XidYGHHEygAAAIk"]
[Sat May 16 10:17:54.919165 2026] [:error] [pid 24874:tid 24946] [client 51.77.43.170:33238] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agfT0siii6x3XidYGHHEywAAAIs"]
[Sat May 16 10:17:57.111930 2026] [:error] [pid 24869:tid 24914] [client 51.77.43.170:50822] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agfT1exo3FMprMltYl4geQAAAEY"]
[Sat May 16 10:17:59.306622 2026] [:error] [pid 24869:tid 24918] [client 51.77.43.170:50834] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agfT1-xo3FMprMltYl4gfgAAAEo"]
[Sat May 16 10:18:01.269562 2026] [:error] [pid 24867:tid 24883] [client 51.77.43.170:50838] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agfT2SDgFLCgyKq-zmYIQgAAAAI"]
[Sat May 16 10:18:03.319856 2026] [:error] [pid 24867:tid 24905] [client 51.77.43.170:50848] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agfT2yDgFLCgyKq-zmYIRAAAABg"]
[Sat May 16 10:18:05.351070 2026] [:error] [pid 24869:tid 24911] [client 51.77.43.170:50864] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agfT3exo3FMprMltYl4giQAAAEM"]
[Sat May 16 10:18:07.606899 2026] [:error] [pid 24867:tid 24895] [client 51.77.43.170:54788] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agfT3yDgFLCgyKq-zmYISAAAAA4"]
[Sat May 16 10:18:08.933381 2026] [:error] [pid 24867:tid 24887] [client 51.77.43.170:54802] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfT4CDgFLCgyKq-zmYISgAAAAY"]
[Sat May 16 10:18:12.772762 2026] [:error] [pid 5602:tid 5604] [client 51.77.43.170:54816] [client 51.77.43.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agfT5NzTTsu77r3UIskKvwAAAQA"]
[Sat May 16 13:18:40.149354 2026] [:error] [pid 61411:tid 61419] [client 43.156.156.96:47464] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agf-MGVkiEwGnPL_dvHhxwAAAYY"]
[Sat May 16 13:40:20.329513 2026] [:error] [pid 61411:tid 61413] [client 54.37.86.223:50846] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aggDRGVkiEwGnPL_dvHk4gAAAYA"]
[Sat May 16 13:40:22.319197 2026] [:error] [pid 24869:tid 24932] [client 54.37.86.223:44002] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aggDRuxo3FMprMltYl4rEgAAAFg"]
[Sat May 16 13:40:24.691882 2026] [:error] [pid 61463:tid 61476] [client 54.37.86.223:56314] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aggDSDXdL1WU7nYXPmTlggAAAcs"]
[Sat May 16 13:40:26.705577 2026] [:error] [pid 24874:tid 24943] [client 54.37.86.223:44008] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aggDSsiii6x3XidYGHHPmQAAAIg"]
[Sat May 16 13:40:28.754073 2026] [:error] [pid 61361:tid 61364] [client 54.37.86.223:44014] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aggDTJZojzbt3jGziNkwRwAAAUE"]
[Sat May 16 13:40:30.816690 2026] [:error] [pid 24979:tid 24999] [client 54.37.86.223:57224] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aggDTrvSFUQiwLaOL2p74wAAANI"]
[Sat May 16 13:40:32.877985 2026] [:error] [pid 5602:tid 5606] [client 54.37.86.223:57236] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aggDUNzTTsu77r3UIskcagAAAQI"]
[Sat May 16 13:40:34.911524 2026] [:error] [pid 61463:tid 61477] [client 54.37.86.223:57250] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aggDUjXdL1WU7nYXPmTlkAAAAcw"]
[Sat May 16 13:40:36.793317 2026] [:error] [pid 61463:tid 61489] [client 54.37.86.223:57252] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "aggDVDXdL1WU7nYXPmTlkgAAAdg"]
[Sat May 16 13:40:38.813745 2026] [:error] [pid 24869:tid 24916] [client 54.37.86.223:57266] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "aggDVuxo3FMprMltYl4rHQAAAEg"]
[Sat May 16 13:40:40.865288 2026] [:error] [pid 24869:tid 24914] [client 54.37.86.223:38410] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "aggDWOxo3FMprMltYl4rHgAAAEY"]
[Sat May 16 13:40:42.888529 2026] [:error] [pid 24869:tid 24930] [client 54.37.86.223:38422] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "aggDWuxo3FMprMltYl4rIQAAAFY"]
[Sat May 16 13:40:44.755852 2026] [:error] [pid 24979:tid 24986] [client 54.37.86.223:38428] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "aggDXLvSFUQiwLaOL2p75wAAAMU"]
[Sat May 16 13:40:46.772994 2026] [:error] [pid 62210:tid 62222] [client 54.37.86.223:38430] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aggDXsjHonCA4ORo40G8AQAAAko"]
[Sat May 16 13:40:48.807907 2026] [:error] [pid 24867:tid 24887] [client 54.37.86.223:38434] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "aggDYCDgFLCgyKq-zmYQvAAAAAY"]
[Sat May 16 13:40:50.808918 2026] [:error] [pid 61411:tid 61433] [client 54.37.86.223:32830] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "aggDYmVkiEwGnPL_dvHk_gAAAZQ"]
[Sat May 16 13:40:52.692463 2026] [:error] [pid 61411:tid 61430] [client 54.37.86.223:32846] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aggDZGVkiEwGnPL_dvHlBAAAAZE"]
[Sat May 16 13:40:54.732205 2026] [:error] [pid 61361:tid 61378] [client 54.37.86.223:32854] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "aggDZpZojzbt3jGziNkwTAAAAU8"]
[Sat May 16 13:40:56.736918 2026] [:error] [pid 62210:tid 62229] [client 54.37.86.223:32860] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "aggDaMjHonCA4ORo40G8BwAAAlE"]
[Sat May 16 13:40:58.612601 2026] [:error] [pid 61463:tid 61468] [client 54.37.86.223:32872] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aggDajXdL1WU7nYXPmTllwAAAcM"]
[Sat May 16 13:41:00.626345 2026] [:error] [pid 61361:tid 61385] [client 54.37.86.223:32878] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aggDbJZojzbt3jGziNkwYwAAAVY"]
[Sat May 16 13:41:02.633687 2026] [:error] [pid 61361:tid 61371] [client 54.37.86.223:46370] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aggDbpZojzbt3jGziNkwagAAAUg"]
[Sat May 16 13:41:05.158014 2026] [:error] [pid 24979:tid 24993] [client 54.37.86.223:44842] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aggDcbvSFUQiwLaOL2p7-wAAAMw"]
[Sat May 16 13:41:07.158077 2026] [:error] [pid 62210:tid 62221] [client 54.37.86.223:46378] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aggDc8jHonCA4ORo40G8CgAAAkk"]
[Sat May 16 13:41:09.177471 2026] [:error] [pid 61361:tid 61364] [client 54.37.86.223:46382] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "aggDdZZojzbt3jGziNkwcgAAAUE"]
[Sat May 16 13:41:11.674645 2026] [:error] [pid 61411:tid 61426] [client 54.37.86.223:50656] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "aggDd2VkiEwGnPL_dvHlQQAAAY0"]
[Sat May 16 13:41:13.670746 2026] [:error] [pid 61411:tid 61427] [client 54.37.86.223:42174] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aggDeWVkiEwGnPL_dvHlRgAAAY4"]
[Sat May 16 13:41:15.683161 2026] [:error] [pid 24979:tid 25000] [client 54.37.86.223:42180] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "aggDe7vSFUQiwLaOL2p8CQAAANM"]
[Sat May 16 13:41:17.691335 2026] [:error] [pid 24869:tid 24916] [client 54.37.86.223:42182] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aggDfexo3FMprMltYl4rNAAAAEg"]
[Sat May 16 13:41:40.644054 2026] [:error] [pid 61411:tid 61419] [client 54.37.86.223:42790] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aggDlGVkiEwGnPL_dvHlWQAAAYY"]
[Sat May 16 13:41:42.586020 2026] [:error] [pid 24874:tid 24955] [client 54.37.86.223:59624] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aggDlsiii6x3XidYGHHPtgAAAJQ"]
[Sat May 16 13:41:44.608984 2026] [:error] [pid 62341:tid 62355] [client 54.37.86.223:59636] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aggDmKnvQ59ep-XG78ieEQAAAok"]
[Sat May 16 13:41:46.622751 2026] [:error] [pid 24869:tid 24925] [client 54.37.86.223:59648] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aggDmuxo3FMprMltYl4rOgAAAFE"]
[Sat May 16 13:41:48.635992 2026] [:error] [pid 61361:tid 61368] [client 54.37.86.223:59662] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aggDnJZojzbt3jGziNkwywAAAUU"]
[Sat May 16 13:41:50.646704 2026] [:error] [pid 61463:tid 61470] [client 54.37.86.223:59670] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aggDnjXdL1WU7nYXPmTlsQAAAcU"]
[Sat May 16 13:41:52.643986 2026] [:error] [pid 24979:tid 24981] [client 54.37.86.223:54130] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "aggDoLvSFUQiwLaOL2p8PwAAAMA"]
[Sat May 16 13:41:54.360071 2026] [:error] [pid 61411:tid 61429] [client 54.37.86.223:54136] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "aggDomVkiEwGnPL_dvHlZwAAAZA"]
[Sat May 16 13:41:56.371626 2026] [:error] [pid 24979:tid 24997] [client 54.37.86.223:54142] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aggDpLvSFUQiwLaOL2p8RAAAANA"]
[Sat May 16 13:41:58.387272 2026] [:error] [pid 62341:tid 62346] [client 54.37.86.223:54150] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aggDpqnvQ59ep-XG78ieGAAAAoA"]
[Sat May 16 13:42:00.391175 2026] [:error] [pid 5602:tid 5609] [client 54.37.86.223:54152] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aggDqNzTTsu77r3UIskcvgAAAQU"]
[Sat May 16 13:42:02.407361 2026] [:error] [pid 24874:tid 24950] [client 54.37.86.223:46420] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "aggDqsiii6x3XidYGHHPuQAAAI8"]
[Sat May 16 13:42:04.407671 2026] [:error] [pid 24874:tid 24958] [client 54.37.86.223:46424] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "aggDrMiii6x3XidYGHHPvQAAAJc"]
[Sat May 16 13:42:06.408308 2026] [:error] [pid 24874:tid 24956] [client 54.37.86.223:46426] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "aggDrsiii6x3XidYGHHPvwAAAJU"]
[Sat May 16 13:42:08.414999 2026] [:error] [pid 24874:tid 24946] [client 54.37.86.223:46440] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "aggDsMiii6x3XidYGHHPwgAAAIs"]
[Sat May 16 13:42:10.420048 2026] [:error] [pid 62341:tid 62366] [client 54.37.86.223:46452] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aggDsqnvQ59ep-XG78ieOgAAApQ"]
[Sat May 16 13:42:12.427124 2026] [:error] [pid 24979:tid 25004] [client 54.37.86.223:59228] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "aggDtLvSFUQiwLaOL2p8UwAAANc"]
[Sat May 16 13:42:14.470164 2026] [:error] [pid 24874:tid 24940] [client 54.37.86.223:59236] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "aggDtsiii6x3XidYGHHPyQAAAIU"]
[Sat May 16 13:42:16.459354 2026] [:error] [pid 61361:tid 61372] [client 54.37.86.223:59250] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "aggDuJZojzbt3jGziNkw6QAAAUk"]
[Sat May 16 13:42:18.462074 2026] [:error] [pid 61361:tid 61382] [client 54.37.86.223:59254] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "aggDupZojzbt3jGziNkw7AAAAVM"]
[Sat May 16 13:42:20.461558 2026] [:error] [pid 61361:tid 61365] [client 54.37.86.223:59270] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "aggDvJZojzbt3jGziNkw8gAAAUI"]
[Sat May 16 13:42:22.469192 2026] [:error] [pid 61411:tid 61431] [client 54.37.86.223:58746] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "aggDvmVkiEwGnPL_dvHlcgAAAZI"]
[Sat May 16 13:42:24.468335 2026] [:error] [pid 5602:tid 5618] [client 54.37.86.223:58752] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "aggDwNzTTsu77r3UIskc0AAAAQ4"]
[Sat May 16 13:42:26.500206 2026] [:error] [pid 61411:tid 61426] [client 54.37.86.223:58762] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aggDwmVkiEwGnPL_dvHldwAAAY0"]
[Sat May 16 13:42:28.495213 2026] [:error] [pid 24979:tid 24994] [client 54.37.86.223:58768] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aggDxLvSFUQiwLaOL2p8XQAAAM0"]
[Sat May 16 13:42:30.502699 2026] [:error] [pid 61411:tid 61428] [client 54.37.86.223:58780] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aggDxmVkiEwGnPL_dvHleQAAAY8"]
[Sat May 16 13:42:32.513567 2026] [:error] [pid 24874:tid 24958] [client 54.37.86.223:38428] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aggDyMiii6x3XidYGHHPzwAAAJc"]
[Sat May 16 13:42:34.515122 2026] [:error] [pid 61361:tid 61372] [client 54.37.86.223:38438] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aggDypZojzbt3jGziNkw9QAAAUk"]
[Sat May 16 13:42:36.513364 2026] [:error] [pid 61361:tid 61374] [client 54.37.86.223:38444] [client 54.37.86.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aggDzJZojzbt3jGziNkw9gAAAUs"]
[Sat May 16 14:16:17.389866 2026] [:error] [pid 61463:tid 61465] [client 43.156.44.207:48146] [client 43.156.44.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aggLsTXdL1WU7nYXPmTnwgAAAcA"]
[Sat May 16 16:01:54.529042 2026] [:error] [pid 61361:tid 61387] [client 65.108.78.33:49462] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aggkcpZojzbt3jGziNlQgwAAAVg"]
[Sat May 16 16:01:56.466556 2026] [:error] [pid 24979:tid 24998] [client 65.108.78.33:49464] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aggkdLvSFUQiwLaOL2qPgAAAANE"]
[Sat May 16 16:01:58.651703 2026] [:error] [pid 24979:tid 25001] [client 65.108.78.33:49476] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aggkdrvSFUQiwLaOL2qPgQAAANQ"]
[Sat May 16 16:02:00.599533 2026] [:error] [pid 5602:tid 5619] [client 65.108.78.33:49486] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "aggkeNzTTsu77r3UIskoygAAAQ8"]
[Sat May 16 16:02:02.483520 2026] [:error] [pid 24874:tid 24954] [client 65.108.78.33:49260] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "aggkesiii6x3XidYGHHW3QAAAJM"]
[Sat May 16 16:02:04.530586 2026] [:error] [pid 61361:tid 61378] [client 65.108.78.33:49270] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "aggkfJZojzbt3jGziNlQhgAAAU8"]
[Sat May 16 16:02:06.454112 2026] [:error] [pid 61411:tid 61426] [client 65.108.78.33:49280] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "aggkfmVkiEwGnPL_dvH7VwAAAY0"]
[Sat May 16 16:02:08.600365 2026] [:error] [pid 62341:tid 62367] [client 65.108.78.33:49282] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "aggkgKnvQ59ep-XG78ityQAAApU"]
[Sat May 16 16:02:10.603831 2026] [:error] [pid 5602:tid 5628] [client 65.108.78.33:49294] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "aggkgtzTTsu77r3UIskozwAAARg"]
[Sat May 16 16:02:12.618023 2026] [:error] [pid 61463:tid 61478] [client 65.108.78.33:24726] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "aggkhDXdL1WU7nYXPmTuJgAAAc0"]
[Sat May 16 16:02:14.717059 2026] [:error] [pid 61361:tid 61385] [client 65.108.78.33:24736] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "aggkhpZojzbt3jGziNlQlQAAAVY"]
[Sat May 16 16:02:16.707750 2026] [:error] [pid 62210:tid 62226] [client 65.108.78.33:24750] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "aggkiMjHonCA4ORo40HFiwAAAk4"]
[Sat May 16 16:02:18.636816 2026] [:error] [pid 61463:tid 61480] [client 65.108.78.33:24760] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "aggkijXdL1WU7nYXPmTuJwAAAc8"]
[Sat May 16 16:02:20.552965 2026] [:error] [pid 61361:tid 61387] [client 65.108.78.33:24776] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "aggkjJZojzbt3jGziNlQpAAAAVg"]
[Sat May 16 16:02:22.636044 2026] [:error] [pid 61361:tid 61367] [client 65.108.78.33:12298] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "aggkjpZojzbt3jGziNlQqAAAAUQ"]
[Sat May 16 16:02:24.611030 2026] [:error] [pid 61463:tid 61489] [client 65.108.78.33:12300] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "aggkkDXdL1WU7nYXPmTuKAAAAdg"]
[Sat May 16 16:02:26.741783 2026] [:error] [pid 24979:tid 24985] [client 65.108.78.33:12314] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aggkkrvSFUQiwLaOL2qPigAAAMQ"]
[Sat May 16 16:02:28.765291 2026] [:error] [pid 24979:tid 24986] [client 65.108.78.33:12322] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "aggklLvSFUQiwLaOL2qPjQAAAMU"]
[Sat May 16 16:02:30.737337 2026] [:error] [pid 24979:tid 24994] [client 65.108.78.33:12338] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aggklrvSFUQiwLaOL2qPkQAAAM0"]
[Sat May 16 16:02:32.775373 2026] [:error] [pid 62341:tid 62357] [client 65.108.78.33:19982] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "aggkmKnvQ59ep-XG78itzwAAAos"]
[Sat May 16 16:02:34.766209 2026] [:error] [pid 62341:tid 62348] [client 65.108.78.33:19992] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "aggkmqnvQ59ep-XG78it0AAAAoI"]
[Sat May 16 16:02:36.700722 2026] [:error] [pid 62341:tid 62352] [client 65.108.78.33:19998] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "aggknKnvQ59ep-XG78it0QAAAoY"]
[Sat May 16 16:02:38.803798 2026] [:error] [pid 62341:tid 62366] [client 65.108.78.33:20000] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "aggknqnvQ59ep-XG78it0wAAApQ"]
[Sat May 16 16:02:40.938969 2026] [:error] [pid 61411:tid 61420] [client 65.108.78.33:20014] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "aggkoGVkiEwGnPL_dvH7ZwAAAYc"]
[Sat May 16 16:02:43.070025 2026] [:error] [pid 61361:tid 61382] [client 65.108.78.33:56378] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "aggko5Zojzbt3jGziNlQrQAAAVM"]
[Sat May 16 16:02:44.998021 2026] [:error] [pid 61411:tid 61427] [client 65.108.78.33:56394] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "aggkpGVkiEwGnPL_dvH7awAAAY4"]
[Sat May 16 19:15:35.856060 2026] [:error] [pid 62341:tid 62351] [client 43.153.10.83:42230] [client 43.153.10.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aghR16nvQ59ep-XG78i7HwAAAoU"]
[Sat May 16 20:01:46.386044 2026] [:error] [pid 62341:tid 62358] [client 129.211.172.249:55396] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "aghcqqnvQ59ep-XG78i-RAAAAow"]
[Sat May 16 22:02:06.576726 2026] [:error] [pid 24874:tid 24935] [client 34.16.193.228:38444] [client 34.16.193.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.switchcreative.net"] [uri "/.git/config"] [unique_id "agh43siii6x3XidYGHHj-AAAAIA"]
[Sat May 16 23:04:35.970383 2026] [:error] [pid 62210:tid 62215] [client 62.84.185.55:12836] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agiHg8jHonCA4ORo40HYngAAAkM"]
[Sat May 16 23:04:40.905659 2026] [:error] [pid 61361:tid 61384] [client 62.84.185.55:61454] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agiHiJZojzbt3jGziNmShQAAAVU"]
[Sat May 16 23:04:45.970362 2026] [:error] [pid 61361:tid 61387] [client 62.84.185.55:36844] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agiHjZZojzbt3jGziNmSiwAAAVg"]
[Sat May 16 23:04:51.677362 2026] [:error] [pid 24979:tid 24981] [client 62.84.185.55:41364] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agiHk7vSFUQiwLaOL2q03AAAAMA"]
[Sat May 16 23:04:55.901024 2026] [:error] [pid 5602:tid 5627] [client 62.84.185.55:41380] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agiHl9zTTsu77r3UIsk_7AAAARc"]
[Sat May 16 23:05:00.160908 2026] [:error] [pid 24979:tid 24990] [client 62.84.185.55:31420] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agiHnLvSFUQiwLaOL2q03wAAAMk"]
[Sat May 16 23:05:04.292703 2026] [:error] [pid 61361:tid 61378] [client 62.84.185.55:16602] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agiHoJZojzbt3jGziNmSkQAAAU8"]
[Sat May 16 23:05:17.585108 2026] [:error] [pid 24869:tid 24918] [client 62.84.185.55:49544] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agiHrexo3FMprMltYl4-rgAAAEo"]
[Sat May 16 23:05:22.392904 2026] [:error] [pid 61361:tid 61370] [client 62.84.185.55:43238] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agiHspZojzbt3jGziNmSmAAAAUc"]
[Sat May 16 23:05:25.583757 2026] [:error] [pid 61361:tid 61385] [client 62.84.185.55:43246] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agiHtZZojzbt3jGziNmSnAAAAVY"]
[Sat May 16 23:06:53.102159 2026] [:error] [pid 61463:tid 61469] [client 62.84.185.55:32708] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agiIDTXdL1WU7nYXPmT-cQAAAcQ"]
[Sat May 16 23:06:58.580886 2026] [:error] [pid 61361:tid 61367] [client 62.84.185.55:11504] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agiIEpZojzbt3jGziNmSzwAAAUQ"]
[Sat May 16 23:07:01.423594 2026] [:error] [pid 62341:tid 62347] [client 62.84.185.55:11520] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agiIFanvQ59ep-XG78jKeQAAAoE"]
[Sat May 16 23:07:05.983280 2026] [:error] [pid 61361:tid 61371] [client 62.84.185.55:11522] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agiIGZZojzbt3jGziNmS0gAAAUg"]
[Sat May 16 23:07:11.176754 2026] [:error] [pid 24979:tid 24990] [client 62.84.185.55:35146] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agiIH7vSFUQiwLaOL2q0-wAAAMk"]
[Sat May 16 23:07:16.061771 2026] [:error] [pid 62341:tid 62361] [client 62.84.185.55:35150] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agiIJKnvQ59ep-XG78jKfgAAAo8"]
[Sat May 16 23:07:19.827945 2026] [:error] [pid 61361:tid 61379] [client 62.84.185.55:59468] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agiIJ5Zojzbt3jGziNmS1wAAAVA"]
[Sat May 16 23:07:26.304534 2026] [:error] [pid 24979:tid 24994] [client 62.84.185.55:59474] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agiILrvSFUQiwLaOL2q1BAAAAM0"]
[Sat May 16 23:07:29.964911 2026] [:error] [pid 24874:tid 24958] [client 62.84.185.55:62106] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agiIMciii6x3XidYGHHmzQAAAJc"]
[Sat May 16 23:07:33.854993 2026] [:error] [pid 62341:tid 62367] [client 62.84.185.55:62122] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agiINanvQ59ep-XG78jKgAAAApU"]
[Sat May 16 23:07:38.197697 2026] [:error] [pid 61411:tid 61429] [client 62.84.185.55:17032] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agiIOmVkiEwGnPL_dvEp3AAAAZA"]
[Sat May 16 23:07:42.993557 2026] [:error] [pid 61463:tid 61481] [client 62.84.185.55:17038] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agiIPjXdL1WU7nYXPmT-dAAAAdA"]
[Sat May 16 23:07:45.697175 2026] [:error] [pid 61411:tid 61435] [client 62.84.185.55:17052] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agiIQWVkiEwGnPL_dvEp5wAAAZY"]
[Sat May 16 23:08:37.208310 2026] [:error] [pid 61411:tid 61420] [client 62.84.185.55:31198] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agiIdWVkiEwGnPL_dvEp-gAAAYc"]
[Sat May 16 23:08:40.187999 2026] [:error] [pid 24979:tid 24986] [client 62.84.185.55:58488] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agiIeLvSFUQiwLaOL2q1cQAAAMU"]
[Sat May 16 23:08:42.573634 2026] [:error] [pid 62210:tid 62219] [client 62.84.185.55:58502] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agiIesjHonCA4ORo40HYuwAAAkc"]
[Sat May 16 23:08:45.705186 2026] [:error] [pid 62341:tid 62350] [client 62.84.185.55:58516] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agiIfanvQ59ep-XG78jKiwAAAoQ"]
[Sat May 16 23:14:48.431671 2026] [:error] [pid 24874:tid 24957] [client 43.135.135.57:45416] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agiJ6Miii6x3XidYGHHm8gAAAJY"]
[Sat May 16 23:56:19.234865 2026] [:error] [pid 61463:tid 61475] [client 5.58.104.243:64603] [client 5.58.104.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.58.104.243, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agiTozXdL1WU7nYXPmQAqQAAAco"]
[Sat May 16 23:56:19.246868 2026] [proxy_fcgi:error] [pid 61463:tid 61475] [client 5.58.104.243:64603] AH01071: Got error 'Primary script unknown'
[Sun May 17 01:11:33.092838 2026] [:error] [pid 24867:tid 24890] [client 62.84.185.55:5414] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agilRSDgFLCgyKq-zmYkyAAAAAk"]
[Sun May 17 01:11:37.154302 2026] [:error] [pid 61411:tid 61422] [client 62.84.185.55:7084] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agilSWVkiEwGnPL_dvE7BgAAAYk"]
[Sun May 17 01:11:44.275306 2026] [:error] [pid 61411:tid 61432] [client 62.84.185.55:7094] [client 62.84.185.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agilUGVkiEwGnPL_dvE7DQAAAZM"]
[Sun May 17 01:21:38.740340 2026] [:error] [pid 62341:tid 62370] [client 223.152.181.235:50685] [client 223.152.181.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aginoqnvQ59ep-XG78jVrgAAApg"], referer: http://www.switchcreative.net/
[Sun May 17 01:41:03.570872 2026] [:error] [pid 61361:tid 61380] [client 51.83.11.108:33424] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "agisL5Zojzbt3jGziNmpzwAAAVE"]
[Sun May 17 01:41:05.272568 2026] [:error] [pid 24867:tid 24883] [client 51.83.11.108:47638] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "agisMSDgFLCgyKq-zmYlhgAAAAI"]
[Sun May 17 01:41:05.802552 2026] [:error] [pid 61361:tid 61370] [client 51.83.11.108:35476] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2xl%20slot.aspx"] [unique_id "agisMZZojzbt3jGziNmp0AAAAUc"]
[Sun May 17 01:41:07.241525 2026] [:error] [pid 5602:tid 5613] [client 51.83.11.108:59798] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "agisM9zTTsu77r3UIslJiAAAAQk"]
[Sun May 17 01:41:08.107106 2026] [:error] [pid 62341:tid 62367] [client 51.83.11.108:59808] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "agisNKnvQ59ep-XG78jXPwAAApU"]
[Sun May 17 01:41:09.832749 2026] [:error] [pid 62341:tid 62349] [client 51.83.11.108:35096] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "agisNanvQ59ep-XG78jXQgAAAoM"]
[Sun May 17 01:41:10.710739 2026] [:error] [pid 62210:tid 62223] [client 51.83.11.108:35106] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/789%20slot.aspx"] [unique_id "agisNsjHonCA4ORo40HgCwAAAks"]
[Sun May 17 01:41:11.862748 2026] [:error] [pid 5602:tid 5619] [client 51.83.11.108:59822] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "agisN9zTTsu77r3UIslJigAAAQ8"]
[Sun May 17 01:41:12.595007 2026] [:error] [pid 61361:tid 61365] [client 51.83.11.108:59826] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "agisOJZojzbt3jGziNmp1AAAAUI"]
[Sun May 17 01:41:14.352796 2026] [:error] [pid 24979:tid 24994] [client 51.83.11.108:35122] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "agisOrvSFUQiwLaOL2rEQQAAAM0"]
[Sun May 17 01:41:15.076043 2026] [:error] [pid 61463:tid 61486] [client 51.83.11.108:35130] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/888%20slot.aspx"] [unique_id "agisOzXdL1WU7nYXPmQFHAAAAdU"]
[Sun May 17 01:41:16.689971 2026] [:error] [pid 61411:tid 61436] [client 51.83.11.108:45050] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "agisPGVkiEwGnPL_dvE_lAAAAZc"]
[Sun May 17 01:41:17.110839 2026] [:error] [pid 61411:tid 61425] [client 51.83.11.108:39100] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "agisPWVkiEwGnPL_dvE_lgAAAYw"]
[Sun May 17 01:41:18.602464 2026] [:error] [pid 5602:tid 5614] [client 51.83.11.108:39106] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "agisPtzTTsu77r3UIslJogAAAQo"]
[Sun May 17 01:41:19.525555 2026] [:error] [pid 61361:tid 61365] [client 51.83.11.108:45056] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "agisP5Zojzbt3jGziNmp5wAAAUI"]
[Sun May 17 01:41:21.192119 2026] [:error] [pid 61361:tid 61382] [client 51.83.11.108:45064] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "agisQZZojzbt3jGziNmp6AAAAVM"]
[Sun May 17 01:41:22.015602 2026] [:error] [pid 62341:tid 62353] [client 51.83.11.108:45074] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "agisQqnvQ59ep-XG78jXRQAAAoc"]
[Sun May 17 01:41:23.065889 2026] [:error] [pid 61463:tid 61475] [client 51.83.11.108:39110] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "agisQzXdL1WU7nYXPmQFHgAAAco"]
[Sun May 17 01:41:23.982768 2026] [:error] [pid 61361:tid 61372] [client 51.83.11.108:39116] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "agisQ5Zojzbt3jGziNmp6gAAAUk"]
[Sun May 17 01:41:25.579715 2026] [:error] [pid 61463:tid 61479] [client 51.83.11.108:45080] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "agisRTXdL1WU7nYXPmQFIAAAAc4"]
[Sun May 17 01:41:26.488498 2026] [:error] [pid 24869:tid 24917] [client 51.83.11.108:45094] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "agisRuxo3FMprMltYl5FBQAAAEk"]
[Sun May 17 01:41:27.849625 2026] [:error] [pid 61411:tid 61436] [client 51.83.11.108:55920] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agisR2VkiEwGnPL_dvE_oQAAAZc"]
[Sun May 17 01:41:28.379271 2026] [:error] [pid 61463:tid 61469] [client 51.83.11.108:59584] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "agisSDXdL1WU7nYXPmQFIwAAAcQ"]
[Sun May 17 01:41:29.861057 2026] [:error] [pid 24979:tid 25000] [client 51.83.11.108:59598] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agisSbvSFUQiwLaOL2rERwAAANM"]
[Sun May 17 01:41:30.922884 2026] [:error] [pid 61411:tid 61425] [client 51.83.11.108:55928] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "agisSmVkiEwGnPL_dvE_owAAAYw"]
[Sun May 17 01:41:32.388547 2026] [:error] [pid 61361:tid 61363] [client 51.83.11.108:55932] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agisTJZojzbt3jGziNmp7AAAAUA"]
[Sun May 17 01:41:33.458337 2026] [:error] [pid 61411:tid 61427] [client 51.83.11.108:55936] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "agisTWVkiEwGnPL_dvE_qgAAAY4"]
[Sun May 17 01:41:34.381846 2026] [:error] [pid 61361:tid 61385] [client 51.83.11.108:59612] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agisTpZojzbt3jGziNmp7gAAAVY"]
[Sun May 17 01:41:35.662563 2026] [:error] [pid 5602:tid 5609] [client 51.83.11.108:59614] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agisT9zTTsu77r3UIslJowAAAQU"]
[Sun May 17 01:41:36.891129 2026] [:error] [pid 61361:tid 61375] [client 51.83.11.108:34312] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agisUJZojzbt3jGziNmp8AAAAUw"]
[Sun May 17 01:41:38.201486 2026] [:error] [pid 24867:tid 24892] [client 51.83.11.108:34314] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "agisUiDgFLCgyKq-zmYliAAAAAs"]
[Sun May 17 01:41:39.271428 2026] [:error] [pid 61361:tid 61381] [client 51.83.11.108:34330] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agisU5Zojzbt3jGziNmp8gAAAVI"]
[Sun May 17 01:41:40.209488 2026] [:error] [pid 24979:tid 24995] [client 51.83.11.108:49210] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agisVLvSFUQiwLaOL2rESwAAAM4"]
[Sun May 17 01:41:41.187845 2026] [:error] [pid 61361:tid 61379] [client 51.83.11.108:49220] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agisVZZojzbt3jGziNmp9QAAAVA"]
[Sun May 17 01:41:42.539456 2026] [:error] [pid 61411:tid 61424] [client 51.83.11.108:34346] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "agisVmVkiEwGnPL_dvE_rwAAAYs"]
[Sun May 17 01:41:43.704482 2026] [:error] [pid 61411:tid 61417] [client 51.83.11.108:34358] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agisV2VkiEwGnPL_dvE_tAAAAYQ"]
[Sun May 17 01:41:45.114344 2026] [:error] [pid 61361:tid 61373] [client 51.83.11.108:34360] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "agisWZZojzbt3jGziNmp-AAAAUo"]
[Sun May 17 01:41:45.614001 2026] [:error] [pid 61361:tid 61382] [client 51.83.11.108:49236] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agisWZZojzbt3jGziNmp-QAAAVM"]
[Sun May 17 01:41:47.395371 2026] [:error] [pid 61463:tid 61486] [client 51.83.11.108:57696] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agisWzXdL1WU7nYXPmQFKwAAAdU"]
[Sun May 17 01:41:48.014186 2026] [:error] [pid 61463:tid 61484] [client 51.83.11.108:55636] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agisXDXdL1WU7nYXPmQFLAAAAdM"]
[Sun May 17 01:41:49.835423 2026] [:error] [pid 61463:tid 61471] [client 51.83.11.108:55644] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agisXTXdL1WU7nYXPmQFMAAAAcY"]
[Sun May 17 01:41:49.991535 2026] [:error] [pid 24869:tid 24908] [client 51.83.11.108:57708] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agisXexo3FMprMltYl5FBwAAAEA"]
[Sun May 17 01:41:51.750786 2026] [:error] [pid 62210:tid 62223] [client 51.83.11.108:57720] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agisX8jHonCA4ORo40HgGAAAAks"]
[Sun May 17 01:41:52.334129 2026] [:error] [pid 62341:tid 62352] [client 51.83.11.108:55652] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agisYKnvQ59ep-XG78jXSwAAAoY"]
[Sun May 17 01:41:54.206602 2026] [:error] [pid 24874:tid 24957] [client 51.83.11.108:55658] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agisYsiii6x3XidYGHHtcAAAAJY"]
[Sun May 17 01:41:54.282495 2026] [:error] [pid 62341:tid 62348] [client 51.83.11.108:57726] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agisYqnvQ59ep-XG78jXTAAAAoI"]
[Sun May 17 01:41:56.116930 2026] [:error] [pid 24874:tid 24935] [client 51.83.11.108:57734] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agisZMiii6x3XidYGHHtcQAAAIA"]
[Sun May 17 01:41:56.801975 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:56806] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agisZGVkiEwGnPL_dvE_uwAAAYo"]
[Sun May 17 01:41:58.526488 2026] [:error] [pid 61411:tid 61436] [client 51.83.11.108:56820] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agisZmVkiEwGnPL_dvE_vgAAAZc"]
[Sun May 17 01:41:58.798129 2026] [:error] [pid 61411:tid 61416] [client 51.83.11.108:51356] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agisZmVkiEwGnPL_dvE_vwAAAYM"]
[Sun May 17 01:42:00.455351 2026] [:error] [pid 61411:tid 61417] [client 51.83.11.108:51358] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agisaGVkiEwGnPL_dvE_wAAAAYQ"]
[Sun May 17 01:42:01.156609 2026] [:error] [pid 61411:tid 61431] [client 51.83.11.108:56832] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "agisaWVkiEwGnPL_dvE_wQAAAZI"]
[Sun May 17 01:42:12.872442 2026] [:error] [pid 5602:tid 5621] [client 51.83.11.108:56850] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agisdNzTTsu77r3UIslJqgAAARE"]
[Sun May 17 01:42:15.049594 2026] [:error] [pid 62341:tid 62346] [client 51.83.11.108:56842] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agisd6nvQ59ep-XG78jXVQAAAoA"]
[Sun May 17 01:42:17.022569 2026] [:error] [pid 24979:tid 25005] [client 51.83.11.108:50414] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agisebvSFUQiwLaOL2rEYgAAANg"]
[Sun May 17 01:42:17.611463 2026] [:error] [pid 5602:tid 5604] [client 51.83.11.108:50428] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agisedzTTsu77r3UIslJqwAAAQA"]
[Sun May 17 01:42:19.327901 2026] [:error] [pid 61361:tid 61386] [client 51.83.11.108:50430] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agise5Zojzbt3jGziNmqAgAAAVc"]
[Sun May 17 01:42:19.553655 2026] [:error] [pid 24874:tid 24959] [client 51.83.11.108:56952] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agise8iii6x3XidYGHHtdQAAAJg"]
[Sun May 17 01:42:21.264033 2026] [:error] [pid 61361:tid 61371] [client 51.83.11.108:56956] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agisfZZojzbt3jGziNmqAwAAAUg"]
[Sun May 17 01:42:22.100468 2026] [:error] [pid 61361:tid 61369] [client 51.83.11.108:50438] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agisfpZojzbt3jGziNmqBgAAAUY"]
[Sun May 17 01:42:23.769270 2026] [:error] [pid 61361:tid 61363] [client 51.83.11.108:50442] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agisf5Zojzbt3jGziNmqCAAAAUA"]
[Sun May 17 01:42:24.558675 2026] [:error] [pid 61361:tid 61385] [client 51.83.11.108:50458] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agisgJZojzbt3jGziNmqDQAAAVY"]
[Sun May 17 01:42:26.236252 2026] [:error] [pid 61411:tid 61432] [client 51.83.11.108:50470] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agisgmVkiEwGnPL_dvE_3gAAAZM"]
[Sun May 17 01:42:26.558913 2026] [:error] [pid 24869:tid 24910] [client 51.83.11.108:37418] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agisguxo3FMprMltYl5FCwAAAEI"]
[Sun May 17 01:42:28.698383 2026] [:error] [pid 62210:tid 62215] [client 51.83.11.108:60310] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agishMjHonCA4ORo40HgIwAAAkM"]
[Sun May 17 01:42:29.094007 2026] [:error] [pid 62210:tid 62212] [client 51.83.11.108:60320] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agishcjHonCA4ORo40HgJQAAAkA"]
[Sun May 17 01:42:30.682555 2026] [:error] [pid 61411:tid 61413] [client 51.83.11.108:37434] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agishmVkiEwGnPL_dvE_5AAAAYA"]
[Sun May 17 01:42:31.744169 2026] [:error] [pid 24874:tid 24945] [client 51.83.11.108:60328] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agish8iii6x3XidYGHHtewAAAIo"]
[Sun May 17 01:42:33.172723 2026] [:error] [pid 24874:tid 24936] [client 51.83.11.108:60342] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agisiciii6x3XidYGHHtfAAAAIE"]
[Sun May 17 01:42:34.009776 2026] [:error] [pid 5602:tid 5626] [client 51.83.11.108:60346] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agisitzTTsu77r3UIslJrQAAARY"]
[Sun May 17 01:42:35.017019 2026] [:error] [pid 62210:tid 62217] [client 51.83.11.108:37442] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agisi8jHonCA4ORo40HgKgAAAkU"]
[Sun May 17 01:42:36.057533 2026] [:error] [pid 61411:tid 61431] [client 51.83.11.108:37444] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agisjGVkiEwGnPL_dvE_7AAAAZI"]
[Sun May 17 01:42:37.517010 2026] [:error] [pid 61411:tid 61421] [client 51.83.11.108:34964] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agisjWVkiEwGnPL_dvE_8AAAAYg"]
[Sun May 17 01:42:38.724931 2026] [:error] [pid 61411:tid 61430] [client 51.83.11.108:34968] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agisjmVkiEwGnPL_dvE_8wAAAZE"]
[Sun May 17 01:42:39.838346 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:34978] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agisj2VkiEwGnPL_dvE_9QAAAYo"]
[Sun May 17 01:42:40.715472 2026] [:error] [pid 61361:tid 61387] [client 51.83.11.108:33386] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agiskJZojzbt3jGziNmqFgAAAVg"]
[Sun May 17 01:42:41.837323 2026] [:error] [pid 61411:tid 61431] [client 51.83.11.108:33388] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agiskWVkiEwGnPL_dvE_-AAAAZI"]
[Sun May 17 01:42:42.990680 2026] [:error] [pid 61411:tid 61426] [client 51.83.11.108:34984] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agiskmVkiEwGnPL_dvE__QAAAY0"]
[Sun May 17 01:42:44.374766 2026] [:error] [pid 61411:tid 61429] [client 51.83.11.108:35000] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agislGVkiEwGnPL_dvE__gAAAZA"]
[Sun May 17 01:42:45.623282 2026] [:error] [pid 61411:tid 61434] [client 51.83.11.108:35004] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agislWVkiEwGnPL_dvFAAQAAAZU"]
[Sun May 17 01:42:46.680301 2026] [:error] [pid 61411:tid 61437] [client 51.83.11.108:55150] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agislmVkiEwGnPL_dvFAAwAAAZg"]
[Sun May 17 01:42:47.600575 2026] [:error] [pid 24874:tid 24943] [client 51.83.11.108:55504] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agisl8iii6x3XidYGHHtfgAAAIg"]
[Sun May 17 01:42:48.990326 2026] [:error] [pid 24874:tid 24939] [client 51.83.11.108:55154] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agismMiii6x3XidYGHHtfwAAAIQ"]
[Sun May 17 01:42:50.026530 2026] [:error] [pid 24867:tid 24882] [client 51.83.11.108:55160] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agismiDgFLCgyKq-zmYliwAAAAE"]
[Sun May 17 01:42:51.290137 2026] [:error] [pid 24874:tid 24935] [client 51.83.11.108:55168] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agism8iii6x3XidYGHHtgAAAAIA"]
[Sun May 17 01:42:52.571134 2026] [:error] [pid 61463:tid 61486] [client 51.83.11.108:55176] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agisnDXdL1WU7nYXPmQFNgAAAdU"]
[Sun May 17 01:42:53.799057 2026] [:error] [pid 62210:tid 62213] [client 51.83.11.108:55192] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agisncjHonCA4ORo40HgLgAAAkE"]
[Sun May 17 01:42:55.150134 2026] [:error] [pid 61463:tid 61475] [client 51.83.11.108:55208] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agisnzXdL1WU7nYXPmQFOQAAAco"]
[Sun May 17 01:42:55.778177 2026] [:error] [pid 24979:tid 25002] [client 51.83.11.108:55506] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agisn7vSFUQiwLaOL2rEZQAAANU"]
[Sun May 17 01:42:57.536754 2026] [:error] [pid 61361:tid 61375] [client 51.83.11.108:45918] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agisoZZojzbt3jGziNmqHQAAAUw"]
[Sun May 17 01:42:58.117986 2026] [:error] [pid 61463:tid 61469] [client 51.83.11.108:45930] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agisojXdL1WU7nYXPmQFPAAAAcQ"]
[Sun May 17 01:42:59.955657 2026] [:error] [pid 61411:tid 61424] [client 51.83.11.108:35098] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agiso2VkiEwGnPL_dvFADwAAAYs"]
[Sun May 17 01:43:00.264528 2026] [:error] [pid 61411:tid 61425] [client 51.83.11.108:45936] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agispGVkiEwGnPL_dvFAEAAAAYw"]
[Sun May 17 01:43:02.197602 2026] [:error] [pid 24979:tid 25001] [client 51.83.11.108:35102] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agisprvSFUQiwLaOL2rEZwAAANQ"]
[Sun May 17 01:43:02.472200 2026] [:error] [pid 61411:tid 61432] [client 51.83.11.108:45950] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agispmVkiEwGnPL_dvFAEgAAAZM"]
[Sun May 17 01:43:04.516124 2026] [:error] [pid 61411:tid 61426] [client 51.83.11.108:45960] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agisqGVkiEwGnPL_dvFAFQAAAY0"]
[Sun May 17 01:43:04.781509 2026] [:error] [pid 24979:tid 24997] [client 51.83.11.108:45962] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agisqLvSFUQiwLaOL2rEaAAAANA"]
[Sun May 17 01:43:06.505912 2026] [:error] [pid 24979:tid 25000] [client 51.83.11.108:58608] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agisqrvSFUQiwLaOL2rEaQAAANM"]
[Sun May 17 01:43:07.269296 2026] [:error] [pid 61361:tid 61371] [client 51.83.11.108:41914] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agisq5Zojzbt3jGziNmqIAAAAUg"]
[Sun May 17 01:43:08.869956 2026] [:error] [pid 61411:tid 61428] [client 51.83.11.108:41916] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agisrGVkiEwGnPL_dvFAFgAAAY8"]
[Sun May 17 01:43:09.247361 2026] [:error] [pid 61411:tid 61435] [client 51.83.11.108:58614] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agisrWVkiEwGnPL_dvFAFwAAAZY"]
[Sun May 17 01:43:20.404893 2026] [:error] [pid 61411:tid 61417] [client 51.83.11.108:41940] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agisuGVkiEwGnPL_dvFAKAAAAYQ"]
[Sun May 17 01:43:21.872053 2026] [:error] [pid 61411:tid 61422] [client 51.83.11.108:58636] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agisuWVkiEwGnPL_dvFAKgAAAYk"]
[Sun May 17 01:43:22.867962 2026] [:error] [pid 24979:tid 24995] [client 51.83.11.108:48868] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agisurvSFUQiwLaOL2rEbQAAAM4"]
[Sun May 17 01:43:23.481502 2026] [:error] [pid 61411:tid 61424] [client 51.83.11.108:41932] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agisu2VkiEwGnPL_dvFALAAAAYs"]
[Sun May 17 01:43:24.684361 2026] [:error] [pid 24979:tid 24986] [client 51.83.11.108:35094] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agisvLvSFUQiwLaOL2rEbgAAAMU"]
[Sun May 17 01:43:25.917049 2026] [:error] [pid 62341:tid 62363] [client 51.83.11.108:48882] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agisvanvQ59ep-XG78jXZAAAApE"]
[Sun May 17 01:43:26.691679 2026] [:error] [pid 62210:tid 62217] [client 51.83.11.108:50888] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agisvsjHonCA4ORo40HgNAAAAkU"]
[Sun May 17 01:43:28.485871 2026] [:error] [pid 61361:tid 61363] [client 51.83.11.108:58474] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agiswJZojzbt3jGziNmqJAAAAUA"]
[Sun May 17 01:43:28.700975 2026] [:error] [pid 62210:tid 62230] [client 51.83.11.108:50894] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agiswMjHonCA4ORo40HgNQAAAlI"]
[Sun May 17 01:43:30.465636 2026] [:error] [pid 24979:tid 24998] [client 51.83.11.108:50896] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agiswrvSFUQiwLaOL2rEbwAAANE"]
[Sun May 17 01:43:30.724326 2026] [:error] [pid 24867:tid 24897] [client 51.83.11.108:50912] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agiswiDgFLCgyKq-zmYlmwAAABA"]
[Sun May 17 01:43:32.358578 2026] [:error] [pid 24867:tid 24904] [client 51.83.11.108:50918] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agisxCDgFLCgyKq-zmYlnAAAABc"]
[Sun May 17 01:43:32.719119 2026] [:error] [pid 61463:tid 61483] [client 51.83.11.108:50922] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agisxDXdL1WU7nYXPmQFTQAAAdI"]
[Sun May 17 01:43:34.162594 2026] [:error] [pid 61411:tid 61434] [client 51.83.11.108:50930] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agisxmVkiEwGnPL_dvFALgAAAZU"]
[Sun May 17 01:43:34.713638 2026] [:error] [pid 24869:tid 24921] [client 51.83.11.108:50940] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agisxuxo3FMprMltYl5FDgAAAE0"]
[Sun May 17 01:43:36.034795 2026] [:error] [pid 5602:tid 5623] [client 51.83.11.108:50944] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agisyNzTTsu77r3UIslJuAAAARM"]
[Sun May 17 01:43:37.053834 2026] [:error] [pid 24869:tid 24915] [client 51.83.11.108:38018] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agisyexo3FMprMltYl5FDwAAAEc"]
[Sun May 17 01:43:38.114091 2026] [:error] [pid 24874:tid 24959] [client 51.83.11.108:49422] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agisysiii6x3XidYGHHthgAAAJg"]
[Sun May 17 01:43:39.548834 2026] [:error] [pid 24867:tid 24887] [client 51.83.11.108:38030] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agisyyDgFLCgyKq-zmYlngAAAAY"]
[Sun May 17 01:43:40.213135 2026] [:error] [pid 24874:tid 24951] [client 51.83.11.108:49432] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agiszMiii6x3XidYGHHthwAAAJA"]
[Sun May 17 01:43:41.531074 2026] [:error] [pid 62210:tid 62214] [client 51.83.11.108:49446] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agiszcjHonCA4ORo40HgNwAAAkI"]
[Sun May 17 01:43:42.807737 2026] [:error] [pid 24869:tid 24931] [client 51.83.11.108:38044] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "agiszuxo3FMprMltYl5FEAAAAFc"]
[Sun May 17 01:43:44.023318 2026] [:error] [pid 24867:tid 24905] [client 51.83.11.108:38050] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agis0CDgFLCgyKq-zmYloAAAABg"]
[Sun May 17 01:43:45.261449 2026] [:error] [pid 61361:tid 61367] [client 51.83.11.108:38062] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agis0ZZojzbt3jGziNmqKAAAAUQ"]
[Sun May 17 01:43:46.002547 2026] [:error] [pid 24867:tid 24889] [client 51.83.11.108:49462] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agis0iDgFLCgyKq-zmYloQAAAAg"]
[Sun May 17 01:43:47.055768 2026] [:error] [pid 24869:tid 24929] [client 51.83.11.108:43344] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agis0-xo3FMprMltYl5FEgAAAFU"]
[Sun May 17 01:43:48.488438 2026] [:error] [pid 5602:tid 5626] [client 51.83.11.108:35052] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agis1NzTTsu77r3UIslJvAAAARY"]
[Sun May 17 01:43:49.305173 2026] [:error] [pid 24867:tid 24893] [client 51.83.11.108:35066] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "agis1SDgFLCgyKq-zmYlowAAAAw"]
[Sun May 17 01:43:50.874585 2026] [:error] [pid 61411:tid 61415] [client 51.83.11.108:35072] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agis1mVkiEwGnPL_dvFALwAAAYI"]
[Sun May 17 01:43:51.188798 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:43358] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agis12VkiEwGnPL_dvFAMAAAAYo"]
[Sun May 17 01:43:52.849144 2026] [:error] [pid 62341:tid 62350] [client 51.83.11.108:43360] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agis2KnvQ59ep-XG78jXcgAAAoQ"]
[Sun May 17 01:43:53.705326 2026] [:error] [pid 61411:tid 61421] [client 51.83.11.108:35086] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "agis2WVkiEwGnPL_dvFAMwAAAYg"]
[Sun May 17 01:43:55.209523 2026] [:error] [pid 61411:tid 61414] [client 51.83.11.108:35092] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agis22VkiEwGnPL_dvFANwAAAYE"]
[Sun May 17 01:43:56.267514 2026] [:error] [pid 61411:tid 61428] [client 51.83.11.108:35106] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agis3GVkiEwGnPL_dvFAOQAAAY8"]
[Sun May 17 01:43:57.213888 2026] [:error] [pid 61411:tid 61418] [client 51.83.11.108:58938] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agis3WVkiEwGnPL_dvFAOwAAAYU"]
[Sun May 17 01:43:58.235098 2026] [:error] [pid 61411:tid 61425] [client 51.83.11.108:58954] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agis3mVkiEwGnPL_dvFAPQAAAYw"]
[Sun May 17 01:43:59.235317 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:58970] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agis32VkiEwGnPL_dvFAQAAAAYo"]
[Sun May 17 01:44:00.569676 2026] [:error] [pid 61361:tid 61381] [client 51.83.11.108:58018] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agis4JZojzbt3jGziNmqQAAAAVI"]
[Sun May 17 01:44:01.733913 2026] [:error] [pid 61411:tid 61420] [client 51.83.11.108:58024] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agis4WVkiEwGnPL_dvFARgAAAYc"]
[Sun May 17 01:44:02.642339 2026] [:error] [pid 61361:tid 61380] [client 51.83.11.108:58974] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agis4pZojzbt3jGziNmqQQAAAVE"]
[Sun May 17 01:44:03.719026 2026] [:error] [pid 61361:tid 61364] [client 51.83.11.108:58984] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agis45Zojzbt3jGziNmqQwAAAUE"]
[Sun May 17 01:44:04.787753 2026] [:error] [pid 61361:tid 61373] [client 51.83.11.108:58998] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agis5JZojzbt3jGziNmqRgAAAUo"]
[Sun May 17 01:44:06.206591 2026] [:error] [pid 61361:tid 61374] [client 51.83.11.108:58038] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agis5pZojzbt3jGziNmqSQAAAUs"]
[Sun May 17 01:44:07.219137 2026] [:error] [pid 24867:tid 24883] [client 51.83.11.108:51034] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agis5yDgFLCgyKq-zmYlpgAAAAI"]
[Sun May 17 01:44:08.195888 2026] [:error] [pid 24867:tid 24881] [client 51.83.11.108:36562] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agis6CDgFLCgyKq-zmYlqAAAAAA"]
[Sun May 17 01:44:09.005761 2026] [:error] [pid 62341:tid 62346] [client 51.83.11.108:36574] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agis6anvQ59ep-XG78jXdQAAAoA"]
[Sun May 17 01:44:10.756985 2026] [:error] [pid 61411:tid 61428] [client 51.83.11.108:51038] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agis6mVkiEwGnPL_dvFAUQAAAY8"]
[Sun May 17 01:44:11.445502 2026] [:error] [pid 61411:tid 61413] [client 51.83.11.108:51050] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agis62VkiEwGnPL_dvFAVQAAAYA"]
[Sun May 17 01:44:12.720053 2026] [:error] [pid 61411:tid 61424] [client 51.83.11.108:36580] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agis7GVkiEwGnPL_dvFAVwAAAYs"]
[Sun May 17 01:44:13.426804 2026] [:error] [pid 61411:tid 61434] [client 51.83.11.108:36588] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agis7WVkiEwGnPL_dvFAWQAAAZU"]
[Sun May 17 01:44:15.227351 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:51058] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agis72VkiEwGnPL_dvFAXAAAAYo"]
[Sun May 17 01:44:15.859185 2026] [:error] [pid 5602:tid 5626] [client 51.83.11.108:51066] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agis79zTTsu77r3UIslJywAAARY"]
[Sun May 17 01:44:17.689276 2026] [:error] [pid 62210:tid 62232] [client 51.83.11.108:55206] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agis8cjHonCA4ORo40HgRAAAAlQ"]
[Sun May 17 01:44:17.730154 2026] [:error] [pid 62341:tid 62353] [client 51.83.11.108:49904] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agis8anvQ59ep-XG78jXdgAAAoc"]
[Sun May 17 01:44:19.667179 2026] [:error] [pid 61361:tid 61368] [client 51.83.11.108:49918] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agis85Zojzbt3jGziNmqSwAAAUU"]
[Sun May 17 01:44:30.591458 2026] [:error] [pid 61361:tid 61370] [client 51.83.11.108:49926] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agis_pZojzbt3jGziNmqVwAAAUc"]
[Sun May 17 01:44:30.841131 2026] [:error] [pid 5602:tid 5627] [client 51.83.11.108:49932] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agis_tzTTsu77r3UIslJ1AAAARc"]
[Sun May 17 01:44:32.354834 2026] [:error] [pid 61361:tid 61375] [client 51.83.11.108:55216] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agitAJZojzbt3jGziNmqWAAAAUw"]
[Sun May 17 01:44:32.573775 2026] [:error] [pid 61411:tid 61427] [client 51.83.11.108:55222] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agitAGVkiEwGnPL_dvFAbQAAAY4"]
[Sun May 17 01:44:34.152632 2026] [:error] [pid 24867:tid 24891] [client 51.83.11.108:47580] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agitAiDgFLCgyKq-zmYlrgAAAAo"]
[Sun May 17 01:44:35.001912 2026] [:error] [pid 62341:tid 62357] [client 51.83.11.108:50858] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agitA6nvQ59ep-XG78jXfQAAAos"]
[Sun May 17 01:44:36.597066 2026] [:error] [pid 5602:tid 5621] [client 51.83.11.108:50866] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agitBNzTTsu77r3UIslJ1gAAARE"]
[Sun May 17 01:44:36.872044 2026] [:error] [pid 62210:tid 62217] [client 51.83.11.108:33464] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agitBMjHonCA4ORo40HgRgAAAkU"]
[Sun May 17 01:44:39.114596 2026] [:error] [pid 5602:tid 5606] [client 51.83.11.108:59972] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agitB9zTTsu77r3UIslJ1wAAAQI"]
[Sun May 17 01:44:39.248583 2026] [:error] [pid 24979:tid 25001] [client 51.83.11.108:59974] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agitB7vSFUQiwLaOL2rEdwAAANQ"]
[Sun May 17 01:44:41.009138 2026] [:error] [pid 61463:tid 61483] [client 51.83.11.108:33472] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agitCTXdL1WU7nYXPmQFXgAAAdI"]
[Sun May 17 01:44:41.241181 2026] [:error] [pid 24979:tid 24990] [client 51.83.11.108:33478] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agitCbvSFUQiwLaOL2rEeQAAAMk"]
[Sun May 17 01:44:43.393677 2026] [:error] [pid 24867:tid 24884] [client 51.83.11.108:59984] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agitCyDgFLCgyKq-zmYlrwAAAAM"]
[Sun May 17 01:44:43.739491 2026] [:error] [pid 62341:tid 62354] [client 51.83.11.108:59988] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agitC6nvQ59ep-XG78jXgQAAAog"]
[Sun May 17 01:44:45.416362 2026] [:error] [pid 62341:tid 62364] [client 51.83.11.108:33488] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agitDanvQ59ep-XG78jXggAAApI"]
[Sun May 17 01:44:45.572404 2026] [:error] [pid 24979:tid 24993] [client 51.83.11.108:33500] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agitDbvSFUQiwLaOL2rEewAAAMw"]
[Sun May 17 01:44:47.810830 2026] [:error] [pid 24867:tid 24893] [client 51.83.11.108:38900] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agitDyDgFLCgyKq-zmYlsgAAAAw"]
[Sun May 17 01:44:48.068908 2026] [:error] [pid 5602:tid 5624] [client 51.83.11.108:38908] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agitENzTTsu77r3UIslJ3QAAARQ"]
[Sun May 17 01:44:49.742472 2026] [:error] [pid 61411:tid 61432] [client 51.83.11.108:54506] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agitEWVkiEwGnPL_dvFAhgAAAZM"]
[Sun May 17 01:44:50.389399 2026] [:error] [pid 61411:tid 61414] [client 51.83.11.108:38912] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agitEmVkiEwGnPL_dvFAhwAAAYE"]
[Sun May 17 01:44:52.211513 2026] [:error] [pid 61411:tid 61422] [client 51.83.11.108:38920] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agitFGVkiEwGnPL_dvFAjAAAAYk"]
[Sun May 17 01:44:52.873123 2026] [:error] [pid 61411:tid 61413] [client 51.83.11.108:38930] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agitFGVkiEwGnPL_dvFAkAAAAYA"]
[Sun May 17 01:44:54.769138 2026] [:error] [pid 61411:tid 61426] [client 51.83.11.108:38942] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agitFmVkiEwGnPL_dvFAoQAAAY0"]
[Sun May 17 01:44:54.855358 2026] [:error] [pid 61411:tid 61418] [client 51.83.11.108:54514] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agitFmVkiEwGnPL_dvFAowAAAYU"]
[Sun May 17 01:44:57.044407 2026] [:error] [pid 61411:tid 61418] [client 51.83.11.108:47920] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agitGWVkiEwGnPL_dvFAsQAAAYU"]
[Sun May 17 01:44:57.226929 2026] [:error] [pid 61411:tid 61428] [client 51.83.11.108:47934] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agitGWVkiEwGnPL_dvFAsgAAAY8"]
[Sun May 17 01:44:58.950351 2026] [:error] [pid 61361:tid 61374] [client 51.83.11.108:44448] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agitGpZojzbt3jGziNmqWgAAAUs"]
[Sun May 17 01:44:59.179573 2026] [:error] [pid 24869:tid 24913] [client 51.83.11.108:44464] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agitG-xo3FMprMltYl5FFQAAAEU"]
[Sun May 17 01:45:01.465768 2026] [:error] [pid 62341:tid 62349] [client 51.83.11.108:47950] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agitHanvQ59ep-XG78jXjwAAAoM"]
[Sun May 17 01:45:01.673719 2026] [:error] [pid 24979:tid 24982] [client 51.83.11.108:47952] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agitHbvSFUQiwLaOL2rEgAAAAME"]
[Sun May 17 01:45:03.484841 2026] [:error] [pid 24874:tid 24942] [client 51.83.11.108:44466] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agitH8iii6x3XidYGHHtmAAAAIc"]
[Sun May 17 01:45:04.185757 2026] [:error] [pid 62210:tid 62234] [client 51.83.11.108:47962] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agitIMjHonCA4ORo40HgTwAAAlY"]
[Sun May 17 01:45:06.093598 2026] [:error] [pid 62210:tid 62219] [client 51.83.11.108:47970] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agitIsjHonCA4ORo40HgUQAAAkc"]
[Sun May 17 01:45:06.149069 2026] [:error] [pid 61411:tid 61413] [client 51.83.11.108:43056] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agitImVkiEwGnPL_dvFAtgAAAYA"]
[Sun May 17 01:45:08.504138 2026] [:error] [pid 61411:tid 61423] [client 51.83.11.108:42398] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agitJGVkiEwGnPL_dvFAuQAAAYo"]
[Sun May 17 01:45:08.509115 2026] [:error] [pid 62341:tid 62364] [client 51.83.11.108:42406] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agitJKnvQ59ep-XG78jXkQAAApI"]
[Sun May 17 01:45:10.459599 2026] [:error] [pid 62341:tid 62363] [client 51.83.11.108:43072] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agitJqnvQ59ep-XG78jXlgAAApE"]
[Sun May 17 01:45:10.491906 2026] [:error] [pid 61411:tid 61435] [client 51.83.11.108:43080] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agitJmVkiEwGnPL_dvFAugAAAZY"]
[Sun May 17 01:45:13.008336 2026] [:error] [pid 24869:tid 24926] [client 51.83.11.108:42416] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agitKexo3FMprMltYl5FGgAAAFI"]
[Sun May 17 01:45:13.019900 2026] [:error] [pid 24869:tid 24916] [client 51.83.11.108:42412] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agitKexo3FMprMltYl5FGwAAAEg"]
[Sun May 17 01:45:14.883954 2026] [:error] [pid 5602:tid 5604] [client 51.83.11.108:43094] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agitKtzTTsu77r3UIslJ3wAAAQA"]
[Sun May 17 01:45:15.365188 2026] [:error] [pid 62341:tid 62367] [client 51.83.11.108:42430] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agitK6nvQ59ep-XG78jXnQAAApU"]
[Sun May 17 01:45:17.360617 2026] [:error] [pid 5602:tid 5622] [client 51.83.11.108:53568] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agitLdzTTsu77r3UIslJ4QAAARI"]
[Sun May 17 01:45:17.419174 2026] [:error] [pid 62341:tid 62365] [client 51.83.11.108:44574] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agitLanvQ59ep-XG78jXnwAAApM"]
[Sun May 17 01:45:19.817501 2026] [:error] [pid 24874:tid 24940] [client 51.83.11.108:44590] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agitL8iii6x3XidYGHHtrAAAAIU"]
[Sun May 17 01:45:19.846449 2026] [:error] [pid 62341:tid 62356] [client 51.83.11.108:44604] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agitL6nvQ59ep-XG78jXogAAAoo"]
[Sun May 17 01:45:21.677201 2026] [:error] [pid 24874:tid 24941] [client 51.83.11.108:53582] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agitMciii6x3XidYGHHtrwAAAIY"]
[Sun May 17 01:45:21.858279 2026] [:error] [pid 61411:tid 61428] [client 51.83.11.108:53586] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agitMWVkiEwGnPL_dvFAuwAAAY8"]
[Sun May 17 01:45:24.119907 2026] [:error] [pid 62341:tid 62364] [client 51.83.11.108:44608] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agitNKnvQ59ep-XG78jXpQAAApI"]
[Sun May 17 01:45:24.260703 2026] [:error] [pid 61463:tid 61468] [client 51.83.11.108:44622] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agitNDXdL1WU7nYXPmQFYwAAAcM"]
[Sun May 17 01:45:26.178293 2026] [:error] [pid 62210:tid 62230] [client 51.83.11.108:43746] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agitNsjHonCA4ORo40HgUwAAAlI"]
[Sun May 17 01:45:26.438696 2026] [:error] [pid 24874:tid 24935] [client 51.83.11.108:44630] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agitNsiii6x3XidYGHHttwAAAIA"]
[Sun May 17 01:45:28.678729 2026] [:error] [pid 62341:tid 62370] [client 51.83.11.108:54328] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agitOKnvQ59ep-XG78jXqQAAApg"]
[Sun May 17 01:45:28.902818 2026] [:error] [pid 24979:tid 24999] [client 51.83.11.108:54334] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agitOLvSFUQiwLaOL2rEgQAAANI"]
[Sun May 17 01:45:41.163451 2026] [:error] [pid 24979:tid 25001] [client 51.83.11.108:54356] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agitRbvSFUQiwLaOL2rEmgAAANQ"]
[Sun May 17 01:45:41.643640 2026] [:error] [pid 61411:tid 61435] [client 51.83.11.108:54348] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agitRWVkiEwGnPL_dvFAzQAAAZY"]
[Sun May 17 01:45:43.648801 2026] [:error] [pid 24869:tid 24923] [client 51.83.11.108:46936] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agitR-xo3FMprMltYl5FIAAAAE8"]
[Sun May 17 01:45:44.096799 2026] [:error] [pid 61463:tid 61482] [client 51.83.11.108:46946] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agitSDXdL1WU7nYXPmQFaAAAAdE"]
[Sun May 17 01:45:46.282878 2026] [:error] [pid 61411:tid 61419] [client 51.83.11.108:46960] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agitSmVkiEwGnPL_dvFA1QAAAYY"]
[Sun May 17 01:45:46.497802 2026] [:error] [pid 61411:tid 61421] [client 51.83.11.108:46972] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agitSmVkiEwGnPL_dvFA1gAAAYg"]
[Sun May 17 01:45:48.426777 2026] [:error] [pid 24979:tid 24993] [client 51.83.11.108:44540] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agitTLvSFUQiwLaOL2rEoQAAAMw"]
[Sun May 17 01:45:48.952261 2026] [:error] [pid 24979:tid 24989] [client 51.83.11.108:57270] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agitTLvSFUQiwLaOL2rEpQAAAMg"]
[Sun May 17 01:45:50.400640 2026] [:error] [pid 61463:tid 61480] [client 51.83.11.108:44550] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agitTjXdL1WU7nYXPmQFawAAAc8"]
[Sun May 17 01:45:52.254977 2026] [:error] [pid 61463:tid 61474] [client 51.83.11.108:44566] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agitUDXdL1WU7nYXPmQFbAAAAck"]
[Sun May 17 01:45:54.163586 2026] [:error] [pid 61411:tid 61435] [client 51.83.11.108:44576] [client 51.83.11.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agitUmVkiEwGnPL_dvFA3gAAAZY"]
[Sun May 17 03:00:09.209506 2026] [:error] [pid 61361:tid 61375] [client 145.239.66.9:49106] [client 145.239.66.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agi-uZZojzbt3jGziNmy9gAAAUw"]
[Sun May 17 03:00:11.684450 2026] [:error] [pid 61411:tid 61415] [client 145.239.66.9:56196] [client 145.239.66.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agi-u2VkiEwGnPL_dvFMhgAAAYI"]
[Sun May 17 03:00:14.193359 2026] [:error] [pid 61361:tid 61377] [client 145.239.66.9:56208] [client 145.239.66.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agi-vpZojzbt3jGziNmy9wAAAU4"]
[Sun May 17 03:34:52.371591 2026] [:error] [pid 59061:tid 59103] [client 65.108.125.120:35672] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agjG3IYS410zAmsYkoLlQwAAAEc"]
[Sun May 17 03:34:54.467580 2026] [:error] [pid 59061:tid 59099] [client 65.108.125.120:35682] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agjG3oYS410zAmsYkoLlSAAAAEM"]
[Sun May 17 03:34:56.467858 2026] [:error] [pid 59062:tid 59136] [client 65.108.125.120:35686] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agjG4D4V9GkVWmCFmGaj9AAAAI0"]
[Sun May 17 03:34:58.472013 2026] [:error] [pid 59060:tid 59082] [client 65.108.125.120:13846] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agjG4vvwvq3bndkPE4m3uQAAAA0"]
[Sun May 17 03:35:00.477933 2026] [:error] [pid 59060:tid 59089] [client 65.108.125.120:13852] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agjG5Pvwvq3bndkPE4m3vAAAABQ"]
[Sun May 17 03:35:02.521938 2026] [:error] [pid 59062:tid 59130] [client 65.108.125.120:13864] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agjG5j4V9GkVWmCFmGaj-wAAAIc"]
[Sun May 17 03:35:04.387155 2026] [:error] [pid 59166:tid 59190] [client 65.108.125.120:13874] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agjG6E_puQ1I47_0UriVcwAAANY"]
[Sun May 17 03:35:06.392746 2026] [:error] [pid 59166:tid 59179] [client 65.108.125.120:13876] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agjG6k_puQ1I47_0UriVdQAAAMs"]
[Sun May 17 03:35:07.818529 2026] [:error] [pid 59061:tid 59115] [client 65.108.125.120:61194] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agjG64YS410zAmsYkoLlVgAAAFM"]
[Sun May 17 03:35:11.558164 2026] [:error] [pid 59166:tid 59188] [client 65.108.125.120:61202] [client 65.108.125.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agjG70_puQ1I47_0UriVggAAANQ"]
[Sun May 17 04:36:13.117910 2026] [:error] [pid 59060:tid 59092] [client 113.72.19.104:14142] [client 113.72.19.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agjVPfvwvq3bndkPE4m9cwAAABc"], referer: http://switchcreative.net/
[Sun May 17 05:53:14.632531 2026] [:error] [pid 59060:tid 59093] [client 43.135.145.117:42146] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agjnSvvwvq3bndkPE4nDdwAAABg"]
[Sun May 17 06:55:00.539422 2026] [:error] [pid 17234:tid 17237] [client 129.226.146.42:37120] [client 129.226.146.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agj1xNJ4QOrYRCeDR2j3WAAAAUE"]
[Sun May 17 07:01:46.960558 2026] [:error] [pid 59166:tid 59170] [client 103.153.183.69:25844] [client 103.153.183.69] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||switchcreative.net|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agj3Wk_puQ1I47_0Uri0nwAAAMI"]
[Sun May 17 07:01:46.960652 2026] [:error] [pid 59166:tid 59170] [client 103.153.183.69:25844] [client 103.153.183.69] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agj3Wk_puQ1I47_0Uri0nwAAAMI"]
[Sun May 17 07:03:50.615696 2026] [:error] [pid 17234:tid 17259] [client 217.182.195.233:48764] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agj31tJ4QOrYRCeDR2j4rgAAAVc"]
[Sun May 17 07:03:52.701055 2026] [:error] [pid 36652:tid 36656] [client 217.182.195.233:38266] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agj32DZrzQadnZADvj8Y4gAAAQI"]
[Sun May 17 07:03:55.688698 2026] [:error] [pid 36652:tid 36672] [client 217.182.195.233:41904] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agj32zZrzQadnZADvj8Y5wAAARI"]
[Sun May 17 07:03:57.657746 2026] [:error] [pid 59062:tid 59125] [client 217.182.195.233:38270] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agj33T4V9GkVWmCFmGbAxwAAAII"]
[Sun May 17 07:03:59.537209 2026] [:error] [pid 59061:tid 59104] [client 217.182.195.233:38286] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agj334YS410zAmsYkoL5fQAAAEg"]
[Sun May 17 07:04:01.369097 2026] [:error] [pid 59060:tid 59090] [client 217.182.195.233:53858] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agj34fvwvq3bndkPE4nIYQAAABU"]
[Sun May 17 07:04:03.389697 2026] [:error] [pid 59166:tid 59188] [client 217.182.195.233:53870] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agj340_puQ1I47_0Uri02gAAANQ"]
[Sun May 17 07:04:05.221610 2026] [:error] [pid 59061:tid 59096] [client 217.182.195.233:53882] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agj35YYS410zAmsYkoL5gwAAAEA"]
[Sun May 17 07:04:07.172246 2026] [:error] [pid 59166:tid 59189] [client 217.182.195.233:53888] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agj350_puQ1I47_0Uri03wAAANU"]
[Sun May 17 07:04:09.110059 2026] [:error] [pid 17234:tid 17243] [client 217.182.195.233:53902] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agj36dJ4QOrYRCeDR2j4sQAAAUc"]
[Sun May 17 07:04:11.076466 2026] [:error] [pid 59060:tid 59089] [client 217.182.195.233:39404] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agj36_vwvq3bndkPE4nIaAAAABQ"]
[Sun May 17 07:04:12.882766 2026] [:error] [pid 59166:tid 59188] [client 217.182.195.233:39418] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agj37E_puQ1I47_0Uri07QAAANQ"]
[Sun May 17 07:04:14.800374 2026] [:error] [pid 59166:tid 59178] [client 217.182.195.233:39430] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agj37k_puQ1I47_0Uri0_AAAAMo"]
[Sun May 17 07:04:16.702081 2026] [:error] [pid 59166:tid 59169] [client 217.182.195.233:39432] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agj38E_puQ1I47_0Uri1CgAAAME"]
[Sun May 17 07:04:18.622281 2026] [:error] [pid 17234:tid 17244] [client 217.182.195.233:39434] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agj38tJ4QOrYRCeDR2j4xwAAAUg"]
[Sun May 17 07:04:20.405203 2026] [:error] [pid 59166:tid 59174] [client 217.182.195.233:45416] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agj39E_puQ1I47_0Uri1CwAAAMY"]
[Sun May 17 07:04:22.321923 2026] [:error] [pid 59062:tid 59133] [client 217.182.195.233:45432] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agj39j4V9GkVWmCFmGbA5wAAAIo"]
[Sun May 17 07:04:24.122653 2026] [:error] [pid 17234:tid 17245] [client 217.182.195.233:45434] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agj3-NJ4QOrYRCeDR2j40QAAAUk"]
[Sun May 17 07:04:26.054624 2026] [:error] [pid 59062:tid 59135] [client 217.182.195.233:45446] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agj3-j4V9GkVWmCFmGbA7AAAAIw"]
[Sun May 17 07:04:27.829063 2026] [:error] [pid 17234:tid 17254] [client 217.182.195.233:45454] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agj3-9J4QOrYRCeDR2j41QAAAVI"]
[Sun May 17 07:04:29.819157 2026] [:error] [pid 36652:tid 36655] [client 217.182.195.233:45460] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agj3_TZrzQadnZADvj8ZAwAAAQE"]
[Sun May 17 07:04:31.937886 2026] [:error] [pid 59062:tid 59128] [client 217.182.195.233:52546] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agj3_z4V9GkVWmCFmGbA9QAAAIU"]
[Sun May 17 07:04:34.513657 2026] [:error] [pid 17234:tid 17252] [client 217.182.195.233:56010] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agj4AtJ4QOrYRCeDR2j44QAAAVA"]
[Sun May 17 07:04:36.420797 2026] [:error] [pid 17234:tid 17242] [client 217.182.195.233:52548] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agj4BNJ4QOrYRCeDR2j45QAAAUY"]
[Sun May 17 07:04:38.340928 2026] [:error] [pid 17234:tid 17241] [client 217.182.195.233:52550] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agj4BtJ4QOrYRCeDR2j48QAAAUU"]
[Sun May 17 07:04:40.864969 2026] [:error] [pid 59060:tid 59088] [client 217.182.195.233:52558] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agj4CPvwvq3bndkPE4nIjAAAABM"]
[Sun May 17 07:04:42.923284 2026] [:error] [pid 36652:tid 36655] [client 217.182.195.233:51846] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agj4CjZrzQadnZADvj8ZFAAAAQE"]
[Sun May 17 07:04:44.841172 2026] [:error] [pid 36652:tid 36673] [client 217.182.195.233:51848] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agj4DDZrzQadnZADvj8ZGQAAARM"]
[Sun May 17 07:04:46.888987 2026] [:error] [pid 36652:tid 36668] [client 217.182.195.233:51864] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agj4DjZrzQadnZADvj8ZHwAAAQ4"]
[Sun May 17 07:05:08.558353 2026] [:error] [pid 17234:tid 17239] [client 217.182.195.233:58952] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agj4JNJ4QOrYRCeDR2j5EgAAAUM"]
[Sun May 17 07:05:10.387377 2026] [:error] [pid 59166:tid 59174] [client 217.182.195.233:43342] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agj4Jk_puQ1I47_0Uri1IwAAAMY"]
[Sun May 17 07:05:12.415524 2026] [:error] [pid 59060:tid 59071] [client 217.182.195.233:43350] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agj4KPvwvq3bndkPE4nIjgAAAAI"]
[Sun May 17 07:05:14.303630 2026] [:error] [pid 59062:tid 59144] [client 217.182.195.233:43364] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agj4Kj4V9GkVWmCFmGbBCwAAAJU"]
[Sun May 17 07:05:16.192009 2026] [:error] [pid 59062:tid 59132] [client 217.182.195.233:43376] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agj4LD4V9GkVWmCFmGbBDgAAAIk"]
[Sun May 17 07:05:17.923653 2026] [:error] [pid 59062:tid 59124] [client 217.182.195.233:43392] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agj4LT4V9GkVWmCFmGbBEAAAAIE"]
[Sun May 17 07:05:19.805105 2026] [:error] [pid 59062:tid 59137] [client 217.182.195.233:43398] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agj4Lz4V9GkVWmCFmGbBEgAAAI4"]
[Sun May 17 07:05:21.705928 2026] [:error] [pid 17234:tid 17251] [client 217.182.195.233:50524] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agj4MdJ4QOrYRCeDR2j5JQAAAU8"]
[Sun May 17 07:05:23.750321 2026] [:error] [pid 36652:tid 36661] [client 217.182.195.233:50534] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agj4MzZrzQadnZADvj8ZQwAAAQc"]
[Sun May 17 07:05:25.630071 2026] [:error] [pid 17234:tid 17255] [client 217.182.195.233:50550] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agj4NdJ4QOrYRCeDR2j5KwAAAVM"]
[Sun May 17 07:05:27.663567 2026] [:error] [pid 59166:tid 59170] [client 217.182.195.233:50558] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agj4N0_puQ1I47_0Uri1NAAAAMI"]
[Sun May 17 07:05:29.547926 2026] [:error] [pid 17234:tid 17247] [client 217.182.195.233:50560] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agj4OdJ4QOrYRCeDR2j5LAAAAUs"]
[Sun May 17 07:05:31.584840 2026] [:error] [pid 36652:tid 36671] [client 217.182.195.233:35254] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agj4OzZrzQadnZADvj8ZVAAAARE"]
[Sun May 17 07:05:33.458298 2026] [:error] [pid 59166:tid 59187] [client 217.182.195.233:35266] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agj4PU_puQ1I47_0Uri1OgAAANM"]
[Sun May 17 07:05:35.489129 2026] [:error] [pid 17234:tid 17240] [client 217.182.195.233:35270] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agj4P9J4QOrYRCeDR2j5LwAAAUQ"]
[Sun May 17 07:05:37.512333 2026] [:error] [pid 17234:tid 17254] [client 217.182.195.233:35284] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agj4QdJ4QOrYRCeDR2j5NAAAAVI"]
[Sun May 17 07:05:39.545830 2026] [:error] [pid 17234:tid 17250] [client 217.182.195.233:35292] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agj4Q9J4QOrYRCeDR2j5NwAAAU4"]
[Sun May 17 07:05:41.558834 2026] [:error] [pid 17234:tid 17237] [client 217.182.195.233:41168] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agj4RdJ4QOrYRCeDR2j5PwAAAUE"]
[Sun May 17 07:05:43.584658 2026] [:error] [pid 36652:tid 36675] [client 217.182.195.233:41182] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agj4RzZrzQadnZADvj8ZYgAAARU"]
[Sun May 17 07:05:45.476049 2026] [:error] [pid 36652:tid 36672] [client 217.182.195.233:41188] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agj4STZrzQadnZADvj8ZZwAAARI"]
[Sun May 17 07:05:47.485008 2026] [:error] [pid 17234:tid 17251] [client 217.182.195.233:41190] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agj4S9J4QOrYRCeDR2j5RQAAAU8"]
[Sun May 17 07:05:49.507072 2026] [:error] [pid 59062:tid 59141] [client 217.182.195.233:41202] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agj4TT4V9GkVWmCFmGbBLQAAAJI"]
[Sun May 17 07:05:51.510142 2026] [:error] [pid 17234:tid 17249] [client 217.182.195.233:59616] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agj4T9J4QOrYRCeDR2j5SQAAAU0"]
[Sun May 17 07:05:53.528554 2026] [:error] [pid 36652:tid 36676] [client 217.182.195.233:59628] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agj4UTZrzQadnZADvj8ZbQAAARY"]
[Sun May 17 07:05:55.540645 2026] [:error] [pid 59166:tid 59192] [client 217.182.195.233:59632] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agj4U0_puQ1I47_0Uri1QgAAANg"]
[Sun May 17 07:05:57.540989 2026] [:error] [pid 59061:tid 59116] [client 217.182.195.233:59648] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agj4VYYS410zAmsYkoL5tAAAAFQ"]
[Sun May 17 07:05:59.400321 2026] [:error] [pid 59061:tid 59105] [client 217.182.195.233:59656] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agj4V4YS410zAmsYkoL5twAAAEk"]
[Sun May 17 07:06:01.411181 2026] [:error] [pid 59061:tid 59118] [client 217.182.195.233:54532] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agj4WYYS410zAmsYkoL5vQAAAFY"]
[Sun May 17 07:06:03.420748 2026] [:error] [pid 59060:tid 59082] [client 217.182.195.233:54536] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agj4W_vwvq3bndkPE4nImwAAAA0"]
[Sun May 17 07:06:05.431311 2026] [:error] [pid 59060:tid 59084] [client 217.182.195.233:54548] [client 217.182.195.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agj4Xfvwvq3bndkPE4nIngAAAA8"]
[Sun May 17 08:32:35.496744 2026] [:error] [pid 17234:tid 17250] [client 101.42.46.71:42320] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agkMo9J4QOrYRCeDR2gJTAAAAU4"]
[Sun May 17 11:02:58.820570 2026] [:error] [pid 59062:tid 59126] [client 92.118.39.29:52770] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "agkv4j4V9GkVWmCFmGbVGQAAAIM"]
[Sun May 17 11:53:16.362423 2026] [:error] [pid 36652:tid 36662] [client 43.156.18.240:55908] [client 43.156.18.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agk7rDZrzQadnZADvj8_qwAAAQg"]
[Sun May 17 13:03:23.598966 2026] [:error] [pid 59166:tid 59192] [client 192.96.159.129:64053] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "aglMG0_puQ1I47_0UrjbBwAAANg"]
[Sun May 17 17:07:15.636092 2026] [:error] [pid 17234:tid 17239] [client 43.159.143.139:39184] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agmFQ9J4QOrYRCeDR2hPbAAAAUM"]
[Sun May 17 17:26:19.542069 2026] [:error] [pid 59060:tid 59087] [client 135.181.213.219:34538] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agmJu_vwvq3bndkPE4nplwAAABI"]
[Sun May 17 17:26:21.547147 2026] [:error] [pid 17234:tid 17254] [client 135.181.213.219:24246] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agmJvdJ4QOrYRCeDR2hQXgAAAVI"]
[Sun May 17 17:26:24.124243 2026] [:error] [pid 59166:tid 59190] [client 135.181.213.219:35560] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agmJwE_puQ1I47_0UrjnCgAAANY"]
[Sun May 17 17:26:26.135153 2026] [:error] [pid 10834:tid 10860] [client 135.181.213.219:24250] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agmJwhISNQ_Nf83-VpqcswAAAc4"]
[Sun May 17 17:26:28.044074 2026] [:error] [pid 10834:tid 10863] [client 135.181.213.219:24254] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agmJxBISNQ_Nf83-VpqctgAAAdE"]
[Sun May 17 17:26:30.451478 2026] [:error] [pid 59166:tid 59188] [client 135.181.213.219:63004] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agmJxk_puQ1I47_0UrjnDQAAANQ"]
[Sun May 17 17:26:32.429149 2026] [:error] [pid 59062:tid 59126] [client 135.181.213.219:28158] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agmJyD4V9GkVWmCFmGYEEwAAAIM"]
[Sun May 17 17:26:34.986689 2026] [:error] [pid 59062:tid 59129] [client 135.181.213.219:63010] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agmJyj4V9GkVWmCFmGYEGwAAAIY"]
[Sun May 17 17:26:37.053897 2026] [:error] [pid 59166:tid 59178] [client 135.181.213.219:28170] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agmJzU_puQ1I47_0UrjnDgAAAMo"]
[Sun May 17 17:26:39.101224 2026] [:error] [pid 59062:tid 59125] [client 135.181.213.219:28180] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agmJzz4V9GkVWmCFmGYEJAAAAII"]
[Sun May 17 17:26:41.029724 2026] [:error] [pid 10784:tid 10809] [client 135.181.213.219:14092] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agmJ0WBWRlKsFkSZGxA9VQAAAYo"]
[Sun May 17 17:26:43.068090 2026] [:error] [pid 59062:tid 59143] [client 135.181.213.219:14104] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agmJ0z4V9GkVWmCFmGYEKwAAAJQ"]
[Sun May 17 17:26:45.082485 2026] [:error] [pid 10834:tid 10869] [client 135.181.213.219:14112] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agmJ1RISNQ_Nf83-Vpqc3QAAAdc"]
[Sun May 17 17:26:47.104640 2026] [:error] [pid 59062:tid 59126] [client 135.181.213.219:14120] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agmJ1z4V9GkVWmCFmGYELAAAAIM"]
[Sun May 17 17:26:49.671454 2026] [:error] [pid 10835:tid 10891] [client 135.181.213.219:53562] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agmJ2Uk8lW0-dtknLl8OxwAAAhI"]
[Sun May 17 17:26:52.316734 2026] [:error] [pid 59060:tid 59081] [client 135.181.213.219:36134] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agmJ3Pvwvq3bndkPE4npnAAAAAw"]
[Sun May 17 17:26:54.378265 2026] [:error] [pid 59062:tid 59128] [client 135.181.213.219:51340] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agmJ3j4V9GkVWmCFmGYELwAAAIU"]
[Sun May 17 17:26:58.165939 2026] [:error] [pid 59061:tid 59099] [client 135.181.213.219:51344] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agmJ4oYS410zAmsYkoIhXAAAAEM"]
[Sun May 17 17:52:06.417830 2026] [:error] [pid 11079:tid 11120] [client 43.133.69.37:44464] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agmPxmeR3-DrxhvUqxHXSAAAAlA"]
[Sun May 17 18:40:12.454400 2026] [:error] [pid 59062:tid 59146] [client 65.108.78.33:50454] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agmbDD4V9GkVWmCFmGYOdwAAAJc"]
[Sun May 17 18:40:15.358189 2026] [:error] [pid 10835:tid 10886] [client 65.108.78.33:40716] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agmbD0k8lW0-dtknLl8X3QAAAg0"]
[Sun May 17 18:40:19.322285 2026] [:error] [pid 59062:tid 59138] [client 65.108.78.33:40726] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agmbEz4V9GkVWmCFmGYOjQAAAI8"]
[Sun May 17 20:02:22.257208 2026] [:error] [pid 59060:tid 59082] [client 62.113.117.240:47204] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agmuTvvwvq3bndkPE4nx7wAAAA0"]
[Sun May 17 20:02:25.854573 2026] [:error] [pid 11079:tid 11126] [client 62.113.117.240:46668] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agmuUWeR3-DrxhvUqxHw_wAAAlY"]
[Sun May 17 20:02:29.417515 2026] [:error] [pid 59062:tid 59144] [client 62.113.117.240:46684] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agmuVT4V9GkVWmCFmGYcMAAAAJU"]
[Sun May 17 20:02:35.348655 2026] [:error] [pid 10834:tid 10850] [client 62.113.117.240:52852] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agmuWxISNQ_Nf83-VpqqVgAAAcQ"]
[Sun May 17 20:02:39.085259 2026] [:error] [pid 11079:tid 11114] [client 62.113.117.240:52866] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agmuX2eR3-DrxhvUqxHxAgAAAko"]
[Sun May 17 20:02:42.818087 2026] [:error] [pid 11079:tid 11117] [client 62.113.117.240:44546] [client 62.113.117.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agmuYmeR3-DrxhvUqxHxBQAAAk0"]
[Sun May 17 20:57:46.782943 2026] [:error] [pid 59062:tid 59146] [client 193.70.46.38:53982] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agm7Sj4V9GkVWmCFmGYnvwAAAJc"]
[Sun May 17 20:57:49.289332 2026] [:error] [pid 10834:tid 10861] [client 193.70.46.38:36092] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agm7TRISNQ_Nf83-Vpqw4gAAAc8"]
[Sun May 17 20:57:51.563845 2026] [:error] [pid 59166:tid 59177] [client 193.70.46.38:36108] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agm7T0_puQ1I47_0UrjxHgAAAMk"]
[Sun May 17 20:57:53.976028 2026] [:error] [pid 59061:tid 59112] [client 193.70.46.38:51570] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agm7UYYS410zAmsYkoIuQQAAAFA"]
[Sun May 17 20:57:56.396784 2026] [:error] [pid 10834:tid 10867] [client 193.70.46.38:51584] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agm7VBISNQ_Nf83-Vpqw5wAAAdU"]
[Sun May 17 20:57:58.784330 2026] [:error] [pid 59062:tid 59138] [client 193.70.46.38:51588] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agm7Vj4V9GkVWmCFmGYnwwAAAI8"]
[Sun May 17 20:58:01.102749 2026] [:error] [pid 59062:tid 59141] [client 193.70.46.38:51600] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agm7WT4V9GkVWmCFmGYnyAAAAJI"]
[Sun May 17 20:58:03.474216 2026] [:error] [pid 10835:tid 10894] [client 193.70.46.38:57342] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agm7W0k8lW0-dtknLl8quwAAAhU"]
[Sun May 17 20:58:05.384682 2026] [:error] [pid 10835:tid 10886] [client 193.70.46.38:51030] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agm7XUk8lW0-dtknLl8qvgAAAg0"]
[Sun May 17 20:58:07.779548 2026] [:error] [pid 17234:tid 17240] [client 193.70.46.38:57354] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agm7X9J4QOrYRCeDR2hecAAAAUQ"]
[Sun May 17 20:58:10.185432 2026] [:error] [pid 17234:tid 17254] [client 193.70.46.38:57362] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agm7YtJ4QOrYRCeDR2hedAAAAVI"]
[Sun May 17 20:58:12.228109 2026] [:error] [pid 59062:tid 59139] [client 193.70.46.38:51038] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agm7ZD4V9GkVWmCFmGYn4gAAAJA"]
[Sun May 17 20:58:14.007273 2026] [:error] [pid 11079:tid 11101] [client 193.70.46.38:50358] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agm7ZmeR3-DrxhvUqxH6xAAAAkE"]
[Sun May 17 20:58:15.909307 2026] [:error] [pid 59062:tid 59136] [client 193.70.46.38:50372] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agm7Zz4V9GkVWmCFmGYn7gAAAI0"]
[Sun May 17 20:58:17.803413 2026] [:error] [pid 10835:tid 10879] [client 193.70.46.38:50378] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agm7aUk8lW0-dtknLl8q0QAAAgY"]
[Sun May 17 20:58:19.729399 2026] [:error] [pid 10784:tid 10800] [client 193.70.46.38:50388] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agm7a2BWRlKsFkSZGxBM1AAAAYE"]
[Sun May 17 20:58:21.625607 2026] [:error] [pid 11079:tid 11114] [client 193.70.46.38:50398] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agm7bWeR3-DrxhvUqxH6zwAAAko"]
[Sun May 17 20:58:23.528590 2026] [:error] [pid 59060:tid 59080] [client 193.70.46.38:52816] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agm7b_vwvq3bndkPE4n0vQAAAAs"]
[Sun May 17 20:58:25.442056 2026] [:error] [pid 10835:tid 10897] [client 193.70.46.38:52832] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agm7cUk8lW0-dtknLl8q3wAAAhg"]
[Sun May 17 20:58:27.344846 2026] [:error] [pid 59062:tid 59143] [client 193.70.46.38:52840] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agm7cz4V9GkVWmCFmGYn9AAAAJQ"]
[Sun May 17 20:58:29.407471 2026] [:error] [pid 11079:tid 11101] [client 193.70.46.38:52854] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agm7dWeR3-DrxhvUqxH6-wAAAkE"]
[Sun May 17 20:58:31.322754 2026] [:error] [pid 10834:tid 10853] [client 193.70.46.38:52870] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agm7dxISNQ_Nf83-VpqxDgAAAcc"]
[Sun May 17 20:58:33.226084 2026] [:error] [pid 10834:tid 10869] [client 193.70.46.38:56460] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agm7eRISNQ_Nf83-VpqxDwAAAdc"]
[Sun May 17 20:58:35.113372 2026] [:error] [pid 10835:tid 10887] [client 193.70.46.38:56466] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agm7e0k8lW0-dtknLl8rCQAAAg4"]
[Sun May 17 20:58:37.014881 2026] [:error] [pid 10784:tid 10822] [client 193.70.46.38:56478] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agm7fWBWRlKsFkSZGxBM1wAAAZY"]
[Sun May 17 20:58:38.917950 2026] [:error] [pid 10784:tid 10816] [client 193.70.46.38:56482] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agm7fmBWRlKsFkSZGxBM2wAAAZA"]
[Sun May 17 20:58:40.809330 2026] [:error] [pid 59062:tid 59145] [client 193.70.46.38:56490] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agm7gD4V9GkVWmCFmGYoAgAAAJY"]
[Sun May 17 20:58:43.488925 2026] [:error] [pid 11079:tid 11101] [client 193.70.46.38:58398] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agm7g2eR3-DrxhvUqxH7BwAAAkE"]
[Sun May 17 21:47:24.587887 2026] [:error] [pid 59062:tid 59127] [client 43.134.36.238:33466] [client 43.134.36.238] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agnG7D4V9GkVWmCFmGYybQAAAIQ"]
[Sun May 17 22:31:12.841882 2026] [:error] [pid 17234:tid 17238] [client 129.226.94.52:47792] [client 129.226.94.52] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agnRMNJ4QOrYRCeDR2hkjAAAAUI"]
[Sun May 17 23:01:25.459764 2026] [:error] [pid 36652:tid 36662] [client 65.108.78.33:45178] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agnYRTZrzQadnZADvj9gdQAAAQg"]
[Sun May 17 23:01:28.113111 2026] [:error] [pid 59061:tid 59097] [client 65.108.78.33:45194] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agnYSIYS410zAmsYkoI16wAAAEE"]
[Sun May 17 23:01:30.622688 2026] [:error] [pid 10834:tid 10857] [client 65.108.78.33:45210] [client 65.108.78.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agnYShISNQ_Nf83-Vpq7pAAAAcs"]
[Mon May 18 01:21:46.679320 2026] [:error] [pid 17234:tid 17245] [client 179.125.141.164:43951] [client 179.125.141.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.125.141.164, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agn5KtJ4QOrYRCeDR2humgAAAUk"]
[Mon May 18 01:21:46.690481 2026] [proxy_fcgi:error] [pid 17234:tid 17245] [client 179.125.141.164:43951] AH01071: Got error 'Primary script unknown'
[Mon May 18 01:48:44.425786 2026] [:error] [pid 10835:tid 10874] [client 51.83.7.81:52088] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agn_fEk8lW0-dtknLl9KEwAAAgE"]
[Mon May 18 01:48:46.337387 2026] [:error] [pid 10835:tid 10883] [client 51.83.7.81:50598] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agn_fkk8lW0-dtknLl9KFwAAAgo"]
[Mon May 18 01:48:48.224787 2026] [:error] [pid 59062:tid 59135] [client 51.83.7.81:50612] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agn_gD4V9GkVWmCFmGZeqwAAAIw"]
[Mon May 18 01:48:50.081211 2026] [:error] [pid 17234:tid 17259] [client 51.83.7.81:50620] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agn_gtJ4QOrYRCeDR2hwXgAAAVc"]
[Mon May 18 01:48:52.120894 2026] [:error] [pid 10834:tid 10857] [client 51.83.7.81:35960] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agn_hBISNQ_Nf83-VprIwgAAAcs"]
[Mon May 18 01:48:53.931931 2026] [:error] [pid 59061:tid 59116] [client 51.83.7.81:35968] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agn_hYYS410zAmsYkoI9mQAAAFQ"]
[Mon May 18 01:48:55.868217 2026] [:error] [pid 10784:tid 10820] [client 51.83.7.81:35980] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agn_h2BWRlKsFkSZGxBfJQAAAZQ"]
[Mon May 18 01:48:57.817938 2026] [:error] [pid 11079:tid 11118] [client 51.83.7.81:35988] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agn_iWeR3-DrxhvUqxEh8wAAAk4"]
[Mon May 18 01:48:59.792591 2026] [:error] [pid 10835:tid 10893] [client 51.83.7.81:36002] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agn_i0k8lW0-dtknLl9KJgAAAhQ"]
[Mon May 18 01:49:01.571009 2026] [:error] [pid 59166:tid 59188] [client 51.83.7.81:36014] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agn_jU_puQ1I47_0Urj8tAAAANQ"]
[Mon May 18 01:49:03.548352 2026] [:error] [pid 59062:tid 59133] [client 51.83.7.81:57784] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agn_jz4V9GkVWmCFmGZetwAAAIo"]
[Mon May 18 01:49:05.476771 2026] [:error] [pid 59166:tid 59185] [client 51.83.7.81:57788] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agn_kU_puQ1I47_0Urj8tQAAANE"]
[Mon May 18 01:49:07.405769 2026] [:error] [pid 17234:tid 17256] [client 51.83.7.81:57802] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agn_k9J4QOrYRCeDR2hwZgAAAVQ"]
[Mon May 18 01:49:09.210445 2026] [:error] [pid 10784:tid 10821] [client 51.83.7.81:57818] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agn_lWBWRlKsFkSZGxBfJwAAAZU"]
[Mon May 18 01:49:11.121603 2026] [:error] [pid 59062:tid 59127] [client 51.83.7.81:57834] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agn_lz4V9GkVWmCFmGZeuAAAAIQ"]
[Mon May 18 01:49:12.925842 2026] [:error] [pid 59062:tid 59143] [client 51.83.7.81:60090] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agn_mD4V9GkVWmCFmGZevwAAAJQ"]
[Mon May 18 01:49:14.992003 2026] [:error] [pid 59061:tid 59113] [client 51.83.7.81:60106] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agn_moYS410zAmsYkoI9oAAAAFE"]
[Mon May 18 01:49:16.907025 2026] [:error] [pid 17234:tid 17240] [client 51.83.7.81:60110] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agn_nNJ4QOrYRCeDR2hwcAAAAUQ"]
[Mon May 18 01:49:18.843404 2026] [:error] [pid 10834:tid 10846] [client 51.83.7.81:60114] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agn_nhISNQ_Nf83-VprIxQAAAcA"]
[Mon May 18 01:49:20.607325 2026] [:error] [pid 10834:tid 10869] [client 51.83.7.81:60118] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agn_oBISNQ_Nf83-VprIyQAAAdc"]
[Mon May 18 01:49:22.545069 2026] [:error] [pid 17234:tid 17253] [client 51.83.7.81:38382] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agn_otJ4QOrYRCeDR2hwcwAAAVE"]
[Mon May 18 01:49:24.467000 2026] [:error] [pid 17234:tid 17241] [client 51.83.7.81:38394] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agn_pNJ4QOrYRCeDR2hwdgAAAUU"]
[Mon May 18 01:49:26.560749 2026] [:error] [pid 11079:tid 11103] [client 51.83.7.81:38404] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agn_pmeR3-DrxhvUqxEiFAAAAkM"]
[Mon May 18 01:49:28.458776 2026] [:error] [pid 11079:tid 11115] [client 51.83.7.81:38410] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agn_qGeR3-DrxhvUqxEiFgAAAks"]
[Mon May 18 01:49:30.567972 2026] [:error] [pid 10835:tid 10886] [client 51.83.7.81:38424] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agn_qkk8lW0-dtknLl9KMwAAAg0"]
[Mon May 18 01:49:32.643150 2026] [:error] [pid 10835:tid 10880] [client 51.83.7.81:53602] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agn_rEk8lW0-dtknLl9KNwAAAgc"]
[Mon May 18 02:05:06.733648 2026] [:error] [pid 59062:tid 59125] [client 117.27.97.241:44040] [client 117.27.97.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agoDUj4V9GkVWmCFmGZhGgAAAII"], referer: http://www.switchcreative.net/
[Mon May 18 03:55:42.139430 2026] [:error] [pid 20884:tid 20886] [client 101.33.81.73:53320] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agodPnv9K_lRldrJG3OcJgAAAMA"]
[Mon May 18 04:52:18.345122 2026] [:error] [pid 20884:tid 20897] [client 183.199.186.107:13044] [client 183.199.186.107] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agoqgnv9K_lRldrJG3OodgAAAMs"], referer: http://switchcreative.net/
[Mon May 18 06:34:43.012722 2026] [proxy_fcgi:error] [pid 20884:tid 20905] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:43.329647 2026] [proxy_fcgi:error] [pid 20884:tid 20910] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:43.644721 2026] [proxy_fcgi:error] [pid 20884:tid 20892] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:43.957845 2026] [proxy_fcgi:error] [pid 20884:tid 20908] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:44.274420 2026] [proxy_fcgi:error] [pid 20884:tid 20886] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:44.591603 2026] [proxy_fcgi:error] [pid 20884:tid 20901] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:44.904531 2026] [proxy_fcgi:error] [pid 20884:tid 20903] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:45.530419 2026] [proxy_fcgi:error] [pid 20884:tid 20900] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:45.882571 2026] [proxy_fcgi:error] [pid 20884:tid 20902] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:46.197590 2026] [proxy_fcgi:error] [pid 20884:tid 20899] [client 20.226.33.48:1854] AH01071: Got error 'Primary script unknown'
[Mon May 18 06:34:46.509038 2026] [:error] [pid 20884:tid 20890] [client 20.226.33.48:1854] [client 20.226.33.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agpChnv9K_lRldrJG3O7owAAAMQ"]
[Mon May 18 06:34:53.433386 2026] [:error] [pid 63115:tid 63131] [client 20.226.33.48:8983] [client 20.226.33.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agpCjez_ApFcYdejvGf55wAAAQ4"]
[Mon May 18 06:34:58.175090 2026] [:error] [pid 20778:tid 20830] [client 20.226.33.48:8998] [client 20.226.33.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agpCkmb9K2_TPGoCpAr4xQAAAEw"]
[Mon May 18 08:22:34.037656 2026] [:error] [pid 48687:tid 48738] [client 43.160.240.216:45048] [client 43.160.240.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agpbyjcdaF2jmdvMWAodHAAAAdU"]
[Mon May 18 10:04:31.658322 2026] [:error] [pid 44087:tid 44090] [client 129.211.172.249:44394] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agpzr25HPHbH9GK7l6zCNQAAAcE"]
[Mon May 18 10:54:51.389596 2026] [:error] [pid 44087:tid 44104] [client 54.37.252.130:59656] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agp_e25HPHbH9GK7l6zFcgAAAc8"]
[Mon May 18 10:54:55.013320 2026] [:error] [pid 36492:tid 36543] [client 54.37.252.130:41234] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agp_f2CVlogrkn9m2w5uiwAAABU"]
[Mon May 18 10:54:56.847642 2026] [:error] [pid 36491:tid 36510] [client 54.37.252.130:41246] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agp_gE555B9CZb6D60l1TAAAAU8"]
[Mon May 18 10:54:59.326928 2026] [:error] [pid 36491:tid 36498] [client 54.37.252.130:33054] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agp_g0555B9CZb6D60l1TwAAAUM"]
[Mon May 18 10:55:01.285690 2026] [:error] [pid 36493:tid 36556] [client 54.37.252.130:41900] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agp_hQynkzQB5nM668qOWAAAAQc"]
[Mon May 18 10:55:03.767466 2026] [:error] [pid 36491:tid 36506] [client 54.37.252.130:33060] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "agp_h0555B9CZb6D60l1UwAAAUs"]
[Mon May 18 10:55:05.728459 2026] [:error] [pid 44087:tid 44089] [client 54.37.252.130:41914] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agp_iW5HPHbH9GK7l6zFcwAAAcA"]
[Mon May 18 10:55:07.713993 2026] [:error] [pid 36579:tid 36596] [client 54.37.252.130:40382] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "agp_i1-aoZxBfgL5vDwz7AAAAE4"]
[Mon May 18 10:55:09.694012 2026] [:error] [pid 36492:tid 36531] [client 54.37.252.130:40394] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "agp_jWCVlogrkn9m2w5ulQAAAAk"]
[Mon May 18 10:55:11.678156 2026] [:error] [pid 43916:tid 43946] [client 54.37.252.130:40410] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "agp_j9QC236p33zJJvmsagAAAJY"]
[Mon May 18 10:55:13.657878 2026] [:error] [pid 36491:tid 36500] [client 54.37.252.130:40424] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "agp_kU555B9CZb6D60l1WwAAAUU"]
[Mon May 18 10:55:15.663588 2026] [:error] [pid 36492:tid 36533] [client 54.37.252.130:40426] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agp_k2CVlogrkn9m2w5unwAAAAs"]
[Mon May 18 10:55:18.135583 2026] [:error] [pid 36579:tid 36595] [client 54.37.252.130:36692] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "agp_ll-aoZxBfgL5vDwz_wAAAE0"]
[Mon May 18 10:55:20.566980 2026] [:error] [pid 43916:tid 43931] [client 54.37.252.130:36704] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agp_mNQC236p33zJJvmscwAAAIc"]
[Mon May 18 10:55:23.349996 2026] [:error] [pid 36492:tid 36540] [client 54.37.252.130:53986] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agp_m2CVlogrkn9m2w5uogAAABI"]
[Mon May 18 10:55:27.118674 2026] [:error] [pid 44010:tid 44023] [client 54.37.252.130:53998] [client 54.37.252.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agp_nzcFUuogD3-74-ZXRgAAAMs"]
[Mon May 18 12:10:43.122289 2026] [:error] [pid 36579:tid 36602] [client 147.135.252.177:47034] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agqRQ1-aoZxBfgL5vDxFmQAAAFQ"]
[Mon May 18 12:10:45.799946 2026] [:error] [pid 36493:tid 36550] [client 147.135.252.177:56300] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqRRQynkzQB5nM668qYYQAAAQE"]
[Mon May 18 12:10:49.609842 2026] [:error] [pid 36491:tid 36503] [client 147.135.252.177:56302] [client 147.135.252.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqRSU555B9CZb6D60mBwAAAAUg"]
[Mon May 18 13:24:39.056808 2026] [:error] [pid 36579:tid 36603] [client 81.167.26.57:42357] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agqil1-aoZxBfgL5vDxcWQAAAFU"]
[Mon May 18 13:24:42.853125 2026] [:error] [pid 36492:tid 36538] [client 81.167.26.57:20413] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agqimmCVlogrkn9m2w6L3gAAABA"]
[Mon May 18 13:24:45.309460 2026] [:error] [pid 36492:tid 36526] [client 81.167.26.57:42591] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agqinWCVlogrkn9m2w6L4AAAAAQ"]
[Mon May 18 13:24:49.837161 2026] [:error] [pid 44010:tid 44025] [client 81.167.26.57:6780] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "agqioTcFUuogD3-74-ZhZwAAAM0"]
[Mon May 18 13:25:44.256905 2026] [:error] [pid 44046:tid 44049] [client 81.167.26.57:36864] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqi2IYF4k2jfXJBXk3eNQAAAYE"]
[Mon May 18 13:25:48.234546 2026] [:error] [pid 36579:tid 36591] [client 81.167.26.57:17213] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqi3F-aoZxBfgL5vDxciAAAAEk"]
[Mon May 18 14:31:36.586076 2026] [:error] [pid 44087:tid 44092] [client 217.182.139.33:49312] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agqySG5HPHbH9GK7l6za3QAAAcM"]
[Mon May 18 14:31:38.901907 2026] [:error] [pid 44087:tid 44103] [client 217.182.139.33:54716] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agqySm5HPHbH9GK7l6za4AAAAc4"]
[Mon May 18 14:31:41.237744 2026] [:error] [pid 36491:tid 36496] [client 217.182.139.33:54718] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agqyTU555B9CZb6D60mYEQAAAUE"]
[Mon May 18 14:31:43.197265 2026] [:error] [pid 44010:tid 44029] [client 217.182.139.33:55042] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agqyTzcFUuogD3-74-ZldAAAANE"]
[Mon May 18 14:31:44.942307 2026] [:error] [pid 36492:tid 36546] [client 217.182.139.33:55058] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agqyUGCVlogrkn9m2w6ciwAAABg"]
[Mon May 18 14:31:46.852618 2026] [:error] [pid 44010:tid 44032] [client 217.182.139.33:55060] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agqyUjcFUuogD3-74-ZldgAAANQ"]
[Mon May 18 14:31:48.744244 2026] [:error] [pid 43916:tid 43928] [client 217.182.139.33:55072] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agqyVNQC236p33zJJvm6RAAAAIQ"]
[Mon May 18 14:31:50.652609 2026] [:error] [pid 44046:tid 44062] [client 217.182.139.33:55088] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agqyVoYF4k2jfXJBXk3jIAAAAY4"]
[Mon May 18 14:31:52.590173 2026] [:error] [pid 36579:tid 36590] [client 217.182.139.33:55094] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agqyWF-aoZxBfgL5vDxp-AAAAEg"]
[Mon May 18 14:31:54.478350 2026] [:error] [pid 36491:tid 36501] [client 217.182.139.33:35936] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agqyWk555B9CZb6D60mYGAAAAUY"]
[Mon May 18 14:31:56.382075 2026] [:error] [pid 44046:tid 44071] [client 217.182.139.33:35940] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agqyXIYF4k2jfXJBXk3jJAAAAZc"]
[Mon May 18 14:31:58.273863 2026] [:error] [pid 36491:tid 36519] [client 217.182.139.33:35950] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agqyXk555B9CZb6D60mYGwAAAVg"]
[Mon May 18 14:32:00.142332 2026] [:error] [pid 36492:tid 36546] [client 217.182.139.33:35962] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agqyYGCVlogrkn9m2w6cnAAAABg"]
[Mon May 18 14:32:02.190866 2026] [:error] [pid 36491:tid 36517] [client 217.182.139.33:35976] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agqyYk555B9CZb6D60mYJAAAAVY"]
[Mon May 18 14:32:04.072642 2026] [:error] [pid 36579:tid 36588] [client 217.182.139.33:42904] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agqyZF-aoZxBfgL5vDxp_gAAAEY"]
[Mon May 18 14:32:06.102569 2026] [:error] [pid 36493:tid 36556] [client 217.182.139.33:42920] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agqyZgynkzQB5nM668qoFwAAAQc"]
[Mon May 18 14:32:08.018871 2026] [:error] [pid 44010:tid 44018] [client 217.182.139.33:42922] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agqyaDcFUuogD3-74-ZlgwAAAMY"]
[Mon May 18 14:32:10.055167 2026] [:error] [pid 36579:tid 36592] [client 217.182.139.33:42932] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agqyal-aoZxBfgL5vDxqAgAAAEo"]
[Mon May 18 14:32:12.108767 2026] [:error] [pid 36579:tid 36589] [client 217.182.139.33:42934] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agqybF-aoZxBfgL5vDxqBQAAAEc"]
[Mon May 18 14:32:13.991412 2026] [:error] [pid 44087:tid 44108] [client 217.182.139.33:43084] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agqybW5HPHbH9GK7l6za7QAAAdM"]
[Mon May 18 14:32:16.880088 2026] [:error] [pid 36492:tid 36532] [client 217.182.139.33:43094] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqycGCVlogrkn9m2w6coQAAAAo"]
[Mon May 18 14:32:20.735074 2026] [:error] [pid 36493:tid 36566] [client 217.182.139.33:43100] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agqydAynkzQB5nM668qoGwAAARE"]
[Mon May 18 14:41:35.590265 2026] [:error] [pid 44010:tid 44028] [client 34.181.176.117:51098] [client 34.181.176.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.176.117, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agq0nzcFUuogD3-74-ZmTwAAANA"]
[Mon May 18 14:41:35.600319 2026] [proxy_fcgi:error] [pid 44010:tid 44028] [client 34.181.176.117:51098] AH01071: Got error 'Primary script unknown'
[Mon May 18 14:41:38.356487 2026] [:error] [pid 44010:tid 44027] [client 34.181.176.117:51098] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "agq0ojcFUuogD3-74-ZmWgAAAM8"]
[Mon May 18 14:41:38.803465 2026] [:error] [pid 36492:tid 36529] [client 34.181.176.117:64400] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "agq0omCVlogrkn9m2w6fcwAAAAc"]
[Mon May 18 14:41:39.288754 2026] [:error] [pid 44087:tid 44109] [client 34.181.176.117:61281] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "agq0o25HPHbH9GK7l6zb0wAAAdQ"]
[Mon May 18 14:41:39.723388 2026] [:error] [pid 36579:tid 36595] [client 34.181.176.117:55648] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "agq0o1-aoZxBfgL5vDxrEwAAAE0"]
[Mon May 18 14:41:40.213726 2026] [:error] [pid 36491:tid 36514] [client 34.181.176.117:65363] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "agq0pE555B9CZb6D60mZwAAAAVM"]
[Mon May 18 14:41:40.645230 2026] [:error] [pid 36491:tid 36499] [client 34.181.176.117:50038] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "agq0pE555B9CZb6D60mZwQAAAUQ"]
[Mon May 18 14:41:41.112578 2026] [:error] [pid 44010:tid 44012] [client 34.181.176.117:63363] [client 34.181.176.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "agq0pTcFUuogD3-74-ZmWwAAAMA"]
[Mon May 18 16:14:40.803918 2026] [:error] [pid 43916:tid 43933] [client 147.135.252.145:44814] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agrKcNQC236p33zJJvm_-gAAAIk"]
[Mon May 18 16:14:43.751164 2026] [:error] [pid 36491:tid 36517] [client 147.135.252.145:49410] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "agrKc0555B9CZb6D60mqBQAAAVY"]
[Mon May 18 16:14:47.244640 2026] [:error] [pid 36491:tid 36511] [client 147.135.252.145:49424] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agrKd0555B9CZb6D60mqCQAAAVA"]
[Mon May 18 17:55:42.827601 2026] [:error] [pid 36492:tid 36535] [client 147.135.212.151:36058] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agriHmCVlogrkn9m2w7KSgAAAA0"]
[Mon May 18 17:55:44.707364 2026] [:error] [pid 44046:tid 44053] [client 147.135.212.151:56964] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agriIIYF4k2jfXJBXk3yFgAAAYU"]
[Mon May 18 17:55:47.291251 2026] [:error] [pid 36491:tid 36507] [client 147.135.212.151:40716] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agriI0555B9CZb6D60m4WgAAAUw"]
[Mon May 18 17:55:49.279384 2026] [:error] [pid 36493:tid 36555] [client 147.135.212.151:60706] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agriJQynkzQB5nM668q7hAAAAQY"]
[Mon May 18 17:55:51.190568 2026] [:error] [pid 44010:tid 44014] [client 147.135.212.151:60708] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agriJzcFUuogD3-74-ZxzgAAAMI"]
[Mon May 18 17:55:53.086889 2026] [:error] [pid 36579:tid 36600] [client 147.135.212.151:60714] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agriKV-aoZxBfgL5vDyCAQAAAFI"]
[Mon May 18 17:55:54.989959 2026] [:error] [pid 36493:tid 36552] [client 147.135.212.151:60716] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agriKgynkzQB5nM668q7igAAAQM"]
[Mon May 18 17:55:57.042755 2026] [:error] [pid 36492:tid 36526] [client 147.135.212.151:60722] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agriLWCVlogrkn9m2w7KVgAAAAQ"]
[Mon May 18 17:55:59.010016 2026] [:error] [pid 36492:tid 36544] [client 147.135.212.151:45070] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agriL2CVlogrkn9m2w7KWgAAABY"]
[Mon May 18 17:56:00.916604 2026] [:error] [pid 36492:tid 36546] [client 147.135.212.151:45074] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agriMGCVlogrkn9m2w7KYgAAABg"]
[Mon May 18 17:56:02.976408 2026] [:error] [pid 36491:tid 36502] [client 147.135.212.151:45086] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agriMk555B9CZb6D60m4agAAAUc"]
[Mon May 18 17:56:04.988676 2026] [:error] [pid 36491:tid 36517] [client 147.135.212.151:45100] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agriNE555B9CZb6D60m4awAAAVY"]
[Mon May 18 17:56:07.019844 2026] [:error] [pid 36493:tid 36567] [client 147.135.212.151:45108] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agriNwynkzQB5nM668q7mwAAARI"]
[Mon May 18 17:56:09.033858 2026] [:error] [pid 36493:tid 36573] [client 147.135.212.151:55422] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agriOQynkzQB5nM668q7nQAAARg"]
[Mon May 18 17:56:10.942121 2026] [:error] [pid 43916:tid 43939] [client 147.135.212.151:55424] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agriOtQC236p33zJJvnErwAAAI8"]
[Mon May 18 17:56:13.014301 2026] [:error] [pid 36493:tid 36563] [client 147.135.212.151:55432] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agriPQynkzQB5nM668q7owAAAQ4"]
[Mon May 18 17:56:14.914738 2026] [:error] [pid 44046:tid 44054] [client 147.135.212.151:55442] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agriPoYF4k2jfXJBXk3yGQAAAYY"]
[Mon May 18 17:56:16.948494 2026] [:error] [pid 44087:tid 44096] [client 147.135.212.151:55450] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agriQG5HPHbH9GK7l6zrDAAAAcc"]
[Mon May 18 17:56:18.982897 2026] [:error] [pid 44046:tid 44057] [client 147.135.212.151:50436] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agriQoYF4k2jfXJBXk3yHQAAAYk"]
[Mon May 18 17:56:21.007663 2026] [:error] [pid 44087:tid 44091] [client 147.135.212.151:50444] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agriRW5HPHbH9GK7l6zrDwAAAcI"]
[Mon May 18 17:56:22.920194 2026] [:error] [pid 36493:tid 36560] [client 147.135.212.151:50454] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agriRgynkzQB5nM668q7pwAAAQs"]
[Mon May 18 17:56:24.995518 2026] [:error] [pid 36579:tid 36601] [client 147.135.212.151:50462] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agriSF-aoZxBfgL5vDyCDQAAAFM"]
[Mon May 18 17:56:27.596378 2026] [:error] [pid 36492:tid 36542] [client 147.135.212.151:44606] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agriS2CVlogrkn9m2w7KagAAABQ"]
[Mon May 18 17:56:29.596691 2026] [:error] [pid 36492:tid 36544] [client 147.135.212.151:37612] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agriTWCVlogrkn9m2w7KcAAAABY"]
[Mon May 18 17:56:31.485439 2026] [:error] [pid 36492:tid 36537] [client 147.135.212.151:37620] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agriT2CVlogrkn9m2w7KdAAAAA8"]
[Mon May 18 17:56:34.065606 2026] [:error] [pid 36491:tid 36508] [client 147.135.212.151:60302] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agriUk555B9CZb6D60m4fAAAAU0"]
[Mon May 18 17:56:36.003548 2026] [:error] [pid 36492:tid 36538] [client 147.135.212.151:37624] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agriVGCVlogrkn9m2w7KdwAAABA"]
[Mon May 18 17:56:38.066959 2026] [:error] [pid 36579:tid 36587] [client 147.135.212.151:45130] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agriVl-aoZxBfgL5vDyCEQAAAEU"]
[Mon May 18 17:56:40.109242 2026] [:error] [pid 36491:tid 36504] [client 147.135.212.151:45136] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agriWE555B9CZb6D60m4hQAAAUk"]
[Mon May 18 17:57:02.069600 2026] [:error] [pid 36579:tid 36591] [client 147.135.212.151:56902] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agribl-aoZxBfgL5vDyCJAAAAEk"]
[Mon May 18 17:57:04.027154 2026] [:error] [pid 36493:tid 36551] [client 147.135.212.151:33812] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agricAynkzQB5nM668q7vAAAAQI"]
[Mon May 18 17:57:06.054535 2026] [:error] [pid 43916:tid 43924] [client 147.135.212.151:33818] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agrictQC236p33zJJvnEygAAAIA"]
[Mon May 18 17:57:08.078596 2026] [:error] [pid 36491:tid 36519] [client 147.135.212.151:40308] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agridE555B9CZb6D60m4qQAAAVg"]
[Mon May 18 17:57:10.062821 2026] [:error] [pid 36491:tid 36505] [client 147.135.212.151:40316] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agridk555B9CZb6D60m4sAAAAUo"]
[Mon May 18 17:57:12.095328 2026] [:error] [pid 36491:tid 36514] [client 147.135.212.151:40318] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agrieE555B9CZb6D60m4tAAAAVM"]
[Mon May 18 17:57:14.136719 2026] [:error] [pid 36492:tid 36523] [client 147.135.212.151:40330] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agriemCVlogrkn9m2w7KoQAAAAE"]
[Mon May 18 17:57:16.148856 2026] [:error] [pid 36491:tid 36501] [client 147.135.212.151:40342] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agrifE555B9CZb6D60m4ugAAAUY"]
[Mon May 18 17:57:18.128046 2026] [:error] [pid 36492:tid 36537] [client 147.135.212.151:50840] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agrifmCVlogrkn9m2w7KqwAAAA8"]
[Mon May 18 17:57:20.268129 2026] [:error] [pid 36492:tid 36528] [client 147.135.212.151:50842] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agrigGCVlogrkn9m2w7KsQAAAAY"]
[Mon May 18 17:57:22.265405 2026] [:error] [pid 36579:tid 36604] [client 147.135.212.151:50850] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agrigl-aoZxBfgL5vDyCKAAAAFY"]
[Mon May 18 17:57:24.289395 2026] [:error] [pid 36491:tid 36500] [client 147.135.212.151:50866] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agrihE555B9CZb6D60m4wAAAAUU"]
[Mon May 18 17:57:26.332660 2026] [:error] [pid 36491:tid 36501] [client 147.135.212.151:50868] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agrihk555B9CZb6D60m4wQAAAUY"]
[Mon May 18 17:57:28.211009 2026] [:error] [pid 44087:tid 44096] [client 147.135.212.151:59032] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agriiG5HPHbH9GK7l6zrIwAAAcc"]
[Mon May 18 17:57:30.223680 2026] [:error] [pid 36492:tid 36536] [client 147.135.212.151:59046] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agriimCVlogrkn9m2w7KtQAAAA4"]
[Mon May 18 17:57:32.257245 2026] [:error] [pid 43916:tid 43943] [client 147.135.212.151:59050] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agrijNQC236p33zJJvnEzwAAAJM"]
[Mon May 18 17:57:34.301633 2026] [:error] [pid 43916:tid 43945] [client 147.135.212.151:59058] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agrijtQC236p33zJJvnE0QAAAJU"]
[Mon May 18 17:57:36.190793 2026] [:error] [pid 36492:tid 36525] [client 147.135.212.151:59060] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agrikGCVlogrkn9m2w7KuwAAAAM"]
[Mon May 18 17:57:38.202496 2026] [:error] [pid 36491:tid 36496] [client 147.135.212.151:49122] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agrikk555B9CZb6D60m4xgAAAUE"]
[Mon May 18 17:57:40.224854 2026] [:error] [pid 36491:tid 36497] [client 147.135.212.151:49138] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agrilE555B9CZb6D60m4ywAAAUI"]
[Mon May 18 17:57:42.085591 2026] [:error] [pid 36493:tid 36562] [client 147.135.212.151:49148] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agrilgynkzQB5nM668q7zAAAAQ0"]
[Mon May 18 17:57:44.090195 2026] [:error] [pid 36493:tid 36560] [client 147.135.212.151:49156] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agrimAynkzQB5nM668q7zwAAAQs"]
[Mon May 18 17:57:46.118251 2026] [:error] [pid 44010:tid 44026] [client 147.135.212.151:49168] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agrimjcFUuogD3-74-Zx8AAAAM4"]
[Mon May 18 17:57:48.130271 2026] [:error] [pid 44087:tid 44093] [client 147.135.212.151:38694] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agrinG5HPHbH9GK7l6zrMAAAAcQ"]
[Mon May 18 17:57:50.142271 2026] [:error] [pid 36493:tid 36554] [client 147.135.212.151:38696] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agringynkzQB5nM668q70gAAAQU"]
[Mon May 18 17:57:52.138039 2026] [:error] [pid 36579:tid 36589] [client 147.135.212.151:38700] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agrioF-aoZxBfgL5vDyCPQAAAEc"]
[Mon May 18 17:57:54.214999 2026] [:error] [pid 44087:tid 44106] [client 147.135.212.151:38710] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agriom5HPHbH9GK7l6zrNwAAAdE"]
[Mon May 18 17:57:56.238192 2026] [:error] [pid 44087:tid 44091] [client 147.135.212.151:38720] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agripG5HPHbH9GK7l6zrOwAAAcI"]
[Mon May 18 17:57:58.241090 2026] [:error] [pid 36579:tid 36606] [client 147.135.212.151:37836] [client 147.135.212.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agripl-aoZxBfgL5vDyCTgAAAFg"]
[Mon May 18 18:14:09.929850 2026] [:error] [pid 36492:tid 36525] [client 88.216.36.40:20450] [client 88.216.36.40] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/x-shockwave-flash"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agrmcWCVlogrkn9m2w7O3gAAAAM"]
[Mon May 18 19:37:47.769107 2026] [:error] [pid 44046:tid 44070] [client 135.181.213.219:4714] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agr6C4YF4k2jfXJBXk35UAAAAZY"]
[Mon May 18 19:37:49.748959 2026] [:error] [pid 44087:tid 44102] [client 135.181.213.219:4722] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agr6DW5HPHbH9GK7l6zzTgAAAc0"]
[Mon May 18 19:37:51.722986 2026] [:error] [pid 36493:tid 36554] [client 135.181.213.219:28846] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agr6DwynkzQB5nM668rEGgAAAQU"]
[Mon May 18 19:37:53.563960 2026] [:error] [pid 36492:tid 36544] [client 135.181.213.219:28856] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agr6EWCVlogrkn9m2w7e_gAAABY"]
[Mon May 18 19:37:55.569770 2026] [:error] [pid 36492:tid 36526] [client 135.181.213.219:28866] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agr6E2CVlogrkn9m2w7fLAAAAAQ"]
[Mon May 18 19:37:57.569395 2026] [:error] [pid 44087:tid 44104] [client 135.181.213.219:28874] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agr6FW5HPHbH9GK7l6zzUQAAAc8"]
[Mon May 18 19:37:59.545690 2026] [:error] [pid 44087:tid 44106] [client 135.181.213.219:28886] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agr6F25HPHbH9GK7l6zzUgAAAdE"]
[Mon May 18 19:38:01.554990 2026] [:error] [pid 44046:tid 44059] [client 135.181.213.219:58062] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agr6GYYF4k2jfXJBXk35VgAAAYs"]
[Mon May 18 19:38:03.529017 2026] [:error] [pid 36491:tid 36510] [client 135.181.213.219:58068] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agr6G0555B9CZb6D60nGXgAAAU8"]
[Mon May 18 19:38:05.509832 2026] [:error] [pid 36492:tid 36543] [client 135.181.213.219:58074] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agr6HWCVlogrkn9m2w7fRAAAABU"]
[Mon May 18 19:38:07.346498 2026] [:error] [pid 36492:tid 36534] [client 135.181.213.219:58082] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agr6H2CVlogrkn9m2w7fSAAAAAw"]
[Mon May 18 19:38:09.323128 2026] [:error] [pid 36492:tid 36533] [client 135.181.213.219:58094] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agr6IWCVlogrkn9m2w7fSgAAAAs"]
[Mon May 18 19:38:11.313201 2026] [:error] [pid 36491:tid 36502] [client 135.181.213.219:63980] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agr6I0555B9CZb6D60nGYwAAAUc"]
[Mon May 18 19:38:13.279878 2026] [:error] [pid 36579:tid 36596] [client 135.181.213.219:63982] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agr6JV-aoZxBfgL5vDyNBQAAAE4"]
[Mon May 18 19:38:15.248070 2026] [:error] [pid 44046:tid 44065] [client 135.181.213.219:63994] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agr6J4YF4k2jfXJBXk35XAAAAZE"]
[Mon May 18 19:38:17.232200 2026] [:error] [pid 43916:tid 43943] [client 135.181.213.219:63998] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agr6KdQC236p33zJJvnKwAAAAJM"]
[Mon May 18 19:38:19.205678 2026] [:error] [pid 36579:tid 36586] [client 135.181.213.219:64014] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agr6K1-aoZxBfgL5vDyNBgAAAEQ"]
[Mon May 18 19:38:21.194714 2026] [:error] [pid 36491:tid 36496] [client 135.181.213.219:19838] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agr6LU555B9CZb6D60nG4QAAAUE"]
[Mon May 18 19:38:23.193393 2026] [:error] [pid 36493:tid 36557] [client 135.181.213.219:19844] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agr6LwynkzQB5nM668rERwAAAQg"]
[Mon May 18 19:38:25.177458 2026] [:error] [pid 44010:tid 44030] [client 135.181.213.219:19858] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agr6MTcFUuogD3-74-Z4DwAAANI"]
[Mon May 18 19:38:27.150624 2026] [:error] [pid 36491:tid 36512] [client 135.181.213.219:19868] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agr6M0555B9CZb6D60nG_gAAAVE"]
[Mon May 18 19:38:28.997609 2026] [:error] [pid 36492:tid 36526] [client 135.181.213.219:19876] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "agr6NGCVlogrkn9m2w7fXwAAAAQ"]
[Mon May 18 19:38:30.992627 2026] [:error] [pid 36493:tid 36568] [client 135.181.213.219:5136] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "agr6NgynkzQB5nM668rEZAAAARM"]
[Mon May 18 19:38:32.983850 2026] [:error] [pid 36491:tid 36514] [client 135.181.213.219:5140] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "agr6OE555B9CZb6D60nHDwAAAVM"]
[Mon May 18 19:38:34.849316 2026] [:error] [pid 36491:tid 36499] [client 135.181.213.219:5144] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "agr6Ok555B9CZb6D60nHEgAAAUQ"]
[Mon May 18 19:38:36.827278 2026] [:error] [pid 43916:tid 43948] [client 135.181.213.219:5152] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "agr6PNQC236p33zJJvnKxgAAAJg"]
[Mon May 18 19:45:56.782089 2026] [:error] [pid 36579:tid 36587] [client 170.106.181.163:49340] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agr79F-aoZxBfgL5vDyNqwAAAEU"]
[Mon May 18 23:47:47.592583 2026] [:error] [pid 43916:tid 43925] [client 43.155.129.131:40330] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ags0o9QC236p33zJJvnXHQAAAIE"]
[Mon May 18 23:55:30.513033 2026] [:error] [pid 36493:tid 36565] [client 94.204.125.118:60051] [client 94.204.125.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.204.125.118, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ags2cgynkzQB5nM668rYYwAAARA"]
[Mon May 18 23:55:30.523403 2026] [proxy_fcgi:error] [pid 36493:tid 36565] [client 94.204.125.118:60051] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:30:40.780551 2026] [:error] [pid 36491:tid 36517] [client 170.106.82.209:45146] [client 170.106.82.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ags-sE555B9CZb6D60nuTwAAAVY"]
[Tue May 19 00:35:13.518681 2026] [proxy_fcgi:error] [pid 36493:tid 36558] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:13.611638 2026] [proxy_fcgi:error] [pid 36493:tid 36551] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:13.798251 2026] [proxy_fcgi:error] [pid 36493:tid 36562] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:13.893031 2026] [proxy_fcgi:error] [pid 36493:tid 36557] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:14.106387 2026] [proxy_fcgi:error] [pid 36493:tid 36565] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:14.200906 2026] [proxy_fcgi:error] [pid 36493:tid 36564] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:14.293354 2026] [proxy_fcgi:error] [pid 36493:tid 36570] [client 20.212.159.166:2503] AH01071: Got error 'Primary script unknown'
[Tue May 19 00:35:14.590927 2026] [:error] [pid 36493:tid 36572] [client 20.212.159.166:2503] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ags_wgynkzQB5nM668rcvgAAARc"]
[Tue May 19 00:35:14.970687 2026] [:error] [pid 36493:tid 36555] [client 20.212.159.166:4731] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ags_wgynkzQB5nM668rcwAAAAQY"]
[Tue May 19 00:35:15.362779 2026] [:error] [pid 36579:tid 36593] [client 20.212.159.166:1436] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ags_w1-aoZxBfgL5vDyrfwAAAEs"]
[Tue May 19 00:35:15.789368 2026] [:error] [pid 36492:tid 36524] [client 20.212.159.166:1424] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "ags_w2CVlogrkn9m2w4aAgAAAAI"]
[Tue May 19 04:52:06.826390 2026] [:error] [pid 38705:tid 38773] [client 103.65.237.216:54665] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/sftp-config.json"] [unique_id "agt79sg5dNOZ5umN9lsNqwAAAIQ"]
[Tue May 19 04:52:07.104365 2026] [:error] [pid 38705:tid 38771] [client 103.65.237.216:54715] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.vscode/sftp.json"] [unique_id "agt798g5dNOZ5umN9lsNrAAAAII"]
[Tue May 19 04:59:19.502022 2026] [proxy_fcgi:error] [pid 38705:tid 38781] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:19.600247 2026] [proxy_fcgi:error] [pid 38705:tid 38776] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:19.786091 2026] [proxy_fcgi:error] [pid 38705:tid 38774] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:19.877748 2026] [proxy_fcgi:error] [pid 38705:tid 38771] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:20.070420 2026] [proxy_fcgi:error] [pid 38705:tid 38772] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:20.162420 2026] [proxy_fcgi:error] [pid 38705:tid 38779] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:20.254804 2026] [proxy_fcgi:error] [pid 38705:tid 38770] [client 20.212.159.166:4703] AH01071: Got error 'Primary script unknown'
[Tue May 19 04:59:20.526577 2026] [:error] [pid 38705:tid 38784] [client 20.212.159.166:4703] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "agt9qMg5dNOZ5umN9lsPeAAAAI8"]
[Tue May 19 04:59:20.883688 2026] [:error] [pid 38705:tid 38780] [client 20.212.159.166:1059] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "agt9qMg5dNOZ5umN9lsPeQAAAIs"]
[Tue May 19 04:59:21.285117 2026] [:error] [pid 38814:tid 38823] [client 20.212.159.166:1444] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "agt9qQvkKuBwP0epzWdHhAAAAMc"]
[Tue May 19 04:59:21.676291 2026] [:error] [pid 38814:tid 38829] [client 20.212.159.166:1417] [client 20.212.159.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ws.php"] [unique_id "agt9qQvkKuBwP0epzWdHhgAAAM0"]
[Tue May 19 06:03:19.074801 2026] [:error] [pid 38699:tid 38744] [client 49.80.91.73:23229] [client 49.80.91.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "aguMp7--Adsw_P-dthYsYwAAAEI"], referer: http://www.switchcreative.net/
[Tue May 19 07:34:10.520920 2026] [proxy_fcgi:error] [pid 38705:tid 38793] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:10.847880 2026] [proxy_fcgi:error] [pid 38705:tid 38792] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:11.134449 2026] [proxy_fcgi:error] [pid 38705:tid 38789] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:11.349800 2026] [proxy_fcgi:error] [pid 38705:tid 38788] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:11.571083 2026] [proxy_fcgi:error] [pid 38705:tid 38770] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:11.910325 2026] [proxy_fcgi:error] [pid 38705:tid 38783] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:12.299839 2026] [proxy_fcgi:error] [pid 38705:tid 38769] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:12.498515 2026] [proxy_fcgi:error] [pid 38705:tid 38779] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:12.710741 2026] [proxy_fcgi:error] [pid 38705:tid 38791] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:13.151113 2026] [proxy_fcgi:error] [pid 38705:tid 38776] [client 172.173.117.54:51647] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:34:13.354929 2026] [:error] [pid 38705:tid 38781] [client 172.173.117.54:51647] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pha.php"] [unique_id "aguh9cg5dNOZ5umN9lsmxwAAAIw"]
[Tue May 19 07:34:14.968422 2026] [:error] [pid 38697:tid 38732] [client 172.173.117.54:20148] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pha.php"] [unique_id "aguh9qXP9pP6Kgt-msS__QAAABE"]
[Tue May 19 07:34:17.172457 2026] [:error] [pid 38705:tid 38771] [client 172.173.117.54:20110] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pha.php"] [unique_id "aguh-cg5dNOZ5umN9lsmyAAAAII"]
[Tue May 19 07:34:19.988031 2026] [:error] [pid 38697:tid 38737] [client 172.173.117.54:62478] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pha.php"] [unique_id "aguh-6XP9pP6Kgt-msTAAAAAABY"]
[Tue May 19 07:34:22.573085 2026] [:error] [pid 46815:tid 46837] [client 172.173.117.54:6720] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c55cdler.php"] [unique_id "aguh_iPnRhJOmA06LgoHOgAAAVQ"]
[Tue May 19 07:34:23.419124 2026] [:error] [pid 38705:tid 38787] [client 172.173.117.54:20212] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c55cdler.php"] [unique_id "aguh_8g5dNOZ5umN9lsmzAAAAJI"]
[Tue May 19 07:34:25.397970 2026] [:error] [pid 46815:tid 46834] [client 172.173.117.54:20206] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c55cdler.php"] [unique_id "aguiASPnRhJOmA06LgoHPAAAAVE"]
[Tue May 19 07:34:26.980762 2026] [:error] [pid 38814:tid 38840] [client 172.173.117.54:51697] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/c55cdler.php"] [unique_id "aguiAgvkKuBwP0epzWdfUwAAANg"]
[Tue May 19 07:34:27.536741 2026] [:error] [pid 38697:tid 38733] [client 172.173.117.54:51678] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guiler.php"] [unique_id "aguiA6XP9pP6Kgt-msTACwAAABI"]
[Tue May 19 07:34:28.687522 2026] [:error] [pid 38814:tid 38827] [client 172.173.117.54:17231] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guiler.php"] [unique_id "aguiBAvkKuBwP0epzWdfVAAAAMs"]
[Tue May 19 07:34:30.704925 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:20160] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guiler.php"] [unique_id "aguiBqXP9pP6Kgt-msTADgAAAAM"]
[Tue May 19 07:34:31.610435 2026] [:error] [pid 41573:tid 41575] [client 172.173.117.54:17220] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/guiler.php"] [unique_id "aguiBy1A2bd6JDSW9RY-sQAAAQA"]
[Tue May 19 07:34:32.383346 2026] [:error] [pid 38814:tid 38821] [client 172.173.117.54:37765] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doko.php"] [unique_id "aguiCAvkKuBwP0epzWdfWQAAAMU"]
[Tue May 19 07:34:34.812771 2026] [:error] [pid 38814:tid 38826] [client 172.173.117.54:62499] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doko.php"] [unique_id "aguiCgvkKuBwP0epzWdfXQAAAMo"]
[Tue May 19 07:34:43.236715 2026] [:error] [pid 38814:tid 38817] [client 172.173.117.54:51676] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doko.php"] [unique_id "aguiEwvkKuBwP0epzWdfXwAAAME"]
[Tue May 19 07:34:45.324729 2026] [:error] [pid 38697:tid 38723] [client 172.173.117.54:43067] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/doko.php"] [unique_id "aguiFaXP9pP6Kgt-msTAEwAAAAg"]
[Tue May 19 07:34:46.289689 2026] [:error] [pid 38705:tid 38783] [client 172.173.117.54:37772] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "aguiFsg5dNOZ5umN9lsm0gAAAI4"]
[Tue May 19 07:35:19.114970 2026] [proxy_fcgi:error] [pid 38697:tid 38722] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:19.403417 2026] [proxy_fcgi:error] [pid 38697:tid 38726] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:19.596712 2026] [proxy_fcgi:error] [pid 38697:tid 38720] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:19.798780 2026] [proxy_fcgi:error] [pid 38697:tid 38731] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:20.119459 2026] [proxy_fcgi:error] [pid 38697:tid 38732] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:20.311823 2026] [proxy_fcgi:error] [pid 38697:tid 38729] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:20.504046 2026] [proxy_fcgi:error] [pid 38697:tid 38715] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:20.698158 2026] [proxy_fcgi:error] [pid 38697:tid 38730] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:20.889701 2026] [proxy_fcgi:error] [pid 38697:tid 38716] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:21.081915 2026] [proxy_fcgi:error] [pid 38697:tid 38737] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:21.274626 2026] [proxy_fcgi:error] [pid 38697:tid 38727] [client 172.173.117.54:39363] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:35:21.463268 2026] [:error] [pid 38697:tid 38717] [client 172.173.117.54:39363] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hayuk.php"] [unique_id "aguiOaXP9pP6Kgt-msTAUQAAAAI"]
[Tue May 19 07:35:22.120491 2026] [:error] [pid 46896:tid 46900] [client 172.173.117.54:57366] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hayuk.php"] [unique_id "aguiOqCHyzL3Ci9LGE3rkwAAAYI"]
[Tue May 19 07:35:23.043163 2026] [:error] [pid 46815:tid 46839] [client 172.173.117.54:12548] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hayuk.php"] [unique_id "aguiOyPnRhJOmA06LgoHYgAAAVY"]
[Tue May 19 07:35:23.863221 2026] [:error] [pid 38699:tid 38745] [client 172.173.117.54:57359] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hayuk.php"] [unique_id "aguiO7--Adsw_P-dthY_8AAAAEM"]
[Tue May 19 07:35:30.124680 2026] [:error] [pid 38699:tid 38762] [client 172.173.117.54:50018] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0d.php"] [unique_id "aguiQr--Adsw_P-dthY_9wAAAFQ"]
[Tue May 19 07:35:35.276220 2026] [:error] [pid 46815:tid 46829] [client 172.173.117.54:50005] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0d.php"] [unique_id "aguiRyPnRhJOmA06LgoHaQAAAUw"]
[Tue May 19 07:35:40.670543 2026] [:error] [pid 41573:tid 41583] [client 172.173.117.54:35048] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "aguiTC1A2bd6JDSW9RY-ygAAAQg"]
[Tue May 19 07:35:43.484800 2026] [:error] [pid 38705:tid 38788] [client 172.173.117.54:36042] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "aguiT8g5dNOZ5umN9lsm3gAAAJM"]
[Tue May 19 07:35:46.688009 2026] [:error] [pid 41573:tid 41594] [client 172.173.117.54:35044] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "aguiUi1A2bd6JDSW9RY-zAAAARM"]
[Tue May 19 07:35:50.343949 2026] [:error] [pid 46815:tid 46822] [client 172.173.117.54:57392] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "aguiViPnRhJOmA06LgoHagAAAUU"]
[Tue May 19 07:35:53.719186 2026] [:error] [pid 41573:tid 41576] [client 172.173.117.54:40597] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp3.php"] [unique_id "aguiWS1A2bd6JDSW9RY-1AAAAQE"]
[Tue May 19 07:35:54.650598 2026] [:error] [pid 46815:tid 46821] [client 172.173.117.54:31343] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp3.php"] [unique_id "aguiWiPnRhJOmA06LgoHawAAAUQ"]
[Tue May 19 07:36:04.639313 2026] [:error] [pid 38697:tid 38724] [client 172.173.117.54:59464] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casp3.php"] [unique_id "aguiZKXP9pP6Kgt-msTAdgAAAAk"]
[Tue May 19 07:36:07.930021 2026] [:error] [pid 38697:tid 38731] [client 172.173.117.54:60234] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unvouc.php"] [unique_id "aguiZ6XP9pP6Kgt-msTAfAAAABA"]
[Tue May 19 07:36:11.388195 2026] [:error] [pid 38699:tid 38758] [client 172.173.117.54:53944] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unvouc.php"] [unique_id "aguia7--Adsw_P-dthZABgAAAFA"]
[Tue May 19 07:36:12.562293 2026] [:error] [pid 38705:tid 38781] [client 172.173.117.54:39366] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unvouc.php"] [unique_id "aguibMg5dNOZ5umN9lsm4gAAAIw"]
[Tue May 19 07:36:13.775866 2026] [:error] [pid 38699:tid 38751] [client 172.173.117.54:25167] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/unvouc.php"] [unique_id "aguibb--Adsw_P-dthZACgAAAEk"]
[Tue May 19 07:36:14.635917 2026] [:error] [pid 38699:tid 38745] [client 172.173.117.54:57204] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signin.php"] [unique_id "aguibr--Adsw_P-dthZADAAAAEM"]
[Tue May 19 07:36:16.011667 2026] [:error] [pid 38814:tid 38837] [client 172.173.117.54:31341] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signin.php"] [unique_id "aguicAvkKuBwP0epzWdfiQAAANU"]
[Tue May 19 07:36:16.983214 2026] [:error] [pid 38705:tid 38780] [client 172.173.117.54:12604] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signin.php"] [unique_id "aguicMg5dNOZ5umN9lsm5wAAAIs"]
[Tue May 19 07:36:18.051839 2026] [:error] [pid 46896:tid 46918] [client 172.173.117.54:52773] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-signin.php"] [unique_id "aguicqCHyzL3Ci9LGE3rrAAAAZQ"]
[Tue May 19 07:36:19.257620 2026] [:error] [pid 38697:tid 38727] [client 172.173.117.54:53930] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "aguic6XP9pP6Kgt-msTAhQAAAAw"]
[Tue May 19 07:36:19.629040 2026] [:error] [pid 46896:tid 46918] [client 172.173.117.54:52773] [client 172.173.117.54] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "178.128.24.157_9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c"): Internal error (specific information not available) [hostname "switchcreative.net"] [uri "/wp-signin.php"] [unique_id "aguicqCHyzL3Ci9LGE3rrAAAAZQ"]
[Tue May 19 07:36:20.830017 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:60244] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "aguidKXP9pP6Kgt-msTAhgAAAAM"]
[Tue May 19 07:36:23.095360 2026] [proxy_fcgi:error] [pid 38699:tid 38750] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:23.999675 2026] [proxy_fcgi:error] [pid 38699:tid 38758] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:24.191388 2026] [proxy_fcgi:error] [pid 38699:tid 38759] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:24.458618 2026] [proxy_fcgi:error] [pid 38699:tid 38748] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:26.175768 2026] [proxy_fcgi:error] [pid 38699:tid 38760] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:26.565006 2026] [proxy_fcgi:error] [pid 38699:tid 38749] [client 172.173.117.54:58980] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:36:26.754041 2026] [:error] [pid 38699:tid 38742] [client 172.173.117.54:58980] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "aguier--Adsw_P-dthZAHAAAAEA"]
[Tue May 19 07:36:30.047822 2026] [:error] [pid 38697:tid 38731] [client 172.173.117.54:40620] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "aguifqXP9pP6Kgt-msTAlwAAABA"]
[Tue May 19 07:36:30.847681 2026] [:error] [pid 41573:tid 41581] [client 172.173.117.54:52755] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "aguifi1A2bd6JDSW9RY-3QAAAQY"]
[Tue May 19 07:36:32.661511 2026] [:error] [pid 41573:tid 41590] [client 172.173.117.54:60262] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "aguigC1A2bd6JDSW9RY-4AAAAQ8"]
[Tue May 19 07:36:33.555307 2026] [:error] [pid 38814:tid 38836] [client 172.173.117.54:20489] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aguigQvkKuBwP0epzWdfjQAAANQ"]
[Tue May 19 07:36:35.425148 2026] [:error] [pid 38697:tid 38725] [client 172.173.117.54:20517] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aguig6XP9pP6Kgt-msTAmgAAAAo"]
[Tue May 19 07:36:36.432902 2026] [:error] [pid 41573:tid 41584] [client 172.173.117.54:60249] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aguihC1A2bd6JDSW9RY-6AAAAQk"]
[Tue May 19 07:36:38.387290 2026] [:error] [pid 38699:tid 38763] [client 172.173.117.54:31883] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kj.php"] [unique_id "aguihr--Adsw_P-dthZAIwAAAFU"]
[Tue May 19 07:36:40.498748 2026] [:error] [pid 46896:tid 46906] [client 172.173.117.54:16648] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "aguiiKCHyzL3Ci9LGE3rtAAAAYg"]
[Tue May 19 07:36:41.455206 2026] [:error] [pid 38699:tid 38751] [client 172.173.117.54:20515] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "aguiib--Adsw_P-dthZAMAAAAEk"]
[Tue May 19 07:36:43.213499 2026] [:error] [pid 46815:tid 46820] [client 172.173.117.54:60284] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "aguiiyPnRhJOmA06LgoHhQAAAUM"]
[Tue May 19 07:36:44.477455 2026] [:error] [pid 38699:tid 38745] [client 172.173.117.54:58965] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/about.php"] [unique_id "aguijL--Adsw_P-dthZANAAAAEM"]
[Tue May 19 07:36:45.267067 2026] [:error] [pid 38814:tid 38825] [client 172.173.117.54:25185] [client 172.173.117.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "aguijQvkKuBwP0epzWdfkgAAAMk"]
[Tue May 19 07:36:46.770850 2026] [:error] [pid 38705:tid 38792] [client 172.173.117.54:20514] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "aguijsg5dNOZ5umN9lsm6QAAAJc"]
[Tue May 19 07:36:47.634448 2026] [:error] [pid 46896:tid 46914] [client 172.173.117.54:43610] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "aguij6CHyzL3Ci9LGE3rvwAAAZA"]
[Tue May 19 07:36:49.394709 2026] [:error] [pid 46896:tid 46917] [client 172.173.117.54:52199] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "aguikaCHyzL3Ci9LGE3rwQAAAZM"]
[Tue May 19 07:36:50.202157 2026] [:error] [pid 41573:tid 41579] [client 172.173.117.54:52780] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "aguiki1A2bd6JDSW9RY-9wAAAQQ"]
[Tue May 19 07:36:51.420438 2026] [:error] [pid 38697:tid 38719] [client 172.173.117.54:31351] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "aguik6XP9pP6Kgt-msTAogAAAAQ"]
[Tue May 19 07:36:55.210083 2026] [:error] [pid 46896:tid 46919] [client 172.173.117.54:57179] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "aguil6CHyzL3Ci9LGE3rxAAAAZU"]
[Tue May 19 07:36:58.122468 2026] [:error] [pid 46896:tid 46905] [client 172.173.117.54:25192] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "aguimqCHyzL3Ci9LGE3rzgAAAYc"]
[Tue May 19 07:36:58.789679 2026] [:error] [pid 41573:tid 41596] [client 172.173.117.54:53940] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "aguimi1A2bd6JDSW9RY-_QAAARU"]
[Tue May 19 07:37:00.273405 2026] [:error] [pid 38697:tid 38722] [client 172.173.117.54:53942] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "aguinKXP9pP6Kgt-msTAxAAAAAc"]
[Tue May 19 07:37:01.341905 2026] [:error] [pid 38697:tid 38728] [client 172.173.117.54:18560] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "aguinaXP9pP6Kgt-msTA1wAAAA0"]
[Tue May 19 07:37:01.928209 2026] [:error] [pid 38705:tid 38769] [client 172.173.117.54:58958] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "aguincg5dNOZ5umN9lsm7wAAAIA"]
[Tue May 19 07:37:02.557732 2026] [:error] [pid 38705:tid 38791] [client 172.173.117.54:58947] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spawns.php"] [unique_id "aguinsg5dNOZ5umN9lsm8AAAAJY"]
[Tue May 19 07:37:04.261319 2026] [:error] [pid 46896:tid 46902] [client 172.173.117.54:60272] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "aguioKCHyzL3Ci9LGE3rzwAAAYQ"]
[Tue May 19 07:37:05.063763 2026] [:error] [pid 38697:tid 38724] [client 172.173.117.54:53895] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "aguioaXP9pP6Kgt-msTA4AAAAAk"]
[Tue May 19 07:37:06.075057 2026] [:error] [pid 41573:tid 41583] [client 172.173.117.54:52741] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "aguioi1A2bd6JDSW9RY_FwAAAQg"]
[Tue May 19 07:37:06.553144 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:52772] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/t3s.php"] [unique_id "aguioqXP9pP6Kgt-msTA4QAAAAM"]
[Tue May 19 07:37:07.231638 2026] [:error] [pid 38697:tid 38715] [client 172.173.117.54:43647] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "aguio6XP9pP6Kgt-msTA5QAAAAA"]
[Tue May 19 07:37:07.810451 2026] [:error] [pid 38699:tid 38764] [client 172.173.117.54:31919] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "aguio7--Adsw_P-dthZAPgAAAFY"]
[Tue May 19 07:37:08.531490 2026] [:error] [pid 38697:tid 38726] [client 172.173.117.54:45091] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "aguipKXP9pP6Kgt-msTA5gAAAAs"]
[Tue May 19 07:37:09.476459 2026] [:error] [pid 38814:tid 38838] [client 172.173.117.54:25202] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "aguipQvkKuBwP0epzWdflAAAANY"]
[Tue May 19 07:37:10.657459 2026] [:error] [pid 46815:tid 46829] [client 172.173.117.54:52796] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "aguipiPnRhJOmA06LgoHiAAAAUw"]
[Tue May 19 07:37:11.694745 2026] [:error] [pid 41573:tid 41576] [client 172.173.117.54:44777] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "aguipy1A2bd6JDSW9RY_IAAAAQE"]
[Tue May 19 07:37:12.362551 2026] [:error] [pid 46896:tid 46911] [client 172.173.117.54:20493] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "aguiqKCHyzL3Ci9LGE3r2gAAAY0"]
[Tue May 19 07:37:12.930976 2026] [:error] [pid 38699:tid 38746] [client 172.173.117.54:31909] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x/"] [unique_id "aguiqL--Adsw_P-dthZAQwAAAEQ"]
[Tue May 19 07:37:14.600300 2026] [:error] [pid 38697:tid 38733] [client 172.173.117.54:60235] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "aguiqqXP9pP6Kgt-msTA6wAAABI"]
[Tue May 19 07:37:15.118305 2026] [:error] [pid 46815:tid 46833] [client 172.173.117.54:40606] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "aguiqyPnRhJOmA06LgoHjAAAAVA"]
[Tue May 19 07:37:15.672742 2026] [:error] [pid 46896:tid 46908] [client 172.173.117.54:31876] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "aguiq6CHyzL3Ci9LGE3r3QAAAYo"]
[Tue May 19 07:37:17.635269 2026] [:error] [pid 38699:tid 38742] [client 172.173.117.54:31307] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/modern/"] [unique_id "aguirb--Adsw_P-dthZATAAAAEA"]
[Tue May 19 07:37:18.170560 2026] [:error] [pid 38699:tid 38745] [client 172.173.117.54:53903] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "aguirr--Adsw_P-dthZATwAAAEM"]
[Tue May 19 07:37:19.004194 2026] [:error] [pid 41573:tid 41592] [client 172.173.117.54:53414] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "aguiry1A2bd6JDSW9RY_IQAAARE"]
[Tue May 19 07:37:19.729908 2026] [:error] [pid 46896:tid 46913] [client 172.173.117.54:40616] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "aguir6CHyzL3Ci9LGE3r4AAAAY8"]
[Tue May 19 07:37:20.464337 2026] [:error] [pid 38697:tid 38719] [client 172.173.117.54:53416] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/"] [unique_id "aguisKXP9pP6Kgt-msTA7QAAAAQ"]
[Tue May 19 07:37:21.066501 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:20486] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aguisaXP9pP6Kgt-msTA7gAAAAM"]
[Tue May 19 07:37:22.110793 2026] [:error] [pid 38697:tid 38728] [client 172.173.117.54:43617] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aguisqXP9pP6Kgt-msTA8AAAAA0"]
[Tue May 19 07:37:22.876214 2026] [:error] [pid 38697:tid 38731] [client 172.173.117.54:52174] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aguisqXP9pP6Kgt-msTA9AAAABA"]
[Tue May 19 07:37:23.797934 2026] [:error] [pid 38699:tid 38755] [client 172.173.117.54:53892] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwu.php"] [unique_id "aguis7--Adsw_P-dthZAUAAAAE0"]
[Tue May 19 07:37:24.375700 2026] [:error] [pid 38697:tid 38724] [client 172.173.117.54:52758] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "aguitKXP9pP6Kgt-msTA-QAAAAk"]
[Tue May 19 07:37:24.930380 2026] [:error] [pid 38697:tid 38733] [client 172.173.117.54:25172] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "aguitKXP9pP6Kgt-msTA-gAAABI"]
[Tue May 19 07:37:25.625138 2026] [:error] [pid 46815:tid 46836] [client 172.173.117.54:18615] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/uwa.php"] [unique_id "aguitSPnRhJOmA06LgoHjwAAAVM"]
[Tue May 19 07:37:26.542943 2026] [proxy_fcgi:error] [pid 38697:tid 38717] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:26.741689 2026] [proxy_fcgi:error] [pid 38697:tid 38739] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:26.933103 2026] [proxy_fcgi:error] [pid 38697:tid 38723] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:27.147862 2026] [proxy_fcgi:error] [pid 38697:tid 38726] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:27.340758 2026] [proxy_fcgi:error] [pid 38697:tid 38721] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:27.635727 2026] [proxy_fcgi:error] [pid 38697:tid 38720] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:27.864068 2026] [proxy_fcgi:error] [pid 38697:tid 38732] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:28.179696 2026] [proxy_fcgi:error] [pid 38697:tid 38725] [client 172.173.117.54:52793] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:37:29.327194 2026] [:error] [pid 38697:tid 38738] [client 172.173.117.54:52793] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "aguiuaXP9pP6Kgt-msTBEQAAABc"]
[Tue May 19 07:37:30.014194 2026] [:error] [pid 46815:tid 46830] [client 172.173.117.54:45084] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "aguiuiPnRhJOmA06LgoHlwAAAU0"]
[Tue May 19 07:37:30.652073 2026] [:error] [pid 38705:tid 38782] [client 172.173.117.54:60286] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "aguiusg5dNOZ5umN9lsnAgAAAI0"]
[Tue May 19 07:37:31.190833 2026] [:error] [pid 38699:tid 38761] [client 172.173.117.54:31315] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.tmb/"] [unique_id "aguiu7--Adsw_P-dthZAZgAAAFM"]
[Tue May 19 07:37:31.911245 2026] [:error] [pid 38699:tid 38762] [client 172.173.117.54:18561] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aguiu7--Adsw_P-dthZAaAAAAFQ"]
[Tue May 19 07:37:32.454411 2026] [:error] [pid 38699:tid 38759] [client 172.173.117.54:45061] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aguivL--Adsw_P-dthZAaQAAAFE"]
[Tue May 19 07:37:33.309960 2026] [:error] [pid 46815:tid 46817] [client 172.173.117.54:16659] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aguivSPnRhJOmA06LgoHmQAAAUA"]
[Tue May 19 07:37:34.481676 2026] [:error] [pid 46815:tid 46841] [client 172.173.117.54:53909] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/one.php"] [unique_id "aguiviPnRhJOmA06LgoHnQAAAVg"]
[Tue May 19 07:37:35.487943 2026] [:error] [pid 46815:tid 46839] [client 172.173.117.54:20541] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sl.php"] [unique_id "aguivyPnRhJOmA06LgoHngAAAVY"]
[Tue May 19 07:37:36.079928 2026] [:error] [pid 38697:tid 38721] [client 172.173.117.54:25212] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sl.php"] [unique_id "aguiwKXP9pP6Kgt-msTBGAAAAAY"]
[Tue May 19 07:37:37.011893 2026] [:error] [pid 46896:tid 46906] [client 172.173.117.54:58960] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sl.php"] [unique_id "aguiwaCHyzL3Ci9LGE3r5gAAAYg"]
[Tue May 19 07:37:37.715694 2026] [:error] [pid 46896:tid 46905] [client 172.173.117.54:40609] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sl.php"] [unique_id "aguiwaCHyzL3Ci9LGE3r5wAAAYc"]
[Tue May 19 07:37:38.267924 2026] [:error] [pid 38705:tid 38787] [client 172.173.117.54:47835] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "aguiwsg5dNOZ5umN9lsnBAAAAJI"]
[Tue May 19 07:37:38.793571 2026] [:error] [pid 46896:tid 46908] [client 172.173.117.54:18602] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "aguiwqCHyzL3Ci9LGE3r6gAAAYo"]
[Tue May 19 07:37:39.456749 2026] [:error] [pid 46896:tid 46903] [client 172.173.117.54:45058] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "aguiw6CHyzL3Ci9LGE3r6wAAAYU"]
[Tue May 19 07:37:40.278564 2026] [:error] [pid 38697:tid 38736] [client 172.173.117.54:53907] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-temp.php"] [unique_id "aguixKXP9pP6Kgt-msTBGwAAABU"]
[Tue May 19 07:37:41.464169 2026] [:error] [pid 38697:tid 38725] [client 172.173.117.54:58991] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aguixaXP9pP6Kgt-msTBHQAAAAo"]
[Tue May 19 07:37:42.458248 2026] [:error] [pid 46896:tid 46916] [client 172.173.117.54:60256] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aguixqCHyzL3Ci9LGE3r8QAAAZI"]
[Tue May 19 07:37:43.158590 2026] [:error] [pid 38697:tid 38737] [client 172.173.117.54:53393] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aguix6XP9pP6Kgt-msTBHgAAABY"]
[Tue May 19 07:37:45.581287 2026] [:error] [pid 38697:tid 38724] [client 172.173.117.54:18592] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aguiyaXP9pP6Kgt-msTBIAAAAAk"]
[Tue May 19 07:37:47.102856 2026] [:error] [pid 46896:tid 46898] [client 172.173.117.54:58967] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aguiy6CHyzL3Ci9LGE3r8gAAAYA"]
[Tue May 19 07:37:48.834740 2026] [:error] [pid 41573:tid 41582] [client 172.173.117.54:52209] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aguizC1A2bd6JDSW9RY_JQAAAQc"]
[Tue May 19 07:37:51.318177 2026] [:error] [pid 46815:tid 46840] [client 172.173.117.54:52187] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "aguizyPnRhJOmA06LgoHogAAAVc"]
[Tue May 19 07:37:52.646395 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:60275] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmu.php"] [unique_id "agui0KXP9pP6Kgt-msTBIgAAAAM"]
[Tue May 19 07:37:55.376540 2026] [:error] [pid 38699:tid 38748] [client 172.173.117.54:52768] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "agui07--Adsw_P-dthZAawAAAEY"]
[Tue May 19 07:37:56.326876 2026] [:error] [pid 46896:tid 46911] [client 172.173.117.54:31306] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "agui1KCHyzL3Ci9LGE3r9QAAAY0"]
[Tue May 19 07:37:57.284673 2026] [:error] [pid 38814:tid 38837] [client 172.173.117.54:53398] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "agui1QvkKuBwP0epzWdfpwAAANU"]
[Tue May 19 07:37:58.036652 2026] [:error] [pid 38705:tid 38792] [client 172.173.117.54:60264] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mode.php"] [unique_id "agui1sg5dNOZ5umN9lsnCAAAAJc"]
[Tue May 19 07:37:58.823672 2026] [:error] [pid 41573:tid 41597] [client 172.173.117.54:52747] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "agui1i1A2bd6JDSW9RY_KAAAARY"]
[Tue May 19 07:37:59.961658 2026] [:error] [pid 38697:tid 38717] [client 172.173.117.54:60267] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "agui16XP9pP6Kgt-msTBJgAAAAI"]
[Tue May 19 07:38:01.264465 2026] [:error] [pid 38699:tid 38756] [client 172.173.117.54:40632] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "agui2b--Adsw_P-dthZAbAAAAE4"]
[Tue May 19 07:38:03.316812 2026] [:error] [pid 38697:tid 38720] [client 172.173.117.54:58985] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/index.php"] [unique_id "agui26XP9pP6Kgt-msTBKQAAAAU"]
[Tue May 19 07:38:04.412959 2026] [:error] [pid 38697:tid 38726] [client 172.173.117.54:16642] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui3KXP9pP6Kgt-msTBKwAAAAs"]
[Tue May 19 07:38:05.872195 2026] [:error] [pid 46896:tid 46905] [client 172.173.117.54:60240] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui3aCHyzL3Ci9LGE3r9wAAAYc"]
[Tue May 19 07:38:06.980746 2026] [:error] [pid 38697:tid 38732] [client 172.173.117.54:25213] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui3qXP9pP6Kgt-msTBLQAAABE"]
[Tue May 19 07:38:07.800439 2026] [:error] [pid 46896:tid 46908] [client 172.173.117.54:47859] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui36CHyzL3Ci9LGE3r-QAAAYo"]
[Tue May 19 07:38:12.326261 2026] [:error] [pid 38697:tid 38718] [client 172.173.117.54:58955] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "agui5KXP9pP6Kgt-msTBMgAAAAM"]
[Tue May 19 07:38:14.846935 2026] [:error] [pid 38814:tid 38834] [client 172.173.117.54:58946] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "agui5gvkKuBwP0epzWdfqQAAANI"]
[Tue May 19 07:38:15.735660 2026] [:error] [pid 38697:tid 38715] [client 172.173.117.54:52208] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "agui56XP9pP6Kgt-msTBPAAAAAA"]
[Tue May 19 07:38:17.102571 2026] [:error] [pid 46896:tid 46921] [client 172.173.117.54:59002] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/puc.php"] [unique_id "agui6aCHyzL3Ci9LGE3r_AAAAZc"]
[Tue May 19 07:38:18.607575 2026] [:error] [pid 38697:tid 38722] [client 172.173.117.54:53420] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "agui6qXP9pP6Kgt-msTBQwAAAAc"]
[Tue May 19 07:38:19.626252 2026] [:error] [pid 38699:tid 38762] [client 172.173.117.54:49699] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "agui67--Adsw_P-dthZAcQAAAFQ"]
[Tue May 19 07:38:20.286096 2026] [:error] [pid 38697:tid 38715] [client 172.173.117.54:30053] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "agui7KXP9pP6Kgt-msTBRQAAAAA"]
[Tue May 19 07:38:22.275868 2026] [:error] [pid 41573:tid 41599] [client 172.173.117.54:53385] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "agui7i1A2bd6JDSW9RY_KwAAARg"]
[Tue May 19 07:38:25.439737 2026] [:error] [pid 46815:tid 46841] [client 172.173.117.54:49701] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui8SPnRhJOmA06LgoHqQAAAVg"]
[Tue May 19 07:38:27.611049 2026] [:error] [pid 38814:tid 38825] [client 172.173.117.54:20513] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dx.php"] [unique_id "agui8wvkKuBwP0epzWdfrAAAAMk"]
[Tue May 19 07:38:28.438382 2026] [proxy_fcgi:error] [pid 41573:tid 41598] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:28.637815 2026] [proxy_fcgi:error] [pid 41573:tid 41589] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:29.328530 2026] [proxy_fcgi:error] [pid 41573:tid 41592] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:29.523377 2026] [proxy_fcgi:error] [pid 41573:tid 41578] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:30.030072 2026] [proxy_fcgi:error] [pid 41573:tid 41580] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:30.292506 2026] [proxy_fcgi:error] [pid 41573:tid 41581] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:30.595667 2026] [proxy_fcgi:error] [pid 41573:tid 41591] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:30.804807 2026] [proxy_fcgi:error] [pid 41573:tid 41583] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:31.052721 2026] [proxy_fcgi:error] [pid 41573:tid 41590] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:31.334095 2026] [proxy_fcgi:error] [pid 41573:tid 41582] [client 172.173.117.54:52168] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:38:31.522416 2026] [:error] [pid 41573:tid 41587] [client 172.173.117.54:52168] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agui9y1A2bd6JDSW9RY_OQAAAQw"]
[Tue May 19 07:38:33.117694 2026] [:error] [pid 41573:tid 41577] [client 172.173.117.54:55985] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agui-S1A2bd6JDSW9RY_PAAAAQI"]
[Tue May 19 07:38:35.833613 2026] [:error] [pid 38699:tid 38753] [client 172.173.117.54:18617] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agui-7--Adsw_P-dthZAdQAAAEs"]
[Tue May 19 07:38:38.258340 2026] [:error] [pid 46815:tid 46818] [client 172.173.117.54:17533] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "agui_iPnRhJOmA06LgoHrwAAAUE"]
[Tue May 19 07:38:42.142965 2026] [:error] [pid 38705:tid 38782] [client 172.173.117.54:59395] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "agujAsg5dNOZ5umN9lsnDwAAAI0"]
[Tue May 19 07:38:44.112744 2026] [:error] [pid 38705:tid 38775] [client 172.173.117.54:64863] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "agujBMg5dNOZ5umN9lsnEQAAAIY"]
[Tue May 19 07:38:47.876795 2026] [:error] [pid 38705:tid 38788] [client 172.173.117.54:49679] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "agujB8g5dNOZ5umN9lsnFAAAAJM"]
[Tue May 19 07:38:48.794298 2026] [:error] [pid 38814:tid 38822] [client 172.173.117.54:55914] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "agujCAvkKuBwP0epzWdfrwAAAMY"]
[Tue May 19 07:38:50.651980 2026] [:error] [pid 38705:tid 38784] [client 172.173.117.54:23566] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agujCsg5dNOZ5umN9lsnFwAAAI8"]
[Tue May 19 07:38:55.734281 2026] [:error] [pid 46815:tid 46834] [client 172.173.117.54:17516] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agujDyPnRhJOmA06LgoHuQAAAVE"]
[Tue May 19 07:39:02.231706 2026] [:error] [pid 46896:tid 46913] [client 172.173.117.54:46808] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agujFqCHyzL3Ci9LGE3sBgAAAY8"]
[Tue May 19 07:39:03.654609 2026] [:error] [pid 41573:tid 41591] [client 172.173.117.54:35371] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agujFy1A2bd6JDSW9RY_QAAAARA"]
[Tue May 19 07:39:07.438847 2026] [:error] [pid 41573:tid 41583] [client 172.173.117.54:61385] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "agujGy1A2bd6JDSW9RY_QQAAAQg"]
[Tue May 19 07:39:08.452577 2026] [:error] [pid 46896:tid 46921] [client 172.173.117.54:46811] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "agujHKCHyzL3Ci9LGE3sBwAAAZc"]
[Tue May 19 07:39:09.520674 2026] [:error] [pid 41573:tid 41590] [client 172.173.117.54:37840] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "agujHS1A2bd6JDSW9RY_QgAAAQ8"]
[Tue May 19 07:39:11.743145 2026] [:error] [pid 38814:tid 38818] [client 172.173.117.54:46788] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xa.php"] [unique_id "agujHwvkKuBwP0epzWdfuAAAAMI"]
[Tue May 19 07:39:14.891686 2026] [:error] [pid 38814:tid 38838] [client 172.173.117.54:35356] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "agujIgvkKuBwP0epzWdfugAAANY"]
[Tue May 19 07:39:15.674797 2026] [:error] [pid 38697:tid 38734] [client 172.173.117.54:36547] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "agujI6XP9pP6Kgt-msTBUgAAABM"]
[Tue May 19 07:39:16.492099 2026] [:error] [pid 38697:tid 38727] [client 172.173.117.54:23163] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "agujJKXP9pP6Kgt-msTBVAAAAAw"]
[Tue May 19 07:39:17.781430 2026] [:error] [pid 38699:tid 38743] [client 172.173.117.54:36548] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "agujJb--Adsw_P-dthZAdgAAAEE"]
[Tue May 19 07:39:35.353229 2026] [proxy_fcgi:error] [pid 46896:tid 46903] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:35.594350 2026] [proxy_fcgi:error] [pid 46896:tid 46899] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:35.853649 2026] [proxy_fcgi:error] [pid 46896:tid 46902] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:36.410518 2026] [proxy_fcgi:error] [pid 46896:tid 46918] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:36.603777 2026] [proxy_fcgi:error] [pid 46896:tid 46914] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:37.020970 2026] [proxy_fcgi:error] [pid 46896:tid 46921] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:37.743871 2026] [proxy_fcgi:error] [pid 46896:tid 46916] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:38.050468 2026] [proxy_fcgi:error] [pid 46896:tid 46920] [client 172.173.117.54:23648] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:39:38.600087 2026] [:error] [pid 46896:tid 46915] [client 172.173.117.54:23648] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "agujOqCHyzL3Ci9LGE3sGgAAAZE"]
[Tue May 19 07:39:39.016365 2026] [:error] [pid 46896:tid 46904] [client 172.173.117.54:59335] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "agujO6CHyzL3Ci9LGE3sGwAAAYY"]
[Tue May 19 07:39:39.888249 2026] [:error] [pid 38697:tid 38726] [client 172.173.117.54:15242] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "agujO6XP9pP6Kgt-msTBaAAAAAs"]
[Tue May 19 07:39:42.234041 2026] [:error] [pid 38697:tid 38716] [client 172.173.117.54:44204] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog.php"] [unique_id "agujPqXP9pP6Kgt-msTBbQAAAAE"]
[Tue May 19 07:39:42.833244 2026] [:error] [pid 38697:tid 38722] [client 172.173.117.54:64141] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "agujPqXP9pP6Kgt-msTBbgAAAAc"]
[Tue May 19 07:39:44.082405 2026] [:error] [pid 38697:tid 38730] [client 172.173.117.54:44167] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "agujQKXP9pP6Kgt-msTBcQAAAA8"]
[Tue May 19 07:39:44.935995 2026] [:error] [pid 38705:tid 38788] [client 172.173.117.54:25925] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "agujQMg5dNOZ5umN9lsnHwAAAJM"]
[Tue May 19 07:39:45.635057 2026] [:error] [pid 41573:tid 41576] [client 172.173.117.54:52174] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/jquery/"] [unique_id "agujQS1A2bd6JDSW9RY_RwAAAQE"]
[Tue May 19 07:39:46.151783 2026] [:error] [pid 38697:tid 38738] [client 172.173.117.54:36557] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "agujQqXP9pP6Kgt-msTBdQAAABc"]
[Tue May 19 07:39:47.116733 2026] [:error] [pid 46815:tid 46829] [client 172.173.117.54:36581] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "agujQyPnRhJOmA06LgoHwwAAAUw"]
[Tue May 19 07:39:47.660313 2026] [:error] [pid 46815:tid 46838] [client 172.173.117.54:11083] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "agujQyPnRhJOmA06LgoHxAAAAVU"]
[Tue May 19 07:39:50.703675 2026] [:error] [pid 41573:tid 41599] [client 172.173.117.54:25971] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "agujRi1A2bd6JDSW9RY_SQAAARg"]
[Tue May 19 07:39:52.022593 2026] [:error] [pid 38705:tid 38770] [client 172.173.117.54:62004] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "agujSMg5dNOZ5umN9lsnIgAAAIE"]
[Tue May 19 07:39:52.834381 2026] [:error] [pid 38697:tid 38721] [client 172.173.117.54:44171] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "agujSKXP9pP6Kgt-msTBfAAAAAY"]
[Tue May 19 07:39:54.316906 2026] [:error] [pid 41573:tid 41578] [client 172.173.117.54:58190] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "agujSi1A2bd6JDSW9RY_TAAAAQM"]
[Tue May 19 07:39:54.978106 2026] [:error] [pid 38697:tid 38727] [client 172.173.117.54:23131] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "agujSqXP9pP6Kgt-msTBgwAAAAw"]
[Tue May 19 07:39:55.553072 2026] [:error] [pid 46896:tid 46901] [client 172.173.117.54:39950] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "agujS6CHyzL3Ci9LGE3sHAAAAYM"]
[Tue May 19 07:39:56.129502 2026] [:error] [pid 38699:tid 38748] [client 172.173.117.54:11080] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "agujTL--Adsw_P-dthZAfwAAAEY"]
[Tue May 19 07:39:56.713006 2026] [:error] [pid 46896:tid 46910] [client 172.173.117.54:64812] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "agujTKCHyzL3Ci9LGE3sHQAAAYw"]
[Tue May 19 07:39:57.500686 2026] [:error] [pid 38705:tid 38790] [client 172.173.117.54:18649] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/goods.php"] [unique_id "agujTcg5dNOZ5umN9lsnJAAAAJU"]
[Tue May 19 07:39:57.957744 2026] [:error] [pid 38697:tid 38738] [client 172.173.117.54:2157] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "agujTaXP9pP6Kgt-msTBhgAAABc"]
[Tue May 19 07:39:58.480866 2026] [:error] [pid 38705:tid 38776] [client 172.173.117.54:5404] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "agujTsg5dNOZ5umN9lsnJQAAAIc"]
[Tue May 19 07:39:58.924470 2026] [:error] [pid 46896:tid 46912] [client 172.173.117.54:31259] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "agujTqCHyzL3Ci9LGE3sHgAAAY4"]
[Tue May 19 07:39:59.489339 2026] [:error] [pid 46896:tid 46900] [client 172.173.117.54:25139] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "agujT6CHyzL3Ci9LGE3sHwAAAYI"]
[Tue May 19 07:40:00.163077 2026] [:error] [pid 38814:tid 38831] [client 172.173.117.54:31247] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "agujUAvkKuBwP0epzWdfwQAAAM8"]
[Tue May 19 07:40:00.701068 2026] [:error] [pid 46896:tid 46919] [client 172.173.117.54:25944] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "agujUKCHyzL3Ci9LGE3sIAAAAZU"]
[Tue May 19 07:40:01.402405 2026] [:error] [pid 38705:tid 38781] [client 172.173.117.54:37131] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "agujUcg5dNOZ5umN9lsnJwAAAIw"]
[Tue May 19 07:40:01.877532 2026] [:error] [pid 38697:tid 38720] [client 172.173.117.54:9045] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/222.php"] [unique_id "agujUaXP9pP6Kgt-msTBiQAAAAU"]
[Tue May 19 07:40:02.492059 2026] [:error] [pid 38814:tid 38819] [client 172.173.117.54:25127] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "agujUgvkKuBwP0epzWdfwgAAAMM"]
[Tue May 19 07:40:03.155696 2026] [:error] [pid 38697:tid 38725] [client 172.173.117.54:17550] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "agujU6XP9pP6Kgt-msTBigAAAAo"]
[Tue May 19 07:40:03.656057 2026] [:error] [pid 46815:tid 46826] [client 172.173.117.54:11100] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "agujUyPnRhJOmA06LgoHxgAAAUk"]
[Tue May 19 07:40:04.094909 2026] [:error] [pid 38697:tid 38737] [client 172.173.117.54:11117] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/index.php"] [unique_id "agujVKXP9pP6Kgt-msTBjAAAABY"]
[Tue May 19 07:40:04.537988 2026] [:error] [pid 38705:tid 38771] [client 172.173.117.54:39956] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "agujVMg5dNOZ5umN9lsnKAAAAII"]
[Tue May 19 07:40:05.021845 2026] [:error] [pid 38697:tid 38728] [client 172.173.117.54:61983] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "agujVaXP9pP6Kgt-msTBjgAAAA0"]
[Tue May 19 07:40:05.692351 2026] [:error] [pid 38814:tid 38832] [client 172.173.117.54:9068] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "agujVQvkKuBwP0epzWdfxgAAANA"]
[Tue May 19 07:40:06.312779 2026] [:error] [pid 38697:tid 38732] [client 172.173.117.54:11095] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/"] [unique_id "agujVqXP9pP6Kgt-msTBkAAAABE"]
[Tue May 19 07:40:07.583881 2026] [:error] [pid 46896:tid 46906] [client 172.173.117.54:34987] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "agujV6CHyzL3Ci9LGE3sIgAAAYg"]
[Tue May 19 07:40:08.097107 2026] [:error] [pid 38697:tid 38723] [client 172.173.117.54:11089] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "agujWKXP9pP6Kgt-msTBkgAAAAg"]
[Tue May 19 07:40:09.321508 2026] [:error] [pid 41573:tid 41596] [client 172.173.117.54:31267] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "agujWS1A2bd6JDSW9RY_TQAAARU"]
[Tue May 19 07:40:10.691593 2026] [:error] [pid 41573:tid 41580] [client 172.173.117.54:35001] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "agujWi1A2bd6JDSW9RY_TgAAAQU"]
[Tue May 19 07:40:11.676770 2026] [:error] [pid 46896:tid 46903] [client 172.173.117.54:19668] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "agujW6CHyzL3Ci9LGE3sJQAAAYU"]
[Tue May 19 07:40:12.809316 2026] [:error] [pid 46896:tid 46913] [client 172.173.117.54:37159] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "agujXKCHyzL3Ci9LGE3sJwAAAY8"]
[Tue May 19 07:40:14.617909 2026] [:error] [pid 38697:tid 38730] [client 172.173.117.54:9030] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "agujXqXP9pP6Kgt-msTBmwAAAA8"]
[Tue May 19 07:40:16.619008 2026] [:error] [pid 41573:tid 41590] [client 172.173.117.54:17543] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/l10n/"] [unique_id "agujYC1A2bd6JDSW9RY_UgAAAQ8"]
[Tue May 19 07:40:17.363569 2026] [:error] [pid 38697:tid 38735] [client 172.173.117.54:11123] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "agujYaXP9pP6Kgt-msTBnQAAABQ"]
[Tue May 19 07:40:20.873455 2026] [:error] [pid 41573:tid 41577] [client 172.173.117.54:19684] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "agujZC1A2bd6JDSW9RY_VAAAAQI"]
[Tue May 19 07:40:22.332468 2026] [:error] [pid 46896:tid 46905] [client 172.173.117.54:25130] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "agujZqCHyzL3Ci9LGE3sMQAAAYc"]
[Tue May 19 07:40:23.766630 2026] [:error] [pid 38697:tid 38736] [client 172.173.117.54:64220] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/"] [unique_id "agujZ6XP9pP6Kgt-msTBoAAAABU"]
[Tue May 19 07:40:25.182057 2026] [:error] [pid 38697:tid 38725] [client 172.173.117.54:64211] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "agujaaXP9pP6Kgt-msTBoQAAAAo"]
[Tue May 19 07:40:26.576740 2026] [:error] [pid 46896:tid 46904] [client 172.173.117.54:64821] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "agujaqCHyzL3Ci9LGE3sNgAAAYY"]
[Tue May 19 07:40:28.919032 2026] [:error] [pid 38697:tid 38731] [client 172.173.117.54:28689] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "agujbKXP9pP6Kgt-msTBowAAABA"]
[Tue May 19 07:40:30.379011 2026] [:error] [pid 38814:tid 38817] [client 172.173.117.54:64246] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "agujbgvkKuBwP0epzWdfzQAAAME"]
[Tue May 19 07:40:31.773133 2026] [:error] [pid 38699:tid 38764] [client 172.173.117.54:61991] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agujb7--Adsw_P-dthZAggAAAFY"]
[Tue May 19 07:40:32.530174 2026] [:error] [pid 38814:tid 38831] [client 172.173.117.54:30599] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agujcAvkKuBwP0epzWdfzwAAAM8"]
[Tue May 19 07:40:35.078320 2026] [:error] [pid 38699:tid 38747] [client 172.173.117.54:28695] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agujc7--Adsw_P-dthZAiwAAAEU"]
[Tue May 19 07:40:37.752003 2026] [:error] [pid 38699:tid 38757] [client 172.173.117.54:35002] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "agujdb--Adsw_P-dthZAjgAAAE8"]
[Tue May 19 07:40:39.616024 2026] [proxy_fcgi:error] [pid 38705:tid 38769] [client 172.173.117.54:19711] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:39.974927 2026] [proxy_fcgi:error] [pid 38705:tid 38790] [client 172.173.117.54:19711] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:40.199924 2026] [proxy_fcgi:error] [pid 38705:tid 38791] [client 172.173.117.54:19711] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:40.611118 2026] [:error] [pid 38705:tid 38777] [client 172.173.117.54:19711] [client 172.173.117.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "agujeMg5dNOZ5umN9lsnOQAAAIg"]
[Tue May 19 07:40:42.442000 2026] [proxy_fcgi:error] [pid 38697:tid 38720] [client 172.173.117.54:9060] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:42.903088 2026] [proxy_fcgi:error] [pid 38697:tid 38731] [client 172.173.117.54:9060] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:43.177985 2026] [proxy_fcgi:error] [pid 38697:tid 38732] [client 172.173.117.54:9060] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:43.680719 2026] [proxy_fcgi:error] [pid 38697:tid 38739] [client 172.173.117.54:9060] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:40:44.110689 2026] [:error] [pid 38697:tid 38727] [client 172.173.117.54:9060] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "agujfKXP9pP6Kgt-msTBuQAAAAw"]
[Tue May 19 07:40:45.589701 2026] [:error] [pid 38697:tid 38726] [client 172.173.117.54:64822] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "agujfaXP9pP6Kgt-msTBuwAAAAs"]
[Tue May 19 07:40:47.204430 2026] [:error] [pid 46815:tid 46821] [client 172.173.117.54:28718] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "agujfyPnRhJOmA06LgoHzwAAAUQ"]
[Tue May 19 07:40:50.371918 2026] [:error] [pid 38697:tid 38717] [client 172.173.117.54:37189] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/"] [unique_id "agujgqXP9pP6Kgt-msTByQAAAAI"]
[Tue May 19 07:40:53.588017 2026] [:error] [pid 41573:tid 41579] [client 172.173.117.54:61958] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agujhS1A2bd6JDSW9RY_YAAAAQQ"]
[Tue May 19 07:40:55.797354 2026] [:error] [pid 38697:tid 38720] [client 172.173.117.54:19692] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agujh6XP9pP6Kgt-msTB0AAAAAU"]
[Tue May 19 07:40:57.731770 2026] [:error] [pid 38705:tid 38769] [client 172.173.117.54:2172] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "agujicg5dNOZ5umN9lsnPAAAAIA"]
[Tue May 19 07:40:59.273739 2026] [:error] [pid 38697:tid 38732] [client 172.173.117.54:64785] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/simple.php"] [unique_id "aguji6XP9pP6Kgt-msTB2QAAABE"]
[Tue May 19 07:41:01.992951 2026] [:error] [pid 38697:tid 38737] [client 172.173.117.54:64216] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "agujjaXP9pP6Kgt-msTB-gAAABY"]
[Tue May 19 07:41:05.440496 2026] [:error] [pid 38699:tid 38757] [client 172.173.117.54:39959] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "agujkb--Adsw_P-dthZAtQAAAE8"]
[Tue May 19 07:41:09.003763 2026] [:error] [pid 38699:tid 38758] [client 172.173.117.54:2148] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "agujlb--Adsw_P-dthZAvwAAAFA"]
[Tue May 19 07:41:10.601703 2026] [:error] [pid 38705:tid 38782] [client 172.173.117.54:19682] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/buy.php"] [unique_id "agujlsg5dNOZ5umN9lsnPwAAAI0"]
[Tue May 19 07:41:12.441868 2026] [:error] [pid 46896:tid 46909] [client 172.173.117.54:18637] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "agujmKCHyzL3Ci9LGE3sXwAAAYs"]
[Tue May 19 07:41:13.621982 2026] [:error] [pid 46896:tid 46905] [client 172.173.117.54:28705] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "agujmaCHyzL3Ci9LGE3sYQAAAYc"]
[Tue May 19 07:41:15.795791 2026] [:error] [pid 38699:tid 38754] [client 172.173.117.54:21523] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "agujm7--Adsw_P-dthZAwwAAAEw"]
[Tue May 19 07:41:17.034600 2026] [:error] [pid 38697:tid 38738] [client 172.173.117.54:16869] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "agujnaXP9pP6Kgt-msTCEAAAABc"]
[Tue May 19 07:41:20.165545 2026] [:error] [pid 41573:tid 41589] [client 172.173.117.54:19669] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "agujoC1A2bd6JDSW9RY_ZQAAAQ4"]
[Tue May 19 07:41:21.781368 2026] [:error] [pid 38697:tid 38717] [client 172.173.117.54:29710] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "agujoaXP9pP6Kgt-msTCEgAAAAI"]
[Tue May 19 07:41:23.571266 2026] [:error] [pid 38697:tid 38723] [client 172.173.117.54:18632] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "agujo6XP9pP6Kgt-msTCFwAAAAg"]
[Tue May 19 07:41:27.435494 2026] [:error] [pid 38699:tid 38760] [client 172.173.117.54:23139] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hypo.php"] [unique_id "agujp7--Adsw_P-dthZA2wAAAFI"]
[Tue May 19 07:41:29.971082 2026] [:error] [pid 38699:tid 38743] [client 172.173.117.54:17574] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agujqb--Adsw_P-dthZA4QAAAEE"]
[Tue May 19 07:41:31.979084 2026] [:error] [pid 38705:tid 38789] [client 172.173.117.54:39316] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agujq8g5dNOZ5umN9lsnSAAAAJQ"]
[Tue May 19 07:41:33.650399 2026] [:error] [pid 41573:tid 41590] [client 172.173.117.54:20807] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agujrS1A2bd6JDSW9RY_aQAAAQ8"]
[Tue May 19 07:41:34.709167 2026] [:error] [pid 38705:tid 38788] [client 172.173.117.54:21056] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/"] [unique_id "agujrsg5dNOZ5umN9lsnSgAAAJM"]
[Tue May 19 07:41:40.474122 2026] [:error] [pid 38699:tid 38761] [client 172.173.117.54:16834] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "agujtL--Adsw_P-dthZA7AAAAFM"]
[Tue May 19 07:42:43.175094 2026] [proxy_fcgi:error] [pid 46815:tid 46819] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:43.367321 2026] [proxy_fcgi:error] [pid 46815:tid 46823] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:43.558744 2026] [proxy_fcgi:error] [pid 46815:tid 46824] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:43.753783 2026] [proxy_fcgi:error] [pid 46815:tid 46836] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:43.945752 2026] [proxy_fcgi:error] [pid 46815:tid 46820] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:44.216126 2026] [proxy_fcgi:error] [pid 46815:tid 46838] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:44.429038 2026] [proxy_fcgi:error] [pid 46815:tid 46830] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:44.647708 2026] [proxy_fcgi:error] [pid 46815:tid 46840] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:44.839693 2026] [proxy_fcgi:error] [pid 46815:tid 46835] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:45.066225 2026] [proxy_fcgi:error] [pid 46815:tid 46829] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:45.268892 2026] [proxy_fcgi:error] [pid 46815:tid 46819] [client 172.173.117.54:30603] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:42:45.456559 2026] [:error] [pid 46815:tid 46824] [client 172.173.117.54:30603] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aguj9SPnRhJOmA06LgoILAAAAUc"]
[Tue May 19 07:42:49.786733 2026] [:error] [pid 46896:tid 46901] [client 172.173.117.54:63787] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aguj-aCHyzL3Ci9LGE3syQAAAYM"]
[Tue May 19 07:42:50.833286 2026] [:error] [pid 41573:tid 41576] [client 172.173.117.54:21069] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aguj-i1A2bd6JDSW9RY_iQAAAQE"]
[Tue May 19 07:42:53.290174 2026] [:error] [pid 46896:tid 46917] [client 172.173.117.54:33243] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ahax.php"] [unique_id "aguj_aCHyzL3Ci9LGE3szgAAAZM"]
[Tue May 19 07:42:56.796483 2026] [:error] [pid 38814:tid 38827] [client 172.173.117.54:2057] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa2.php"] [unique_id "agukAAvkKuBwP0epzWdgAQAAAMs"]
[Tue May 19 07:42:59.756587 2026] [:error] [pid 38699:tid 38751] [client 172.173.117.54:21545] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa2.php"] [unique_id "agukA7--Adsw_P-dthZBIQAAAEk"]
[Tue May 19 07:43:01.432661 2026] [:error] [pid 46896:tid 46906] [client 172.173.117.54:21086] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa2.php"] [unique_id "agukBaCHyzL3Ci9LGE3s2gAAAYg"]
[Tue May 19 07:43:02.770843 2026] [:error] [pid 46896:tid 46918] [client 172.173.117.54:62538] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa2.php"] [unique_id "agukBqCHyzL3Ci9LGE3s3QAAAZQ"]
[Tue May 19 07:43:04.710044 2026] [:error] [pid 38697:tid 38729] [client 172.173.117.54:16838] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "agukCKXP9pP6Kgt-msTCpgAAAA4"]
[Tue May 19 07:43:08.405285 2026] [:error] [pid 38814:tid 38829] [client 172.173.117.54:29723] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "agukDAvkKuBwP0epzWdgFAAAAM0"]
[Tue May 19 07:43:09.766089 2026] [:error] [pid 38697:tid 38738] [client 172.173.117.54:17409] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "agukDaXP9pP6Kgt-msTCqwAAABc"]
[Tue May 19 07:43:11.530562 2026] [:error] [pid 46815:tid 46831] [client 172.173.117.54:62582] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "agukDyPnRhJOmA06LgoINgAAAU4"]
[Tue May 19 07:43:12.482048 2026] [:error] [pid 46815:tid 46820] [client 172.173.117.54:12639] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/login8.php"] [unique_id "agukECPnRhJOmA06LgoIOgAAAUM"]
[Tue May 19 07:43:17.667347 2026] [:error] [pid 46896:tid 46902] [client 172.173.117.54:2105] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/login8.php"] [unique_id "agukFaCHyzL3Ci9LGE3tBQAAAYQ"]
[Tue May 19 07:43:19.226622 2026] [:error] [pid 38814:tid 38821] [client 172.173.117.54:59301] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/login8.php"] [unique_id "agukFwvkKuBwP0epzWdgFQAAAMU"]
[Tue May 19 07:43:25.235937 2026] [:error] [pid 46896:tid 46899] [client 172.173.117.54:49771] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/login8.php"] [unique_id "agukHaCHyzL3Ci9LGE3tGAAAAYE"]
[Tue May 19 07:43:26.489719 2026] [:error] [pid 38814:tid 38839] [client 172.173.117.54:47805] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oiqcXuO.php"] [unique_id "agukHgvkKuBwP0epzWdgHwAAANc"]
[Tue May 19 07:43:27.383892 2026] [:error] [pid 38705:tid 38771] [client 172.173.117.54:17463] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oiqcXuO.php"] [unique_id "agukH8g5dNOZ5umN9lsnegAAAII"]
[Tue May 19 07:43:28.975526 2026] [:error] [pid 46896:tid 46921] [client 172.173.117.54:59292] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oiqcXuO.php"] [unique_id "agukIKCHyzL3Ci9LGE3tHgAAAZc"]
[Tue May 19 07:43:30.089970 2026] [:error] [pid 38697:tid 38728] [client 172.173.117.54:63780] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/oiqcXuO.php"] [unique_id "agukIqXP9pP6Kgt-msTCzwAAAA0"]
[Tue May 19 07:43:32.485886 2026] [:error] [pid 38699:tid 38755] [client 88.88.156.124:56644] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "agukJL--Adsw_P-dthZBUQAAAE0"]
[Tue May 19 07:43:32.648018 2026] [:error] [pid 38697:tid 38734] [client 172.173.117.54:47773] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nx.php"] [unique_id "agukJKXP9pP6Kgt-msTC2AAAABM"]
[Tue May 19 07:43:34.349022 2026] [:error] [pid 41573:tid 41584] [client 172.173.117.54:29744] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nx.php"] [unique_id "agukJi1A2bd6JDSW9RY_owAAAQk"]
[Tue May 19 07:43:34.960406 2026] [:error] [pid 46896:tid 46908] [client 88.88.156.124:47180] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agukJqCHyzL3Ci9LGE3tKQAAAYo"]
[Tue May 19 07:43:36.108916 2026] [:error] [pid 46815:tid 46836] [client 172.173.117.54:17414] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nx.php"] [unique_id "agukKCPnRhJOmA06LgoIVwAAAVM"]
[Tue May 19 07:43:37.399856 2026] [:error] [pid 38697:tid 38725] [client 88.88.156.124:55400] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agukKaXP9pP6Kgt-msTC5wAAAAo"]
[Tue May 19 07:43:38.197249 2026] [:error] [pid 38697:tid 38735] [client 172.173.117.54:35402] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/nx.php"] [unique_id "agukKqXP9pP6Kgt-msTC6gAAABQ"]
[Tue May 19 07:43:40.452141 2026] [:error] [pid 38699:tid 38759] [client 88.88.156.124:59084] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agukLL--Adsw_P-dthZBWwAAAFE"]
[Tue May 19 07:43:41.100894 2026] [:error] [pid 38699:tid 38749] [client 172.173.117.54:48390] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dr.php"] [unique_id "agukLb--Adsw_P-dthZBYwAAAEc"]
[Tue May 19 07:43:42.030785 2026] [:error] [pid 38697:tid 38727] [client 172.173.117.54:12624] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dr.php"] [unique_id "agukLqXP9pP6Kgt-msTDHgAAAAw"]
[Tue May 19 07:43:42.473535 2026] [:error] [pid 38699:tid 38761] [client 88.88.156.124:59094] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agukLr--Adsw_P-dthZBbAAAAFM"]
[Tue May 19 07:43:42.966921 2026] [:error] [pid 38705:tid 38775] [client 172.173.117.54:17637] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dr.php"] [unique_id "agukLsg5dNOZ5umN9lsnfwAAAIY"]
[Tue May 19 07:43:44.139713 2026] [:error] [pid 46815:tid 46832] [client 172.173.117.54:52149] [client 172.173.117.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dr.php"] [unique_id "agukMCPnRhJOmA06LgoIZAAAAU8"]
[Tue May 19 07:43:44.452270 2026] [:error] [pid 38699:tid 38756] [client 88.88.156.124:59106] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agukML--Adsw_P-dthZBcAAAAE4"]
[Tue May 19 07:43:46.420791 2026] [:error] [pid 41573:tid 41576] [client 88.88.156.124:37830] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agukMi1A2bd6JDSW9RY_tgAAAQE"]
[Tue May 19 07:43:46.801768 2026] [proxy_fcgi:error] [pid 38814:tid 38816] [client 172.173.117.54:21601] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:43:46.996041 2026] [proxy_fcgi:error] [pid 38814:tid 38825] [client 172.173.117.54:21601] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:43:47.189512 2026] [proxy_fcgi:error] [pid 38814:tid 38839] [client 172.173.117.54:21601] AH01071: Got error 'Primary script unknown'
[Tue May 19 07:43:48.402011 2026] [:error] [pid 38699:tid 38744] [client 88.88.156.124:37836] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agukNL--Adsw_P-dthZBdwAAAEI"]
[Tue May 19 07:43:50.391477 2026] [:error] [pid 41573:tid 41585] [client 88.88.156.124:37838] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agukNi1A2bd6JDSW9RY_uQAAAQo"]
[Tue May 19 07:43:52.362522 2026] [:error] [pid 46815:tid 46837] [client 88.88.156.124:37848] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agukOCPnRhJOmA06LgoIagAAAVQ"]
[Tue May 19 07:43:54.340834 2026] [:error] [pid 41573:tid 41580] [client 88.88.156.124:37862] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agukOi1A2bd6JDSW9RY_uwAAAQU"]
[Tue May 19 07:43:56.310920 2026] [:error] [pid 38697:tid 38732] [client 88.88.156.124:46902] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agukPKXP9pP6Kgt-msTDMQAAABE"]
[Tue May 19 07:43:58.284835 2026] [:error] [pid 38705:tid 38782] [client 88.88.156.124:46914] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agukPsg5dNOZ5umN9lsnhwAAAI0"]
[Tue May 19 07:44:00.261685 2026] [:error] [pid 38697:tid 38723] [client 88.88.156.124:46916] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agukQKXP9pP6Kgt-msTDNgAAAAg"]
[Tue May 19 07:44:02.235391 2026] [:error] [pid 38705:tid 38781] [client 88.88.156.124:46922] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agukQsg5dNOZ5umN9lsniAAAAIw"]
[Tue May 19 07:44:04.224729 2026] [:error] [pid 46815:tid 46825] [client 88.88.156.124:46928] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "agukRCPnRhJOmA06LgoIcgAAAUg"]
[Tue May 19 07:44:06.211485 2026] [:error] [pid 38705:tid 38777] [client 88.88.156.124:46938] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agukRsg5dNOZ5umN9lsniQAAAIg"]
[Tue May 19 07:44:08.037324 2026] [:error] [pid 46815:tid 46841] [client 88.88.156.124:47128] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agukSCPnRhJOmA06LgoIdAAAAVg"]
[Tue May 19 07:44:10.027426 2026] [:error] [pid 46815:tid 46819] [client 88.88.156.124:47142] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "agukSiPnRhJOmA06LgoIdgAAAUI"]
[Tue May 19 07:44:12.016875 2026] [:error] [pid 38699:tid 38755] [client 88.88.156.124:47146] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agukTL--Adsw_P-dthZBhAAAAE0"]
[Tue May 19 07:44:13.242020 2026] [:error] [pid 46896:tid 46918] [client 88.88.156.124:47160] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agukTaCHyzL3Ci9LGE3taAAAAZQ"]
[Tue May 19 07:44:17.073339 2026] [:error] [pid 38699:tid 38757] [client 88.88.156.124:58014] [client 88.88.156.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agukUb--Adsw_P-dthZBqAAAAE8"]
[Tue May 19 08:50:02.738617 2026] [:error] [pid 38699:tid 38764] [client 93.158.213.26:56988] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "aguzur--Adsw_P-dthZNHQAAAFY"]
[Tue May 19 08:50:06.375488 2026] [:error] [pid 38814:tid 38822] [client 93.158.213.26:35690] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "aguzvgvkKuBwP0epzWdkjQAAAMY"]
[Tue May 19 08:50:09.291618 2026] [:error] [pid 46815:tid 46818] [client 93.158.213.26:60924] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "aguzwSPnRhJOmA06LgoRQwAAAUE"]
[Tue May 19 08:50:11.470010 2026] [:error] [pid 46896:tid 46906] [client 93.158.213.26:60930] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "aguzw6CHyzL3Ci9LGE34AwAAAYg"]
[Tue May 19 08:50:13.563606 2026] [:error] [pid 38697:tid 38727] [client 93.158.213.26:40156] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "aguzxaXP9pP6Kgt-msTWxwAAAAw"]
[Tue May 19 08:50:15.634634 2026] [:error] [pid 38705:tid 38776] [client 93.158.213.26:40164] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "aguzx8g5dNOZ5umN9lstmQAAAIc"]
[Tue May 19 08:50:17.557075 2026] [:error] [pid 38697:tid 38730] [client 93.158.213.26:40178] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "aguzyaXP9pP6Kgt-msTWyQAAAA8"]
[Tue May 19 08:50:19.559745 2026] [:error] [pid 38699:tid 38763] [client 93.158.213.26:40180] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "aguzy7--Adsw_P-dthZNIwAAAFU"]
[Tue May 19 08:50:22.187762 2026] [:error] [pid 46896:tid 46903] [client 93.158.213.26:55260] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "aguzzqCHyzL3Ci9LGE34CgAAAYU"]
[Tue May 19 08:50:24.293724 2026] [:error] [pid 38814:tid 38823] [client 93.158.213.26:36224] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "aguz0AvkKuBwP0epzWdkjwAAAMc"]
[Tue May 19 08:50:26.755732 2026] [:error] [pid 38697:tid 38723] [client 93.158.213.26:38422] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "aguz0qXP9pP6Kgt-msTWzQAAAAg"]
[Tue May 19 08:50:28.834824 2026] [:error] [pid 41573:tid 41579] [client 93.158.213.26:36232] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "aguz1C1A2bd6JDSW9RZGCQAAAQQ"]
[Tue May 19 08:50:31.250792 2026] [:error] [pid 38697:tid 38725] [client 93.158.213.26:38436] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "aguz16XP9pP6Kgt-msTWzwAAAAo"]
[Tue May 19 08:50:33.355370 2026] [:error] [pid 41573:tid 41593] [client 93.158.213.26:44570] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "aguz2S1A2bd6JDSW9RZGCgAAARI"]
[Tue May 19 08:50:35.501866 2026] [:error] [pid 46896:tid 46906] [client 93.158.213.26:44576] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aguz26CHyzL3Ci9LGE34EQAAAYg"]
[Tue May 19 08:50:37.551931 2026] [:error] [pid 46896:tid 46903] [client 93.158.213.26:44590] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "aguz3aCHyzL3Ci9LGE34GAAAAYU"]
[Tue May 19 08:50:39.672610 2026] [:error] [pid 46896:tid 46902] [client 93.158.213.26:44606] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "aguz36CHyzL3Ci9LGE34GgAAAYQ"]
[Tue May 19 08:50:41.761041 2026] [:error] [pid 46896:tid 46911] [client 93.158.213.26:44608] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "aguz4aCHyzL3Ci9LGE34HwAAAY0"]
[Tue May 19 08:50:44.025917 2026] [:error] [pid 46896:tid 46915] [client 93.158.213.26:34398] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "aguz5KCHyzL3Ci9LGE34IQAAAZE"]
[Tue May 19 08:50:46.003782 2026] [:error] [pid 38697:tid 38726] [client 93.158.213.26:34412] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "aguz5qXP9pP6Kgt-msTW0gAAAAs"]
[Tue May 19 08:50:48.174997 2026] [:error] [pid 38697:tid 38720] [client 93.158.213.26:34416] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "aguz6KXP9pP6Kgt-msTW0wAAAAU"]
[Tue May 19 08:50:50.846352 2026] [:error] [pid 38697:tid 38735] [client 93.158.213.26:46108] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "aguz6qXP9pP6Kgt-msTW1AAAABQ"]
[Tue May 19 08:50:53.083062 2026] [:error] [pid 46896:tid 46900] [client 93.158.213.26:59946] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "aguz7aCHyzL3Ci9LGE34KQAAAYI"]
[Tue May 19 08:50:54.990122 2026] [:error] [pid 38814:tid 38838] [client 93.158.213.26:59960] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aguz7gvkKuBwP0epzWdkkwAAANY"]
[Tue May 19 08:50:57.190708 2026] [:error] [pid 46896:tid 46918] [client 93.158.213.26:59976] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "aguz8aCHyzL3Ci9LGE34LQAAAZQ"]
[Tue May 19 08:50:59.133715 2026] [:error] [pid 46896:tid 46919] [client 93.158.213.26:59978] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "aguz86CHyzL3Ci9LGE34MAAAAZU"]
[Tue May 19 08:51:29.645122 2026] [:error] [pid 46896:tid 46900] [client 93.158.213.26:59726] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agu0EaCHyzL3Ci9LGE34YgAAAYI"]
[Tue May 19 08:51:31.438893 2026] [:error] [pid 38814:tid 38826] [client 93.158.213.26:38312] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agu0EwvkKuBwP0epzWdkngAAAMo"]
[Tue May 19 08:51:33.862347 2026] [:error] [pid 38697:tid 38718] [client 93.158.213.26:48802] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agu0FaXP9pP6Kgt-msTW1wAAAAM"]
[Tue May 19 08:51:36.052214 2026] [:error] [pid 46896:tid 46907] [client 93.158.213.26:48818] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agu0GKCHyzL3Ci9LGE34bAAAAYk"]
[Tue May 19 08:51:38.022766 2026] [:error] [pid 38705:tid 38775] [client 93.158.213.26:48820] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agu0Gsg5dNOZ5umN9lstpQAAAIY"]
[Tue May 19 08:51:40.635561 2026] [:error] [pid 46896:tid 46905] [client 93.158.213.26:55774] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agu0HKCHyzL3Ci9LGE34bgAAAYc"]
[Tue May 19 08:51:43.152510 2026] [:error] [pid 46896:tid 46919] [client 93.158.213.26:54570] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agu0H6CHyzL3Ci9LGE34dAAAAZU"]
[Tue May 19 08:51:45.235887 2026] [:error] [pid 38705:tid 38774] [client 93.158.213.26:54572] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agu0Icg5dNOZ5umN9lstpgAAAIU"]
[Tue May 19 08:51:47.581421 2026] [:error] [pid 38697:tid 38737] [client 93.158.213.26:54582] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agu0I6XP9pP6Kgt-msTW2QAAABY"]
[Tue May 19 08:51:49.535076 2026] [:error] [pid 38697:tid 38734] [client 93.158.213.26:54592] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agu0JaXP9pP6Kgt-msTW2gAAABM"]
[Tue May 19 08:51:51.506446 2026] [:error] [pid 46815:tid 46832] [client 93.158.213.26:54606] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agu0JyPnRhJOmA06LgoRXgAAAU8"]
[Tue May 19 08:51:54.281067 2026] [:error] [pid 38699:tid 38756] [client 93.158.213.26:48194] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agu0Kr--Adsw_P-dthZNPAAAAE4"]
[Tue May 19 08:51:56.307717 2026] [:error] [pid 46815:tid 46828] [client 93.158.213.26:34638] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agu0LCPnRhJOmA06LgoRZAAAAUs"]
[Tue May 19 08:51:58.331516 2026] [:error] [pid 38697:tid 38719] [client 93.158.213.26:34640] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agu0LqXP9pP6Kgt-msTW3QAAAAQ"]
[Tue May 19 08:52:00.680783 2026] [:error] [pid 46896:tid 46915] [client 93.158.213.26:48206] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agu0MKCHyzL3Ci9LGE34kgAAAZE"]
[Tue May 19 08:52:02.735826 2026] [:error] [pid 46896:tid 46910] [client 93.158.213.26:34650] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agu0MqCHyzL3Ci9LGE34mAAAAYw"]
[Tue May 19 08:52:04.617293 2026] [:error] [pid 38697:tid 38726] [client 93.158.213.26:57700] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agu0NKXP9pP6Kgt-msTW4AAAAAs"]
[Tue May 19 08:52:06.772895 2026] [:error] [pid 38697:tid 38724] [client 93.158.213.26:57702] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agu0NqXP9pP6Kgt-msTW5QAAAAk"]
[Tue May 19 08:52:09.719243 2026] [:error] [pid 38697:tid 38715] [client 93.158.213.26:57708] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agu0OaXP9pP6Kgt-msTW7QAAAAA"]
[Tue May 19 08:52:13.595011 2026] [:error] [pid 38814:tid 38818] [client 93.158.213.26:50852] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agu0PQvkKuBwP0epzWdkqgAAAMI"]
[Tue May 19 10:19:55.599141 2026] [:error] [pid 38705:tid 38784] [client 43.153.35.128:34706] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agvIy8g5dNOZ5umN9ls22QAAAI8"]
[Tue May 19 11:15:45.233290 2026] [:error] [pid 38705:tid 38792] [client 185.231.100.72:60148] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agvV4cg5dNOZ5umN9ls9DQAAAJc"]
[Tue May 19 11:15:47.764356 2026] [:error] [pid 38699:tid 38749] [client 185.231.100.72:52258] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "agvV47--Adsw_P-dthZliAAAAEc"]
[Tue May 19 11:15:49.802178 2026] [:error] [pid 46896:tid 46921] [client 185.231.100.72:46650] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agvV5aCHyzL3Ci9LGE0gaAAAAZc"]
[Tue May 19 11:15:52.339013 2026] [:error] [pid 46896:tid 46913] [client 185.231.100.72:47196] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agvV6KCHyzL3Ci9LGE0gcgAAAY8"]
[Tue May 19 11:15:54.254345 2026] [:error] [pid 38705:tid 38770] [client 185.231.100.72:38986] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agvV6sg5dNOZ5umN9ls9FwAAAIE"]
[Tue May 19 11:15:56.265413 2026] [:error] [pid 41573:tid 41578] [client 185.231.100.72:38998] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agvV7C1A2bd6JDSW9RZT0QAAAQM"]
[Tue May 19 11:15:58.398529 2026] [:error] [pid 38705:tid 38774] [client 185.231.100.72:39002] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agvV7sg5dNOZ5umN9ls9GwAAAIU"]
[Tue May 19 11:16:00.930293 2026] [:error] [pid 38699:tid 38743] [client 185.231.100.72:42882] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agvV8L--Adsw_P-dthZllAAAAEE"]
[Tue May 19 11:16:02.851845 2026] [:error] [pid 41573:tid 41593] [client 185.231.100.72:35546] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agvV8i1A2bd6JDSW9RZT1AAAARI"]
[Tue May 19 11:16:05.404739 2026] [:error] [pid 38697:tid 38725] [client 185.231.100.72:42892] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agvV9aXP9pP6Kgt-msT8dQAAAAo"]
[Tue May 19 11:16:07.445992 2026] [:error] [pid 41573:tid 41580] [client 185.231.100.72:35554] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agvV9y1A2bd6JDSW9RZT1gAAAQU"]
[Tue May 19 11:16:09.796386 2026] [:error] [pid 46896:tid 46905] [client 185.231.100.72:42902] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agvV-aCHyzL3Ci9LGE0geQAAAYc"]
[Tue May 19 11:16:12.121932 2026] [:error] [pid 38705:tid 38772] [client 185.231.100.72:40508] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agvV_Mg5dNOZ5umN9ls9HwAAAIM"]
[Tue May 19 11:16:14.755516 2026] [:error] [pid 46896:tid 46910] [client 185.231.100.72:40512] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agvV_qCHyzL3Ci9LGE0ghQAAAYw"]
[Tue May 19 11:16:16.662948 2026] [:error] [pid 38697:tid 38718] [client 185.231.100.72:45334] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agvWAKXP9pP6Kgt-msT8nQAAAAM"]
[Tue May 19 11:16:19.181212 2026] [:error] [pid 38697:tid 38735] [client 185.231.100.72:40528] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agvWA6XP9pP6Kgt-msT8owAAABQ"]
[Tue May 19 11:16:21.632398 2026] [:error] [pid 46815:tid 46819] [client 185.231.100.72:54494] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agvWBSPnRhJOmA06LgokgwAAAUI"]
[Tue May 19 11:16:23.573442 2026] [:error] [pid 38697:tid 38716] [client 185.231.100.72:54822] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agvWB6XP9pP6Kgt-msT8qAAAAAE"]
[Tue May 19 11:16:25.962670 2026] [:error] [pid 46896:tid 46913] [client 185.231.100.72:54506] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agvWCaCHyzL3Ci9LGE0gkAAAAY8"]
[Tue May 19 11:16:27.873202 2026] [:error] [pid 46815:tid 46820] [client 185.231.100.72:54828] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agvWCyPnRhJOmA06LgokhQAAAUM"]
[Tue May 19 11:16:30.404039 2026] [:error] [pid 38705:tid 38783] [client 185.231.100.72:33846] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agvWDsg5dNOZ5umN9ls9KAAAAI4"]
[Tue May 19 11:16:32.339898 2026] [:error] [pid 46896:tid 46917] [client 185.231.100.72:56706] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agvWEKCHyzL3Ci9LGE0guwAAAZM"]
[Tue May 19 11:16:34.329076 2026] [:error] [pid 46896:tid 46899] [client 185.231.100.72:56716] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agvWEqCHyzL3Ci9LGE0gwgAAAYE"]
[Tue May 19 11:16:36.847930 2026] [:error] [pid 46896:tid 46911] [client 185.231.100.72:33852] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agvWFKCHyzL3Ci9LGE0g0wAAAY0"]
[Tue May 19 11:16:39.305091 2026] [:error] [pid 38697:tid 38725] [client 185.231.100.72:33862] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agvWF6XP9pP6Kgt-msT86gAAAAo"]
[Tue May 19 11:16:41.216420 2026] [:error] [pid 46896:tid 46922] [client 185.231.100.72:33544] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agvWGaCHyzL3Ci9LGE0g6QAAAZg"]
[Tue May 19 11:17:02.460823 2026] [:error] [pid 38699:tid 38749] [client 185.231.100.72:33548] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agvWLr--Adsw_P-dthZlygAAAEc"]
[Tue May 19 11:17:04.426343 2026] [:error] [pid 46896:tid 46905] [client 185.231.100.72:34174] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agvWMKCHyzL3Ci9LGE0hAgAAAYc"]
[Tue May 19 11:17:06.332390 2026] [:error] [pid 46896:tid 46911] [client 185.231.100.72:34186] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agvWMqCHyzL3Ci9LGE0hBAAAAY0"]
[Tue May 19 11:17:08.846173 2026] [:error] [pid 38699:tid 38766] [client 185.231.100.72:39262] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agvWNL--Adsw_P-dthZl1AAAAFg"]
[Tue May 19 11:17:10.783483 2026] [:error] [pid 38697:tid 38725] [client 185.231.100.72:36282] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agvWNqXP9pP6Kgt-msT8_gAAAAo"]
[Tue May 19 11:17:12.783250 2026] [:error] [pid 38814:tid 38825] [client 185.231.100.72:36286] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agvWOAvkKuBwP0epzWdxZAAAAMk"]
[Tue May 19 11:17:15.297114 2026] [:error] [pid 46896:tid 46905] [client 185.231.100.72:51224] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agvWO6CHyzL3Ci9LGE0hPQAAAYc"]
[Tue May 19 11:17:17.228484 2026] [:error] [pid 38699:tid 38760] [client 185.231.100.72:36300] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agvWPb--Adsw_P-dthZl8wAAAFI"]
[Tue May 19 11:17:19.245508 2026] [:error] [pid 38814:tid 38836] [client 185.231.100.72:36310] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agvWPwvkKuBwP0epzWdxZwAAANQ"]
[Tue May 19 11:17:21.235855 2026] [:error] [pid 38697:tid 38731] [client 185.231.100.72:52344] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agvWQaXP9pP6Kgt-msT9MgAAABA"]
[Tue May 19 11:17:23.238759 2026] [:error] [pid 46815:tid 46823] [client 185.231.100.72:52354] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agvWQyPnRhJOmA06LgolGAAAAUY"]
[Tue May 19 11:17:25.236907 2026] [:error] [pid 46896:tid 46908] [client 185.231.100.72:52360] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agvWRaCHyzL3Ci9LGE0hTAAAAYo"]
[Tue May 19 11:17:27.238222 2026] [:error] [pid 46815:tid 46833] [client 185.231.100.72:52374] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agvWRyPnRhJOmA06LgolHQAAAVA"]
[Tue May 19 11:17:29.219174 2026] [:error] [pid 46896:tid 46901] [client 185.231.100.72:52376] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agvWSaCHyzL3Ci9LGE0hVAAAAYM"]
[Tue May 19 11:17:31.736430 2026] [:error] [pid 38697:tid 38725] [client 185.231.100.72:54828] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agvWS6XP9pP6Kgt-msT9OwAAAAo"]
[Tue May 19 11:17:34.193634 2026] [:error] [pid 38697:tid 38738] [client 185.231.100.72:54832] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agvWTqXP9pP6Kgt-msT9QAAAABc"]
[Tue May 19 11:17:35.378806 2026] [:error] [pid 46815:tid 46837] [client 185.231.100.72:43384] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agvWTyPnRhJOmA06LgolIAAAAVQ"]
[Tue May 19 11:17:39.236675 2026] [:error] [pid 38697:tid 38726] [client 185.231.100.72:43396] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agvWU6XP9pP6Kgt-msT9UQAAAAs"]
[Tue May 19 11:29:00.727896 2026] [:error] [pid 41573:tid 41578] [client 175.27.171.245:41972] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agvY_C1A2bd6JDSW9RZVigAAAQM"]
[Tue May 19 11:34:04.285592 2026] [:error] [pid 38697:tid 38733] [client 137.131.60.126:44814] [client 137.131.60.126] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/pdf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agvaLKXP9pP6Kgt-msQDEgAAABI"]
[Tue May 19 15:22:53.756371 2026] [:error] [pid 46815:tid 46833] [client 43.130.139.177:48018] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agwPzSPnRhJOmA06LgpflgAAAVA"]
[Tue May 19 17:33:28.514553 2026] [:error] [pid 38705:tid 38783] [client 34.138.197.173:62633] [client 34.138.197.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.197.173, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agwuaMg5dNOZ5umN9ltaCQAAAI4"]
[Tue May 19 17:33:28.524706 2026] [proxy_fcgi:error] [pid 38705:tid 38783] [client 34.138.197.173:62633] AH01071: Got error 'Primary script unknown'
[Tue May 19 17:33:31.388065 2026] [:error] [pid 38705:tid 38787] [client 34.138.197.173:62633] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "agwua8g5dNOZ5umN9ltaFAAAAJI"]
[Tue May 19 17:33:31.902540 2026] [:error] [pid 38705:tid 38773] [client 34.138.197.173:56474] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "agwua8g5dNOZ5umN9ltaFQAAAIQ"]
[Tue May 19 17:33:32.407891 2026] [:error] [pid 29823:tid 29858] [client 34.138.197.173:62393] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "agwubGO09C0nAz8vRk4v1gAAAdM"]
[Tue May 19 17:33:32.923955 2026] [:error] [pid 38705:tid 38778] [client 34.138.197.173:52905] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "agwubMg5dNOZ5umN9ltaFgAAAIk"]
[Tue May 19 17:33:33.444347 2026] [:error] [pid 38705:tid 38789] [client 34.138.197.173:50588] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "agwubcg5dNOZ5umN9ltaGQAAAJQ"]
[Tue May 19 17:33:33.930593 2026] [:error] [pid 41573:tid 41597] [client 34.138.197.173:59163] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "agwubS1A2bd6JDSW9RZ1xwAAARY"]
[Tue May 19 17:33:34.427184 2026] [:error] [pid 29823:tid 29842] [client 34.138.197.173:59466] [client 34.138.197.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "agwubmO09C0nAz8vRk4v1wAAAcc"]
[Tue May 19 19:28:56.914142 2026] [:error] [pid 46896:tid 46909] [client 43.165.174.53:48914] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agxJeKCHyzL3Ci9LGE1gaAAAAYs"]
[Tue May 19 20:17:02.182932 2026] [:error] [pid 38697:tid 38739] [client 43.167.157.80:50852] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agxUvqXP9pP6Kgt-msRPHQAAABg"]
[Tue May 19 21:56:29.648109 2026] [:error] [pid 38705:tid 38776] [client 103.178.142.81:58706] [client 103.178.142.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.178.142.81, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "agxsDcg5dNOZ5umN9ltlXwAAAIc"]
[Tue May 19 21:56:29.660981 2026] [proxy_fcgi:error] [pid 38705:tid 38776] [client 103.178.142.81:58706] AH01071: Got error 'Primary script unknown'
[Wed May 20 00:07:35.597056 2026] [:error] [pid 29622:tid 29624] [client 147.135.214.95:42482] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "agyKxzkOqPKWkPs_P15aoAAAAgA"]
[Wed May 20 00:07:38.135407 2026] [:error] [pid 29823:tid 29859] [client 147.135.214.95:39792] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agyKymO09C0nAz8vRk5l7AAAAdQ"]
[Wed May 20 00:07:42.095546 2026] [:error] [pid 46815:tid 46839] [client 147.135.214.95:55302] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agyKziPnRhJOmA06LgqFyAAAAVY"]
[Wed May 20 00:13:52.487617 2026] [:error] [pid 46896:tid 46901] [client 43.156.202.34:58104] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agyMQKCHyzL3Ci9LGE1tvQAAAYM"]
[Wed May 20 00:55:14.824481 2026] [:error] [pid 46896:tid 46916] [client 49.235.136.28:38646] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agyV8qCHyzL3Ci9LGE1vPAAAAZI"]
[Wed May 20 01:08:08.379730 2026] [:error] [pid 38697:tid 38731] [client 43.162.114.69:37448] [client 43.162.114.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agyY-KXP9pP6Kgt-msRr-gAAABA"]
[Wed May 20 02:38:59.979242 2026] [proxy_fcgi:error] [pid 38699:tid 38749] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:00.199356 2026] [proxy_fcgi:error] [pid 38699:tid 38751] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:00.444510 2026] [proxy_fcgi:error] [pid 38699:tid 38747] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:00.689152 2026] [proxy_fcgi:error] [pid 38699:tid 38744] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:00.907492 2026] [proxy_fcgi:error] [pid 38699:tid 38754] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:01.154382 2026] [proxy_fcgi:error] [pid 38699:tid 38742] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:01.374324 2026] [proxy_fcgi:error] [pid 38699:tid 38762] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:01.836736 2026] [proxy_fcgi:error] [pid 38699:tid 38755] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:02.052992 2026] [proxy_fcgi:error] [pid 38699:tid 38761] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:02.292462 2026] [proxy_fcgi:error] [pid 38699:tid 38763] [client 20.220.236.34:40682] AH01071: Got error 'Primary script unknown'
[Wed May 20 02:39:02.504908 2026] [:error] [pid 38699:tid 38760] [client 20.220.236.34:40682] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agyuRr--Adsw_P-dthbddgAAAFI"]
[Wed May 20 02:39:03.429988 2026] [:error] [pid 38705:tid 38783] [client 20.220.236.34:14883] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agyuR8g5dNOZ5umN9ltzogAAAI4"]
[Wed May 20 02:39:04.324143 2026] [:error] [pid 29823:tid 29835] [client 20.220.236.34:4065] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agyuSGO09C0nAz8vRk56ygAAAcA"]
[Wed May 20 02:39:05.244830 2026] [:error] [pid 41573:tid 41587] [client 20.220.236.34:31723] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "agyuSS1A2bd6JDSW9RbasAAAAQw"]
[Wed May 20 02:58:51.134030 2026] [:error] [pid 29823:tid 29852] [client 135.181.213.219:48228] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agyy62O09C0nAz8vRk58HgAAAc0"]
[Wed May 20 02:58:53.645845 2026] [:error] [pid 41573:tid 41599] [client 135.181.213.219:48238] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agyy7S1A2bd6JDSW9RbeeAAAARg"]
[Wed May 20 02:58:56.223783 2026] [:error] [pid 38697:tid 38725] [client 135.181.213.219:48240] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agyy8KXP9pP6Kgt-msR3MwAAAAo"]
[Wed May 20 02:58:58.739484 2026] [:error] [pid 29823:tid 29858] [client 135.181.213.219:48250] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agyy8mO09C0nAz8vRk58IgAAAdM"]
[Wed May 20 02:59:01.262369 2026] [:error] [pid 41573:tid 41578] [client 135.181.213.219:16788] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agyy9S1A2bd6JDSW9RbegwAAAQM"]
[Wed May 20 02:59:03.884771 2026] [:error] [pid 38697:tid 38737] [client 135.181.213.219:16800] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "agyy96XP9pP6Kgt-msR3OAAAABY"]
[Wed May 20 02:59:06.406816 2026] [:error] [pid 29823:tid 29838] [client 135.181.213.219:16826] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agyy-mO09C0nAz8vRk58JQAAAcM"]
[Wed May 20 02:59:08.909381 2026] [:error] [pid 29823:tid 29854] [client 135.181.213.219:16848] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agyy_GO09C0nAz8vRk58JwAAAc8"]
[Wed May 20 02:59:11.470969 2026] [:error] [pid 41573:tid 41597] [client 135.181.213.219:30694] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agyy_y1A2bd6JDSW9RbehQAAARY"]
[Wed May 20 02:59:14.022135 2026] [:error] [pid 41573:tid 41581] [client 135.181.213.219:30708] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agyzAi1A2bd6JDSW9RbeigAAAQY"]
[Wed May 20 02:59:16.635337 2026] [:error] [pid 38699:tid 38757] [client 135.181.213.219:30718] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agyzBL--Adsw_P-dthbf9wAAAE8"]
[Wed May 20 02:59:19.137120 2026] [:error] [pid 38699:tid 38750] [client 135.181.213.219:30734] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agyzB7--Adsw_P-dthbf-wAAAEg"]
[Wed May 20 03:00:42.921137 2026] [:error] [pid 41573:tid 41584] [client 135.181.213.219:17004] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agyzWi1A2bd6JDSW9RbetAAAAQk"]
[Wed May 20 03:00:44.597026 2026] [:error] [pid 38699:tid 38761] [client 135.181.213.219:46164] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agyzXL--Adsw_P-dthbgDgAAAFM"]
[Wed May 20 03:00:48.381152 2026] [:error] [pid 38697:tid 38717] [client 135.181.213.219:46172] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agyzYKXP9pP6Kgt-msR3SgAAAAI"]
[Wed May 20 03:41:41.995599 2026] [:error] [pid 27706:tid 27719] [client 65.108.2.171:5228] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agy89S7FDg1R2uNDfeqpGQAAAAE"]
[Wed May 20 03:41:43.916817 2026] [:error] [pid 27706:tid 27732] [client 65.108.2.171:5236] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agy89y7FDg1R2uNDfeqpIAAAAA4"]
[Wed May 20 03:41:45.922577 2026] [:error] [pid 27708:tid 27772] [client 65.108.2.171:55038] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agy8-ci-0ZN4onezSfJYAwAAAIA"]
[Wed May 20 03:41:47.996082 2026] [:error] [pid 27803:tid 27809] [client 65.108.2.171:55042] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agy8-xKGK3gwdL8PE-Er_wAAAMQ"]
[Wed May 20 03:41:50.464594 2026] [:error] [pid 27803:tid 27812] [client 65.108.2.171:40122] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agy8_hKGK3gwdL8PE-EsBQAAAMc"]
[Wed May 20 03:41:52.456718 2026] [:error] [pid 27706:tid 27718] [client 65.108.2.171:55046] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "agy9AC7FDg1R2uNDfeqpJgAAAAA"]
[Wed May 20 03:41:54.548734 2026] [:error] [pid 27803:tid 27814] [client 65.108.2.171:1602] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "agy9AhKGK3gwdL8PE-EsDQAAAMk"]
[Wed May 20 03:41:56.478875 2026] [:error] [pid 27708:tid 27781] [client 65.108.2.171:1606] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "agy9BMi-0ZN4onezSfJYIwAAAIk"]
[Wed May 20 03:41:58.596352 2026] [:error] [pid 27707:tid 27763] [client 65.108.2.171:1620] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "agy9BmyzdbGE0LveTTdpiQAAAFI"]
[Wed May 20 03:42:01.297808 2026] [:error] [pid 27708:tid 27795] [client 65.108.2.171:23488] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "agy9Cci-0ZN4onezSfJYLgAAAJc"]
[Wed May 20 03:42:03.176120 2026] [:error] [pid 27708:tid 27773] [client 65.108.2.171:1634] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agy9C8i-0ZN4onezSfJYNAAAAIE"]
[Wed May 20 03:42:05.073885 2026] [:error] [pid 27803:tid 27809] [client 65.108.2.171:38996] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "agy9DRKGK3gwdL8PE-EsGwAAAMQ"]
[Wed May 20 03:42:07.244855 2026] [:error] [pid 27708:tid 27796] [client 65.108.2.171:39006] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agy9D8i-0ZN4onezSfJYOgAAAJg"]
[Wed May 20 03:42:09.289940 2026] [:error] [pid 27803:tid 27815] [client 65.108.2.171:39010] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "agy9ERKGK3gwdL8PE-EsIQAAAMo"]
[Wed May 20 03:42:11.289128 2026] [:error] [pid 27706:tid 27725] [client 65.108.2.171:39024] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agy9Ey7FDg1R2uNDfeqpNQAAAAc"]
[Wed May 20 03:42:13.781970 2026] [:error] [pid 27708:tid 27792] [client 65.108.2.171:27296] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agy9Fci-0ZN4onezSfJYQwAAAJQ"]
[Wed May 20 03:42:15.815532 2026] [:error] [pid 27707:tid 27748] [client 65.108.2.171:22400] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agy9F2yzdbGE0LveTTdpogAAAEM"]
[Wed May 20 03:42:17.873435 2026] [:error] [pid 27803:tid 27809] [client 65.108.2.171:22402] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agy9GRKGK3gwdL8PE-EsKAAAAMQ"]
[Wed May 20 03:42:20.484749 2026] [:error] [pid 27803:tid 27813] [client 65.108.2.171:16560] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agy9HBKGK3gwdL8PE-EsLQAAAMg"]
[Wed May 20 03:42:22.527255 2026] [:error] [pid 27707:tid 27755] [client 65.108.2.171:22416] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agy9HmyzdbGE0LveTTdpqgAAAEo"]
[Wed May 20 03:42:23.952312 2026] [:error] [pid 27706:tid 27728] [client 120.229.212.240:13371] [client 120.229.212.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agy9Hy7FDg1R2uNDfeqpQwAAAAo"], referer: http://www.switchcreative.net/
[Wed May 20 03:42:24.619007 2026] [:error] [pid 27708:tid 27792] [client 65.108.2.171:9414] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agy9IMi-0ZN4onezSfJYVAAAAJQ"]
[Wed May 20 03:42:26.763112 2026] [:error] [pid 27706:tid 27724] [client 65.108.2.171:9418] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agy9Ii7FDg1R2uNDfeqpSAAAAAY"]
[Wed May 20 03:42:29.147329 2026] [:error] [pid 27706:tid 27738] [client 65.108.2.171:9426] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agy9JS7FDg1R2uNDfeqpTAAAABQ"]
[Wed May 20 03:42:32.913799 2026] [:error] [pid 27706:tid 27742] [client 65.108.2.171:9442] [client 65.108.2.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agy9KC7FDg1R2uNDfeqpUgAAABg"]
[Wed May 20 04:47:43.988492 2026] [:error] [pid 59245:tid 59286] [client 51.75.128.50:35358] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "agzMb6OutR70QIZRVkTOtAAAAEY"]
[Wed May 20 04:47:46.099583 2026] [:error] [pid 59244:tid 59276] [client 51.75.128.50:35372] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "agzMcrxU0SdQQE7pLs2tswAAABc"]
[Wed May 20 04:47:48.189652 2026] [:error] [pid 59349:tid 59370] [client 51.75.128.50:35386] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "agzMdDvvxTUy-ppKSZV_8QAAANM"]
[Wed May 20 04:47:50.298820 2026] [:error] [pid 36145:tid 36168] [client 51.75.128.50:40612] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "agzMdqtS18KtvF2VagsvmwAAARQ"]
[Wed May 20 04:47:52.693299 2026] [:error] [pid 36145:tid 36159] [client 51.75.128.50:53518] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "agzMeKtS18KtvF2VagsvowAAAQs"]
[Wed May 20 04:47:54.478987 2026] [:error] [pid 59244:tid 59262] [client 51.75.128.50:40626] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agzMerxU0SdQQE7pLs2ttgAAAAk"]
[Wed May 20 04:47:56.899464 2026] [:error] [pid 36145:tid 36159] [client 51.75.128.50:53524] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "agzMfKtS18KtvF2VagsvrQAAAQs"]
[Wed May 20 04:47:58.931273 2026] [:error] [pid 36145:tid 36160] [client 51.75.128.50:40632] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "agzMfqtS18KtvF2VagsvsgAAAQw"]
[Wed May 20 04:48:01.274105 2026] [:error] [pid 36145:tid 36163] [client 51.75.128.50:58180] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "agzMgatS18KtvF2VagsvugAAAQ8"]
[Wed May 20 04:48:03.290571 2026] [:error] [pid 36145:tid 36164] [client 51.75.128.50:59454] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "agzMg6tS18KtvF2VagsvwAAAARA"]
[Wed May 20 04:48:05.316429 2026] [:error] [pid 59245:tid 59304] [client 51.75.128.50:59456] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agzMhaOutR70QIZRVkTOwgAAAFg"]
[Wed May 20 04:48:07.335195 2026] [:error] [pid 59244:tid 59257] [client 51.75.128.50:59470] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "agzMh7xU0SdQQE7pLs2tvQAAAAQ"]
[Wed May 20 04:48:09.199738 2026] [:error] [pid 59244:tid 59273] [client 51.75.128.50:59482] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "agzMibxU0SdQQE7pLs2twgAAABQ"]
[Wed May 20 04:48:11.224435 2026] [:error] [pid 59244:tid 59255] [client 51.75.128.50:52366] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "agzMi7xU0SdQQE7pLs2txQAAAAI"]
[Wed May 20 04:48:13.237856 2026] [:error] [pid 36145:tid 36153] [client 51.75.128.50:52374] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "agzMjatS18KtvF2VagsvzgAAAQU"]
[Wed May 20 04:48:15.110299 2026] [:error] [pid 36145:tid 36158] [client 51.75.128.50:52382] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agzMj6tS18KtvF2Vagsv1AAAAQo"]
[Wed May 20 04:48:17.130900 2026] [:error] [pid 36145:tid 36162] [client 51.75.128.50:52392] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agzMkatS18KtvF2Vagsv2QAAAQ4"]
[Wed May 20 04:48:19.621604 2026] [:error] [pid 36145:tid 36149] [client 51.75.128.50:58402] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agzMk6tS18KtvF2Vagsv4AAAAQE"]
[Wed May 20 04:48:21.613293 2026] [:error] [pid 59349:tid 59367] [client 51.75.128.50:57018] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agzMlTvvxTUy-ppKSZV_9QAAANA"]
[Wed May 20 04:48:23.623425 2026] [:error] [pid 59244:tid 59262] [client 51.75.128.50:57032] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agzMl7xU0SdQQE7pLs2t2wAAAAk"]
[Wed May 20 04:48:25.662050 2026] [:error] [pid 59244:tid 59272] [client 51.75.128.50:57038] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agzMmbxU0SdQQE7pLs2t4AAAABM"]
[Wed May 20 04:48:27.670102 2026] [:error] [pid 36145:tid 36167] [client 51.75.128.50:57046] [client 51.75.128.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agzMm6tS18KtvF2Vagsv7AAAARM"]
[Wed May 20 04:52:10.981596 2026] [:error] [pid 36145:tid 36152] [client 144.172.115.139:54550] [client 144.172.115.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "agzNeqtS18KtvF2VagsxNQAAAQQ"]
[Wed May 20 05:21:42.361049 2026] [:error] [pid 57774:tid 57827] [client 54.37.252.36:58390] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agzUZqzH4LWfnGU0RXC2egAAAdg"]
[Wed May 20 05:21:44.324057 2026] [:error] [pid 59349:tid 59359] [client 54.37.252.36:46776] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "agzUaDvvxTUy-ppKSZWHaAAAAMg"]
[Wed May 20 05:21:46.262998 2026] [:error] [pid 57835:tid 57926] [client 54.37.252.36:46786] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "agzUamYoVRVVHvoOYbo9RwAAAsg"]
[Wed May 20 05:21:48.144123 2026] [:error] [pid 59349:tid 59367] [client 54.37.252.36:46792] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "agzUbDvvxTUy-ppKSZWHfAAAANA"]
[Wed May 20 05:21:50.002379 2026] [:error] [pid 57774:tid 57808] [client 54.37.252.36:55030] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "agzUbqzH4LWfnGU0RXC2fwAAAcU"]
[Wed May 20 05:21:51.814517 2026] [:error] [pid 36145:tid 36172] [client 54.37.252.36:55038] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agzUb6tS18KtvF2Vags6jgAAARg"]
[Wed May 20 05:21:53.899882 2026] [:error] [pid 59244:tid 59256] [client 54.37.252.36:55052] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agzUcbxU0SdQQE7pLs2xUwAAAAM"]
[Wed May 20 05:21:55.868536 2026] [:error] [pid 59349:tid 59371] [client 54.37.252.36:55064] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "agzUczvvxTUy-ppKSZWHkgAAANQ"]
[Wed May 20 05:21:57.830282 2026] [:error] [pid 57832:tid 57849] [client 54.37.252.36:55066] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agzUdUNip5HpFD8GxxX2XQAAAgw"]
[Wed May 20 05:21:59.678964 2026] [:error] [pid 59349:tid 59370] [client 54.37.252.36:54396] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agzUdzvvxTUy-ppKSZWHmgAAANM"]
[Wed May 20 05:22:01.653876 2026] [:error] [pid 59349:tid 59362] [client 54.37.252.36:54402] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agzUeTvvxTUy-ppKSZWHoAAAAMs"]
[Wed May 20 05:22:03.659083 2026] [:error] [pid 57833:tid 57865] [client 54.37.252.36:54418] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agzUe7VqIe7Xlzcr5bagNQAAAkE"]
[Wed May 20 05:22:05.444405 2026] [:error] [pid 57834:tid 57908] [client 54.37.252.36:54428] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "agzUfXTOfwZ09EhqoYD6YwAAApE"]
[Wed May 20 05:22:07.328514 2026] [:error] [pid 59349:tid 59355] [client 54.37.252.36:54442] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agzUfzvvxTUy-ppKSZWHqwAAAMQ"]
[Wed May 20 05:22:18.044969 2026] [:error] [pid 59349:tid 59364] [client 54.37.252.36:42892] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agzUijvvxTUy-ppKSZWHtgAAAM0"]
[Wed May 20 05:22:21.933566 2026] [:error] [pid 59244:tid 59262] [client 54.37.252.36:34536] [client 54.37.252.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agzUjbxU0SdQQE7pLs2xgAAAAAk"]
[Wed May 20 05:38:22.207675 2026] [:error] [pid 59349:tid 59374] [client 170.106.37.134:53964] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agzYTjvvxTUy-ppKSZWNDQAAANc"]
[Wed May 20 05:59:11.996590 2026] [:error] [pid 36145:tid 36163] [client 123.181.228.9:2522] [client 123.181.228.9] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "agzdL6tS18KtvF2Vags_igAAAQ8"], referer: http://switchcreative.net/
[Wed May 20 06:35:49.283937 2026] [:error] [pid 57835:tid 57934] [client 147.135.213.107:33748] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "agzlxWYoVRVVHvoOYbpFQAAAAtA"]
[Wed May 20 06:35:51.281659 2026] [:error] [pid 59244:tid 59262] [client 147.135.213.107:45184] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agzlx7xU0SdQQE7pLs2_7gAAAAk"]
[Wed May 20 06:35:53.755528 2026] [:error] [pid 57832:tid 57850] [client 147.135.213.107:55364] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "agzlyUNip5HpFD8GxxX7oAAAAg0"]
[Wed May 20 06:35:56.305978 2026] [:error] [pid 59349:tid 59361] [client 147.135.213.107:55366] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "agzlzDvvxTUy-ppKSZWYyAAAAMo"]
[Wed May 20 06:35:58.348684 2026] [:error] [pid 59349:tid 59356] [client 147.135.213.107:45200] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "agzlzjvvxTUy-ppKSZWY0wAAAMU"]
[Wed May 20 06:36:00.802117 2026] [:error] [pid 57774:tid 57806] [client 147.135.213.107:55380] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "agzl0KzH4LWfnGU0RXC56gAAAcM"]
[Wed May 20 06:36:03.343111 2026] [:error] [pid 59244:tid 59275] [client 147.135.213.107:42806] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "agzl07xU0SdQQE7pLs2_8QAAABY"]
[Wed May 20 06:36:05.881883 2026] [:error] [pid 57835:tid 57921] [client 147.135.213.107:42808] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/jili%20slot.aspx"] [unique_id "agzl1WYoVRVVHvoOYbpFRgAAAsM"]
[Wed May 20 06:36:08.266989 2026] [:error] [pid 57835:tid 57932] [client 147.135.213.107:42814] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "agzl2GYoVRVVHvoOYbpFSAAAAs4"]
[Wed May 20 06:36:10.638207 2026] [:error] [pid 59349:tid 59362] [client 147.135.213.107:42822] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "agzl2jvvxTUy-ppKSZWZFQAAAMs"]
[Wed May 20 06:36:12.944364 2026] [:error] [pid 59349:tid 59359] [client 147.135.213.107:58000] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agzl3DvvxTUy-ppKSZWZJAAAAMg"]
[Wed May 20 06:36:15.056735 2026] [:error] [pid 36145:tid 36171] [client 147.135.213.107:34208] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agzl36tS18KtvF2VagtEJgAAARc"]
[Wed May 20 06:36:16.867444 2026] [:error] [pid 36145:tid 36149] [client 147.135.213.107:34212] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agzl4KtS18KtvF2VagtEKgAAAQE"]
[Wed May 20 06:36:19.459095 2026] [:error] [pid 57774:tid 57818] [client 147.135.213.107:58012] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "agzl46zH4LWfnGU0RXC57gAAAc8"]
[Wed May 20 06:36:21.528603 2026] [:error] [pid 57742:tid 57765] [client 147.135.213.107:38684] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agzl5aQ_304u6rVT2w-mSgAAAVU"]
[Wed May 20 06:36:23.459596 2026] [:error] [pid 57742:tid 57766] [client 147.135.213.107:38700] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agzl56Q_304u6rVT2w-mSwAAAVY"]
[Wed May 20 06:36:26.003277 2026] [:error] [pid 59244:tid 59255] [client 147.135.213.107:34458] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agzl6rxU0SdQQE7pLs3ABAAAAAI"]
[Wed May 20 06:36:27.921117 2026] [:error] [pid 36145:tid 36155] [client 147.135.213.107:38710] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agzl66tS18KtvF2VagtELAAAAQc"]
[Wed May 20 06:36:29.972483 2026] [:error] [pid 57742:tid 57760] [client 147.135.213.107:38724] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agzl7aQ_304u6rVT2w-mTgAAAVA"]
[Wed May 20 06:36:31.745232 2026] [:error] [pid 59349:tid 59353] [client 147.135.213.107:35684] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agzl7zvvxTUy-ppKSZWZOAAAAMI"]
[Wed May 20 06:36:33.675947 2026] [:error] [pid 59244:tid 59253] [client 147.135.213.107:35694] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agzl8bxU0SdQQE7pLs3AGwAAAAA"]
[Wed May 20 06:36:35.579264 2026] [:error] [pid 36145:tid 36148] [client 147.135.213.107:35700] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "agzl86tS18KtvF2VagtEMQAAAQA"]
[Wed May 20 06:36:37.519308 2026] [:error] [pid 57774:tid 57823] [client 147.135.213.107:35712] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "agzl9azH4LWfnGU0RXC58gAAAdQ"]
[Wed May 20 06:36:39.424053 2026] [:error] [pid 57833:tid 57878] [client 147.135.213.107:35722] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agzl97VqIe7Xlzcr5bal7AAAAk4"]
[Wed May 20 06:36:41.831293 2026] [:error] [pid 59349:tid 59370] [client 147.135.213.107:44802] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "agzl-TvvxTUy-ppKSZWZTwAAANM"]
[Wed May 20 06:36:44.237366 2026] [:error] [pid 59245:tid 59290] [client 147.135.213.107:44806] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "agzl_KOutR70QIZRVkTYOgAAAEo"]
[Wed May 20 06:36:46.639497 2026] [:error] [pid 59245:tid 59302] [client 147.135.213.107:46970] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "agzl_qOutR70QIZRVkTYOwAAAFY"]
[Wed May 20 06:37:08.568779 2026] [:error] [pid 57742:tid 57761] [client 147.135.213.107:46982] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "agzmFKQ_304u6rVT2w-mXwAAAVE"]
[Wed May 20 06:37:10.381313 2026] [:error] [pid 59349:tid 59365] [client 147.135.213.107:33220] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "agzmFjvvxTUy-ppKSZWZWgAAAM4"]
[Wed May 20 06:37:12.301368 2026] [:error] [pid 57835:tid 57935] [client 147.135.213.107:58298] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "agzmGGYoVRVVHvoOYbpFYgAAAtE"]
[Wed May 20 06:37:14.203362 2026] [:error] [pid 59349:tid 59368] [client 147.135.213.107:58310] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "agzmGjvvxTUy-ppKSZWZYQAAANE"]
[Wed May 20 06:37:16.104529 2026] [:error] [pid 59349:tid 59364] [client 147.135.213.107:58326] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "agzmHDvvxTUy-ppKSZWZZgAAAM0"]
[Wed May 20 06:37:18.017517 2026] [:error] [pid 59349:tid 59365] [client 147.135.213.107:58342] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "agzmHjvvxTUy-ppKSZWZbAAAAM4"]
[Wed May 20 06:37:20.055397 2026] [:error] [pid 59245:tid 59282] [client 147.135.213.107:58348] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "agzmIKOutR70QIZRVkTYPAAAAEI"]
[Wed May 20 06:37:21.950801 2026] [:error] [pid 57835:tid 57930] [client 147.135.213.107:45176] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "agzmIWYoVRVVHvoOYbpFZQAAAsw"]
[Wed May 20 06:37:23.831412 2026] [:error] [pid 36145:tid 36158] [client 147.135.213.107:45224] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "agzmI6tS18KtvF2VagtERAAAAQo"]
[Wed May 20 06:37:25.881682 2026] [:error] [pid 59245:tid 59298] [client 147.135.213.107:45238] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "agzmJaOutR70QIZRVkTYPQAAAFI"]
[Wed May 20 06:37:27.767135 2026] [:error] [pid 59349:tid 59355] [client 147.135.213.107:45274] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "agzmJzvvxTUy-ppKSZWZcwAAAMQ"]
[Wed May 20 06:37:29.673033 2026] [:error] [pid 36145:tid 36154] [client 147.135.213.107:45290] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "agzmKatS18KtvF2VagtESQAAAQY"]
[Wed May 20 06:37:31.562662 2026] [:error] [pid 59349:tid 59366] [client 147.135.213.107:52806] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "agzmKzvvxTUy-ppKSZWZdwAAAM8"]
[Wed May 20 06:37:33.602890 2026] [:error] [pid 59349:tid 59357] [client 147.135.213.107:52818] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "agzmLTvvxTUy-ppKSZWZfAAAAMY"]
[Wed May 20 06:37:35.501101 2026] [:error] [pid 59244:tid 59253] [client 147.135.213.107:52826] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "agzmL7xU0SdQQE7pLs3AOwAAAAA"]
[Wed May 20 06:37:37.379470 2026] [:error] [pid 57833:tid 57869] [client 147.135.213.107:52830] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "agzmMbVqIe7Xlzcr5bamCQAAAkU"]
[Wed May 20 06:37:39.284813 2026] [:error] [pid 59244:tid 59273] [client 147.135.213.107:52836] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "agzmM7xU0SdQQE7pLs3AQQAAABQ"]
[Wed May 20 06:37:41.316935 2026] [:error] [pid 57835:tid 57933] [client 147.135.213.107:58740] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "agzmNWYoVRVVHvoOYbpFZwAAAs8"]
[Wed May 20 06:37:43.231196 2026] [:error] [pid 59349:tid 59372] [client 147.135.213.107:58744] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "agzmNzvvxTUy-ppKSZWZggAAANU"]
[Wed May 20 06:37:45.119363 2026] [:error] [pid 59349:tid 59353] [client 147.135.213.107:58758] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "agzmOTvvxTUy-ppKSZWZgwAAAMI"]
[Wed May 20 06:37:47.156762 2026] [:error] [pid 57832:tid 57853] [client 147.135.213.107:58766] [client 147.135.213.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "agzmO0Nip5HpFD8GxxX8CAAAAhA"]
[Wed May 20 06:49:44.163303 2026] [:error] [pid 57834:tid 57893] [client 144.172.116.102:37030] [client 144.172.116.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "agzpCHTOfwZ09EhqoYAB-wAAAoI"]
[Wed May 20 07:57:29.331076 2026] [:error] [pid 41364:tid 41373] [client 146.19.215.244:32950] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "agz46RKTmyvxtNXrN-gwmAAAAIc"]
[Wed May 20 07:57:31.649714 2026] [:error] [pid 41364:tid 41377] [client 146.19.215.244:51836] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "agz46xKTmyvxtNXrN-gwmgAAAIs"]
[Wed May 20 07:57:34.100512 2026] [:error] [pid 41279:tid 41346] [client 146.19.215.244:48196] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "agz47rEFyfaehGZbt4wvsgAAAMo"]
[Wed May 20 07:57:36.501854 2026] [:error] [pid 41279:tid 41344] [client 146.19.215.244:48204] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "agz48LEFyfaehGZbt4wvtQAAAMg"]
[Wed May 20 07:57:39.006691 2026] [:error] [pid 41279:tid 41359] [client 146.19.215.244:48210] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agz487EFyfaehGZbt4wvtgAAANc"]
[Wed May 20 07:57:41.557643 2026] [:error] [pid 41279:tid 41350] [client 146.19.215.244:48226] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agz49bEFyfaehGZbt4wvtwAAAM4"]
[Wed May 20 07:57:43.944815 2026] [:error] [pid 41364:tid 41371] [client 146.19.215.244:44856] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "agz49xKTmyvxtNXrN-gwqwAAAIU"]
[Wed May 20 07:57:46.407860 2026] [:error] [pid 41279:tid 41343] [client 146.19.215.244:44872] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "agz4-rEFyfaehGZbt4wvuQAAAMc"]
[Wed May 20 07:57:48.896516 2026] [:error] [pid 41278:tid 41322] [client 146.19.215.244:44878] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agz4_PWiNKASEfiGdwZiBwAAAE0"]
[Wed May 20 07:57:51.381391 2026] [:error] [pid 41279:tid 41338] [client 146.19.215.244:44888] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agz4_7EFyfaehGZbt4wvvQAAAMI"]
[Wed May 20 07:57:53.850126 2026] [:error] [pid 41277:tid 41285] [client 146.19.215.244:44904] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agz5AbTTCltJmboB5ue5ngAAAAM"]
[Wed May 20 07:57:56.320164 2026] [:error] [pid 41364:tid 41367] [client 146.19.215.244:53024] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agz5BBKTmyvxtNXrN-gwuwAAAIE"]
[Wed May 20 07:58:54.277605 2026] [:error] [pid 41364:tid 41371] [client 146.19.215.244:47022] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/1234%20slot.aspx"] [unique_id "agz5PhKTmyvxtNXrN-gxLAAAAIU"]
[Wed May 20 07:58:56.223463 2026] [:error] [pid 41279:tid 41339] [client 146.19.215.244:57630] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/1234%20superslot.aspx"] [unique_id "agz5QLEFyfaehGZbt4wv9wAAAMM"]
[Wed May 20 07:58:58.224000 2026] [:error] [pid 41278:tid 41322] [client 146.19.215.244:57636] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "agz5QvWiNKASEfiGdwZiLgAAAE0"]
[Wed May 20 07:59:00.226008 2026] [:error] [pid 41278:tid 41328] [client 146.19.215.244:57646] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "agz5RPWiNKASEfiGdwZiLwAAAFM"]
[Wed May 20 07:59:02.068455 2026] [:error] [pid 41277:tid 41286] [client 146.19.215.244:57658] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "agz5RrTTCltJmboB5ue5rQAAAAQ"]
[Wed May 20 07:59:03.987518 2026] [:error] [pid 41364:tid 41371] [client 146.19.215.244:48814] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "agz5RxKTmyvxtNXrN-gxOAAAAIU"]
[Wed May 20 07:59:06.021124 2026] [:error] [pid 41364:tid 41389] [client 146.19.215.244:48816] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "agz5ShKTmyvxtNXrN-gxPwAAAJc"]
[Wed May 20 07:59:07.919984 2026] [:error] [pid 41277:tid 41290] [client 146.19.215.244:48824] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "agz5S7TTCltJmboB5ue5tAAAAAg"]
[Wed May 20 07:59:09.941801 2026] [:error] [pid 41364:tid 41386] [client 146.19.215.244:48834] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "agz5TRKTmyvxtNXrN-gxQwAAAJQ"]
[Wed May 20 07:59:11.722063 2026] [:error] [pid 41364:tid 41387] [client 146.19.215.244:48838] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "agz5TxKTmyvxtNXrN-gxRQAAAJU"]
[Wed May 20 07:59:13.732386 2026] [:error] [pid 41277:tid 41298] [client 146.19.215.244:37782] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "agz5UbTTCltJmboB5ue5uQAAABA"]
[Wed May 20 07:59:27.450412 2026] [:error] [pid 41364:tid 41387] [client 146.19.215.244:42054] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "agz5XxKTmyvxtNXrN-gxUAAAAJU"]
[Wed May 20 07:59:29.472200 2026] [:error] [pid 41279:tid 41336] [client 146.19.215.244:42062] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "agz5YbEFyfaehGZbt4wwAQAAAMA"]
[Wed May 20 07:59:31.473759 2026] [:error] [pid 41277:tid 41306] [client 146.19.215.244:42076] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "agz5Y7TTCltJmboB5ue51gAAABg"]
[Wed May 20 07:59:33.323412 2026] [:error] [pid 41278:tid 41332] [client 146.19.215.244:42088] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "agz5ZfWiNKASEfiGdwZiOwAAAFc"]
[Wed May 20 07:59:35.329749 2026] [:error] [pid 41279:tid 41346] [client 146.19.215.244:48638] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "agz5Z7EFyfaehGZbt4wwAwAAAMo"]
[Wed May 20 07:59:37.219869 2026] [:error] [pid 41364:tid 41376] [client 146.19.215.244:48640] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "agz5aRKTmyvxtNXrN-gxVwAAAIo"]
[Wed May 20 07:59:39.235815 2026] [:error] [pid 41364:tid 41373] [client 146.19.215.244:48644] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "agz5axKTmyvxtNXrN-gxWAAAAIc"]
[Wed May 20 07:59:41.236675 2026] [:error] [pid 41279:tid 41351] [client 146.19.215.244:48656] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "agz5bbEFyfaehGZbt4wwBAAAAM8"]
[Wed May 20 07:59:43.258276 2026] [:error] [pid 41364:tid 41383] [client 146.19.215.244:48668] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "agz5bxKTmyvxtNXrN-gxWgAAAJE"]
[Wed May 20 07:59:45.304279 2026] [:error] [pid 41278:tid 41310] [client 146.19.215.244:39406] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "agz5cfWiNKASEfiGdwZiPgAAAEE"]
[Wed May 20 07:59:47.179725 2026] [:error] [pid 41364:tid 41378] [client 146.19.215.244:39416] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "agz5cxKTmyvxtNXrN-gxXgAAAIw"]
[Wed May 20 07:59:49.175894 2026] [:error] [pid 41278:tid 41311] [client 146.19.215.244:39428] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "agz5dfWiNKASEfiGdwZiQAAAAEI"]
[Wed May 20 07:59:51.227312 2026] [:error] [pid 41278:tid 41318] [client 146.19.215.244:39438] [client 146.19.215.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "agz5d_WiNKASEfiGdwZiQgAAAEk"]
[Wed May 20 08:13:16.221098 2026] [:error] [pid 44059:tid 44073] [client 82.156.34.74:34092] [client 82.156.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "agz8nBfFs-oSOOcyjyxG2wAAAQw"]
[Wed May 20 10:46:47.095182 2026] [:error] [pid 44059:tid 44062] [client 43.134.177.47:38242] [client 43.134.177.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag0glxfFs-oSOOcyjyyDeAAAAQE"]
[Wed May 20 11:30:46.461982 2026] [:error] [pid 41364:tid 41367] [client 43.135.183.82:47276] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag0q5hKTmyvxtNXrN-hrhgAAAIE"]
[Wed May 20 12:23:43.550098 2026] [proxy_fcgi:error] [pid 44059:tid 44075] [client 212.30.36.115:55213] AH01071: Got error 'Primary script unknown'
[Wed May 20 12:23:44.546302 2026] [proxy_fcgi:error] [pid 41279:tid 41350] [client 212.30.36.118:55567] AH01071: Got error 'Primary script unknown'
[Wed May 20 12:23:45.052284 2026] [proxy_fcgi:error] [pid 44059:tid 44061] [client 212.30.36.114:29313] AH01071: Got error 'Primary script unknown'
[Wed May 20 13:24:28.207091 2026] [:error] [pid 41279:tid 41351] [client 135.181.213.219:55380] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ag1FjLEFyfaehGZbt4xsYwAAAM8"]
[Wed May 20 13:24:30.222107 2026] [:error] [pid 41277:tid 41285] [client 135.181.213.219:51734] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag1FjrTTCltJmboB5ufiMAAAAAM"]
[Wed May 20 13:24:32.803825 2026] [:error] [pid 41364:tid 41374] [client 135.181.213.219:64004] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag1FkBKTmyvxtNXrN-iH8AAAAIg"]
[Wed May 20 13:24:34.752463 2026] [:error] [pid 41277:tid 41298] [client 135.181.213.219:51746] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag1FkrTTCltJmboB5ufiMwAAABA"]
[Wed May 20 13:24:36.784522 2026] [:error] [pid 7731:tid 7746] [client 135.181.213.219:51754] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ag1FlH9qQlHXbkl2nEuOsgAAAY0"]
[Wed May 20 13:24:39.357929 2026] [:error] [pid 7731:tid 7735] [client 135.181.213.219:64008] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ag1Fl39qQlHXbkl2nEuOtAAAAYI"]
[Wed May 20 13:24:41.299163 2026] [:error] [pid 7731:tid 7736] [client 135.181.213.219:42386] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag1FmX9qQlHXbkl2nEuOuQAAAYM"]
[Wed May 20 13:24:43.853392 2026] [:error] [pid 44059:tid 44062] [client 135.181.213.219:12902] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag1FmxfFs-oSOOcyjyy6swAAAQE"]
[Wed May 20 13:24:45.820883 2026] [:error] [pid 41364:tid 41385] [client 135.181.213.219:42402] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ag1FnRKTmyvxtNXrN-iH_QAAAJM"]
[Wed May 20 13:24:47.665199 2026] [:error] [pid 41277:tid 41305] [client 135.181.213.219:42404] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ag1Fn7TTCltJmboB5ufiNgAAABc"]
[Wed May 20 13:24:49.668094 2026] [:error] [pid 41278:tid 41314] [client 135.181.213.219:42410] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ag1FofWiNKASEfiGdwaRdQAAAEU"]
[Wed May 20 13:24:51.668833 2026] [:error] [pid 41279:tid 41348] [client 135.181.213.219:55272] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ag1Fo7EFyfaehGZbt4xsZQAAAMw"]
[Wed May 20 13:24:53.661725 2026] [:error] [pid 44059:tid 44085] [client 135.181.213.219:55284] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ag1FpRfFs-oSOOcyjyy6wQAAARg"]
[Wed May 20 13:24:55.649078 2026] [:error] [pid 44059:tid 44080] [client 135.181.213.219:55294] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag1FpxfFs-oSOOcyjyy6xgAAARM"]
[Wed May 20 13:24:58.173135 2026] [:error] [pid 41277:tid 41288] [client 135.181.213.219:46096] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag1FqrTTCltJmboB5ufiNwAAAAY"]
[Wed May 20 13:25:00.649269 2026] [:error] [pid 41278:tid 41317] [client 135.181.213.219:40770] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ag1FrPWiNKASEfiGdwaRdwAAAEg"]
[Wed May 20 13:25:04.069186 2026] [:error] [pid 44059:tid 44073] [client 135.181.213.219:33114] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag1FsBfFs-oSOOcyjyy62AAAAQw"]
[Wed May 20 13:25:07.890075 2026] [:error] [pid 41364:tid 41376] [client 135.181.213.219:33128] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag1FsxKTmyvxtNXrN-iIAwAAAIo"]
[Wed May 20 13:27:44.771560 2026] [:error] [pid 44059:tid 44075] [client 1.12.70.96:47542] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag1GUBfFs-oSOOcyjyy7dAAAAQ4"]
[Wed May 20 14:34:00.401115 2026] [:error] [pid 41278:tid 41330] [client 34.46.57.55:50917] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag1V2PWiNKASEfiGdwaXKwAAAFU"]
[Wed May 20 14:34:00.794179 2026] [:error] [pid 41364:tid 41378] [client 34.46.57.55:55990] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag1V2BKTmyvxtNXrN-iUrgAAAIw"]
[Wed May 20 14:34:01.182035 2026] [:error] [pid 41277:tid 41302] [client 34.46.57.55:53864] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2bTTCltJmboB5ufm1AAAABQ"]
[Wed May 20 15:37:23.442514 2026] [:error] [pid 7731:tid 7736] [client 129.226.214.57:38664] [client 129.226.214.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag1ks39qQlHXbkl2nEur3wAAAYM"]
[Wed May 20 16:29:21.400772 2026] [:error] [pid 44059:tid 44082] [client 43.165.4.2:38228] [client 43.165.4.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag1w4RfFs-oSOOcyjyzrKwAAARU"]
[Wed May 20 16:40:09.789582 2026] [:error] [pid 44059:tid 44074] [client 129.212.237.14:57530] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ag1zaRfFs-oSOOcyjyztdQAAAQ0"]
[Wed May 20 16:40:24.044202 2026] [:error] [pid 7731:tid 7738] [client 129.212.237.14:61211] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/admin/server/php/"] [unique_id "ag1zeH9qQlHXbkl2nEvAuAAAAYU"]
[Wed May 20 16:40:45.031828 2026] [:error] [pid 7731:tid 7752] [client 129.212.237.14:49716] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/fileupload/server/php/"] [unique_id "ag1zjX9qQlHXbkl2nEvAywAAAZM"]
[Wed May 20 16:40:47.068596 2026] [:error] [pid 7731:tid 7750] [client 129.212.237.14:50724] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/public/server/php/"] [unique_id "ag1zj39qQlHXbkl2nEvA2gAAAZE"]
[Wed May 20 16:40:51.608177 2026] [:error] [pid 7731:tid 7735] [client 129.212.237.14:52074] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/admin/assets/jquery-file-upload/server/php/"] [unique_id "ag1zk39qQlHXbkl2nEvA4QAAAYI"]
[Wed May 20 16:40:52.605062 2026] [:error] [pid 41278:tid 41320] [client 129.212.237.14:52246] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/filemanager/dialog.php"] [unique_id "ag1zlPWiNKASEfiGdwaf1wAAAEs"]
[Wed May 20 16:40:53.023287 2026] [:error] [pid 44059:tid 44085] [client 129.212.237.14:52488] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/assets/filemanager/dialog.php"] [unique_id "ag1zlRfFs-oSOOcyjyztuwAAARg"]
[Wed May 20 16:40:53.495600 2026] [:error] [pid 44059:tid 44063] [client 129.212.237.14:52677] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/admin/filemanager/dialog.php"] [unique_id "ag1zlRfFs-oSOOcyjyztvQAAAQI"]
[Wed May 20 16:40:53.884104 2026] [:error] [pid 7731:tid 7749] [client 129.212.237.14:52811] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ag1zlX9qQlHXbkl2nEvA4wAAAZA"]
[Wed May 20 16:40:54.291520 2026] [:error] [pid 41277:tid 41299] [client 129.212.237.14:52968] [client 129.212.237.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/js/filemanager/dialog.php"] [unique_id "ag1zlrTTCltJmboB5ufuggAAABE"]
[Wed May 20 17:36:29.743554 2026] [:error] [pid 44059:tid 44076] [client 51.75.128.94:41618] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ag2AnRfFs-oSOOcyjyz4wQAAAQ8"]
[Wed May 20 17:36:32.092377 2026] [:error] [pid 41279:tid 41360] [client 51.75.128.94:49954] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag2AoLEFyfaehGZbt4yDWAAAANg"]
[Wed May 20 17:36:34.484886 2026] [:error] [pid 7731:tid 7751] [client 51.75.128.94:49964] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag2Aon9qQlHXbkl2nEvSKgAAAZI"]
[Wed May 20 17:36:36.512631 2026] [:error] [pid 41364:tid 41377] [client 51.75.128.94:53860] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag2ApBKTmyvxtNXrN-ixAwAAAIs"]
[Wed May 20 17:36:38.572951 2026] [:error] [pid 41364:tid 41380] [client 51.75.128.94:53862] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ag2AphKTmyvxtNXrN-ixBQAAAI4"]
[Wed May 20 17:36:40.632324 2026] [:error] [pid 7664:tid 7675] [client 51.75.128.94:53870] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ag2AqHZ8s7o3eiqT2kvlkwAAAUg"]
[Wed May 20 17:36:42.657699 2026] [:error] [pid 41279:tid 41343] [client 51.75.128.94:53878] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ag2AqrEFyfaehGZbt4yDWwAAAMc"]
[Wed May 20 17:36:44.552694 2026] [:error] [pid 44059:tid 44085] [client 51.75.128.94:53892] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ag2ArBfFs-oSOOcyjyz4ygAAARg"]
[Wed May 20 17:36:46.593445 2026] [:error] [pid 41364:tid 41373] [client 51.75.128.94:51342] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ag2ArhKTmyvxtNXrN-ixDgAAAIc"]
[Wed May 20 17:36:48.464627 2026] [:error] [pid 7664:tid 7690] [client 51.75.128.94:51354] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ag2AsHZ8s7o3eiqT2kvlnAAAAVc"]
[Wed May 20 17:36:50.511939 2026] [:error] [pid 41279:tid 41342] [client 51.75.128.94:51364] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ag2AsrEFyfaehGZbt4yDXwAAAMY"]
[Wed May 20 17:36:52.430206 2026] [:error] [pid 7731:tid 7748] [client 51.75.128.94:51368] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ag2AtH9qQlHXbkl2nEvSMgAAAY8"]
[Wed May 20 17:36:54.300949 2026] [:error] [pid 7731:tid 7744] [client 51.75.128.94:51378] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ag2Atn9qQlHXbkl2nEvSOQAAAYs"]
[Wed May 20 17:36:56.845398 2026] [:error] [pid 44059:tid 44065] [client 51.75.128.94:54304] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ag2AuBfFs-oSOOcyjyz41wAAAQQ"]
[Wed May 20 17:36:59.198167 2026] [:error] [pid 41279:tid 41358] [client 51.75.128.94:54320] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ag2Au7EFyfaehGZbt4yDYwAAANY"]
[Wed May 20 17:37:01.539647 2026] [:error] [pid 41279:tid 41344] [client 51.75.128.94:54334] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag2AvbEFyfaehGZbt4yDZwAAAMg"]
[Wed May 20 17:37:04.027527 2026] [:error] [pid 44059:tid 44074] [client 51.75.128.94:54342] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ag2AwBfFs-oSOOcyjyz43QAAAQ0"]
[Wed May 20 17:37:06.027067 2026] [:error] [pid 41279:tid 41358] [client 51.75.128.94:55300] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ag2AwrEFyfaehGZbt4yDbgAAANY"]
[Wed May 20 17:37:08.531785 2026] [:error] [pid 7664:tid 7667] [client 51.75.128.94:50018] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ag2AxHZ8s7o3eiqT2kvlqgAAAUA"]
[Wed May 20 17:37:11.030893 2026] [:error] [pid 44059:tid 44074] [client 51.75.128.94:50024] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ag2AxxfFs-oSOOcyjyz46gAAAQ0"]
[Wed May 20 17:37:13.518550 2026] [:error] [pid 44059:tid 44081] [client 51.75.128.94:50030] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ag2AyRfFs-oSOOcyjyz47QAAARQ"]
[Wed May 20 17:37:15.866005 2026] [:error] [pid 41364:tid 41378] [client 51.75.128.94:50036] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ag2AyxKTmyvxtNXrN-ixHAAAAIw"]
[Wed May 20 17:37:18.355471 2026] [:error] [pid 44059:tid 44071] [client 51.75.128.94:38982] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ag2AzhfFs-oSOOcyjyz4-wAAAQo"]
[Wed May 20 17:37:20.179776 2026] [:error] [pid 41277:tid 41289] [client 51.75.128.94:48286] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ag2A0LTTCltJmboB5ufyTQAAAAc"]
[Wed May 20 17:37:22.200972 2026] [:error] [pid 7731:tid 7753] [client 51.75.128.94:48300] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ag2A0n9qQlHXbkl2nEvSUQAAAZQ"]
[Wed May 20 17:37:24.695288 2026] [:error] [pid 41277:tid 41290] [client 51.75.128.94:38998] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ag2A1LTTCltJmboB5ufyTgAAAAg"]
[Wed May 20 17:37:26.702315 2026] [:error] [pid 7664:tid 7673] [client 51.75.128.94:39540] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ag2A1nZ8s7o3eiqT2kvlrgAAAUY"]
[Wed May 20 17:37:49.749294 2026] [:error] [pid 41364:tid 41382] [client 51.75.128.94:39788] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag2A7RKTmyvxtNXrN-ixNwAAAJA"]
[Wed May 20 17:37:51.698880 2026] [:error] [pid 7664:tid 7684] [client 51.75.128.94:49046] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ag2A73Z8s7o3eiqT2kvlwQAAAVE"]
[Wed May 20 17:37:53.717088 2026] [:error] [pid 41277:tid 41285] [client 51.75.128.94:49054] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ag2A8bTTCltJmboB5ufybAAAAAM"]
[Wed May 20 17:37:55.748628 2026] [:error] [pid 41364:tid 41385] [client 51.75.128.94:49070] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ag2A8xKTmyvxtNXrN-ixPwAAAJM"]
[Wed May 20 17:37:57.626299 2026] [:error] [pid 41277:tid 41296] [client 51.75.128.94:50428] [client 51.75.128.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ag2A9bTTCltJmboB5ufycgAAAA4"]
[Wed May 20 19:50:42.780397 2026] [:error] [pid 41364:tid 41379] [client 95.187.115.44:6010] [client 95.187.115.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.187.115.44, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ag2gEhKTmyvxtNXrN-jKKQAAAI0"]
[Wed May 20 19:50:42.791952 2026] [proxy_fcgi:error] [pid 41364:tid 41379] [client 95.187.115.44:6010] AH01071: Got error 'Primary script unknown'
[Wed May 20 21:05:50.367943 2026] [:error] [pid 41364:tid 41368] [client 147.135.215.173:60912] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ag2xrhKTmyvxtNXrN-jbkQAAAII"]
[Wed May 20 21:05:52.941990 2026] [:error] [pid 41279:tid 41341] [client 147.135.215.173:48062] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ag2xsLEFyfaehGZbt4ydogAAAMU"]
[Wed May 20 21:05:56.032209 2026] [:error] [pid 7664:tid 7684] [client 147.135.215.173:35702] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag2xtHZ8s7o3eiqT2ksGygAAAVE"]
[Wed May 20 21:05:58.599984 2026] [:error] [pid 44059:tid 44064] [client 147.135.215.173:48068] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ag2xthfFs-oSOOcyjywptQAAAQM"]
[Wed May 20 21:06:01.672652 2026] [:error] [pid 7664:tid 7672] [client 147.135.215.173:35708] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ag2xuXZ8s7o3eiqT2ksGzQAAAUU"]
[Wed May 20 21:06:03.972794 2026] [:error] [pid 41364:tid 41371] [client 147.135.215.173:53396] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ag2xuxKTmyvxtNXrN-jboQAAAIU"]
[Wed May 20 21:06:06.165973 2026] [:error] [pid 44059:tid 44074] [client 147.135.215.173:53408] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ag2xvhfFs-oSOOcyjywpvAAAAQ0"]
[Wed May 20 21:06:09.005767 2026] [:error] [pid 7664:tid 7677] [client 147.135.215.173:53160] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ag2xwXZ8s7o3eiqT2ksG0QAAAUo"]
[Wed May 20 21:06:11.419676 2026] [:error] [pid 41364:tid 41369] [client 147.135.215.173:53486] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ag2xwxKTmyvxtNXrN-jbrwAAAIM"]
[Wed May 20 21:06:13.737914 2026] [:error] [pid 7731:tid 7743] [client 147.135.215.173:53490] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ag2xxX9qQlHXbkl2nEsdawAAAYo"]
[Wed May 20 21:06:16.598139 2026] [:error] [pid 41364:tid 41374] [client 147.135.215.173:51462] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ag2xyBKTmyvxtNXrN-jbtAAAAIg"]
[Wed May 20 21:06:18.631403 2026] [:error] [pid 7664:tid 7676] [client 147.135.215.173:53502] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag2xynZ8s7o3eiqT2ksG2wAAAUk"]
[Wed May 20 21:06:21.086736 2026] [:error] [pid 41277:tid 41291] [client 147.135.215.173:51474] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag2xzbTTCltJmboB5ucF2gAAAAk"]
[Wed May 20 21:06:23.679333 2026] [:error] [pid 7664:tid 7680] [client 147.135.215.173:45952] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag2xz3Z8s7o3eiqT2ksG4wAAAU0"]
[Wed May 20 21:06:26.013601 2026] [:error] [pid 41364:tid 41381] [client 147.135.215.173:50468] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ag2x0hKTmyvxtNXrN-jbwQAAAI8"]
[Wed May 20 21:06:28.795010 2026] [:error] [pid 41279:tid 41340] [client 147.135.215.173:45968] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ag2x1LEFyfaehGZbt4ydwAAAAMQ"]
[Wed May 20 21:06:30.883721 2026] [:error] [pid 44059:tid 44071] [client 147.135.215.173:50480] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ag2x1hfFs-oSOOcyjywp1wAAAQo"]
[Wed May 20 21:06:33.396366 2026] [:error] [pid 7731:tid 7739] [client 147.135.215.173:42406] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ag2x2X9qQlHXbkl2nEsdfwAAAYY"]
[Wed May 20 21:06:35.402392 2026] [:error] [pid 7731:tid 7751] [client 147.135.215.173:40442] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ag2x239qQlHXbkl2nEsdgAAAAZI"]
[Wed May 20 21:06:37.826185 2026] [:error] [pid 41277:tid 41301] [client 147.135.215.173:42444] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ag2x3bTTCltJmboB5ucF4gAAABM"]
[Wed May 20 21:06:39.730200 2026] [:error] [pid 7731:tid 7735] [client 147.135.215.173:40448] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ag2x339qQlHXbkl2nEsdigAAAYI"]
[Wed May 20 21:06:42.230755 2026] [:error] [pid 44059:tid 44062] [client 147.135.215.173:39834] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ag2x4hfFs-oSOOcyjywp8AAAAQE"]
[Wed May 20 21:06:44.733042 2026] [:error] [pid 44059:tid 44071] [client 147.135.215.173:39850] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ag2x5BfFs-oSOOcyjywp9gAAAQo"]
[Wed May 20 21:06:46.623016 2026] [:error] [pid 44059:tid 44080] [client 147.135.215.173:41616] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ag2x5hfFs-oSOOcyjywp_AAAARM"]
[Wed May 20 21:07:08.354828 2026] [:error] [pid 41279:tid 41341] [client 147.135.215.173:39866] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ag2x_LEFyfaehGZbt4yd6QAAAMU"]
[Wed May 20 21:07:12.322752 2026] [:error] [pid 41277:tid 41296] [client 147.135.215.173:39446] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ag2yALTTCltJmboB5ucF7gAAAA4"]
[Wed May 20 21:07:14.426687 2026] [:error] [pid 41364:tid 41366] [client 147.135.215.173:45572] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ag2yAhKTmyvxtNXrN-jb8gAAAIA"]
[Wed May 20 21:07:16.839135 2026] [:error] [pid 41364:tid 41369] [client 147.135.215.173:39462] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ag2yBBKTmyvxtNXrN-jb9gAAAIM"]
[Wed May 20 21:07:19.230830 2026] [:error] [pid 41277:tid 41302] [client 147.135.215.173:39478] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ag2yB7TTCltJmboB5ucF7wAAABQ"]
[Wed May 20 21:07:21.299190 2026] [:error] [pid 44059:tid 44070] [client 147.135.215.173:42884] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ag2yCRfFs-oSOOcyjywqLQAAAQk"]
[Wed May 20 21:07:23.708187 2026] [:error] [pid 41278:tid 41323] [client 147.135.215.173:50754] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ag2yC_WiNKASEfiGdwa6uAAAAE4"]
[Wed May 20 21:07:25.732788 2026] [:error] [pid 7731:tid 7740] [client 147.135.215.173:42894] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ag2yDX9qQlHXbkl2nEsdxQAAAYc"]
[Wed May 20 21:07:28.134785 2026] [:error] [pid 7731:tid 7737] [client 147.135.215.173:50768] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ag2yEH9qQlHXbkl2nEsdzwAAAYQ"]
[Wed May 20 21:07:30.655635 2026] [:error] [pid 41278:tid 41333] [client 147.135.215.173:50774] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ag2yEvWiNKASEfiGdwa6vQAAAFg"]
[Wed May 20 21:07:33.186427 2026] [:error] [pid 44059:tid 44069] [client 147.135.215.173:35258] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ag2yFRfFs-oSOOcyjywqOQAAAQg"]
[Wed May 20 21:07:35.703737 2026] [:error] [pid 7731:tid 7751] [client 147.135.215.173:35268] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ag2yF39qQlHXbkl2nEsd3AAAAZI"]
[Wed May 20 21:07:38.201249 2026] [:error] [pid 41277:tid 41299] [client 147.135.215.173:35270] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ag2yGrTTCltJmboB5ucF9QAAABE"]
[Wed May 20 21:07:40.246897 2026] [:error] [pid 7664:tid 7690] [client 147.135.215.173:56982] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ag2yHHZ8s7o3eiqT2ksHKQAAAVc"]
[Wed May 20 21:07:42.781428 2026] [:error] [pid 41279:tid 41360] [client 147.135.215.173:57154] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ag2yHrEFyfaehGZbt4yd9AAAANg"]
[Wed May 20 21:07:45.273655 2026] [:error] [pid 7731:tid 7746] [client 147.135.215.173:57164] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ag2yIX9qQlHXbkl2nEsd9wAAAY0"]
[Wed May 20 21:07:47.780647 2026] [:error] [pid 44059:tid 44074] [client 147.135.215.173:57170] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ag2yIxfFs-oSOOcyjywqdwAAAQ0"]
[Wed May 20 21:07:50.272361 2026] [:error] [pid 41279:tid 41355] [client 147.135.215.173:57184] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ag2yJrEFyfaehGZbt4yd-gAAANM"]
[Wed May 20 21:07:52.774919 2026] [:error] [pid 7731:tid 7736] [client 147.135.215.173:47562] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ag2yKH9qQlHXbkl2nEseDgAAAYM"]
[Wed May 20 21:07:55.975120 2026] [:error] [pid 7731:tid 7736] [client 147.135.215.173:56928] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag2yK39qQlHXbkl2nEseGAAAAYM"]
[Wed May 20 21:07:59.632813 2026] [:error] [pid 41279:tid 41355] [client 147.135.215.173:56942] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag2yL7EFyfaehGZbt4yeAQAAANM"]
[Wed May 20 21:10:57.069368 2026] [:error] [pid 44059:tid 44068] [client 43.156.67.44:49698] [client 43.156.67.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag2y4RfFs-oSOOcyjywrbQAAAQc"]
[Wed May 20 22:07:15.599687 2026] [:error] [pid 41364:tid 41368] [client 31.134.0.165:28497] [client 31.134.0.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.134.0.165, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ag3AExKTmyvxtNXrN-jqlAAAAII"]
[Wed May 20 22:07:15.610439 2026] [proxy_fcgi:error] [pid 41364:tid 41368] [client 31.134.0.165:28497] AH01071: Got error 'Primary script unknown'
[Wed May 20 22:23:43.942435 2026] [:error] [pid 7664:tid 7687] [client 31.220.76.35:54594] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ag3D73Z8s7o3eiqT2ksT_AAAAVQ"]
[Wed May 20 22:23:46.505490 2026] [:error] [pid 44059:tid 44063] [client 31.220.76.35:40230] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ag3D8hfFs-oSOOcyjyw7GQAAAQI"]
[Wed May 20 22:23:48.640616 2026] [:error] [pid 41364:tid 41376] [client 31.220.76.35:54606] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ag3D9BKTmyvxtNXrN-jvkAAAAIo"]
[Wed May 20 22:23:51.262380 2026] [:error] [pid 7731:tid 7736] [client 31.220.76.35:55312] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ag3D939qQlHXbkl2nEs0gwAAAYM"]
[Wed May 20 22:23:53.335040 2026] [:error] [pid 41364:tid 41383] [client 31.220.76.35:58718] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag3D-RKTmyvxtNXrN-jvlAAAAJE"]
[Wed May 20 22:23:55.295977 2026] [:error] [pid 41278:tid 41310] [client 31.220.76.35:58724] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ag3D-_WiNKASEfiGdwbDYwAAAEE"]
[Wed May 20 22:23:57.418885 2026] [:error] [pid 44059:tid 44079] [client 31.220.76.35:58726] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ag3D_RfFs-oSOOcyjyw7JAAAARI"]
[Wed May 20 22:23:59.577304 2026] [:error] [pid 41364:tid 41388] [client 31.220.76.35:58730] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ag3D_xKTmyvxtNXrN-jvpQAAAJY"]
[Wed May 20 22:24:01.606121 2026] [:error] [pid 7664:tid 7678] [client 31.220.76.35:52758] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ag3EAXZ8s7o3eiqT2ksUDwAAAUs"]
[Wed May 20 22:24:03.648609 2026] [:error] [pid 44059:tid 44064] [client 31.220.76.35:52768] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag3EAxfFs-oSOOcyjyw7MwAAAQM"]
[Wed May 20 22:24:06.276210 2026] [:error] [pid 41364:tid 41385] [client 31.220.76.35:37562] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag3EBhKTmyvxtNXrN-jvqgAAAJM"]
[Wed May 20 22:24:08.280951 2026] [:error] [pid 7664:tid 7669] [client 31.220.76.35:52774] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ag3ECHZ8s7o3eiqT2ksUFQAAAUI"]
[Wed May 20 22:24:10.471418 2026] [:error] [pid 41364:tid 41376] [client 31.220.76.35:56838] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag3EChKTmyvxtNXrN-jvsgAAAIo"]
[Wed May 20 22:24:13.043868 2026] [:error] [pid 41278:tid 41323] [client 31.220.76.35:46828] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag3EDfWiNKASEfiGdwbDaQAAAE4"]
[Wed May 20 22:24:15.111772 2026] [:error] [pid 41364:tid 41382] [client 31.220.76.35:56848] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag3EDxKTmyvxtNXrN-jvwwAAAJA"]
[Wed May 20 22:24:17.199643 2026] [:error] [pid 7664:tid 7688] [client 31.220.76.35:56854] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag3EEXZ8s7o3eiqT2ksUJAAAAVU"]
[Wed May 20 22:24:20.004282 2026] [:error] [pid 41279:tid 41338] [client 31.220.76.35:46842] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag3EFLEFyfaehGZbt4yn4AAAAMI"]
[Wed May 20 22:24:21.911698 2026] [:error] [pid 44059:tid 44083] [client 31.220.76.35:43808] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag3EFRfFs-oSOOcyjyw7SgAAARY"]
[Wed May 20 22:24:23.850666 2026] [:error] [pid 41279:tid 41340] [client 31.220.76.35:43824] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ag3EF7EFyfaehGZbt4yn4QAAAMQ"]
[Wed May 20 22:24:25.986548 2026] [:error] [pid 44059:tid 44080] [client 31.220.76.35:43826] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ag3EGRfFs-oSOOcyjyw7TAAAARM"]
[Wed May 20 22:24:27.941000 2026] [:error] [pid 41279:tid 41346] [client 31.220.76.35:43842] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ag3EG7EFyfaehGZbt4yn5QAAAMo"]
[Wed May 20 22:24:29.941645 2026] [:error] [pid 7664:tid 7690] [client 31.220.76.35:59850] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ag3EHXZ8s7o3eiqT2ksUOAAAAVc"]
[Wed May 20 22:24:31.994615 2026] [:error] [pid 7731:tid 7734] [client 31.220.76.35:59866] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ag3EH39qQlHXbkl2nEs0rgAAAYE"]
[Wed May 20 22:24:33.901205 2026] [:error] [pid 44059:tid 44070] [client 31.220.76.35:59876] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ag3EIRfFs-oSOOcyjyw7YAAAAQk"]
[Wed May 20 22:24:35.796725 2026] [:error] [pid 41279:tid 41342] [client 31.220.76.35:59884] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ag3EI7EFyfaehGZbt4yn6wAAAMY"]
[Wed May 20 22:24:37.797294 2026] [:error] [pid 44059:tid 44082] [client 31.220.76.35:59896] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ag3EJRfFs-oSOOcyjyw7YwAAARU"]
[Wed May 20 22:24:39.896010 2026] [:error] [pid 41279:tid 41353] [client 31.220.76.35:40236] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ag3EJ7EFyfaehGZbt4yn8gAAANE"]
[Wed May 20 22:25:01.490060 2026] [:error] [pid 7731:tid 7751] [client 31.220.76.35:40238] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ag3EPX9qQlHXbkl2nEs0zAAAAZI"]
[Wed May 20 22:25:03.559704 2026] [:error] [pid 7731:tid 7750] [client 31.220.76.35:35184] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag3EP39qQlHXbkl2nEs00AAAAZE"]
[Wed May 20 22:25:05.412910 2026] [:error] [pid 44059:tid 44083] [client 31.220.76.35:35194] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ag3EQRfFs-oSOOcyjyw7ewAAARY"]
[Wed May 20 22:25:07.567190 2026] [:error] [pid 41279:tid 41349] [client 31.220.76.35:35208] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag3EQ7EFyfaehGZbt4yoAwAAAM0"]
[Wed May 20 22:25:09.522706 2026] [:error] [pid 41364:tid 41385] [client 31.220.76.35:35220] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag3ERRKTmyvxtNXrN-jv6gAAAJM"]
[Wed May 20 22:25:11.644546 2026] [:error] [pid 7731:tid 7752] [client 31.220.76.35:44478] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag3ER39qQlHXbkl2nEs01wAAAZM"]
[Wed May 20 22:25:13.635933 2026] [:error] [pid 41364:tid 41381] [client 31.220.76.35:44488] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag3ESRKTmyvxtNXrN-jv9QAAAI8"]
[Wed May 20 22:25:15.724414 2026] [:error] [pid 41364:tid 41382] [client 31.220.76.35:44502] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ag3ESxKTmyvxtNXrN-jv_AAAAJA"]
[Wed May 20 22:25:17.759422 2026] [:error] [pid 44059:tid 44065] [client 31.220.76.35:44510] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag3ETRfFs-oSOOcyjyw7ggAAAQQ"]
[Wed May 20 22:25:19.070660 2026] [:error] [pid 41277:tid 41304] [client 31.220.76.35:44516] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag3ET7TTCltJmboB5ucOOgAAABY"]
[Wed May 20 22:25:22.984913 2026] [:error] [pid 41364:tid 41375] [client 31.220.76.35:43986] [client 31.220.76.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag3EUhKTmyvxtNXrN-jwAgAAAIk"]
[Wed May 20 22:27:34.987394 2026] [:error] [pid 7731:tid 7751] [client 103.124.110.97:51072] [client 103.124.110.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.110.97, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ag3E1n9qQlHXbkl2nEs1NwAAAZI"]
[Wed May 20 22:27:34.997828 2026] [proxy_fcgi:error] [pid 7731:tid 7751] [client 103.124.110.97:51072] AH01071: Got error 'Primary script unknown'
[Thu May 21 01:12:41.559663 2026] [:error] [pid 41364:tid 41381] [client 43.134.53.242:42934] [client 43.134.53.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag3riRKTmyvxtNXrN-gjOwAAAI8"]
[Thu May 21 01:22:20.859024 2026] [:error] [pid 7731:tid 7740] [client 79.137.67.90:50056] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ag3tzH9qQlHXbkl2nEtgugAAAYc"]
[Thu May 21 01:22:24.949913 2026] [:error] [pid 7664:tid 7671] [client 79.137.67.90:60168] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ag3t0HZ8s7o3eiqT2kswSgAAAUQ"]
[Thu May 21 01:22:29.693484 2026] [:error] [pid 44059:tid 44077] [client 79.137.67.90:58018] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ag3t1RfFs-oSOOcyjyxbCgAAARA"]
[Thu May 21 01:22:32.363973 2026] [:error] [pid 41364:tid 41367] [client 79.137.67.90:58030] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ag3t2BKTmyvxtNXrN-gmeQAAAIE"]
[Thu May 21 01:22:36.260539 2026] [:error] [pid 41279:tid 41355] [client 79.137.67.90:40992] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag3t3LEFyfaehGZbt4y-fAAAANM"]
[Thu May 21 01:22:39.443388 2026] [:error] [pid 41279:tid 41356] [client 79.137.67.90:41008] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ag3t37EFyfaehGZbt4y-fwAAANQ"]
[Thu May 21 01:22:42.755393 2026] [:error] [pid 44059:tid 44077] [client 79.137.67.90:41010] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag3t4hfFs-oSOOcyjyxbDAAAARA"]
[Thu May 21 01:22:45.910786 2026] [:error] [pid 44059:tid 44084] [client 79.137.67.90:40390] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ag3t5RfFs-oSOOcyjyxbFAAAARc"]
[Thu May 21 01:22:49.392861 2026] [:error] [pid 41364:tid 41369] [client 79.137.67.90:40396] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag3t6RKTmyvxtNXrN-gmkAAAAIM"]
[Thu May 21 01:22:52.753975 2026] [:error] [pid 41364:tid 41367] [client 79.137.67.90:40400] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag3t7BKTmyvxtNXrN-gmnAAAAIE"]
[Thu May 21 01:22:56.160942 2026] [:error] [pid 41364:tid 41370] [client 79.137.67.90:45050] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag3t8BKTmyvxtNXrN-gmqwAAAIQ"]
[Thu May 21 01:22:59.848046 2026] [:error] [pid 41277:tid 41306] [client 79.137.67.90:45054] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag3t87TTCltJmboB5ucfBgAAABg"]
[Thu May 21 01:23:06.796250 2026] [:error] [pid 41364:tid 41374] [client 79.137.67.90:52660] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ag3t-hKTmyvxtNXrN-gmxwAAAIg"]
[Thu May 21 01:23:10.799853 2026] [:error] [pid 44059:tid 44068] [client 79.137.67.90:52670] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ag3t_hfFs-oSOOcyjyxbLAAAAQc"]
[Thu May 21 01:23:14.145432 2026] [:error] [pid 41364:tid 41386] [client 79.137.67.90:52672] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ag3uAhKTmyvxtNXrN-gm5AAAAJQ"]
[Thu May 21 01:23:16.952534 2026] [:error] [pid 41364:tid 41366] [client 79.137.67.90:40284] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ag3uBBKTmyvxtNXrN-gm9QAAAIA"]
[Thu May 21 01:23:56.960061 2026] [:error] [pid 7731:tid 7757] [client 79.137.67.90:56686] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag3uLH9qQlHXbkl2nEthFQAAAZg"]
[Thu May 21 01:23:59.672090 2026] [:error] [pid 44059:tid 44063] [client 79.137.67.90:34744] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag3uLxfFs-oSOOcyjyxbRwAAAQI"]
[Thu May 21 01:24:04.088852 2026] [:error] [pid 41364:tid 41373] [client 79.137.67.90:34748] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag3uNBKTmyvxtNXrN-gnUgAAAIc"]
[Thu May 21 01:24:08.068805 2026] [:error] [pid 41364:tid 41371] [client 79.137.67.90:42850] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag3uOBKTmyvxtNXrN-gnWgAAAIU"]
[Thu May 21 01:24:12.018102 2026] [:error] [pid 41278:tid 41328] [client 79.137.67.90:42852] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag3uPPWiNKASEfiGdwbWdQAAAFM"]
[Thu May 21 01:24:15.192643 2026] [:error] [pid 41279:tid 41360] [client 79.137.67.90:45082] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ag3uP7EFyfaehGZbt4y-qgAAANg"]
[Thu May 21 01:24:18.901735 2026] [:error] [pid 41278:tid 41327] [client 79.137.67.90:45092] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ag3uQvWiNKASEfiGdwbWewAAAFI"]
[Thu May 21 01:24:22.921760 2026] [:error] [pid 44059:tid 44062] [client 79.137.67.90:45108] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ag3uRhfFs-oSOOcyjyxbUgAAAQE"]
[Thu May 21 01:24:26.569488 2026] [:error] [pid 41278:tid 41333] [client 79.137.67.90:56592] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ag3uSvWiNKASEfiGdwbWfgAAAFg"]
[Thu May 21 01:24:29.389434 2026] [:error] [pid 44059:tid 44064] [client 79.137.67.90:56606] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ag3uTRfFs-oSOOcyjyxbWQAAAQM"]
[Thu May 21 01:24:33.177665 2026] [:error] [pid 41277:tid 41292] [client 79.137.67.90:56622] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag3uUbTTCltJmboB5ucfJgAAAAo"]
[Thu May 21 01:24:36.394388 2026] [:error] [pid 41278:tid 41333] [client 79.137.67.90:39884] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag3uVPWiNKASEfiGdwbWigAAAFg"]
[Thu May 21 01:24:39.909503 2026] [:error] [pid 41277:tid 41287] [client 79.137.67.90:39890] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ag3uV7TTCltJmboB5ucfKQAAAAU"]
[Thu May 21 01:24:42.337970 2026] [:error] [pid 44059:tid 44072] [client 79.137.67.90:39902] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ag3uWhfFs-oSOOcyjyxbaAAAAQs"]
[Thu May 21 01:24:46.767092 2026] [:error] [pid 41277:tid 41289] [client 79.137.67.90:55284] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ag3uXrTTCltJmboB5ucfKgAAAAc"]
[Thu May 21 01:24:50.081408 2026] [:error] [pid 41364:tid 41382] [client 79.137.67.90:55290] [client 79.137.67.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ag3uYhKTmyvxtNXrN-gnnAAAAJA"]
[Thu May 21 02:09:27.906565 2026] [:error] [pid 41364:tid 41372] [client 43.133.91.48:52300] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag341xKTmyvxtNXrN-g2pgAAAIY"]
[Thu May 21 03:27:59.435818 2026] [:error] [pid 41364:tid 41380] [client 195.178.110.65:2970] [client 195.178.110.65] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.switchcreative.net|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LPhKTmyvxtNXrN-hOhAAAAI4"]
[Thu May 21 03:27:59.435931 2026] [:error] [pid 41364:tid 41380] [client 195.178.110.65:2970] [client 195.178.110.65] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LPhKTmyvxtNXrN-hOhAAAAI4"]
[Thu May 21 03:28:08.807992 2026] [:error] [pid 41364:tid 41381] [client 195.178.110.65:25954] [client 195.178.110.65] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.switchcreative.net|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LSBKTmyvxtNXrN-hOjAAAAI8"]
[Thu May 21 03:28:08.808093 2026] [:error] [pid 41364:tid 41381] [client 195.178.110.65:25954] [client 195.178.110.65] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LSBKTmyvxtNXrN-hOjAAAAI8"]
[Thu May 21 03:28:22.128341 2026] [:error] [pid 41277:tid 41300] [client 195.178.110.65:51114] [client 195.178.110.65] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.switchcreative.net|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LVLTTCltJmboB5ucsVwAAABI"]
[Thu May 21 03:28:22.128443 2026] [:error] [pid 41277:tid 41300] [client 195.178.110.65:51114] [client 195.178.110.65] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.switchcreative.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag4LVLTTCltJmboB5ucsVwAAABI"]
[Thu May 21 06:39:46.253092 2026] [:error] [pid 51613:tid 51618] [client 183.222.202.58:8398] [client 183.222.202.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag44MmbP0MDvqrVnweqQdQAAAQM"], referer: http://www.switchcreative.net/
[Thu May 21 07:09:34.746797 2026] [:error] [pid 51613:tid 51632] [client 147.135.213.153:42118] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ag4_LmbP0MDvqrVnweqX6QAAARE"]
[Thu May 21 07:09:36.617385 2026] [:error] [pid 49982:tid 50005] [client 147.135.213.153:44994] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag4_MGFwIDa5Tf8O4bYw_wAAANU"]
[Thu May 21 07:09:39.963422 2026] [:error] [pid 49884:tid 49957] [client 147.135.213.153:45002] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag4_M65MPpsTNNHWS6jPCgAAAIo"]
[Thu May 21 07:09:42.025714 2026] [:error] [pid 49982:tid 49987] [client 147.135.213.153:37000] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ag4_NmFwIDa5Tf8O4bYxBAAAAMM"]
[Thu May 21 07:09:44.344841 2026] [:error] [pid 9114:tid 9126] [client 147.135.213.153:46066] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ag4_OG8FiJqDBEoTvqwr0gAAAUo"]
[Thu May 21 07:09:46.316762 2026] [:error] [pid 9189:tid 9240] [client 147.135.213.153:37008] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag4_OpvTDh1NbYizKVwWlgAAAhU"]
[Thu May 21 07:09:48.744714 2026] [:error] [pid 9157:tid 9168] [client 147.135.213.153:46068] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag4_PMGfHcLNqE8m88I2qwAAAYk"]
[Thu May 21 07:09:50.790870 2026] [:error] [pid 49884:tid 49968] [client 147.135.213.153:49500] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ag4_Pq5MPpsTNNHWS6jPIAAAAJU"]
[Thu May 21 07:09:52.859524 2026] [:error] [pid 51613:tid 51635] [client 147.135.213.153:49516] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ag4_QGbP0MDvqrVnweqX_gAAARQ"]
[Thu May 21 07:09:54.803003 2026] [:error] [pid 9157:tid 9177] [client 147.135.213.153:49518] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ag4_QsGfHcLNqE8m88I2rQAAAZI"]
[Thu May 21 07:09:56.805435 2026] [:error] [pid 51613:tid 51625] [client 147.135.213.153:49526] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ag4_RGbP0MDvqrVnweqX_wAAAQo"]
[Thu May 21 07:09:58.865567 2026] [:error] [pid 49884:tid 49959] [client 147.135.213.153:49530] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ag4_Rq5MPpsTNNHWS6jPMQAAAIw"]
[Thu May 21 07:10:00.845088 2026] [:error] [pid 9189:tid 9225] [client 147.135.213.153:42128] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag4_SJvTDh1NbYizKVwWoQAAAgY"]
[Thu May 21 07:10:03.359738 2026] [:error] [pid 49884:tid 49952] [client 147.135.213.153:58002] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag4_S65MPpsTNNHWS6jPOgAAAIU"]
[Thu May 21 07:10:05.611610 2026] [:error] [pid 49877:tid 49900] [client 147.135.213.153:58004] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ag4_TRgN4MeSe4kIL9AAewAAAAw"]
[Thu May 21 07:10:07.900645 2026] [:error] [pid 49982:tid 49984] [client 147.135.213.153:42144] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag4_T2FwIDa5Tf8O4bYxFwAAAMA"]
[Thu May 21 07:10:11.713158 2026] [:error] [pid 49982:tid 50000] [client 147.135.213.153:42090] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag4_U2FwIDa5Tf8O4bYxHQAAANA"]
[Thu May 21 07:26:30.109655 2026] [:error] [pid 9114:tid 9116] [client 43.159.143.139:44900] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag5DJm8FiJqDBEoTvqwtNwAAAUA"]
[Thu May 21 11:29:47.227255 2026] [:error] [pid 49879:tid 49924] [client 54.37.252.231:57332] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ag58K4VqYDjFSyG2gFoxGwAAAEQ"]
[Thu May 21 11:29:50.692099 2026] [:error] [pid 9114:tid 9128] [client 54.37.252.231:60780] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag58Lm8FiJqDBEoTvqxFmgAAAUw"]
[Thu May 21 11:29:53.474941 2026] [:error] [pid 9188:tid 9208] [client 54.37.252.231:60788] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag58MbGYm6q5dNSUvA-NugAAAdA"]
[Thu May 21 11:29:55.837848 2026] [:error] [pid 9114:tid 9122] [client 54.37.252.231:43772] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag58M28FiJqDBEoTvqxFogAAAUY"]
[Thu May 21 11:29:58.715187 2026] [:error] [pid 49877:tid 49888] [client 54.37.252.231:43780] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ag58NhgN4MeSe4kIL9AUSwAAAAA"]
[Thu May 21 11:30:01.237758 2026] [:error] [pid 9114:tid 9130] [client 54.37.252.231:44272] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ag58OW8FiJqDBEoTvqxFpAAAAU4"]
[Thu May 21 11:30:04.128006 2026] [:error] [pid 49884:tid 49970] [client 54.37.252.231:44286] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ag58PK5MPpsTNNHWS6gl_QAAAJc"]
[Thu May 21 11:30:07.438700 2026] [:error] [pid 9157:tid 9164] [client 54.37.252.231:44294] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ag58P8GfHcLNqE8m88JSiAAAAYU"]
[Thu May 21 11:30:09.493500 2026] [:error] [pid 49879:tid 49940] [client 54.37.252.231:59598] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ag58QYVqYDjFSyG2gFoxJAAAAFQ"]
[Thu May 21 11:30:12.033308 2026] [:error] [pid 49884:tid 49956] [client 54.37.252.231:59610] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ag58RK5MPpsTNNHWS6gmBQAAAIk"]
[Thu May 21 11:30:14.096206 2026] [:error] [pid 9157:tid 9175] [client 54.37.252.231:59620] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ag58RsGfHcLNqE8m88JSigAAAZA"]
[Thu May 21 11:30:16.370786 2026] [:error] [pid 9157:tid 9179] [client 54.37.252.231:59634] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ag58SMGfHcLNqE8m88JSjAAAAZQ"]
[Thu May 21 11:30:18.792584 2026] [:error] [pid 49982:tid 50003] [client 54.37.252.231:59642] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ag58SmFwIDa5Tf8O4bZxbAAAANM"]
[Thu May 21 11:30:21.792429 2026] [:error] [pid 49982:tid 49990] [client 54.37.252.231:48084] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ag58TWFwIDa5Tf8O4bZxbwAAAMY"]
[Thu May 21 11:30:25.070509 2026] [:error] [pid 49877:tid 49902] [client 54.37.252.231:48086] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ag58URgN4MeSe4kIL9AUVAAAAA4"]
[Thu May 21 11:30:28.287562 2026] [:error] [pid 9157:tid 9166] [client 54.37.252.231:48096] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag58VMGfHcLNqE8m88JSmwAAAYc"]
[Thu May 21 11:30:31.417846 2026] [:error] [pid 49884:tid 49948] [client 54.37.252.231:60044] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ag58V65MPpsTNNHWS6gmHAAAAIE"]
[Thu May 21 11:30:33.871367 2026] [:error] [pid 49884:tid 49967] [client 54.37.252.231:39274] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ag58Wa5MPpsTNNHWS6gmIAAAAJQ"]
[Thu May 21 11:30:36.744075 2026] [:error] [pid 49982:tid 49991] [client 54.37.252.231:60050] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ag58XGFwIDa5Tf8O4bZxegAAAMc"]
[Thu May 21 11:30:39.812262 2026] [:error] [pid 49884:tid 49961] [client 54.37.252.231:60052] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ag58X65MPpsTNNHWS6gmKQAAAI4"]
[Thu May 21 11:30:42.743825 2026] [:error] [pid 51613:tid 51637] [client 54.37.252.231:48526] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ag58YmbP0MDvqrVnweq5OwAAARY"]
[Thu May 21 11:31:14.587081 2026] [:error] [pid 49884:tid 49951] [client 54.37.252.231:49994] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/168%20slot.aspx"] [unique_id "ag58gq5MPpsTNNHWS6gmTwAAAIQ"]
[Thu May 21 11:31:17.129682 2026] [:error] [pid 9157:tid 9160] [client 54.37.252.231:50000] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/24th%20slot.aspx"] [unique_id "ag58hcGfHcLNqE8m88JSswAAAYE"]
[Thu May 21 11:31:19.553308 2026] [:error] [pid 49884:tid 49969] [client 54.37.252.231:41662] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/auto%20slot.aspx"] [unique_id "ag58h65MPpsTNNHWS6gmUwAAAJY"]
[Thu May 21 11:31:22.098034 2026] [:error] [pid 49982:tid 49991] [client 54.37.252.231:41672] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ag58imFwIDa5Tf8O4bZxrwAAAMc"]
[Thu May 21 11:31:24.356366 2026] [:error] [pid 49877:tid 49902] [client 54.37.252.231:41678] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag58jBgN4MeSe4kIL9AUXAAAAA4"]
[Thu May 21 11:31:27.171578 2026] [:error] [pid 9157:tid 9176] [client 54.37.252.231:41680] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ag58j8GfHcLNqE8m88JSugAAAZE"]
[Thu May 21 11:31:29.802461 2026] [:error] [pid 9157:tid 9180] [client 54.37.252.231:58494] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag58kcGfHcLNqE8m88JSxgAAAZU"]
[Thu May 21 11:31:32.531881 2026] [:error] [pid 9114:tid 9135] [client 54.37.252.231:58496] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ag58lG8FiJqDBEoTvqxFzQAAAVM"]
[Thu May 21 11:31:35.245029 2026] [:error] [pid 49982:tid 49996] [client 54.37.252.231:58502] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ag58l2FwIDa5Tf8O4bZxvQAAAMw"]
[Thu May 21 11:31:37.600701 2026] [:error] [pid 49877:tid 49900] [client 54.37.252.231:58512] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ag58mRgN4MeSe4kIL9AUYAAAAAw"]
[Thu May 21 11:31:39.730385 2026] [:error] [pid 49982:tid 50000] [client 54.37.252.231:39388] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ag58m2FwIDa5Tf8O4bZxwAAAANA"]
[Thu May 21 11:44:14.242178 2026] [:error] [pid 49982:tid 49998] [client 43.153.207.127:57768] [client 43.153.207.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag5_jmFwIDa5Tf8O4bZ1zQAAAM4"]
[Thu May 21 12:35:11.693470 2026] [:error] [pid 51613:tid 51621] [client 43.134.111.142:33552] [client 43.134.111.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag6Lf2bP0MDvqrVnwerBRAAAAQY"]
[Thu May 21 14:29:27.447279 2026] [:error] [pid 51613:tid 51625] [client 162.14.109.170:57182] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag6mR2bP0MDvqrVnwerQbgAAAQo"]
[Thu May 21 15:43:36.941138 2026] [:error] [pid 49877:tid 49893] [client 217.182.195.176:42544] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ag63qBgN4MeSe4kIL9AoaQAAAAU"]
[Thu May 21 15:43:38.786344 2026] [:error] [pid 49877:tid 49894] [client 217.182.195.176:54822] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ag63qhgN4MeSe4kIL9AobQAAAAY"]
[Thu May 21 15:43:40.834701 2026] [:error] [pid 9188:tid 9212] [client 217.182.195.176:54830] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ag63rLGYm6q5dNSUvA-9AgAAAdQ"]
[Thu May 21 15:43:42.745108 2026] [:error] [pid 49879:tid 49937] [client 217.182.195.176:54838] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ag63roVqYDjFSyG2gFpKYgAAAFE"]
[Thu May 21 15:43:44.670472 2026] [:error] [pid 49877:tid 49901] [client 217.182.195.176:54844] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ag63sBgN4MeSe4kIL9AocwAAAA0"]
[Thu May 21 15:43:46.595515 2026] [:error] [pid 49982:tid 49998] [client 217.182.195.176:35404] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ag63smFwIDa5Tf8O4ba4_wAAAM4"]
[Thu May 21 15:43:48.479924 2026] [:error] [pid 49884:tid 49969] [client 217.182.195.176:35416] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ag63tK5MPpsTNNHWS6iIswAAAJY"]
[Thu May 21 15:43:50.390569 2026] [:error] [pid 9188:tid 9209] [client 217.182.195.176:35420] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ag63trGYm6q5dNSUvA-9BwAAAdE"]
[Thu May 21 15:43:52.306782 2026] [:error] [pid 49982:tid 49989] [client 217.182.195.176:35424] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ag63uGFwIDa5Tf8O4ba5DgAAAMU"]
[Thu May 21 15:43:54.445685 2026] [:error] [pid 9189:tid 9237] [client 217.182.195.176:36270] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ag63upvTDh1NbYizKVyEhQAAAhI"]
[Thu May 21 15:43:58.740742 2026] [:error] [pid 49982:tid 49999] [client 217.182.195.176:56876] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ag63vmFwIDa5Tf8O4ba5LAAAAM8"]
[Thu May 21 15:44:01.084522 2026] [:error] [pid 49879:tid 49924] [client 217.182.195.176:34154] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag63wYVqYDjFSyG2gFpKaQAAAEQ"]
[Thu May 21 15:44:02.987106 2026] [:error] [pid 51613:tid 51619] [client 217.182.195.176:34164] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag63wmbP0MDvqrVnwercHgAAAQQ"]
[Thu May 21 15:44:04.889174 2026] [:error] [pid 9188:tid 9205] [client 217.182.195.176:34168] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ag63xLGYm6q5dNSUvA-9EAAAAc0"]
[Thu May 21 15:44:06.927600 2026] [:error] [pid 51613:tid 51623] [client 217.182.195.176:33618] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag63xmbP0MDvqrVnwercIAAAAQg"]
[Thu May 21 15:44:08.796505 2026] [:error] [pid 51613:tid 51625] [client 217.182.195.176:33628] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag63yGbP0MDvqrVnwercJwAAAQo"]
[Thu May 21 15:44:10.801951 2026] [:error] [pid 49879:tid 49931] [client 217.182.195.176:33634] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ag63yoVqYDjFSyG2gFpKawAAAEs"]
[Thu May 21 15:44:12.834716 2026] [:error] [pid 49877:tid 49896] [client 217.182.195.176:33636] [client 217.182.195.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag63zBgN4MeSe4kIL9AofwAAAAg"]
[Thu May 21 16:24:41.402766 2026] [:error] [pid 49879:tid 49926] [client 152.53.187.237:62260] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20dc.aspx"] [unique_id "ag7BSYVqYDjFSyG2gFpO5QAAAEY"]
[Thu May 21 16:24:43.600894 2026] [:error] [pid 49879:tid 49941] [client 152.53.187.237:43442] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag7BS4VqYDjFSyG2gFpO5wAAAFU"]
[Thu May 21 16:24:45.946559 2026] [:error] [pid 49884:tid 49960] [client 152.53.187.237:43454] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ag7BTa5MPpsTNNHWS6iYnQAAAI0"]
[Thu May 21 16:24:48.176513 2026] [:error] [pid 49884:tid 49969] [client 152.53.187.237:43458] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ag7BUK5MPpsTNNHWS6iYowAAAJY"]
[Thu May 21 16:24:50.516101 2026] [:error] [pid 9114:tid 9129] [client 152.53.187.237:61052] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ag7BUm8FiJqDBEoTvqxnSwAAAU0"]
[Thu May 21 16:24:53.517930 2026] [:error] [pid 9188:tid 9215] [client 152.53.187.237:53470] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag7BVbGYm6q5dNSUvA_D7gAAAdc"]
[Thu May 21 16:24:57.346052 2026] [:error] [pid 49982:tid 49997] [client 152.53.187.237:61062] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ag7BWWFwIDa5Tf8O4bbExwAAAM0"]
[Thu May 21 16:25:00.207589 2026] [:error] [pid 9189:tid 9239] [client 152.53.187.237:53472] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag7BXJvTDh1NbYizKVyMqwAAAhQ"]
[Thu May 21 16:25:02.592045 2026] [:error] [pid 49982:tid 49989] [client 152.53.187.237:56650] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag7BXmFwIDa5Tf8O4bbE0AAAAMU"]
[Thu May 21 16:25:05.399168 2026] [:error] [pid 9114:tid 9131] [client 152.53.187.237:47100] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag7BYW8FiJqDBEoTvqxnTAAAAU8"]
[Thu May 21 16:25:07.554749 2026] [:error] [pid 51613:tid 51620] [client 152.53.187.237:56654] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag7BY2bP0MDvqrVnweriIgAAAQU"]
[Thu May 21 16:25:09.866006 2026] [:error] [pid 49884:tid 49949] [client 152.53.187.237:56666] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ag7BZa5MPpsTNNHWS6iYtAAAAII"]
[Thu May 21 16:25:12.392720 2026] [:error] [pid 49884:tid 49959] [client 152.53.187.237:56592] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ag7BaK5MPpsTNNHWS6iYugAAAIw"]
[Thu May 21 16:25:14.691469 2026] [:error] [pid 51613:tid 51617] [client 152.53.187.237:56600] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ag7BambP0MDvqrVnweriJAAAAQI"]
[Thu May 21 16:25:17.094332 2026] [:error] [pid 51613:tid 51639] [client 152.53.187.237:56604] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ag7BbWbP0MDvqrVnweriOwAAARg"]
[Thu May 21 16:25:19.173964 2026] [:error] [pid 49982:tid 49991] [client 152.53.187.237:56610] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ag7Bb2FwIDa5Tf8O4bbE2gAAAMc"]
[Thu May 21 16:25:21.337008 2026] [:error] [pid 49982:tid 49992] [client 152.53.187.237:59862] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ag7BcWFwIDa5Tf8O4bbE3QAAAMg"]
[Thu May 21 16:25:23.719896 2026] [:error] [pid 49884:tid 49951] [client 152.53.187.237:59874] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ag7Bc65MPpsTNNHWS6iY2AAAAIQ"]
[Thu May 21 16:25:25.889839 2026] [:error] [pid 9114:tid 9126] [client 152.53.187.237:59888] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag7BdW8FiJqDBEoTvqxnUQAAAUo"]
[Thu May 21 16:25:28.230380 2026] [:error] [pid 9157:tid 9161] [client 152.53.187.237:59892] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag7BeMGfHcLNqE8m88J4OQAAAYI"]
[Thu May 21 16:25:30.035804 2026] [:error] [pid 49982:tid 49984] [client 152.53.187.237:59906] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7BemFwIDa5Tf8O4bbE5gAAAMA"]
[Thu May 21 16:25:34.191856 2026] [:error] [pid 9189:tid 9224] [client 152.53.187.237:55802] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7BfpvTDh1NbYizKVyMtgAAAgU"]
[Thu May 21 16:33:55.789352 2026] [:error] [pid 49884:tid 49948] [client 180.153.236.116:52345] [client 180.153.236.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag7Dc65MPpsTNNHWS6ib3wAAAIE"], referer: http://switchcreative.net/
[Thu May 21 16:39:31.964211 2026] [autoindex:error] [pid 49884:tid 49958] [client 4.194.68.0:1704] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 16:39:32.062075 2026] [proxy_fcgi:error] [pid 49884:tid 49966] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.153383 2026] [proxy_fcgi:error] [pid 49884:tid 49952] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.245384 2026] [proxy_fcgi:error] [pid 49884:tid 49950] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.372360 2026] [proxy_fcgi:error] [pid 49884:tid 49959] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.463977 2026] [proxy_fcgi:error] [pid 49884:tid 49968] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.558123 2026] [proxy_fcgi:error] [pid 49884:tid 49964] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.649995 2026] [proxy_fcgi:error] [pid 49884:tid 49956] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.744657 2026] [proxy_fcgi:error] [pid 49884:tid 49949] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:32.836160 2026] [proxy_fcgi:error] [pid 49884:tid 49948] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:33.019558 2026] [proxy_fcgi:error] [pid 49884:tid 49954] [client 4.194.68.0:1704] AH01071: Got error 'Primary script unknown'
[Thu May 21 16:39:33.107542 2026] [:error] [pid 49884:tid 49960] [client 4.194.68.0:1704] [client 4.194.68.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag7Exa5MPpsTNNHWS6idJwAAAI0"]
[Thu May 21 16:39:33.508160 2026] [:error] [pid 9114:tid 9123] [client 4.194.68.0:1693] [client 4.194.68.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag7ExW8FiJqDBEoTvqxolwAAAUc"]
[Thu May 21 16:39:33.917885 2026] [:error] [pid 9157:tid 9181] [client 4.194.68.0:1623] [client 4.194.68.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag7ExcGfHcLNqE8m88J5uQAAAZY"]
[Thu May 21 16:39:34.316246 2026] [:error] [pid 9188:tid 9210] [client 4.194.68.0:3856] [client 4.194.68.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag7ExrGYm6q5dNSUvA_FwAAAAdI"]
[Thu May 21 16:52:24.347613 2026] [:error] [pid 9157:tid 9160] [client 43.155.140.157:41336] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag7HyMGfHcLNqE8m88J7GQAAAYE"]
[Thu May 21 17:22:04.279499 2026] [:error] [pid 49982:tid 49995] [client 208.72.153.151:60806] [client 208.72.153.151] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.switchcreative.net|F|2"] [data "TX:0=application/xhtml+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag7OvGFwIDa5Tf8O4bbTBgAAAMs"]
[Thu May 21 17:40:36.068437 2026] [:error] [pid 49884:tid 49964] [client 43.135.142.7:35144] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag7TFK5MPpsTNNHWS6ixMwAAAJE"]
[Thu May 21 18:36:23.799391 2026] [:error] [pid 9188:tid 9210] [client 183.80.25.18:58864] [client 183.80.25.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.80.25.18, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ag7gJ7GYm6q5dNSUvA_WVgAAAdI"]
[Thu May 21 18:36:23.809800 2026] [proxy_fcgi:error] [pid 9188:tid 9210] [client 183.80.25.18:58864] AH01071: Got error 'Primary script unknown'
[Thu May 21 18:53:21.736681 2026] [:error] [pid 9188:tid 9200] [client 147.135.213.130:56498] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ag7kIbGYm6q5dNSUvA_YYwAAAcg"]
[Thu May 21 18:53:22.052547 2026] [:error] [pid 9189:tid 9225] [client 147.135.213.130:39260] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ag7kIpvTDh1NbYizKVymCwAAAgY"]
[Thu May 21 18:53:24.078906 2026] [:error] [pid 9188:tid 9201] [client 147.135.213.130:59106] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ag7kJLGYm6q5dNSUvA_YZAAAAck"]
[Thu May 21 18:53:24.496312 2026] [:error] [pid 49877:tid 49910] [client 147.135.213.130:59116] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ag7kJBgN4MeSe4kIL9A3AAAAABY"]
[Thu May 21 18:53:26.616189 2026] [:error] [pid 9189:tid 9231] [client 147.135.213.130:59120] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ag7kJpvTDh1NbYizKVymDQAAAgw"]
[Thu May 21 18:53:26.759153 2026] [:error] [pid 51613:tid 51624] [client 147.135.213.130:59122] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ag7kJmbP0MDvqrVnwer0XgAAAQk"]
[Thu May 21 18:53:28.999956 2026] [:error] [pid 51613:tid 51635] [client 147.135.213.130:60376] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ag7kKGbP0MDvqrVnwer0YwAAARQ"]
[Thu May 21 18:53:29.330906 2026] [:error] [pid 51613:tid 51634] [client 147.135.213.130:60378] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ag7kKWbP0MDvqrVnwer0ZAAAARM"]
[Thu May 21 18:53:31.522304 2026] [:error] [pid 9157:tid 9174] [client 147.135.213.130:60382] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ag7kK8GfHcLNqE8m88KI8gAAAY8"]
[Thu May 21 18:53:31.816254 2026] [:error] [pid 9157:tid 9170] [client 147.135.213.130:60392] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ag7kK8GfHcLNqE8m88KI9AAAAYs"]
[Thu May 21 18:53:33.932972 2026] [:error] [pid 49879:tid 49935] [client 147.135.213.130:60398] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ag7kLYVqYDjFSyG2gFpb2gAAAE8"]
[Thu May 21 18:53:34.197054 2026] [:error] [pid 49879:tid 49937] [client 147.135.213.130:60400] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ag7kLoVqYDjFSyG2gFpb3AAAAFE"]
[Thu May 21 18:53:36.464660 2026] [:error] [pid 9157:tid 9159] [client 147.135.213.130:60410] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag7kMMGfHcLNqE8m88KI-wAAAYA"]
[Thu May 21 18:53:36.538276 2026] [:error] [pid 9157:tid 9171] [client 147.135.213.130:60424] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ag7kMMGfHcLNqE8m88KI_AAAAYw"]
[Thu May 21 18:53:38.987760 2026] [:error] [pid 49982:tid 50004] [client 147.135.213.130:60430] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ag7kMmFwIDa5Tf8O4bblUAAAANQ"]
[Thu May 21 18:53:39.004401 2026] [:error] [pid 9114:tid 9121] [client 147.135.213.130:44482] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ag7kM28FiJqDBEoTvqx2OQAAAUU"]
[Thu May 21 18:53:41.491943 2026] [:error] [pid 9157:tid 9180] [client 147.135.213.130:44494] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ag7kNcGfHcLNqE8m88KI_wAAAZU"]
[Thu May 21 18:53:41.531958 2026] [:error] [pid 9157:tid 9160] [client 147.135.213.130:44500] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ag7kNcGfHcLNqE8m88KJAAAAAYE"]
[Thu May 21 18:53:43.911028 2026] [:error] [pid 9189:tid 9226] [client 147.135.213.130:44518] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ag7kN5vTDh1NbYizKVymGAAAAgc"]
[Thu May 21 18:53:43.919967 2026] [:error] [pid 9114:tid 9117] [client 147.135.213.130:44502] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ag7kN28FiJqDBEoTvqx2PAAAAUE"]
[Thu May 21 18:53:46.270574 2026] [:error] [pid 51613:tid 51619] [client 147.135.213.130:44530] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ag7kOmbP0MDvqrVnwer0agAAAQQ"]
[Thu May 21 18:53:46.280443 2026] [:error] [pid 9114:tid 9126] [client 147.135.213.130:44546] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ag7kOm8FiJqDBEoTvqx2QQAAAUo"]
[Thu May 21 18:53:48.555761 2026] [:error] [pid 49982:tid 49987] [client 147.135.213.130:44550] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag7kPGFwIDa5Tf8O4bblUwAAAMM"]
[Thu May 21 18:53:48.663678 2026] [:error] [pid 49884:tid 49961] [client 147.135.213.130:44556] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ag7kPK5MPpsTNNHWS6jHFAAAAI4"]
[Thu May 21 18:53:50.869078 2026] [:error] [pid 49982:tid 50008] [client 147.135.213.130:59314] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ag7kPmFwIDa5Tf8O4bblVgAAANg"]
[Thu May 21 18:53:51.099952 2026] [:error] [pid 49884:tid 49953] [client 147.135.213.130:59316] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ag7kP65MPpsTNNHWS6jHHAAAAIY"]
[Thu May 21 18:53:53.353450 2026] [:error] [pid 49982:tid 49996] [client 147.135.213.130:59324] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ag7kQWFwIDa5Tf8O4bblWwAAAMw"]
[Thu May 21 18:53:53.507751 2026] [:error] [pid 49982:tid 49998] [client 147.135.213.130:59330] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ag7kQWFwIDa5Tf8O4bblXAAAAM4"]
[Thu May 21 18:53:55.871512 2026] [:error] [pid 49982:tid 49995] [client 147.135.213.130:59338] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ag7kQ2FwIDa5Tf8O4bblZwAAAMs"]
[Thu May 21 18:53:56.018667 2026] [:error] [pid 9114:tid 9135] [client 147.135.213.130:59340] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ag7kRG8FiJqDBEoTvqx2SAAAAVM"]
[Thu May 21 18:53:58.343563 2026] [:error] [pid 49982:tid 50000] [client 147.135.213.130:43206] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7kRmFwIDa5Tf8O4bblbQAAANA"]
[Thu May 21 18:53:58.352057 2026] [:error] [pid 9189:tid 9240] [client 147.135.213.130:59352] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ag7kRpvTDh1NbYizKVymHAAAAhU"]
[Thu May 21 18:54:00.659221 2026] [:error] [pid 9157:tid 9172] [client 147.135.213.130:40874] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ag7kSMGfHcLNqE8m88KJBwAAAY0"]
[Thu May 21 18:54:02.263104 2026] [:error] [pid 49982:tid 50004] [client 147.135.213.130:59316] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7kSmFwIDa5Tf8O4bblewAAANQ"]
[Thu May 21 18:54:03.161628 2026] [:error] [pid 49884:tid 49951] [client 147.135.213.130:40886] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ag7kS65MPpsTNNHWS6jHIAAAAIQ"]
[Thu May 21 18:54:05.393224 2026] [:error] [pid 49884:tid 49965] [client 147.135.213.130:40894] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ag7kTa5MPpsTNNHWS6jHLAAAAJI"]
[Thu May 21 18:54:07.789050 2026] [:error] [pid 51613:tid 51623] [client 147.135.213.130:40910] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ag7kT2bP0MDvqrVnwer0dgAAAQg"]
[Thu May 21 18:54:09.630138 2026] [:error] [pid 49879:tid 49939] [client 147.135.213.130:41960] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7kUYVqYDjFSyG2gFpb5QAAAFM"]
[Thu May 21 18:54:13.412273 2026] [:error] [pid 49982:tid 50000] [client 147.135.213.130:41968] [client 147.135.213.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag7kVWFwIDa5Tf8O4bbligAAANA"]
[Thu May 21 19:54:05.429701 2026] [autoindex:error] [pid 9114:tid 9131] [client 31.220.74.20:64838] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu May 21 21:29:00.941531 2026] [:error] [pid 49982:tid 49985] [client 212.116.244.105:38374] [client 212.116.244.105] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag8InGFwIDa5Tf8O4bYKnQAAAME"]
[Thu May 21 21:38:23.517390 2026] [:error] [pid 49884:tid 49953] [client 43.133.66.51:51812] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag8Kz65MPpsTNNHWS6j8FgAAAIY"]
[Thu May 21 22:23:41.201983 2026] [:error] [pid 49877:tid 49903] [client 43.167.239.66:55502] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag8VbRgN4MeSe4kIL9BEegAAAA8"]
[Thu May 21 23:18:01.962613 2026] [autoindex:error] [pid 49884:tid 49949] [client 20.78.148.25:14401] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 21 23:18:02.091632 2026] [proxy_fcgi:error] [pid 49884:tid 49971] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.216856 2026] [proxy_fcgi:error] [pid 49884:tid 49959] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.340560 2026] [proxy_fcgi:error] [pid 49884:tid 49961] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.464511 2026] [proxy_fcgi:error] [pid 49884:tid 49958] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.606114 2026] [proxy_fcgi:error] [pid 49884:tid 49952] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.730264 2026] [proxy_fcgi:error] [pid 49884:tid 49966] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:02.853686 2026] [proxy_fcgi:error] [pid 49884:tid 49947] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:03.008416 2026] [proxy_fcgi:error] [pid 49884:tid 49967] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:03.133118 2026] [proxy_fcgi:error] [pid 49884:tid 49964] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:03.513639 2026] [proxy_fcgi:error] [pid 49884:tid 49954] [client 20.78.148.25:14401] AH01071: Got error 'Primary script unknown'
[Thu May 21 23:18:03.854493 2026] [:error] [pid 49884:tid 49953] [client 20.78.148.25:14401] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag8iK65MPpsTNNHWS6gWPwAAAIY"]
[Thu May 21 23:18:04.339008 2026] [:error] [pid 9188:tid 9212] [client 20.78.148.25:14452] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag8iLLGYm6q5dNSUvA_-cAAAAdQ"]
[Thu May 21 23:18:04.834183 2026] [:error] [pid 51613:tid 51619] [client 20.78.148.25:10981] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag8iLGbP0MDvqrVnweoTWwAAAQQ"]
[Thu May 21 23:18:05.318272 2026] [:error] [pid 49884:tid 49971] [client 20.78.148.25:15545] [client 20.78.148.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ag8iLa5MPpsTNNHWS6gWQgAAAJg"]
[Thu May 21 23:24:10.002971 2026] [:error] [pid 49884:tid 49950] [client 34.150.255.112:62935] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXSQAAAIM"]
[Thu May 21 23:24:10.431269 2026] [:error] [pid 49884:tid 49962] [client 34.150.255.112:50096] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXsgAAAI8"]
[Thu May 21 23:24:10.873669 2026] [:error] [pid 9188:tid 9211] [client 34.150.255.112:51875] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmrGYm6q5dNSUvA__CQAAAdM"]
[Fri May 22 01:31:16.471758 2026] [:error] [pid 49877:tid 49888] [client 195.201.199.99:34806] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag9BZBgN4MeSe4kIL9BVWgAAAAA"]
[Fri May 22 01:31:19.122760 2026] [:error] [pid 9157:tid 9170] [client 195.201.199.99:36864] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag9BZ8GfHcLNqE8m88K2jQAAAYs"]
[Fri May 22 01:31:21.353870 2026] [:error] [pid 49877:tid 49901] [client 195.201.199.99:39338] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag9BaRgN4MeSe4kIL9BVZAAAAA0"]
[Fri May 22 01:31:23.531301 2026] [:error] [pid 49877:tid 49896] [client 195.201.199.99:39812] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ag9BaxgN4MeSe4kIL9BVaQAAAAg"]
[Fri May 22 01:31:26.180420 2026] [:error] [pid 49877:tid 49894] [client 195.201.199.99:38262] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ag9BbhgN4MeSe4kIL9BVdAAAAAY"]
[Fri May 22 01:31:28.456144 2026] [:error] [pid 49877:tid 49896] [client 195.201.199.99:40778] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag9BcBgN4MeSe4kIL9BVewAAAAg"]
[Fri May 22 01:31:31.175355 2026] [:error] [pid 49877:tid 49902] [client 195.201.199.99:39336] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ag9BcxgN4MeSe4kIL9BVgQAAAA4"]
[Fri May 22 01:31:33.130699 2026] [:error] [pid 38463:tid 38642] [client 195.201.199.99:41864] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ag9BdR4oIQTtH1fRix0dpAAAAkQ"]
[Fri May 22 01:31:35.260307 2026] [:error] [pid 49877:tid 49906] [client 195.201.199.99:42348] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ag9BdxgN4MeSe4kIL9BViAAAABI"]
[Fri May 22 01:31:37.543628 2026] [:error] [pid 49877:tid 49890] [client 195.201.199.99:42858] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ag9BeRgN4MeSe4kIL9BVigAAAAI"]
[Fri May 22 01:31:39.751701 2026] [:error] [pid 49982:tid 50002] [client 195.201.199.99:43336] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ag9Be2FwIDa5Tf8O4bY25AAAANI"]
[Fri May 22 01:31:41.961415 2026] [:error] [pid 9157:tid 9174] [client 195.201.199.99:43742] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ag9BfcGfHcLNqE8m88K2nAAAAY8"]
[Fri May 22 01:31:44.201795 2026] [:error] [pid 49877:tid 49908] [client 195.201.199.99:44272] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag9BgBgN4MeSe4kIL9BVkQAAABQ"]
[Fri May 22 01:31:46.692371 2026] [:error] [pid 51613:tid 51634] [client 195.201.199.99:42844] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ag9BgmbP0MDvqrVnweod_gAAARM"]
[Fri May 22 01:31:48.620484 2026] [:error] [pid 9157:tid 9163] [client 195.201.199.99:45426] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag9BhMGfHcLNqE8m88K2nQAAAYQ"]
[Fri May 22 01:31:52.453469 2026] [:error] [pid 49982:tid 49999] [client 195.201.199.99:46460] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag9BiGFwIDa5Tf8O4bY25QAAAM8"]
[Fri May 22 02:51:11.647310 2026] [:error] [pid 49879:tid 49931] [client 162.14.81.106:43346] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag9UH4VqYDjFSyG2gFp7uAAAAEs"]
[Fri May 22 02:59:00.844727 2026] [:error] [pid 38463:tid 38660] [client 43.134.92.251:49692] [client 43.134.92.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag9V9B4oIQTtH1fRix0nHQAAAlY"]
[Fri May 22 04:00:55.223094 2026] [:error] [pid 49392:tid 49470] [client 43.156.55.246:55010] [client 43.156.55.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag9kd96KX5mDbYUc-fu_nQAAAJQ"]
[Fri May 22 04:15:04.896782 2026] [proxy_fcgi:error] [pid 15583:tid 15610] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:05.098758 2026] [proxy_fcgi:error] [pid 15583:tid 15600] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:05.294382 2026] [proxy_fcgi:error] [pid 15583:tid 15598] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:05.573115 2026] [proxy_fcgi:error] [pid 15583:tid 15589] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:05.765457 2026] [proxy_fcgi:error] [pid 15583:tid 15592] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:05.964501 2026] [proxy_fcgi:error] [pid 15583:tid 15594] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:06.155793 2026] [proxy_fcgi:error] [pid 15583:tid 15604] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:06.758654 2026] [proxy_fcgi:error] [pid 15583:tid 15593] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:07.068504 2026] [proxy_fcgi:error] [pid 15583:tid 15607] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:07.262921 2026] [proxy_fcgi:error] [pid 15583:tid 15602] [client 52.242.199.195:35750] AH01071: Got error 'Primary script unknown'
[Fri May 22 04:15:07.503137 2026] [:error] [pid 15583:tid 15597] [client 52.242.199.195:35750] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag9ny3naOncRcIm17YVhUgAAAAk"]
[Fri May 22 04:15:09.628398 2026] [:error] [pid 15583:tid 15591] [client 52.242.199.195:33135] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag9nzXnaOncRcIm17YVhVAAAAAM"]
[Fri May 22 04:15:11.831876 2026] [:error] [pid 15584:tid 15641] [client 52.242.199.195:33101] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag9nz99Z_TVLbNEx52hh8wAAAFU"]
[Fri May 22 04:15:13.422443 2026] [:error] [pid 15583:tid 15592] [client 52.242.199.195:39359] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag9n0XnaOncRcIm17YVhWgAAAAQ"]
[Fri May 22 06:49:37.509640 2026] [:error] [pid 15584:tid 15630] [client 81.167.26.57:30607] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ag-MAd9Z_TVLbNEx52iCSwAAAEo"]
[Fri May 22 06:49:39.478676 2026] [:error] [pid 58782:tid 58806] [client 81.167.26.57:28744] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ag-MA4xsdTFafgO8vhSyHwAAARY"]
[Fri May 22 06:49:41.481330 2026] [:error] [pid 15584:tid 15631] [client 81.167.26.57:27958] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag-MBd9Z_TVLbNEx52iCTgAAAEs"]
[Fri May 22 06:49:44.049319 2026] [:error] [pid 15679:tid 15693] [client 81.167.26.57:45323] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ag-MCCh8tgGc38WJ-Gx3YwAAAMw"]
[Fri May 22 06:49:46.051419 2026] [:error] [pid 15679:tid 15691] [client 81.167.26.57:15847] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ag-MCih8tgGc38WJ-Gx3aQAAAMo"]
[Fri May 22 06:49:48.177006 2026] [:error] [pid 58813:tid 58833] [client 81.167.26.57:31261] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ag-MDJ6yyKWDKULhxJ0BmwAAAVE"]
[Fri May 22 06:49:50.158612 2026] [:error] [pid 15679:tid 15701] [client 81.167.26.57:20596] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ag-MDih8tgGc38WJ-Gx3bAAAANQ"]
[Fri May 22 06:49:51.989022 2026] [:error] [pid 15679:tid 15705] [client 81.167.26.57:15489] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ag-MDyh8tgGc38WJ-Gx3bgAAANg"]
[Fri May 22 06:49:53.978437 2026] [:error] [pid 15584:tid 15622] [client 81.167.26.57:37659] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ag-MEd9Z_TVLbNEx52iCYAAAAEI"]
[Fri May 22 06:49:56.106267 2026] [:error] [pid 15584:tid 15633] [client 81.167.26.57:14416] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag-MFN9Z_TVLbNEx52iCYgAAAE0"]
[Fri May 22 06:49:58.082694 2026] [:error] [pid 15679:tid 15694] [client 81.167.26.57:48280] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ag-MFih8tgGc38WJ-Gx3cAAAAM0"]
[Fri May 22 06:49:59.919108 2026] [:error] [pid 15584:tid 15632] [client 81.167.26.57:49125] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ag-MF99Z_TVLbNEx52iCZQAAAEw"]
[Fri May 22 06:50:02.060083 2026] [:error] [pid 15679:tid 15698] [client 81.167.26.57:12282] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ag-MGih8tgGc38WJ-Gx3cQAAANE"]
[Fri May 22 06:50:04.072758 2026] [:error] [pid 15585:tid 15656] [client 81.167.26.57:51151] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ag-MHCKb-vB41AF-LC1SNwAAAIk"]
[Fri May 22 06:50:06.660599 2026] [:error] [pid 15584:tid 15621] [client 81.167.26.57:32538] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ag-MHt9Z_TVLbNEx52iCaAAAAEE"]
[Fri May 22 06:50:08.662611 2026] [:error] [pid 15583:tid 15605] [client 81.167.26.57:25593] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ag-MIHnaOncRcIm17YV_TAAAABE"]
[Fri May 22 06:50:10.654445 2026] [:error] [pid 15679:tid 15682] [client 81.167.26.57:42680] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ag-MIih8tgGc38WJ-Gx3dgAAAME"]
[Fri May 22 06:50:12.643105 2026] [:error] [pid 15585:tid 15669] [client 81.167.26.57:17732] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ag-MJCKb-vB41AF-LC1SYAAAAJY"]
[Fri May 22 06:50:14.472647 2026] [:error] [pid 15679:tid 15689] [client 81.167.26.57:28264] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ag-MJih8tgGc38WJ-Gx3eAAAAMg"]
[Fri May 22 06:50:16.459829 2026] [:error] [pid 15585:tid 15659] [client 81.167.26.57:22871] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ag-MKCKb-vB41AF-LC1SZAAAAIw"]
[Fri May 22 06:50:18.290819 2026] [:error] [pid 15585:tid 15651] [client 81.167.26.57:38330] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ag-MKiKb-vB41AF-LC1SZQAAAIQ"]
[Fri May 22 06:50:20.270680 2026] [:error] [pid 15583:tid 15604] [client 81.167.26.57:39089] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ag-MLHnaOncRcIm17YV_WgAAABA"]
[Fri May 22 06:50:22.094088 2026] [:error] [pid 15679:tid 15693] [client 81.167.26.57:28285] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ag-MLih8tgGc38WJ-Gx3ewAAAMw"]
[Fri May 22 06:50:24.081994 2026] [:error] [pid 15585:tid 15652] [client 81.167.26.57:14461] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ag-MMCKb-vB41AF-LC1SaQAAAIU"]
[Fri May 22 06:50:26.669146 2026] [:error] [pid 15583:tid 15593] [client 81.167.26.57:62413] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ag-MMnnaOncRcIm17YV_XAAAAAU"]
[Fri May 22 06:50:28.684203 2026] [:error] [pid 15583:tid 15590] [client 81.167.26.57:60438] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ag-MNHnaOncRcIm17YV_XQAAAAI"]
[Fri May 22 06:50:30.817866 2026] [:error] [pid 58782:tid 58789] [client 81.167.26.57:12186] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ag-MNoxsdTFafgO8vhSyLQAAAQU"]
[Fri May 22 06:50:32.818442 2026] [:error] [pid 58782:tid 58785] [client 81.167.26.57:16593] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ag-MOIxsdTFafgO8vhSyMQAAAQE"]
[Fri May 22 06:50:56.290593 2026] [:error] [pid 15679:tid 15681] [client 81.167.26.57:8148] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ag-MUCh8tgGc38WJ-Gx3pQAAAMA"]
[Fri May 22 06:50:58.435025 2026] [:error] [pid 15585:tid 15663] [client 81.167.26.57:32853] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ag-MUiKb-vB41AF-LC1SkwAAAJA"]
[Fri May 22 06:51:00.553357 2026] [:error] [pid 15585:tid 15653] [client 81.167.26.57:8555] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ag-MVCKb-vB41AF-LC1SlwAAAIY"]
[Fri May 22 06:51:02.527511 2026] [:error] [pid 15679:tid 15689] [client 81.167.26.57:38135] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ag-MVih8tgGc38WJ-Gx3qQAAAMg"]
[Fri May 22 06:51:03.754967 2026] [:error] [pid 15679:tid 15687] [client 81.167.26.57:17844] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-MVyh8tgGc38WJ-Gx3qgAAAMY"]
[Fri May 22 06:51:07.566194 2026] [:error] [pid 15585:tid 15650] [client 81.167.26.57:5448] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-MWyKb-vB41AF-LC1SmAAAAIM"]
[Fri May 22 08:01:34.596913 2026] [:error] [pid 15584:tid 15632] [client 36.142.116.76:49120] [client 36.142.116.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag-c3t9Z_TVLbNEx52iQ1QAAAEw"], referer: http://switchcreative.net/
[Fri May 22 08:26:46.435089 2026] [:error] [pid 58782:tid 58791] [client 43.156.117.41:33066] [client 43.156.117.41] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ag-ixoxsdTFafgO8vhS_EgAAAQc"]
[Fri May 22 08:39:00.097917 2026] [:error] [pid 58782:tid 58802] [client 178.151.245.162:36774] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ag-lpIxsdTFafgO8vhTBMgAAARI"]
[Fri May 22 08:39:02.077424 2026] [:error] [pid 15679:tid 15689] [client 178.151.245.162:38166] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ag-lpih8tgGc38WJ-GyVpAAAAMg"]
[Fri May 22 08:39:04.087810 2026] [:error] [pid 58813:tid 58818] [client 178.151.245.162:38168] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ag-lqJ6yyKWDKULhxJ0SogAAAUI"]
[Fri May 22 08:39:06.086023 2026] [:error] [pid 15585:tid 15660] [client 178.151.245.162:47648] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ag-lqiKb-vB41AF-LC180gAAAI0"]
[Fri May 22 08:39:08.093255 2026] [:error] [pid 15585:tid 15665] [client 178.151.245.162:47650] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ag-lrCKb-vB41AF-LC183QAAAJI"]
[Fri May 22 08:39:10.100744 2026] [:error] [pid 15584:tid 15636] [client 178.151.245.162:47652] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ag-lrt9Z_TVLbNEx52iZmQAAAFA"]
[Fri May 22 08:39:12.666360 2026] [:error] [pid 15679:tid 15699] [client 178.151.245.162:53114] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ag-lsCh8tgGc38WJ-GyVrAAAANI"]
[Fri May 22 08:39:15.281127 2026] [:error] [pid 58782:tid 58806] [client 178.151.245.162:48894] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ag-ls4xsdTFafgO8vhTBMwAAARY"]
[Fri May 22 08:39:18.700042 2026] [:error] [pid 15585:tid 15666] [client 178.151.245.162:32880] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-ltiKb-vB41AF-LC184gAAAJM"]
[Fri May 22 08:39:22.551149 2026] [:error] [pid 15585:tid 15665] [client 178.151.245.162:32890] [client 178.151.245.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-luiKb-vB41AF-LC186AAAAJI"]
[Fri May 22 09:27:45.311203 2026] [:error] [pid 15585:tid 15668] [client 43.153.205.132:32800] [client 43.153.205.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag-xESKb-vB41AF-LC2b9QAAAJU"]
[Fri May 22 09:43:45.372581 2026] [:error] [pid 15679:tid 15691] [client 87.185.77.164:53166] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag-00Sh8tgGc38WJ-GyzOAAAAMo"]
[Fri May 22 09:43:45.946400 2026] [:error] [pid 15584:tid 15639] [client 87.185.77.164:53169] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag-00d9Z_TVLbNEx52iulAAAAFM"]
[Fri May 22 09:43:48.954540 2026] [:error] [pid 15585:tid 15671] [client 87.185.77.164:53199] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ag-01CKb-vB41AF-LC2iDgAAAJg"]
[Fri May 22 09:43:49.527885 2026] [:error] [pid 15585:tid 15654] [client 87.185.77.164:53211] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ag-01SKb-vB41AF-LC2iEQAAAIc"]
[Fri May 22 09:43:52.857006 2026] [:error] [pid 15584:tid 15623] [client 87.185.77.164:53262] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ag-02N9Z_TVLbNEx52iunwAAAEM"]
[Fri May 22 09:43:53.426294 2026] [:error] [pid 15679:tid 15697] [client 87.185.77.164:53269] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ag-02Sh8tgGc38WJ-GyzRAAAANA"]
[Fri May 22 09:43:55.884321 2026] [:error] [pid 15584:tid 15620] [client 87.185.77.164:53311] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ag-0299Z_TVLbNEx52iuowAAAEA"]
[Fri May 22 09:43:56.452721 2026] [:error] [pid 15584:tid 15638] [client 87.185.77.164:53327] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ag-03N9Z_TVLbNEx52iupgAAAFI"]
[Fri May 22 09:43:59.669209 2026] [:error] [pid 15679:tid 15693] [client 87.185.77.164:53364] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ag-03yh8tgGc38WJ-GyzUAAAAMw"]
[Fri May 22 09:44:00.232442 2026] [:error] [pid 15679:tid 15685] [client 87.185.77.164:53378] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ag-04Ch8tgGc38WJ-GyzUQAAAMQ"]
[Fri May 22 09:44:03.123751 2026] [:error] [pid 15584:tid 15642] [client 87.185.77.164:53431] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ag-0499Z_TVLbNEx52iurAAAAFY"]
[Fri May 22 09:44:03.686744 2026] [:error] [pid 58813:tid 58819] [client 87.185.77.164:53448] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ag-0456yyKWDKULhxJ0hXgAAAUM"]
[Fri May 22 09:44:06.551841 2026] [:error] [pid 15585:tid 15667] [client 87.185.77.164:53493] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ag-05iKb-vB41AF-LC2iFgAAAJQ"]
[Fri May 22 09:44:07.114210 2026] [:error] [pid 15584:tid 15643] [client 87.185.77.164:53497] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ag-0599Z_TVLbNEx52iusAAAAFc"]
[Fri May 22 09:44:09.850763 2026] [:error] [pid 58782:tid 58801] [client 87.185.77.164:53558] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag-06YxsdTFafgO8vhTN2wAAARE"]
[Fri May 22 09:44:10.420859 2026] [:error] [pid 58813:tid 58838] [client 87.185.77.164:53562] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag-06p6yyKWDKULhxJ0hYAAAAVY"]
[Fri May 22 09:44:13.138310 2026] [:error] [pid 15584:tid 15634] [client 87.185.77.164:53608] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag-07d9Z_TVLbNEx52iutAAAAE4"]
[Fri May 22 09:44:13.703102 2026] [:error] [pid 58813:tid 58825] [client 87.185.77.164:53612] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag-07Z6yyKWDKULhxJ0hYwAAAUk"]
[Fri May 22 09:44:16.323510 2026] [:error] [pid 15583:tid 15607] [client 87.185.77.164:53660] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag-08HnaOncRcIm17YWkoQAAABM"]
[Fri May 22 09:44:16.886329 2026] [:error] [pid 58782:tid 58791] [client 87.185.77.164:53669] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag-08IxsdTFafgO8vhTN3QAAAQc"]
[Fri May 22 09:44:19.787636 2026] [:error] [pid 15584:tid 15636] [client 87.185.77.164:53705] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ag-0899Z_TVLbNEx52iutwAAAFA"]
[Fri May 22 09:44:20.365721 2026] [:error] [pid 58813:tid 58833] [client 87.185.77.164:53713] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ag-09J6yyKWDKULhxJ0hbAAAAVE"]
[Fri May 22 09:44:22.851708 2026] [:error] [pid 15585:tid 15671] [client 87.185.77.164:53752] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ag-09iKb-vB41AF-LC2iGAAAAJg"]
[Fri May 22 09:44:23.418722 2026] [:error] [pid 15585:tid 15669] [client 87.185.77.164:53759] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ag-09yKb-vB41AF-LC2iGQAAAJY"]
[Fri May 22 09:44:25.726844 2026] [:error] [pid 58813:tid 58836] [client 87.185.77.164:53784] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ag-0-Z6yyKWDKULhxJ0hbgAAAVQ"]
[Fri May 22 09:44:26.288789 2026] [:error] [pid 58813:tid 58827] [client 87.185.77.164:53789] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ag-0-p6yyKWDKULhxJ0hbwAAAUs"]
[Fri May 22 09:44:28.564776 2026] [:error] [pid 15679:tid 15705] [client 87.185.77.164:53851] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ag-0_Ch8tgGc38WJ-GyzVgAAANg"]
[Fri May 22 09:44:29.139921 2026] [:error] [pid 15584:tid 15621] [client 87.185.77.164:53861] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ag-0_d9Z_TVLbNEx52iuugAAAEE"]
[Fri May 22 09:44:31.571665 2026] [:error] [pid 15679:tid 15684] [client 87.185.77.164:53880] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ag-0_yh8tgGc38WJ-GyzVwAAAMM"]
[Fri May 22 09:44:32.165898 2026] [:error] [pid 58813:tid 58824] [client 87.185.77.164:53887] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ag-1AJ6yyKWDKULhxJ0hcQAAAUg"]
[Fri May 22 09:44:34.565314 2026] [:error] [pid 15584:tid 15627] [client 87.185.77.164:53921] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ag-1At9Z_TVLbNEx52iuvgAAAEc"]
[Fri May 22 09:44:35.133989 2026] [:error] [pid 15679:tid 15683] [client 87.185.77.164:53934] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ag-1Ayh8tgGc38WJ-GyzWAAAAMI"]
[Fri May 22 09:44:37.538366 2026] [:error] [pid 15585:tid 15663] [client 87.185.77.164:53973] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ag-1BSKb-vB41AF-LC2iHwAAAJA"]
[Fri May 22 09:44:38.102649 2026] [:error] [pid 58813:tid 58828] [client 87.185.77.164:53980] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ag-1Bp6yyKWDKULhxJ0hcwAAAUw"]
[Fri May 22 09:44:41.477126 2026] [:error] [pid 15585:tid 15668] [client 87.185.77.164:54032] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ag-1CSKb-vB41AF-LC2iIQAAAJU"]
[Fri May 22 09:45:09.330924 2026] [:error] [pid 15585:tid 15655] [client 87.185.77.164:54487] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ag-1JSKb-vB41AF-LC2iQwAAAIg"]
[Fri May 22 09:45:10.490572 2026] [:error] [pid 15585:tid 15654] [client 87.185.77.164:54518] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ag-1JiKb-vB41AF-LC2iRAAAAIc"]
[Fri May 22 09:45:13.157453 2026] [:error] [pid 15585:tid 15660] [client 87.185.77.164:54574] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag-1KSKb-vB41AF-LC2iSQAAAI0"]
[Fri May 22 09:45:13.725660 2026] [:error] [pid 15583:tid 15597] [client 87.185.77.164:54583] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ag-1KXnaOncRcIm17YWkrgAAAAk"]
[Fri May 22 09:45:15.828643 2026] [:error] [pid 15585:tid 15648] [client 87.185.77.164:54638] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ag-1KyKb-vB41AF-LC2iWAAAAIE"]
[Fri May 22 09:45:16.396528 2026] [:error] [pid 15585:tid 15652] [client 87.185.77.164:54645] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ag-1LCKb-vB41AF-LC2iWgAAAIU"]
[Fri May 22 09:45:19.155060 2026] [:error] [pid 15583:tid 15605] [client 87.185.77.164:54695] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag-1L3naOncRcIm17YWksQAAABE"]
[Fri May 22 09:45:19.721487 2026] [:error] [pid 15583:tid 15598] [client 87.185.77.164:54708] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ag-1L3naOncRcIm17YWksgAAAAo"]
[Fri May 22 09:45:21.897074 2026] [:error] [pid 15585:tid 15649] [client 87.185.77.164:54730] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ag-1MSKb-vB41AF-LC2iaQAAAII"]
[Fri May 22 09:45:22.496643 2026] [:error] [pid 15585:tid 15648] [client 87.185.77.164:54741] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ag-1MiKb-vB41AF-LC2iawAAAIE"]
[Fri May 22 09:45:24.893573 2026] [:error] [pid 15584:tid 15636] [client 87.185.77.164:54771] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag-1NN9Z_TVLbNEx52iu0AAAAFA"]
[Fri May 22 09:45:25.500594 2026] [:error] [pid 15584:tid 15632] [client 87.185.77.164:54776] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ag-1Nd9Z_TVLbNEx52iu0QAAAEw"]
[Fri May 22 09:45:28.137410 2026] [:error] [pid 15583:tid 15588] [client 87.185.77.164:54792] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag-1OHnaOncRcIm17YWktAAAAAA"]
[Fri May 22 09:45:28.706131 2026] [:error] [pid 15584:tid 15634] [client 87.185.77.164:54803] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ag-1ON9Z_TVLbNEx52iu1wAAAE4"]
[Fri May 22 09:45:30.903827 2026] [:error] [pid 15585:tid 15656] [client 87.185.77.164:54826] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag-1OiKb-vB41AF-LC2icgAAAIk"]
[Fri May 22 09:45:31.711838 2026] [:error] [pid 15585:tid 15650] [client 87.185.77.164:54832] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ag-1OyKb-vB41AF-LC2icwAAAIM"]
[Fri May 22 09:45:33.759346 2026] [:error] [pid 58782:tid 58808] [client 87.185.77.164:54862] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag-1PYxsdTFafgO8vhTODQAAARg"]
[Fri May 22 09:45:34.332596 2026] [:error] [pid 15679:tid 15700] [client 87.185.77.164:54902] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ag-1Pih8tgGc38WJ-GyzYAAAANM"]
[Fri May 22 09:45:39.529609 2026] [:error] [pid 15584:tid 15640] [client 87.185.77.164:54986] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ag-1Q99Z_TVLbNEx52iu2gAAAFQ"]
[Fri May 22 09:45:40.105579 2026] [:error] [pid 15583:tid 15599] [client 87.185.77.164:55002] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ag-1RHnaOncRcIm17YWkugAAAAs"]
[Fri May 22 09:45:50.351092 2026] [:error] [pid 58813:tid 58827] [client 87.185.77.164:55064] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag-1Tp6yyKWDKULhxJ0hoQAAAUs"]
[Fri May 22 09:45:50.920310 2026] [:error] [pid 15583:tid 15599] [client 87.185.77.164:55073] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag-1TnnaOncRcIm17YWkvgAAAAs"]
[Fri May 22 09:45:53.255649 2026] [:error] [pid 58782:tid 58792] [client 87.185.77.164:55136] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-1UYxsdTFafgO8vhTOFAAAAQg"]
[Fri May 22 09:45:54.486012 2026] [:error] [pid 58813:tid 58824] [client 87.185.77.164:55166] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-1Up6yyKWDKULhxJ0howAAAUg"]
[Fri May 22 09:45:58.554034 2026] [:error] [pid 15583:tid 15597] [client 87.185.77.164:55218] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-1VnnaOncRcIm17YWkwwAAAAk"]
[Fri May 22 09:45:59.136488 2026] [:error] [pid 15584:tid 15624] [client 87.185.77.164:55220] [client 87.185.77.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag-1V99Z_TVLbNEx52iu4QAAAEQ"]
[Fri May 22 10:20:20.640490 2026] [:error] [pid 15583:tid 15599] [client 159.223.216.201:51268] [client 159.223.216.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.216.201, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ag-9ZHnaOncRcIm17YWpswAAAAs"]
[Fri May 22 10:20:20.649959 2026] [proxy_fcgi:error] [pid 15583:tid 15599] [client 159.223.216.201:51268] AH01071: Got error 'Primary script unknown'
[Fri May 22 10:22:15.155278 2026] [:error] [pid 15679:tid 15705] [client 142.93.41.114:54504] [client 142.93.41.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.41.114, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ag-91yh8tgGc38WJ-Gy8oQAAANg"]
[Fri May 22 10:22:15.164993 2026] [proxy_fcgi:error] [pid 15679:tid 15705] [client 142.93.41.114:54504] AH01071: Got error 'Primary script unknown'
[Fri May 22 10:54:04.532108 2026] [:error] [pid 58782:tid 58803] [client 152.53.187.237:46366] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ag_FTIxsdTFafgO8vhTXEQAAARM"]
[Fri May 22 10:54:07.229370 2026] [:error] [pid 58782:tid 58801] [client 152.53.187.237:65444] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ag_FT4xsdTFafgO8vhTXEgAAARE"]
[Fri May 22 10:54:10.056070 2026] [:error] [pid 15584:tid 15624] [client 152.53.187.237:65450] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ag_FUt9Z_TVLbNEx52i8UQAAAEQ"]
[Fri May 22 10:54:12.873983 2026] [:error] [pid 15585:tid 15667] [client 152.53.187.237:33496] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ag_FVCKb-vB41AF-LC27EwAAAJQ"]
[Fri May 22 10:54:15.743059 2026] [:error] [pid 15585:tid 15648] [client 152.53.187.237:33510] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ag_FVyKb-vB41AF-LC27HAAAAIE"]
[Fri May 22 10:54:18.607841 2026] [:error] [pid 15679:tid 15691] [client 152.53.187.237:33522] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ag_FWih8tgGc38WJ-GzEwQAAAMo"]
[Fri May 22 10:54:21.314438 2026] [:error] [pid 15584:tid 15636] [client 152.53.187.237:55584] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ag_FXd9Z_TVLbNEx52i8WQAAAFA"]
[Fri May 22 10:54:24.137512 2026] [:error] [pid 15679:tid 15686] [client 152.53.187.237:55592] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ag_FYCh8tgGc38WJ-GzExgAAAMU"]
[Fri May 22 10:54:26.782885 2026] [:error] [pid 15583:tid 15603] [client 152.53.187.237:55604] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ag_FYnnaOncRcIm17YWwVAAAAA8"]
[Fri May 22 10:54:29.632705 2026] [:error] [pid 15679:tid 15701] [client 152.53.187.237:55610] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ag_FZSh8tgGc38WJ-GzE0QAAANQ"]
[Fri May 22 10:54:32.490331 2026] [:error] [pid 58813:tid 58823] [client 152.53.187.237:43306] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ag_FaJ6yyKWDKULhxJ0sDgAAAUc"]
[Fri May 22 10:54:35.302146 2026] [:error] [pid 15583:tid 15607] [client 152.53.187.237:43314] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ag_Fa3naOncRcIm17YWwWwAAABM"]
[Fri May 22 10:54:37.241726 2026] [:error] [pid 15585:tid 15650] [client 152.53.187.237:46842] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ag_FbSKb-vB41AF-LC27SQAAAIM"]
[Fri May 22 10:54:40.030952 2026] [:error] [pid 58813:tid 58826] [client 152.53.187.237:43330] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ag_FcJ6yyKWDKULhxJ0sFgAAAUo"]
[Fri May 22 10:54:42.964110 2026] [:error] [pid 15584:tid 15632] [client 152.53.187.237:50146] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ag_Fct9Z_TVLbNEx52i8aQAAAEw"]
[Fri May 22 10:54:46.558062 2026] [:error] [pid 15585:tid 15654] [client 152.53.187.237:36430] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag_FdiKb-vB41AF-LC27WAAAAIc"]
[Fri May 22 10:54:49.317562 2026] [:error] [pid 15679:tid 15689] [client 152.53.187.237:50158] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ag_FeSh8tgGc38WJ-GzFOQAAAMg"]
[Fri May 22 10:54:52.070756 2026] [:error] [pid 58813:tid 58829] [client 152.53.187.237:61216] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ag_FfJ6yyKWDKULhxJ0sHwAAAU0"]
[Fri May 22 10:54:54.143990 2026] [:error] [pid 15585:tid 15661] [client 152.53.187.237:40482] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag_FfiKb-vB41AF-LC27ZwAAAI4"]
[Fri May 22 10:54:56.703414 2026] [:error] [pid 15585:tid 15663] [client 152.53.187.237:61228] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ag_FgCKb-vB41AF-LC27bQAAAJA"]
[Fri May 22 10:54:58.938469 2026] [:error] [pid 15585:tid 15666] [client 152.53.187.237:40498] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ag_FgiKb-vB41AF-LC27cAAAAJM"]
[Fri May 22 10:55:01.610055 2026] [:error] [pid 15584:tid 15624] [client 152.53.187.237:34008] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ag_Fhd9Z_TVLbNEx52i8cwAAAEQ"]
[Fri May 22 10:55:24.840743 2026] [:error] [pid 15584:tid 15638] [client 152.53.187.237:34012] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag_FnN9Z_TVLbNEx52i8kwAAAFI"]
[Fri May 22 10:55:27.700877 2026] [:error] [pid 15584:tid 15644] [client 152.53.187.237:39674] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ag_Fn99Z_TVLbNEx52i8mgAAAFg"]
[Fri May 22 10:55:30.263290 2026] [:error] [pid 15585:tid 15659] [client 152.53.187.237:39686] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ag_FoiKb-vB41AF-LC27hQAAAIw"]
[Fri May 22 10:55:44.360407 2026] [:error] [pid 15583:tid 15595] [client 152.53.187.237:64160] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ag_FsHnaOncRcIm17YWwkgAAAAc"]
[Fri May 22 10:55:46.980561 2026] [:error] [pid 15583:tid 15596] [client 152.53.187.237:64172] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ag_FsnnaOncRcIm17YWwkwAAAAg"]
[Fri May 22 10:55:49.979980 2026] [:error] [pid 15583:tid 15612] [client 152.53.187.237:64180] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ag_FtXnaOncRcIm17YWwlwAAABg"]
[Fri May 22 10:55:52.901938 2026] [:error] [pid 15679:tid 15685] [client 152.53.187.237:48270] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ag_FuCh8tgGc38WJ-GzFgQAAAMQ"]
[Fri May 22 10:55:55.742505 2026] [:error] [pid 15585:tid 15668] [client 152.53.187.237:48274] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ag_FuyKb-vB41AF-LC27tAAAAJU"]
[Fri May 22 10:55:58.500816 2026] [:error] [pid 15585:tid 15652] [client 152.53.187.237:48276] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ag_FviKb-vB41AF-LC27vwAAAIU"]
[Fri May 22 10:56:01.606318 2026] [:error] [pid 15679:tid 15702] [client 152.53.187.237:57602] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ag_FwSh8tgGc38WJ-GzFigAAANU"]
[Fri May 22 10:56:04.528031 2026] [:error] [pid 15585:tid 15666] [client 152.53.187.237:57610] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ag_FxCKb-vB41AF-LC27xQAAAJM"]
[Fri May 22 10:56:07.187881 2026] [:error] [pid 15679:tid 15682] [client 152.53.187.237:57616] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ag_Fxyh8tgGc38WJ-GzFiwAAAME"]
[Fri May 22 10:56:09.887040 2026] [:error] [pid 15583:tid 15604] [client 152.53.187.237:57620] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ag_FyXnaOncRcIm17YWwnwAAABA"]
[Fri May 22 10:56:12.486729 2026] [:error] [pid 15584:tid 15627] [client 152.53.187.237:39594] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ag_FzN9Z_TVLbNEx52i80AAAAEc"]
[Fri May 22 10:56:15.172264 2026] [:error] [pid 58782:tid 58789] [client 152.53.187.237:39600] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ag_Fz4xsdTFafgO8vhTXWAAAAQU"]
[Fri May 22 10:56:17.950120 2026] [:error] [pid 15679:tid 15703] [client 152.53.187.237:39610] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ag_F0Sh8tgGc38WJ-GzFmAAAANY"]
[Fri May 22 10:56:20.853145 2026] [:error] [pid 15585:tid 15653] [client 152.53.187.237:39616] [client 152.53.187.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ag_F1CKb-vB41AF-LC271QAAAIY"]
[Fri May 22 10:58:23.483576 2026] [:error] [pid 58813:tid 58821] [client 37.187.226.31:38314] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ag_GT56yyKWDKULhxJ0sqwAAAUU"]
[Fri May 22 10:58:25.874948 2026] [:error] [pid 58782:tid 58790] [client 37.187.226.31:60230] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ag_GUYxsdTFafgO8vhTXxQAAAQY"]
[Fri May 22 10:58:28.751058 2026] [:error] [pid 15584:tid 15631] [client 37.187.226.31:56412] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag_GVN9Z_TVLbNEx52i9XAAAAEs"]
[Fri May 22 10:58:32.435776 2026] [:error] [pid 15585:tid 15668] [client 37.187.226.31:43712] [client 37.187.226.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag_GWCKb-vB41AF-LC285AAAAJU"]
[Fri May 22 12:11:12.112579 2026] [:error] [pid 15585:tid 15667] [client 145.239.69.44:43152] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ag_XYCKb-vB41AF-LC3ZCgAAAJQ"]
[Fri May 22 12:11:13.935951 2026] [:error] [pid 15584:tid 15627] [client 145.239.69.44:59140] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ag_XYd9Z_TVLbNEx52jK3AAAAEc"]
[Fri May 22 12:11:15.853839 2026] [:error] [pid 15584:tid 15628] [client 145.239.69.44:59152] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ag_XY99Z_TVLbNEx52jK4wAAAEg"]
[Fri May 22 12:11:17.739415 2026] [:error] [pid 15584:tid 15623] [client 145.239.69.44:59162] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ag_XZd9Z_TVLbNEx52jK6AAAAEM"]
[Fri May 22 12:11:19.651778 2026] [:error] [pid 58782:tid 58800] [client 145.239.69.44:59172] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ag_XZ4xsdTFafgO8vhThJQAAARA"]
[Fri May 22 12:11:21.534062 2026] [:error] [pid 15679:tid 15696] [client 145.239.69.44:50794] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ag_XaSh8tgGc38WJ-GzYsgAAAM8"]
[Fri May 22 12:11:23.441016 2026] [:error] [pid 15679:tid 15699] [client 145.239.69.44:50804] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ag_Xayh8tgGc38WJ-GzYtQAAANI"]
[Fri May 22 12:11:25.347044 2026] [:error] [pid 15585:tid 15650] [client 145.239.69.44:50814] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ag_XbSKb-vB41AF-LC3ZFwAAAIM"]
[Fri May 22 12:11:27.235392 2026] [:error] [pid 15585:tid 15657] [client 145.239.69.44:50828] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ag_XbyKb-vB41AF-LC3ZHgAAAIo"]
[Fri May 22 12:11:29.277984 2026] [:error] [pid 58782:tid 58787] [client 145.239.69.44:50830] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ag_XcYxsdTFafgO8vhThKgAAAQM"]
[Fri May 22 12:11:31.164542 2026] [:error] [pid 58782:tid 58793] [client 145.239.69.44:50844] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ag_Xc4xsdTFafgO8vhThLgAAAQk"]
[Fri May 22 12:11:33.076171 2026] [:error] [pid 15584:tid 15636] [client 145.239.69.44:39224] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ag_Xdd9Z_TVLbNEx52jK8AAAAFA"]
[Fri May 22 12:11:34.955343 2026] [:error] [pid 58782:tid 58808] [client 145.239.69.44:39234] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ag_XdoxsdTFafgO8vhThMgAAARg"]
[Fri May 22 12:11:36.864130 2026] [:error] [pid 15585:tid 15649] [client 145.239.69.44:39238] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ag_XeCKb-vB41AF-LC3ZIgAAAII"]
[Fri May 22 12:11:38.748965 2026] [:error] [pid 58782:tid 58798] [client 145.239.69.44:39252] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ag_XeoxsdTFafgO8vhThNgAAAQ4"]
[Fri May 22 12:11:40.779330 2026] [:error] [pid 15585:tid 15652] [client 145.239.69.44:39258] [client 145.239.69.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ag_XfCKb-vB41AF-LC3ZLwAAAIU"]
[Fri May 22 12:45:37.086084 2026] [:error] [pid 15584:tid 15644] [client 193.70.46.38:37100] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag_fcd9Z_TVLbNEx52jStQAAAFg"]
[Fri May 22 12:45:40.959941 2026] [:error] [pid 15583:tid 15589] [client 193.70.46.38:37112] [client 193.70.46.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ag_fdHnaOncRcIm17YXEOgAAAAE"]
[Fri May 22 12:57:23.651104 2026] [proxy_fcgi:error] [pid 15584:tid 15637] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:25.035506 2026] [proxy_fcgi:error] [pid 15584:tid 15630] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:25.423277 2026] [proxy_fcgi:error] [pid 15584:tid 15621] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:25.646144 2026] [proxy_fcgi:error] [pid 15584:tid 15622] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:27.141786 2026] [proxy_fcgi:error] [pid 15584:tid 15628] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:28.098718 2026] [proxy_fcgi:error] [pid 15584:tid 15629] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:30.133699 2026] [proxy_fcgi:error] [pid 15584:tid 15623] [client 52.242.199.195:57584] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:57:30.340528 2026] [:error] [pid 15584:tid 15641] [client 52.242.199.195:57584] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "ag_iOt9Z_TVLbNEx52jVVQAAAFU"]
[Fri May 22 12:57:33.291320 2026] [:error] [pid 15584:tid 15639] [client 52.242.199.195:57547] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "ag_iPd9Z_TVLbNEx52jVWQAAAFM"]
[Fri May 22 12:57:35.411299 2026] [:error] [pid 15583:tid 15591] [client 52.242.199.195:57580] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "ag_iP3naOncRcIm17YXGjQAAAAM"]
[Fri May 22 12:57:38.350707 2026] [:error] [pid 15585:tid 15660] [client 52.242.199.195:31922] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/"] [unique_id "ag_iQiKb-vB41AF-LC3pWwAAAI0"]
[Fri May 22 12:57:39.908750 2026] [:error] [pid 15585:tid 15665] [client 52.242.199.195:43458] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/controller/extension/extension/ultra.php"] [unique_id "ag_iQyKb-vB41AF-LC3pXwAAAJI"]
[Fri May 22 12:57:41.828736 2026] [:error] [pid 15584:tid 15620] [client 52.242.199.195:39767] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/controller/extension/extension/ultra.php"] [unique_id "ag_iRd9Z_TVLbNEx52jVYgAAAEA"]
[Fri May 22 12:57:43.363188 2026] [:error] [pid 58813:tid 58827] [client 52.242.199.195:34078] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/controller/extension/extension/ultra.php"] [unique_id "ag_iR56yyKWDKULhxJ1AFQAAAUs"]
[Fri May 22 12:57:44.257414 2026] [:error] [pid 58813:tid 58825] [client 52.242.199.195:4064] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/controller/extension/extension/ultra.php"] [unique_id "ag_iSJ6yyKWDKULhxJ1AHgAAAUk"]
[Fri May 22 12:57:46.716350 2026] [:error] [pid 15584:tid 15643] [client 52.242.199.195:44654] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag_iSt9Z_TVLbNEx52jVbwAAAFc"]
[Fri May 22 12:57:47.562478 2026] [:error] [pid 15679:tid 15700] [client 52.242.199.195:43482] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag_iSyh8tgGc38WJ-GznkgAAANM"]
[Fri May 22 12:57:48.610027 2026] [:error] [pid 15679:tid 15702] [client 52.242.199.195:53953] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag_iTCh8tgGc38WJ-GznlQAAANU"]
[Fri May 22 12:57:49.414048 2026] [:error] [pid 58813:tid 58836] [client 52.242.199.195:4051] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ag_iTZ6yyKWDKULhxJ1AJgAAAVQ"]
[Fri May 22 12:57:50.504386 2026] [:error] [pid 15679:tid 15686] [client 52.242.199.195:4072] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/go.php"] [unique_id "ag_iTih8tgGc38WJ-GznmgAAAMU"]
[Fri May 22 12:57:53.826192 2026] [:error] [pid 15584:tid 15623] [client 52.242.199.195:4035] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/go.php"] [unique_id "ag_iUd9Z_TVLbNEx52jVfQAAAEM"]
[Fri May 22 12:57:57.619534 2026] [:error] [pid 15583:tid 15599] [client 52.242.199.195:53995] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/go.php"] [unique_id "ag_iVXnaOncRcIm17YXGsAAAAAs"]
[Fri May 22 12:57:59.825290 2026] [:error] [pid 58782:tid 58803] [client 52.242.199.195:4079] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/go.php"] [unique_id "ag_iV4xsdTFafgO8vhTpWwAAARM"]
[Fri May 22 12:58:02.774590 2026] [:error] [pid 58782:tid 58801] [client 52.242.199.195:4042] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "ag_iWoxsdTFafgO8vhTpXQAAARE"]
[Fri May 22 12:58:05.200301 2026] [:error] [pid 15585:tid 15652] [client 52.242.199.195:39797] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "ag_iXSKb-vB41AF-LC3pdAAAAIU"]
[Fri May 22 12:58:08.043450 2026] [:error] [pid 15679:tid 15690] [client 52.242.199.195:54005] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "ag_iYCh8tgGc38WJ-GznuwAAAMk"]
[Fri May 22 12:58:09.737974 2026] [:error] [pid 58813:tid 58826] [client 52.242.199.195:6081] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vv.php"] [unique_id "ag_iYZ6yyKWDKULhxJ1AQAAAAUo"]
[Fri May 22 12:58:12.283609 2026] [:error] [pid 15679:tid 15693] [client 52.242.199.195:31904] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ag_iZCh8tgGc38WJ-GznxAAAAMw"]
[Fri May 22 12:58:14.448470 2026] [:error] [pid 58813:tid 58831] [client 52.242.199.195:43497] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ag_iZp6yyKWDKULhxJ1AQwAAAU8"]
[Fri May 22 12:58:16.342970 2026] [:error] [pid 15584:tid 15621] [client 52.242.199.195:34088] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ag_iaN9Z_TVLbNEx52jVggAAAEE"]
[Fri May 22 12:58:18.788439 2026] [:error] [pid 15585:tid 15665] [client 52.242.199.195:47407] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ag_iaiKb-vB41AF-LC3phAAAAJI"]
[Fri May 22 12:58:26.540029 2026] [:error] [pid 15679:tid 15682] [client 52.242.199.195:44667] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f35.php"] [unique_id "ag_icih8tgGc38WJ-Gzn0wAAAME"]
[Fri May 22 12:58:34.364582 2026] [proxy_fcgi:error] [pid 15679:tid 15682] [client 52.242.199.195:57140] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:34.964038 2026] [proxy_fcgi:error] [pid 15679:tid 15701] [client 52.242.199.195:57140] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:35.155739 2026] [proxy_fcgi:error] [pid 15679:tid 15684] [client 52.242.199.195:57140] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:35.741575 2026] [proxy_fcgi:error] [pid 15679:tid 15694] [client 52.242.199.195:57140] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:36.120585 2026] [:error] [pid 15679:tid 15690] [client 52.242.199.195:57140] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "ag_ifCh8tgGc38WJ-Gzn7gAAAMk"]
[Fri May 22 12:58:38.568508 2026] [proxy_fcgi:error] [pid 15584:tid 15637] [client 52.242.199.195:6035] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:38.778125 2026] [proxy_fcgi:error] [pid 15584:tid 15624] [client 52.242.199.195:6035] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:58:39.167210 2026] [:error] [pid 15584:tid 15634] [client 52.242.199.195:6035] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ag_if99Z_TVLbNEx52jVlgAAAE4"]
[Fri May 22 12:58:41.685539 2026] [:error] [pid 15585:tid 15656] [client 52.242.199.195:1608] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ag_igSKb-vB41AF-LC3qRAAAAIk"]
[Fri May 22 12:58:44.722249 2026] [:error] [pid 15585:tid 15655] [client 52.242.199.195:25035] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ag_ihCKb-vB41AF-LC3qSQAAAIg"]
[Fri May 22 12:58:46.513971 2026] [:error] [pid 15585:tid 15654] [client 52.242.199.195:40173] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ag_ihiKb-vB41AF-LC3qUAAAAIc"]
[Fri May 22 12:58:49.180686 2026] [:error] [pid 15584:tid 15639] [client 52.242.199.195:5150] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ag_iid9Z_TVLbNEx52jVpQAAAFM"]
[Fri May 22 12:58:50.706983 2026] [:error] [pid 58782:tid 58805] [client 52.242.199.195:5152] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ag_iioxsdTFafgO8vhTpfwAAARU"]
[Fri May 22 12:58:55.293593 2026] [:error] [pid 58782:tid 58808] [client 52.242.199.195:35404] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ag_ij4xsdTFafgO8vhTphAAAARg"]
[Fri May 22 12:58:59.746644 2026] [:error] [pid 15585:tid 15650] [client 52.242.199.195:35923] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ag_ikyKb-vB41AF-LC3qbgAAAIM"]
[Fri May 22 12:59:02.373776 2026] [:error] [pid 15583:tid 15607] [client 52.242.199.195:32008] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/cache/"] [unique_id "ag_ilnnaOncRcIm17YXHGwAAABM"]
[Fri May 22 12:59:05.257958 2026] [:error] [pid 15584:tid 15635] [client 52.242.199.195:42426] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/cache/"] [unique_id "ag_imd9Z_TVLbNEx52jVvAAAAE8"]
[Fri May 22 12:59:08.126661 2026] [:error] [pid 15679:tid 15705] [client 52.242.199.195:64379] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/cache/"] [unique_id "ag_inCh8tgGc38WJ-GzoKAAAANg"]
[Fri May 22 12:59:10.112409 2026] [:error] [pid 15585:tid 15658] [client 52.242.199.195:64330] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/cache/"] [unique_id "ag_iniKb-vB41AF-LC3qfAAAAIs"]
[Fri May 22 12:59:13.022336 2026] [:error] [pid 15584:tid 15626] [client 52.242.199.195:42204] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ag_iod9Z_TVLbNEx52jVxwAAAEY"]
[Fri May 22 12:59:14.104921 2026] [:error] [pid 15585:tid 15660] [client 52.242.199.195:47044] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ag_ioiKb-vB41AF-LC3qhAAAAI0"]
[Fri May 22 12:59:17.472818 2026] [:error] [pid 15585:tid 15667] [client 52.242.199.195:47125] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ag_ipSKb-vB41AF-LC3qhQAAAJQ"]
[Fri May 22 12:59:18.837972 2026] [:error] [pid 58813:tid 58823] [client 52.242.199.195:56588] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ag_ipp6yyKWDKULhxJ1AhwAAAUc"]
[Fri May 22 12:59:20.357319 2026] [:error] [pid 58813:tid 58835] [client 52.242.199.195:42235] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "ag_iqJ6yyKWDKULhxJ1AigAAAVM"]
[Fri May 22 12:59:21.652270 2026] [:error] [pid 15584:tid 15629] [client 52.242.199.195:34950] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "ag_iqd9Z_TVLbNEx52jVywAAAEk"]
[Fri May 22 12:59:22.944085 2026] [:error] [pid 15679:tid 15689] [client 52.242.199.195:42409] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "ag_iqih8tgGc38WJ-GzoPAAAAMg"]
[Fri May 22 12:59:24.522897 2026] [:error] [pid 15583:tid 15588] [client 52.242.199.195:47122] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/"] [unique_id "ag_irHnaOncRcIm17YXHOAAAAAA"]
[Fri May 22 12:59:25.740940 2026] [:error] [pid 15585:tid 15654] [client 52.242.199.195:35368] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ag_irSKb-vB41AF-LC3qmAAAAIc"]
[Fri May 22 12:59:26.733573 2026] [:error] [pid 15585:tid 15651] [client 52.242.199.195:9582] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ag_iriKb-vB41AF-LC3qngAAAIQ"]
[Fri May 22 12:59:27.751810 2026] [:error] [pid 15585:tid 15660] [client 52.242.199.195:53888] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ag_iryKb-vB41AF-LC3qqAAAAI0"]
[Fri May 22 12:59:28.834307 2026] [:error] [pid 15584:tid 15627] [client 52.242.199.195:51347] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ag_isN9Z_TVLbNEx52jV1AAAAEc"]
[Fri May 22 12:59:31.186625 2026] [:error] [pid 15585:tid 15654] [client 52.242.199.195:52618] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ag_isyKb-vB41AF-LC3qrAAAAIc"]
[Fri May 22 12:59:32.042644 2026] [:error] [pid 58782:tid 58784] [client 52.242.199.195:63479] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ag_itIxsdTFafgO8vhTpogAAAQA"]
[Fri May 22 12:59:32.934936 2026] [:error] [pid 15583:tid 15596] [client 52.242.199.195:34963] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ag_itHnaOncRcIm17YXHRAAAAAg"]
[Fri May 22 12:59:34.598646 2026] [:error] [pid 15585:tid 15651] [client 52.242.199.195:2723] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/0x.php"] [unique_id "ag_itiKb-vB41AF-LC3quAAAAIQ"]
[Fri May 22 12:59:35.750948 2026] [:error] [pid 15585:tid 15661] [client 52.242.199.195:2701] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ag_ityKb-vB41AF-LC3qugAAAI4"]
[Fri May 22 12:59:37.480311 2026] [:error] [pid 15679:tid 15695] [client 52.242.199.195:56699] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ag_iuSh8tgGc38WJ-GzoYQAAAM4"]
[Fri May 22 12:59:39.738745 2026] [proxy_fcgi:error] [pid 15585:tid 15666] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:40.421145 2026] [proxy_fcgi:error] [pid 15585:tid 15656] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:41.032057 2026] [proxy_fcgi:error] [pid 15585:tid 15657] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:41.241804 2026] [proxy_fcgi:error] [pid 15585:tid 15660] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:41.444344 2026] [proxy_fcgi:error] [pid 15585:tid 15664] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:41.896146 2026] [proxy_fcgi:error] [pid 15585:tid 15655] [client 52.242.199.195:36227] AH01071: Got error 'Primary script unknown'
[Fri May 22 12:59:42.121294 2026] [:error] [pid 15585:tid 15661] [client 52.242.199.195:36227] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/x/index.php"] [unique_id "ag_iviKb-vB41AF-LC3q1AAAAI4"]
[Fri May 22 12:59:44.275039 2026] [:error] [pid 58782:tid 58803] [client 52.242.199.195:3976] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/x/index.php"] [unique_id "ag_iwIxsdTFafgO8vhTpqwAAARM"]
[Fri May 22 12:59:47.029630 2026] [:error] [pid 15679:tid 15698] [client 52.242.199.195:5913] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/x/index.php"] [unique_id "ag_iwyh8tgGc38WJ-GzoagAAANE"]
[Fri May 22 12:59:52.424014 2026] [:error] [pid 15585:tid 15651] [client 52.242.199.195:43730] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/x/index.php"] [unique_id "ag_iyCKb-vB41AF-LC3q6wAAAIQ"]
[Fri May 22 12:59:58.263714 2026] [:error] [pid 15583:tid 15608] [client 52.242.199.195:43736] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "ag_iznnaOncRcIm17YXHSwAAABQ"]
[Fri May 22 13:00:01.862081 2026] [:error] [pid 15583:tid 15591] [client 52.242.199.195:5410] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "ag_i0XnaOncRcIm17YXHTQAAAAM"]
[Fri May 22 13:00:04.933416 2026] [:error] [pid 15583:tid 15590] [client 52.242.199.195:41387] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/index.php"] [unique_id "ag_i1HnaOncRcIm17YXHVAAAAAI"]
[Fri May 22 13:00:09.353545 2026] [:error] [pid 15585:tid 15662] [client 52.242.199.195:42250] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ag_i2SKb-vB41AF-LC3rGQAAAI8"]
[Fri May 22 13:00:11.419507 2026] [:error] [pid 15584:tid 15642] [client 52.242.199.195:35570] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ag_i299Z_TVLbNEx52jV8AAAAFY"]
[Fri May 22 13:00:12.997138 2026] [:error] [pid 15583:tid 15609] [client 52.242.199.195:33990] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ag_i3HnaOncRcIm17YXHiAAAABU"]
[Fri May 22 13:00:15.429038 2026] [:error] [pid 15585:tid 15660] [client 52.242.199.195:32556] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/as.php"] [unique_id "ag_i3yKb-vB41AF-LC3rNwAAAI0"]
[Fri May 22 13:00:17.441659 2026] [:error] [pid 15584:tid 15625] [client 52.242.199.195:31498] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ag_i4d9Z_TVLbNEx52jV8wAAAEU"]
[Fri May 22 13:00:19.502897 2026] [:error] [pid 15679:tid 15682] [client 52.242.199.195:26640] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ag_i4yh8tgGc38WJ-GzolQAAAME"]
[Fri May 22 13:00:23.212282 2026] [:error] [pid 15583:tid 15605] [client 52.242.199.195:26645] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ag_i53naOncRcIm17YXHwQAAABE"]
[Fri May 22 13:00:25.123219 2026] [:error] [pid 15585:tid 15648] [client 52.242.199.195:30588] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ag_i6SKb-vB41AF-LC3rUAAAAIE"]
[Fri May 22 13:00:28.576504 2026] [:error] [pid 15585:tid 15656] [client 52.242.199.195:5652] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-config-sample.php"] [unique_id "ag_i7CKb-vB41AF-LC3rWwAAAIk"]
[Fri May 22 13:00:31.197051 2026] [:error] [pid 15584:tid 15629] [client 52.242.199.195:16193] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-config-sample.php"] [unique_id "ag_i799Z_TVLbNEx52jV-wAAAEk"]
[Fri May 22 13:00:33.398402 2026] [:error] [pid 15583:tid 15598] [client 52.242.199.195:47465] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-config-sample.php"] [unique_id "ag_i8XnaOncRcIm17YXHxgAAAAo"]
[Fri May 22 13:00:35.160410 2026] [:error] [pid 15585:tid 15661] [client 52.242.199.195:41368] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-config-sample.php"] [unique_id "ag_i8yKb-vB41AF-LC3rawAAAI4"]
[Fri May 22 13:00:35.655816 2026] [:error] [pid 58813:tid 58818] [client 52.242.199.195:41348] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ag_i856yyKWDKULhxJ1AuwAAAUI"]
[Fri May 22 13:00:36.411654 2026] [:error] [pid 15679:tid 15687] [client 52.242.199.195:61170] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ag_i9Ch8tgGc38WJ-GzopQAAAMY"]
[Fri May 22 13:00:39.024473 2026] [:error] [pid 15585:tid 15647] [client 52.242.199.195:24996] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ag_i9yKb-vB41AF-LC3regAAAIA"]
[Fri May 22 13:00:41.369663 2026] [proxy_fcgi:error] [pid 15583:tid 15600] [client 52.242.199.195:42627] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:41.557029 2026] [:error] [pid 15583:tid 15596] [client 52.242.199.195:42627] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "ag_i-XnaOncRcIm17YXHzAAAAAg"]
[Fri May 22 13:00:46.016439 2026] [proxy_fcgi:error] [pid 15584:tid 15621] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:46.257470 2026] [proxy_fcgi:error] [pid 15584:tid 15639] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:46.646155 2026] [proxy_fcgi:error] [pid 15584:tid 15632] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:46.835754 2026] [:error] [pid 15584:tid 15637] [client 52.242.199.195:36500] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.199.195, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ag_i_t9Z_TVLbNEx52jWCwAAAFE"]
[Fri May 22 13:00:46.840894 2026] [proxy_fcgi:error] [pid 15584:tid 15637] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:47.423709 2026] [autoindex:error] [pid 15584:tid 15627] [client 52.242.199.195:36500] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri May 22 13:00:47.630092 2026] [proxy_fcgi:error] [pid 15584:tid 15623] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:47.821439 2026] [proxy_fcgi:error] [pid 15584:tid 15644] [client 52.242.199.195:36500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:00:48.017867 2026] [:error] [pid 15584:tid 15640] [client 52.242.199.195:36500] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "ag_jAN9Z_TVLbNEx52jWEQAAAFQ"]
[Fri May 22 13:00:49.277279 2026] [:error] [pid 15584:tid 15638] [client 52.242.199.195:57031] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "ag_jAd9Z_TVLbNEx52jWEwAAAFI"]
[Fri May 22 13:00:52.007846 2026] [:error] [pid 58813:tid 58839] [client 52.242.199.195:59407] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "ag_jBJ6yyKWDKULhxJ1AzwAAAVc"]
[Fri May 22 13:00:55.614149 2026] [:error] [pid 15583:tid 15611] [client 52.242.199.195:30638] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/index/function.php"] [unique_id "ag_jB3naOncRcIm17YXH1QAAABc"]
[Fri May 22 13:01:00.677128 2026] [:error] [pid 15584:tid 15623] [client 52.242.199.195:34895] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ag_jDN9Z_TVLbNEx52jWGAAAAEM"]
[Fri May 22 13:01:02.481704 2026] [:error] [pid 15584:tid 15638] [client 52.242.199.195:2829] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ag_jDt9Z_TVLbNEx52jWHAAAAFI"]
[Fri May 22 13:01:06.431423 2026] [:error] [pid 15584:tid 15621] [client 52.242.199.195:31243] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ag_jEt9Z_TVLbNEx52jWJQAAAEE"]
[Fri May 22 13:01:08.347148 2026] [:error] [pid 15679:tid 15696] [client 52.242.199.195:8339] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ag_jFCh8tgGc38WJ-GzotgAAAM8"]
[Fri May 22 13:01:11.390137 2026] [:error] [pid 15585:tid 15648] [client 52.242.199.195:34920] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ag_jFyKb-vB41AF-LC3rpAAAAIE"]
[Fri May 22 13:01:14.613892 2026] [:error] [pid 15679:tid 15687] [client 52.242.199.195:54493] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ag_jGih8tgGc38WJ-GzowgAAAMY"]
[Fri May 22 13:01:17.657019 2026] [:error] [pid 15679:tid 15703] [client 52.242.199.195:58205] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ag_jHSh8tgGc38WJ-GzoyAAAANY"]
[Fri May 22 13:01:20.779680 2026] [:error] [pid 58813:tid 58816] [client 52.242.199.195:8325] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ag_jIJ6yyKWDKULhxJ1A7wAAAUA"]
[Fri May 22 13:01:27.900411 2026] [:error] [pid 15679:tid 15702] [client 52.242.199.195:37885] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "ag_jJyh8tgGc38WJ-Gzo3AAAANU"]
[Fri May 22 13:01:34.686538 2026] [:error] [pid 15679:tid 15694] [client 52.242.199.195:2795] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "ag_jLih8tgGc38WJ-Gzo7QAAAM0"]
[Fri May 22 13:01:38.410455 2026] [:error] [pid 15679:tid 15688] [client 52.242.199.195:5719] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ag_jMih8tgGc38WJ-Gzo9gAAAMc"]
[Fri May 22 13:01:41.742640 2026] [:error] [pid 58813:tid 58821] [client 52.242.199.195:58267] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ag_jNZ6yyKWDKULhxJ1BDgAAAUU"]
[Fri May 22 13:01:47.517413 2026] [proxy_fcgi:error] [pid 15584:tid 15634] [client 52.242.199.195:2243] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:01:48.241394 2026] [proxy_fcgi:error] [pid 15584:tid 15640] [client 52.242.199.195:2243] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:01:50.480737 2026] [proxy_fcgi:error] [pid 15584:tid 15627] [client 52.242.199.195:2243] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:01:50.673396 2026] [proxy_fcgi:error] [pid 15584:tid 15620] [client 52.242.199.195:2243] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:01:51.065830 2026] [:error] [pid 15584:tid 15622] [client 52.242.199.195:2243] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.242.199.195, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ag_jP99Z_TVLbNEx52jWVQAAAEI"]
[Fri May 22 13:01:51.069518 2026] [proxy_fcgi:error] [pid 15584:tid 15622] [client 52.242.199.195:2243] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:01:51.260605 2026] [:error] [pid 15584:tid 15644] [client 52.242.199.195:2243] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cache.php"] [unique_id "ag_jP99Z_TVLbNEx52jWVgAAAFg"]
[Fri May 22 13:01:52.290638 2026] [:error] [pid 15679:tid 15690] [client 52.242.199.195:28985] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cache.php"] [unique_id "ag_jQCh8tgGc38WJ-GzpBgAAAMk"]
[Fri May 22 13:01:53.157803 2026] [:error] [pid 15679:tid 15685] [client 52.242.199.195:28970] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cache.php"] [unique_id "ag_jQSh8tgGc38WJ-GzpBwAAAMQ"]
[Fri May 22 13:01:54.306838 2026] [:error] [pid 58813:tid 58818] [client 52.242.199.195:58275] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cache.php"] [unique_id "ag_jQp6yyKWDKULhxJ1BJQAAAUI"]
[Fri May 22 13:01:55.312315 2026] [:error] [pid 15583:tid 15590] [client 52.242.199.195:46844] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "ag_jQ3naOncRcIm17YXICwAAAAI"]
[Fri May 22 13:01:55.902697 2026] [:error] [pid 15679:tid 15697] [client 52.242.199.195:5757] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "ag_jQyh8tgGc38WJ-GzpDAAAANA"]
[Fri May 22 13:01:56.801811 2026] [:error] [pid 58782:tid 58800] [client 52.242.199.195:28988] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "ag_jRIxsdTFafgO8vhTqFQAAARA"]
[Fri May 22 13:01:59.647286 2026] [:error] [pid 15679:tid 15687] [client 52.242.199.195:58268] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/block-bindings/"] [unique_id "ag_jRyh8tgGc38WJ-GzpEQAAAMY"]
[Fri May 22 13:02:01.830845 2026] [:error] [pid 15585:tid 15655] [client 52.242.199.195:28956] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "ag_jSSKb-vB41AF-LC3rwwAAAIg"]
[Fri May 22 13:02:03.141603 2026] [:error] [pid 15585:tid 15648] [client 52.242.199.195:57118] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "ag_jSyKb-vB41AF-LC3rywAAAIE"]
[Fri May 22 13:02:05.391334 2026] [:error] [pid 58813:tid 58831] [client 52.242.199.195:5732] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "ag_jTZ6yyKWDKULhxJ1BPQAAAU8"]
[Fri May 22 13:02:06.273727 2026] [:error] [pid 15583:tid 15599] [client 52.242.199.195:29326] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "ag_jTnnaOncRcIm17YXIIQAAAAs"]
[Fri May 22 13:02:08.374783 2026] [:error] [pid 58813:tid 58832] [client 52.242.199.195:2299] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ag_jUJ6yyKWDKULhxJ1BQQAAAVA"]
[Fri May 22 13:02:09.698957 2026] [:error] [pid 15583:tid 15597] [client 52.242.199.195:3022] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ag_jUXnaOncRcIm17YXIJwAAAAk"]
[Fri May 22 13:02:11.909682 2026] [:error] [pid 15583:tid 15602] [client 52.242.199.195:3035] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ag_jU3naOncRcIm17YXILQAAAA4"]
[Fri May 22 13:02:17.087287 2026] [:error] [pid 15585:tid 15656] [client 52.242.199.195:2240] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ag_jWSKb-vB41AF-LC3r3wAAAIk"]
[Fri May 22 13:02:19.552728 2026] [:error] [pid 15583:tid 15607] [client 52.242.199.195:53990] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ag_jW3naOncRcIm17YXIOAAAABM"]
[Fri May 22 13:02:26.261834 2026] [:error] [pid 15585:tid 15671] [client 52.242.199.195:36938] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/"] [unique_id "ag_jYiKb-vB41AF-LC3r6QAAAJg"]
[Fri May 22 13:02:34.795779 2026] [:error] [pid 58813:tid 58835] [client 52.242.199.195:44664] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/js/crop/"] [unique_id "ag_jap6yyKWDKULhxJ1BZAAAAVM"]
[Fri May 22 13:02:38.687566 2026] [:error] [pid 15679:tid 15694] [client 52.242.199.195:44666] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php"] [unique_id "ag_jbih8tgGc38WJ-GzpPgAAAM0"]
[Fri May 22 13:02:39.178532 2026] [:error] [pid 15583:tid 15596] [client 52.242.199.195:2117] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php"] [unique_id "ag_jb3naOncRcIm17YXIXgAAAAg"]
[Fri May 22 13:02:40.308720 2026] [:error] [pid 58782:tid 58784] [client 52.242.199.195:44655] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php"] [unique_id "ag_jcIxsdTFafgO8vhTqRgAAAQA"]
[Fri May 22 13:02:42.413691 2026] [:error] [pid 15583:tid 15607] [client 52.242.199.195:60449] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-mail.php"] [unique_id "ag_jcnnaOncRcIm17YXIYQAAABM"]
[Fri May 22 13:02:44.019917 2026] [:error] [pid 15585:tid 15664] [client 52.242.199.195:60463] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "ag_jdCKb-vB41AF-LC3sLAAAAJE"]
[Fri May 22 13:02:44.800289 2026] [:error] [pid 58813:tid 58827] [client 52.242.199.195:47407] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "ag_jdJ6yyKWDKULhxJ1BdwAAAUs"]
[Fri May 22 13:02:46.934413 2026] [:error] [pid 58813:tid 58825] [client 52.242.199.195:39754] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "ag_jdp6yyKWDKULhxJ1BewAAAUk"]
[Fri May 22 13:02:48.375866 2026] [:error] [pid 15585:tid 15666] [client 52.242.199.195:47393] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/o.php"] [unique_id "ag_jeCKb-vB41AF-LC3sSQAAAJM"]
[Fri May 22 13:02:49.589313 2026] [:error] [pid 15679:tid 15695] [client 52.242.199.195:39788] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bb.php"] [unique_id "ag_jeSh8tgGc38WJ-GzpTQAAAM4"]
[Fri May 22 13:02:51.738440 2026] [proxy_fcgi:error] [pid 15584:tid 15636] [client 52.242.199.195:62099] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:02:53.022095 2026] [:error] [pid 15584:tid 15627] [client 52.242.199.195:62099] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "ag_jfd9Z_TVLbNEx52jWjAAAAEc"]
[Fri May 22 13:02:54.432190 2026] [proxy_fcgi:error] [pid 15584:tid 15631] [client 52.242.199.195:48274] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:02:55.726273 2026] [proxy_fcgi:error] [pid 15584:tid 15628] [client 52.242.199.195:48274] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:02:56.316871 2026] [:error] [pid 15584:tid 15621] [client 52.242.199.195:48274] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ag_jgN9Z_TVLbNEx52jWlgAAAEE"]
[Fri May 22 13:02:57.510839 2026] [proxy_fcgi:error] [pid 15583:tid 15611] [client 52.242.199.195:62143] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:02:57.912152 2026] [:error] [pid 15583:tid 15597] [client 52.242.199.195:62143] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ag_jgXnaOncRcIm17YXIdgAAAAk"]
[Fri May 22 13:02:59.952940 2026] [:error] [pid 15679:tid 15687] [client 52.242.199.195:48299] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/admin.php"] [unique_id "ag_jgyh8tgGc38WJ-GzpWAAAAMY"]
[Fri May 22 13:03:04.059750 2026] [proxy_fcgi:error] [pid 58813:tid 58838] [client 52.242.199.195:35500] AH01071: Got error 'Primary script unknown'
[Fri May 22 13:03:04.281147 2026] [:error] [pid 58813:tid 58820] [client 52.242.199.195:35500] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ag_jiJ6yyKWDKULhxJ1BjwAAAUQ"]
[Fri May 22 13:03:09.005692 2026] [:error] [pid 15679:tid 15691] [client 52.242.199.195:35492] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ag_jjSh8tgGc38WJ-GzpXwAAAMo"]
[Fri May 22 13:03:12.493523 2026] [:error] [pid 15583:tid 15591] [client 52.242.199.195:29383] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ag_jkHnaOncRcIm17YXIhQAAAAM"]
[Fri May 22 13:03:14.387441 2026] [:error] [pid 15584:tid 15626] [client 52.242.199.195:63126] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ag_jkt9Z_TVLbNEx52jWowAAAEY"]
[Fri May 22 13:03:15.881954 2026] [:error] [pid 15679:tid 15704] [client 52.242.199.195:5482] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "ag_jkyh8tgGc38WJ-GzpbAAAANc"]
[Fri May 22 13:03:17.071413 2026] [:error] [pid 15584:tid 15638] [client 52.242.199.195:35437] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "ag_jld9Z_TVLbNEx52jWqQAAAFI"]
[Fri May 22 13:03:18.536961 2026] [:error] [pid 15679:tid 15685] [client 52.242.199.195:42143] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "ag_jlih8tgGc38WJ-GzpbgAAAMQ"]
[Fri May 22 13:03:20.567666 2026] [:error] [pid 15585:tid 15662] [client 52.242.199.195:31467] [client 52.242.199.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/byp.php"] [unique_id "ag_jmCKb-vB41AF-LC3shQAAAI8"]
[Fri May 22 14:14:37.573982 2026] [:error] [pid 15583:tid 15606] [client 49.235.136.28:58834] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ag_0TXnaOncRcIm17YXWjQAAABI"]
[Fri May 22 14:38:50.854368 2026] [:error] [pid 15679:tid 15681] [client 45.131.195.10:36753] [client 45.131.195.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/wp-includes/css/buttons.css"] [unique_id "ag_5-ih8tgGc38WJ-GwGqAAAAMA"]
[Fri May 22 17:07:48.698585 2026] [:error] [pid 15583:tid 15606] [client 161.118.202.128:56340] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "ahAc5HnaOncRcIm17YX0wAAAABI"]
[Fri May 22 17:07:48.896172 2026] [:error] [pid 15583:tid 15612] [client 161.118.202.128:56456] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file-manager/initialize"] [unique_id "ahAc5HnaOncRcIm17YX0wQAAABg"]
[Fri May 22 17:11:07.716956 2026] [:error] [pid 15585:tid 15663] [client 34.93.63.75:58971] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahAdqyKb-vB41AF-LC1JFQAAAJA"]
[Fri May 22 17:11:08.013008 2026] [:error] [pid 15584:tid 15633] [client 34.93.63.75:60245] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrN9Z_TVLbNEx52gL0AAAAE0"]
[Fri May 22 17:11:08.304044 2026] [:error] [pid 15584:tid 15639] [client 34.93.63.75:61741] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/feed/"] [unique_id "ahAdrN9Z_TVLbNEx52gL_gAAAFM"]
[Fri May 22 19:09:51.141711 2026] [:error] [pid 58813:tid 58834] [client 43.156.250.82:48722] [client 43.156.250.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahA5f56yyKWDKULhxJ17SwAAAVI"]
[Fri May 22 19:55:41.186846 2026] [:error] [pid 15679:tid 15686] [client 43.167.245.18:34646] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahBEPSh8tgGc38WJ-GxUsAAAAMU"]
[Fri May 22 20:47:16.482362 2026] [:error] [pid 15679:tid 15682] [client 117.173.181.155:14182] [client 117.173.181.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahBQVCh8tgGc38WJ-GxgzgAAAME"], referer: http://www.switchcreative.net/
[Sat May 23 00:39:39.268535 2026] [:error] [pid 15584:tid 15622] [client 43.157.20.63:34744] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahCGy99Z_TVLbNEx52hcSAAAAEI"]
[Sat May 23 01:41:29.445599 2026] [:error] [pid 58782:tid 58792] [client 195.201.199.99:52514] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahCVSYxsdTFafgO8vhRQMwAAAQg"]
[Sat May 23 01:41:33.980435 2026] [:error] [pid 15583:tid 15608] [client 195.201.199.99:56016] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahCVTXnaOncRcIm17YV2GAAAABQ"]
[Sat May 23 01:41:36.314149 2026] [:error] [pid 15585:tid 15649] [client 195.201.199.99:56742] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahCVUCKb-vB41AF-LC3MywAAAII"]
[Sat May 23 01:41:39.606116 2026] [:error] [pid 15583:tid 15591] [client 195.201.199.99:55604] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahCVU3naOncRcIm17YV2KQAAAAM"]
[Sat May 23 01:41:41.990923 2026] [:error] [pid 15585:tid 15660] [client 195.201.199.99:58450] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ahCVVSKb-vB41AF-LC3M0QAAAI0"]
[Sat May 23 01:41:44.307367 2026] [:error] [pid 15585:tid 15657] [client 195.201.199.99:59124] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ahCVWCKb-vB41AF-LC3M1AAAAIo"]
[Sat May 23 01:41:46.887020 2026] [:error] [pid 15585:tid 15653] [client 195.201.199.99:59828] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ahCVWiKb-vB41AF-LC3M2gAAAIY"]
[Sat May 23 01:41:49.673910 2026] [:error] [pid 15679:tid 15692] [client 195.201.199.99:60584] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahCVXSh8tgGc38WJ-GytjAAAAMs"]
[Sat May 23 01:41:52.275604 2026] [:error] [pid 15679:tid 15697] [client 195.201.199.99:33044] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ahCVYCh8tgGc38WJ-GytjwAAANA"]
[Sat May 23 01:41:54.903397 2026] [:error] [pid 15583:tid 15609] [client 195.201.199.99:33728] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahCVYnnaOncRcIm17YV2QAAAABU"]
[Sat May 23 01:41:57.224283 2026] [:error] [pid 15585:tid 15648] [client 195.201.199.99:34306] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahCVZSKb-vB41AF-LC3M6gAAAIE"]
[Sat May 23 01:41:59.717795 2026] [:error] [pid 15679:tid 15683] [client 195.201.199.99:34962] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahCVZyh8tgGc38WJ-GytlQAAAMI"]
[Sat May 23 01:42:02.417177 2026] [:error] [pid 58813:tid 58838] [client 195.201.199.99:35654] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahCVap6yyKWDKULhxJ22hAAAAVY"]
[Sat May 23 01:42:04.705670 2026] [:error] [pid 15679:tid 15703] [client 195.201.199.99:36340] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahCVbCh8tgGc38WJ-GytoQAAANY"]
[Sat May 23 01:42:07.823200 2026] [:error] [pid 15583:tid 15593] [client 195.201.199.99:35024] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahCVb3naOncRcIm17YV2VAAAAAU"]
[Sat May 23 01:42:10.486861 2026] [:error] [pid 15679:tid 15698] [client 195.201.199.99:37898] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahCVcih8tgGc38WJ-GytpQAAANE"]
[Sat May 23 01:42:13.036963 2026] [:error] [pid 15583:tid 15610] [client 195.201.199.99:38628] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahCVdXnaOncRcIm17YV2YQAAABY"]
[Sat May 23 01:42:15.530148 2026] [:error] [pid 15679:tid 15699] [client 195.201.199.99:39234] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahCVdyh8tgGc38WJ-GytsAAAANI"]
[Sat May 23 01:42:18.105279 2026] [:error] [pid 58782:tid 58808] [client 195.201.199.99:39886] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahCVeoxsdTFafgO8vhRQUwAAARg"]
[Sat May 23 01:42:20.484280 2026] [:error] [pid 58813:tid 58816] [client 195.201.199.99:40464] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahCVfJ6yyKWDKULhxJ22jgAAAUA"]
[Sat May 23 01:42:23.085219 2026] [:error] [pid 15583:tid 15600] [client 195.201.199.99:41078] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahCVf3naOncRcIm17YV2awAAAAw"]
[Sat May 23 01:42:25.766841 2026] [:error] [pid 15679:tid 15704] [client 195.201.199.99:41734] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahCVgSh8tgGc38WJ-GytzwAAANc"]
[Sat May 23 01:42:54.613122 2026] [:error] [pid 58782:tid 58798] [client 195.201.199.99:47608] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahCVnoxsdTFafgO8vhRQggAAAQ4"]
[Sat May 23 01:42:56.843718 2026] [:error] [pid 15679:tid 15681] [client 195.201.199.99:50248] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahCVoCh8tgGc38WJ-GyuBgAAAMA"]
[Sat May 23 01:42:59.700384 2026] [:error] [pid 15583:tid 15590] [client 195.201.199.99:51038] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahCVo3naOncRcIm17YV2mQAAAAI"]
[Sat May 23 01:43:02.261219 2026] [:error] [pid 15679:tid 15690] [client 195.201.199.99:49638] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahCVpih8tgGc38WJ-GyuEAAAAMk"]
[Sat May 23 01:43:04.584942 2026] [:error] [pid 15679:tid 15688] [client 195.201.199.99:52332] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahCVqCh8tgGc38WJ-GyuFAAAAMc"]
[Sat May 23 01:43:06.749181 2026] [:error] [pid 15585:tid 15661] [client 195.201.199.99:52924] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahCVqiKb-vB41AF-LC3NMAAAAI4"]
[Sat May 23 01:43:08.917944 2026] [:error] [pid 15584:tid 15628] [client 195.201.199.99:53724] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahCVrN9Z_TVLbNEx52hnTwAAAEg"]
[Sat May 23 01:43:11.121389 2026] [:error] [pid 15583:tid 15602] [client 195.201.199.99:54404] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ahCVr3naOncRcIm17YV2pwAAAA4"]
[Sat May 23 01:43:13.373779 2026] [:error] [pid 15679:tid 15702] [client 195.201.199.99:55164] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahCVsSh8tgGc38WJ-GyuHAAAANU"]
[Sat May 23 01:43:19.034971 2026] [:error] [pid 15583:tid 15601] [client 195.201.199.99:56924] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahCVt3naOncRcIm17YV2uwAAAA0"]
[Sat May 23 01:43:22.945868 2026] [:error] [pid 15679:tid 15697] [client 195.201.199.99:57988] [client 195.201.199.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahCVuih8tgGc38WJ-GyuRwAAANA"]
[Sat May 23 02:58:16.446865 2026] [:error] [pid 15679:tid 15705] [client 116.240.149.7:64593] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahCnSCh8tgGc38WJ-GzG2gAAANg"]
[Sat May 23 02:58:17.993583 2026] [:error] [pid 58813:tid 58824] [client 116.240.149.7:59837] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahCnSZ6yyKWDKULhxJ3EIQAAAUg"]
[Sat May 23 02:58:19.592840 2026] [:error] [pid 15584:tid 15643] [client 116.240.149.7:65023] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahCnS99Z_TVLbNEx52h2AwAAAFc"]
[Sat May 23 02:58:21.398018 2026] [:error] [pid 58813:tid 58831] [client 116.240.149.7:61802] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahCnTZ6yyKWDKULhxJ3EIwAAAU8"]
[Sat May 23 02:58:22.944829 2026] [:error] [pid 15583:tid 15591] [client 116.240.149.7:63976] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahCnTnnaOncRcIm17YWYIgAAAAM"]
[Sat May 23 02:58:24.497642 2026] [:error] [pid 58813:tid 58830] [client 116.240.149.7:60285] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahCnUJ6yyKWDKULhxJ3EJwAAAU4"]
[Sat May 23 02:58:26.382318 2026] [:error] [pid 15584:tid 15624] [client 116.240.149.7:63737] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahCnUt9Z_TVLbNEx52h2BgAAAEQ"]
[Sat May 23 02:58:27.923361 2026] [:error] [pid 15585:tid 15664] [client 116.240.149.7:60043] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahCnUyKb-vB41AF-LC3eLwAAAJE"]
[Sat May 23 02:58:29.480043 2026] [:error] [pid 15584:tid 15629] [client 116.240.149.7:61985] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahCnVd9Z_TVLbNEx52h2CQAAAEk"]
[Sat May 23 02:58:31.130181 2026] [:error] [pid 15679:tid 15705] [client 116.240.149.7:61708] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahCnVyh8tgGc38WJ-GzG8gAAANg"]
[Sat May 23 02:58:32.733787 2026] [:error] [pid 15583:tid 15594] [client 116.240.149.7:64885] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahCnWHnaOncRcIm17YWYNwAAAAY"]
[Sat May 23 02:58:34.396232 2026] [:error] [pid 15584:tid 15637] [client 116.240.149.7:62760] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ahCnWt9Z_TVLbNEx52h2CwAAAFE"]
[Sat May 23 02:58:35.892794 2026] [:error] [pid 15679:tid 15696] [client 116.240.149.7:59146] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahCnWyh8tgGc38WJ-GzHAwAAAM8"]
[Sat May 23 02:58:37.486774 2026] [:error] [pid 15679:tid 15684] [client 116.240.149.7:63218] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahCnXSh8tgGc38WJ-GzHEAAAAMM"]
[Sat May 23 02:58:39.024158 2026] [:error] [pid 15679:tid 15684] [client 116.240.149.7:62075] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahCnXyh8tgGc38WJ-GzHGgAAAMM"]
[Sat May 23 02:58:40.424076 2026] [:error] [pid 15583:tid 15590] [client 116.240.149.7:61426] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahCnYHnaOncRcIm17YWYYgAAAAI"]
[Sat May 23 02:58:42.043784 2026] [:error] [pid 15583:tid 15604] [client 116.240.149.7:62784] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahCnYnnaOncRcIm17YWYbgAAABA"]
[Sat May 23 02:58:43.507583 2026] [:error] [pid 15584:tid 15620] [client 116.240.149.7:62735] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ahCnY99Z_TVLbNEx52h2FgAAAEA"]
[Sat May 23 02:58:44.983268 2026] [:error] [pid 15584:tid 15630] [client 116.240.149.7:59720] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahCnZN9Z_TVLbNEx52h2GAAAAEo"]
[Sat May 23 02:58:46.620718 2026] [:error] [pid 15583:tid 15600] [client 116.240.149.7:60281] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahCnZnnaOncRcIm17YWYgAAAAAw"]
[Sat May 23 02:58:48.129000 2026] [:error] [pid 15583:tid 15601] [client 116.240.149.7:62462] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ahCnaHnaOncRcIm17YWYiQAAAA0"]
[Sat May 23 02:58:49.661553 2026] [:error] [pid 15583:tid 15590] [client 116.240.149.7:62435] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahCnaXnaOncRcIm17YWYjgAAAAI"]
[Sat May 23 02:58:51.263690 2026] [:error] [pid 15583:tid 15610] [client 116.240.149.7:59493] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahCna3naOncRcIm17YWYkAAAABY"]
[Sat May 23 02:58:52.769321 2026] [:error] [pid 58813:tid 58830] [client 116.240.149.7:64654] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahCnbJ6yyKWDKULhxJ3EPAAAAU4"]
[Sat May 23 02:58:54.265188 2026] [:error] [pid 58813:tid 58833] [client 116.240.149.7:61537] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahCnbp6yyKWDKULhxJ3EPgAAAVE"]
[Sat May 23 02:58:55.695658 2026] [:error] [pid 15584:tid 15631] [client 116.240.149.7:61409] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ahCnb99Z_TVLbNEx52h2GgAAAEs"]
[Sat May 23 02:58:57.202198 2026] [:error] [pid 15584:tid 15625] [client 116.240.149.7:62541] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahCncd9Z_TVLbNEx52h2HAAAAEU"]
[Sat May 23 02:58:58.821362 2026] [:error] [pid 58813:tid 58828] [client 116.240.149.7:63671] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ahCncp6yyKWDKULhxJ3ESgAAAUw"]
[Sat May 23 02:59:00.365500 2026] [:error] [pid 58782:tid 58805] [client 116.240.149.7:64380] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahCndIxsdTFafgO8vhRcgwAAARU"]
[Sat May 23 02:59:01.874701 2026] [:error] [pid 15585:tid 15658] [client 116.240.149.7:60617] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahCndSKb-vB41AF-LC3eYQAAAIs"]
[Sat May 23 02:59:03.548853 2026] [:error] [pid 15583:tid 15610] [client 116.240.149.7:59898] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahCnd3naOncRcIm17YWYmAAAABY"]
[Sat May 23 02:59:05.114159 2026] [:error] [pid 15585:tid 15654] [client 116.240.149.7:62453] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahCneSKb-vB41AF-LC3ebQAAAIc"]
[Sat May 23 02:59:06.721200 2026] [:error] [pid 15679:tid 15688] [client 116.240.149.7:60955] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahCneih8tgGc38WJ-GzHMAAAAMc"]
[Sat May 23 02:59:07.578079 2026] [:error] [pid 15679:tid 15689] [client 116.240.149.7:64248] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahCneyh8tgGc38WJ-GzHMgAAAMg"]
[Sat May 23 02:59:10.990833 2026] [:error] [pid 15583:tid 15599] [client 116.240.149.7:63092] [client 116.240.149.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahCnfnnaOncRcIm17YWYpQAAAAs"]
[Sat May 23 04:12:03.307929 2026] [:error] [pid 30940:tid 30969] [client 147.135.252.145:35248] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahC4k5qUP2XZmzp7RDpjpAAAABQ"]
[Sat May 23 04:12:05.831839 2026] [:error] [pid 31039:tid 31044] [client 147.135.252.145:40116] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahC4laIYDYo8WvA5zLIwWgAAAMM"]
[Sat May 23 04:12:07.817974 2026] [:error] [pid 30941:tid 30996] [client 147.135.252.145:36408] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahC4l3TIgjSDhiZmvlUCLgAAAFQ"]
[Sat May 23 04:12:09.718382 2026] [:error] [pid 31039:tid 31047] [client 147.135.252.145:36414] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahC4maIYDYo8WvA5zLIwfwAAAMY"]
[Sat May 23 04:12:11.618821 2026] [:error] [pid 30942:tid 31010] [client 147.135.252.145:43778] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahC4m9Uosz64YFiBlG2ZHwAAAIc"]
[Sat May 23 04:12:13.517010 2026] [:error] [pid 31039:tid 31041] [client 147.135.252.145:43794] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahC4naIYDYo8WvA5zLIwlwAAAMA"]
[Sat May 23 04:12:15.436670 2026] [:error] [pid 31039:tid 31041] [client 147.135.252.145:43800] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahC4n6IYDYo8WvA5zLIwogAAAMA"]
[Sat May 23 04:12:17.991493 2026] [:error] [pid 30941:tid 30983] [client 147.135.252.145:48012] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahC4oXTIgjSDhiZmvlUCQAAAAEc"]
[Sat May 23 04:12:20.083389 2026] [:error] [pid 30942:tid 31012] [client 147.135.252.145:43810] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahC4pNUosz64YFiBlG2ZKAAAAIk"]
[Sat May 23 04:12:21.977458 2026] [:error] [pid 30942:tid 31006] [client 147.135.252.145:56794] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahC4pdUosz64YFiBlG2ZMwAAAIM"]
[Sat May 23 04:12:24.027071 2026] [:error] [pid 30942:tid 31014] [client 147.135.252.145:56808] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahC4qNUosz64YFiBlG2ZNAAAAIs"]
[Sat May 23 04:12:26.134742 2026] [:error] [pid 30940:tid 30971] [client 147.135.252.145:56818] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahC4qpqUP2XZmzp7RDpjugAAABY"]
[Sat May 23 04:12:28.019967 2026] [:error] [pid 30941:tid 30984] [client 147.135.252.145:56830] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahC4rHTIgjSDhiZmvlUCRwAAAEg"]
[Sat May 23 04:12:30.009678 2026] [:error] [pid 31039:tid 31050] [client 147.135.252.145:56840] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahC4rqIYDYo8WvA5zLIwtgAAAMk"]
[Sat May 23 04:12:32.460416 2026] [:error] [pid 30942:tid 31010] [client 147.135.252.145:41532] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahC4sNUosz64YFiBlG2ZNQAAAIc"]
[Sat May 23 04:12:34.924935 2026] [:error] [pid 31039:tid 31057] [client 147.135.252.145:33852] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahC4sqIYDYo8WvA5zLIwvgAAANA"]
[Sat May 23 04:12:38.716979 2026] [:error] [pid 30941:tid 30981] [client 147.135.252.145:33856] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahC4tnTIgjSDhiZmvlUCSQAAAEU"]
[Sat May 23 05:12:02.966412 2026] [:error] [pid 31039:tid 31044] [client 62.84.185.67:23480] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahDGoqIYDYo8WvA5zLJMPAAAAMM"]
[Sat May 23 05:12:05.696534 2026] [:error] [pid 30940:tid 30965] [client 62.84.185.67:48630] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahDGpZqUP2XZmzp7RDpwpAAAABA"]
[Sat May 23 05:12:09.495427 2026] [:error] [pid 30940:tid 30958] [client 62.84.185.67:11838] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahDGqZqUP2XZmzp7RDpwrQAAAAk"]
[Sat May 23 05:12:13.297294 2026] [:error] [pid 31039:tid 31062] [client 62.84.185.67:63362] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahDGraIYDYo8WvA5zLJMTwAAANU"]
[Sat May 23 05:12:17.689808 2026] [:error] [pid 31039:tid 31045] [client 62.84.185.67:51692] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahDGsaIYDYo8WvA5zLJMVwAAAMQ"]
[Sat May 23 05:12:21.384325 2026] [:error] [pid 30942:tid 31018] [client 62.84.185.67:42772] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahDGtdUosz64YFiBlG2uBQAAAI8"]
[Sat May 23 05:12:24.382756 2026] [:error] [pid 31039:tid 31050] [client 62.84.185.67:51698] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahDGuKIYDYo8WvA5zLJMawAAAMk"]
[Sat May 23 05:12:28.004263 2026] [:error] [pid 30941:tid 30989] [client 62.84.185.67:11728] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahDGvHTIgjSDhiZmvlUU2AAAAE0"]
[Sat May 23 05:12:30.573328 2026] [:error] [pid 30940:tid 30971] [client 62.84.185.67:26164] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahDGvpqUP2XZmzp7RDpwvAAAABY"]
[Sat May 23 05:12:32.996665 2026] [:error] [pid 31039:tid 31043] [client 62.84.185.67:26178] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahDGwKIYDYo8WvA5zLJMfAAAAMI"]
[Sat May 23 05:12:36.985954 2026] [:error] [pid 31039:tid 31054] [client 62.84.185.67:10328] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahDGxKIYDYo8WvA5zLJMgwAAAM0"]
[Sat May 23 05:12:40.382985 2026] [:error] [pid 31039:tid 31055] [client 62.84.185.67:10340] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahDGyKIYDYo8WvA5zLJMigAAAM4"]
[Sat May 23 05:12:43.393528 2026] [:error] [pid 31039:tid 31052] [client 62.84.185.67:10354] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahDGy6IYDYo8WvA5zLJMjgAAAMs"]
[Sat May 23 05:12:46.107510 2026] [:error] [pid 31039:tid 31056] [client 62.84.185.67:2566] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahDGzqIYDYo8WvA5zLJMkwAAAM8"]
[Sat May 23 05:12:49.992753 2026] [:error] [pid 30942:tid 31014] [client 62.84.185.67:12124] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahDG0dUosz64YFiBlG2uMgAAAIs"]
[Sat May 23 05:12:53.383331 2026] [:error] [pid 30940:tid 30953] [client 62.84.185.67:2568] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDG1ZqUP2XZmzp7RDpwzgAAAAQ"]
[Sat May 23 05:12:57.802643 2026] [:error] [pid 31039:tid 31049] [client 62.84.185.67:21522] [client 62.84.185.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDG2aIYDYo8WvA5zLJMtwAAAMg"]
[Sat May 23 05:55:58.271741 2026] [:error] [pid 30940:tid 30951] [client 75.119.155.172:19836] [client 75.119.155.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahDQ7pqUP2XZmzp7RDp3tgAAAAI"]
[Sat May 23 05:56:00.660766 2026] [:error] [pid 30940:tid 30952] [client 75.119.155.172:20770] [client 75.119.155.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDQ8JqUP2XZmzp7RDp3vgAAAAM"]
[Sat May 23 05:56:04.475443 2026] [:error] [pid 30942:tid 31019] [client 75.119.155.172:20772] [client 75.119.155.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDQ9NUosz64YFiBlG24igAAAJA"]
[Sat May 23 06:04:09.578533 2026] [:error] [pid 25876:tid 25888] [client 151.196.18.82:61628] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahDS2QSpWUCKPezIBJB39QAAAQo"]
[Sat May 23 06:04:09.989864 2026] [:error] [pid 31039:tid 31058] [client 151.196.18.82:61837] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahDS2aIYDYo8WvA5zLJdMAAAANE"]
[Sat May 23 06:04:10.412609 2026] [:error] [pid 31039:tid 31060] [client 151.196.18.82:61845] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahDS2qIYDYo8WvA5zLJdMgAAANM"]
[Sat May 23 06:04:12.371486 2026] [:error] [pid 25876:tid 25892] [client 151.196.18.82:61862] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahDS3ASpWUCKPezIBJB3-QAAAQ4"]
[Sat May 23 06:04:12.793271 2026] [:error] [pid 25876:tid 25899] [client 151.196.18.82:61866] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahDS3ASpWUCKPezIBJB3-gAAARU"]
[Sat May 23 06:04:14.960363 2026] [:error] [pid 25876:tid 25901] [client 151.196.18.82:61894] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahDS3gSpWUCKPezIBJB3_wAAARc"]
[Sat May 23 06:04:15.385545 2026] [:error] [pid 25876:tid 25887] [client 151.196.18.82:61901] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahDS3wSpWUCKPezIBJB4AAAAAQk"]
[Sat May 23 06:04:17.570629 2026] [:error] [pid 30942:tid 31017] [client 151.196.18.82:61924] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahDS4dUosz64YFiBlG26OAAAAI4"]
[Sat May 23 06:04:17.985759 2026] [:error] [pid 31039:tid 31054] [client 151.196.18.82:61934] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahDS4aIYDYo8WvA5zLJdOQAAAM0"]
[Sat May 23 06:04:20.393201 2026] [:error] [pid 25876:tid 25901] [client 151.196.18.82:61956] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahDS5ASpWUCKPezIBJB4DAAAARc"]
[Sat May 23 06:04:20.809161 2026] [:error] [pid 30942:tid 31011] [client 151.196.18.82:61962] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahDS5NUosz64YFiBlG26PAAAAIg"]
[Sat May 23 06:04:22.810475 2026] [:error] [pid 31039:tid 31051] [client 151.196.18.82:61990] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ahDS5qIYDYo8WvA5zLJdOwAAAMo"]
[Sat May 23 06:04:23.220542 2026] [:error] [pid 31039:tid 31063] [client 151.196.18.82:61994] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ahDS56IYDYo8WvA5zLJdPQAAANY"]
[Sat May 23 06:04:25.250116 2026] [:error] [pid 31039:tid 31054] [client 151.196.18.82:62018] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahDS6aIYDYo8WvA5zLJdRAAAAM0"]
[Sat May 23 06:04:25.662700 2026] [:error] [pid 25876:tid 25883] [client 151.196.18.82:62033] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahDS6QSpWUCKPezIBJB4DgAAAQU"]
[Sat May 23 06:04:27.563861 2026] [:error] [pid 31039:tid 31049] [client 151.196.18.82:62058] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahDS66IYDYo8WvA5zLJdSAAAAMg"]
[Sat May 23 06:04:27.987013 2026] [:error] [pid 31039:tid 31042] [client 151.196.18.82:62065] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahDS66IYDYo8WvA5zLJdSwAAAME"]
[Sat May 23 06:04:29.878432 2026] [:error] [pid 31039:tid 31065] [client 151.196.18.82:62099] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahDS7aIYDYo8WvA5zLJdUAAAANg"]
[Sat May 23 06:04:30.292104 2026] [:error] [pid 31039:tid 31043] [client 151.196.18.82:62106] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahDS7qIYDYo8WvA5zLJdUgAAAMI"]
[Sat May 23 06:04:32.380752 2026] [:error] [pid 31039:tid 31047] [client 151.196.18.82:62128] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahDS8KIYDYo8WvA5zLJdXQAAAMY"]
[Sat May 23 06:04:32.801859 2026] [:error] [pid 31039:tid 31063] [client 151.196.18.82:62136] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahDS8KIYDYo8WvA5zLJdXgAAANY"]
[Sat May 23 06:04:34.945145 2026] [:error] [pid 30941:tid 30982] [client 151.196.18.82:62155] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahDS8nTIgjSDhiZmvlUeuAAAAEY"]
[Sat May 23 06:04:35.356972 2026] [:error] [pid 31039:tid 31062] [client 151.196.18.82:62159] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahDS86IYDYo8WvA5zLJdYwAAANU"]
[Sat May 23 06:04:37.375527 2026] [:error] [pid 30941:tid 30979] [client 151.196.18.82:62175] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahDS9XTIgjSDhiZmvlUeuQAAAEM"]
[Sat May 23 06:04:37.794177 2026] [:error] [pid 31039:tid 31054] [client 151.196.18.82:62183] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahDS9aIYDYo8WvA5zLJdaQAAAM0"]
[Sat May 23 06:04:39.793481 2026] [:error] [pid 30942:tid 31006] [client 151.196.18.82:62204] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahDS99Uosz64YFiBlG26SAAAAIM"]
[Sat May 23 06:04:40.208744 2026] [:error] [pid 30941:tid 30987] [client 151.196.18.82:62209] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahDS-HTIgjSDhiZmvlUevAAAAEs"]
[Sat May 23 06:04:42.163624 2026] [:error] [pid 31039:tid 31051] [client 151.196.18.82:62226] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahDS-qIYDYo8WvA5zLJdcgAAAMo"]
[Sat May 23 06:04:42.576692 2026] [:error] [pid 31039:tid 31055] [client 151.196.18.82:62231] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahDS-qIYDYo8WvA5zLJdcwAAAM4"]
[Sat May 23 06:04:44.568278 2026] [:error] [pid 25876:tid 25884] [client 151.196.18.82:62250] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahDS_ASpWUCKPezIBJB4IQAAAQY"]
[Sat May 23 06:04:44.984306 2026] [:error] [pid 25876:tid 25896] [client 151.196.18.82:62254] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahDS_ASpWUCKPezIBJB4IgAAARI"]
[Sat May 23 06:04:46.953593 2026] [:error] [pid 25876:tid 25895] [client 151.196.18.82:62273] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahDS_gSpWUCKPezIBJB4KQAAARE"]
[Sat May 23 06:04:47.370487 2026] [:error] [pid 25876:tid 25897] [client 151.196.18.82:62278] [client 151.196.18.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahDS_wSpWUCKPezIBJB4KwAAARM"]
[Sat May 23 06:44:06.528008 2026] [:error] [pid 30941:tid 30985] [client 147.135.214.95:55136] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahDcNnTIgjSDhiZmvlUmVwAAAEk"]
[Sat May 23 06:44:09.092051 2026] [:error] [pid 30940:tid 30964] [client 147.135.214.95:51768] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahDcOZqUP2XZmzp7RDp_8wAAAA8"]
[Sat May 23 06:44:11.487174 2026] [:error] [pid 30941:tid 30998] [client 147.135.214.95:56448] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahDcO3TIgjSDhiZmvlUmWgAAAFY"]
[Sat May 23 06:44:13.841080 2026] [:error] [pid 25876:tid 25902] [client 147.135.214.95:56460] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahDcPQSpWUCKPezIBJCGYwAAARg"]
[Sat May 23 06:44:16.423390 2026] [:error] [pid 30941:tid 30985] [client 147.135.214.95:56466] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahDcQHTIgjSDhiZmvlUmawAAAEk"]
[Sat May 23 06:44:19.041517 2026] [:error] [pid 25876:tid 25881] [client 147.135.214.95:56476] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahDcQwSpWUCKPezIBJCGaAAAAQM"]
[Sat May 23 06:44:21.585313 2026] [:error] [pid 30942:tid 31020] [client 147.135.214.95:40842] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahDcRdUosz64YFiBlG3DBQAAAJE"]
[Sat May 23 06:44:24.101558 2026] [:error] [pid 25876:tid 25902] [client 147.135.214.95:40848] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahDcSASpWUCKPezIBJCGcwAAARg"]
[Sat May 23 06:44:26.450713 2026] [:error] [pid 25876:tid 25890] [client 147.135.214.95:40862] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahDcSgSpWUCKPezIBJCGfQAAAQw"]
[Sat May 23 06:44:28.954731 2026] [:error] [pid 31039:tid 31058] [client 147.135.214.95:40872] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahDcTKIYDYo8WvA5zLJpxAAAANE"]
[Sat May 23 06:44:31.352052 2026] [:error] [pid 30942:tid 31021] [client 147.135.214.95:46630] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahDcT9Uosz64YFiBlG3DFwAAAJI"]
[Sat May 23 06:44:33.694886 2026] [:error] [pid 31039:tid 31050] [client 147.135.214.95:46636] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahDcUaIYDYo8WvA5zLJpzgAAAMk"]
[Sat May 23 06:44:35.940637 2026] [:error] [pid 30940:tid 30965] [client 147.135.214.95:33728] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDcU5qUP2XZmzp7RDqACAAAABA"]
[Sat May 23 06:44:39.791452 2026] [:error] [pid 25876:tid 25897] [client 147.135.214.95:33734] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDcVwSpWUCKPezIBJCGiQAAARM"]
[Sat May 23 06:46:00.468511 2026] [:error] [pid 31039:tid 31049] [client 147.135.214.95:50782] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahDcqKIYDYo8WvA5zLJqUAAAAMg"]
[Sat May 23 06:46:02.991014 2026] [:error] [pid 31039:tid 31060] [client 147.135.214.95:49214] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahDcqqIYDYo8WvA5zLJqWAAAANM"]
[Sat May 23 06:46:05.508906 2026] [:error] [pid 25876:tid 25878] [client 147.135.214.95:49226] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahDcrQSpWUCKPezIBJCHDgAAAQA"]
[Sat May 23 06:46:07.875362 2026] [:error] [pid 30940:tid 30971] [client 147.135.214.95:49234] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahDcr5qUP2XZmzp7RDqATAAAABY"]
[Sat May 23 06:46:10.245425 2026] [:error] [pid 25876:tid 25884] [client 147.135.214.95:49246] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahDcsgSpWUCKPezIBJCHEgAAAQY"]
[Sat May 23 06:46:12.734438 2026] [:error] [pid 25876:tid 25882] [client 147.135.214.95:35460] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahDctASpWUCKPezIBJCHIAAAAQQ"]
[Sat May 23 06:46:15.181802 2026] [:error] [pid 25876:tid 25899] [client 147.135.214.95:35470] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahDctwSpWUCKPezIBJCHTAAAARU"]
[Sat May 23 06:46:17.691146 2026] [:error] [pid 25876:tid 25898] [client 147.135.214.95:35482] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahDcuQSpWUCKPezIBJCHYQAAARQ"]
[Sat May 23 06:46:20.022658 2026] [:error] [pid 30941:tid 30993] [client 147.135.214.95:35498] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahDcvHTIgjSDhiZmvlUm8wAAAFE"]
[Sat May 23 06:46:22.493862 2026] [:error] [pid 30941:tid 30988] [client 147.135.214.95:54268] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahDcvnTIgjSDhiZmvlUm9wAAAEw"]
[Sat May 23 06:46:24.958768 2026] [:error] [pid 31039:tid 31055] [client 147.135.214.95:54280] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahDcwKIYDYo8WvA5zLJqXgAAAM4"]
[Sat May 23 06:46:27.295868 2026] [:error] [pid 25876:tid 25890] [client 147.135.214.95:54282] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahDcwwSpWUCKPezIBJCHdgAAAQw"]
[Sat May 23 06:46:28.698202 2026] [:error] [pid 31039:tid 31047] [client 147.135.214.95:57852] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDcxKIYDYo8WvA5zLJqaAAAAMY"]
[Sat May 23 06:46:32.439751 2026] [:error] [pid 25876:tid 25880] [client 147.135.214.95:37966] [client 147.135.214.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahDcyASpWUCKPezIBJCHhgAAAQI"]
[Sat May 23 10:52:39.413100 2026] [:error] [pid 25876:tid 25884] [client 43.155.27.244:51166] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahEWdwSpWUCKPezIBJDqHAAAAQY"]
[Sat May 23 11:28:17.877388 2026] [:error] [pid 31039:tid 31050] [client 172.212.190.121:18081] [client 172.212.190.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahEe0aIYDYo8WvA5zLK45wAAAMk"]
[Sat May 23 11:28:19.390379 2026] [:error] [pid 31039:tid 31062] [client 172.212.190.121:25716] [client 172.212.190.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahEe06IYDYo8WvA5zLK47QAAANU"]
[Sat May 23 11:28:20.277232 2026] [:error] [pid 31039:tid 31064] [client 172.212.190.121:26895] [client 172.212.190.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahEe1KIYDYo8WvA5zLK48gAAANc"]
[Sat May 23 11:28:21.923125 2026] [:error] [pid 31039:tid 31057] [client 172.212.190.121:18103] [client 172.212.190.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ahEe1aIYDYo8WvA5zLK4-wAAANA"]
[Sat May 23 12:04:38.147109 2026] [:error] [pid 30940:tid 30955] [client 170.106.193.108:48520] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahEnVpqUP2XZmzp7RDq3vgAAAAY"]
[Sat May 23 13:38:53.825049 2026] [:error] [pid 25876:tid 25895] [client 192.144.148.122:44824] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahE9bQSpWUCKPezIBJArkQAAARE"]
[Sat May 23 16:26:44.981142 2026] [:error] [pid 25876:tid 25883] [client 89.19.35.171:29033] [client 89.19.35.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.19.35.171, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ahFkxASpWUCKPezIBJB-pAAAAQU"]
[Sat May 23 16:26:44.990373 2026] [proxy_fcgi:error] [pid 25876:tid 25883] [client 89.19.35.171:29033] AH01071: Got error 'Primary script unknown'
[Sat May 23 17:46:22.540426 2026] [:error] [pid 30942:tid 31023] [client 49.51.132.100:59972] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahF3btUosz64YFiBlG1iaAAAAJQ"]
[Sat May 23 19:57:10.076150 2026] [:error] [pid 25876:tid 25887] [client 77.83.25.104:12819] [client 77.83.25.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.83.25.104, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ahGWFgSpWUCKPezIBJColAAAAQk"]
[Sat May 23 19:57:10.085018 2026] [proxy_fcgi:error] [pid 25876:tid 25887] [client 77.83.25.104:12819] AH01071: Got error 'Primary script unknown'
[Sat May 23 20:00:44.370322 2026] [:error] [pid 44326:tid 44369] [client 42.234.198.60:4753] [client 42.234.198.60] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahGW7MyrPrcAqE-FOKKU8wAAAc4"], referer: http://www.switchcreative.net/
[Sat May 23 20:26:59.383362 2026] [:error] [pid 30941:tid 30981] [client 135.181.213.219:56396] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahGdE3TIgjSDhiZmvlXllwAAAEU"]
[Sat May 23 20:27:01.387202 2026] [:error] [pid 44326:tid 44355] [client 135.181.213.219:53486] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahGdFcyrPrcAqE-FOKKZ5AAAAcA"]
[Sat May 23 20:27:03.500167 2026] [:error] [pid 44325:tid 44342] [client 135.181.213.219:53494] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahGdF1gUQb4puB_2yV8g4QAAAY4"]
[Sat May 23 20:27:05.492961 2026] [:error] [pid 44326:tid 44356] [client 135.181.213.219:53514] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahGdGcyrPrcAqE-FOKKZ6QAAAcE"]
[Sat May 23 20:27:07.641557 2026] [:error] [pid 44296:tid 44315] [client 135.181.213.219:53522] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahGdG5drUdFI6ijvMkmIbAAAAVE"]
[Sat May 23 20:27:09.612953 2026] [:error] [pid 31039:tid 31051] [client 135.181.213.219:53532] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahGdHaIYDYo8WvA5zLJDDAAAAMo"]
[Sat May 23 20:27:11.617268 2026] [:error] [pid 44296:tid 44311] [client 135.181.213.219:30350] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahGdH5drUdFI6ijvMkmIeQAAAU0"]
[Sat May 23 20:27:13.602175 2026] [:error] [pid 30940:tid 30973] [client 135.181.213.219:30360] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahGdIZqUP2XZmzp7RDoKPAAAABg"]
[Sat May 23 20:27:15.605233 2026] [:error] [pid 30940:tid 30965] [client 135.181.213.219:30376] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahGdI5qUP2XZmzp7RDoKPQAAABA"]
[Sat May 23 20:27:17.749113 2026] [:error] [pid 30941:tid 30981] [client 135.181.213.219:30380] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahGdJXTIgjSDhiZmvlXlngAAAEU"]
[Sat May 23 20:27:19.717790 2026] [:error] [pid 44326:tid 44375] [client 135.181.213.219:30390] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahGdJ8yrPrcAqE-FOKKZ_gAAAdQ"]
[Sat May 23 20:27:21.727496 2026] [:error] [pid 30940:tid 30957] [client 135.181.213.219:26846] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ahGdKZqUP2XZmzp7RDoKPwAAAAg"]
[Sat May 23 20:27:23.748948 2026] [:error] [pid 44296:tid 44299] [client 135.181.213.219:26858] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahGdK5drUdFI6ijvMkmIjAAAAUE"]
[Sat May 23 20:27:25.894497 2026] [:error] [pid 30942:tid 31021] [client 135.181.213.219:26870] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahGdLdUosz64YFiBlG1zCwAAAJI"]
[Sat May 23 20:27:27.886337 2026] [:error] [pid 44325:tid 44335] [client 135.181.213.219:26878] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahGdL1gUQb4puB_2yV8hGwAAAYc"]
[Sat May 23 20:27:29.928040 2026] [:error] [pid 25876:tid 25895] [client 135.181.213.219:45900] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahGdMQSpWUCKPezIBJCq8AAAARE"]
[Sat May 23 20:27:31.805296 2026] [:error] [pid 44296:tid 44321] [client 135.181.213.219:45914] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahGdM5drUdFI6ijvMkmIjwAAAVc"]
[Sat May 23 20:27:33.813880 2026] [:error] [pid 30941:tid 30990] [client 135.181.213.219:45920] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ahGdNXTIgjSDhiZmvlXlqQAAAE4"]
[Sat May 23 20:27:35.805908 2026] [:error] [pid 44325:tid 44345] [client 135.181.213.219:45922] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahGdN1gUQb4puB_2yV8hJwAAAZE"]
[Sat May 23 20:27:37.636146 2026] [:error] [pid 25876:tid 25881] [client 135.181.213.219:45934] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahGdOQSpWUCKPezIBJCq9AAAAQM"]
[Sat May 23 20:27:39.615605 2026] [:error] [pid 44325:tid 44342] [client 135.181.213.219:45950] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ahGdO1gUQb4puB_2yV8hLgAAAY4"]
[Sat May 23 20:27:41.447713 2026] [:error] [pid 44326:tid 44374] [client 135.181.213.219:32748] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahGdPcyrPrcAqE-FOKKaFQAAAdM"]
[Sat May 23 20:27:43.573928 2026] [:error] [pid 25876:tid 25886] [client 135.181.213.219:32758] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahGdPwSpWUCKPezIBJCq9wAAAQg"]
[Sat May 23 20:27:45.558518 2026] [:error] [pid 44326:tid 44373] [client 135.181.213.219:32770] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahGdQcyrPrcAqE-FOKKaGwAAAdI"]
[Sat May 23 20:27:47.544812 2026] [:error] [pid 25876:tid 25887] [client 135.181.213.219:32786] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahGdQwSpWUCKPezIBJCq-gAAAQk"]
[Sat May 23 20:27:49.545877 2026] [:error] [pid 44326:tid 44356] [client 135.181.213.219:32800] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ahGdRcyrPrcAqE-FOKKaIwAAAcE"]
[Sat May 23 20:27:51.533641 2026] [:error] [pid 30942:tid 31009] [client 135.181.213.219:11624] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahGdR9Uosz64YFiBlG1zHQAAAIY"]
[Sat May 23 20:27:53.509654 2026] [:error] [pid 44326:tid 44365] [client 135.181.213.219:11630] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ahGdScyrPrcAqE-FOKKaKQAAAco"]
[Sat May 23 20:27:55.490783 2026] [:error] [pid 25876:tid 25879] [client 135.181.213.219:11642] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahGdSwSpWUCKPezIBJCq_gAAAQE"]
[Sat May 23 20:28:20.976969 2026] [:error] [pid 44326:tid 44357] [client 135.181.213.219:11182] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahGdZMyrPrcAqE-FOKKaLgAAAcI"]
[Sat May 23 20:28:22.854301 2026] [:error] [pid 25876:tid 25883] [client 135.181.213.219:11188] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahGdZgSpWUCKPezIBJCrGgAAAQU"]
[Sat May 23 20:28:24.844320 2026] [:error] [pid 44326:tid 44372] [client 135.181.213.219:11190] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahGdaMyrPrcAqE-FOKKaMAAAAdE"]
[Sat May 23 20:28:26.685456 2026] [:error] [pid 44325:tid 44342] [client 135.181.213.219:11192] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahGdalgUQb4puB_2yV8hTQAAAY4"]
[Sat May 23 20:28:28.677157 2026] [:error] [pid 44325:tid 44340] [client 135.181.213.219:11194] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahGdbFgUQb4puB_2yV8hUQAAAYw"]
[Sat May 23 20:28:30.683512 2026] [:error] [pid 30940:tid 30961] [client 135.181.213.219:55316] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahGdbpqUP2XZmzp7RDoKZwAAAAw"]
[Sat May 23 20:28:32.509326 2026] [:error] [pid 44326:tid 44363] [client 135.181.213.219:55330] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ahGdcMyrPrcAqE-FOKKaMgAAAcg"]
[Sat May 23 20:28:34.518279 2026] [:error] [pid 44325:tid 44328] [client 135.181.213.219:55344] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahGdclgUQb4puB_2yV8hVgAAAYA"]
[Sat May 23 20:28:36.493598 2026] [:error] [pid 30942:tid 31026] [client 135.181.213.219:55350] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahGddNUosz64YFiBlG1zUAAAAJc"]
[Sat May 23 20:28:38.477525 2026] [:error] [pid 44326:tid 44375] [client 135.181.213.219:55360] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ahGddsyrPrcAqE-FOKKaPAAAAdQ"]
[Sat May 23 20:28:40.473336 2026] [:error] [pid 30940:tid 30969] [client 135.181.213.219:38892] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahGdeJqUP2XZmzp7RDoKbwAAABQ"]
[Sat May 23 20:28:42.449196 2026] [:error] [pid 30942:tid 31015] [client 135.181.213.219:38900] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahGdetUosz64YFiBlG1zWAAAAIw"]
[Sat May 23 20:28:44.467216 2026] [:error] [pid 25876:tid 25889] [client 135.181.213.219:38916] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahGdfASpWUCKPezIBJCrKgAAAQs"]
[Sat May 23 20:28:46.616362 2026] [:error] [pid 30941:tid 30984] [client 135.181.213.219:38926] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahGdfnTIgjSDhiZmvlXl3gAAAEg"]
[Sat May 23 20:28:48.603260 2026] [:error] [pid 30942:tid 31017] [client 135.181.213.219:38938] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahGdgNUosz64YFiBlG1zXgAAAI4"]
[Sat May 23 20:28:50.595474 2026] [:error] [pid 44326:tid 44357] [client 135.181.213.219:5980] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahGdgsyrPrcAqE-FOKKaTQAAAcI"]
[Sat May 23 20:28:52.593649 2026] [:error] [pid 44296:tid 44298] [client 135.181.213.219:5986] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahGdhJdrUdFI6ijvMkmIygAAAUA"]
[Sat May 23 20:28:54.562557 2026] [:error] [pid 30940:tid 30959] [client 135.181.213.219:5998] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahGdhpqUP2XZmzp7RDoKcQAAAAo"]
[Sat May 23 20:28:56.441204 2026] [:error] [pid 30941:tid 30976] [client 135.181.213.219:6012] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahGdiHTIgjSDhiZmvlXl5wAAAEA"]
[Sat May 23 20:28:58.441338 2026] [:error] [pid 30940:tid 30968] [client 135.181.213.219:6028] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahGdipqUP2XZmzp7RDoKcgAAABM"]
[Sat May 23 20:29:00.271295 2026] [:error] [pid 44325:tid 44330] [client 135.181.213.219:60954] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahGdjFgUQb4puB_2yV8hZAAAAYI"]
[Sat May 23 20:29:02.265604 2026] [:error] [pid 44296:tid 44304] [client 135.181.213.219:60956] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahGdjpdrUdFI6ijvMkmI0QAAAUY"]
[Sat May 23 20:29:04.228099 2026] [:error] [pid 31039:tid 31043] [client 135.181.213.219:60970] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahGdkKIYDYo8WvA5zLJDRQAAAMI"]
[Sat May 23 20:29:06.213958 2026] [:error] [pid 30941:tid 30996] [client 135.181.213.219:60980] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahGdknTIgjSDhiZmvlXl8gAAAFQ"]
[Sat May 23 20:29:08.200983 2026] [:error] [pid 44296:tid 44306] [client 135.181.213.219:60982] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahGdlJdrUdFI6ijvMkmI0wAAAUg"]
[Sat May 23 20:29:10.177743 2026] [:error] [pid 30941:tid 30991] [client 135.181.213.219:51636] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahGdlnTIgjSDhiZmvlXl_QAAAE8"]
[Sat May 23 20:29:12.138957 2026] [:error] [pid 44296:tid 44308] [client 135.181.213.219:51650] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahGdmJdrUdFI6ijvMkmI1AAAAUo"]
[Sat May 23 20:29:14.137423 2026] [:error] [pid 30942:tid 31015] [client 135.181.213.219:51658] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahGdmtUosz64YFiBlG1zZQAAAIw"]
[Sat May 23 20:29:16.115596 2026] [:error] [pid 44325:tid 44339] [client 135.181.213.219:51662] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahGdnFgUQb4puB_2yV8haQAAAYs"]
[Sat May 23 20:58:56.139068 2026] [:error] [pid 44325:tid 44331] [client 147.135.252.145:54136] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahGkkFgUQb4puB_2yV8nWgAAAYM"]
[Sat May 23 20:58:58.253588 2026] [:error] [pid 30941:tid 30994] [client 147.135.252.145:34686] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahGkknTIgjSDhiZmvlXyVwAAAFI"]
[Sat May 23 20:59:01.139575 2026] [:error] [pid 44326:tid 44372] [client 147.135.252.145:57946] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahGklcyrPrcAqE-FOKKjAQAAAdE"]
[Sat May 23 20:59:03.246453 2026] [:error] [pid 44325:tid 44350] [client 147.135.252.145:58232] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahGkl1gUQb4puB_2yV8nXQAAAZY"]
[Sat May 23 20:59:05.401917 2026] [:error] [pid 30941:tid 30997] [client 147.135.252.145:58248] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahGkmXTIgjSDhiZmvlXyXAAAAFU"]
[Sat May 23 20:59:08.838333 2026] [:error] [pid 44326:tid 44378] [client 147.135.252.145:56226] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahGknMyrPrcAqE-FOKKjJQAAAdc"]
[Sat May 23 20:59:11.417495 2026] [:error] [pid 44296:tid 44309] [client 147.135.252.145:46438] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahGkn5drUdFI6ijvMkmOHgAAAUs"]
[Sat May 23 20:59:14.777785 2026] [:error] [pid 30941:tid 30991] [client 147.135.252.145:36264] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahGkonTIgjSDhiZmvlXyaQAAAE8"]
[Sat May 23 20:59:16.976537 2026] [:error] [pid 30941:tid 30978] [client 147.135.252.145:46440] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahGkpHTIgjSDhiZmvlXyfAAAAEI"]
[Sat May 23 20:59:19.546827 2026] [:error] [pid 44326:tid 44359] [client 147.135.252.145:46444] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahGkp8yrPrcAqE-FOKKjLwAAAcQ"]
[Sat May 23 20:59:21.889575 2026] [:error] [pid 44326:tid 44356] [client 147.135.252.145:55914] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahGkqcyrPrcAqE-FOKKjMwAAAcE"]
[Sat May 23 20:59:23.859557 2026] [:error] [pid 44326:tid 44378] [client 147.135.252.145:55920] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahGkq8yrPrcAqE-FOKKjQAAAAdc"]
[Sat May 23 20:59:25.992457 2026] [:error] [pid 25876:tid 25886] [client 147.135.252.145:55928] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahGkrQSpWUCKPezIBJCvrQAAAQg"]
[Sat May 23 20:59:28.442142 2026] [:error] [pid 30941:tid 30979] [client 147.135.252.145:55932] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahGksHTIgjSDhiZmvlXyjAAAAEM"]
[Sat May 23 20:59:31.258424 2026] [:error] [pid 25876:tid 25879] [client 147.135.252.145:39760] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahGkswSpWUCKPezIBJCvrwAAAQE"]
[Sat May 23 20:59:35.364684 2026] [:error] [pid 25876:tid 25883] [client 147.135.252.145:44212] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahGktwSpWUCKPezIBJCvswAAAQU"]
[Sat May 23 20:59:39.387357 2026] [:error] [pid 30941:tid 30982] [client 147.135.252.145:44216] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahGku3TIgjSDhiZmvlXymAAAAEY"]
[Sat May 23 22:58:22.861620 2026] [:error] [pid 44326:tid 44373] [client 93.158.213.26:53706] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahHAjsyrPrcAqE-FOKLEgwAAAdI"]
[Sat May 23 22:58:24.626306 2026] [:error] [pid 25876:tid 25898] [client 93.158.213.26:32916] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahHAkASpWUCKPezIBJDDAAAAARQ"]
[Sat May 23 22:58:26.741722 2026] [:error] [pid 30942:tid 31009] [client 93.158.213.26:35568] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahHAktUosz64YFiBlG2GSAAAAIY"]
[Sat May 23 22:58:28.804780 2026] [:error] [pid 31039:tid 31052] [client 93.158.213.26:35582] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahHAlKIYDYo8WvA5zLJYlAAAAMs"]
[Sat May 23 22:58:31.395177 2026] [:error] [pid 44296:tid 44319] [client 93.158.213.26:44914] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahHAl5drUdFI6ijvMkmmTgAAAVU"]
[Sat May 23 22:58:33.256863 2026] [:error] [pid 30941:tid 30993] [client 93.158.213.26:36800] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ahHAmXTIgjSDhiZmvlUdtwAAAFE"]
[Sat May 23 22:58:35.260047 2026] [:error] [pid 25876:tid 25889] [client 93.158.213.26:36810] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ahHAmwSpWUCKPezIBJDDFQAAAQs"]
[Sat May 23 22:58:37.248798 2026] [:error] [pid 30940:tid 30960] [client 93.158.213.26:36824] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ahHAnZqUP2XZmzp7RDoc5QAAAAs"]
[Sat May 23 22:58:39.236624 2026] [:error] [pid 25876:tid 25894] [client 93.158.213.26:36834] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahHAnwSpWUCKPezIBJDDHwAAARA"]
[Sat May 23 22:58:41.206188 2026] [:error] [pid 30940:tid 30958] [client 93.158.213.26:36850] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ahHAoZqUP2XZmzp7RDoc7AAAAAk"]
[Sat May 23 22:58:43.142677 2026] [:error] [pid 30941:tid 30996] [client 93.158.213.26:39778] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahHAo3TIgjSDhiZmvlUdxAAAAFQ"]
[Sat May 23 22:58:45.047705 2026] [:error] [pid 30941:tid 30981] [client 93.158.213.26:39786] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahHApXTIgjSDhiZmvlUdzQAAAEU"]
[Sat May 23 22:58:47.068076 2026] [:error] [pid 30941:tid 30987] [client 93.158.213.26:39796] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahHAp3TIgjSDhiZmvlUd1gAAAEs"]
[Sat May 23 22:58:49.082237 2026] [:error] [pid 44326:tid 44379] [client 93.158.213.26:39810] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahHAqcyrPrcAqE-FOKLElQAAAdg"]
[Sat May 23 22:58:51.049090 2026] [:error] [pid 44326:tid 44367] [client 93.158.213.26:39822] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahHAq8yrPrcAqE-FOKLEmgAAAcw"]
[Sat May 23 22:58:53.621350 2026] [:error] [pid 31039:tid 31059] [client 93.158.213.26:48876] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahHAraIYDYo8WvA5zLJYsQAAANI"]
[Sat May 23 22:58:55.729808 2026] [:error] [pid 25876:tid 25888] [client 93.158.213.26:49112] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahHArwSpWUCKPezIBJDDLwAAAQo"]
[Sat May 23 22:58:57.769849 2026] [:error] [pid 30941:tid 30993] [client 93.158.213.26:49124] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahHAsXTIgjSDhiZmvlUd_gAAAFE"]
[Sat May 23 22:58:59.960653 2026] [:error] [pid 44326:tid 44371] [client 93.158.213.26:49134] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahHAs8yrPrcAqE-FOKLEpwAAAdA"]
[Sat May 23 22:59:01.849381 2026] [:error] [pid 44325:tid 44331] [client 93.158.213.26:49142] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahHAtVgUQb4puB_2yV9CyQAAAYM"]
[Sat May 23 22:59:03.850347 2026] [:error] [pid 44296:tid 44307] [client 93.158.213.26:56534] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahHAt5drUdFI6ijvMkmmXwAAAUk"]
[Sat May 23 22:59:05.860171 2026] [:error] [pid 44325:tid 44349] [client 93.158.213.26:56548] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahHAuVgUQb4puB_2yV9C0QAAAZU"]
[Sat May 23 22:59:07.820040 2026] [:error] [pid 44326:tid 44355] [client 93.158.213.26:56562] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahHAu8yrPrcAqE-FOKLErAAAAcA"]
[Sat May 23 22:59:09.779865 2026] [:error] [pid 44325:tid 44339] [client 93.158.213.26:56576] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahHAvVgUQb4puB_2yV9C1wAAAYs"]
[Sat May 23 22:59:11.839570 2026] [:error] [pid 30940:tid 30970] [client 93.158.213.26:56592] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahHAv5qUP2XZmzp7RDoc9AAAABU"]
[Sat May 23 22:59:14.366385 2026] [:error] [pid 30941:tid 30987] [client 93.158.213.26:48260] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahHAwnTIgjSDhiZmvlUeEQAAAEs"]
[Sat May 23 22:59:16.422445 2026] [:error] [pid 30941:tid 30980] [client 93.158.213.26:52040] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahHAxHTIgjSDhiZmvlUeGQAAAEQ"]
[Sat May 23 22:59:18.560175 2026] [:error] [pid 31039:tid 31052] [client 93.158.213.26:52054] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahHAxqIYDYo8WvA5zLJYyQAAAMs"]
[Sat May 23 22:59:42.170848 2026] [:error] [pid 44325:tid 44345] [client 93.158.213.26:52066] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahHA3lgUQb4puB_2yV9C9gAAAZE"]
[Sat May 23 22:59:44.229311 2026] [:error] [pid 30941:tid 30993] [client 93.158.213.26:38426] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahHA4HTIgjSDhiZmvlUeVAAAAFE"]
[Sat May 23 22:59:46.310712 2026] [:error] [pid 30941:tid 30983] [client 93.158.213.26:38434] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahHA4nTIgjSDhiZmvlUeVgAAAEc"]
[Sat May 23 22:59:48.346798 2026] [:error] [pid 44326:tid 44378] [client 93.158.213.26:38436] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ahHA5MyrPrcAqE-FOKLE0QAAAdc"]
[Sat May 23 22:59:50.358441 2026] [:error] [pid 30941:tid 30985] [client 93.158.213.26:38450] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahHA5nTIgjSDhiZmvlUeYwAAAEk"]
[Sat May 23 22:59:53.330434 2026] [:error] [pid 30941:tid 30995] [client 93.158.213.26:47396] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHA6XTIgjSDhiZmvlUeawAAAFM"]
[Sat May 23 22:59:57.166544 2026] [:error] [pid 30940:tid 30958] [client 93.158.213.26:47404] [client 93.158.213.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHA7ZqUP2XZmzp7RDodCQAAAAk"]
[Sat May 23 23:32:00.764577 2026] [:error] [pid 44326:tid 44373] [client 43.128.87.4:58992] [client 43.128.87.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahHIcMyrPrcAqE-FOKLN1AAAAdI"]
[Sat May 23 23:34:35.182678 2026] [:error] [pid 30941:tid 30998] [client 81.167.26.57:59959] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahHJC3TIgjSDhiZmvlUsnwAAAFY"]
[Sat May 23 23:34:36.391320 2026] [:error] [pid 30941:tid 30984] [client 81.167.26.57:3255] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHJDHTIgjSDhiZmvlUspAAAAEg"]
[Sat May 23 23:34:40.205557 2026] [:error] [pid 44326:tid 44359] [client 81.167.26.57:33937] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHJEMyrPrcAqE-FOKLOxwAAAcQ"]
[Sun May 24 00:08:16.585443 2026] [:error] [pid 44325:tid 44337] [client 135.181.213.219:26924] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahHQ8FgUQb4puB_2yV9TJgAAAYk"]
[Sun May 24 00:08:19.178137 2026] [:error] [pid 44296:tid 44299] [client 135.181.213.219:26940] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahHQ85drUdFI6ijvMkmzSwAAAUE"]
[Sun May 24 00:08:21.785921 2026] [:error] [pid 31039:tid 31051] [client 135.181.213.219:28360] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahHQ9aIYDYo8WvA5zLJjCgAAAMo"]
[Sun May 24 00:08:22.917731 2026] [:error] [pid 44326:tid 44372] [client 135.181.213.219:31050] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHQ9syrPrcAqE-FOKLXlAAAAdE"]
[Sun May 24 00:08:26.642213 2026] [:error] [pid 44325:tid 44344] [client 135.181.213.219:31058] [client 135.181.213.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahHQ-lgUQb4puB_2yV9TKwAAAZA"]
[Sun May 24 03:32:44.862146 2026] [proxy_fcgi:error] [pid 42006:tid 42096] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:45.083385 2026] [proxy_fcgi:error] [pid 42006:tid 42089] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:45.298972 2026] [proxy_fcgi:error] [pid 42006:tid 42106] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:45.513118 2026] [proxy_fcgi:error] [pid 42006:tid 42097] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:45.726804 2026] [proxy_fcgi:error] [pid 42006:tid 42104] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:45.940769 2026] [proxy_fcgi:error] [pid 42006:tid 42095] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:46.155814 2026] [proxy_fcgi:error] [pid 42006:tid 42092] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:46.369873 2026] [proxy_fcgi:error] [pid 42006:tid 42090] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:46.594174 2026] [proxy_fcgi:error] [pid 42006:tid 42085] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:46.808358 2026] [proxy_fcgi:error] [pid 42006:tid 42093] [client 20.63.33.98:18683] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:32:47.018915 2026] [:error] [pid 42006:tid 42101] [client 20.63.33.98:18683] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahIA34_b7rIKIkITfyGupgAAABE"]
[Sun May 24 03:32:47.438695 2026] [:error] [pid 42010:tid 42139] [client 20.63.33.98:52814] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahIA3wE3Qc65z6z90S9ragAAAIE"]
[Sun May 24 03:32:47.862437 2026] [:error] [pid 42010:tid 42160] [client 20.63.33.98:11519] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahIA3wE3Qc65z6z90S9rawAAAJY"]
[Sun May 24 03:32:48.347783 2026] [:error] [pid 42197:tid 42201] [client 20.63.33.98:17974] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahIA4KIG0JRyocIl2y89PgAAAMI"]
[Sun May 24 03:32:48.841301 2026] [:error] [pid 42010:tid 42149] [client 20.63.33.98:17928] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahIA4AE3Qc65z6z90S9rbQAAAIs"]
[Sun May 24 03:32:49.406493 2026] [:error] [pid 42010:tid 42161] [client 20.63.33.98:52810] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahIA4QE3Qc65z6z90S9rcAAAAJc"]
[Sun May 24 03:32:49.870102 2026] [:error] [pid 42010:tid 42162] [client 20.63.33.98:17726] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahIA4QE3Qc65z6z90S9rdQAAAJg"]
[Sun May 24 03:32:50.287817 2026] [:error] [pid 42197:tid 42220] [client 20.63.33.98:52815] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahIA4qIG0JRyocIl2y89RQAAANU"]
[Sun May 24 03:32:50.829113 2026] [:error] [pid 42197:tid 42216] [client 20.63.33.98:48882] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ahIA4qIG0JRyocIl2y89RwAAANE"]
[Sun May 24 03:32:51.253066 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:48858] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ahIA46IG0JRyocIl2y89SgAAAM4"]
[Sun May 24 03:32:51.698826 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:17938] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ahIA46IG0JRyocIl2y89TAAAAME"]
[Sun May 24 03:32:52.120129 2026] [:error] [pid 42197:tid 42212] [client 20.63.33.98:17709] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atomlib.php"] [unique_id "ahIA5KIG0JRyocIl2y89TgAAAM0"]
[Sun May 24 03:32:52.536624 2026] [:error] [pid 42010:tid 42161] [client 20.63.33.98:17942] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-der.php"] [unique_id "ahIA5AE3Qc65z6z90S9rfAAAAJc"]
[Sun May 24 03:32:52.968355 2026] [:error] [pid 42006:tid 42098] [client 20.63.33.98:11456] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-der.php"] [unique_id "ahIA5I_b7rIKIkITfyGurgAAAA4"]
[Sun May 24 03:32:53.401966 2026] [:error] [pid 42006:tid 42092] [client 20.63.33.98:9228] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-der.php"] [unique_id "ahIA5Y_b7rIKIkITfyGurwAAAAg"]
[Sun May 24 03:32:53.883042 2026] [:error] [pid 42006:tid 42085] [client 20.63.33.98:18661] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-der.php"] [unique_id "ahIA5Y_b7rIKIkITfyGusQAAAAE"]
[Sun May 24 03:32:54.310567 2026] [:error] [pid 42006:tid 42093] [client 20.63.33.98:9232] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ahIA5o_b7rIKIkITfyGusgAAAAk"]
[Sun May 24 03:32:54.740950 2026] [:error] [pid 42006:tid 42107] [client 20.63.33.98:17679] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ahIA5o_b7rIKIkITfyGuswAAABc"]
[Sun May 24 03:32:55.169578 2026] [:error] [pid 42197:tid 42199] [client 20.63.33.98:11473] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ahIA56IG0JRyocIl2y89UwAAAMA"]
[Sun May 24 03:32:55.612930 2026] [:error] [pid 42006:tid 42101] [client 20.63.33.98:38798] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ftde.php"] [unique_id "ahIA54_b7rIKIkITfyGutAAAABE"]
[Sun May 24 03:32:56.043266 2026] [:error] [pid 42006:tid 42103] [client 20.63.33.98:11467] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ahIA6I_b7rIKIkITfyGutgAAABM"]
[Sun May 24 03:32:56.467834 2026] [:error] [pid 42197:tid 42211] [client 20.63.33.98:38829] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ahIA6KIG0JRyocIl2y89VQAAAMw"]
[Sun May 24 03:32:56.930937 2026] [:error] [pid 42010:tid 42144] [client 20.63.33.98:9237] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ahIA6AE3Qc65z6z90S9rgwAAAIY"]
[Sun May 24 03:32:57.436941 2026] [:error] [pid 42009:tid 42125] [client 20.63.33.98:17675] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ahIA6QXVSzrAx_1X5pVNeQAAAE4"]
[Sun May 24 03:32:57.900139 2026] [:error] [pid 42009:tid 42122] [client 20.63.33.98:17966] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ahIA6QXVSzrAx_1X5pVNegAAAEs"]
[Sun May 24 03:32:58.315159 2026] [:error] [pid 42010:tid 42142] [client 20.63.33.98:52819] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ahIA6gE3Qc65z6z90S9rhAAAAIQ"]
[Sun May 24 03:32:58.754322 2026] [:error] [pid 42197:tid 42222] [client 20.63.33.98:18676] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ahIA6qIG0JRyocIl2y89VwAAANc"]
[Sun May 24 03:32:59.170289 2026] [:error] [pid 42010:tid 42150] [client 20.63.33.98:17702] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ahIA6wE3Qc65z6z90S9rhQAAAIw"]
[Sun May 24 03:32:59.586586 2026] [:error] [pid 42010:tid 42141] [client 20.63.33.98:38791] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "ahIA6wE3Qc65z6z90S9rhgAAAIM"]
[Sun May 24 03:33:00.026669 2026] [:error] [pid 42010:tid 42158] [client 20.63.33.98:18636] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "ahIA7AE3Qc65z6z90S9rhwAAAJQ"]
[Sun May 24 03:33:00.475996 2026] [:error] [pid 42197:tid 42223] [client 20.63.33.98:38789] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "ahIA7KIG0JRyocIl2y89XQAAANg"]
[Sun May 24 03:33:01.018331 2026] [:error] [pid 42010:tid 42145] [client 20.63.33.98:17978] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/app.php"] [unique_id "ahIA7QE3Qc65z6z90S9riAAAAIc"]
[Sun May 24 03:33:01.467599 2026] [:error] [pid 42010:tid 42138] [client 20.63.33.98:17724] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahIA7QE3Qc65z6z90S9riQAAAIA"]
[Sun May 24 03:33:01.927561 2026] [:error] [pid 42197:tid 42207] [client 20.63.33.98:52852] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahIA7aIG0JRyocIl2y89YQAAAMg"]
[Sun May 24 03:33:02.393826 2026] [:error] [pid 42197:tid 42206] [client 20.63.33.98:17683] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahIA7qIG0JRyocIl2y89ZQAAAMc"]
[Sun May 24 03:33:02.839629 2026] [:error] [pid 42009:tid 42123] [client 20.63.33.98:18685] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahIA7gXVSzrAx_1X5pVNfQAAAEw"]
[Sun May 24 03:33:03.307021 2026] [:error] [pid 42197:tid 42203] [client 20.63.33.98:17962] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "ahIA76IG0JRyocIl2y89aQAAAMQ"]
[Sun May 24 03:33:03.804754 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:18662] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "ahIA76IG0JRyocIl2y89awAAAM8"]
[Sun May 24 03:33:04.361160 2026] [:error] [pid 42197:tid 42216] [client 20.63.33.98:17684] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "ahIA8KIG0JRyocIl2y89bgAAANE"]
[Sun May 24 03:33:04.952563 2026] [:error] [pid 42009:tid 42134] [client 20.63.33.98:52832] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wuasr.php"] [unique_id "ahIA8AXVSzrAx_1X5pVNfgAAAFc"]
[Sun May 24 03:33:05.520099 2026] [:error] [pid 42010:tid 42160] [client 20.63.33.98:48887] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahIA8QE3Qc65z6z90S9riwAAAJY"]
[Sun May 24 03:33:06.042142 2026] [:error] [pid 42010:tid 42143] [client 20.63.33.98:17947] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahIA8gE3Qc65z6z90S9rjAAAAIU"]
[Sun May 24 03:33:06.559121 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:9234] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahIA8gE3Qc65z6z90S9rjQAAAIg"]
[Sun May 24 03:33:07.105057 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:52801] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahIA86IG0JRyocIl2y89dAAAAM8"]
[Sun May 24 03:33:07.748832 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:17672] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ahIA86IG0JRyocIl2y89dwAAAMs"]
[Sun May 24 03:33:08.240027 2026] [:error] [pid 42197:tid 42206] [client 20.63.33.98:48837] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ahIA9KIG0JRyocIl2y89eQAAAMc"]
[Sun May 24 03:33:08.701093 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:9216] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ahIA9KIG0JRyocIl2y89fAAAAM8"]
[Sun May 24 03:33:09.135464 2026] [:error] [pid 42197:tid 42209] [client 20.63.33.98:11506] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ahIA9aIG0JRyocIl2y89fgAAAMo"]
[Sun May 24 03:33:09.624784 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:52800] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahIA9aIG0JRyocIl2y89ggAAAM4"]
[Sun May 24 03:33:10.153971 2026] [:error] [pid 42197:tid 42212] [client 20.63.33.98:52818] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahIA9qIG0JRyocIl2y89hAAAAM0"]
[Sun May 24 03:33:10.644146 2026] [:error] [pid 42010:tid 42147] [client 20.63.33.98:17968] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahIA9gE3Qc65z6z90S9rkwAAAIk"]
[Sun May 24 03:33:11.097617 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:56472] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahIA9wXVSzrAx_1X5pVNhAAAAE0"]
[Sun May 24 03:33:11.596511 2026] [:error] [pid 42010:tid 42145] [client 20.63.33.98:9263] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "ahIA9wE3Qc65z6z90S9rmgAAAIc"]
[Sun May 24 03:33:12.028355 2026] [:error] [pid 42010:tid 42138] [client 20.63.33.98:38830] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "ahIA-AE3Qc65z6z90S9rmwAAAIA"]
[Sun May 24 03:33:12.444730 2026] [:error] [pid 42197:tid 42218] [client 20.63.33.98:52809] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "ahIA-KIG0JRyocIl2y89jQAAANM"]
[Sun May 24 03:33:12.920719 2026] [:error] [pid 42010:tid 42151] [client 20.63.33.98:17931] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file30.php"] [unique_id "ahIA-AE3Qc65z6z90S9rnAAAAI0"]
[Sun May 24 03:33:13.378212 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:9220] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "ahIA-QE3Qc65z6z90S9rnwAAAIg"]
[Sun May 24 03:33:13.825345 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:9222] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "ahIA-aIG0JRyocIl2y89jgAAAMs"]
[Sun May 24 03:33:14.513019 2026] [:error] [pid 42197:tid 42206] [client 20.63.33.98:9255] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "ahIA-qIG0JRyocIl2y89kAAAAMc"]
[Sun May 24 03:33:14.928361 2026] [:error] [pid 42010:tid 42158] [client 20.63.33.98:17959] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file4.php"] [unique_id "ahIA-gE3Qc65z6z90S9rowAAAJQ"]
[Sun May 24 03:33:15.353104 2026] [:error] [pid 42010:tid 42157] [client 20.63.33.98:9264] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahIA-wE3Qc65z6z90S9rpAAAAJM"]
[Sun May 24 03:33:15.802813 2026] [:error] [pid 42006:tid 42096] [client 20.63.33.98:59343] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahIA-4_b7rIKIkITfyGuvgAAAAw"]
[Sun May 24 03:33:16.263132 2026] [:error] [pid 42197:tid 42208] [client 20.63.33.98:17710] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahIA_KIG0JRyocIl2y89kQAAAMk"]
[Sun May 24 03:33:16.695487 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:17948] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahIA_AE3Qc65z6z90S9rqwAAAIg"]
[Sun May 24 03:33:17.132422 2026] [:error] [pid 42009:tid 42129] [client 20.63.33.98:17960] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahIA_QXVSzrAx_1X5pVNigAAAFI"]
[Sun May 24 03:33:17.559019 2026] [:error] [pid 42197:tid 42207] [client 20.63.33.98:11505] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahIA_aIG0JRyocIl2y89kgAAAMg"]
[Sun May 24 03:33:17.987515 2026] [:error] [pid 42010:tid 42152] [client 20.63.33.98:38840] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahIA_QE3Qc65z6z90S9rsAAAAI4"]
[Sun May 24 03:33:18.427835 2026] [:error] [pid 42006:tid 42086] [client 20.63.33.98:52827] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahIA_o_b7rIKIkITfyGuvwAAAAI"]
[Sun May 24 03:33:18.946012 2026] [:error] [pid 42006:tid 42097] [client 20.63.33.98:52803] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ahIA_o_b7rIKIkITfyGuwQAAAA0"]
[Sun May 24 03:33:19.407977 2026] [:error] [pid 42006:tid 42104] [client 20.63.33.98:38794] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ahIA_4_b7rIKIkITfyGuwgAAABQ"]
[Sun May 24 03:33:19.825287 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:52812] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ahIA_wXVSzrAx_1X5pVNjAAAAE0"]
[Sun May 24 03:33:20.243631 2026] [:error] [pid 42197:tid 42215] [client 20.63.33.98:11482] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-access.php"] [unique_id "ahIBAKIG0JRyocIl2y89lgAAANA"]
[Sun May 24 03:33:20.660187 2026] [:error] [pid 42006:tid 42084] [client 20.63.33.98:48845] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahIBAI_b7rIKIkITfyGuxAAAAAA"]
[Sun May 24 03:33:21.075927 2026] [:error] [pid 42010:tid 42144] [client 20.63.33.98:9260] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahIBAQE3Qc65z6z90S9rtAAAAIY"]
[Sun May 24 03:33:21.610733 2026] [:error] [pid 42010:tid 42158] [client 20.63.33.98:38799] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahIBAQE3Qc65z6z90S9rtQAAAJQ"]
[Sun May 24 03:33:22.121749 2026] [:error] [pid 42006:tid 42085] [client 20.63.33.98:51607] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahIBAo_b7rIKIkITfyGuxgAAAAE"]
[Sun May 24 03:33:22.579231 2026] [:error] [pid 42006:tid 42093] [client 20.63.33.98:17686] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ahIBAo_b7rIKIkITfyGuyAAAAAk"]
[Sun May 24 03:33:22.995870 2026] [:error] [pid 42010:tid 42138] [client 20.63.33.98:38785] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ahIBAgE3Qc65z6z90S9rtwAAAIA"]
[Sun May 24 03:33:23.417024 2026] [:error] [pid 42010:tid 42155] [client 20.63.33.98:11517] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ahIBAwE3Qc65z6z90S9ruAAAAJE"]
[Sun May 24 03:33:23.867517 2026] [:error] [pid 42006:tid 42107] [client 20.63.33.98:17668] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vx.php"] [unique_id "ahIBA4_b7rIKIkITfyGuywAAABc"]
[Sun May 24 03:33:24.292943 2026] [:error] [pid 42010:tid 42159] [client 20.63.33.98:17954] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahIBBAE3Qc65z6z90S9ruQAAAJU"]
[Sun May 24 03:33:24.800959 2026] [:error] [pid 42009:tid 42119] [client 20.63.33.98:18645] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahIBBAXVSzrAx_1X5pVNkQAAAEg"]
[Sun May 24 03:33:25.226099 2026] [:error] [pid 42006:tid 42096] [client 20.63.33.98:9244] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahIBBY_b7rIKIkITfyGuzQAAAAw"]
[Sun May 24 03:33:25.786368 2026] [:error] [pid 42006:tid 42108] [client 20.63.33.98:56485] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahIBBY_b7rIKIkITfyGuzgAAABg"]
[Sun May 24 03:33:26.230765 2026] [:error] [pid 42010:tid 42157] [client 20.63.33.98:17693] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "ahIBBgE3Qc65z6z90S9rvQAAAJM"]
[Sun May 24 03:33:26.649438 2026] [:error] [pid 42006:tid 42104] [client 20.63.33.98:17721] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "ahIBBo_b7rIKIkITfyGu0AAAABQ"]
[Sun May 24 03:33:27.142602 2026] [:error] [pid 42010:tid 42150] [client 20.63.33.98:52850] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "ahIBBwE3Qc65z6z90S9rvgAAAIw"]
[Sun May 24 03:33:27.610802 2026] [:error] [pid 42010:tid 42148] [client 20.63.33.98:52811] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/crgio.php"] [unique_id "ahIBBwE3Qc65z6z90S9rvwAAAIo"]
[Sun May 24 03:33:28.139584 2026] [:error] [pid 42010:tid 42160] [client 20.63.33.98:48857] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahIBCAE3Qc65z6z90S9rwAAAAJY"]
[Sun May 24 03:33:28.560249 2026] [:error] [pid 42006:tid 42088] [client 20.63.33.98:48841] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahIBCI_b7rIKIkITfyGu1gAAAAQ"]
[Sun May 24 03:33:29.021714 2026] [:error] [pid 42009:tid 42120] [client 20.63.33.98:17711] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahIBCQXVSzrAx_1X5pVNlwAAAEk"]
[Sun May 24 03:33:29.801956 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:17712] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahIBCQE3Qc65z6z90S9rwwAAAIg"]
[Sun May 24 03:33:30.245241 2026] [:error] [pid 42010:tid 42151] [client 20.63.33.98:11498] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ahIBCgE3Qc65z6z90S9rxAAAAI0"]
[Sun May 24 03:33:30.676355 2026] [:error] [pid 42006:tid 42097] [client 20.63.33.98:18655] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ahIBCo_b7rIKIkITfyGu2gAAAA0"]
[Sun May 24 03:33:31.133160 2026] [:error] [pid 42006:tid 42104] [client 20.63.33.98:17941] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ahIBC4_b7rIKIkITfyGu2wAAABQ"]
[Sun May 24 03:33:31.708222 2026] [:error] [pid 42010:tid 42142] [client 20.63.33.98:38787] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp.php"] [unique_id "ahIBCwE3Qc65z6z90S9ryAAAAIQ"]
[Sun May 24 03:33:32.155474 2026] [:error] [pid 42006:tid 42091] [client 20.63.33.98:11507] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "ahIBDI_b7rIKIkITfyGu3QAAAAc"]
[Sun May 24 03:33:32.607627 2026] [:error] [pid 42006:tid 42088] [client 20.63.33.98:48880] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "ahIBDI_b7rIKIkITfyGu3gAAAAQ"]
[Sun May 24 03:33:33.106317 2026] [:error] [pid 42010:tid 42153] [client 20.63.33.98:17725] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "ahIBDQE3Qc65z6z90S9rywAAAI8"]
[Sun May 24 03:33:33.886815 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:59339] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ccou.php"] [unique_id "ahIBDaIG0JRyocIl2y89mwAAAM8"]
[Sun May 24 03:33:34.372409 2026] [:error] [pid 42006:tid 42100] [client 20.63.33.98:18675] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahIBDo_b7rIKIkITfyGu4gAAABA"]
[Sun May 24 03:33:35.079383 2026] [:error] [pid 42009:tid 42119] [client 20.63.33.98:17701] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahIBDwXVSzrAx_1X5pVNmAAAAEg"]
[Sun May 24 03:33:35.910051 2026] [:error] [pid 42010:tid 42160] [client 20.63.33.98:17937] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahIBDwE3Qc65z6z90S9rzwAAAJY"]
[Sun May 24 03:33:36.424812 2026] [:error] [pid 42006:tid 42106] [client 20.63.33.98:17957] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahIBEI_b7rIKIkITfyGu5QAAABY"]
[Sun May 24 03:33:37.160901 2026] [:error] [pid 42009:tid 42114] [client 20.63.33.98:9238] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahIBEQXVSzrAx_1X5pVNmQAAAEM"]
[Sun May 24 03:33:37.939426 2026] [:error] [pid 42010:tid 42158] [client 20.63.33.98:18626] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahIBEQE3Qc65z6z90S9r0QAAAJQ"]
[Sun May 24 03:33:38.604354 2026] [:error] [pid 42006:tid 42107] [client 20.63.33.98:9230] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahIBEo_b7rIKIkITfyGu6AAAABc"]
[Sun May 24 03:33:39.148183 2026] [:error] [pid 42006:tid 42105] [client 20.63.33.98:11491] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahIBE4_b7rIKIkITfyGu6QAAABU"]
[Sun May 24 03:33:39.919845 2026] [:error] [pid 42197:tid 42209] [client 20.63.33.98:56479] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahIBE6IG0JRyocIl2y89pAAAAMo"]
[Sun May 24 03:33:40.387770 2026] [:error] [pid 42197:tid 42208] [client 20.63.33.98:17950] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahIBFKIG0JRyocIl2y89pQAAAMk"]
[Sun May 24 03:33:41.010046 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:63916] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahIBFQXVSzrAx_1X5pVNowAAAE0"]
[Sun May 24 03:33:41.491520 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:17727] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahIBFaIG0JRyocIl2y89pwAAAMs"]
[Sun May 24 03:33:41.972524 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:17688] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahIBFaIG0JRyocIl2y89qQAAAME"]
[Sun May 24 03:33:42.411065 2026] [:error] [pid 42197:tid 42222] [client 20.63.33.98:63875] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahIBFqIG0JRyocIl2y89qgAAANc"]
[Sun May 24 03:33:42.927133 2026] [:error] [pid 42010:tid 42145] [client 20.63.33.98:11469] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahIBFgE3Qc65z6z90S9r1QAAAIc"]
[Sun May 24 03:33:43.542094 2026] [:error] [pid 42197:tid 42218] [client 20.63.33.98:17972] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahIBF6IG0JRyocIl2y89rQAAANM"]
[Sun May 24 03:33:44.099193 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:18647] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "ahIBGKIG0JRyocIl2y89rwAAAM4"]
[Sun May 24 03:33:44.615100 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:18672] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "ahIBGKIG0JRyocIl2y89sQAAAMs"]
[Sun May 24 03:33:45.028525 2026] [:error] [pid 42197:tid 42211] [client 20.63.33.98:18663] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "ahIBGaIG0JRyocIl2y89sgAAAMw"]
[Sun May 24 03:33:45.458593 2026] [:error] [pid 42009:tid 42114] [client 20.63.33.98:48871] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-firewall.php"] [unique_id "ahIBGQXVSzrAx_1X5pVNqQAAAEM"]
[Sun May 24 03:33:45.931095 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:11470] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fun.php"] [unique_id "ahIBGaIG0JRyocIl2y89tQAAAME"]
[Sun May 24 03:33:46.443769 2026] [proxy_fcgi:error] [pid 42009:tid 42132] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:46.671558 2026] [proxy_fcgi:error] [pid 42009:tid 42117] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:46.919349 2026] [proxy_fcgi:error] [pid 42009:tid 42113] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:47.133325 2026] [proxy_fcgi:error] [pid 42009:tid 42116] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:47.362184 2026] [proxy_fcgi:error] [pid 42009:tid 42120] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:47.573587 2026] [proxy_fcgi:error] [pid 42009:tid 42131] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:47.847346 2026] [proxy_fcgi:error] [pid 42009:tid 42126] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:48.059132 2026] [proxy_fcgi:error] [pid 42009:tid 42118] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:48.270985 2026] [proxy_fcgi:error] [pid 42009:tid 42122] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:48.482616 2026] [proxy_fcgi:error] [pid 42009:tid 42125] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:48.695177 2026] [proxy_fcgi:error] [pid 42009:tid 42128] [client 20.63.33.98:11514] AH01071: Got error 'Primary script unknown'
[Sun May 24 03:33:48.903676 2026] [:error] [pid 42009:tid 42111] [client 20.63.33.98:11514] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahIBHAXVSzrAx_1X5pVNuAAAAEA"]
[Sun May 24 03:33:49.328473 2026] [:error] [pid 42197:tid 42199] [client 20.63.33.98:9249] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahIBHaIG0JRyocIl2y89uQAAAMA"]
[Sun May 24 03:33:49.763977 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:18652] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahIBHaIG0JRyocIl2y89ugAAAM4"]
[Sun May 24 03:33:50.335152 2026] [:error] [pid 42197:tid 42208] [client 20.63.33.98:38841] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahIBHqIG0JRyocIl2y89vQAAAMk"]
[Sun May 24 03:33:50.749625 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:38834] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahIBHqIG0JRyocIl2y89vwAAAME"]
[Sun May 24 03:33:51.196956 2026] [:error] [pid 42009:tid 42117] [client 20.63.33.98:11465] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahIBHwXVSzrAx_1X5pVNugAAAEY"]
[Sun May 24 03:33:51.743997 2026] [:error] [pid 42009:tid 42113] [client 20.63.33.98:59337] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahIBHwXVSzrAx_1X5pVNuwAAAEI"]
[Sun May 24 03:33:52.254105 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:48279] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahIBIAXVSzrAx_1X5pVNvgAAAE0"]
[Sun May 24 03:33:52.990322 2026] [:error] [pid 42006:tid 42108] [client 20.63.33.98:52854] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff.php"] [unique_id "ahIBII_b7rIKIkITfyGu8QAAABg"]
[Sun May 24 03:33:53.512109 2026] [:error] [pid 42009:tid 42121] [client 20.63.33.98:17933] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff.php"] [unique_id "ahIBIQXVSzrAx_1X5pVNwgAAAEo"]
[Sun May 24 03:33:54.003386 2026] [:error] [pid 42009:tid 42128] [client 20.63.33.98:9270] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff.php"] [unique_id "ahIBIgXVSzrAx_1X5pVNwwAAAFE"]
[Sun May 24 03:33:54.515288 2026] [:error] [pid 42006:tid 42090] [client 20.63.33.98:17695] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff.php"] [unique_id "ahIBIo_b7rIKIkITfyGu9AAAAAY"]
[Sun May 24 03:33:54.959568 2026] [:error] [pid 42010:tid 42150] [client 20.63.33.98:48865] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "ahIBIgE3Qc65z6z90S9r3gAAAIw"]
[Sun May 24 03:33:55.416870 2026] [:error] [pid 42010:tid 42148] [client 20.63.33.98:62531] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "ahIBIwE3Qc65z6z90S9r4AAAAIo"]
[Sun May 24 03:33:55.907586 2026] [:error] [pid 42006:tid 42096] [client 20.63.33.98:48840] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "ahIBI4_b7rIKIkITfyGu9QAAAAw"]
[Sun May 24 03:33:56.353336 2026] [:error] [pid 42010:tid 42149] [client 20.63.33.98:11484] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yas.php"] [unique_id "ahIBJAE3Qc65z6z90S9r4wAAAIs"]
[Sun May 24 03:33:56.807188 2026] [:error] [pid 42006:tid 42102] [client 20.63.33.98:56501] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "ahIBJI_b7rIKIkITfyGu9gAAABI"]
[Sun May 24 03:33:57.260345 2026] [:error] [pid 42009:tid 42117] [client 20.63.33.98:9276] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "ahIBJQXVSzrAx_1X5pVNyAAAAEY"]
[Sun May 24 03:33:57.826231 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:56476] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "ahIBJQXVSzrAx_1X5pVNygAAAE0"]
[Sun May 24 03:33:58.281026 2026] [:error] [pid 42009:tid 42115] [client 20.63.33.98:17717] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/png.php"] [unique_id "ahIBJgXVSzrAx_1X5pVNzAAAAEQ"]
[Sun May 24 03:33:58.895928 2026] [:error] [pid 42006:tid 42089] [client 20.63.33.98:38816] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "ahIBJo_b7rIKIkITfyGu-AAAAAU"]
[Sun May 24 03:33:59.437015 2026] [:error] [pid 42006:tid 42085] [client 20.63.33.98:52825] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "ahIBJ4_b7rIKIkITfyGu-QAAAAE"]
[Sun May 24 03:33:59.853158 2026] [:error] [pid 42006:tid 42093] [client 20.63.33.98:17961] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "ahIBJ4_b7rIKIkITfyGu-wAAAAk"]
[Sun May 24 03:34:00.368532 2026] [:error] [pid 42010:tid 42152] [client 20.63.33.98:18634] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wmore1.php"] [unique_id "ahIBKAE3Qc65z6z90S9r6AAAAI4"]
[Sun May 24 03:34:00.816309 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:51645] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "ahIBKKIG0JRyocIl2y89xQAAAM8"]
[Sun May 24 03:34:01.439523 2026] [:error] [pid 42197:tid 42206] [client 20.63.33.98:17932] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "ahIBKaIG0JRyocIl2y89xwAAAMc"]
[Sun May 24 03:34:01.873601 2026] [:error] [pid 42006:tid 42107] [client 20.63.33.98:11496] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "ahIBKY_b7rIKIkITfyGu_wAAABc"]
[Sun May 24 03:34:02.297877 2026] [:error] [pid 42197:tid 42203] [client 20.63.33.98:38823] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ah25.php"] [unique_id "ahIBKqIG0JRyocIl2y89yQAAAMQ"]
[Sun May 24 03:34:02.718543 2026] [:error] [pid 42197:tid 42199] [client 20.63.33.98:38801] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "ahIBKqIG0JRyocIl2y89zAAAAMA"]
[Sun May 24 03:34:03.195265 2026] [:error] [pid 42009:tid 42112] [client 20.63.33.98:17924] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "ahIBKwXVSzrAx_1X5pVNzwAAAEE"]
[Sun May 24 03:34:03.624722 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:17690] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "ahIBK6IG0JRyocIl2y890AAAAMs"]
[Sun May 24 03:34:04.158129 2026] [:error] [pid 42197:tid 42202] [client 20.63.33.98:11496] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/forbidals.php"] [unique_id "ahIBLKIG0JRyocIl2y890gAAAMM"]
[Sun May 24 03:34:04.591552 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:62541] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "ahIBLKIG0JRyocIl2y890wAAAME"]
[Sun May 24 03:34:05.023145 2026] [:error] [pid 42010:tid 42142] [client 20.63.33.98:48873] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "ahIBLQE3Qc65z6z90S9r7gAAAIQ"]
[Sun May 24 03:34:05.495462 2026] [:error] [pid 42197:tid 42214] [client 20.63.33.98:17973] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "ahIBLaIG0JRyocIl2y891QAAAM8"]
[Sun May 24 03:34:06.006763 2026] [:error] [pid 42197:tid 42206] [client 20.63.33.98:56482] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lv.php"] [unique_id "ahIBLqIG0JRyocIl2y891wAAAMc"]
[Sun May 24 03:34:06.531697 2026] [:error] [pid 42010:tid 42157] [client 20.63.33.98:41198] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "ahIBLgE3Qc65z6z90S9r8AAAAJM"]
[Sun May 24 03:34:06.983706 2026] [:error] [pid 42197:tid 42216] [client 20.63.33.98:17981] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "ahIBLqIG0JRyocIl2y892QAAANE"]
[Sun May 24 03:34:07.466198 2026] [:error] [pid 42010:tid 42147] [client 20.63.33.98:17922] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "ahIBLwE3Qc65z6z90S9r8gAAAIk"]
[Sun May 24 03:34:07.904358 2026] [:error] [pid 42197:tid 42219] [client 20.63.33.98:48833] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/explorer/index_.php"] [unique_id "ahIBL6IG0JRyocIl2y892wAAANQ"]
[Sun May 24 03:34:08.410720 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:38786] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahIBMKIG0JRyocIl2y893QAAAME"]
[Sun May 24 03:34:08.847144 2026] [:error] [pid 42006:tid 42095] [client 20.63.33.98:38784] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahIBMI_b7rIKIkITfyGvAQAAAAs"]
[Sun May 24 03:34:09.309922 2026] [:error] [pid 42009:tid 42116] [client 20.63.33.98:18653] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahIBMQXVSzrAx_1X5pVN0wAAAEU"]
[Sun May 24 03:34:09.770247 2026] [:error] [pid 42009:tid 42126] [client 20.63.33.98:38842] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahIBMQXVSzrAx_1X5pVN1AAAAE8"]
[Sun May 24 03:34:10.196905 2026] [:error] [pid 42010:tid 42144] [client 20.63.33.98:48883] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "ahIBMgE3Qc65z6z90S9r-gAAAIY"]
[Sun May 24 03:34:10.632198 2026] [:error] [pid 42009:tid 42121] [client 20.63.33.98:11488] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "ahIBMgXVSzrAx_1X5pVN1gAAAEo"]
[Sun May 24 03:34:11.051523 2026] [:error] [pid 42010:tid 42143] [client 20.63.33.98:52862] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "ahIBMwE3Qc65z6z90S9r_AAAAIU"]
[Sun May 24 03:34:11.594467 2026] [:error] [pid 42010:tid 42158] [client 20.63.33.98:17970] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/samll.php"] [unique_id "ahIBMwE3Qc65z6z90S9r_gAAAJQ"]
[Sun May 24 03:34:12.016263 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:17707] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "ahIBNKIG0JRyocIl2y896AAAAMs"]
[Sun May 24 03:34:12.431184 2026] [:error] [pid 42010:tid 42157] [client 20.63.33.98:18644] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "ahIBNAE3Qc65z6z90S9sAAAAAJM"]
[Sun May 24 03:34:12.936624 2026] [:error] [pid 42006:tid 42092] [client 20.63.33.98:11474] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "ahIBNI_b7rIKIkITfyGvAgAAAAg"]
[Sun May 24 03:34:13.352564 2026] [:error] [pid 42009:tid 42114] [client 20.63.33.98:38843] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-at.php"] [unique_id "ahIBNQXVSzrAx_1X5pVN1wAAAEM"]
[Sun May 24 03:34:13.876499 2026] [:error] [pid 42197:tid 42199] [client 20.63.33.98:41161] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahIBNaIG0JRyocIl2y898QAAAMA"]
[Sun May 24 03:34:14.294159 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:38810] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahIBNqIG0JRyocIl2y899AAAAMs"]
[Sun May 24 03:34:14.729676 2026] [:error] [pid 42197:tid 42202] [client 20.63.33.98:18662] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahIBNqIG0JRyocIl2y899gAAAMM"]
[Sun May 24 03:34:15.154833 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:17718] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahIBN6IG0JRyocIl2y89-QAAAM4"]
[Sun May 24 03:34:15.568289 2026] [:error] [pid 42010:tid 42153] [client 20.63.33.98:38838] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ahIBNwE3Qc65z6z90S9sAwAAAI8"]
[Sun May 24 03:34:15.991322 2026] [:error] [pid 42197:tid 42209] [client 20.63.33.98:9226] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ahIBN6IG0JRyocIl2y89_AAAAMo"]
[Sun May 24 03:34:16.459824 2026] [:error] [pid 42197:tid 42204] [client 20.63.33.98:11479] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ahIBOKIG0JRyocIl2y89_gAAAMU"]
[Sun May 24 03:34:16.901917 2026] [:error] [pid 42006:tid 42093] [client 20.63.33.98:59342] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-the.php"] [unique_id "ahIBOI_b7rIKIkITfyGvAwAAAAk"]
[Sun May 24 03:34:17.325963 2026] [:error] [pid 42197:tid 42219] [client 20.63.33.98:17953] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ahIBOaIG0JRyocIl2y8-AgAAANQ"]
[Sun May 24 03:34:17.742960 2026] [:error] [pid 42006:tid 42099] [client 20.63.33.98:48853] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ahIBOY_b7rIKIkITfyGvBgAAAA8"]
[Sun May 24 03:34:18.198109 2026] [:error] [pid 42006:tid 42105] [client 20.63.33.98:38831] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ahIBOo_b7rIKIkITfyGvBwAAABU"]
[Sun May 24 03:34:18.611999 2026] [:error] [pid 42010:tid 42138] [client 20.63.33.98:52820] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ff1.php"] [unique_id "ahIBOgE3Qc65z6z90S9sBAAAAIA"]
[Sun May 24 03:34:19.048856 2026] [:error] [pid 42197:tid 42201] [client 20.63.33.98:48891] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahIBO6IG0JRyocIl2y8-CAAAAMI"]
[Sun May 24 03:34:19.470511 2026] [:error] [pid 42197:tid 42223] [client 20.63.33.98:48856] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahIBO6IG0JRyocIl2y8-CgAAANg"]
[Sun May 24 03:34:19.893956 2026] [:error] [pid 42197:tid 42219] [client 20.63.33.98:38788] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahIBO6IG0JRyocIl2y8-DAAAANQ"]
[Sun May 24 03:34:20.393222 2026] [:error] [pid 42006:tid 42107] [client 20.63.33.98:52833] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahIBPI_b7rIKIkITfyGvCAAAABc"]
[Sun May 24 03:34:20.810868 2026] [:error] [pid 42010:tid 42152] [client 20.63.33.98:59330] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "ahIBPAE3Qc65z6z90S9sCAAAAI4"]
[Sun May 24 03:34:21.392730 2026] [:error] [pid 42197:tid 42205] [client 20.63.33.98:63880] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "ahIBPaIG0JRyocIl2y8-DwAAAMY"]
[Sun May 24 03:34:21.808574 2026] [:error] [pid 42010:tid 42147] [client 20.63.33.98:41186] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "ahIBPQE3Qc65z6z90S9sCQAAAIk"]
[Sun May 24 03:34:22.370914 2026] [:error] [pid 42009:tid 42132] [client 20.63.33.98:38839] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/Okxob.php"] [unique_id "ahIBPgXVSzrAx_1X5pVN2gAAAFU"]
[Sun May 24 03:34:22.867171 2026] [:error] [pid 42009:tid 42124] [client 20.63.33.98:11495] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "ahIBPgXVSzrAx_1X5pVN2wAAAE0"]
[Sun May 24 03:34:23.342274 2026] [:error] [pid 42006:tid 42090] [client 20.63.33.98:11486] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "ahIBP4_b7rIKIkITfyGvDAAAAAY"]
[Sun May 24 03:34:23.796722 2026] [:error] [pid 42006:tid 42104] [client 20.63.33.98:38847] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "ahIBP4_b7rIKIkITfyGvDgAAABQ"]
[Sun May 24 03:34:24.212905 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:52808] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pass4.php"] [unique_id "ahIBQAE3Qc65z6z90S9sDQAAAIg"]
[Sun May 24 03:34:24.658323 2026] [:error] [pid 42197:tid 42211] [client 20.63.33.98:17682] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-su.php"] [unique_id "ahIBQKIG0JRyocIl2y8-FQAAAMw"]
[Sun May 24 03:34:25.071601 2026] [:error] [pid 42010:tid 42149] [client 20.63.33.98:48286] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-su.php"] [unique_id "ahIBQQE3Qc65z6z90S9sDwAAAIs"]
[Sun May 24 03:34:25.543044 2026] [:error] [pid 42006:tid 42085] [client 20.63.33.98:38817] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-su.php"] [unique_id "ahIBQY_b7rIKIkITfyGvEgAAAAE"]
[Sun May 24 03:34:25.972382 2026] [:error] [pid 42006:tid 42088] [client 20.63.33.98:17946] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-su.php"] [unique_id "ahIBQY_b7rIKIkITfyGvEwAAAAQ"]
[Sun May 24 03:34:26.391337 2026] [:error] [pid 42006:tid 42106] [client 20.63.33.98:11459] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "ahIBQo_b7rIKIkITfyGvFAAAABY"]
[Sun May 24 03:34:26.886438 2026] [:error] [pid 42197:tid 42208] [client 20.63.33.98:48836] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "ahIBQqIG0JRyocIl2y8-HAAAAMk"]
[Sun May 24 03:34:27.301844 2026] [:error] [pid 42006:tid 42108] [client 20.63.33.98:9259] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "ahIBQ4_b7rIKIkITfyGvFwAAABg"]
[Sun May 24 03:34:27.719828 2026] [:error] [pid 42006:tid 42096] [client 20.63.33.98:11509] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/like.php"] [unique_id "ahIBQ4_b7rIKIkITfyGvGQAAAAw"]
[Sun May 24 03:34:28.183596 2026] [:error] [pid 42010:tid 42144] [client 20.63.33.98:56507] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mass.php"] [unique_id "ahIBRAE3Qc65z6z90S9sEAAAAIY"]
[Sun May 24 03:34:28.602820 2026] [:error] [pid 42006:tid 42102] [client 20.63.33.98:17980] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mass.php"] [unique_id "ahIBRI_b7rIKIkITfyGvHAAAABI"]
[Sun May 24 03:34:29.045627 2026] [:error] [pid 42197:tid 42200] [client 20.63.33.98:51640] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mass.php"] [unique_id "ahIBRaIG0JRyocIl2y8-IgAAAME"]
[Sun May 24 03:34:29.461481 2026] [:error] [pid 42006:tid 42085] [client 20.63.33.98:52816] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mass.php"] [unique_id "ahIBRY_b7rIKIkITfyGvHwAAAAE"]
[Sun May 24 03:34:29.887962 2026] [:error] [pid 42010:tid 42140] [client 20.63.33.98:62539] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i.php"] [unique_id "ahIBRQE3Qc65z6z90S9sFAAAAII"]
[Sun May 24 03:34:30.305561 2026] [:error] [pid 42197:tid 42201] [client 20.63.33.98:17715] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i.php"] [unique_id "ahIBRqIG0JRyocIl2y8-JQAAAMI"]
[Sun May 24 03:34:30.723147 2026] [:error] [pid 42006:tid 42098] [client 20.63.33.98:52856] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i.php"] [unique_id "ahIBRo_b7rIKIkITfyGvIQAAAA4"]
[Sun May 24 03:34:31.140349 2026] [:error] [pid 42010:tid 42146] [client 20.63.33.98:38814] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/i.php"] [unique_id "ahIBRwE3Qc65z6z90S9sFgAAAIg"]
[Sun May 24 03:34:31.554970 2026] [:error] [pid 42010:tid 42151] [client 20.63.33.98:38826] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahIBRwE3Qc65z6z90S9sGAAAAI0"]
[Sun May 24 03:34:32.010251 2026] [:error] [pid 42010:tid 42144] [client 20.63.33.98:9247] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahIBSAE3Qc65z6z90S9sGgAAAIY"]
[Sun May 24 03:34:32.440694 2026] [:error] [pid 42010:tid 42138] [client 20.63.33.98:9279] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahIBSAE3Qc65z6z90S9sGwAAAIA"]
[Sun May 24 03:34:32.858806 2026] [:error] [pid 42010:tid 42155] [client 20.63.33.98:11504] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahIBSAE3Qc65z6z90S9sHQAAAJE"]
[Sun May 24 03:34:33.315898 2026] [:error] [pid 42010:tid 42141] [client 20.63.33.98:38807] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/la.php"] [unique_id "ahIBSQE3Qc65z6z90S9sHwAAAIM"]
[Sun May 24 03:34:33.889423 2026] [:error] [pid 42197:tid 42205] [client 20.63.33.98:11510] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/la.php"] [unique_id "ahIBSaIG0JRyocIl2y8-KAAAAMY"]
[Sun May 24 03:34:34.721551 2026] [:error] [pid 42197:tid 42201] [client 20.63.33.98:17939] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/la.php"] [unique_id "ahIBSqIG0JRyocIl2y8-LgAAAMI"]
[Sun May 24 03:34:35.171878 2026] [:error] [pid 42009:tid 42115] [client 20.63.33.98:52843] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/la.php"] [unique_id "ahIBSwXVSzrAx_1X5pVN3AAAAEQ"]
[Sun May 24 03:34:35.645245 2026] [:error] [pid 42197:tid 42213] [client 20.63.33.98:38845] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahIBS6IG0JRyocIl2y8-MQAAAM4"]
[Sun May 24 03:34:36.367749 2026] [:error] [pid 42197:tid 42205] [client 20.63.33.98:38822] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahIBTKIG0JRyocIl2y8-MwAAAMY"]
[Sun May 24 03:34:36.989409 2026] [:error] [pid 42010:tid 42156] [client 20.63.33.98:17940] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahIBTAE3Qc65z6z90S9sJQAAAJI"]
[Sun May 24 03:34:37.555244 2026] [:error] [pid 42009:tid 42131] [client 20.63.33.98:17676] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahIBTQXVSzrAx_1X5pVN3wAAAFQ"]
[Sun May 24 03:34:38.058002 2026] [:error] [pid 42009:tid 42121] [client 20.63.33.98:18664] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/database.php"] [unique_id "ahIBTgXVSzrAx_1X5pVN4QAAAEo"]
[Sun May 24 03:34:39.673708 2026] [:error] [pid 42009:tid 42130] [client 20.63.33.98:38846] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/database.php"] [unique_id "ahIBTwXVSzrAx_1X5pVN6AAAAFM"]
[Sun May 24 03:34:41.102463 2026] [:error] [pid 42006:tid 42104] [client 20.63.33.98:59357] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/database.php"] [unique_id "ahIBUY_b7rIKIkITfyGvLwAAABQ"]
[Sun May 24 03:34:42.057046 2026] [:error] [pid 42197:tid 42204] [client 20.63.33.98:17971] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/database.php"] [unique_id "ahIBUqIG0JRyocIl2y8-QAAAAMU"]
[Sun May 24 03:34:42.747270 2026] [:error] [pid 42197:tid 42223] [client 20.63.33.98:17669] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.php"] [unique_id "ahIBUqIG0JRyocIl2y8-RQAAANg"]
[Sun May 24 03:34:43.352038 2026] [:error] [pid 42010:tid 42140] [client 20.63.33.98:17923] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.php"] [unique_id "ahIBUwE3Qc65z6z90S9sJgAAAII"]
[Sun May 24 03:34:43.934797 2026] [:error] [pid 42006:tid 42106] [client 20.63.33.98:59331] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.php"] [unique_id "ahIBU4_b7rIKIkITfyGvMAAAABY"]
[Sun May 24 03:34:44.382761 2026] [:error] [pid 42197:tid 42210] [client 20.63.33.98:11499] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/favicon.php"] [unique_id "ahIBVKIG0JRyocIl2y8-SgAAAMs"]
[Sun May 24 06:01:47.939915 2026] [:error] [pid 58521:tid 58536] [client 51.75.119.168:50494] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ahIjy2u03QVCX-cF2G_SzgAAAQ0"]
[Sun May 24 06:01:49.540183 2026] [:error] [pid 58797:tid 58822] [client 51.75.119.168:57766] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ahIjzfzoIKLVypLB5NgljAAAAVY"]
[Sun May 24 06:01:51.984609 2026] [:error] [pid 58918:tid 58924] [client 51.75.119.168:56088] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ahIjz6T5tvv40jh4HYYJkQAAAYQ"]
[Sun May 24 06:01:54.406449 2026] [:error] [pid 58797:tid 58816] [client 51.75.119.168:56102] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ahIj0vzoIKLVypLB5NglkAAAAVA"]
[Sun May 24 06:01:56.829799 2026] [:error] [pid 58521:tid 58533] [client 51.75.119.168:56112] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ahIj1Gu03QVCX-cF2G_S1QAAAQo"]
[Sun May 24 06:01:59.253481 2026] [:error] [pid 58521:tid 58538] [client 51.75.119.168:46790] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ahIj12u03QVCX-cF2G_S2AAAAQ8"]
[Sun May 24 06:02:01.796691 2026] [:error] [pid 58797:tid 58806] [client 51.75.119.168:46804] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ahIj2fzoIKLVypLB5NgllwAAAUY"]
[Sun May 24 06:02:04.217575 2026] [:error] [pid 58521:tid 58542] [client 51.75.119.168:46818] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahIj3Gu03QVCX-cF2G_S4QAAARM"]
[Sun May 24 06:02:06.622225 2026] [:error] [pid 58797:tid 58819] [client 51.75.119.168:46832] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahIj3vzoIKLVypLB5NglmwAAAVM"]
[Sun May 24 06:02:09.074519 2026] [:error] [pid 50871:tid 50898] [client 51.75.119.168:40038] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahIj4ecdOvA3ACH24lebZwAAABE"]
[Sun May 24 06:02:11.606510 2026] [:error] [pid 50873:tid 50941] [client 51.75.119.168:40054] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahIj4-lYxsqwDcWZbhLNIwAAAIE"]
[Sun May 24 06:02:14.025375 2026] [:error] [pid 50978:tid 51009] [client 51.75.119.168:40056] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahIj5iu0qFnUKJJuyO6BBgAAANY"]
[Sun May 24 06:02:16.555031 2026] [:error] [pid 50978:tid 51001] [client 51.75.119.168:40068] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahIj6Cu0qFnUKJJuyO6BCQAAAM4"]
[Sun May 24 06:02:18.385936 2026] [:error] [pid 58521:tid 58537] [client 51.75.119.168:41356] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahIj6mu03QVCX-cF2G_S6QAAAQ4"]
[Sun May 24 06:02:20.848027 2026] [:error] [pid 58918:tid 58921] [client 51.75.119.168:37468] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahIj7KT5tvv40jh4HYYJswAAAYE"]
[Sun May 24 06:02:23.387889 2026] [:error] [pid 50978:tid 50986] [client 51.75.119.168:37480] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahIj7yu0qFnUKJJuyO6BEAAAAME"]
[Sun May 24 06:02:25.369994 2026] [:error] [pid 50978:tid 51008] [client 51.75.119.168:41366] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahIj8Su0qFnUKJJuyO6BEwAAANU"]
[Sun May 24 06:02:27.827107 2026] [:error] [pid 58521:tid 58532] [client 51.75.119.168:37490] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahIj82u03QVCX-cF2G_S7QAAAQk"]
[Sun May 24 06:02:30.345793 2026] [:error] [pid 58521:tid 58535] [client 51.75.119.168:34906] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahIj9mu03QVCX-cF2G_S8QAAAQw"]
[Sun May 24 06:02:32.354547 2026] [:error] [pid 50871:tid 50890] [client 51.75.119.168:53718] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahIj-OcdOvA3ACH24lebawAAAAk"]
[Sun May 24 06:02:34.776923 2026] [:error] [pid 50873:tid 50960] [client 51.75.119.168:34920] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahIj-ulYxsqwDcWZbhLNLgAAAJQ"]
[Sun May 24 06:02:36.779813 2026] [:error] [pid 50873:tid 50961] [client 51.75.119.168:53728] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahIj_OlYxsqwDcWZbhLNMAAAAJU"]
[Sun May 24 06:02:39.237871 2026] [:error] [pid 50873:tid 50941] [client 51.75.119.168:43182] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahIj_-lYxsqwDcWZbhLNMQAAAIE"]
[Sun May 24 06:02:41.763941 2026] [:error] [pid 50873:tid 50942] [client 51.75.119.168:43184] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahIkAelYxsqwDcWZbhLNNAAAAII"]
[Sun May 24 06:02:43.729804 2026] [:error] [pid 58797:tid 58802] [client 51.75.119.168:47710] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ahIkA_zoIKLVypLB5NglvQAAAUI"]
[Sun May 24 06:03:04.920939 2026] [:error] [pid 58797:tid 58819] [client 51.75.119.168:43190] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahIkGPzoIKLVypLB5Ngl6gAAAVM"]
[Sun May 24 06:03:07.334597 2026] [:error] [pid 58918:tid 58925] [client 51.75.119.168:40212] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahIkG6T5tvv40jh4HYYJ7wAAAYU"]
[Sun May 24 06:03:09.879353 2026] [:error] [pid 58918:tid 58931] [client 51.75.119.168:46328] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahIkHaT5tvv40jh4HYYJ_AAAAYs"]
[Sun May 24 06:03:12.388038 2026] [:error] [pid 58918:tid 58943] [client 51.75.119.168:46344] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahIkIKT5tvv40jh4HYYKAwAAAZc"]
[Sun May 24 06:03:14.769372 2026] [:error] [pid 58521:tid 58536] [client 51.75.119.168:46352] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahIkImu03QVCX-cF2G_TQwAAAQ0"]
[Sun May 24 06:03:17.273700 2026] [:error] [pid 50872:tid 50922] [client 51.75.119.168:46368] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahIkJUbX_GQ5p_34ISZYpQAAAEk"]
[Sun May 24 06:03:19.801687 2026] [:error] [pid 50872:tid 50926] [client 51.75.119.168:46324] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahIkJ0bX_GQ5p_34ISZYpwAAAE0"]
[Sun May 24 06:03:22.441297 2026] [:error] [pid 50872:tid 50913] [client 51.75.119.168:46330] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahIkKkbX_GQ5p_34ISZYqAAAAEA"]
[Sun May 24 06:03:24.948059 2026] [:error] [pid 50873:tid 50957] [client 51.75.119.168:46346] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahIkLOlYxsqwDcWZbhLNQQAAAJE"]
[Sun May 24 06:03:27.466640 2026] [:error] [pid 58797:tid 58822] [client 51.75.119.168:46350] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahIkL_zoIKLVypLB5Ngl7gAAAVY"]
[Sun May 24 06:03:29.843789 2026] [:error] [pid 50978:tid 50989] [client 51.75.119.168:54674] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahIkMSu0qFnUKJJuyO6BHQAAAMQ"]
[Sun May 24 06:03:32.380234 2026] [:error] [pid 50871:tid 50884] [client 51.75.119.168:54686] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahIkNOcdOvA3ACH24lebfwAAAAQ"]
[Sun May 24 06:03:34.891520 2026] [:error] [pid 58918:tid 58937] [client 51.75.119.168:54690] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahIkNqT5tvv40jh4HYYKJwAAAZE"]
[Sun May 24 06:03:37.402389 2026] [:error] [pid 58521:tid 58534] [client 51.75.119.168:54706] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahIkOWu03QVCX-cF2G_TRwAAAQs"]
[Sun May 24 06:03:39.919973 2026] [:error] [pid 50872:tid 50917] [client 51.75.119.168:60716] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahIkO0bX_GQ5p_34ISZYrwAAAEQ"]
[Sun May 24 06:03:42.579709 2026] [:error] [pid 50978:tid 50986] [client 51.75.119.168:60728] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahIkPiu0qFnUKJJuyO6BKAAAAME"]
[Sun May 24 06:03:45.135291 2026] [:error] [pid 50872:tid 50929] [client 51.75.119.168:60744] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahIkQUbX_GQ5p_34ISZYsAAAAFA"]
[Sun May 24 06:03:47.639986 2026] [:error] [pid 58521:tid 58545] [client 51.75.119.168:60752] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahIkQ2u03QVCX-cF2G_TSwAAARY"]
[Sun May 24 06:03:50.036992 2026] [:error] [pid 50873:tid 50953] [client 51.75.119.168:54332] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahIkRulYxsqwDcWZbhLNSQAAAI0"]
[Sun May 24 06:03:52.520905 2026] [:error] [pid 50873:tid 50956] [client 51.75.119.168:54340] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahIkSOlYxsqwDcWZbhLNSwAAAJA"]
[Sun May 24 06:03:55.039100 2026] [:error] [pid 50872:tid 50920] [client 51.75.119.168:54356] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahIkS0bX_GQ5p_34ISZYugAAAEc"]
[Sun May 24 06:03:57.683379 2026] [:error] [pid 50978:tid 50992] [client 51.75.119.168:54370] [client 51.75.119.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahIkTSu0qFnUKJJuyO6BMQAAAMc"]
[Sun May 24 09:02:40.370311 2026] [:error] [pid 58918:tid 58934] [client 112.32.119.208:14148] [client 112.32.119.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahJOMKT5tvv40jh4HYZHHQAAAY4"], referer: http://switchcreative.net/
[Sun May 24 10:57:19.003638 2026] [:error] [pid 49688:tid 49707] [client 15.223.239.19:39548] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ahJpD2YoQ9V6a_4pBshxEQAAAFA"]
[Sun May 24 10:57:20.261968 2026] [:error] [pid 49689:tid 49733] [client 15.223.239.19:52974] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/credentials"] [unique_id "ahJpEAaxiY3NxLUD97Us_gAAAI8"]
[Sun May 24 10:57:21.560313 2026] [:error] [pid 49689:tid 49732] [client 15.223.239.19:52982] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ahJpEQaxiY3NxLUD97UtAgAAAI4"]
[Sun May 24 10:57:22.913946 2026] [:error] [pid 49775:tid 49794] [client 15.223.239.19:52986] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "ahJpEovZb8G6T8WpI1g6tgAAABE"]
[Sun May 24 10:57:23.894346 2026] [:error] [pid 49775:tid 49791] [client 15.223.239.19:52996] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production"] [unique_id "ahJpE4vZb8G6T8WpI1g6twAAAA4"]
[Sun May 24 10:57:24.774286 2026] [:error] [pid 49744:tid 49751] [client 15.223.239.19:53012] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.staging"] [unique_id "ahJpFDsE5kPdFpUbbHF9agAAAMU"]
[Sun May 24 10:57:25.639145 2026] [:error] [pid 49744:tid 49770] [client 15.223.239.19:53022] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development"] [unique_id "ahJpFTsE5kPdFpUbbHF9bAAAANg"]
[Sun May 24 10:57:26.693293 2026] [:error] [pid 2639:tid 2644] [client 15.223.239.19:53038] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.test"] [unique_id "ahJpFkzQncQTd0Z0Oe_1TQAAAQM"]
[Sun May 24 10:57:27.659211 2026] [:error] [pid 49775:tid 49800] [client 15.223.239.19:53052] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.remote"] [unique_id "ahJpF4vZb8G6T8WpI1g6vwAAABc"]
[Sun May 24 10:57:28.661343 2026] [:error] [pid 2639:tid 2662] [client 15.223.239.19:57884] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.bak"] [unique_id "ahJpGEzQncQTd0Z0Oe_1UAAAARU"]
[Sun May 24 10:57:29.879475 2026] [:error] [pid 49689:tid 49731] [client 15.223.239.19:57890] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.backup"] [unique_id "ahJpGQaxiY3NxLUD97UtCQAAAI0"]
[Sun May 24 10:57:30.899662 2026] [:error] [pid 49689:tid 49728] [client 15.223.239.19:57906] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.save"] [unique_id "ahJpGgaxiY3NxLUD97UtCwAAAIo"]
[Sun May 24 10:57:31.835288 2026] [:error] [pid 49775:tid 49777] [client 15.223.239.19:57910] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.old"] [unique_id "ahJpG4vZb8G6T8WpI1g6yAAAAAA"]
[Sun May 24 10:57:32.937368 2026] [:error] [pid 49775:tid 49800] [client 15.223.239.19:57926] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.sample"] [unique_id "ahJpHIvZb8G6T8WpI1g6ygAAABc"]
[Sun May 24 10:57:33.879934 2026] [:error] [pid 2639:tid 2663] [client 15.223.239.19:57942] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.example"] [unique_id "ahJpHUzQncQTd0Z0Oe_1YAAAARY"]
[Sun May 24 10:57:34.868669 2026] [:error] [pid 49744:tid 49747] [client 15.223.239.19:57950] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "ahJpHjsE5kPdFpUbbHF9dAAAAME"]
[Sun May 24 10:57:35.853444 2026] [:error] [pid 49688:tid 49695] [client 15.223.239.19:57954] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.prod"] [unique_id "ahJpH2YoQ9V6a_4pBshxGAAAAEQ"]
[Sun May 24 10:57:36.845589 2026] [:error] [pid 49744:tid 49770] [client 15.223.239.19:57968] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.stage"] [unique_id "ahJpIDsE5kPdFpUbbHF9dgAAANg"]
[Sun May 24 10:57:37.938391 2026] [:error] [pid 49744:tid 49768] [client 15.223.239.19:57974] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.ci"] [unique_id "ahJpITsE5kPdFpUbbHF9dwAAANY"]
[Sun May 24 10:57:39.040153 2026] [:error] [pid 49688:tid 49711] [client 15.223.239.19:54554] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "ahJpI2YoQ9V6a_4pBshxHAAAAFQ"]
[Sun May 24 10:57:40.041276 2026] [:error] [pid 2639:tid 2665] [client 15.223.239.19:54562] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.live"] [unique_id "ahJpJEzQncQTd0Z0Oe_1dwAAARg"]
[Sun May 24 10:57:41.029446 2026] [:error] [pid 49775:tid 49795] [client 15.223.239.19:54572] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.preprod"] [unique_id "ahJpJYvZb8G6T8WpI1g64gAAABI"]
[Sun May 24 10:57:42.036441 2026] [:error] [pid 49688:tid 49698] [client 15.223.239.19:54588] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.uat"] [unique_id "ahJpJmYoQ9V6a_4pBshxJQAAAEc"]
[Sun May 24 10:57:42.985091 2026] [:error] [pid 49744:tid 49762] [client 15.223.239.19:54592] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dist"] [unique_id "ahJpJjsE5kPdFpUbbHF9eQAAANA"]
[Sun May 24 10:57:43.958011 2026] [:error] [pid 49775:tid 49797] [client 15.223.239.19:54602] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.swp"] [unique_id "ahJpJ4vZb8G6T8WpI1g67QAAABQ"]
[Sun May 24 10:57:45.118997 2026] [:error] [pid 49688:tid 49693] [client 15.223.239.19:54608] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env~"] [unique_id "ahJpKWYoQ9V6a_4pBshxLwAAAEI"]
[Sun May 24 10:57:46.104643 2026] [:error] [pid 2639:tid 2645] [client 15.223.239.19:54622] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env1"] [unique_id "ahJpKkzQncQTd0Z0Oe_1jQAAAQQ"]
[Sun May 24 10:57:47.017827 2026] [:error] [pid 49689:tid 49719] [client 15.223.239.19:54626] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env2"] [unique_id "ahJpKwaxiY3NxLUD97UtGAAAAIE"]
[Sun May 24 10:57:48.080098 2026] [:error] [pid 49775:tid 49796] [client 15.223.239.19:54642] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_copy"] [unique_id "ahJpLIvZb8G6T8WpI1g68wAAABM"]
[Sun May 24 10:57:49.090069 2026] [:error] [pid 2639:tid 2654] [client 15.223.239.19:58672] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.txt"] [unique_id "ahJpLUzQncQTd0Z0Oe_1kQAAAQ0"]
[Sun May 24 10:57:50.200115 2026] [:error] [pid 49775:tid 49794] [client 15.223.239.19:58674] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.json"] [unique_id "ahJpLovZb8G6T8WpI1g69wAAABE"]
[Sun May 24 10:57:53.742091 2026] [:error] [pid 2639:tid 2657] [client 15.223.239.19:58684] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yaml"] [unique_id "ahJpMUzQncQTd0Z0Oe_1ngAAARA"]
[Sun May 24 10:57:54.753430 2026] [:error] [pid 2639:tid 2651] [client 15.223.239.19:58688] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yml"] [unique_id "ahJpMkzQncQTd0Z0Oe_1owAAAQo"]
[Sun May 24 10:57:55.837994 2026] [:error] [pid 49744:tid 49762] [client 15.223.239.19:58694] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ahJpMzsE5kPdFpUbbHF9ggAAANA"]
[Sun May 24 10:57:56.998125 2026] [:error] [pid 49775:tid 49798] [client 15.223.239.19:58708] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/apps/.env"] [unique_id "ahJpNIvZb8G6T8WpI1g7CAAAABU"]
[Sun May 24 10:57:58.091137 2026] [:error] [pid 49689:tid 49724] [client 15.223.239.19:58710] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "ahJpNgaxiY3NxLUD97UtIwAAAIY"]
[Sun May 24 10:57:59.345753 2026] [:error] [pid 49775:tid 49796] [client 15.223.239.19:46226] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/web/.env"] [unique_id "ahJpN4vZb8G6T8WpI1g7CgAAABM"]
[Sun May 24 10:58:00.715629 2026] [:error] [pid 49744:tid 49770] [client 15.223.239.19:46228] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/site/.env"] [unique_id "ahJpODsE5kPdFpUbbHF9igAAANg"]
[Sun May 24 10:58:01.952280 2026] [:error] [pid 49689:tid 49740] [client 15.223.239.19:46244] [client 15.223.239.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/public/.env"] [unique_id "ahJpOQaxiY3NxLUD97UtJQAAAJY"]
[Sun May 24 13:14:30.159613 2026] [:error] [pid 2639:tid 2650] [client 1.15.52.154:45306] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahKJNkzQncQTd0Z0Oe8mCAAAAQk"]
[Sun May 24 13:32:04.571708 2026] [:error] [pid 23497:tid 23516] [client 180.153.236.25:22972] [client 180.153.236.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahKNVCPlV47QcYwd2v-QGQAAAVA"], referer: http://switchcreative.net/
[Sun May 24 13:50:19.025554 2026] [:error] [pid 23497:tid 23519] [client 54.37.84.47:49832] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahKRmyPlV47QcYwd2v-XNwAAAVM"]
[Sun May 24 13:50:21.022953 2026] [:error] [pid 23497:tid 23506] [client 54.37.84.47:55762] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahKRnSPlV47QcYwd2v-XQAAAAUY"]
[Sun May 24 13:50:22.897757 2026] [:error] [pid 23497:tid 23518] [client 54.37.84.47:55776] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahKRniPlV47QcYwd2v-XTgAAAVI"]
[Sun May 24 13:50:24.919279 2026] [:error] [pid 49775:tid 49797] [client 54.37.84.47:55792] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahKRoIvZb8G6T8WpI1hqIwAAABQ"]
[Sun May 24 13:50:26.782656 2026] [:error] [pid 49744:tid 49755] [client 54.37.84.47:49356] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahKRojsE5kPdFpUbbHGlYwAAAMk"]
[Sun May 24 13:50:28.800952 2026] [:error] [pid 23497:tid 23520] [client 54.37.84.47:49364] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahKRpCPlV47QcYwd2v-XVwAAAVQ"]
[Sun May 24 13:50:30.809903 2026] [:error] [pid 2639:tid 2651] [client 54.37.84.47:49366] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahKRpkzQncQTd0Z0Oe8wJQAAAQo"]
[Sun May 24 13:50:32.830021 2026] [:error] [pid 2639:tid 2658] [client 54.37.84.47:49380] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahKRqEzQncQTd0Z0Oe8wKAAAARE"]
[Sun May 24 13:50:34.846609 2026] [:error] [pid 2639:tid 2648] [client 54.37.84.47:49384] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahKRqkzQncQTd0Z0Oe8wLwAAAQc"]
[Sun May 24 13:50:36.878744 2026] [:error] [pid 49689:tid 49728] [client 54.37.84.47:38024] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahKRrAaxiY3NxLUD97VQtwAAAIo"]
[Sun May 24 13:50:38.891715 2026] [:error] [pid 23497:tid 23516] [client 54.37.84.47:38028] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahKRriPlV47QcYwd2v-XXwAAAVA"]
[Sun May 24 13:50:40.913538 2026] [:error] [pid 23497:tid 23507] [client 54.37.84.47:38040] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ahKRsCPlV47QcYwd2v-XZAAAAUc"]
[Sun May 24 13:50:42.925556 2026] [:error] [pid 23497:tid 23501] [client 54.37.84.47:38048] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahKRsiPlV47QcYwd2v-XbgAAAUE"]
[Sun May 24 13:50:44.932640 2026] [:error] [pid 2639:tid 2665] [client 54.37.84.47:38052] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahKRtEzQncQTd0Z0Oe8wRAAAARg"]
[Sun May 24 13:50:46.951685 2026] [:error] [pid 2639:tid 2658] [client 54.37.84.47:41138] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahKRtkzQncQTd0Z0Oe8wTQAAARE"]
[Sun May 24 13:50:48.954377 2026] [:error] [pid 49688:tid 49693] [client 54.37.84.47:41142] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahKRuGYoQ9V6a_4pBsiPXgAAAEI"]
[Sun May 24 13:50:50.967140 2026] [:error] [pid 49689:tid 49741] [client 54.37.84.47:41158] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahKRugaxiY3NxLUD97VQxAAAAJc"]
[Sun May 24 13:50:52.972870 2026] [:error] [pid 49689:tid 49727] [client 54.37.84.47:41174] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahKRvAaxiY3NxLUD97VQxgAAAIk"]
[Sun May 24 13:50:54.968310 2026] [:error] [pid 2639:tid 2651] [client 54.37.84.47:41190] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahKRvkzQncQTd0Z0Oe8wYgAAAQo"]
[Sun May 24 13:50:56.962102 2026] [:error] [pid 2639:tid 2659] [client 54.37.84.47:53368] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahKRwEzQncQTd0Z0Oe8wawAAARI"]
[Sun May 24 13:50:58.956614 2026] [:error] [pid 23497:tid 23520] [client 54.37.84.47:53378] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahKRwiPlV47QcYwd2v-XfAAAAVQ"]
[Sun May 24 13:51:00.951931 2026] [:error] [pid 49775:tid 49786] [client 54.37.84.47:53388] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahKRxIvZb8G6T8WpI1hqPgAAAAk"]
[Sun May 24 13:51:02.970033 2026] [:error] [pid 49775:tid 49784] [client 54.37.84.47:53402] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahKRxovZb8G6T8WpI1hqRgAAAAc"]
[Sun May 24 13:51:04.966726 2026] [:error] [pid 49775:tid 49793] [client 54.37.84.47:53404] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ahKRyIvZb8G6T8WpI1hqUAAAABA"]
[Sun May 24 13:51:06.956718 2026] [:error] [pid 49744:tid 49765] [client 54.37.84.47:54460] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahKRyjsE5kPdFpUbbHGljAAAANM"]
[Sun May 24 13:51:08.958789 2026] [:error] [pid 49744:tid 49756] [client 54.37.84.47:54464] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ahKRzDsE5kPdFpUbbHGlkgAAAMo"]
[Sun May 24 13:51:10.989979 2026] [:error] [pid 49744:tid 49764] [client 54.37.84.47:54466] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahKRzjsE5kPdFpUbbHGllQAAANI"]
[Sun May 24 13:51:12.969584 2026] [:error] [pid 49688:tid 49710] [client 54.37.84.47:54480] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahKR0GYoQ9V6a_4pBsiPbQAAAFM"]
[Sun May 24 13:51:14.961318 2026] [:error] [pid 2639:tid 2659] [client 54.37.84.47:54490] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahKR0kzQncQTd0Z0Oe8wngAAARI"]
[Sun May 24 13:51:44.262013 2026] [:error] [pid 23497:tid 23505] [client 54.37.84.47:42010] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahKR8CPlV47QcYwd2v-XyAAAAUU"]
[Sun May 24 13:51:46.220155 2026] [:error] [pid 23497:tid 23507] [client 54.37.84.47:42282] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahKR8iPlV47QcYwd2v-XzAAAAUc"]
[Sun May 24 13:51:48.057988 2026] [:error] [pid 2639:tid 2645] [client 54.37.84.47:57390] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahKR9EzQncQTd0Z0Oe8w3wAAAQQ"]
[Sun May 24 13:51:50.076122 2026] [:error] [pid 49775:tid 49791] [client 54.37.84.47:57398] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahKR9ovZb8G6T8WpI1hqbwAAAA4"]
[Sun May 24 13:51:52.060615 2026] [:error] [pid 49775:tid 49790] [client 54.37.84.47:57410] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahKR-IvZb8G6T8WpI1hqcwAAAA0"]
[Sun May 24 13:51:54.050865 2026] [:error] [pid 49744:tid 49747] [client 54.37.84.47:57414] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahKR-jsE5kPdFpUbbHGmCwAAAME"]
[Sun May 24 13:51:56.045883 2026] [:error] [pid 49689:tid 49721] [client 54.37.84.47:57416] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahKR_AaxiY3NxLUD97VRBAAAAIM"]
[Sun May 24 13:51:58.058307 2026] [:error] [pid 2639:tid 2659] [client 54.37.84.47:55702] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahKR_kzQncQTd0Z0Oe8w8wAAARI"]
[Sun May 24 13:52:00.052857 2026] [:error] [pid 2639:tid 2645] [client 54.37.84.47:55712] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahKSAEzQncQTd0Z0Oe8w_QAAAQQ"]
[Sun May 24 13:52:02.066252 2026] [:error] [pid 49775:tid 49790] [client 54.37.84.47:55728] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahKSAovZb8G6T8WpI1hqdwAAAA0"]
[Sun May 24 13:52:04.062832 2026] [:error] [pid 2639:tid 2658] [client 54.37.84.47:55730] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahKSBEzQncQTd0Z0Oe8xEQAAARE"]
[Sun May 24 13:52:06.062562 2026] [:error] [pid 23497:tid 23513] [client 54.37.84.47:55732] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahKSBiPlV47QcYwd2v-X3QAAAU0"]
[Sun May 24 13:52:08.062174 2026] [:error] [pid 2639:tid 2651] [client 54.37.84.47:59428] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahKSCEzQncQTd0Z0Oe8xIwAAAQo"]
[Sun May 24 13:52:09.892845 2026] [:error] [pid 23497:tid 23504] [client 54.37.84.47:59440] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahKSCSPlV47QcYwd2v-X5gAAAUQ"]
[Sun May 24 13:52:11.883867 2026] [:error] [pid 23497:tid 23520] [client 54.37.84.47:59454] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahKSCyPlV47QcYwd2v-X6gAAAVQ"]
[Sun May 24 13:52:13.895346 2026] [:error] [pid 23497:tid 23500] [client 54.37.84.47:59466] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahKSDSPlV47QcYwd2v-X8AAAAUA"]
[Sun May 24 13:52:15.885798 2026] [:error] [pid 2639:tid 2655] [client 54.37.84.47:59478] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahKSD0zQncQTd0Z0Oe8xMwAAAQ4"]
[Sun May 24 13:52:17.882780 2026] [:error] [pid 23497:tid 23510] [client 54.37.84.47:36218] [client 54.37.84.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ahKSESPlV47QcYwd2v-X-AAAAUo"]
[Sun May 24 13:56:27.164124 2026] [:error] [pid 23497:tid 23520] [client 180.153.236.25:52262] [client 180.153.236.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahKTCyPlV47QcYwd2v-ZhgAAAVQ"], referer: http://www.switchcreative.net/
[Sun May 24 14:12:31.080635 2026] [:error] [pid 49689:tid 49724] [client 150.109.119.38:38060] [client 150.109.119.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahKWzwaxiY3NxLUD97VUNAAAAIY"]
[Sun May 24 14:21:17.807808 2026] [:error] [pid 2639:tid 2664] [client 141.94.101.142:40686] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahKY3UzQncQTd0Z0Oe84xQAAARc"]
[Sun May 24 14:21:19.865158 2026] [:error] [pid 2639:tid 2659] [client 141.94.101.142:35372] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahKY30zQncQTd0Z0Oe84ygAAARI"]
[Sun May 24 14:21:22.029332 2026] [:error] [pid 23497:tid 23507] [client 141.94.101.142:35374] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahKY4iPlV47QcYwd2v-jxgAAAUc"]
[Sun May 24 14:21:24.583042 2026] [:error] [pid 23497:tid 23515] [client 141.94.101.142:40840] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahKY5CPlV47QcYwd2v-j1QAAAU8"]
[Sun May 24 14:21:27.331343 2026] [:error] [pid 2639:tid 2645] [client 141.94.101.142:40842] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahKY50zQncQTd0Z0Oe840QAAAQQ"]
[Sun May 24 14:21:29.508263 2026] [:error] [pid 23497:tid 23508] [client 141.94.101.142:42164] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKY6SPlV47QcYwd2v-j5gAAAUg"]
[Sun May 24 14:21:33.471066 2026] [:error] [pid 23497:tid 23520] [client 141.94.101.142:42176] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKY7SPlV47QcYwd2v-j8wAAAVQ"]
[Sun May 24 14:52:19.928600 2026] [:error] [pid 49689:tid 49733] [client 147.135.252.145:45986] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahKgIwaxiY3NxLUD97VbfQAAAI8"]
[Sun May 24 14:52:22.182290 2026] [:error] [pid 49689:tid 49742] [client 147.135.252.145:53810] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahKgJgaxiY3NxLUD97VbgAAAAJg"]
[Sun May 24 14:52:24.160087 2026] [:error] [pid 49689:tid 49726] [client 147.135.252.145:52174] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKgKAaxiY3NxLUD97VbgQAAAIg"]
[Sun May 24 14:52:28.607886 2026] [:error] [pid 49744:tid 49748] [client 147.135.252.145:52182] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKgLDsE5kPdFpUbbHGysQAAAMI"]
[Sun May 24 14:52:31.602314 2026] [:error] [pid 2639:tid 2643] [client 147.135.252.145:47406] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahKgL0zQncQTd0Z0Oe9DNgAAAQI"]
[Sun May 24 14:52:34.427529 2026] [:error] [pid 49689:tid 49730] [client 147.135.252.145:47416] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahKgMgaxiY3NxLUD97VbhAAAAIw"]
[Sun May 24 14:52:36.477191 2026] [:error] [pid 49688:tid 49699] [client 147.135.252.145:47426] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahKgNGYoQ9V6a_4pBsiZoAAAAEg"]
[Sun May 24 14:52:38.611146 2026] [:error] [pid 49689:tid 49727] [client 147.135.252.145:47442] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahKgNgaxiY3NxLUD97VbiAAAAIk"]
[Sun May 24 14:52:40.720933 2026] [:error] [pid 2639:tid 2664] [client 147.135.252.145:59604] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahKgOEzQncQTd0Z0Oe9DPAAAARc"]
[Sun May 24 14:52:42.779947 2026] [:error] [pid 2639:tid 2652] [client 147.135.252.145:59612] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahKgOkzQncQTd0Z0Oe9DPgAAAQs"]
[Sun May 24 14:52:45.058507 2026] [:error] [pid 2639:tid 2643] [client 147.135.252.145:59622] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahKgPUzQncQTd0Z0Oe9DPwAAAQI"]
[Sun May 24 14:52:48.378518 2026] [:error] [pid 23497:tid 23515] [client 147.135.252.145:59630] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahKgQCPlV47QcYwd2v-0lgAAAU8"]
[Sun May 24 14:52:51.752112 2026] [:error] [pid 23497:tid 23517] [client 147.135.252.145:59484] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahKgQyPlV47QcYwd2v-0ngAAAVE"]
[Sun May 24 14:52:53.928250 2026] [:error] [pid 49775:tid 49785] [client 147.135.252.145:59500] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahKgRYvZb8G6T8WpI1h5-wAAAAg"]
[Sun May 24 14:52:56.130083 2026] [:error] [pid 23497:tid 23501] [client 147.135.252.145:59516] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahKgSCPlV47QcYwd2v-0pwAAAUE"]
[Sun May 24 14:52:58.342919 2026] [:error] [pid 23497:tid 23515] [client 147.135.252.145:59524] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ahKgSiPlV47QcYwd2v-0qgAAAU8"]
[Sun May 24 14:53:00.538847 2026] [:error] [pid 23497:tid 23512] [client 147.135.252.145:59530] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahKgTCPlV47QcYwd2v-0rgAAAUw"]
[Sun May 24 14:53:04.633602 2026] [:error] [pid 49775:tid 49799] [client 147.135.252.145:56236] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKgUIvZb8G6T8WpI1h6CQAAABY"]
[Sun May 24 14:53:08.515496 2026] [:error] [pid 23497:tid 23511] [client 147.135.252.145:56252] [client 147.135.252.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKgVCPlV47QcYwd2v-0ugAAAUs"]
[Sun May 24 15:10:57.867767 2026] [:error] [pid 2639:tid 2648] [client 43.130.14.245:56158] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahKkgUzQncQTd0Z0Oe9JTQAAAQc"]
[Sun May 24 15:29:12.662160 2026] [:error] [pid 41708:tid 41730] [client 217.182.139.33:41628] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ahKoyP4tQzoTxpuHBF6dAwAAAZQ"]
[Sun May 24 15:29:14.529866 2026] [:error] [pid 23497:tid 23510] [client 217.182.139.33:59542] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ahKoyiPlV47QcYwd2v_ETAAAAUo"]
[Sun May 24 15:29:16.413982 2026] [:error] [pid 2639:tid 2651] [client 217.182.139.33:59558] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahKozEzQncQTd0Z0Oe9OxAAAAQo"]
[Sun May 24 15:29:18.458331 2026] [:error] [pid 49744:tid 49746] [client 217.182.139.33:59566] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahKozjsE5kPdFpUbbHG5hAAAAMA"]
[Sun May 24 15:29:20.511378 2026] [:error] [pid 2639:tid 2659] [client 217.182.139.33:59578] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahKo0EzQncQTd0Z0Oe9OywAAARI"]
[Sun May 24 15:29:22.413582 2026] [:error] [pid 49688:tid 49706] [client 217.182.139.33:59584] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahKo0mYoQ9V6a_4pBsieVAAAAE8"]
[Sun May 24 15:29:25.008591 2026] [:error] [pid 41708:tid 41724] [client 217.182.139.33:49992] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahKo1f4tQzoTxpuHBF6dDgAAAY4"]
[Sun May 24 15:29:26.820145 2026] [:error] [pid 41708:tid 41732] [client 217.182.139.33:50278] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahKo1v4tQzoTxpuHBF6dFwAAAZY"]
[Sun May 24 15:29:28.726002 2026] [:error] [pid 49689:tid 49719] [client 217.182.139.33:50284] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahKo2AaxiY3NxLUD97Vh8wAAAIE"]
[Sun May 24 15:29:31.166545 2026] [:error] [pid 2639:tid 2654] [client 217.182.139.33:50000] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahKo20zQncQTd0Z0Oe9O1wAAAQ0"]
[Sun May 24 15:29:33.148531 2026] [:error] [pid 49775:tid 49786] [client 217.182.139.33:50294] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ahKo3YvZb8G6T8WpI1iBuQAAAAk"]
[Sun May 24 15:29:35.020425 2026] [:error] [pid 49744:tid 49749] [client 217.182.139.33:53750] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ahKo3zsE5kPdFpUbbHG5jAAAAMM"]
[Sun May 24 15:29:36.920192 2026] [:error] [pid 49744:tid 49758] [client 217.182.139.33:53762] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ahKo4DsE5kPdFpUbbHG5kAAAAMw"]
[Sun May 24 15:29:38.967650 2026] [:error] [pid 2639:tid 2659] [client 217.182.139.33:53778] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahKo4kzQncQTd0Z0Oe9O5wAAARI"]
[Sun May 24 15:29:40.861419 2026] [:error] [pid 49689:tid 49725] [client 217.182.139.33:53782] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ahKo5AaxiY3NxLUD97ViCgAAAIc"]
[Sun May 24 15:29:43.277736 2026] [:error] [pid 49689:tid 49726] [client 217.182.139.33:60438] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahKo5waxiY3NxLUD97ViEAAAAIg"]
[Sun May 24 15:29:45.232427 2026] [:error] [pid 49688:tid 49701] [client 217.182.139.33:57682] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahKo6WYoQ9V6a_4pBsieWgAAAEo"]
[Sun May 24 15:29:47.276375 2026] [:error] [pid 49744:tid 49752] [client 217.182.139.33:57694] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahKo6zsE5kPdFpUbbHG5mgAAAMY"]
[Sun May 24 15:29:49.157528 2026] [:error] [pid 49775:tid 49800] [client 217.182.139.33:57710] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahKo7YvZb8G6T8WpI1iBwQAAABc"]
[Sun May 24 15:29:51.038589 2026] [:error] [pid 2639:tid 2645] [client 217.182.139.33:57712] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahKo70zQncQTd0Z0Oe9O8gAAAQQ"]
[Sun May 24 15:29:53.627917 2026] [:error] [pid 49775:tid 49798] [client 217.182.139.33:44824] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahKo8YvZb8G6T8WpI1iBzQAAABU"]
[Sun May 24 15:29:55.567583 2026] [:error] [pid 49689:tid 49719] [client 217.182.139.33:33622] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahKo8waxiY3NxLUD97ViFgAAAIE"]
[Sun May 24 15:29:57.454381 2026] [:error] [pid 49689:tid 49720] [client 217.182.139.33:33638] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahKo9QaxiY3NxLUD97ViGwAAAII"]
[Sun May 24 15:29:59.483060 2026] [:error] [pid 23497:tid 23505] [client 217.182.139.33:33644] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahKo9yPlV47QcYwd2v_EcgAAAUU"]
[Sun May 24 15:30:01.360391 2026] [:error] [pid 41708:tid 41712] [client 217.182.139.33:33654] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahKo-f4tQzoTxpuHBF6dNQAAAYI"]
[Sun May 24 15:30:03.386711 2026] [:error] [pid 23497:tid 23509] [client 217.182.139.33:35152] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahKo-yPlV47QcYwd2v_EdQAAAUk"]
[Sun May 24 15:30:05.266926 2026] [:error] [pid 2639:tid 2647] [client 217.182.139.33:35156] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahKo_UzQncQTd0Z0Oe9PAQAAAQY"]
[Sun May 24 15:30:07.695839 2026] [:error] [pid 41708:tid 41734] [client 217.182.139.33:55326] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahKo__4tQzoTxpuHBF6dRQAAAZg"]
[Sun May 24 15:30:09.659071 2026] [:error] [pid 41708:tid 41729] [client 217.182.139.33:35170] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahKpAf4tQzoTxpuHBF6dSgAAAZM"]
[Sun May 24 15:30:31.319939 2026] [:error] [pid 23497:tid 23509] [client 217.182.139.33:35184] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahKpFyPlV47QcYwd2v_E_gAAAUk"]
[Sun May 24 15:30:33.056515 2026] [:error] [pid 41708:tid 41733] [client 217.182.139.33:41776] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahKpGf4tQzoTxpuHBF6dpAAAAZc"]
[Sun May 24 15:30:34.915982 2026] [:error] [pid 23497:tid 23518] [client 217.182.139.33:47172] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ahKpGiPlV47QcYwd2v_FBgAAAVI"]
[Sun May 24 15:30:37.369083 2026] [:error] [pid 49688:tid 49711] [client 217.182.139.33:60474] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20c4.aspx"] [unique_id "ahKpHWYoQ9V6a_4pBsieiwAAAFQ"]
[Sun May 24 15:30:39.228813 2026] [:error] [pid 23497:tid 23508] [client 217.182.139.33:47174] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahKpHyPlV47QcYwd2v_FDwAAAUg"]
[Sun May 24 15:30:41.670471 2026] [:error] [pid 41708:tid 41711] [client 217.182.139.33:60480] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahKpIf4tQzoTxpuHBF6drwAAAYE"]
[Sun May 24 15:30:43.628027 2026] [:error] [pid 41708:tid 41732] [client 217.182.139.33:33868] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahKpI_4tQzoTxpuHBF6dtQAAAZY"]
[Sun May 24 15:30:45.548842 2026] [:error] [pid 2639:tid 2643] [client 217.182.139.33:33878] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahKpJUzQncQTd0Z0Oe9PXwAAAQI"]
[Sun May 24 15:30:47.990906 2026] [:error] [pid 41708:tid 41716] [client 217.182.139.33:42782] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahKpJ_4tQzoTxpuHBF6dvAAAAYY"]
[Sun May 24 15:30:49.814999 2026] [:error] [pid 49744:tid 49769] [client 217.182.139.33:33888] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahKpKTsE5kPdFpUbbHG5vwAAANc"]
[Sun May 24 15:30:51.842857 2026] [:error] [pid 41708:tid 41729] [client 217.182.139.33:33892] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahKpK_4tQzoTxpuHBF6dwwAAAZM"]
[Sun May 24 15:30:55.561167 2026] [:error] [pid 49689:tid 49729] [client 217.182.139.33:54000] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKpLwaxiY3NxLUD97ViUwAAAIs"]
[Sun May 24 15:30:59.378784 2026] [:error] [pid 41708:tid 41728] [client 217.182.139.33:54016] [client 217.182.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahKpM_4tQzoTxpuHBF6d0gAAAZI"]
[Sun May 24 16:44:19.335226 2026] [:error] [pid 41708:tid 41733] [client 51.68.234.131:40178] [client 51.68.234.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahK6Y_4tQzoTxpuHBF64swAAAZc"]
[Sun May 24 16:44:22.904987 2026] [:error] [pid 23497:tid 23509] [client 51.68.234.131:60564] [client 51.68.234.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahK6ZiPlV47QcYwd2v_WBAAAAUk"]
[Sun May 24 16:44:28.246522 2026] [:error] [pid 23497:tid 23513] [client 51.68.234.131:60566] [client 51.68.234.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahK6bCPlV47QcYwd2v_WDQAAAU0"]
[Sun May 24 18:06:13.577526 2026] [:error] [pid 49775:tid 49785] [client 51.91.242.106:37930] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahLNlYvZb8G6T8WpI1iXmAAAAAg"]
[Sun May 24 18:06:16.110196 2026] [:error] [pid 49775:tid 49798] [client 51.91.242.106:53192] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahLNmIvZb8G6T8WpI1iXnAAAABU"]
[Sun May 24 18:06:18.877097 2026] [:error] [pid 49775:tid 49777] [client 51.91.242.106:34594] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahLNmovZb8G6T8WpI1iXpQAAAAA"]
[Sun May 24 18:06:21.554200 2026] [:error] [pid 49744:tid 49769] [client 51.91.242.106:34602] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahLNnTsE5kPdFpUbbHHNvQAAANc"]
[Sun May 24 18:06:24.161743 2026] [:error] [pid 4777:tid 4800] [client 51.91.242.106:34616] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahLNoPtPctoQOm4w5pNwYgAAAdI"]
[Sun May 24 18:06:26.838134 2026] [:error] [pid 41708:tid 41715] [client 51.91.242.106:34632] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahLNov4tQzoTxpuHBF7HNQAAAYU"]
[Sun May 24 18:06:29.429422 2026] [:error] [pid 49744:tid 49748] [client 51.91.242.106:47606] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahLNpTsE5kPdFpUbbHHNwAAAAMI"]
[Sun May 24 18:06:32.085907 2026] [:error] [pid 23497:tid 23503] [client 51.91.242.106:47612] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahLNqCPlV47QcYwd2v_vQQAAAUM"]
[Sun May 24 18:06:34.800500 2026] [:error] [pid 49744:tid 49753] [client 51.91.242.106:47628] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahLNqjsE5kPdFpUbbHHNwQAAAMc"]
[Sun May 24 18:06:37.309618 2026] [:error] [pid 2639:tid 2655] [client 51.91.242.106:47640] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahLNrUzQncQTd0Z0Oe9paQAAAQ4"]
[Sun May 24 18:06:39.723109 2026] [:error] [pid 49689:tid 49728] [client 51.91.242.106:46514] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahLNrwaxiY3NxLUD97VzrwAAAIo"]
[Sun May 24 18:06:42.283716 2026] [:error] [pid 2639:tid 2657] [client 51.91.242.106:46520] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahLNskzQncQTd0Z0Oe9pbAAAARA"]
[Sun May 24 18:06:44.873542 2026] [:error] [pid 49775:tid 49778] [client 51.91.242.106:46526] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahLNtIvZb8G6T8WpI1iXugAAAAE"]
[Sun May 24 18:06:46.477937 2026] [:error] [pid 41708:tid 41713] [client 51.91.242.106:55272] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahLNtv4tQzoTxpuHBF7HQgAAAYM"]
[Sun May 24 18:06:50.335043 2026] [:error] [pid 49689:tid 49722] [client 51.91.242.106:40276] [client 51.91.242.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahLNugaxiY3NxLUD97VzuAAAAIQ"]
[Sun May 24 18:21:18.652622 2026] [:error] [pid 23497:tid 23516] [client 35.227.167.89:64907] [client 35.227.167.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.167.89, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahLRHiPlV47QcYwd2v_z1wAAAVA"]
[Sun May 24 18:21:18.661773 2026] [proxy_fcgi:error] [pid 23497:tid 23516] [client 35.227.167.89:64907] AH01071: Got error 'Primary script unknown'
[Sun May 24 18:21:21.115752 2026] [:error] [pid 23497:tid 23505] [client 35.227.167.89:64907] [client 35.227.167.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ahLRISPlV47QcYwd2v_z4AAAAUU"]
[Sun May 24 18:21:21.443508 2026] [:error] [pid 23497:tid 23523] [client 35.227.167.89:59960] [client 35.227.167.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ahLRISPlV47QcYwd2v_z4QAAAVc"]
[Sun May 24 18:21:21.825641 2026] [:error] [pid 49688:tid 49692] [client 35.227.167.89:53738] [client 35.227.167.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ahLRIWYoQ9V6a_4pBsiusAAAAEE"]
[Sun May 24 18:21:22.198544 2026] [:error] [pid 41708:tid 41730] [client 35.227.167.89:50740] [client 35.227.167.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ahLRIv4tQzoTxpuHBF7JgwAAAZQ"]
[Sun May 24 20:35:13.709806 2026] [proxy_fcgi:error] [pid 11368:tid 11392] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:13.980752 2026] [proxy_fcgi:error] [pid 11368:tid 11376] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:14.230919 2026] [proxy_fcgi:error] [pid 11368:tid 11373] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:14.423710 2026] [proxy_fcgi:error] [pid 11368:tid 11394] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:14.666747 2026] [proxy_fcgi:error] [pid 11368:tid 11389] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:14.907288 2026] [proxy_fcgi:error] [pid 11368:tid 11381] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:15.101548 2026] [proxy_fcgi:error] [pid 11368:tid 11382] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:15.594155 2026] [proxy_fcgi:error] [pid 11368:tid 11387] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:15.871118 2026] [proxy_fcgi:error] [pid 11368:tid 11379] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:16.064076 2026] [proxy_fcgi:error] [pid 11368:tid 11394] [client 20.9.45.132:8344] AH01071: Got error 'Primary script unknown'
[Sun May 24 20:35:16.253505 2026] [:error] [pid 11368:tid 11393] [client 20.9.45.132:8344] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahLwhIfq_sTmmtTKm1UOBgAAARc"]
[Sun May 24 20:35:18.316606 2026] [:error] [pid 11282:tid 11354] [client 20.9.45.132:9034] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahLwhu0bPyN3C7HZ1R-IOwAAAM4"]
[Sun May 24 20:35:20.096021 2026] [:error] [pid 11282:tid 11340] [client 20.9.45.132:8323] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahLwiO0bPyN3C7HZ1R-IQAAAAMA"]
[Sun May 24 20:35:21.753205 2026] [:error] [pid 11281:tid 11318] [client 20.9.45.132:19340] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahLwiZKmC9taWvA91j5wKQAAAIU"]
[Sun May 24 21:11:35.793328 2026] [:error] [pid 11280:tid 11286] [client 43.134.224.16:53628] [client 43.134.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahL5B4Rn5s7laoSxy1QQAQAAAEE"]
[Sun May 24 22:48:33.892499 2026] [:error] [pid 15835:tid 15838] [client 81.167.26.57:29217] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ahMPwWWbknYlUM9P0qP52AAAAAE"]
[Sun May 24 22:48:36.453336 2026] [:error] [pid 15835:tid 15838] [client 81.167.26.57:37159] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ahMPxGWbknYlUM9P0qP53QAAAAE"]
[Sun May 24 22:48:39.035314 2026] [:error] [pid 15835:tid 15859] [client 81.167.26.57:25168] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ahMPx2WbknYlUM9P0qP55AAAABY"]
[Sun May 24 22:48:41.626065 2026] [:error] [pid 15835:tid 15843] [client 81.167.26.57:54724] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ahMPyWWbknYlUM9P0qP55wAAAAY"]
[Sun May 24 22:48:44.220749 2026] [:error] [pid 11281:tid 11330] [client 81.167.26.57:43072] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ahMPzJKmC9taWvA91j6T6AAAAJE"]
[Sun May 24 22:48:46.943752 2026] [:error] [pid 11280:tid 11304] [client 81.167.26.57:28885] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahMPzoRn5s7laoSxy1Qj1AAAAFM"]
[Sun May 24 22:48:49.649532 2026] [:error] [pid 11368:tid 11374] [client 81.167.26.57:33739] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahMP0Yfq_sTmmtTKm1VGoAAAAQQ"]
[Sun May 24 22:48:52.237512 2026] [:error] [pid 15835:tid 15849] [client 81.167.26.57:47678] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahMP1GWbknYlUM9P0qP57QAAAAw"]
[Sun May 24 22:48:54.654132 2026] [:error] [pid 11281:tid 11326] [client 81.167.26.57:1641] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahMP1pKmC9taWvA91j6T9gAAAI0"]
[Sun May 24 22:48:57.227810 2026] [:error] [pid 11281:tid 11333] [client 81.167.26.57:2882] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahMP2ZKmC9taWvA91j6T-AAAAJQ"]
[Sun May 24 22:48:59.852032 2026] [:error] [pid 15835:tid 15837] [client 81.167.26.57:32052] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahMP22WbknYlUM9P0qP5-QAAAAA"]
[Sun May 24 22:49:01.954003 2026] [:error] [pid 11281:tid 11336] [client 81.167.26.57:64360] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahMP3ZKmC9taWvA91j6T-wAAAJc"]
[Sun May 24 22:49:04.533402 2026] [:error] [pid 15835:tid 15840] [client 81.167.26.57:29819] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahMP4GWbknYlUM9P0qP6CgAAAAM"]
[Sun May 24 22:49:07.244521 2026] [:error] [pid 11368:tid 11370] [client 81.167.26.57:64287] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahMP44fq_sTmmtTKm1VGpwAAAQA"]
[Sun May 24 22:49:09.255266 2026] [:error] [pid 11368:tid 11380] [client 81.167.26.57:51887] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahMP5Yfq_sTmmtTKm1VGqAAAAQo"]
[Sun May 24 22:49:12.657407 2026] [:error] [pid 11280:tid 11292] [client 81.167.26.57:41059] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahMP6IRn5s7laoSxy1Qj4AAAAEc"]
[Sun May 24 22:49:15.333515 2026] [:error] [pid 11368:tid 11385] [client 81.167.26.57:40768] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahMP64fq_sTmmtTKm1VGrgAAAQ8"]
[Sun May 24 22:49:17.445884 2026] [:error] [pid 15835:tid 15856] [client 81.167.26.57:42317] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahMP7WWbknYlUM9P0qP6HAAAABM"]
[Sun May 24 22:49:20.011811 2026] [:error] [pid 15835:tid 15842] [client 81.167.26.57:40443] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahMP8GWbknYlUM9P0qP6KwAAAAU"]
[Sun May 24 22:49:21.988451 2026] [:error] [pid 11368:tid 11393] [client 81.167.26.57:47075] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahMP8Yfq_sTmmtTKm1VGtgAAARc"]
[Sun May 24 22:49:24.559125 2026] [:error] [pid 11282:tid 11362] [client 81.167.26.57:9714] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahMP9O0bPyN3C7HZ1R-0ZwAAANY"]
[Sun May 24 22:49:27.771831 2026] [:error] [pid 11281:tid 11332] [client 81.167.26.57:19819] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahMP95KmC9taWvA91j6USQAAAJM"]
[Sun May 24 22:49:29.871686 2026] [:error] [pid 11281:tid 11318] [client 81.167.26.57:56909] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ahMP-ZKmC9taWvA91j6UUQAAAIU"]
[Sun May 24 22:49:51.581070 2026] [:error] [pid 15835:tid 15844] [client 81.167.26.57:38852] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahMQD2WbknYlUM9P0qP6TQAAAAc"]
[Sun May 24 22:49:54.956169 2026] [:error] [pid 15835:tid 15842] [client 81.167.26.57:32277] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahMQEmWbknYlUM9P0qP6UQAAAAU"]
[Sun May 24 22:49:57.727507 2026] [:error] [pid 15835:tid 15855] [client 81.167.26.57:9928] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahMQFWWbknYlUM9P0qP6VQAAABI"]
[Sun May 24 22:50:00.333198 2026] [:error] [pid 15835:tid 15861] [client 81.167.26.57:61079] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahMQGGWbknYlUM9P0qP6WwAAABg"]
[Sun May 24 22:50:03.050874 2026] [:error] [pid 11368:tid 11375] [client 81.167.26.57:28591] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahMQG4fq_sTmmtTKm1VHAQAAAQU"]
[Sun May 24 22:50:05.654593 2026] [:error] [pid 11280:tid 11301] [client 81.167.26.57:6140] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahMQHYRn5s7laoSxy1Qj9wAAAFA"]
[Sun May 24 22:50:08.222360 2026] [:error] [pid 11368:tid 11375] [client 81.167.26.57:49946] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahMQIIfq_sTmmtTKm1VHGAAAAQU"]
[Sun May 24 22:50:10.782513 2026] [:error] [pid 15835:tid 15848] [client 81.167.26.57:23872] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahMQImWbknYlUM9P0qP6ZgAAAAs"]
[Sun May 24 22:50:13.236422 2026] [:error] [pid 11368:tid 11376] [client 81.167.26.57:23985] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahMQJYfq_sTmmtTKm1VHIAAAAQY"]
[Sun May 24 22:50:15.821842 2026] [:error] [pid 11282:tid 11347] [client 81.167.26.57:57896] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahMQJ-0bPyN3C7HZ1R-0mwAAAMc"]
[Sun May 24 22:50:18.258800 2026] [:error] [pid 11282:tid 11358] [client 81.167.26.57:45274] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahMQKu0bPyN3C7HZ1R-0nwAAANI"]
[Sun May 24 22:50:20.963944 2026] [:error] [pid 15835:tid 15857] [client 81.167.26.57:26396] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahMQLGWbknYlUM9P0qP6gQAAABQ"]
[Sun May 24 22:50:23.567925 2026] [:error] [pid 11282:tid 11362] [client 81.167.26.57:2176] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahMQL-0bPyN3C7HZ1R-0rQAAANY"]
[Sun May 24 22:50:26.129598 2026] [:error] [pid 15835:tid 15843] [client 81.167.26.57:26349] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahMQMmWbknYlUM9P0qP6hgAAAAY"]
[Sun May 24 22:50:28.596787 2026] [:error] [pid 11281:tid 11324] [client 81.167.26.57:42125] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahMQNJKmC9taWvA91j6UxwAAAIs"]
[Sun May 24 22:50:32.490643 2026] [:error] [pid 11282:tid 11359] [client 81.167.26.57:46656] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahMQOO0bPyN3C7HZ1R-0vgAAANM"]
[Sun May 24 22:50:35.139062 2026] [:error] [pid 15835:tid 15838] [client 81.167.26.57:26522] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahMQO2WbknYlUM9P0qP6tgAAAAE"]
[Sun May 24 22:50:37.728826 2026] [:error] [pid 11368:tid 11371] [client 81.167.26.57:30443] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahMQPYfq_sTmmtTKm1VHPAAAAQE"]
[Sun May 24 22:50:40.465298 2026] [:error] [pid 11282:tid 11351] [client 81.167.26.57:33772] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahMQQO0bPyN3C7HZ1R-0ygAAAMs"]
[Sun May 24 22:50:43.002638 2026] [:error] [pid 11282:tid 11347] [client 81.167.26.57:58003] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahMQQ-0bPyN3C7HZ1R-0zwAAAMc"]
[Sun May 24 22:50:45.595354 2026] [:error] [pid 15835:tid 15843] [client 81.167.26.57:23131] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahMQRWWbknYlUM9P0qP65wAAAAY"]
[Sun May 24 22:50:48.045711 2026] [:error] [pid 11282:tid 11341] [client 81.167.26.57:31166] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahMQSO0bPyN3C7HZ1R-02AAAAME"]
[Sun May 24 22:53:39.762970 2026] [:error] [pid 11282:tid 11348] [client 34.181.252.225:61938] [client 34.181.252.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.252.225, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahMQ8-0bPyN3C7HZ1R-1lwAAAMg"]
[Sun May 24 22:53:39.775483 2026] [proxy_fcgi:error] [pid 11282:tid 11348] [client 34.181.252.225:61938] AH01071: Got error 'Primary script unknown'
[Sun May 24 22:53:42.035915 2026] [:error] [pid 11282:tid 11352] [client 34.181.252.225:61938] [client 34.181.252.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ahMQ9u0bPyN3C7HZ1R-1qAAAAMw"]
[Sun May 24 22:53:42.758749 2026] [:error] [pid 11280:tid 11288] [client 34.181.252.225:59956] [client 34.181.252.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ahMQ9oRn5s7laoSxy1QkvwAAAEM"]
[Sun May 24 22:53:43.218743 2026] [:error] [pid 11368:tid 11384] [client 34.181.252.225:49163] [client 34.181.252.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ahMQ94fq_sTmmtTKm1VIawAAAQ4"]
[Sun May 24 22:53:43.799165 2026] [:error] [pid 11282:tid 11349] [client 34.181.252.225:61992] [client 34.181.252.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ahMQ9-0bPyN3C7HZ1R-1rAAAAMk"]
[Mon May 25 02:36:57.060221 2026] [:error] [pid 11282:tid 11354] [client 3.144.22.62:34386] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ahNFSe0bPyN3C7HZ1R_rjAAAAM4"]
[Mon May 25 02:36:58.829568 2026] [:error] [pid 15835:tid 15855] [client 3.144.22.62:53990] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/credentials"] [unique_id "ahNFSmWbknYlUM9P0qNbcgAAABI"]
[Mon May 25 02:37:00.383361 2026] [:error] [pid 11282:tid 11340] [client 3.144.22.62:53996] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ahNFTO0bPyN3C7HZ1R_rlQAAAMA"]
[Mon May 25 02:37:01.673412 2026] [:error] [pid 11281:tid 11335] [client 3.144.22.62:54002] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "ahNFTZKmC9taWvA91j7BtwAAAJY"]
[Mon May 25 02:37:05.709863 2026] [:error] [pid 11282:tid 11358] [client 3.144.22.62:54012] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production"] [unique_id "ahNFUe0bPyN3C7HZ1R_rmwAAANI"]
[Mon May 25 02:37:10.680906 2026] [:error] [pid 15835:tid 15857] [client 3.144.22.62:56656] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.staging"] [unique_id "ahNFVmWbknYlUM9P0qNbhQAAABQ"]
[Mon May 25 02:37:12.018853 2026] [:error] [pid 15835:tid 15854] [client 3.144.22.62:56660] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development"] [unique_id "ahNFWGWbknYlUM9P0qNbiwAAABE"]
[Mon May 25 02:37:13.180047 2026] [:error] [pid 11368:tid 11375] [client 3.144.22.62:56668] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.test"] [unique_id "ahNFWYfq_sTmmtTKm1WNNgAAAQU"]
[Mon May 25 02:37:14.445547 2026] [:error] [pid 11282:tid 11359] [client 3.144.22.62:56674] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.remote"] [unique_id "ahNFWu0bPyN3C7HZ1R_rrAAAANM"]
[Mon May 25 02:37:15.680663 2026] [:error] [pid 11282:tid 11344] [client 3.144.22.62:59798] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.bak"] [unique_id "ahNFW-0bPyN3C7HZ1R_rrwAAAMQ"]
[Mon May 25 02:37:17.037830 2026] [:error] [pid 11282:tid 11356] [client 3.144.22.62:59810] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.backup"] [unique_id "ahNFXe0bPyN3C7HZ1R_rtQAAANA"]
[Mon May 25 02:37:18.311892 2026] [:error] [pid 11281:tid 11333] [client 3.144.22.62:59814] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.save"] [unique_id "ahNFXpKmC9taWvA91j7BxgAAAJQ"]
[Mon May 25 02:37:19.267691 2026] [:error] [pid 11368:tid 11374] [client 3.144.22.62:59828] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.old"] [unique_id "ahNFX4fq_sTmmtTKm1WNQAAAAQQ"]
[Mon May 25 02:37:20.824338 2026] [:error] [pid 15835:tid 15861] [client 3.144.22.62:59832] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.sample"] [unique_id "ahNFYGWbknYlUM9P0qNbngAAABg"]
[Mon May 25 02:37:22.708613 2026] [:error] [pid 11282:tid 11351] [client 3.144.22.62:59844] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.example"] [unique_id "ahNFYu0bPyN3C7HZ1R_ruQAAAMs"]
[Mon May 25 02:37:24.151174 2026] [:error] [pid 15835:tid 15854] [client 3.144.22.62:59856] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "ahNFZGWbknYlUM9P0qNbrQAAABE"]
[Mon May 25 02:37:25.397431 2026] [:error] [pid 15835:tid 15852] [client 3.144.22.62:50764] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.prod"] [unique_id "ahNFZWWbknYlUM9P0qNbtAAAAA8"]
[Mon May 25 02:37:26.787785 2026] [:error] [pid 11368:tid 11379] [client 3.144.22.62:50768] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.stage"] [unique_id "ahNFZofq_sTmmtTKm1WNRwAAAQk"]
[Mon May 25 02:37:28.126075 2026] [:error] [pid 15835:tid 15857] [client 3.144.22.62:50782] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.ci"] [unique_id "ahNFaGWbknYlUM9P0qNbvQAAABQ"]
[Mon May 25 02:37:29.283684 2026] [:error] [pid 15835:tid 15861] [client 3.144.22.62:50788] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "ahNFaWWbknYlUM9P0qNbxAAAABg"]
[Mon May 25 02:37:30.742720 2026] [:error] [pid 11282:tid 11349] [client 3.144.22.62:50796] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.live"] [unique_id "ahNFau0bPyN3C7HZ1R_rxgAAAMk"]
[Mon May 25 02:37:32.422767 2026] [:error] [pid 11280:tid 11293] [client 3.144.22.62:50806] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.preprod"] [unique_id "ahNFbIRn5s7laoSxy1ROWwAAAEg"]
[Mon May 25 02:37:37.078851 2026] [:error] [pid 11281:tid 11313] [client 3.144.22.62:55656] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dist"] [unique_id "ahNFcZKmC9taWvA91j7B1gAAAIA"]
[Mon May 25 02:37:38.487891 2026] [:error] [pid 11368:tid 11374] [client 3.144.22.62:55672] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.swp"] [unique_id "ahNFcofq_sTmmtTKm1WNVQAAAQQ"]
[Mon May 25 02:37:39.769214 2026] [:error] [pid 11280:tid 11295] [client 3.144.22.62:55688] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env~"] [unique_id "ahNFc4Rn5s7laoSxy1RObwAAAEo"]
[Mon May 25 02:37:41.094346 2026] [:error] [pid 11282:tid 11346] [client 3.144.22.62:55696] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env1"] [unique_id "ahNFde0bPyN3C7HZ1R_r2AAAAMY"]
[Mon May 25 02:37:42.567530 2026] [:error] [pid 15835:tid 15848] [client 3.144.22.62:55698] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env2"] [unique_id "ahNFdmWbknYlUM9P0qNb1wAAAAs"]
[Mon May 25 02:37:43.859781 2026] [:error] [pid 15835:tid 15859] [client 3.144.22.62:55704] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_copy"] [unique_id "ahNFd2WbknYlUM9P0qNb2wAAABY"]
[Mon May 25 02:37:45.370162 2026] [:error] [pid 15835:tid 15854] [client 3.144.22.62:43916] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.txt"] [unique_id "ahNFeWWbknYlUM9P0qNb3wAAABE"]
[Mon May 25 02:37:46.626929 2026] [:error] [pid 15835:tid 15855] [client 3.144.22.62:43926] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.json"] [unique_id "ahNFemWbknYlUM9P0qNb4QAAABI"]
[Mon May 25 02:37:47.761217 2026] [:error] [pid 15835:tid 15840] [client 3.144.22.62:43934] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yaml"] [unique_id "ahNFe2WbknYlUM9P0qNb5QAAAAM"]
[Mon May 25 02:37:49.600777 2026] [:error] [pid 11368:tid 11394] [client 3.144.22.62:43948] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yml"] [unique_id "ahNFfYfq_sTmmtTKm1WNcgAAARg"]
[Mon May 25 02:37:50.775476 2026] [:error] [pid 15835:tid 15844] [client 3.144.22.62:43952] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ahNFfmWbknYlUM9P0qNb7QAAAAc"]
[Mon May 25 02:37:53.118660 2026] [:error] [pid 15835:tid 15845] [client 3.144.22.62:43966] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/apps/.env"] [unique_id "ahNFgWWbknYlUM9P0qNb9AAAAAg"]
[Mon May 25 02:37:54.396137 2026] [:error] [pid 15835:tid 15843] [client 3.144.22.62:43970] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "ahNFgmWbknYlUM9P0qNb9wAAAAY"]
[Mon May 25 02:37:56.059532 2026] [:error] [pid 15835:tid 15847] [client 3.144.22.62:51862] [client 3.144.22.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/web/.env"] [unique_id "ahNFhGWbknYlUM9P0qNb-wAAAAo"]
[Mon May 25 03:17:41.689742 2026] [:error] [pid 9319:tid 9354] [client 49.51.73.183:55902] [client 49.51.73.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahNO1QDGXf7RIAJLdji7sgAAAEQ"]
[Mon May 25 03:49:03.502191 2026] [proxy_fcgi:error] [pid 9398:tid 9402] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:03.814313 2026] [proxy_fcgi:error] [pid 9398:tid 9426] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:04.126726 2026] [proxy_fcgi:error] [pid 9398:tid 9428] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:04.750766 2026] [proxy_fcgi:error] [pid 9398:tid 9421] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:05.064425 2026] [proxy_fcgi:error] [pid 9398:tid 9407] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:05.376529 2026] [proxy_fcgi:error] [pid 9398:tid 9414] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:05.688855 2026] [proxy_fcgi:error] [pid 9398:tid 9405] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:06.000545 2026] [proxy_fcgi:error] [pid 9398:tid 9420] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:06.318176 2026] [proxy_fcgi:error] [pid 9398:tid 9413] [client 20.195.182.236:41759] AH01071: Got error 'Primary script unknown'
[Mon May 25 03:49:06.627329 2026] [:error] [pid 9398:tid 9412] [client 20.195.182.236:41759] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "ahNWMuhIu7KstzsCua9xEwAAAMg"]
[Mon May 25 03:49:07.244520 2026] [:error] [pid 9304:tid 9370] [client 20.195.182.236:6121] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "ahNWM-VEV2qpMC_1UzRMXwAAAIk"]
[Mon May 25 03:49:07.861414 2026] [:error] [pid 9302:tid 9327] [client 20.195.182.236:24858] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "ahNWMy1RaFfTSnDQnqEsJgAAABQ"]
[Mon May 25 03:49:08.477337 2026] [:error] [pid 9398:tid 9407] [client 20.195.182.236:39848] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sd.php"] [unique_id "ahNWNOhIu7KstzsCua9xFgAAAMc"]
[Mon May 25 03:49:09.108786 2026] [:error] [pid 9303:tid 9340] [client 20.195.182.236:25295] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "ahNWNX3bQScbssitjPQN9gAAAEY"]
[Mon May 25 03:49:09.725367 2026] [:error] [pid 9303:tid 9347] [client 20.195.182.236:5958] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "ahNWNX3bQScbssitjPQN9wAAAE0"]
[Mon May 25 03:49:10.342083 2026] [:error] [pid 9304:tid 9384] [client 20.195.182.236:48277] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "ahNWNuVEV2qpMC_1UzRMYQAAAJc"]
[Mon May 25 03:49:10.964449 2026] [:error] [pid 9304:tid 9383] [client 20.195.182.236:25312] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/000.php"] [unique_id "ahNWNuVEV2qpMC_1UzRMYwAAAJY"]
[Mon May 25 03:49:11.586659 2026] [:error] [pid 9303:tid 9355] [client 20.195.182.236:25301] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/w3llstore.php"] [unique_id "ahNWN33bQScbssitjPQN-QAAAFU"]
[Mon May 25 03:49:12.211331 2026] [:error] [pid 9303:tid 9342] [client 20.195.182.236:25333] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/w3llstore.php"] [unique_id "ahNWOH3bQScbssitjPQN-wAAAEg"]
[Mon May 25 03:49:12.827600 2026] [:error] [pid 9304:tid 9363] [client 20.195.182.236:48264] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/w3llstore.php"] [unique_id "ahNWOOVEV2qpMC_1UzRMZwAAAII"]
[Mon May 25 03:49:13.447756 2026] [:error] [pid 9304:tid 9373] [client 20.195.182.236:5666] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/w3llstore.php"] [unique_id "ahNWOeVEV2qpMC_1UzRMaAAAAIw"]
[Mon May 25 03:49:14.063930 2026] [:error] [pid 9302:tid 9318] [client 20.195.182.236:5695] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w3llstore.php"] [unique_id "ahNWOi1RaFfTSnDQnqEsMAAAAAs"]
[Mon May 25 03:49:14.688473 2026] [:error] [pid 9398:tid 9412] [client 20.195.182.236:5240] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w3llstore.php"] [unique_id "ahNWOuhIu7KstzsCua9xGgAAAMg"]
[Mon May 25 03:49:15.305134 2026] [:error] [pid 9302:tid 9315] [client 20.195.182.236:42648] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w3llstore.php"] [unique_id "ahNWOy1RaFfTSnDQnqEsNAAAAAg"]
[Mon May 25 03:49:15.923914 2026] [:error] [pid 9302:tid 9326] [client 20.195.182.236:5191] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w3llstore.php"] [unique_id "ahNWOy1RaFfTSnDQnqEsNgAAABM"]
[Mon May 25 03:49:16.541326 2026] [:error] [pid 9302:tid 9308] [client 20.195.182.236:12912] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/themes.php"] [unique_id "ahNWPC1RaFfTSnDQnqEsOAAAAAE"]
[Mon May 25 03:49:17.157429 2026] [:error] [pid 9302:tid 9314] [client 20.195.182.236:31702] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/themes.php"] [unique_id "ahNWPS1RaFfTSnDQnqEsOQAAAAc"]
[Mon May 25 03:49:17.776891 2026] [:error] [pid 9302:tid 9325] [client 20.195.182.236:6005] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/themes.php"] [unique_id "ahNWPS1RaFfTSnDQnqEsOwAAABI"]
[Mon May 25 03:49:18.392181 2026] [:error] [pid 9302:tid 9318] [client 20.195.182.236:31719] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/themes.php"] [unique_id "ahNWPi1RaFfTSnDQnqEsPgAAAAs"]
[Mon May 25 03:49:19.007366 2026] [:error] [pid 9302:tid 9312] [client 20.195.182.236:31634] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ahNWPy1RaFfTSnDQnqEsQQAAAAU"]
[Mon May 25 03:49:19.622567 2026] [:error] [pid 9302:tid 9327] [client 20.195.182.236:17030] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ahNWPy1RaFfTSnDQnqEsQwAAABQ"]
[Mon May 25 03:49:20.239962 2026] [:error] [pid 9302:tid 9311] [client 20.195.182.236:31626] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ahNWQC1RaFfTSnDQnqEsRwAAAAQ"]
[Mon May 25 03:49:20.856779 2026] [:error] [pid 9302:tid 9318] [client 20.195.182.236:17012] [client 20.195.182.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/themes.php"] [unique_id "ahNWQC1RaFfTSnDQnqEsSwAAAAs"]
[Mon May 25 04:06:02.605081 2026] [proxy_fcgi:error] [pid 9398:tid 9405] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:02.920771 2026] [proxy_fcgi:error] [pid 9398:tid 9400] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:03.264555 2026] [proxy_fcgi:error] [pid 9398:tid 9424] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:03.577046 2026] [proxy_fcgi:error] [pid 9398:tid 9404] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:03.891539 2026] [proxy_fcgi:error] [pid 9398:tid 9403] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:04.203737 2026] [proxy_fcgi:error] [pid 9398:tid 9420] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:04.531045 2026] [proxy_fcgi:error] [pid 9398:tid 9428] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:04.843428 2026] [proxy_fcgi:error] [pid 9398:tid 9412] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:05.165161 2026] [proxy_fcgi:error] [pid 9398:tid 9405] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:05.480840 2026] [proxy_fcgi:error] [pid 9398:tid 9424] [client 20.206.111.14:14890] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:06:05.813000 2026] [:error] [pid 9398:tid 9416] [client 20.206.111.14:14890] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahNaLehIu7KstzsCua94fQAAAMw"]
[Mon May 25 04:06:07.721334 2026] [:error] [pid 50423:tid 50425] [client 20.206.111.14:14927] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahNaL6JWO7En4nKEQ3js4QAAAQA"]
[Mon May 25 04:06:09.416316 2026] [:error] [pid 9398:tid 9424] [client 20.206.111.14:14918] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahNaMehIu7KstzsCua94hQAAANQ"]
[Mon May 25 04:06:11.276284 2026] [:error] [pid 9398:tid 9404] [client 20.206.111.14:14642] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahNaM-hIu7KstzsCua94hwAAAMQ"]
[Mon May 25 04:06:14.373088 2026] [:error] [pid 9398:tid 9417] [client 20.206.111.14:14592] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahNaNuhIu7KstzsCua94jQAAAM0"]
[Mon May 25 04:06:19.210715 2026] [:error] [pid 9302:tid 9309] [client 20.206.111.14:14643] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahNaOy1RaFfTSnDQnqEwugAAAAI"]
[Mon May 25 04:06:20.640013 2026] [:error] [pid 9398:tid 9404] [client 20.206.111.14:14633] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahNaPOhIu7KstzsCua94lQAAAMQ"]
[Mon May 25 04:06:23.296936 2026] [:error] [pid 50423:tid 50445] [client 20.206.111.14:14641] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahNaP6JWO7En4nKEQ3js9gAAARQ"]
[Mon May 25 04:06:24.547388 2026] [:error] [pid 9303:tid 9338] [client 20.206.111.14:14922] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ahNaQH3bQScbssitjPQTkgAAAEQ"]
[Mon May 25 04:06:25.784809 2026] [:error] [pid 50423:tid 50430] [client 20.206.111.14:14916] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ahNaQaJWO7En4nKEQ3js_wAAAQU"]
[Mon May 25 04:06:27.629284 2026] [:error] [pid 50423:tid 50442] [client 20.206.111.14:14912] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ahNaQ6JWO7En4nKEQ3jtAgAAARE"]
[Mon May 25 04:06:28.965141 2026] [:error] [pid 50423:tid 50444] [client 20.206.111.14:14917] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aaa.php"] [unique_id "ahNaRKJWO7En4nKEQ3jtBAAAARM"]
[Mon May 25 04:06:30.286714 2026] [:error] [pid 50423:tid 50429] [client 20.206.111.14:14936] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ahNaRqJWO7En4nKEQ3jtBwAAAQQ"]
[Mon May 25 04:06:32.429715 2026] [:error] [pid 50423:tid 50427] [client 20.206.111.14:14655] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ahNaSKJWO7En4nKEQ3jtDAAAAQI"]
[Mon May 25 04:06:34.802474 2026] [:error] [pid 9303:tid 9351] [client 20.206.111.14:14948] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ahNaSn3bQScbssitjPQTlQAAAFE"]
[Mon May 25 04:06:36.378249 2026] [:error] [pid 9304:tid 9385] [client 20.206.111.14:14626] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bal.php"] [unique_id "ahNaTOVEV2qpMC_1UzRSzAAAAJg"]
[Mon May 25 04:06:37.756914 2026] [:error] [pid 9303:tid 9345] [client 20.206.111.14:14963] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "ahNaTX3bQScbssitjPQTmQAAAEs"]
[Mon May 25 04:06:39.304101 2026] [:error] [pid 9304:tid 9364] [client 20.206.111.14:14932] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "ahNaT-VEV2qpMC_1UzRSzgAAAIM"]
[Mon May 25 04:06:41.501986 2026] [:error] [pid 9302:tid 9309] [client 20.206.111.14:14617] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "ahNaUS1RaFfTSnDQnqEw3AAAAAI"]
[Mon May 25 04:06:42.679009 2026] [:error] [pid 9304:tid 9373] [client 20.206.111.14:14621] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/drykl.php"] [unique_id "ahNaUuVEV2qpMC_1UzRS0AAAAIw"]
[Mon May 25 04:06:44.459612 2026] [:error] [pid 9303:tid 9354] [client 20.206.111.14:14975] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ahNaVH3bQScbssitjPQTnQAAAFQ"]
[Mon May 25 04:06:46.222895 2026] [:error] [pid 50423:tid 50447] [client 20.206.111.14:14605] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ahNaVqJWO7En4nKEQ3jtEgAAARY"]
[Mon May 25 04:06:49.004921 2026] [:error] [pid 9303:tid 9339] [client 20.206.111.14:14623] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ahNaWX3bQScbssitjPQToAAAAEU"]
[Mon May 25 04:06:51.782635 2026] [:error] [pid 9304:tid 9370] [client 20.206.111.14:14638] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/av.php"] [unique_id "ahNaW-VEV2qpMC_1UzRS1gAAAIk"]
[Mon May 25 04:06:53.720489 2026] [:error] [pid 9303:tid 9352] [client 20.206.111.14:14603] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ahNaXX3bQScbssitjPQTowAAAFI"]
[Mon May 25 04:06:55.185162 2026] [:error] [pid 9398:tid 9401] [client 20.206.111.14:14598] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ahNaX-hIu7KstzsCua94rAAAAME"]
[Mon May 25 04:06:56.911809 2026] [:error] [pid 9302:tid 9327] [client 20.206.111.14:14644] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ahNaYC1RaFfTSnDQnqEw6QAAABQ"]
[Mon May 25 04:06:58.650296 2026] [:error] [pid 9302:tid 9318] [client 20.206.111.14:14613] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/11.php"] [unique_id "ahNaYi1RaFfTSnDQnqEw7QAAAAs"]
[Mon May 25 04:06:59.526531 2026] [:error] [pid 50423:tid 50434] [client 20.206.111.14:14600] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/77.php"] [unique_id "ahNaY6JWO7En4nKEQ3jtIgAAAQk"]
[Mon May 25 04:07:01.043262 2026] [:error] [pid 9398:tid 9402] [client 20.206.111.14:14859] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/77.php"] [unique_id "ahNaZehIu7KstzsCua94sAAAAMI"]
[Mon May 25 04:07:05.155300 2026] [proxy_fcgi:error] [pid 50423:tid 50426] [client 20.206.111.14:14602] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:05.467847 2026] [proxy_fcgi:error] [pid 50423:tid 50429] [client 20.206.111.14:14602] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:05.789135 2026] [proxy_fcgi:error] [pid 50423:tid 50442] [client 20.206.111.14:14602] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:06.114290 2026] [proxy_fcgi:error] [pid 50423:tid 50440] [client 20.206.111.14:14602] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:06.439884 2026] [:error] [pid 50423:tid 50434] [client 20.206.111.14:14602] [client 20.206.111.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ahNaaqJWO7En4nKEQ3jtNQAAAQk"]
[Mon May 25 04:07:10.220419 2026] [proxy_fcgi:error] [pid 9302:tid 9316] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:10.533316 2026] [proxy_fcgi:error] [pid 9302:tid 9322] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:10.847576 2026] [proxy_fcgi:error] [pid 9302:tid 9310] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:11.495094 2026] [proxy_fcgi:error] [pid 9302:tid 9327] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:11.808760 2026] [proxy_fcgi:error] [pid 9302:tid 9320] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:12.122136 2026] [proxy_fcgi:error] [pid 9302:tid 9312] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:12.435162 2026] [proxy_fcgi:error] [pid 9302:tid 9326] [client 20.206.111.14:14631] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:07:12.939649 2026] [:error] [pid 9302:tid 9325] [client 20.206.111.14:14631] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahNacC1RaFfTSnDQnqExEAAAABI"]
[Mon May 25 04:07:15.692195 2026] [:error] [pid 9398:tid 9419] [client 20.206.111.14:14921] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahNac-hIu7KstzsCua94yQAAAM8"]
[Mon May 25 04:07:18.174512 2026] [:error] [pid 50423:tid 50443] [client 20.206.111.14:14886] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahNadqJWO7En4nKEQ3jtTgAAARI"]
[Mon May 25 04:07:23.757965 2026] [:error] [pid 9303:tid 9353] [client 20.206.111.14:14611] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahNae33bQScbssitjPQTzwAAAFM"]
[Mon May 25 04:07:25.739946 2026] [:error] [pid 9302:tid 9314] [client 20.206.111.14:14924] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ahNafS1RaFfTSnDQnqExGAAAAAc"]
[Mon May 25 04:07:27.025855 2026] [:error] [pid 9303:tid 9342] [client 20.206.111.14:14934] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ahNaf33bQScbssitjPQT0AAAAEg"]
[Mon May 25 04:07:30.127192 2026] [:error] [pid 9398:tid 9415] [client 20.206.111.14:14599] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ahNaguhIu7KstzsCua945wAAAMs"]
[Mon May 25 04:07:31.668182 2026] [:error] [pid 9398:tid 9420] [client 20.206.111.14:14652] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ng.php"] [unique_id "ahNag-hIu7KstzsCua947QAAANA"]
[Mon May 25 04:07:33.030585 2026] [:error] [pid 9302:tid 9331] [client 20.206.111.14:14597] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "ahNahS1RaFfTSnDQnqExHgAAABg"]
[Mon May 25 04:07:34.510184 2026] [:error] [pid 9302:tid 9313] [client 20.206.111.14:14881] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "ahNahi1RaFfTSnDQnqExHwAAAAY"]
[Mon May 25 04:07:36.903590 2026] [:error] [pid 9302:tid 9321] [client 20.206.111.14:14867] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "ahNaiC1RaFfTSnDQnqExJwAAAA4"]
[Mon May 25 04:07:40.777768 2026] [:error] [pid 9304:tid 9367] [client 20.206.111.14:14636] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/link.php"] [unique_id "ahNajOVEV2qpMC_1UzRTKgAAAIY"]
[Mon May 25 04:07:42.127686 2026] [:error] [pid 9303:tid 9349] [client 20.206.111.14:14929] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahNajn3bQScbssitjPQT3gAAAE8"]
[Mon May 25 04:07:44.145783 2026] [:error] [pid 9398:tid 9400] [client 20.206.111.14:14606] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahNakOhIu7KstzsCua95AAAAAMA"]
[Mon May 25 04:07:45.600497 2026] [:error] [pid 50423:tid 50441] [client 20.206.111.14:14913] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahNakaJWO7En4nKEQ3jtaAAAARA"]
[Mon May 25 04:07:49.117123 2026] [:error] [pid 50423:tid 50427] [client 20.206.111.14:14940] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahNalaJWO7En4nKEQ3jtcQAAAQI"]
[Mon May 25 04:07:53.488325 2026] [:error] [pid 9398:tid 9405] [client 20.206.111.14:14955] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ahNamehIu7KstzsCua95EQAAAMU"]
[Mon May 25 04:07:55.319532 2026] [:error] [pid 9398:tid 9407] [client 20.206.111.14:14622] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ahNam-hIu7KstzsCua95FAAAAMc"]
[Mon May 25 04:07:56.934158 2026] [:error] [pid 9303:tid 9355] [client 20.206.111.14:14604] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ahNanH3bQScbssitjPQUEQAAAFU"]
[Mon May 25 04:07:59.691249 2026] [:error] [pid 9304:tid 9376] [client 20.206.111.14:14944] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/BDKR28WP.php"] [unique_id "ahNan-VEV2qpMC_1UzRTMQAAAI8"]
[Mon May 25 04:08:01.679792 2026] [:error] [pid 50423:tid 50442] [client 20.206.111.14:14958] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahNaoaJWO7En4nKEQ3jtmwAAARE"]
[Mon May 25 04:08:02.677048 2026] [:error] [pid 9302:tid 9308] [client 20.206.111.14:14926] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahNaoi1RaFfTSnDQnqExZgAAAAE"]
[Mon May 25 04:08:03.707251 2026] [:error] [pid 9398:tid 9428] [client 20.206.111.14:14861] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahNao-hIu7KstzsCua95HwAAANg"]
[Mon May 25 04:08:04.951385 2026] [:error] [pid 9302:tid 9329] [client 20.206.111.14:14610] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.php"] [unique_id "ahNapC1RaFfTSnDQnqExaAAAABY"]
[Mon May 25 04:08:06.471893 2026] [:error] [pid 50423:tid 50427] [client 20.206.111.14:14935] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "ahNapqJWO7En4nKEQ3jtogAAAQI"]
[Mon May 25 04:08:08.547894 2026] [:error] [pid 9398:tid 9426] [client 20.206.111.14:14637] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "ahNaqOhIu7KstzsCua95JgAAANY"]
[Mon May 25 04:08:09.569105 2026] [:error] [pid 50423:tid 50428] [client 20.206.111.14:14953] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp.php"] [unique_id "ahNaqaJWO7En4nKEQ3jtpQAAAQM"]
[Mon May 25 04:08:12.261420 2026] [proxy_fcgi:error] [pid 50423:tid 50449] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:12.574972 2026] [proxy_fcgi:error] [pid 50423:tid 50428] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:12.889200 2026] [proxy_fcgi:error] [pid 50423:tid 50426] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:13.213053 2026] [proxy_fcgi:error] [pid 50423:tid 50435] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:13.634735 2026] [proxy_fcgi:error] [pid 50423:tid 50449] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:13.947842 2026] [proxy_fcgi:error] [pid 50423:tid 50431] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:14.277619 2026] [proxy_fcgi:error] [pid 50423:tid 50432] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:14.590260 2026] [proxy_fcgi:error] [pid 50423:tid 50439] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:14.906887 2026] [proxy_fcgi:error] [pid 50423:tid 50435] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:15.219642 2026] [proxy_fcgi:error] [pid 50423:tid 50449] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:15.546149 2026] [proxy_fcgi:error] [pid 50423:tid 50437] [client 20.206.111.14:14647] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:08:15.857756 2026] [:error] [pid 50423:tid 50444] [client 20.206.111.14:14647] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "ahNar6JWO7En4nKEQ3jtxgAAARM"]
[Mon May 25 04:08:20.706838 2026] [:error] [pid 9304:tid 9378] [client 20.206.111.14:14884] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "ahNatOVEV2qpMC_1UzRTRAAAAJE"]
[Mon May 25 04:08:22.784999 2026] [:error] [pid 50423:tid 50427] [client 20.206.111.14:14608] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "ahNatqJWO7En4nKEQ3jtzQAAAQI"]
[Mon May 25 04:08:25.043140 2026] [:error] [pid 9398:tid 9404] [client 20.206.111.14:14608] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bc.php"] [unique_id "ahNauehIu7KstzsCua95PQAAAMQ"]
[Mon May 25 04:08:27.670518 2026] [:error] [pid 9302:tid 9317] [client 20.206.111.14:14954] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "ahNauy1RaFfTSnDQnqExeAAAAAo"]
[Mon May 25 04:08:30.971078 2026] [:error] [pid 9303:tid 9356] [client 20.206.111.14:14959] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "ahNavn3bQScbssitjPQUOAAAAFY"]
[Mon May 25 04:08:34.715186 2026] [:error] [pid 9302:tid 9311] [client 20.206.111.14:14930] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "ahNawi1RaFfTSnDQnqExeQAAAAQ"]
[Mon May 25 04:08:37.935760 2026] [:error] [pid 50423:tid 50433] [client 20.206.111.14:14951] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tx79.php"] [unique_id "ahNaxaJWO7En4nKEQ3jt4QAAAQg"]
[Mon May 25 04:08:42.009033 2026] [:error] [pid 9398:tid 9416] [client 20.206.111.14:14625] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "ahNayuhIu7KstzsCua95XAAAAMw"]
[Mon May 25 04:08:43.986964 2026] [:error] [pid 9302:tid 9329] [client 20.206.111.14:14919] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "ahNayy1RaFfTSnDQnqExfwAAABY"]
[Mon May 25 04:08:46.687856 2026] [:error] [pid 50423:tid 50440] [client 20.206.111.14:14601] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "ahNazqJWO7En4nKEQ3jt9AAAAQ8"]
[Mon May 25 04:08:48.991162 2026] [:error] [pid 50423:tid 50441] [client 20.206.111.14:14639] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/moshou.php"] [unique_id "ahNa0KJWO7En4nKEQ3jt-QAAARA"]
[Mon May 25 04:08:54.325003 2026] [:error] [pid 9304:tid 9379] [client 20.206.111.14:14630] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahNa1uVEV2qpMC_1UzRTWgAAAJI"]
[Mon May 25 04:08:58.002283 2026] [:error] [pid 9303:tid 9335] [client 20.206.111.14:14950] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahNa2n3bQScbssitjPQUWwAAAEE"]
[Mon May 25 04:09:00.879531 2026] [:error] [pid 50423:tid 50443] [client 20.206.111.14:14640] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahNa3KJWO7En4nKEQ3juIQAAARI"]
[Mon May 25 04:09:02.907028 2026] [:error] [pid 9303:tid 9351] [client 20.206.111.14:14945] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lib.php"] [unique_id "ahNa3n3bQScbssitjPQUYQAAAFE"]
[Mon May 25 04:09:03.592038 2026] [:error] [pid 9303:tid 9353] [client 20.206.111.14:14850] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ahNa333bQScbssitjPQUYgAAAFM"]
[Mon May 25 04:09:04.679652 2026] [:error] [pid 9304:tid 9383] [client 20.206.111.14:14852] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ahNa4OVEV2qpMC_1UzRTYQAAAJY"]
[Mon May 25 04:09:06.441443 2026] [:error] [pid 9304:tid 9379] [client 20.206.111.14:14946] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ahNa4uVEV2qpMC_1UzRTYwAAAJI"]
[Mon May 25 04:09:07.646316 2026] [:error] [pid 9304:tid 9374] [client 20.206.111.14:14653] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoper1.php"] [unique_id "ahNa4-VEV2qpMC_1UzRTZgAAAI0"]
[Mon May 25 04:09:08.720988 2026] [:error] [pid 9304:tid 9365] [client 20.206.111.14:14931] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ahNa5OVEV2qpMC_1UzRTZwAAAIQ"]
[Mon May 25 04:09:09.913936 2026] [:error] [pid 9303:tid 9353] [client 20.206.111.14:14785] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ahNa5X3bQScbssitjPQUbAAAAFM"]
[Mon May 25 04:09:10.962327 2026] [:error] [pid 9398:tid 9405] [client 20.206.111.14:14654] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ahNa5uhIu7KstzsCua95lgAAAMU"]
[Mon May 25 04:09:12.699974 2026] [:error] [pid 9398:tid 9428] [client 20.206.111.14:14649] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/19.php"] [unique_id "ahNa6OhIu7KstzsCua95ngAAANg"]
[Mon May 25 04:09:14.836797 2026] [:error] [pid 9303:tid 9354] [client 20.206.111.14:14863] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/geforce.php"] [unique_id "ahNa6n3bQScbssitjPQUcAAAAFQ"]
[Mon May 25 04:09:24.980281 2026] [proxy_fcgi:error] [pid 9302:tid 9316] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:26.186898 2026] [proxy_fcgi:error] [pid 9302:tid 9326] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:26.499188 2026] [proxy_fcgi:error] [pid 9302:tid 9311] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:26.812729 2026] [proxy_fcgi:error] [pid 9302:tid 9315] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:27.124380 2026] [proxy_fcgi:error] [pid 9302:tid 9322] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:27.443839 2026] [proxy_fcgi:error] [pid 9302:tid 9327] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:27.756038 2026] [proxy_fcgi:error] [pid 9302:tid 9331] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:28.179389 2026] [proxy_fcgi:error] [pid 9302:tid 9310] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:28.617566 2026] [proxy_fcgi:error] [pid 9302:tid 9323] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:28.934731 2026] [proxy_fcgi:error] [pid 9302:tid 9320] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:29.266628 2026] [proxy_fcgi:error] [pid 9302:tid 9312] [client 20.206.111.14:14923] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:09:29.578806 2026] [:error] [pid 9302:tid 9318] [client 20.206.111.14:14923] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "ahNa-S1RaFfTSnDQnqExnQAAAAs"]
[Mon May 25 04:09:36.111452 2026] [:error] [pid 9304:tid 9383] [client 20.206.111.14:14624] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "ahNbAOVEV2qpMC_1UzRTgQAAAJY"]
[Mon May 25 04:09:43.873738 2026] [:error] [pid 9304:tid 9365] [client 20.206.111.14:14969] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file6.php"] [unique_id "ahNbB-VEV2qpMC_1UzRTiAAAAIQ"]
[Mon May 25 04:09:47.213429 2026] [:error] [pid 50423:tid 50446] [client 20.206.111.14:14925] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "ahNbC6JWO7En4nKEQ3juWgAAARU"]
[Mon May 25 04:09:51.780698 2026] [:error] [pid 9398:tid 9425] [client 20.206.111.14:14956] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "ahNbD-hIu7KstzsCua95uwAAANU"]
[Mon May 25 04:09:58.638937 2026] [:error] [pid 9303:tid 9358] [client 20.206.111.14:14855] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ss.php"] [unique_id "ahNbFn3bQScbssitjPQUgAAAAFg"]
[Mon May 25 04:10:03.669379 2026] [:error] [pid 9398:tid 9418] [client 20.206.111.14:14618] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "ahNbG-hIu7KstzsCua950wAAAM4"]
[Mon May 25 04:10:06.108357 2026] [:error] [pid 9304:tid 9385] [client 20.206.111.14:14974] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "ahNbHuVEV2qpMC_1UzRTlAAAAJg"]
[Mon May 25 04:10:07.148214 2026] [:error] [pid 9303:tid 9352] [client 20.206.111.14:14632] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "ahNbH33bQScbssitjPQUigAAAFI"]
[Mon May 25 04:10:08.234541 2026] [:error] [pid 50423:tid 50431] [client 20.206.111.14:14620] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/options.php"] [unique_id "ahNbIKJWO7En4nKEQ3jubAAAAQY"]
[Mon May 25 04:10:09.542684 2026] [:error] [pid 50423:tid 50425] [client 20.206.111.14:14970] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/min.php"] [unique_id "ahNbIaJWO7En4nKEQ3jucQAAAQA"]
[Mon May 25 04:10:12.388673 2026] [:error] [pid 9303:tid 9358] [client 20.206.111.14:14937] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/min.php"] [unique_id "ahNbJH3bQScbssitjPQUkgAAAFg"]
[Mon May 25 04:10:15.944602 2026] [:error] [pid 9302:tid 9316] [client 20.206.111.14:14856] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/min.php"] [unique_id "ahNbJy1RaFfTSnDQnqExvQAAAAk"]
[Mon May 25 04:10:16.913650 2026] [:error] [pid 9303:tid 9352] [client 20.206.111.14:14596] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/min.php"] [unique_id "ahNbKH3bQScbssitjPQUmAAAAFI"]
[Mon May 25 04:10:23.703967 2026] [:error] [pid 9398:tid 9423] [client 20.206.111.14:14614] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ahNbL-hIu7KstzsCua958QAAANM"]
[Mon May 25 04:10:27.352753 2026] [:error] [pid 9398:tid 9401] [client 20.206.111.14:14650] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ahNbM-hIu7KstzsCua958wAAAME"]
[Mon May 25 04:10:28.842614 2026] [:error] [pid 9303:tid 9338] [client 20.206.111.14:14651] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/img.php"] [unique_id "ahNbNH3bQScbssitjPQUqQAAAEQ"]
[Mon May 25 04:10:33.883118 2026] [proxy_fcgi:error] [pid 50423:tid 50442] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:34.206991 2026] [proxy_fcgi:error] [pid 50423:tid 50443] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:34.616591 2026] [proxy_fcgi:error] [pid 50423:tid 50434] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:34.928791 2026] [proxy_fcgi:error] [pid 50423:tid 50446] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:35.240845 2026] [proxy_fcgi:error] [pid 50423:tid 50433] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:35.567527 2026] [proxy_fcgi:error] [pid 50423:tid 50445] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:35.881125 2026] [proxy_fcgi:error] [pid 50423:tid 50448] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:36.192770 2026] [proxy_fcgi:error] [pid 50423:tid 50441] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:36.516104 2026] [proxy_fcgi:error] [pid 50423:tid 50440] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:36.830972 2026] [proxy_fcgi:error] [pid 50423:tid 50426] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:37.143601 2026] [proxy_fcgi:error] [pid 50423:tid 50442] [client 20.206.111.14:14952] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:10:37.477316 2026] [:error] [pid 50423:tid 50443] [client 20.206.111.14:14952] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "ahNbPaJWO7En4nKEQ3juoQAAARI"]
[Mon May 25 04:10:39.038645 2026] [:error] [pid 9302:tid 9320] [client 20.206.111.14:14643] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "ahNbPy1RaFfTSnDQnqEx4QAAAA0"]
[Mon May 25 04:10:41.453829 2026] [:error] [pid 50423:tid 50439] [client 20.206.111.14:14851] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "ahNbQaJWO7En4nKEQ3jupwAAAQ4"]
[Mon May 25 04:10:46.472287 2026] [:error] [pid 9398:tid 9414] [client 20.206.111.14:14967] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bob.php"] [unique_id "ahNbRuhIu7KstzsCua96FAAAAMo"]
[Mon May 25 04:10:48.558992 2026] [:error] [pid 9398:tid 9412] [client 20.206.111.14:14627] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ahNbSOhIu7KstzsCua96GQAAAMg"]
[Mon May 25 04:10:53.783957 2026] [:error] [pid 9304:tid 9381] [client 20.206.111.14:14966] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ahNbTeVEV2qpMC_1UzRT0QAAAJQ"]
[Mon May 25 04:10:55.916211 2026] [:error] [pid 50423:tid 50448] [client 20.206.111.14:14917] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ahNbT6JWO7En4nKEQ3juwwAAARc"]
[Mon May 25 04:10:58.848392 2026] [:error] [pid 9398:tid 9427] [client 20.206.111.14:14875] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yuzuru1.php"] [unique_id "ahNbUuhIu7KstzsCua96JQAAANc"]
[Mon May 25 04:10:59.884704 2026] [:error] [pid 9398:tid 9428] [client 20.206.111.14:14942] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/insta.php"] [unique_id "ahNbU-hIu7KstzsCua96KgAAANg"]
[Mon May 25 04:11:02.315323 2026] [:error] [pid 9303:tid 9357] [client 20.206.111.14:14961] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/insta.php"] [unique_id "ahNbVn3bQScbssitjPQUvQAAAFc"]
[Mon May 25 04:11:05.229384 2026] [:error] [pid 50423:tid 50441] [client 20.206.111.14:14878] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/insta.php"] [unique_id "ahNbWaJWO7En4nKEQ3ju0wAAARA"]
[Mon May 25 04:11:11.293512 2026] [:error] [pid 9303:tid 9351] [client 20.206.111.14:14634] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/insta.php"] [unique_id "ahNbX33bQScbssitjPQUzgAAAFE"]
[Mon May 25 04:11:16.065078 2026] [:error] [pid 50423:tid 50444] [client 20.206.111.14:14943] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kz.php"] [unique_id "ahNbZKJWO7En4nKEQ3ju3QAAARM"]
[Mon May 25 04:11:17.543110 2026] [:error] [pid 9303:tid 9340] [client 20.206.111.14:14932] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kz.php"] [unique_id "ahNbZX3bQScbssitjPQU5AAAAEY"]
[Mon May 25 04:11:20.473898 2026] [:error] [pid 9302:tid 9313] [client 20.206.111.14:14907] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kz.php"] [unique_id "ahNbaC1RaFfTSnDQnqEyCgAAAAY"]
[Mon May 25 04:11:23.014246 2026] [:error] [pid 9302:tid 9331] [client 20.206.111.14:14792] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kz.php"] [unique_id "ahNbay1RaFfTSnDQnqEyEQAAABg"]
[Mon May 25 04:11:24.863120 2026] [:error] [pid 9302:tid 9310] [client 20.206.111.14:14635] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "ahNbbC1RaFfTSnDQnqEyFAAAAAM"]
[Mon May 25 04:11:27.981670 2026] [:error] [pid 9303:tid 9349] [client 20.206.111.14:14638] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "ahNbb33bQScbssitjPQVFQAAAE8"]
[Mon May 25 04:11:30.653223 2026] [:error] [pid 50423:tid 50426] [client 20.206.111.14:14916] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "ahNbcqJWO7En4nKEQ3ju9QAAAQE"]
[Mon May 25 04:11:32.313889 2026] [:error] [pid 9398:tid 9404] [client 20.206.111.14:14957] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xs.php"] [unique_id "ahNbdOhIu7KstzsCua96VgAAAMQ"]
[Mon May 25 04:11:33.297073 2026] [:error] [pid 50423:tid 50447] [client 20.206.111.14:14655] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2026w.php"] [unique_id "ahNbdaJWO7En4nKEQ3ju_QAAARY"]
[Mon May 25 04:11:38.178959 2026] [proxy_fcgi:error] [pid 50423:tid 50446] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:38.491549 2026] [proxy_fcgi:error] [pid 50423:tid 50448] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:38.803520 2026] [proxy_fcgi:error] [pid 50423:tid 50438] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:39.115953 2026] [proxy_fcgi:error] [pid 50423:tid 50430] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:39.437312 2026] [proxy_fcgi:error] [pid 50423:tid 50439] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:39.974867 2026] [proxy_fcgi:error] [pid 50423:tid 50437] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:40.299153 2026] [proxy_fcgi:error] [pid 50423:tid 50426] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:40.621374 2026] [proxy_fcgi:error] [pid 50423:tid 50425] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:40.934707 2026] [proxy_fcgi:error] [pid 50423:tid 50444] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:41.250061 2026] [proxy_fcgi:error] [pid 50423:tid 50427] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:41.562410 2026] [proxy_fcgi:error] [pid 50423:tid 50431] [client 20.206.111.14:14629] AH01071: Got error 'Primary script unknown'
[Mon May 25 04:11:41.871574 2026] [:error] [pid 50423:tid 50445] [client 20.206.111.14:14629] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "ahNbfaJWO7En4nKEQ3jvFQAAARQ"]
[Mon May 25 04:11:44.963180 2026] [:error] [pid 9304:tid 9373] [client 20.206.111.14:14947] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "ahNbgOVEV2qpMC_1UzRT6QAAAIw"]
[Mon May 25 04:11:47.053005 2026] [:error] [pid 9398:tid 9405] [client 20.206.111.14:14912] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "ahNbg-hIu7KstzsCua96ZQAAAMU"]
[Mon May 25 04:11:48.667171 2026] [:error] [pid 9302:tid 9329] [client 20.206.111.14:14915] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ortasekerli1.php"] [unique_id "ahNbhC1RaFfTSnDQnqEyKwAAABY"]
[Mon May 25 04:11:50.427250 2026] [:error] [pid 9398:tid 9401] [client 20.206.111.14:14929] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xstelth.php"] [unique_id "ahNbhuhIu7KstzsCua96bQAAAME"]
[Mon May 25 04:11:52.843195 2026] [:error] [pid 50423:tid 50449] [client 20.206.111.14:14975] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xstelth.php"] [unique_id "ahNbiKJWO7En4nKEQ3jvGAAAARg"]
[Mon May 25 04:11:57.642797 2026] [:error] [pid 9304:tid 9367] [client 20.206.111.14:14612] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xstelth.php"] [unique_id "ahNbjeVEV2qpMC_1UzRT-wAAAIY"]
[Mon May 25 04:12:00.351070 2026] [:error] [pid 9398:tid 9416] [client 20.206.111.14:14910] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xstelth.php"] [unique_id "ahNbkOhIu7KstzsCua96cgAAAMw"]
[Mon May 25 04:12:02.706904 2026] [:error] [pid 50423:tid 50439] [client 20.206.111.14:14862] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3369.php"] [unique_id "ahNbkqJWO7En4nKEQ3jvJQAAAQ4"]
[Mon May 25 04:12:04.130285 2026] [:error] [pid 9398:tid 9413] [client 20.206.111.14:14644] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3369.php"] [unique_id "ahNblOhIu7KstzsCua96fwAAAMk"]
[Mon May 25 04:12:07.724152 2026] [:error] [pid 9304:tid 9375] [client 20.206.111.14:14609] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3369.php"] [unique_id "ahNbl-VEV2qpMC_1UzRUGwAAAI4"]
[Mon May 25 04:12:13.864374 2026] [:error] [pid 50423:tid 50432] [client 20.206.111.14:14886] [client 20.206.111.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/3369.php"] [unique_id "ahNbnaJWO7En4nKEQ3jvOgAAAQc"]
[Mon May 25 07:09:24.723538 2026] [:error] [pid 9304:tid 9369] [client 104.28.246.122:60690] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/ms-themes.php"] [unique_id "ahOFJOVEV2qpMC_1UzSWFwAAAIg"]
[Mon May 25 07:09:25.179449 2026] [:error] [pid 9398:tid 9423] [client 104.28.214.122:20386] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/chosen.php"] [unique_id "ahOFJehIu7KstzsCua-3SwAAANM"]
[Mon May 25 07:09:32.730908 2026] [:error] [pid 50423:tid 50434] [client 104.28.246.122:55323] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/file.php"] [unique_id "ahOFLKJWO7En4nKEQ3g_DwAAAQk"]
[Mon May 25 07:09:33.178581 2026] [:error] [pid 9302:tid 9307] [client 104.28.246.122:55354] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/flower.php"] [unique_id "ahOFLS1RaFfTSnDQnqFb1wAAAAA"]
[Mon May 25 07:09:33.630819 2026] [:error] [pid 9304:tid 9381] [client 104.28.246.122:55416] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/gifclass.php"] [unique_id "ahOFLeVEV2qpMC_1UzSWdwAAAJQ"]
[Mon May 25 07:09:34.084559 2026] [:error] [pid 9304:tid 9372] [client 104.28.246.122:55482] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "switchcreative.net"] [uri "/bless.php"] [unique_id "ahOFLuVEV2qpMC_1UzSWggAAAIs"]
[Mon May 25 07:24:05.834813 2026] [:error] [pid 9398:tid 9415] [client 18.202.221.231:38510] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/config"] [unique_id "ahOIlehIu7KstzsCua-9KAAAAMs"]
[Mon May 25 07:24:07.852335 2026] [:error] [pid 9304:tid 9384] [client 18.202.221.231:57386] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.git/credentials"] [unique_id "ahOIl-VEV2qpMC_1UzSg6wAAAJc"]
[Mon May 25 07:24:09.838772 2026] [:error] [pid 9304:tid 9385] [client 18.202.221.231:57388] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env"] [unique_id "ahOImeVEV2qpMC_1UzSg8AAAAJg"]
[Mon May 25 07:24:11.212271 2026] [:error] [pid 50423:tid 50439] [client 18.202.221.231:57390] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.local"] [unique_id "ahOIm6JWO7En4nKEQ3hFgQAAAQ4"]
[Mon May 25 07:24:13.198818 2026] [:error] [pid 9304:tid 9376] [client 18.202.221.231:56812] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.production"] [unique_id "ahOIneVEV2qpMC_1UzSg9gAAAI8"]
[Mon May 25 07:24:14.340797 2026] [:error] [pid 9303:tid 9344] [client 18.202.221.231:56818] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.staging"] [unique_id "ahOInn3bQScbssitjPRIrgAAAEo"]
[Mon May 25 07:24:15.970133 2026] [:error] [pid 9398:tid 9424] [client 18.202.221.231:56828] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.development"] [unique_id "ahOIn-hIu7KstzsCua-9UwAAANQ"]
[Mon May 25 07:24:17.730194 2026] [:error] [pid 9302:tid 9311] [client 18.202.221.231:56832] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.test"] [unique_id "ahOIoS1RaFfTSnDQnqFf2AAAAAQ"]
[Mon May 25 07:24:18.822131 2026] [:error] [pid 9304:tid 9381] [client 18.202.221.231:56848] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.remote"] [unique_id "ahOIouVEV2qpMC_1UzSg9wAAAJQ"]
[Mon May 25 07:24:29.622809 2026] [:error] [pid 9304:tid 9375] [client 18.202.221.231:59690] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.backup"] [unique_id "ahOIreVEV2qpMC_1UzSg_gAAAI4"]
[Mon May 25 07:24:31.575836 2026] [:error] [pid 21606:tid 21614] [client 18.202.221.231:59696] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.save"] [unique_id "ahOIr2swdp0RYkH5t9XNfwAAAUY"]
[Mon May 25 07:24:37.962738 2026] [:error] [pid 21606:tid 21623] [client 18.202.221.231:50022] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.old"] [unique_id "ahOItWswdp0RYkH5t9XNggAAAU8"]
[Mon May 25 07:24:42.225719 2026] [:error] [pid 9303:tid 9356] [client 18.202.221.231:49900] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.sample"] [unique_id "ahOIun3bQScbssitjPRIwQAAAFY"]
[Mon May 25 07:24:43.349542 2026] [:error] [pid 9302:tid 9328] [client 18.202.221.231:49902] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.example"] [unique_id "ahOIuy1RaFfTSnDQnqFf9AAAABU"]
[Mon May 25 07:24:44.474157 2026] [:error] [pid 50423:tid 50438] [client 18.202.221.231:49906] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dev"] [unique_id "ahOIvKJWO7En4nKEQ3hFwQAAAQ0"]
[Mon May 25 07:24:45.599145 2026] [:error] [pid 9304:tid 9367] [client 18.202.221.231:49908] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.prod"] [unique_id "ahOIveVEV2qpMC_1UzShBQAAAIY"]
[Mon May 25 07:24:46.694547 2026] [:error] [pid 50423:tid 50447] [client 18.202.221.231:49912] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.stage"] [unique_id "ahOIvqJWO7En4nKEQ3hFxwAAARY"]
[Mon May 25 07:24:47.817398 2026] [:error] [pid 9398:tid 9402] [client 18.202.221.231:49924] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.ci"] [unique_id "ahOIv-hIu7KstzsCua-9aAAAAMI"]
[Mon May 25 07:24:48.950182 2026] [:error] [pid 9304:tid 9362] [client 18.202.221.231:49934] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.docker"] [unique_id "ahOIwOVEV2qpMC_1UzShCAAAAIE"]
[Mon May 25 07:24:50.041409 2026] [:error] [pid 9304:tid 9375] [client 18.202.221.231:49950] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.live"] [unique_id "ahOIwuVEV2qpMC_1UzShDQAAAI4"]
[Mon May 25 07:24:51.192149 2026] [:error] [pid 9398:tid 9428] [client 18.202.221.231:49962] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.preprod"] [unique_id "ahOIw-hIu7KstzsCua-9bAAAANg"]
[Mon May 25 07:24:52.353183 2026] [:error] [pid 9304:tid 9385] [client 18.202.221.231:36460] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.uat"] [unique_id "ahOIxOVEV2qpMC_1UzShFAAAAJg"]
[Mon May 25 07:24:53.559874 2026] [:error] [pid 9304:tid 9364] [client 18.202.221.231:36472] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.dist"] [unique_id "ahOIxeVEV2qpMC_1UzShGgAAAIM"]
[Mon May 25 07:24:54.921364 2026] [:error] [pid 9398:tid 9407] [client 18.202.221.231:36488] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.swp"] [unique_id "ahOIxuhIu7KstzsCua-9cwAAAMc"]
[Mon May 25 07:24:56.994885 2026] [:error] [pid 9302:tid 9310] [client 18.202.221.231:36500] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env~"] [unique_id "ahOIyC1RaFfTSnDQnqFf-gAAAAM"]
[Mon May 25 07:24:58.740184 2026] [:error] [pid 9304:tid 9382] [client 18.202.221.231:36514] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env1"] [unique_id "ahOIyuVEV2qpMC_1UzShJwAAAJU"]
[Mon May 25 07:24:59.975893 2026] [:error] [pid 9302:tid 9315] [client 18.202.221.231:36516] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env2"] [unique_id "ahOIyy1RaFfTSnDQnqFf_wAAAAg"]
[Mon May 25 07:25:01.080426 2026] [:error] [pid 9302:tid 9328] [client 18.202.221.231:36518] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env_copy"] [unique_id "ahOIzS1RaFfTSnDQnqFgAgAAABU"]
[Mon May 25 07:25:02.398337 2026] [:error] [pid 21606:tid 21628] [client 18.202.221.231:38864] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.txt"] [unique_id "ahOIzmswdp0RYkH5t9XNkwAAAVQ"]
[Mon May 25 07:25:03.890604 2026] [:error] [pid 50423:tid 50448] [client 18.202.221.231:38870] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.json"] [unique_id "ahOIz6JWO7En4nKEQ3hGAQAAARc"]
[Mon May 25 07:25:05.033675 2026] [:error] [pid 9302:tid 9312] [client 18.202.221.231:38880] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yaml"] [unique_id "ahOI0S1RaFfTSnDQnqFgBgAAAAU"]
[Mon May 25 07:25:06.198864 2026] [:error] [pid 9303:tid 9345] [client 18.202.221.231:38888] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/.env.yml"] [unique_id "ahOI0n3bQScbssitjPRIzQAAAEs"]
[Mon May 25 07:25:08.001683 2026] [:error] [pid 9304:tid 9382] [client 18.202.221.231:38902] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/app/.env"] [unique_id "ahOI1OVEV2qpMC_1UzShMwAAAJU"]
[Mon May 25 07:25:09.351116 2026] [:error] [pid 9398:tid 9423] [client 18.202.221.231:38906] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/apps/.env"] [unique_id "ahOI1ehIu7KstzsCua-9hQAAANM"]
[Mon May 25 07:25:10.682142 2026] [:error] [pid 9303:tid 9341] [client 18.202.221.231:38920] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/api/.env"] [unique_id "ahOI1n3bQScbssitjPRI3AAAAEc"]
[Mon May 25 07:25:12.006773 2026] [:error] [pid 9398:tid 9413] [client 18.202.221.231:38932] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/web/.env"] [unique_id "ahOI2OhIu7KstzsCua-9jAAAAMk"]
[Mon May 25 07:25:13.156500 2026] [:error] [pid 9398:tid 9425] [client 18.202.221.231:45912] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/site/.env"] [unique_id "ahOI2ehIu7KstzsCua-9jQAAANU"]
[Mon May 25 07:25:14.258974 2026] [:error] [pid 9398:tid 9415] [client 18.202.221.231:45920] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/public/.env"] [unique_id "ahOI2uhIu7KstzsCua-9kQAAAMs"]
[Mon May 25 07:25:15.389174 2026] [:error] [pid 50423:tid 50425] [client 18.202.221.231:45936] [client 18.202.221.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/admin/.env"] [unique_id "ahOI26JWO7En4nKEQ3hGBQAAAQA"]
[Mon May 25 08:04:20.572779 2026] [:error] [pid 62428:tid 62488] [client 81.167.26.57:64709] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahOSBJNosGBa7mui3VSbsgAAAIQ"]
[Mon May 25 08:04:22.684207 2026] [:error] [pid 62515:tid 62519] [client 81.167.26.57:11013] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahOSBhig0_XsOwmnrv9MWAAAAMI"]
[Mon May 25 08:04:24.644917 2026] [:error] [pid 62722:tid 62748] [client 81.167.26.57:16167] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahOSCKM6ssnLWYf6CVBAWQAAAFg"]
[Mon May 25 08:04:26.621836 2026] [:error] [pid 62428:tid 62496] [client 81.167.26.57:14245] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahOSCpNosGBa7mui3VSbtgAAAIw"]
[Mon May 25 08:04:28.593046 2026] [:error] [pid 62426:tid 62444] [client 81.167.26.57:35561] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahOSDEj3D3Mo8ANpTRBwPQAAAA4"]
[Mon May 25 08:04:30.550526 2026] [:error] [pid 62515:tid 62523] [client 81.167.26.57:10942] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahOSDhig0_XsOwmnrv9MXgAAAMY"]
[Mon May 25 08:04:32.372376 2026] [:error] [pid 62426:tid 62446] [client 81.167.26.57:58727] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahOSEEj3D3Mo8ANpTRBwQQAAABA"]
[Mon May 25 08:04:34.344543 2026] [:error] [pid 62428:tid 62486] [client 81.167.26.57:17494] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahOSEpNosGBa7mui3VSbwQAAAII"]
[Mon May 25 08:04:36.309935 2026] [:error] [pid 62515:tid 62529] [client 81.167.26.57:21769] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/g2g%20slot.aspx"] [unique_id "ahOSFBig0_XsOwmnrv9MaAAAAMw"]
[Mon May 25 08:04:38.294169 2026] [:error] [pid 62515:tid 62523] [client 81.167.26.57:31187] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahOSFhig0_XsOwmnrv9MawAAAMY"]
[Mon May 25 08:04:40.256722 2026] [:error] [pid 62427:tid 62479] [client 81.167.26.57:4903] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahOSGPMUa83fc4GDyBzvuQAAAVY"]
[Mon May 25 08:04:42.218980 2026] [:error] [pid 62428:tid 62500] [client 81.167.26.57:32552] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/h25%20com.aspx"] [unique_id "ahOSGpNosGBa7mui3VSb1AAAAJA"]
[Mon May 25 08:04:44.188345 2026] [:error] [pid 62722:tid 62733] [client 81.167.26.57:36101] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahOSHKM6ssnLWYf6CVBAaQAAAEk"]
[Mon May 25 08:04:46.033041 2026] [:error] [pid 62515:tid 62535] [client 81.167.26.57:45813] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahOSHhig0_XsOwmnrv9MbAAAANI"]
[Mon May 25 08:04:47.999415 2026] [:error] [pid 62515:tid 62524] [client 81.167.26.57:7119] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahOSHxig0_XsOwmnrv9McgAAAMc"]
[Mon May 25 08:04:49.984336 2026] [:error] [pid 62426:tid 62443] [client 81.167.26.57:43390] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahOSIUj3D3Mo8ANpTRBwSAAAAA0"]
[Mon May 25 08:04:51.959905 2026] [:error] [pid 62515:tid 62541] [client 81.167.26.57:33137] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahOSIxig0_XsOwmnrv9MfQAAANg"]
[Mon May 25 08:04:54.083765 2026] [:error] [pid 62722:tid 62725] [client 81.167.26.57:5761] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahOSJqM6ssnLWYf6CVBAeQAAAEE"]
[Mon May 25 08:04:56.052351 2026] [:error] [pid 62722:tid 62747] [client 81.167.26.57:41171] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahOSKKM6ssnLWYf6CVBAgwAAAFc"]
[Mon May 25 08:04:58.043301 2026] [:error] [pid 62515:tid 62528] [client 81.167.26.57:50018] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahOSKhig0_XsOwmnrv9MhAAAAMs"]
[Mon May 25 08:04:59.880460 2026] [:error] [pid 62515:tid 62536] [client 81.167.26.57:32067] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahOSKxig0_XsOwmnrv9MiAAAANM"]
[Mon May 25 08:05:01.852766 2026] [:error] [pid 62722:tid 62727] [client 81.167.26.57:39535] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahOSLaM6ssnLWYf6CVBAlAAAAEM"]
[Mon May 25 08:05:03.703767 2026] [:error] [pid 62428:tid 62501] [client 81.167.26.57:44355] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20plus.aspx"] [unique_id "ahOSL5NosGBa7mui3VSb7AAAAJE"]
[Mon May 25 08:05:05.689118 2026] [:error] [pid 62515:tid 62532] [client 81.167.26.57:2290] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ahOSMRig0_XsOwmnrv9MiwAAAM8"]
[Mon May 25 08:05:07.671386 2026] [:error] [pid 62722:tid 62741] [client 81.167.26.57:46943] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahOSM6M6ssnLWYf6CVBAuQAAAFE"]
[Mon May 25 08:05:09.800981 2026] [:error] [pid 62427:tid 62460] [client 81.167.26.57:38687] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto%20wallet.aspx"] [unique_id "ahOSNfMUa83fc4GDyBzvyAAAAUM"]
[Mon May 25 08:05:11.931291 2026] [:error] [pid 62426:tid 62433] [client 81.167.26.57:51972] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahOSN0j3D3Mo8ANpTRBwZAAAAAM"]
[Mon May 25 08:05:13.895288 2026] [:error] [pid 62427:tid 62475] [client 81.167.26.57:18342] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahOSOfMUa83fc4GDyBzv1QAAAVI"]
[Mon May 25 08:05:15.872276 2026] [:error] [pid 62428:tid 62498] [client 81.167.26.57:64924] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahOSO5NosGBa7mui3VSb9AAAAI4"]
[Mon May 25 08:05:17.278074 2026] [:error] [pid 62515:tid 62529] [client 81.167.26.57:34164] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahOSPRig0_XsOwmnrv9MqgAAAMw"]
[Mon May 25 08:05:39.892930 2026] [:error] [pid 62722:tid 62731] [client 81.167.26.57:52558] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20888th.aspx"] [unique_id "ahOSU6M6ssnLWYf6CVBBUgAAAEc"]
[Mon May 25 08:05:41.915538 2026] [:error] [pid 62428:tid 62486] [client 81.167.26.57:13261] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahOSVZNosGBa7mui3VScMgAAAII"]
[Mon May 25 08:05:43.914900 2026] [:error] [pid 62427:tid 62465] [client 81.167.26.57:36822] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahOSV_MUa83fc4GDyBzv-QAAAUg"]
[Mon May 25 08:05:45.941984 2026] [:error] [pid 62428:tid 62498] [client 81.167.26.57:35656] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahOSWZNosGBa7mui3VScOQAAAI4"]
[Mon May 25 08:05:47.932324 2026] [:error] [pid 62427:tid 62481] [client 81.167.26.57:17771] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahOSW_MUa83fc4GDyBzv-wAAAVg"]
[Mon May 25 08:05:49.937342 2026] [:error] [pid 62515:tid 62532] [client 81.167.26.57:63678] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahOSXRig0_XsOwmnrv9NBgAAAM8"]
[Mon May 25 08:05:51.881470 2026] [:error] [pid 62722:tid 62735] [client 81.167.26.57:16479] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahOSX6M6ssnLWYf6CVBBXgAAAEs"]
[Mon May 25 08:05:53.743349 2026] [:error] [pid 62515:tid 62526] [client 81.167.26.57:7242] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahOSYRig0_XsOwmnrv9NCgAAAMk"]
[Mon May 25 08:05:55.747657 2026] [:error] [pid 62515:tid 62538] [client 81.167.26.57:27117] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahOSYxig0_XsOwmnrv9NDgAAANU"]
[Mon May 25 08:05:57.770380 2026] [:error] [pid 62428:tid 62506] [client 81.167.26.57:18666] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahOSZZNosGBa7mui3VScQwAAAJY"]
[Mon May 25 08:05:59.756949 2026] [:error] [pid 62428:tid 62504] [client 81.167.26.57:2799] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahOSZ5NosGBa7mui3VScRwAAAJQ"]
[Mon May 25 08:06:01.779887 2026] [:error] [pid 62428:tid 62494] [client 81.167.26.57:40860] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahOSaZNosGBa7mui3VScTQAAAIo"]
[Mon May 25 08:06:03.779516 2026] [:error] [pid 62722:tid 62727] [client 81.167.26.57:32242] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahOSa6M6ssnLWYf6CVBBoQAAAEM"]
[Mon May 25 08:06:05.794363 2026] [:error] [pid 62515:tid 62517] [client 81.167.26.57:31720] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahOSbRig0_XsOwmnrv9NKwAAAMA"]
[Mon May 25 08:06:07.789702 2026] [:error] [pid 62722:tid 62727] [client 81.167.26.57:7984] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahOSb6M6ssnLWYf6CVBBrwAAAEM"]
[Mon May 25 08:19:18.815943 2026] [:error] [pid 62722:tid 62738] [client 145.239.65.226:41982] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahOVhqM6ssnLWYf6CVBH6AAAAE4"]
[Mon May 25 08:19:20.823536 2026] [:error] [pid 62515:tid 62539] [client 145.239.65.226:54496] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahOViBig0_XsOwmnrv9SKQAAANY"]
[Mon May 25 08:19:22.723949 2026] [:error] [pid 62515:tid 62522] [client 145.239.65.226:51194] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahOVihig0_XsOwmnrv9SLgAAAMU"]
[Mon May 25 08:19:24.623977 2026] [:error] [pid 62428:tid 62505] [client 145.239.65.226:51196] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahOVjJNosGBa7mui3VSgOQAAAJU"]
[Mon May 25 08:19:26.649524 2026] [:error] [pid 62722:tid 62732] [client 145.239.65.226:51212] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahOVjqM6ssnLWYf6CVBH_QAAAEg"]
[Mon May 25 08:19:28.554191 2026] [:error] [pid 62428:tid 62495] [client 145.239.65.226:51216] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahOVkJNosGBa7mui3VSgOwAAAIs"]
[Mon May 25 08:19:30.469743 2026] [:error] [pid 62722:tid 62746] [client 145.239.65.226:51232] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahOVkqM6ssnLWYf6CVBIEwAAAFY"]
[Mon May 25 08:19:32.333631 2026] [:error] [pid 62722:tid 62736] [client 145.239.65.226:33270] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahOVlKM6ssnLWYf6CVBIHwAAAEw"]
[Mon May 25 08:19:34.344832 2026] [:error] [pid 62722:tid 62732] [client 145.239.65.226:33274] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahOVlqM6ssnLWYf6CVBIKgAAAEg"]
[Mon May 25 08:19:36.373566 2026] [:error] [pid 62427:tid 62471] [client 145.239.65.226:33282] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahOVmPMUa83fc4GDyBzy8wAAAU4"]
[Mon May 25 08:19:38.383913 2026] [:error] [pid 62426:tid 62446] [client 145.239.65.226:33286] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahOVmkj3D3Mo8ANpTRBztwAAABA"]
[Mon May 25 08:19:40.276981 2026] [:error] [pid 62427:tid 62458] [client 145.239.65.226:33302] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahOVnPMUa83fc4GDyBzy9QAAAUE"]
[Mon May 25 08:19:42.183296 2026] [:error] [pid 62426:tid 62438] [client 145.239.65.226:50756] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahOVnkj3D3Mo8ANpTRBzvgAAAAg"]
[Mon May 25 08:19:44.190736 2026] [:error] [pid 62515:tid 62536] [client 145.239.65.226:50768] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahOVoBig0_XsOwmnrv9SWAAAANM"]
[Mon May 25 08:19:46.773124 2026] [:error] [pid 62426:tid 62450] [client 145.239.65.226:41900] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20168.aspx"] [unique_id "ahOVokj3D3Mo8ANpTRBzwwAAABQ"]
[Mon May 25 08:19:48.709672 2026] [:error] [pid 62722:tid 62729] [client 145.239.65.226:50774] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahOVpKM6ssnLWYf6CVBIRAAAAEU"]
[Mon May 25 08:19:51.309112 2026] [:error] [pid 62427:tid 62465] [client 145.239.65.226:41906] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahOVp_MUa83fc4GDyBzzCQAAAUg"]
[Mon May 25 08:19:53.134936 2026] [:error] [pid 62428:tid 62503] [client 145.239.65.226:53120] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahOVqZNosGBa7mui3VSgXgAAAJM"]
[Mon May 25 08:19:55.581495 2026] [:error] [pid 62428:tid 62487] [client 145.239.65.226:34424] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahOVq5NosGBa7mui3VSgYwAAAIM"]
[Mon May 25 08:19:57.575759 2026] [:error] [pid 62427:tid 62463] [client 145.239.65.226:53130] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahOVrfMUa83fc4GDyBzzCwAAAUY"]
[Mon May 25 08:19:59.584363 2026] [:error] [pid 62515:tid 62521] [client 145.239.65.226:53134] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahOVrxig0_XsOwmnrv9SdAAAAMQ"]
[Mon May 25 08:20:01.461841 2026] [:error] [pid 62515:tid 62530] [client 145.239.65.226:60986] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahOVsRig0_XsOwmnrv9SegAAAM0"]
[Mon May 25 08:20:03.375023 2026] [:error] [pid 62428:tid 62500] [client 145.239.65.226:60998] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahOVs5NosGBa7mui3VSgbwAAAJA"]
[Mon May 25 08:20:05.284660 2026] [:error] [pid 62428:tid 62506] [client 145.239.65.226:32772] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahOVtZNosGBa7mui3VSgeAAAAJY"]
[Mon May 25 08:20:07.174204 2026] [:error] [pid 62427:tid 62464] [client 145.239.65.226:32788] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahOVt_MUa83fc4GDyBzzHwAAAUc"]
[Mon May 25 08:20:09.641122 2026] [:error] [pid 62722:tid 62743] [client 145.239.65.226:57362] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahOVuaM6ssnLWYf6CVBIeAAAAFM"]
[Mon May 25 08:20:11.602684 2026] [:error] [pid 62426:tid 62446] [client 145.239.65.226:39668] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahOVu0j3D3Mo8ANpTRBz0wAAABA"]
[Mon May 25 08:20:14.067820 2026] [:error] [pid 62426:tid 62434] [client 145.239.65.226:51554] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahOVvkj3D3Mo8ANpTRBz1gAAAAQ"]
[Mon May 25 08:20:16.192034 2026] [:error] [pid 62515:tid 62540] [client 145.239.65.226:39680] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahOVwBig0_XsOwmnrv9SpAAAANc"]
[Mon May 25 08:20:38.496471 2026] [:error] [pid 62722:tid 62730] [client 145.239.65.226:55494] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/all%20slot.aspx"] [unique_id "ahOV1qM6ssnLWYf6CVBI3AAAAEY"]
[Mon May 25 08:20:40.487815 2026] [:error] [pid 62427:tid 62468] [client 145.239.65.226:58516] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/allslot%20wallet.aspx"] [unique_id "ahOV2PMUa83fc4GDyBzzaQAAAUs"]
[Mon May 25 08:20:42.523085 2026] [:error] [pid 62722:tid 62734] [client 145.239.65.226:48120] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ahOV2qM6ssnLWYf6CVBI8AAAAEo"]
[Mon May 25 08:20:44.394605 2026] [:error] [pid 62722:tid 62738] [client 145.239.65.226:48126] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ahOV3KM6ssnLWYf6CVBI9gAAAE4"]
[Mon May 25 08:20:46.412314 2026] [:error] [pid 62428:tid 62500] [client 145.239.65.226:48134] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ahOV3pNosGBa7mui3VSgzwAAAJA"]
[Mon May 25 08:20:48.289853 2026] [:error] [pid 62722:tid 62742] [client 145.239.65.226:48140] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ahOV4KM6ssnLWYf6CVBJAwAAAFI"]
[Mon May 25 08:20:50.335116 2026] [:error] [pid 62722:tid 62735] [client 145.239.65.226:48152] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahOV4qM6ssnLWYf6CVBJCAAAAEs"]
[Mon May 25 08:20:52.207676 2026] [:error] [pid 62515:tid 62531] [client 145.239.65.226:43634] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahOV5Big0_XsOwmnrv9TFwAAAM4"]
[Mon May 25 08:20:54.247513 2026] [:error] [pid 62515:tid 62519] [client 145.239.65.226:43650] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahOV5hig0_XsOwmnrv9THwAAAMI"]
[Mon May 25 08:20:56.118439 2026] [:error] [pid 62722:tid 62737] [client 145.239.65.226:43658] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahOV6KM6ssnLWYf6CVBJEQAAAE0"]
[Mon May 25 08:20:58.156528 2026] [:error] [pid 62427:tid 62480] [client 145.239.65.226:43662] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahOV6vMUa83fc4GDyBzzcAAAAVc"]
[Mon May 25 08:21:00.036616 2026] [:error] [pid 62426:tid 62454] [client 145.239.65.226:43668] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahOV7Ej3D3Mo8ANpTRB0AgAAABg"]
[Mon May 25 08:21:02.075042 2026] [:error] [pid 62426:tid 62430] [client 145.239.65.226:44846] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahOV7kj3D3Mo8ANpTRB0CwAAAAA"]
[Mon May 25 08:21:03.926129 2026] [:error] [pid 62427:tid 62461] [client 145.239.65.226:44850] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahOV7_MUa83fc4GDyBzzeAAAAUQ"]
[Mon May 25 08:21:05.958711 2026] [:error] [pid 62427:tid 62476] [client 145.239.65.226:44860] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahOV8fMUa83fc4GDyBzzewAAAVM"]
[Mon May 25 08:21:07.846894 2026] [:error] [pid 62427:tid 62462] [client 145.239.65.226:44874] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahOV8_MUa83fc4GDyBzzfwAAAUU"]
[Mon May 25 08:21:09.875444 2026] [:error] [pid 62722:tid 62730] [client 145.239.65.226:44888] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahOV9aM6ssnLWYf6CVBJJAAAAEY"]
[Mon May 25 08:21:11.916127 2026] [:error] [pid 62722:tid 62741] [client 145.239.65.226:47914] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ahOV96M6ssnLWYf6CVBJLgAAAFE"]
[Mon May 25 08:21:13.940925 2026] [:error] [pid 62722:tid 62724] [client 145.239.65.226:47928] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahOV-aM6ssnLWYf6CVBJOQAAAEA"]
[Mon May 25 08:21:15.967639 2026] [:error] [pid 62426:tid 62448] [client 145.239.65.226:47944] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ahOV-0j3D3Mo8ANpTRB0FQAAABI"]
[Mon May 25 08:21:17.979769 2026] [:error] [pid 62722:tid 62727] [client 145.239.65.226:47958] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahOV_aM6ssnLWYf6CVBJRQAAAEM"]
[Mon May 25 08:21:20.018050 2026] [:error] [pid 62427:tid 62459] [client 145.239.65.226:47968] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahOWAPMUa83fc4GDyBzzjgAAAUI"]
[Mon May 25 08:21:21.875723 2026] [:error] [pid 62427:tid 62469] [client 145.239.65.226:58528] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahOWAfMUa83fc4GDyBzzkAAAAUw"]
[Mon May 25 08:21:23.896744 2026] [:error] [pid 62427:tid 62465] [client 145.239.65.226:58536] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20789.aspx"] [unique_id "ahOWA_MUa83fc4GDyBzzlQAAAUg"]
[Mon May 25 08:21:25.924934 2026] [:error] [pid 62427:tid 62464] [client 145.239.65.226:58550] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahOWBfMUa83fc4GDyBzzmgAAAUc"]
[Mon May 25 08:21:27.780926 2026] [:error] [pid 62427:tid 62479] [client 145.239.65.226:58562] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahOWB_MUa83fc4GDyBzzngAAAVY"]
[Mon May 25 08:21:29.796993 2026] [:error] [pid 62428:tid 62488] [client 145.239.65.226:58564] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahOWCZNosGBa7mui3VSg7AAAAIQ"]
[Mon May 25 08:21:31.818431 2026] [:error] [pid 62428:tid 62506] [client 145.239.65.226:46800] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahOWC5NosGBa7mui3VSg8gAAAJY"]
[Mon May 25 08:21:33.842789 2026] [:error] [pid 62722:tid 62745] [client 145.239.65.226:46804] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahOWDaM6ssnLWYf6CVBJZgAAAFU"]
[Mon May 25 08:21:35.699891 2026] [:error] [pid 62722:tid 62732] [client 145.239.65.226:46806] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahOWD6M6ssnLWYf6CVBJcgAAAEg"]
[Mon May 25 08:21:56.478722 2026] [:error] [pid 62722:tid 62740] [client 145.239.65.226:46808] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahOWJKM6ssnLWYf6CVBJxQAAAFA"]
[Mon May 25 08:21:58.451579 2026] [:error] [pid 62428:tid 62506] [client 145.239.65.226:41276] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahOWJpNosGBa7mui3VShDwAAAJY"]
[Mon May 25 08:22:00.449326 2026] [:error] [pid 62722:tid 62736] [client 145.239.65.226:41284] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahOWKKM6ssnLWYf6CVBJ1QAAAEw"]
[Mon May 25 08:22:02.457231 2026] [:error] [pid 62427:tid 62473] [client 145.239.65.226:50106] [client 145.239.65.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahOWKvMUa83fc4GDyBzzywAAAVA"]
[Mon May 25 09:47:54.538382 2026] [:error] [pid 62515:tid 62541] [client 94.103.87.20:38572] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ahOqShig0_XsOwmnrv9zgAAAANg"]
[Mon May 25 09:47:57.178488 2026] [autoindex:error] [pid 62428:tid 62485] [client 4.225.163.177:6078] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 09:47:57.450111 2026] [proxy_fcgi:error] [pid 62428:tid 62495] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:57.716472 2026] [proxy_fcgi:error] [pid 62428:tid 62504] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:57.983177 2026] [proxy_fcgi:error] [pid 62428:tid 62500] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:58.250567 2026] [proxy_fcgi:error] [pid 62428:tid 62491] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:58.524276 2026] [proxy_fcgi:error] [pid 62428:tid 62490] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:58.790048 2026] [proxy_fcgi:error] [pid 62428:tid 62507] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:59.055712 2026] [proxy_fcgi:error] [pid 62428:tid 62496] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:59.323042 2026] [proxy_fcgi:error] [pid 62428:tid 62485] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:47:59.588511 2026] [proxy_fcgi:error] [pid 62428:tid 62497] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:48:00.121375 2026] [proxy_fcgi:error] [pid 62428:tid 62504] [client 4.225.163.177:6078] AH01071: Got error 'Primary script unknown'
[Mon May 25 09:48:00.385530 2026] [:error] [pid 62428:tid 62500] [client 4.225.163.177:6078] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahOqUJNosGBa7mui3VS7NwAAAJA"]
[Mon May 25 09:48:01.846595 2026] [:error] [pid 62426:tid 62435] [client 4.225.163.177:43541] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahOqUUj3D3Mo8ANpTRCGXgAAAAU"]
[Mon May 25 09:48:02.905319 2026] [:error] [pid 62722:tid 62727] [client 4.225.163.177:43582] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahOqUqM6ssnLWYf6CVB37AAAAEM"]
[Mon May 25 09:48:04.266136 2026] [:error] [pid 62722:tid 62739] [client 4.225.163.177:5753] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahOqVKM6ssnLWYf6CVB37wAAAE8"]
[Mon May 25 09:49:26.419285 2026] [:error] [pid 62426:tid 62448] [client 115.63.64.92:17576] [client 115.63.64.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahOqpkj3D3Mo8ANpTRCGgQAAABI"], referer: http://switchcreative.net/
[Mon May 25 09:58:44.296037 2026] [:error] [pid 62515:tid 62539] [client 94.103.87.20:54782] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahOs1Big0_XsOwmnrv94TgAAANY"]
[Mon May 25 09:59:07.853313 2026] [:error] [pid 62428:tid 62507] [client 94.103.87.20:46598] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahOs65NosGBa7mui3VS_HgAAAJc"]
[Mon May 25 09:59:21.562969 2026] [:error] [pid 62722:tid 62746] [client 94.103.87.20:43944] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sa%20casino.aspx"] [unique_id "ahOs-aM6ssnLWYf6CVB9cgAAAFY"]
[Mon May 25 09:59:25.425992 2026] [:error] [pid 62427:tid 62462] [client 94.103.87.20:53430] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahOs_fMUa83fc4GDyBwO8QAAAUU"]
[Mon May 25 10:00:54.742124 2026] [:error] [pid 62428:tid 62485] [client 94.103.87.20:38080] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahOtVpNosGBa7mui3VS_5wAAAIE"]
[Mon May 25 10:00:59.249298 2026] [:error] [pid 62428:tid 62493] [client 94.103.87.20:42854] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahOtW5NosGBa7mui3VS_9wAAAIk"]
[Mon May 25 10:01:02.104040 2026] [:error] [pid 62428:tid 62503] [client 94.103.87.20:53532] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahOtXpNosGBa7mui3VTACAAAAJM"]
[Mon May 25 10:01:07.535420 2026] [:error] [pid 62722:tid 62740] [client 94.103.87.20:47418] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahOtY6M6ssnLWYf6CVB_HQAAAFA"]
[Mon May 25 10:01:28.740746 2026] [:error] [pid 62515:tid 62531] [client 94.103.87.20:50776] [client 94.103.87.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ahOteBig0_XsOwmnrv96JAAAAM4"]
[Mon May 25 10:12:32.351794 2026] [:error] [pid 62427:tid 62472] [client 185.231.100.72:43108] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahOwEPMUa83fc4GDyBwSIAAAAU8"]
[Mon May 25 10:12:33.540266 2026] [:error] [pid 62426:tid 62431] [client 185.231.100.72:55034] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahOwEUj3D3Mo8ANpTRCMPgAAAAE"]
[Mon May 25 10:12:37.373325 2026] [:error] [pid 62722:tid 62732] [client 185.231.100.72:55040] [client 185.231.100.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahOwFaM6ssnLWYf6CVCEFgAAAEg"]
[Mon May 25 11:13:18.310810 2026] [:error] [pid 62427:tid 62477] [client 147.135.213.153:45618] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahO-TvMUa83fc4GDyBwhjgAAAVQ"]
[Mon May 25 11:13:20.973176 2026] [:error] [pid 62722:tid 62741] [client 147.135.213.153:38454] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahO-UKM6ssnLWYf6CVCkMAAAAFE"]
[Mon May 25 11:13:23.589119 2026] [:error] [pid 62722:tid 62738] [client 147.135.213.153:38470] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahO-U6M6ssnLWYf6CVCkMQAAAE4"]
[Mon May 25 11:13:26.195447 2026] [:error] [pid 62428:tid 62490] [client 147.135.213.153:38476] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahO-VpNosGBa7mui3VTVzAAAAIY"]
[Mon May 25 11:13:28.958809 2026] [:error] [pid 62722:tid 62732] [client 147.135.213.153:35340] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahO-WKM6ssnLWYf6CVCkNAAAAEg"]
[Mon May 25 11:13:31.742940 2026] [:error] [pid 62722:tid 62726] [client 147.135.213.153:35346] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahO-W6M6ssnLWYf6CVCkNwAAAEI"]
[Mon May 25 11:13:34.493279 2026] [:error] [pid 62722:tid 62745] [client 147.135.213.153:35348] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahO-XqM6ssnLWYf6CVCkXAAAAFU"]
[Mon May 25 11:13:37.068841 2026] [:error] [pid 62427:tid 62475] [client 147.135.213.153:35358] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahO-YfMUa83fc4GDyBwhlwAAAVI"]
[Mon May 25 11:13:39.740610 2026] [:error] [pid 62427:tid 62474] [client 147.135.213.153:33812] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahO-Y_MUa83fc4GDyBwhnAAAAVE"]
[Mon May 25 11:13:42.635084 2026] [:error] [pid 62426:tid 62435] [client 147.135.213.153:33828] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahO-Zkj3D3Mo8ANpTRCYOQAAAAU"]
[Mon May 25 11:13:45.126977 2026] [:error] [pid 62427:tid 62460] [client 147.135.213.153:33830] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahO-afMUa83fc4GDyBwhpwAAAUM"]
[Mon May 25 11:13:47.887885 2026] [:error] [pid 62515:tid 62530] [client 147.135.213.153:33832] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahO-axig0_XsOwmnrv-ULAAAAM0"]
[Mon May 25 11:13:50.437076 2026] [:error] [pid 62515:tid 62527] [client 147.135.213.153:38412] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahO-bhig0_XsOwmnrv-UiwAAAMo"]
[Mon May 25 11:13:57.455592 2026] [:error] [pid 62426:tid 62447] [client 147.135.213.153:54270] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahO-dUj3D3Mo8ANpTRCYRgAAABE"]
[Mon May 25 11:14:01.412900 2026] [:error] [pid 62722:tid 62729] [client 147.135.213.153:57560] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahO-eaM6ssnLWYf6CVCkmwAAAEU"]
[Mon May 25 12:14:00.119630 2026] [proxy_fcgi:error] [pid 62515:tid 62537] [client 20.206.89.89:36887] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:36:59.647570 2026] [autoindex:error] [pid 62722:tid 62748] [client 4.225.163.177:37739] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 13:36:59.918959 2026] [proxy_fcgi:error] [pid 62722:tid 62741] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:00.185567 2026] [proxy_fcgi:error] [pid 62722:tid 62742] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:00.453180 2026] [proxy_fcgi:error] [pid 62722:tid 62737] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:00.718616 2026] [proxy_fcgi:error] [pid 62722:tid 62728] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:00.984533 2026] [proxy_fcgi:error] [pid 62722:tid 62747] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:01.272114 2026] [proxy_fcgi:error] [pid 62722:tid 62734] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:01.537958 2026] [proxy_fcgi:error] [pid 62722:tid 62726] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:01.808828 2026] [proxy_fcgi:error] [pid 62722:tid 62740] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:02.074650 2026] [proxy_fcgi:error] [pid 62722:tid 62739] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:02.608872 2026] [proxy_fcgi:error] [pid 62722:tid 62728] [client 4.225.163.177:37739] AH01071: Got error 'Primary script unknown'
[Mon May 25 13:37:02.870700 2026] [:error] [pid 62722:tid 62725] [client 4.225.163.177:37739] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahPf_qM6ssnLWYf6CVDkMwAAAEE"]
[Mon May 25 13:37:04.036569 2026] [:error] [pid 62722:tid 62744] [client 4.225.163.177:36702] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahPgAKM6ssnLWYf6CVDkNgAAAFQ"]
[Mon May 25 13:37:05.093588 2026] [:error] [pid 62722:tid 62724] [client 4.225.163.177:34103] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahPgAaM6ssnLWYf6CVDkOAAAAEA"]
[Mon May 25 13:37:06.408811 2026] [:error] [pid 62426:tid 62432] [client 4.225.163.177:42792] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class-t.api.php"] [unique_id "ahPgAkj3D3Mo8ANpTRCslAAAAAI"]
[Mon May 25 17:08:12.969767 2026] [:error] [pid 62722:tid 62747] [client 43.160.241.129:53164] [client 43.160.241.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahQRfKM6ssnLWYf6CVAsdgAAAFc"]
[Mon May 25 19:06:26.176673 2026] [proxy_fcgi:error] [pid 62515:tid 62539] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:26.388396 2026] [proxy_fcgi:error] [pid 62515:tid 62520] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:26.598601 2026] [proxy_fcgi:error] [pid 62515:tid 62521] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:26.823776 2026] [proxy_fcgi:error] [pid 62515:tid 62530] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:27.034834 2026] [proxy_fcgi:error] [pid 62515:tid 62517] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:27.577468 2026] [proxy_fcgi:error] [pid 62515:tid 62522] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:27.880144 2026] [proxy_fcgi:error] [pid 62515:tid 62535] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:28.090184 2026] [proxy_fcgi:error] [pid 62515:tid 62523] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:28.376468 2026] [proxy_fcgi:error] [pid 62515:tid 62541] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:28.587074 2026] [proxy_fcgi:error] [pid 62515:tid 62528] [client 20.151.106.7:63027] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:06:28.794635 2026] [:error] [pid 62515:tid 62529] [client 20.151.106.7:63027] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-indx.php"] [unique_id "ahQtNBig0_XsOwmnrv8g7wAAAMw"]
[Mon May 25 19:06:31.040659 2026] [:error] [pid 62515:tid 62534] [client 20.151.106.7:36666] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-indx.php"] [unique_id "ahQtNxig0_XsOwmnrv8g8AAAANE"]
[Mon May 25 19:06:33.136029 2026] [:error] [pid 62428:tid 62492] [client 20.151.106.7:36670] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-indx.php"] [unique_id "ahQtOZNosGBa7mui3VQ5OgAAAIg"]
[Mon May 25 19:06:36.662697 2026] [:error] [pid 62428:tid 62508] [client 20.151.106.7:46723] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-indx.php"] [unique_id "ahQtPJNosGBa7mui3VQ5QQAAAJg"]
[Mon May 25 19:06:38.696050 2026] [:error] [pid 62515:tid 62533] [client 20.151.106.7:36609] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoo.php"] [unique_id "ahQtPhig0_XsOwmnrv8g-QAAANA"]
[Mon May 25 19:06:43.955873 2026] [:error] [pid 3698:tid 3716] [client 20.151.106.7:40737] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zoo.php"] [unique_id "ahQtQwtZBEwA4fyFLKPjUQAAARA"]
[Mon May 25 19:06:53.611385 2026] [:error] [pid 62428:tid 62484] [client 20.151.106.7:51528] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-spm.php"] [unique_id "ahQtTZNosGBa7mui3VQ5YgAAAIA"]
[Mon May 25 19:06:55.073807 2026] [:error] [pid 62428:tid 62491] [client 20.151.106.7:36730] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-spm.php"] [unique_id "ahQtT5NosGBa7mui3VQ5aQAAAIc"]
[Mon May 25 19:06:55.847182 2026] [:error] [pid 62428:tid 62498] [client 20.151.106.7:15752] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-spm.php"] [unique_id "ahQtT5NosGBa7mui3VQ5bQAAAI4"]
[Mon May 25 19:07:00.998539 2026] [:error] [pid 62426:tid 62444] [client 20.151.106.7:35453] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-spm.php"] [unique_id "ahQtVEj3D3Mo8ANpTRDrqwAAAA4"]
[Mon May 25 19:07:04.087955 2026] [:error] [pid 62722:tid 62740] [client 20.151.106.7:34061] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahQtWKM6ssnLWYf6CVA-iwAAAFA"]
[Mon May 25 19:07:08.141509 2026] [:error] [pid 53791:tid 53800] [client 20.151.106.7:38505] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahQtXCCRhhNTD40Nf1ULHAAAAYc"]
[Mon May 25 19:07:11.330616 2026] [:error] [pid 62515:tid 62517] [client 20.151.106.7:63582] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahQtXxig0_XsOwmnrv8hKAAAAMA"]
[Mon May 25 19:07:13.269989 2026] [:error] [pid 3698:tid 3723] [client 20.151.106.7:16470] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-link-snpm.php"] [unique_id "ahQtYQtZBEwA4fyFLKPjawAAARc"]
[Mon May 25 19:07:15.357445 2026] [:error] [pid 62428:tid 62493] [client 20.151.106.7:36690] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahQtY5NosGBa7mui3VQ5ggAAAIk"]
[Mon May 25 19:07:16.933909 2026] [:error] [pid 62428:tid 62489] [client 20.151.106.7:49831] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahQtZJNosGBa7mui3VQ5jwAAAIU"]
[Mon May 25 19:07:18.194457 2026] [:error] [pid 53791:tid 53797] [client 20.151.106.7:35431] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahQtZiCRhhNTD40Nf1ULIwAAAYQ"]
[Mon May 25 19:07:20.276061 2026] [:error] [pid 62515:tid 62538] [client 20.151.106.7:36700] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xminie.php"] [unique_id "ahQtaBig0_XsOwmnrv8hNgAAANU"]
[Mon May 25 19:07:33.394186 2026] [proxy_fcgi:error] [pid 62428:tid 62488] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:34.141739 2026] [proxy_fcgi:error] [pid 62428:tid 62490] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:34.360921 2026] [proxy_fcgi:error] [pid 62428:tid 62507] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:34.611938 2026] [proxy_fcgi:error] [pid 62428:tid 62484] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:34.822317 2026] [proxy_fcgi:error] [pid 62428:tid 62496] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:35.057965 2026] [proxy_fcgi:error] [pid 62428:tid 62494] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:35.426197 2026] [proxy_fcgi:error] [pid 62428:tid 62486] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:35.637971 2026] [proxy_fcgi:error] [pid 62428:tid 62508] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:35.862507 2026] [proxy_fcgi:error] [pid 62428:tid 62499] [client 20.151.106.7:63605] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:36.069121 2026] [:error] [pid 62428:tid 62505] [client 20.151.106.7:63605] [client 20.151.106.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "switchcreative.net"] [uri "/tiny.php"] [unique_id "ahQteJNosGBa7mui3VQ5twAAAJU"]
[Mon May 25 19:07:37.628360 2026] [proxy_fcgi:error] [pid 3698:tid 3717] [client 20.151.106.7:36689] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:37.860409 2026] [proxy_fcgi:error] [pid 3698:tid 3703] [client 20.151.106.7:36689] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:07:38.068274 2026] [:error] [pid 3698:tid 3722] [client 20.151.106.7:36689] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "ahQtegtZBEwA4fyFLKPjigAAARY"]
[Mon May 25 19:07:40.429314 2026] [:error] [pid 62515:tid 62524] [client 20.151.106.7:36678] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "ahQtfBig0_XsOwmnrv8hYQAAAMc"]
[Mon May 25 19:07:42.257386 2026] [:error] [pid 62428:tid 62508] [client 20.151.106.7:33531] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "ahQtfpNosGBa7mui3VQ6IgAAAJg"]
[Mon May 25 19:07:43.957500 2026] [:error] [pid 62428:tid 62506] [client 20.151.106.7:52229] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/tires.php"] [unique_id "ahQtf5NosGBa7mui3VQ6LAAAAJY"]
[Mon May 25 19:07:45.543089 2026] [:error] [pid 53791:tid 53793] [client 20.151.106.7:34089] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahQtgSCRhhNTD40Nf1ULPQAAAYA"]
[Mon May 25 19:07:50.750904 2026] [:error] [pid 62426:tid 62453] [client 20.151.106.7:52247] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahQthkj3D3Mo8ANpTRDr4AAAABc"]
[Mon May 25 19:07:55.764958 2026] [:error] [pid 3698:tid 3705] [client 20.151.106.7:35402] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahQtiwtZBEwA4fyFLKPjlQAAAQU"]
[Mon May 25 19:07:57.765917 2026] [:error] [pid 62515:tid 62521] [client 20.151.106.7:64913] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bthil.php"] [unique_id "ahQtjRig0_XsOwmnrv8hcAAAAMQ"]
[Mon May 25 19:07:59.688809 2026] [:error] [pid 62515:tid 62534] [client 20.151.106.7:64899] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "ahQtjxig0_XsOwmnrv8hdAAAANE"]
[Mon May 25 19:08:07.827340 2026] [:error] [pid 53791:tid 53801] [client 20.151.106.7:64939] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "ahQtlyCRhhNTD40Nf1ULRQAAAYg"]
[Mon May 25 19:08:12.058888 2026] [:error] [pid 62515:tid 62519] [client 20.151.106.7:37963] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/d.php"] [unique_id "ahQtnBig0_XsOwmnrv8hkAAAAMI"]
[Mon May 25 19:08:16.290885 2026] [:error] [pid 62515:tid 62517] [client 20.151.106.7:34055] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "ahQtoBig0_XsOwmnrv8hlQAAAMA"]
[Mon May 25 19:08:17.636654 2026] [:error] [pid 3698:tid 3715] [client 20.151.106.7:63581] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "ahQtoQtZBEwA4fyFLKPjqAAAAQ8"]
[Mon May 25 19:08:19.028585 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:63565] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "ahQto0j3D3Mo8ANpTRDsAgAAABM"]
[Mon May 25 19:08:20.694550 2026] [:error] [pid 3698:tid 3711] [client 20.151.106.7:33520] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cu.php"] [unique_id "ahQtpAtZBEwA4fyFLKPjrQAAAQs"]
[Mon May 25 19:08:22.098487 2026] [:error] [pid 62426:tid 62452] [client 20.151.106.7:53721] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "ahQtpkj3D3Mo8ANpTRDsCAAAABY"]
[Mon May 25 19:08:24.517098 2026] [:error] [pid 53791:tid 53794] [client 20.151.106.7:35420] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "ahQtqCCRhhNTD40Nf1ULVQAAAYE"]
[Mon May 25 19:08:27.101819 2026] [:error] [pid 62426:tid 62441] [client 20.151.106.7:35398] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "ahQtq0j3D3Mo8ANpTRDsDgAAAAs"]
[Mon May 25 19:08:28.659170 2026] [:error] [pid 62427:tid 62463] [client 20.151.106.7:35441] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fone1.php"] [unique_id "ahQtrPMUa83fc4GDyBxy7AAAAUY"]
[Mon May 25 19:08:32.008108 2026] [:error] [pid 62426:tid 62444] [client 20.151.106.7:52259] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahQtsEj3D3Mo8ANpTRDsEwAAAA4"]
[Mon May 25 19:08:36.123047 2026] [:error] [pid 62426:tid 62452] [client 20.151.106.7:52280] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sallu.php"] [unique_id "ahQttEj3D3Mo8ANpTRDsHgAAABY"]
[Mon May 25 19:08:39.798891 2026] [proxy_fcgi:error] [pid 62515:tid 62525] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:40.058919 2026] [proxy_fcgi:error] [pid 62515:tid 62518] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:40.569663 2026] [proxy_fcgi:error] [pid 62515:tid 62535] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:40.830061 2026] [proxy_fcgi:error] [pid 62515:tid 62529] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:42.419744 2026] [proxy_fcgi:error] [pid 62515:tid 62528] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:42.679294 2026] [proxy_fcgi:error] [pid 62515:tid 62522] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:43.244384 2026] [proxy_fcgi:error] [pid 62515:tid 62517] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:43.504171 2026] [proxy_fcgi:error] [pid 62515:tid 62534] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:43.779014 2026] [proxy_fcgi:error] [pid 62515:tid 62536] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:44.039348 2026] [proxy_fcgi:error] [pid 62515:tid 62537] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:44.306022 2026] [proxy_fcgi:error] [pid 62515:tid 62523] [client 20.151.106.7:35394] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:08:44.563038 2026] [:error] [pid 62515:tid 62530] [client 20.151.106.7:35394] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "ahQtvBig0_XsOwmnrv8hxgAAAM0"]
[Mon May 25 19:08:45.969484 2026] [:error] [pid 62428:tid 62506] [client 20.151.106.7:52282] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "ahQtvZNosGBa7mui3VQ6VwAAAJY"]
[Mon May 25 19:08:54.271303 2026] [:error] [pid 62426:tid 62451] [client 20.151.106.7:43639] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "ahQtxkj3D3Mo8ANpTRDsRgAAABU"]
[Mon May 25 19:08:56.610000 2026] [:error] [pid 53791:tid 53795] [client 20.151.106.7:15793] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/axe.php"] [unique_id "ahQtyCCRhhNTD40Nf1ULawAAAYI"]
[Mon May 25 19:09:01.073905 2026] [:error] [pid 62428:tid 62492] [client 20.151.106.7:52279] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "ahQtzZNosGBa7mui3VQ6YgAAAIg"]
[Mon May 25 19:09:02.710653 2026] [:error] [pid 3698:tid 3700] [client 20.151.106.7:43628] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "ahQtzgtZBEwA4fyFLKPjwwAAAQA"]
[Mon May 25 19:09:05.479804 2026] [:error] [pid 62722:tid 62731] [client 20.151.106.7:63592] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "ahQt0aM6ssnLWYf6CVA-zwAAAEc"]
[Mon May 25 19:09:08.272597 2026] [:error] [pid 3698:tid 3722] [client 20.151.106.7:52234] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/de.php"] [unique_id "ahQt1AtZBEwA4fyFLKPjywAAARY"]
[Mon May 25 19:09:09.735994 2026] [:error] [pid 3698:tid 3700] [client 20.151.106.7:52278] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahQt1QtZBEwA4fyFLKPjzwAAAQA"]
[Mon May 25 19:09:17.511346 2026] [:error] [pid 62428:tid 62503] [client 20.151.106.7:37965] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahQt3ZNosGBa7mui3VQ6aQAAAJM"]
[Mon May 25 19:09:18.726907 2026] [:error] [pid 62428:tid 62497] [client 20.151.106.7:63591] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahQt3pNosGBa7mui3VQ6awAAAI0"]
[Mon May 25 19:09:20.327393 2026] [:error] [pid 62428:tid 62493] [client 20.151.106.7:63578] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahQt4JNosGBa7mui3VQ6bgAAAIk"]
[Mon May 25 19:09:21.423445 2026] [:error] [pid 62428:tid 62485] [client 20.151.106.7:38003] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ahQt4ZNosGBa7mui3VQ6cgAAAIE"]
[Mon May 25 19:09:22.261833 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:52255] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ahQt4pNosGBa7mui3VQ6dgAAAIs"]
[Mon May 25 19:09:25.307375 2026] [:error] [pid 53791:tid 53803] [client 20.151.106.7:37974] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ahQt5SCRhhNTD40Nf1ULdgAAAYo"]
[Mon May 25 19:09:26.490188 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:37962] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/100.php"] [unique_id "ahQt5pNosGBa7mui3VQ6gwAAAIs"]
[Mon May 25 19:09:27.515753 2026] [:error] [pid 62427:tid 62458] [client 20.151.106.7:33485] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "ahQt5_MUa83fc4GDyBxzBgAAAUE"]
[Mon May 25 19:09:30.264604 2026] [:error] [pid 53791:tid 53816] [client 20.151.106.7:37980] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "ahQt6iCRhhNTD40Nf1ULeAAAAZc"]
[Mon May 25 19:09:31.060350 2026] [:error] [pid 53791:tid 53813] [client 20.151.106.7:33509] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "ahQt6yCRhhNTD40Nf1ULeQAAAZQ"]
[Mon May 25 19:09:32.859770 2026] [:error] [pid 62426:tid 62434] [client 20.151.106.7:53726] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/f5.php"] [unique_id "ahQt7Ej3D3Mo8ANpTRDsWQAAAAQ"]
[Mon May 25 19:09:37.816190 2026] [:error] [pid 62428:tid 62497] [client 20.151.106.7:43634] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "ahQt8ZNosGBa7mui3VQ6lAAAAI0"]
[Mon May 25 19:09:39.336805 2026] [:error] [pid 62515:tid 62541] [client 20.151.106.7:53743] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "ahQt8xig0_XsOwmnrv8h5wAAANg"]
[Mon May 25 19:09:42.781131 2026] [:error] [pid 62428:tid 62501] [client 20.151.106.7:36675] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "ahQt9pNosGBa7mui3VQ6nQAAAJE"]
[Mon May 25 19:09:43.714434 2026] [:error] [pid 62426:tid 62437] [client 20.151.106.7:43625] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/view.php"] [unique_id "ahQt90j3D3Mo8ANpTRDsYQAAAAc"]
[Mon May 25 19:09:44.678341 2026] [proxy_fcgi:error] [pid 62428:tid 62486] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:44.949976 2026] [proxy_fcgi:error] [pid 62428:tid 62487] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:45.273559 2026] [proxy_fcgi:error] [pid 62428:tid 62484] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:45.634877 2026] [proxy_fcgi:error] [pid 62428:tid 62499] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:45.894321 2026] [proxy_fcgi:error] [pid 62428:tid 62497] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:46.167401 2026] [proxy_fcgi:error] [pid 62428:tid 62493] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:46.522510 2026] [proxy_fcgi:error] [pid 62428:tid 62507] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:46.781840 2026] [proxy_fcgi:error] [pid 62428:tid 62508] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:47.041428 2026] [proxy_fcgi:error] [pid 62428:tid 62487] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:47.302388 2026] [proxy_fcgi:error] [pid 62428:tid 62495] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:47.588740 2026] [proxy_fcgi:error] [pid 62428:tid 62484] [client 20.151.106.7:33488] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:09:47.851038 2026] [:error] [pid 62428:tid 62500] [client 20.151.106.7:33488] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ahQt-5NosGBa7mui3VQ6tAAAAJA"]
[Mon May 25 19:09:55.020724 2026] [:error] [pid 62426:tid 62441] [client 20.151.106.7:36679] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ahQuA0j3D3Mo8ANpTRDsZQAAAAs"]
[Mon May 25 19:09:58.837369 2026] [:error] [pid 62428:tid 62503] [client 20.151.106.7:63595] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ahQuBpNosGBa7mui3VQ62wAAAJM"]
[Mon May 25 19:10:02.113303 2026] [:error] [pid 62427:tid 62457] [client 20.151.106.7:53697] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a1.php"] [unique_id "ahQuCvMUa83fc4GDyBxzFwAAAUA"]
[Mon May 25 19:10:03.414882 2026] [:error] [pid 62515:tid 62523] [client 20.151.106.7:33506] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "ahQuCxig0_XsOwmnrv8iAAAAAMY"]
[Mon May 25 19:10:09.761971 2026] [:error] [pid 62427:tid 62463] [client 20.151.106.7:35425] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "ahQuEfMUa83fc4GDyBxzGgAAAUY"]
[Mon May 25 19:10:11.772939 2026] [:error] [pid 62426:tid 62438] [client 20.151.106.7:35443] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "ahQuE0j3D3Mo8ANpTRDscwAAAAg"]
[Mon May 25 19:10:16.718623 2026] [:error] [pid 62428:tid 62493] [client 20.151.106.7:63606] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ms-edit.php"] [unique_id "ahQuGJNosGBa7mui3VQ7AwAAAIk"]
[Mon May 25 19:10:22.112080 2026] [:error] [pid 3698:tid 3709] [client 20.151.106.7:43623] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ahQuHgtZBEwA4fyFLKPkAAAAAQk"]
[Mon May 25 19:10:25.207844 2026] [:error] [pid 53791:tid 53812] [client 20.151.106.7:34076] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ahQuISCRhhNTD40Nf1ULjAAAAZM"]
[Mon May 25 19:10:28.572726 2026] [:error] [pid 62722:tid 62735] [client 20.151.106.7:37960] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/8.php"] [unique_id "ahQuJKM6ssnLWYf6CVA_AgAAAEs"]
[Mon May 25 19:10:35.476468 2026] [:error] [pid 3698:tid 3708] [client 20.151.106.7:43592] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ahQuKwtZBEwA4fyFLKPkCgAAAQg"]
[Mon May 25 19:10:36.336739 2026] [:error] [pid 53791:tid 53795] [client 20.151.106.7:33478] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ahQuLCCRhhNTD40Nf1ULjgAAAYI"]
[Mon May 25 19:10:37.327351 2026] [:error] [pid 53791:tid 53798] [client 20.151.106.7:34065] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ahQuLSCRhhNTD40Nf1ULkAAAAYU"]
[Mon May 25 19:10:39.233490 2026] [:error] [pid 3698:tid 3701] [client 20.151.106.7:33498] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xltt.php"] [unique_id "ahQuLwtZBEwA4fyFLKPkDwAAAQE"]
[Mon May 25 19:10:41.028784 2026] [:error] [pid 62428:tid 62490] [client 20.151.106.7:35447] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahQuMZNosGBa7mui3VQ7SgAAAIY"]
[Mon May 25 19:10:44.759200 2026] [:error] [pid 62426:tid 62454] [client 20.151.106.7:52235] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahQuNEj3D3Mo8ANpTRDshwAAABg"]
[Mon May 25 19:10:46.390848 2026] [:error] [pid 62515:tid 62522] [client 20.151.106.7:64951] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahQuNhig0_XsOwmnrv8iLAAAAMU"]
[Mon May 25 19:10:48.374941 2026] [proxy_fcgi:error] [pid 62515:tid 62529] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:48.637348 2026] [proxy_fcgi:error] [pid 62515:tid 62537] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:48.899304 2026] [proxy_fcgi:error] [pid 62515:tid 62539] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:50.312565 2026] [proxy_fcgi:error] [pid 62515:tid 62539] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:50.575456 2026] [proxy_fcgi:error] [pid 62515:tid 62532] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:50.878187 2026] [proxy_fcgi:error] [pid 62515:tid 62535] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:51.143742 2026] [proxy_fcgi:error] [pid 62515:tid 62522] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:51.428057 2026] [proxy_fcgi:error] [pid 62515:tid 62520] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:51.695523 2026] [proxy_fcgi:error] [pid 62515:tid 62519] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:51.957455 2026] [proxy_fcgi:error] [pid 62515:tid 62536] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:52.225393 2026] [proxy_fcgi:error] [pid 62515:tid 62538] [client 20.151.106.7:63583] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:10:52.503988 2026] [:error] [pid 62515:tid 62541] [client 20.151.106.7:63583] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ahQuPBig0_XsOwmnrv8iQwAAANg"]
[Mon May 25 19:10:54.150726 2026] [:error] [pid 62515:tid 62525] [client 20.151.106.7:52251] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ahQuPhig0_XsOwmnrv8iRwAAAMg"]
[Mon May 25 19:10:54.794860 2026] [:error] [pid 62722:tid 62727] [client 20.151.106.7:52239] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ahQuPqM6ssnLWYf6CVA_IAAAAEM"]
[Mon May 25 19:10:57.537675 2026] [:error] [pid 3698:tid 3722] [client 20.151.106.7:38011] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/fs.php"] [unique_id "ahQuQQtZBEwA4fyFLKPkLAAAARY"]
[Mon May 25 19:11:02.726270 2026] [:error] [pid 62515:tid 62522] [client 20.151.106.7:43624] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/2.php"] [unique_id "ahQuRhig0_XsOwmnrv8iYAAAAMU"]
[Mon May 25 19:11:15.247906 2026] [:error] [pid 62515:tid 62518] [client 20.151.106.7:52284] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "ahQuUxig0_XsOwmnrv8idgAAAME"]
[Mon May 25 19:11:16.489974 2026] [:error] [pid 62515:tid 62532] [client 20.151.106.7:63573] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "ahQuVBig0_XsOwmnrv8iewAAAM8"]
[Mon May 25 19:11:18.109105 2026] [:error] [pid 62515:tid 62534] [client 20.151.106.7:35414] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "ahQuVhig0_XsOwmnrv8igAAAANE"]
[Mon May 25 19:11:20.258080 2026] [:error] [pid 62515:tid 62521] [client 20.151.106.7:52248] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/man.php"] [unique_id "ahQuWBig0_XsOwmnrv8ihQAAAMQ"]
[Mon May 25 19:11:21.582583 2026] [:error] [pid 62515:tid 62536] [client 20.151.106.7:37976] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "ahQuWRig0_XsOwmnrv8iiQAAANM"]
[Mon May 25 19:11:23.666782 2026] [:error] [pid 62515:tid 62525] [client 20.151.106.7:63600] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "ahQuWxig0_XsOwmnrv8iiwAAAMg"]
[Mon May 25 19:11:25.164638 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:63557] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "ahQuXZNosGBa7mui3VQ7dwAAAIM"]
[Mon May 25 19:11:26.332463 2026] [:error] [pid 62428:tid 62489] [client 20.151.106.7:34070] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/12.php"] [unique_id "ahQuXpNosGBa7mui3VQ7ewAAAIU"]
[Mon May 25 19:11:29.791652 2026] [:error] [pid 53791:tid 53804] [client 20.151.106.7:52267] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ahQuYSCRhhNTD40Nf1ULzAAAAYs"]
[Mon May 25 19:11:32.893068 2026] [:error] [pid 62722:tid 62734] [client 20.151.106.7:35437] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ahQuZKM6ssnLWYf6CVA_VgAAAEo"]
[Mon May 25 19:11:36.522643 2026] [:error] [pid 62427:tid 62472] [client 20.151.106.7:64909] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ahQuaPMUa83fc4GDyBxzVgAAAU8"]
[Mon May 25 19:11:37.615834 2026] [:error] [pid 53791:tid 53796] [client 20.151.106.7:64932] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/acp.php"] [unique_id "ahQuaSCRhhNTD40Nf1UL0gAAAYM"]
[Mon May 25 19:11:40.549631 2026] [:error] [pid 53791:tid 53809] [client 20.151.106.7:63590] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ahQubCCRhhNTD40Nf1UL1AAAAZA"]
[Mon May 25 19:11:42.876077 2026] [:error] [pid 62722:tid 62748] [client 20.151.106.7:48581] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ahQubqM6ssnLWYf6CVA_ggAAAFg"]
[Mon May 25 19:11:44.236816 2026] [:error] [pid 3698:tid 3715] [client 20.151.106.7:16013] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ahQucAtZBEwA4fyFLKPkPwAAAQ8"]
[Mon May 25 19:11:46.769620 2026] [:error] [pid 62722:tid 62725] [client 20.151.106.7:35419] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wps.php"] [unique_id "ahQucqM6ssnLWYf6CVA_hQAAAEE"]
[Mon May 25 19:11:49.116892 2026] [:error] [pid 62515:tid 62536] [client 20.151.106.7:16045] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "ahQudRig0_XsOwmnrv8iuwAAANM"]
[Mon May 25 19:11:50.887446 2026] [:error] [pid 62515:tid 62532] [client 20.151.106.7:33477] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alpha.php"] [unique_id "ahQudhig0_XsOwmnrv8iwgAAAM8"]
[Mon May 25 19:11:54.348847 2026] [proxy_fcgi:error] [pid 53791:tid 53811] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:54.559341 2026] [proxy_fcgi:error] [pid 53791:tid 53810] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:54.970898 2026] [proxy_fcgi:error] [pid 53791:tid 53796] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:55.213176 2026] [proxy_fcgi:error] [pid 53791:tid 53800] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:55.437700 2026] [proxy_fcgi:error] [pid 53791:tid 53794] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:55.654850 2026] [proxy_fcgi:error] [pid 53791:tid 53795] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:55.895093 2026] [proxy_fcgi:error] [pid 53791:tid 53793] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:56.150852 2026] [proxy_fcgi:error] [pid 53791:tid 53798] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:56.360876 2026] [proxy_fcgi:error] [pid 53791:tid 53797] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:56.587175 2026] [proxy_fcgi:error] [pid 53791:tid 53812] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:56.797138 2026] [proxy_fcgi:error] [pid 53791:tid 53802] [client 20.151.106.7:16060] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:11:57.014934 2026] [:error] [pid 53791:tid 53808] [client 20.151.106.7:16060] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ahQufSCRhhNTD40Nf1UL7QAAAY8"]
[Mon May 25 19:11:59.810576 2026] [:error] [pid 62428:tid 62489] [client 20.151.106.7:42267] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ahQuf5NosGBa7mui3VQ7ggAAAIU"]
[Mon May 25 19:12:00.952252 2026] [:error] [pid 62722:tid 62748] [client 20.151.106.7:48601] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ahQugKM6ssnLWYf6CVA_iwAAAFg"]
[Mon May 25 19:12:03.548339 2026] [:error] [pid 62426:tid 62440] [client 20.151.106.7:48591] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ayk.php"] [unique_id "ahQug0j3D3Mo8ANpTRDspAAAAAo"]
[Mon May 25 19:12:05.484874 2026] [:error] [pid 53791:tid 53798] [client 20.151.106.7:42285] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ahQuhSCRhhNTD40Nf1UL9QAAAYU"]
[Mon May 25 19:12:23.722648 2026] [:error] [pid 62426:tid 62446] [client 20.151.106.7:52328] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "ahQul0j3D3Mo8ANpTRDstQAAABA"]
[Mon May 25 19:12:26.165461 2026] [:error] [pid 53791:tid 53808] [client 20.151.106.7:53752] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "ahQumiCRhhNTD40Nf1UMAwAAAY8"]
[Mon May 25 19:12:29.543747 2026] [:error] [pid 62428:tid 62506] [client 20.151.106.7:38009] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "ahQunZNosGBa7mui3VQ7mQAAAJY"]
[Mon May 25 19:12:32.528061 2026] [:error] [pid 62515:tid 62531] [client 20.151.106.7:42283] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wpxml.php"] [unique_id "ahQuoBig0_XsOwmnrv8i6wAAAM4"]
[Mon May 25 19:12:35.365674 2026] [:error] [pid 62428:tid 62502] [client 20.151.106.7:44172] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "ahQuo5NosGBa7mui3VQ7nAAAAJI"]
[Mon May 25 19:12:40.768613 2026] [:error] [pid 62428:tid 62491] [client 20.151.106.7:48619] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "ahQuqJNosGBa7mui3VQ7oAAAAIc"]
[Mon May 25 19:12:46.088425 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:53723] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "ahQurpNosGBa7mui3VQ7sQAAAIM"]
[Mon May 25 19:12:47.785973 2026] [:error] [pid 62427:tid 62463] [client 20.151.106.7:62283] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/zo.php"] [unique_id "ahQur_MUa83fc4GDyBxzcwAAAUY"]
[Mon May 25 19:12:49.255504 2026] [:error] [pid 62426:tid 62448] [client 20.151.106.7:42297] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sky.php"] [unique_id "ahQusUj3D3Mo8ANpTRDszgAAABI"]
[Mon May 25 19:12:59.373654 2026] [proxy_fcgi:error] [pid 62426:tid 62437] [client 20.151.106.7:42253] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:12:59.611356 2026] [proxy_fcgi:error] [pid 62426:tid 62446] [client 20.151.106.7:42253] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:12:59.824049 2026] [proxy_fcgi:error] [pid 62426:tid 62439] [client 20.151.106.7:42253] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:13:00.036903 2026] [proxy_fcgi:error] [pid 62426:tid 62453] [client 20.151.106.7:42253] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:13:00.265693 2026] [proxy_fcgi:error] [pid 62426:tid 62445] [client 20.151.106.7:42253] AH01071: Got error 'Primary script unknown'
[Mon May 25 19:56:19.790794 2026] [:error] [pid 62515:tid 62528] [client 49.235.136.28:39532] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahQ44xig0_XsOwmnrv8vMgAAAMs"]
[Mon May 25 21:24:27.084522 2026] [:error] [pid 3698:tid 3705] [client 43.134.36.238:56574] [client 43.134.36.238] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahRNiwtZBEwA4fyFLKP4YwAAAQU"]
[Mon May 25 22:26:28.003281 2026] [proxy_fcgi:error] [pid 53791:tid 53816] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:28.319300 2026] [proxy_fcgi:error] [pid 53791:tid 53794] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:28.642097 2026] [proxy_fcgi:error] [pid 53791:tid 53800] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:29.160418 2026] [proxy_fcgi:error] [pid 53791:tid 53806] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:29.474981 2026] [:error] [pid 53791:tid 53793] [client 20.197.232.217:47076] [client 20.197.232.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.197.232.217, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ahRcFSCRhhNTD40Nf1UvZwAAAYA"]
[Mon May 25 22:26:29.797900 2026] [proxy_fcgi:error] [pid 53791:tid 53809] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:30.241432 2026] [proxy_fcgi:error] [pid 53791:tid 53801] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:30.579496 2026] [proxy_fcgi:error] [pid 53791:tid 53804] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:31.859516 2026] [:error] [pid 53791:tid 53814] [client 20.197.232.217:47076] [client 20.197.232.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.197.232.217, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-login.php"] [unique_id "ahRcFyCRhhNTD40Nf1UvbAAAAZU"]
[Mon May 25 22:26:31.863290 2026] [proxy_fcgi:error] [pid 53791:tid 53814] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:36.596835 2026] [proxy_fcgi:error] [pid 53791:tid 53794] [client 20.197.232.217:47076] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:26:37.474599 2026] [:error] [pid 53791:tid 53800] [client 20.197.232.217:47076] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahRcHSCRhhNTD40Nf1UvcAAAAYc"]
[Mon May 25 22:26:38.994924 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:38158] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahRcHkj3D3Mo8ANpTRAj0wAAAA0"]
[Mon May 25 22:26:40.142750 2026] [:error] [pid 62515:tid 62536] [client 20.197.232.217:4880] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahRcIBig0_XsOwmnrv9dAgAAANM"]
[Mon May 25 22:26:41.004536 2026] [:error] [pid 53791:tid 53806] [client 20.197.232.217:5060] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahRcISCRhhNTD40Nf1UvcgAAAY0"]
[Mon May 25 22:26:42.121906 2026] [:error] [pid 62515:tid 62527] [client 20.197.232.217:42656] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2025/"] [unique_id "ahRcIhig0_XsOwmnrv9dBQAAAMo"]
[Mon May 25 22:26:43.534721 2026] [:error] [pid 62515:tid 62530] [client 20.197.232.217:40931] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2025/"] [unique_id "ahRcIxig0_XsOwmnrv9dBgAAAM0"]
[Mon May 25 22:26:45.045559 2026] [:error] [pid 62428:tid 62487] [client 20.197.232.217:4496] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2025/"] [unique_id "ahRcJZNosGBa7mui3VRyVAAAAIM"]
[Mon May 25 22:26:46.126065 2026] [:error] [pid 62428:tid 62492] [client 20.197.232.217:4483] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2025/"] [unique_id "ahRcJpNosGBa7mui3VRyVwAAAIg"]
[Mon May 25 22:26:46.813950 2026] [:error] [pid 62428:tid 62494] [client 20.197.232.217:11889] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ahRcJpNosGBa7mui3VRyWAAAAIo"]
[Mon May 25 22:26:47.521747 2026] [:error] [pid 62426:tid 62439] [client 20.197.232.217:5114] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ahRcJ0j3D3Mo8ANpTRAj3gAAAAk"]
[Mon May 25 22:26:48.537458 2026] [:error] [pid 62426:tid 62446] [client 20.197.232.217:40896] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ahRcKEj3D3Mo8ANpTRAj3wAAABA"]
[Mon May 25 22:26:49.220802 2026] [:error] [pid 62426:tid 62434] [client 20.197.232.217:42655] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin.php"] [unique_id "ahRcKUj3D3Mo8ANpTRAj4gAAAAQ"]
[Mon May 25 22:26:50.342356 2026] [:error] [pid 62426:tid 62440] [client 20.197.232.217:11880] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ahRcKkj3D3Mo8ANpTRAj5AAAAAo"]
[Mon May 25 22:26:51.251986 2026] [:error] [pid 62427:tid 62460] [client 20.197.232.217:30475] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ahRcK_MUa83fc4GDyByJcAAAAUM"]
[Mon May 25 22:26:52.528219 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:28634] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ahRcLBig0_XsOwmnrv9dCgAAAMU"]
[Mon May 25 22:26:54.494997 2026] [:error] [pid 62515:tid 62537] [client 20.197.232.217:40497] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ioxi-o.php"] [unique_id "ahRcLhig0_XsOwmnrv9dDAAAANQ"]
[Mon May 25 22:26:57.666661 2026] [:error] [pid 62515:tid 62534] [client 20.197.232.217:28625] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/login.php"] [unique_id "ahRcMRig0_XsOwmnrv9dDwAAANE"]
[Mon May 25 22:27:00.461910 2026] [:error] [pid 62515:tid 62520] [client 20.197.232.217:38150] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/login.php"] [unique_id "ahRcNBig0_XsOwmnrv9dEAAAAMM"]
[Mon May 25 22:27:03.028726 2026] [:error] [pid 62722:tid 62729] [client 20.197.232.217:39249] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/login.php"] [unique_id "ahRcN6M6ssnLWYf6CVBZIQAAAEU"]
[Mon May 25 22:27:04.820223 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:22434] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/upload/login.php"] [unique_id "ahRcOBig0_XsOwmnrv9dFQAAAMU"]
[Mon May 25 22:27:05.514583 2026] [:error] [pid 3698:tid 3718] [client 20.197.232.217:54998] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "ahRcOQtZBEwA4fyFLKMBswAAARI"]
[Mon May 25 22:27:06.206720 2026] [:error] [pid 62427:tid 62481] [client 20.197.232.217:39252] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "ahRcOvMUa83fc4GDyByJpwAAAVg"]
[Mon May 25 22:27:07.792863 2026] [:error] [pid 62428:tid 62493] [client 20.197.232.217:30487] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "ahRcO5NosGBa7mui3VRyWgAAAIk"]
[Mon May 25 22:27:09.177025 2026] [:error] [pid 62428:tid 62498] [client 20.197.232.217:48784] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/adminfuns.php"] [unique_id "ahRcPZNosGBa7mui3VRyWwAAAI4"]
[Mon May 25 22:27:10.879750 2026] [:error] [pid 62428:tid 62488] [client 20.197.232.217:33104] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/index.php"] [unique_id "ahRcPpNosGBa7mui3VRyXAAAAIQ"]
[Mon May 25 22:27:14.176604 2026] [:error] [pid 62426:tid 62451] [client 20.197.232.217:56574] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ahRcQkj3D3Mo8ANpTRAj9AAAABU"]
[Mon May 25 22:27:16.526553 2026] [:error] [pid 62427:tid 62459] [client 20.197.232.217:28642] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ahRcRPMUa83fc4GDyByJ3QAAAUI"]
[Mon May 25 22:27:18.834807 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:56542] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ahRcRkj3D3Mo8ANpTRAj_QAAAAA"]
[Mon May 25 22:27:21.388029 2026] [:error] [pid 62428:tid 62506] [client 20.197.232.217:35162] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/index.php"] [unique_id "ahRcSZNosGBa7mui3VRyYQAAAJY"]
[Mon May 25 22:27:24.155387 2026] [:error] [pid 62515:tid 62534] [client 20.197.232.217:48782] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahRcTBig0_XsOwmnrv9dHAAAANE"]
[Mon May 25 22:27:27.323843 2026] [:error] [pid 62428:tid 62505] [client 20.197.232.217:25992] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahRcT5NosGBa7mui3VRyZAAAAJU"]
[Mon May 25 22:27:32.213582 2026] [:error] [pid 62427:tid 62468] [client 20.197.232.217:33632] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/about.php"] [unique_id "ahRcVPMUa83fc4GDyByJ7AAAAUs"]
[Mon May 25 22:27:36.304738 2026] [proxy_fcgi:error] [pid 62427:tid 62472] [client 20.197.232.217:4574] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:37.592566 2026] [proxy_fcgi:error] [pid 62427:tid 62459] [client 20.197.232.217:4574] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:38.834452 2026] [proxy_fcgi:error] [pid 62427:tid 62470] [client 20.197.232.217:4574] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:39.145503 2026] [:error] [pid 62427:tid 62475] [client 20.197.232.217:4574] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/about.php"] [unique_id "ahRcW_MUa83fc4GDyByJ9gAAAVI"]
[Mon May 25 22:27:43.136338 2026] [:error] [pid 62427:tid 62481] [client 20.197.232.217:45744] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/index.php"] [unique_id "ahRcX_MUa83fc4GDyByJ-wAAAVg"]
[Mon May 25 22:27:45.476729 2026] [proxy_fcgi:error] [pid 3698:tid 3716] [client 20.197.232.217:13598] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:45.789277 2026] [proxy_fcgi:error] [pid 3698:tid 3712] [client 20.197.232.217:13598] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:46.097128 2026] [:error] [pid 3698:tid 3722] [client 20.197.232.217:13598] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admiin.php"] [unique_id "ahRcYgtZBEwA4fyFLKMBvAAAARY"]
[Mon May 25 22:27:47.928150 2026] [proxy_fcgi:error] [pid 62515:tid 62521] [client 20.197.232.217:39609] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:27:49.048117 2026] [:error] [pid 62515:tid 62517] [client 20.197.232.217:39609] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "ahRcZRig0_XsOwmnrv9dOAAAAMA"]
[Mon May 25 22:27:51.256121 2026] [:error] [pid 62426:tid 62431] [client 20.197.232.217:45735] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "ahRcZ0j3D3Mo8ANpTRAkFwAAAAE"]
[Mon May 25 22:27:52.630189 2026] [:error] [pid 62515:tid 62531] [client 20.197.232.217:25589] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "ahRcaBig0_XsOwmnrv9dPgAAAM4"]
[Mon May 25 22:27:53.860967 2026] [:error] [pid 62515:tid 62530] [client 20.197.232.217:26550] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell.php"] [unique_id "ahRcaRig0_XsOwmnrv9dQQAAAM0"]
[Mon May 25 22:27:54.933148 2026] [:error] [pid 62426:tid 62451] [client 20.197.232.217:4844] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "ahRcakj3D3Mo8ANpTRAkGAAAABU"]
[Mon May 25 22:27:55.873667 2026] [:error] [pid 62515:tid 62538] [client 20.197.232.217:14107] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "ahRcaxig0_XsOwmnrv9dQgAAANU"]
[Mon May 25 22:27:56.846604 2026] [:error] [pid 62722:tid 62745] [client 20.197.232.217:31601] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "ahRcbKM6ssnLWYf6CVBZOgAAAFU"]
[Mon May 25 22:27:57.718426 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:25597] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/index.php"] [unique_id "ahRcbUj3D3Mo8ANpTRAkHgAAAAU"]
[Mon May 25 22:27:58.591911 2026] [:error] [pid 62426:tid 62434] [client 20.197.232.217:33070] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahRcbkj3D3Mo8ANpTRAkIQAAAAQ"]
[Mon May 25 22:27:59.793216 2026] [:error] [pid 62722:tid 62736] [client 20.197.232.217:45746] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahRcb6M6ssnLWYf6CVBZOwAAAEw"]
[Mon May 25 22:28:02.914290 2026] [:error] [pid 3698:tid 3702] [client 20.197.232.217:22508] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahRccgtZBEwA4fyFLKMBxQAAAQI"]
[Mon May 25 22:28:11.717089 2026] [:error] [pid 62426:tid 62440] [client 20.197.232.217:45393] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahRce0j3D3Mo8ANpTRAkWQAAAAo"]
[Mon May 25 22:28:14.424842 2026] [:error] [pid 62515:tid 62530] [client 20.197.232.217:38157] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/themes.php"] [unique_id "ahRcfhig0_XsOwmnrv9dUgAAAM0"]
[Mon May 25 22:28:15.745518 2026] [:error] [pid 62426:tid 62449] [client 20.197.232.217:24525] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/themes.php"] [unique_id "ahRcf0j3D3Mo8ANpTRAkbwAAABM"]
[Mon May 25 22:28:16.901082 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:4956] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/themes.php"] [unique_id "ahRcgAtZBEwA4fyFLKMBzQAAAQ8"]
[Mon May 25 22:28:18.070178 2026] [:error] [pid 62428:tid 62499] [client 20.197.232.217:24549] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/themes.php"] [unique_id "ahRcgpNosGBa7mui3VRyiwAAAI8"]
[Mon May 25 22:28:19.102878 2026] [:error] [pid 62427:tid 62458] [client 20.197.232.217:29674] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/08/"] [unique_id "ahRcg_MUa83fc4GDyByKBwAAAUE"]
[Mon May 25 22:28:20.515004 2026] [:error] [pid 62427:tid 62471] [client 20.197.232.217:37817] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/08/"] [unique_id "ahRchPMUa83fc4GDyByKCAAAAU4"]
[Mon May 25 22:28:22.631336 2026] [:error] [pid 3698:tid 3710] [client 20.197.232.217:21460] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/08/"] [unique_id "ahRchgtZBEwA4fyFLKMB0QAAAQo"]
[Mon May 25 22:28:24.542572 2026] [:error] [pid 62428:tid 62487] [client 20.197.232.217:4976] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/08/"] [unique_id "ahRciJNosGBa7mui3VRyjAAAAIM"]
[Mon May 25 22:28:26.712440 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:44350] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "ahRcikj3D3Mo8ANpTRAklAAAABI"]
[Mon May 25 22:28:28.729082 2026] [:error] [pid 62515:tid 62526] [client 20.197.232.217:42231] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "ahRcjBig0_XsOwmnrv9dXAAAAMk"]
[Mon May 25 22:28:30.678024 2026] [:error] [pid 62428:tid 62501] [client 20.197.232.217:21469] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "ahRcjpNosGBa7mui3VRyjgAAAJE"]
[Mon May 25 22:28:32.829854 2026] [:error] [pid 62426:tid 62446] [client 20.197.232.217:29970] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/network/index.php"] [unique_id "ahRckEj3D3Mo8ANpTRAkmAAAABA"]
[Mon May 25 22:28:34.479436 2026] [:error] [pid 62428:tid 62507] [client 20.197.232.217:42183] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ahRckpNosGBa7mui3VRykgAAAJc"]
[Mon May 25 22:28:36.243291 2026] [:error] [pid 3698:tid 3721] [client 20.197.232.217:4986] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ahRclAtZBEwA4fyFLKMCDAAAARU"]
[Mon May 25 22:28:37.306303 2026] [:error] [pid 62428:tid 62506] [client 20.197.232.217:29658] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ahRclZNosGBa7mui3VRynAAAAJY"]
[Mon May 25 22:28:42.353154 2026] [:error] [pid 62428:tid 62489] [client 20.197.232.217:13598] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/admin.php"] [unique_id "ahRcmpNosGBa7mui3VRyowAAAIU"]
[Mon May 25 22:28:43.121440 2026] [:error] [pid 62722:tid 62735] [client 20.197.232.217:21899] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahRcm6M6ssnLWYf6CVBZRAAAAEs"]
[Mon May 25 22:28:44.142164 2026] [:error] [pid 53791:tid 53794] [client 20.197.232.217:4941] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahRcnCCRhhNTD40Nf1UvkgAAAYE"]
[Mon May 25 22:28:45.023277 2026] [:error] [pid 53791:tid 53806] [client 20.197.232.217:21503] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahRcnSCRhhNTD40Nf1UvlQAAAY0"]
[Mon May 25 22:28:45.711745 2026] [:error] [pid 62428:tid 62501] [client 20.197.232.217:5014] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/sitemaps/providers/"] [unique_id "ahRcnZNosGBa7mui3VRyqAAAAJE"]
[Mon May 25 22:28:46.456137 2026] [:error] [pid 62428:tid 62494] [client 20.197.232.217:5035] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/index.php"] [unique_id "ahRcnpNosGBa7mui3VRyqwAAAIo"]
[Mon May 25 22:28:47.109687 2026] [:error] [pid 62428:tid 62495] [client 20.197.232.217:5047] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/abcd.php"] [unique_id "ahRcn5NosGBa7mui3VRyrQAAAIs"]
[Mon May 25 22:28:48.611629 2026] [proxy_fcgi:error] [pid 3698:tid 3717] [client 20.197.232.217:28581] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:28:50.565721 2026] [proxy_fcgi:error] [pid 3698:tid 3708] [client 20.197.232.217:28581] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:28:51.252296 2026] [proxy_fcgi:error] [pid 3698:tid 3722] [client 20.197.232.217:28581] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:28:52.218379 2026] [:error] [pid 3698:tid 3720] [client 20.197.232.217:28581] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css/index.php"] [unique_id "ahRcpAtZBEwA4fyFLKMCUQAAARQ"]
[Mon May 25 22:28:53.658526 2026] [:error] [pid 53791:tid 53814] [client 20.197.232.217:26584] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ahRcpSCRhhNTD40Nf1UvnwAAAZU"]
[Mon May 25 22:28:54.574473 2026] [:error] [pid 62428:tid 62491] [client 20.197.232.217:4989] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ahRcppNosGBa7mui3VRyxAAAAIc"]
[Mon May 25 22:28:55.405824 2026] [:error] [pid 62428:tid 62495] [client 20.197.232.217:42203] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ahRcp5NosGBa7mui3VRyxQAAAIs"]
[Mon May 25 22:28:56.048205 2026] [:error] [pid 53791:tid 53810] [client 20.197.232.217:37760] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/index.php"] [unique_id "ahRcqCCRhhNTD40Nf1UvoQAAAZE"]
[Mon May 25 22:28:56.991747 2026] [:error] [pid 62722:tid 62724] [client 20.197.232.217:42204] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/about.php"] [unique_id "ahRcqKM6ssnLWYf6CVBZTwAAAEA"]
[Mon May 25 22:28:57.791203 2026] [:error] [pid 53791:tid 53798] [client 20.197.232.217:21492] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "ahRcqSCRhhNTD40Nf1UvowAAAYU"]
[Mon May 25 22:28:58.659565 2026] [:error] [pid 62722:tid 62748] [client 20.197.232.217:29636] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "ahRcqqM6ssnLWYf6CVBZUAAAAFg"]
[Mon May 25 22:29:00.146713 2026] [:error] [pid 62722:tid 62745] [client 20.197.232.217:36674] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new4.php"] [unique_id "ahRcrKM6ssnLWYf6CVBZVAAAAFU"]
[Mon May 25 22:29:03.911262 2026] [:error] [pid 62515:tid 62539] [client 20.197.232.217:42207] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/images/about.php"] [unique_id "ahRcrxig0_XsOwmnrv9dcQAAANY"]
[Mon May 25 22:29:05.869513 2026] [:error] [pid 62428:tid 62501] [client 20.197.232.217:21933] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/images/about.php"] [unique_id "ahRcsZNosGBa7mui3VRyzQAAAJE"]
[Mon May 25 22:29:07.146140 2026] [:error] [pid 62426:tid 62450] [client 20.197.232.217:21918] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/images/about.php"] [unique_id "ahRcs0j3D3Mo8ANpTRAkoAAAABQ"]
[Mon May 25 22:29:08.665631 2026] [:error] [pid 62426:tid 62453] [client 20.197.232.217:4110] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/images/about.php"] [unique_id "ahRctEj3D3Mo8ANpTRAkogAAABc"]
[Mon May 25 22:29:09.579740 2026] [:error] [pid 62426:tid 62438] [client 20.197.232.217:5000] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "ahRctUj3D3Mo8ANpTRAkpQAAAAg"]
[Mon May 25 22:29:10.770192 2026] [:error] [pid 62428:tid 62499] [client 20.197.232.217:4114] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "ahRctpNosGBa7mui3VRyzgAAAI8"]
[Mon May 25 22:29:11.752011 2026] [:error] [pid 62426:tid 62439] [client 20.197.232.217:37779] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "ahRct0j3D3Mo8ANpTRAkpgAAAAk"]
[Mon May 25 22:29:12.583137 2026] [:error] [pid 62515:tid 62519] [client 20.197.232.217:4103] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/defaults.php"] [unique_id "ahRcuBig0_XsOwmnrv9degAAAMI"]
[Mon May 25 22:29:13.598301 2026] [:error] [pid 62515:tid 62524] [client 20.197.232.217:37768] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-file.php"] [unique_id "ahRcuRig0_XsOwmnrv9dfAAAAMc"]
[Mon May 25 22:29:14.413875 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:24514] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-file.php"] [unique_id "ahRcuhig0_XsOwmnrv9dfgAAAMs"]
[Mon May 25 22:29:15.143451 2026] [:error] [pid 53791:tid 53816] [client 20.197.232.217:37822] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-file.php"] [unique_id "ahRcuyCRhhNTD40Nf1UvqwAAAZc"]
[Mon May 25 22:29:15.952384 2026] [:error] [pid 62515:tid 62526] [client 20.197.232.217:4143] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-file.php"] [unique_id "ahRcuxig0_XsOwmnrv9dfwAAAMk"]
[Mon May 25 22:29:16.761106 2026] [:error] [pid 62515:tid 62532] [client 20.197.232.217:5019] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ahRcvBig0_XsOwmnrv9dgAAAAM8"]
[Mon May 25 22:29:17.943773 2026] [:error] [pid 3698:tid 3703] [client 20.197.232.217:29641] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ahRcvQtZBEwA4fyFLKMCkAAAAQM"]
[Mon May 25 22:29:18.728064 2026] [:error] [pid 62428:tid 62494] [client 20.197.232.217:4113] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ahRcvpNosGBa7mui3VRy0gAAAIo"]
[Mon May 25 22:29:19.853519 2026] [:error] [pid 62722:tid 62747] [client 20.197.232.217:36703] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/upgrade/index.php"] [unique_id "ahRcv6M6ssnLWYf6CVBZXwAAAFc"]
[Mon May 25 22:29:20.876037 2026] [:error] [pid 62427:tid 62472] [client 20.197.232.217:26580] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ahRcwPMUa83fc4GDyByKFgAAAU8"]
[Mon May 25 22:29:21.926983 2026] [:error] [pid 62428:tid 62502] [client 20.197.232.217:26564] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ahRcwZNosGBa7mui3VRy1QAAAJI"]
[Mon May 25 22:29:23.011508 2026] [:error] [pid 62515:tid 62537] [client 20.197.232.217:37763] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ahRcwxig0_XsOwmnrv9diQAAANQ"]
[Mon May 25 22:29:24.421464 2026] [:error] [pid 53791:tid 53797] [client 20.197.232.217:36720] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/403.php"] [unique_id "ahRcxCCRhhNTD40Nf1UvsQAAAYQ"]
[Mon May 25 22:29:25.615003 2026] [:error] [pid 53791:tid 53817] [client 20.197.232.217:37765] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/widgets/"] [unique_id "ahRcxSCRhhNTD40Nf1UvswAAAZg"]
[Mon May 25 22:29:26.411181 2026] [:error] [pid 62426:tid 62450] [client 20.197.232.217:4138] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/widgets/"] [unique_id "ahRcxkj3D3Mo8ANpTRAkrAAAABQ"]
[Mon May 25 22:29:27.311411 2026] [:error] [pid 62515:tid 62527] [client 20.197.232.217:42229] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/widgets/"] [unique_id "ahRcxxig0_XsOwmnrv9dkAAAAMo"]
[Mon May 25 22:29:27.986726 2026] [:error] [pid 62426:tid 62453] [client 20.197.232.217:21917] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/css/dist/widgets/"] [unique_id "ahRcx0j3D3Mo8ANpTRAkrgAAABc"]
[Mon May 25 22:29:28.805187 2026] [:error] [pid 53791:tid 53805] [client 20.197.232.217:5017] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahRcyCCRhhNTD40Nf1UvtAAAAYw"]
[Mon May 25 22:29:29.643289 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:5013] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahRcyRig0_XsOwmnrv9dkwAAAMs"]
[Mon May 25 22:29:30.301901 2026] [:error] [pid 62515:tid 62521] [client 20.197.232.217:21453] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahRcyhig0_XsOwmnrv9dlQAAAMQ"]
[Mon May 25 22:29:31.086393 2026] [:error] [pid 3698:tid 3709] [client 20.197.232.217:4872] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahRcywtZBEwA4fyFLKMCkwAAAQk"]
[Mon May 25 22:29:32.178060 2026] [:error] [pid 62515:tid 62534] [client 20.197.232.217:26617] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "ahRczBig0_XsOwmnrv9dmAAAANE"]
[Mon May 25 22:29:33.353724 2026] [:error] [pid 62515:tid 62530] [client 20.197.232.217:21493] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "ahRczRig0_XsOwmnrv9dmgAAAM0"]
[Mon May 25 22:29:34.724205 2026] [:error] [pid 53791:tid 53794] [client 20.197.232.217:44300] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "ahRcziCRhhNTD40Nf1UvtgAAAYE"]
[Mon May 25 22:29:35.508507 2026] [:error] [pid 62426:tid 62447] [client 20.197.232.217:37806] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/admin.php"] [unique_id "ahRcz0j3D3Mo8ANpTRAktgAAABE"]
[Mon May 25 22:29:36.412519 2026] [:error] [pid 62426:tid 62436] [client 20.197.232.217:21450] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/block/"] [unique_id "ahRc0Ej3D3Mo8ANpTRAktwAAAAY"]
[Mon May 25 22:29:37.407344 2026] [:error] [pid 62428:tid 62491] [client 20.197.232.217:44337] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/block/"] [unique_id "ahRc0ZNosGBa7mui3VRy2wAAAIc"]
[Mon May 25 22:29:38.364880 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:21448] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/block/"] [unique_id "ahRc0kj3D3Mo8ANpTRAkuQAAAA0"]
[Mon May 25 22:29:39.467343 2026] [:error] [pid 62428:tid 62485] [client 20.197.232.217:37801] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/block/"] [unique_id "ahRc05NosGBa7mui3VRy3gAAAIE"]
[Mon May 25 22:29:40.263707 2026] [:error] [pid 62722:tid 62744] [client 20.197.232.217:21941] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "ahRc1KM6ssnLWYf6CVBZagAAAFQ"]
[Mon May 25 22:29:41.524066 2026] [:error] [pid 62426:tid 62454] [client 20.197.232.217:21930] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "ahRc1Uj3D3Mo8ANpTRAkuwAAABg"]
[Mon May 25 22:29:42.330943 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:4100] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "ahRc1kj3D3Mo8ANpTRAkvAAAABI"]
[Mon May 25 22:29:42.964174 2026] [:error] [pid 62427:tid 62470] [client 20.197.232.217:5003] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/404.php"] [unique_id "ahRc1vMUa83fc4GDyByKFwAAAU0"]
[Mon May 25 22:29:43.602599 2026] [:error] [pid 62426:tid 62444] [client 20.197.232.217:36707] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-2019.php"] [unique_id "ahRc10j3D3Mo8ANpTRAkwAAAAA4"]
[Mon May 25 22:29:44.362341 2026] [:error] [pid 62428:tid 62497] [client 20.197.232.217:36685] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-2019.php"] [unique_id "ahRc2JNosGBa7mui3VRy4AAAAI0"]
[Mon May 25 22:29:45.646382 2026] [:error] [pid 3698:tid 3716] [client 20.197.232.217:4946] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-2019.php"] [unique_id "ahRc2QtZBEwA4fyFLKMClwAAARA"]
[Mon May 25 22:29:46.628044 2026] [:error] [pid 62428:tid 62500] [client 20.197.232.217:26578] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-2019.php"] [unique_id "ahRc2pNosGBa7mui3VRy4gAAAJA"]
[Mon May 25 22:29:47.432929 2026] [:error] [pid 62428:tid 62501] [client 20.197.232.217:4109] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/edit.php"] [unique_id "ahRc25NosGBa7mui3VRy4wAAAJE"]
[Mon May 25 22:29:48.089554 2026] [:error] [pid 62428:tid 62486] [client 20.197.232.217:44384] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/edit.php"] [unique_id "ahRc3JNosGBa7mui3VRy5AAAAII"]
[Mon May 25 22:29:48.846543 2026] [:error] [pid 62426:tid 62449] [client 20.197.232.217:44315] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/edit.php"] [unique_id "ahRc3Ej3D3Mo8ANpTRAkwgAAABM"]
[Mon May 25 22:29:49.682395 2026] [:error] [pid 62515:tid 62537] [client 20.197.232.217:4938] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/edit.php"] [unique_id "ahRc3Rig0_XsOwmnrv9dngAAANQ"]
[Mon May 25 22:29:50.682818 2026] [:error] [pid 62428:tid 62503] [client 20.197.232.217:4975] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ahRc3pNosGBa7mui3VRy5QAAAJM"]
[Mon May 25 22:29:51.616869 2026] [:error] [pid 62515:tid 62533] [client 20.197.232.217:32559] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ahRc3xig0_XsOwmnrv9doAAAANA"]
[Mon May 25 22:29:52.275622 2026] [:error] [pid 53791:tid 53801] [client 20.197.232.217:4788] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/install.php"] [unique_id "ahRc4CCRhhNTD40Nf1UvvAAAAYg"]
[Mon May 25 22:29:53.106816 2026] [proxy_fcgi:error] [pid 62426:tid 62431] [client 20.197.232.217:32635] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:53.422565 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:32635] [client 20.197.232.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.197.232.217, incrementing brute counter"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ahRc4Uj3D3Mo8ANpTRAkxQAAAAA"]
[Mon May 25 22:29:53.864045 2026] [proxy_fcgi:error] [pid 62426:tid 62447] [client 20.197.232.217:32635] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:54.182396 2026] [proxy_fcgi:error] [pid 62426:tid 62436] [client 20.197.232.217:32635] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:54.866521 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:32635] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "ahRc4kj3D3Mo8ANpTRAkywAAAAU"]
[Mon May 25 22:29:56.122956 2026] [proxy_fcgi:error] [pid 3698:tid 3712] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:56.489890 2026] [proxy_fcgi:error] [pid 3698:tid 3723] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:56.809625 2026] [proxy_fcgi:error] [pid 3698:tid 3715] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:57.127448 2026] [proxy_fcgi:error] [pid 3698:tid 3718] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:57.950859 2026] [proxy_fcgi:error] [pid 3698:tid 3701] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:58.431335 2026] [proxy_fcgi:error] [pid 3698:tid 3708] [client 20.197.232.217:45324] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:29:58.758486 2026] [:error] [pid 3698:tid 3719] [client 20.197.232.217:45324] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sx.php"] [unique_id "ahRc5gtZBEwA4fyFLKMCoAAAARM"]
[Mon May 25 22:29:59.817006 2026] [:error] [pid 62428:tid 62499] [client 20.197.232.217:4772] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sx.php"] [unique_id "ahRc55NosGBa7mui3VRy5wAAAI8"]
[Mon May 25 22:30:01.338902 2026] [:error] [pid 62426:tid 62454] [client 20.197.232.217:38692] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sx.php"] [unique_id "ahRc6Uj3D3Mo8ANpTRAkzQAAABg"]
[Mon May 25 22:30:02.808011 2026] [:error] [pid 62426:tid 62444] [client 20.197.232.217:38669] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sx.php"] [unique_id "ahRc6kj3D3Mo8ANpTRAk0AAAAA4"]
[Mon May 25 22:30:03.762611 2026] [:error] [pid 62426:tid 62449] [client 20.197.232.217:32023] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin-header.php"] [unique_id "ahRc60j3D3Mo8ANpTRAk0wAAABM"]
[Mon May 25 22:30:04.803729 2026] [:error] [pid 62515:tid 62536] [client 20.197.232.217:48832] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin-header.php"] [unique_id "ahRc7Big0_XsOwmnrv9dogAAANM"]
[Mon May 25 22:30:05.656525 2026] [:error] [pid 62722:tid 62731] [client 20.197.232.217:32038] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin-header.php"] [unique_id "ahRc7aM6ssnLWYf6CVBZbAAAAEc"]
[Mon May 25 22:30:07.111413 2026] [:error] [pid 62722:tid 62735] [client 20.197.232.217:14816] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin-header.php"] [unique_id "ahRc76M6ssnLWYf6CVBZbgAAAEs"]
[Mon May 25 22:30:08.216058 2026] [:error] [pid 62428:tid 62494] [client 20.197.232.217:53850] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ahRc8JNosGBa7mui3VRy6QAAAIo"]
[Mon May 25 22:30:08.931188 2026] [:error] [pid 62426:tid 62431] [client 20.197.232.217:14810] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ahRc8Ej3D3Mo8ANpTRAk1QAAAAE"]
[Mon May 25 22:30:09.770941 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:32006] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ahRc8Uj3D3Mo8ANpTRAk1gAAAAA"]
[Mon May 25 22:30:11.055954 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:63390] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/class.php"] [unique_id "ahRc8xig0_XsOwmnrv9dpgAAAMU"]
[Mon May 25 22:30:11.732017 2026] [:error] [pid 62515:tid 62539] [client 20.197.232.217:38673] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahRc8xig0_XsOwmnrv9dqQAAANY"]
[Mon May 25 22:30:13.281193 2026] [:error] [pid 62722:tid 62724] [client 20.197.232.217:24055] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahRc9aM6ssnLWYf6CVBZcAAAAEA"]
[Mon May 25 22:30:15.299074 2026] [:error] [pid 62428:tid 62502] [client 20.197.232.217:27568] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahRc95NosGBa7mui3VRy7gAAAJI"]
[Mon May 25 22:30:18.011607 2026] [:error] [pid 62515:tid 62536] [client 20.197.232.217:63431] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahRc-hig0_XsOwmnrv9dsQAAANM"]
[Mon May 25 22:30:20.001129 2026] [:error] [pid 62515:tid 62523] [client 20.197.232.217:34613] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/admin.php"] [unique_id "ahRc_Big0_XsOwmnrv9dswAAAMY"]
[Mon May 25 22:30:23.030615 2026] [:error] [pid 3698:tid 3706] [client 20.197.232.217:14760] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ahRc_wtZBEwA4fyFLKMCpAAAAQY"]
[Mon May 25 22:30:26.780217 2026] [:error] [pid 62426:tid 62433] [client 20.197.232.217:46627] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ahRdAkj3D3Mo8ANpTRAk2gAAAAM"]
[Mon May 25 22:30:28.757595 2026] [:error] [pid 62428:tid 62499] [client 20.197.232.217:4297] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/item.php"] [unique_id "ahRdBJNosGBa7mui3VRy9AAAAI8"]
[Mon May 25 22:30:30.158267 2026] [:error] [pid 62426:tid 62434] [client 20.197.232.217:34610] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2024/"] [unique_id "ahRdBkj3D3Mo8ANpTRAk3wAAAAQ"]
[Mon May 25 22:30:31.643697 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:29630] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2024/"] [unique_id "ahRdBxig0_XsOwmnrv9duAAAAMs"]
[Mon May 25 22:30:34.653886 2026] [:error] [pid 62426:tid 62436] [client 20.197.232.217:35659] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2024/"] [unique_id "ahRdCkj3D3Mo8ANpTRAk5gAAAAY"]
[Mon May 25 22:30:40.436676 2026] [:error] [pid 62428:tid 62495] [client 20.197.232.217:35685] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2024/"] [unique_id "ahRdEJNosGBa7mui3VRzBAAAAIs"]
[Mon May 25 22:30:48.592890 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:30032] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ahRdGEj3D3Mo8ANpTRAk7QAAAA0"]
[Mon May 25 22:30:49.596163 2026] [:error] [pid 62426:tid 62447] [client 20.197.232.217:27086] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ahRdGUj3D3Mo8ANpTRAk7gAAABE"]
[Mon May 25 22:30:51.594078 2026] [:error] [pid 62428:tid 62500] [client 20.197.232.217:47017] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ahRdG5NosGBa7mui3VRzDwAAAJA"]
[Mon May 25 22:30:52.883661 2026] [:error] [pid 62426:tid 62436] [client 20.197.232.217:36611] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/style.php"] [unique_id "ahRdHEj3D3Mo8ANpTRAk_QAAAAY"]
[Mon May 25 22:30:54.799094 2026] [:error] [pid 3698:tid 3708] [client 20.197.232.217:4402] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/"] [unique_id "ahRdHgtZBEwA4fyFLKMCuAAAAQg"]
[Mon May 25 22:30:57.124109 2026] [:error] [pid 62428:tid 62488] [client 20.197.232.217:31041] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/includes/"] [unique_id "ahRdIZNosGBa7mui3VRzEAAAAIQ"]
[Mon May 25 22:30:59.568623 2026] [proxy_fcgi:error] [pid 3698:tid 3702] [client 20.197.232.217:53025] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:31:00.261796 2026] [:error] [pid 3698:tid 3712] [client 20.197.232.217:53025] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/about.php"] [unique_id "ahRdJAtZBEwA4fyFLKMCyQAAAQw"]
[Mon May 25 22:31:02.868736 2026] [proxy_fcgi:error] [pid 53791:tid 53794] [client 20.197.232.217:13668] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:31:04.299362 2026] [proxy_fcgi:error] [pid 53791:tid 53806] [client 20.197.232.217:13668] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:31:05.388051 2026] [:error] [pid 53791:tid 53812] [client 20.197.232.217:13668] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ahRdKSCRhhNTD40Nf1Uv2AAAAZM"]
[Mon May 25 22:31:06.538168 2026] [:error] [pid 62722:tid 62739] [client 20.197.232.217:31101] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "ahRdKqM6ssnLWYf6CVBZiAAAAE8"]
[Mon May 25 22:31:07.706130 2026] [:error] [pid 3698:tid 3713] [client 20.197.232.217:23451] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "ahRdKwtZBEwA4fyFLKMC0gAAAQ0"]
[Mon May 25 22:31:08.946221 2026] [:error] [pid 3698:tid 3712] [client 20.197.232.217:36621] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "ahRdLAtZBEwA4fyFLKMC1AAAAQw"]
[Mon May 25 22:31:10.434423 2026] [:error] [pid 53791:tid 53813] [client 20.197.232.217:31076] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin.php"] [unique_id "ahRdLiCRhhNTD40Nf1Uv4AAAAZQ"]
[Mon May 25 22:31:11.695863 2026] [:error] [pid 62515:tid 62521] [client 20.197.232.217:4470] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "ahRdLxig0_XsOwmnrv9d8AAAAMQ"]
[Mon May 25 22:31:12.990744 2026] [:error] [pid 53791:tid 53800] [client 20.197.232.217:13647] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "ahRdMCCRhhNTD40Nf1Uv5QAAAYc"]
[Mon May 25 22:31:14.687946 2026] [:error] [pid 53791:tid 53796] [client 20.197.232.217:26067] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "ahRdMiCRhhNTD40Nf1Uv5gAAAYM"]
[Mon May 25 22:31:15.805085 2026] [:error] [pid 53791:tid 53817] [client 20.197.232.217:33537] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/index.php"] [unique_id "ahRdMyCRhhNTD40Nf1Uv6AAAAZg"]
[Mon May 25 22:31:17.045859 2026] [:error] [pid 62515:tid 62526] [client 20.197.232.217:13685] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/admin.php"] [unique_id "ahRdNRig0_XsOwmnrv9d8QAAAMk"]
[Mon May 25 22:31:17.988789 2026] [:error] [pid 62515:tid 62524] [client 20.197.232.217:36647] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/admin.php"] [unique_id "ahRdNRig0_XsOwmnrv9d9AAAAMc"]
[Mon May 25 22:31:19.448680 2026] [:error] [pid 62515:tid 62529] [client 20.197.232.217:38242] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/admin.php"] [unique_id "ahRdNxig0_XsOwmnrv9d9gAAAMw"]
[Mon May 25 22:31:22.773972 2026] [:error] [pid 62515:tid 62527] [client 20.197.232.217:33571] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/admin/admin.php"] [unique_id "ahRdOhig0_XsOwmnrv9d-AAAAMo"]
[Mon May 25 22:31:25.344751 2026] [:error] [pid 62428:tid 62508] [client 20.197.232.217:38220] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahRdPZNosGBa7mui3VRzGwAAAJg"]
[Mon May 25 22:31:29.891157 2026] [:error] [pid 3698:tid 3702] [client 20.197.232.217:4431] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahRdQQtZBEwA4fyFLKMC1wAAAQI"]
[Mon May 25 22:31:31.043022 2026] [:error] [pid 3698:tid 3712] [client 20.197.232.217:30995] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahRdQwtZBEwA4fyFLKMC2AAAAQw"]
[Mon May 25 22:31:33.117200 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:30977] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahRdRRig0_XsOwmnrv9d-wAAAMs"]
[Mon May 25 22:31:34.571017 2026] [:error] [pid 62428:tid 62493] [client 20.197.232.217:11802] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/about.php"] [unique_id "ahRdRpNosGBa7mui3VRzHQAAAIk"]
[Mon May 25 22:31:36.430061 2026] [:error] [pid 62515:tid 62540] [client 20.197.232.217:27597] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/file.php"] [unique_id "ahRdSBig0_XsOwmnrv9d_wAAANc"]
[Mon May 25 22:31:38.621249 2026] [:error] [pid 62515:tid 62536] [client 20.197.232.217:25583] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/file.php"] [unique_id "ahRdShig0_XsOwmnrv9eBgAAANM"]
[Mon May 25 22:31:40.522229 2026] [:error] [pid 62515:tid 62523] [client 20.197.232.217:27629] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/images/file.php"] [unique_id "ahRdTBig0_XsOwmnrv9eCgAAAMY"]
[Mon May 25 22:31:41.983207 2026] [:error] [pid 62426:tid 62442] [client 20.197.232.217:31012] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/"] [unique_id "ahRdTUj3D3Mo8ANpTRAlPAAAAAw"]
[Mon May 25 22:31:42.719139 2026] [:error] [pid 62426:tid 62440] [client 20.197.232.217:40533] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/"] [unique_id "ahRdTkj3D3Mo8ANpTRAlPQAAAAo"]
[Mon May 25 22:31:43.540739 2026] [:error] [pid 53791:tid 53806] [client 20.197.232.217:47102] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/"] [unique_id "ahRdTyCRhhNTD40Nf1Uv7gAAAY0"]
[Mon May 25 22:31:44.354073 2026] [:error] [pid 62426:tid 62450] [client 20.197.232.217:11835] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/theme-compat/"] [unique_id "ahRdUEj3D3Mo8ANpTRAlPwAAABQ"]
[Mon May 25 22:31:46.200960 2026] [:error] [pid 3698:tid 3711] [client 20.197.232.217:38210] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/index.php"] [unique_id "ahRdUgtZBEwA4fyFLKMC2wAAAQs"]
[Mon May 25 22:31:47.811056 2026] [:error] [pid 62427:tid 62459] [client 20.197.232.217:53084] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/"] [unique_id "ahRdU_MUa83fc4GDyByKQQAAAUI"]
[Mon May 25 22:31:49.123886 2026] [:error] [pid 62428:tid 62496] [client 20.197.232.217:24968] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/"] [unique_id "ahRdVZNosGBa7mui3VRzJgAAAIw"]
[Mon May 25 22:31:50.057316 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:29057] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/"] [unique_id "ahRdVhig0_XsOwmnrv9eEQAAAMs"]
[Mon May 25 22:31:51.097846 2026] [:error] [pid 62515:tid 62526] [client 20.197.232.217:45785] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/fonts/"] [unique_id "ahRdVxig0_XsOwmnrv9eEgAAAMk"]
[Mon May 25 22:31:52.434818 2026] [:error] [pid 62428:tid 62492] [client 20.197.232.217:45794] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akc.php"] [unique_id "ahRdWJNosGBa7mui3VRzMwAAAIg"]
[Mon May 25 22:31:53.829424 2026] [:error] [pid 62428:tid 62486] [client 20.197.232.217:4210] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akc.php"] [unique_id "ahRdWZNosGBa7mui3VRzNAAAAII"]
[Mon May 25 22:31:54.725522 2026] [:error] [pid 3698:tid 3703] [client 20.197.232.217:11800] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akc.php"] [unique_id "ahRdWgtZBEwA4fyFLKMC5AAAAQM"]
[Mon May 25 22:31:56.225583 2026] [:error] [pid 62428:tid 62490] [client 20.197.232.217:13594] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/akc.php"] [unique_id "ahRdXJNosGBa7mui3VRzNwAAAIY"]
[Mon May 25 22:31:57.231040 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:40546] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "ahRdXUj3D3Mo8ANpTRAlSQAAABI"]
[Mon May 25 22:31:58.612504 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:53073] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "ahRdXkj3D3Mo8ANpTRAlTQAAAAU"]
[Mon May 25 22:31:59.396338 2026] [:error] [pid 53791:tid 53812] [client 20.197.232.217:45810] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "ahRdXyCRhhNTD40Nf1Uv8QAAAZM"]
[Mon May 25 22:32:00.451174 2026] [:error] [pid 53791:tid 53797] [client 20.197.232.217:23535] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "ahRdYCCRhhNTD40Nf1Uv8gAAAYQ"]
[Mon May 25 22:32:01.274579 2026] [:error] [pid 62428:tid 62498] [client 20.197.232.217:11853] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ahRdYZNosGBa7mui3VRzOQAAAI4"]
[Mon May 25 22:32:02.306549 2026] [:error] [pid 62428:tid 62489] [client 20.197.232.217:4829] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/asasx.php"] [unique_id "ahRdYpNosGBa7mui3VRzOgAAAIU"]
[Mon May 25 22:32:04.179186 2026] [proxy_fcgi:error] [pid 62426:tid 62443] [client 20.197.232.217:13568] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:05.688951 2026] [:error] [pid 62426:tid 62433] [client 20.197.232.217:13568] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/widgets/about.php"] [unique_id "ahRdZUj3D3Mo8ANpTRAlWQAAAAM"]
[Mon May 25 22:32:07.052991 2026] [proxy_fcgi:error] [pid 62427:tid 62477] [client 20.197.232.217:13621] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:07.702716 2026] [proxy_fcgi:error] [pid 62427:tid 62460] [client 20.197.232.217:13621] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:08.113396 2026] [proxy_fcgi:error] [pid 62427:tid 62481] [client 20.197.232.217:13621] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:08.465174 2026] [proxy_fcgi:error] [pid 62427:tid 62476] [client 20.197.232.217:13621] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:08.781146 2026] [:error] [pid 62427:tid 62467] [client 20.197.232.217:13621] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ahRdaPMUa83fc4GDyByKTQAAAUo"]
[Mon May 25 22:32:10.798980 2026] [proxy_fcgi:error] [pid 62428:tid 62495] [client 20.197.232.217:45150] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:11.113839 2026] [:error] [pid 62428:tid 62500] [client 20.197.232.217:45150] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/lv.php"] [unique_id "ahRda5NosGBa7mui3VRzPwAAAJA"]
[Mon May 25 22:32:13.130399 2026] [proxy_fcgi:error] [pid 62515:tid 62532] [client 20.197.232.217:31611] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:14.334165 2026] [proxy_fcgi:error] [pid 62515:tid 62524] [client 20.197.232.217:31611] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:32:14.671303 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:31611] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/123.php"] [unique_id "ahRdbhig0_XsOwmnrv9eLQAAAMU"]
[Mon May 25 22:32:16.329875 2026] [:error] [pid 62515:tid 62532] [client 20.197.232.217:33629] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/123.php"] [unique_id "ahRdcBig0_XsOwmnrv9eMAAAAM8"]
[Mon May 25 22:32:22.109722 2026] [:error] [pid 62426:tid 62431] [client 20.197.232.217:43782] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/123.php"] [unique_id "ahRddkj3D3Mo8ANpTRAlagAAAAE"]
[Mon May 25 22:32:26.245858 2026] [:error] [pid 53791:tid 53793] [client 20.197.232.217:4495] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/123.php"] [unique_id "ahRdeiCRhhNTD40Nf1Uv_gAAAYA"]
[Mon May 25 22:32:31.030089 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:35155] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "ahRdf0j3D3Mo8ANpTRAldwAAABI"]
[Mon May 25 22:32:39.073286 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:38192] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/st.php"] [unique_id "ahRdh0j3D3Mo8ANpTRAligAAAAU"]
[Mon May 25 22:32:45.596196 2026] [:error] [pid 62515:tid 62537] [client 20.197.232.217:40910] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/class-config.php"] [unique_id "ahRdjRig0_XsOwmnrv9ePwAAANQ"]
[Mon May 25 22:32:47.896843 2026] [:error] [pid 62427:tid 62479] [client 20.197.232.217:35199] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/class-config.php"] [unique_id "ahRdj_MUa83fc4GDyByKWgAAAVY"]
[Mon May 25 22:32:48.731410 2026] [:error] [pid 62427:tid 62463] [client 20.197.232.217:42625] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/class-config.php"] [unique_id "ahRdkPMUa83fc4GDyByKXAAAAUY"]
[Mon May 25 22:32:50.419415 2026] [:error] [pid 53791:tid 53808] [client 20.197.232.217:42669] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/images/class-config.php"] [unique_id "ahRdkiCRhhNTD40Nf1UwEwAAAY8"]
[Mon May 25 22:32:51.998202 2026] [:error] [pid 62428:tid 62503] [client 20.197.232.217:54980] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/file.php"] [unique_id "ahRdk5NosGBa7mui3VRzXAAAAJM"]
[Mon May 25 22:32:52.788294 2026] [:error] [pid 53791:tid 53801] [client 20.197.232.217:22425] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/file.php"] [unique_id "ahRdlCCRhhNTD40Nf1UwFQAAAYg"]
[Mon May 25 22:32:54.135494 2026] [:error] [pid 62426:tid 62445] [client 20.197.232.217:55035] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/file.php"] [unique_id "ahRdlkj3D3Mo8ANpTRAlqAAAAA8"]
[Mon May 25 22:32:55.945155 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:35148] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/file.php"] [unique_id "ahRdlwtZBEwA4fyFLKMC_QAAAQ8"]
[Mon May 25 22:32:58.109198 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:55036] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.phphttps://win55.bike/ioxi-o.php"] [unique_id "ahRdmhig0_XsOwmnrv9eRQAAAMs"]
[Mon May 25 22:33:02.531794 2026] [:error] [pid 53791:tid 53798] [client 20.197.232.217:56566] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.phphttps://win55.bike/ioxi-o.php"] [unique_id "ahRdniCRhhNTD40Nf1UwGQAAAYU"]
[Mon May 25 22:33:04.737774 2026] [:error] [pid 62428:tid 62498] [client 20.197.232.217:56548] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.phphttps://win55.bike/ioxi-o.php"] [unique_id "ahRdoJNosGBa7mui3VRzawAAAI4"]
[Mon May 25 22:33:05.862335 2026] [:error] [pid 62722:tid 62741] [client 20.197.232.217:21377] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/edit.phphttps://win55.bike/ioxi-o.php"] [unique_id "ahRdoaM6ssnLWYf6CVBZowAAAFE"]
[Mon May 25 22:33:06.828206 2026] [:error] [pid 62426:tid 62442] [client 20.197.232.217:56535] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/404.php"] [unique_id "ahRdokj3D3Mo8ANpTRAlrAAAAAw"]
[Mon May 25 22:33:07.786815 2026] [:error] [pid 62515:tid 62518] [client 20.197.232.217:40497] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/404.php"] [unique_id "ahRdoxig0_XsOwmnrv9eSgAAAME"]
[Mon May 25 22:33:08.636031 2026] [:error] [pid 53791:tid 53799] [client 20.197.232.217:23535] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/404.php"] [unique_id "ahRdpCCRhhNTD40Nf1UwGwAAAYY"]
[Mon May 25 22:33:09.463744 2026] [:error] [pid 53791:tid 53793] [client 20.197.232.217:40949] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/404.php"] [unique_id "ahRdpSCRhhNTD40Nf1UwHQAAAYA"]
[Mon May 25 22:33:10.291939 2026] [:error] [pid 62427:tid 62471] [client 20.197.232.217:33104] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahRdpvMUa83fc4GDyByKaQAAAU4"]
[Mon May 25 22:33:11.070455 2026] [:error] [pid 62426:tid 62436] [client 20.197.232.217:33119] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahRdp0j3D3Mo8ANpTRAlrwAAAAY"]
[Mon May 25 22:33:11.894963 2026] [:error] [pid 3698:tid 3708] [client 20.197.232.217:35185] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahRdpwtZBEwA4fyFLKMDCgAAAQg"]
[Mon May 25 22:33:12.649865 2026] [:error] [pid 62515:tid 62539] [client 20.197.232.217:33129] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ahRdqBig0_XsOwmnrv9eTAAAANY"]
[Mon May 25 22:33:13.332931 2026] [:error] [pid 62515:tid 62531] [client 20.197.232.217:4484] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ini.php"] [unique_id "ahRdqRig0_XsOwmnrv9eTQAAAM4"]
[Mon May 25 22:33:14.245791 2026] [proxy_fcgi:error] [pid 62515:tid 62528] [client 20.197.232.217:35161] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:33:14.966564 2026] [proxy_fcgi:error] [pid 62515:tid 62527] [client 20.197.232.217:35161] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:33:15.629122 2026] [proxy_fcgi:error] [pid 62515:tid 62526] [client 20.197.232.217:35161] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:33:16.255554 2026] [proxy_fcgi:error] [pid 62515:tid 62532] [client 20.197.232.217:35161] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:33:16.912559 2026] [:error] [pid 62515:tid 62517] [client 20.197.232.217:35161] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "ahRdrBig0_XsOwmnrv9eVwAAAMA"]
[Mon May 25 22:33:18.764388 2026] [:error] [pid 62427:tid 62460] [client 20.197.232.217:56484] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/index.php"] [unique_id "ahRdrvMUa83fc4GDyByKdgAAAUM"]
[Mon May 25 22:33:20.224981 2026] [proxy_fcgi:error] [pid 62515:tid 62541] [client 20.197.232.217:60024] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:33:21.059574 2026] [:error] [pid 62515:tid 62530] [client 20.197.232.217:60024] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "ahRdsRig0_XsOwmnrv9eYgAAAM0"]
[Mon May 25 22:33:21.855918 2026] [:error] [pid 62427:tid 62477] [client 20.197.232.217:14351] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "ahRdsfMUa83fc4GDyByKfQAAAVQ"]
[Mon May 25 22:33:22.973094 2026] [:error] [pid 3698:tid 3700] [client 20.197.232.217:60014] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "ahRdsgtZBEwA4fyFLKMDDgAAAQA"]
[Mon May 25 22:33:24.010144 2026] [:error] [pid 62515:tid 62526] [client 20.197.232.217:39282] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/file.php"] [unique_id "ahRdtBig0_XsOwmnrv9eaAAAAMk"]
[Mon May 25 22:33:25.076843 2026] [:error] [pid 62515:tid 62536] [client 20.197.232.217:50091] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/chosen.php"] [unique_id "ahRdtRig0_XsOwmnrv9ebAAAANM"]
[Mon May 25 22:33:26.204958 2026] [:error] [pid 53791:tid 53812] [client 20.197.232.217:33632] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ahRdtiCRhhNTD40Nf1UwKAAAAZM"]
[Mon May 25 22:33:27.220813 2026] [:error] [pid 62427:tid 62471] [client 20.197.232.217:41611] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ahRdt_MUa83fc4GDyByKhwAAAU4"]
[Mon May 25 22:33:27.920564 2026] [:error] [pid 62426:tid 62431] [client 20.197.232.217:4569] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ahRdt0j3D3Mo8ANpTRAluAAAAAE"]
[Mon May 25 22:33:28.725958 2026] [:error] [pid 3698:tid 3719] [client 20.197.232.217:28646] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/"] [unique_id "ahRduAtZBEwA4fyFLKMDEgAAARM"]
[Mon May 25 22:33:29.534566 2026] [:error] [pid 53791:tid 53796] [client 20.197.232.217:14086] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahRduSCRhhNTD40Nf1UwLAAAAYM"]
[Mon May 25 22:33:30.448854 2026] [:error] [pid 3698:tid 3722] [client 20.197.232.217:4677] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahRdugtZBEwA4fyFLKMDFAAAARY"]
[Mon May 25 22:33:31.322876 2026] [:error] [pid 3698:tid 3709] [client 20.197.232.217:39586] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahRduwtZBEwA4fyFLKMDFQAAAQk"]
[Mon May 25 22:33:32.064711 2026] [:error] [pid 62426:tid 62449] [client 20.197.232.217:45148] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ahRdvEj3D3Mo8ANpTRAlwAAAABM"]
[Mon May 25 22:33:33.183189 2026] [:error] [pid 3698:tid 3717] [client 20.197.232.217:4731] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/about.php"] [unique_id "ahRdvQtZBEwA4fyFLKMDFwAAARE"]
[Mon May 25 22:33:34.119263 2026] [:error] [pid 53791:tid 53795] [client 20.197.232.217:23506] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/about.php"] [unique_id "ahRdviCRhhNTD40Nf1UwMQAAAYI"]
[Mon May 25 22:33:34.927662 2026] [:error] [pid 3698:tid 3724] [client 20.197.232.217:37197] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/about.php"] [unique_id "ahRdvgtZBEwA4fyFLKMDGgAAARg"]
[Mon May 25 22:33:35.880672 2026] [:error] [pid 62426:tid 62451] [client 20.197.232.217:31051] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/about.php"] [unique_id "ahRdv0j3D3Mo8ANpTRAlxwAAABU"]
[Mon May 25 22:33:36.991308 2026] [:error] [pid 62426:tid 62444] [client 20.197.232.217:26074] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa-rex.php"] [unique_id "ahRdwEj3D3Mo8ANpTRAlywAAAA4"]
[Mon May 25 22:33:37.907928 2026] [:error] [pid 62426:tid 62447] [client 20.197.232.217:26050] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa-rex.php"] [unique_id "ahRdwUj3D3Mo8ANpTRAlzQAAABE"]
[Mon May 25 22:33:38.885990 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:4477] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa-rex.php"] [unique_id "ahRdwkj3D3Mo8ANpTRAl0AAAAAA"]
[Mon May 25 22:33:39.768931 2026] [:error] [pid 62426:tid 62439] [client 20.197.232.217:33538] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/alfa-rex.php"] [unique_id "ahRdw0j3D3Mo8ANpTRAl0gAAAAk"]
[Mon May 25 22:33:41.003138 2026] [:error] [pid 62427:tid 62469] [client 20.197.232.217:34135] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/xmrlpc.php"] [unique_id "ahRdxfMUa83fc4GDyByKlQAAAUw"]
[Mon May 25 22:33:42.032007 2026] [:error] [pid 53791:tid 53809] [client 20.197.232.217:34125] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/xmrlpc.php"] [unique_id "ahRdxiCRhhNTD40Nf1UwNQAAAZA"]
[Mon May 25 22:33:42.911983 2026] [:error] [pid 62722:tid 62731] [client 20.197.232.217:23486] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/xmrlpc.php"] [unique_id "ahRdxqM6ssnLWYf6CVBZvAAAAEc"]
[Mon May 25 22:33:44.176129 2026] [:error] [pid 62515:tid 62518] [client 20.197.232.217:23033] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/xmrlpc.php"] [unique_id "ahRdyBig0_XsOwmnrv9ecgAAAME"]
[Mon May 25 22:33:44.883500 2026] [:error] [pid 62722:tid 62740] [client 20.197.232.217:4361] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ahRdyKM6ssnLWYf6CVBZwwAAAFA"]
[Mon May 25 22:33:46.159326 2026] [:error] [pid 62426:tid 62432] [client 20.197.232.217:31072] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ahRdykj3D3Mo8ANpTRAl1wAAAAI"]
[Mon May 25 22:33:47.572937 2026] [:error] [pid 62515:tid 62539] [client 20.197.232.217:23025] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ahRdyxig0_XsOwmnrv9edAAAANY"]
[Mon May 25 22:33:48.317558 2026] [:error] [pid 3698:tid 3700] [client 20.197.232.217:4472] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ahRdzAtZBEwA4fyFLKMDIQAAAQA"]
[Mon May 25 22:33:49.291088 2026] [:error] [pid 62722:tid 62735] [client 20.197.232.217:31070] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ahRdzaM6ssnLWYf6CVBZxwAAAEs"]
[Mon May 25 22:33:50.590948 2026] [:error] [pid 53791:tid 53809] [client 20.197.232.217:21385] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ahRdziCRhhNTD40Nf1UwPQAAAZA"]
[Mon May 25 22:33:51.943283 2026] [:error] [pid 3698:tid 3713] [client 20.197.232.217:23439] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ahRdzwtZBEwA4fyFLKMDIgAAAQ0"]
[Mon May 25 22:33:52.863228 2026] [:error] [pid 3698:tid 3702] [client 20.197.232.217:11815] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-blog-header.php"] [unique_id "ahRd0AtZBEwA4fyFLKMDJQAAAQI"]
[Mon May 25 22:33:53.602692 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:26086] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ahRd0Uj3D3Mo8ANpTRAl4AAAAAU"]
[Mon May 25 22:33:54.758508 2026] [:error] [pid 62428:tid 62503] [client 20.197.232.217:45115] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ahRd0pNosGBa7mui3VRzegAAAJM"]
[Mon May 25 22:33:56.056739 2026] [:error] [pid 62428:tid 62508] [client 20.197.232.217:23434] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ahRd1JNosGBa7mui3VRzgQAAAJg"]
[Mon May 25 22:33:57.558156 2026] [:error] [pid 3698:tid 3712] [client 20.197.232.217:26101] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-cron.php"] [unique_id "ahRd1QtZBEwA4fyFLKMDJwAAAQw"]
[Mon May 25 22:33:58.642822 2026] [:error] [pid 3698:tid 3701] [client 20.197.232.217:31061] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "ahRd1gtZBEwA4fyFLKMDKwAAAQE"]
[Mon May 25 22:34:00.501156 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:11787] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "ahRd2Ej3D3Mo8ANpTRAl5gAAAA0"]
[Mon May 25 22:34:01.893459 2026] [:error] [pid 62426:tid 62450] [client 20.197.232.217:36627] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "ahRd2Uj3D3Mo8ANpTRAl6wAAABQ"]
[Mon May 25 22:34:02.993990 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:26069] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/maint/index.php"] [unique_id "ahRd2kj3D3Mo8ANpTRAl9AAAAA0"]
[Mon May 25 22:34:03.915878 2026] [:error] [pid 62428:tid 62496] [client 20.197.232.217:26076] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/news.php"] [unique_id "ahRd25NosGBa7mui3VRzhwAAAIw"]
[Mon May 25 22:34:04.612322 2026] [:error] [pid 62428:tid 62485] [client 20.197.232.217:4391] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/news.php"] [unique_id "ahRd3JNosGBa7mui3VRziAAAAIE"]
[Mon May 25 22:34:05.733491 2026] [:error] [pid 62722:tid 62732] [client 20.197.232.217:45088] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/news.php"] [unique_id "ahRd3aM6ssnLWYf6CVBZ1AAAAEg"]
[Mon May 25 22:34:07.114984 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:45067] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/news.php"] [unique_id "ahRd3xig0_XsOwmnrv9egAAAAMs"]
[Mon May 25 22:34:07.819375 2026] [:error] [pid 62515:tid 62517] [client 20.197.232.217:22984] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/index.php"] [unique_id "ahRd3xig0_XsOwmnrv9eggAAAMA"]
[Mon May 25 22:34:08.553110 2026] [:error] [pid 3698:tid 3701] [client 20.197.232.217:21393] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "ahRd4AtZBEwA4fyFLKMDMQAAAQE"]
[Mon May 25 22:34:09.252150 2026] [:error] [pid 62515:tid 62534] [client 20.197.232.217:45082] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "ahRd4Rig0_XsOwmnrv9ehAAAANE"]
[Mon May 25 22:34:10.146661 2026] [:error] [pid 62427:tid 62476] [client 20.197.232.217:34174] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/1index.php"] [unique_id "ahRd4vMUa83fc4GDyByKogAAAVM"]
[Mon May 25 22:34:10.904698 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:36650] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/"] [unique_id "ahRd4kj3D3Mo8ANpTRAl-wAAABI"]
[Mon May 25 22:34:11.819507 2026] [:error] [pid 62722:tid 62742] [client 20.197.232.217:40524] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/"] [unique_id "ahRd46M6ssnLWYf6CVBZ1gAAAFI"]
[Mon May 25 22:34:12.642366 2026] [:error] [pid 62515:tid 62527] [client 20.197.232.217:34165] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/"] [unique_id "ahRd5Big0_XsOwmnrv9eiQAAAMo"]
[Mon May 25 22:34:13.700011 2026] [:error] [pid 62515:tid 62517] [client 20.197.232.217:11781] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/uploads/2023/"] [unique_id "ahRd5Rig0_XsOwmnrv9eigAAAMA"]
[Mon May 25 22:34:14.438252 2026] [:error] [pid 53791:tid 53803] [client 20.197.232.217:21382] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ahRd5iCRhhNTD40Nf1UwTQAAAYo"]
[Mon May 25 22:34:15.126668 2026] [:error] [pid 62426:tid 62441] [client 20.197.232.217:59957] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ahRd50j3D3Mo8ANpTRAl_wAAAAs"]
[Mon May 25 22:34:15.901045 2026] [:error] [pid 62426:tid 62437] [client 20.197.232.217:23461] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ahRd50j3D3Mo8ANpTRAmAQAAAAc"]
[Mon May 25 22:34:16.759156 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:34136] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/admin.php"] [unique_id "ahRd6Big0_XsOwmnrv9ekgAAAMU"]
[Mon May 25 22:34:17.744168 2026] [:error] [pid 62515:tid 62525] [client 20.197.232.217:32104] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahRd6Rig0_XsOwmnrv9elgAAAMg"]
[Mon May 25 22:34:18.720229 2026] [:error] [pid 53791:tid 53817] [client 20.197.232.217:34131] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahRd6iCRhhNTD40Nf1UwTwAAAZg"]
[Mon May 25 22:34:19.418989 2026] [:error] [pid 53791:tid 53805] [client 20.197.232.217:23014] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahRd6yCRhhNTD40Nf1UwUQAAAYw"]
[Mon May 25 22:34:20.435762 2026] [proxy_fcgi:error] [pid 53791:tid 53811] [client 20.197.232.217:23459] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:20.747899 2026] [proxy_fcgi:error] [pid 53791:tid 53816] [client 20.197.232.217:23459] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:21.709665 2026] [:error] [pid 53791:tid 53814] [client 20.197.232.217:23459] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/index.php"] [unique_id "ahRd7SCRhhNTD40Nf1UwXAAAAZU"]
[Mon May 25 22:34:22.822501 2026] [proxy_fcgi:error] [pid 3698:tid 3702] [client 20.197.232.217:23031] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:23.427476 2026] [proxy_fcgi:error] [pid 3698:tid 3706] [client 20.197.232.217:23031] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:23.797288 2026] [proxy_fcgi:error] [pid 3698:tid 3712] [client 20.197.232.217:23031] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:24.115379 2026] [proxy_fcgi:error] [pid 3698:tid 3716] [client 20.197.232.217:23031] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:24.430170 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:23031] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/assets/index.php"] [unique_id "ahRd8AtZBEwA4fyFLKMDPQAAAQ8"]
[Mon May 25 22:34:25.351894 2026] [:error] [pid 62427:tid 62458] [client 20.197.232.217:45085] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ahRd8fMUa83fc4GDyByKrgAAAUE"]
[Mon May 25 22:34:26.693857 2026] [proxy_fcgi:error] [pid 62426:tid 62441] [client 20.197.232.217:23440] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:34:27.919930 2026] [:error] [pid 62426:tid 62451] [client 20.197.232.217:23440] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "ahRd80j3D3Mo8ANpTRAmDwAAABU"]
[Mon May 25 22:34:29.004147 2026] [:error] [pid 62515:tid 62524] [client 20.197.232.217:4370] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "ahRd9Rig0_XsOwmnrv9engAAAMc"]
[Mon May 25 22:34:30.277460 2026] [:error] [pid 53791:tid 53793] [client 20.197.232.217:30032] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "ahRd9iCRhhNTD40Nf1UwXgAAAYA"]
[Mon May 25 22:34:31.277407 2026] [:error] [pid 62428:tid 62490] [client 20.197.232.217:11795] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-links-opml.php"] [unique_id "ahRd95NosGBa7mui3VRztAAAAIY"]
[Mon May 25 22:34:32.552044 2026] [:error] [pid 62428:tid 62491] [client 20.197.232.217:45081] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/"] [unique_id "ahRd-JNosGBa7mui3VRztgAAAIc"]
[Mon May 25 22:34:33.627932 2026] [:error] [pid 3698:tid 3709] [client 20.197.232.217:59950] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/"] [unique_id "ahRd-QtZBEwA4fyFLKMDSwAAAQk"]
[Mon May 25 22:34:34.458689 2026] [:error] [pid 62426:tid 62433] [client 20.197.232.217:11801] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/"] [unique_id "ahRd-kj3D3Mo8ANpTRAmFAAAAAM"]
[Mon May 25 22:34:35.717779 2026] [:error] [pid 62427:tid 62475] [client 20.197.232.217:22989] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/"] [unique_id "ahRd-_MUa83fc4GDyByKtgAAAVI"]
[Mon May 25 22:34:36.579496 2026] [:error] [pid 53791:tid 53800] [client 20.197.232.217:31085] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "ahRd_CCRhhNTD40Nf1UwYgAAAYc"]
[Mon May 25 22:34:37.363400 2026] [:error] [pid 62515:tid 62525] [client 20.197.232.217:45057] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "ahRd_Rig0_XsOwmnrv9erwAAAMg"]
[Mon May 25 22:34:38.606193 2026] [:error] [pid 62426:tid 62432] [client 20.197.232.217:32575] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "ahRd_kj3D3Mo8ANpTRAmGwAAAAI"]
[Mon May 25 22:34:39.864882 2026] [:error] [pid 62426:tid 62445] [client 20.197.232.217:32536] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/system.php"] [unique_id "ahRd_0j3D3Mo8ANpTRAmHwAAAA8"]
[Mon May 25 22:34:40.669166 2026] [:error] [pid 62426:tid 62454] [client 20.197.232.217:32560] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/special.php"] [unique_id "ahReAEj3D3Mo8ANpTRAmIwAAABg"]
[Mon May 25 22:34:42.149169 2026] [:error] [pid 62515:tid 62523] [client 20.197.232.217:24496] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/special.php"] [unique_id "ahReAhig0_XsOwmnrv9etwAAAMY"]
[Mon May 25 22:34:43.731384 2026] [:error] [pid 62427:tid 62474] [client 20.197.232.217:34130] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/special.php"] [unique_id "ahReA_MUa83fc4GDyByKugAAAVE"]
[Mon May 25 22:34:44.371053 2026] [:error] [pid 62427:tid 62464] [client 20.197.232.217:23027] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/special.php"] [unique_id "ahReBPMUa83fc4GDyByKvAAAAUc"]
[Mon May 25 22:34:45.194379 2026] [:error] [pid 62722:tid 62737] [client 20.197.232.217:22986] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/"] [unique_id "ahReBaM6ssnLWYf6CVBZ2wAAAE0"]
[Mon May 25 22:34:46.059074 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:45070] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/"] [unique_id "ahReBgtZBEwA4fyFLKMDTQAAAQ8"]
[Mon May 25 22:34:47.142198 2026] [:error] [pid 62515:tid 62535] [client 20.197.232.217:26056] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/"] [unique_id "ahReBxig0_XsOwmnrv9evQAAANI"]
[Mon May 25 22:34:47.851291 2026] [:error] [pid 3698:tid 3704] [client 20.197.232.217:23029] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/media/"] [unique_id "ahReBwtZBEwA4fyFLKMDTgAAAQQ"]
[Mon May 25 22:34:48.609863 2026] [:error] [pid 62722:tid 62732] [client 20.197.232.217:11827] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ahReCKM6ssnLWYf6CVBZ3wAAAEg"]
[Mon May 25 22:34:49.968392 2026] [:error] [pid 62427:tid 62477] [client 20.197.232.217:45066] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ahReCfMUa83fc4GDyByKvgAAAVQ"]
[Mon May 25 22:34:51.090330 2026] [:error] [pid 62515:tid 62540] [client 20.197.232.217:50118] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/IXR/about.php"] [unique_id "ahReCxig0_XsOwmnrv9ewgAAANc"]
[Mon May 25 22:34:55.728548 2026] [:error] [pid 62515:tid 62520] [client 20.197.232.217:35655] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-signup.php"] [unique_id "ahReDxig0_XsOwmnrv9exwAAAMM"]
[Mon May 25 22:34:56.475263 2026] [:error] [pid 62426:tid 62433] [client 20.197.232.217:25487] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-signup.php"] [unique_id "ahReEEj3D3Mo8ANpTRAmMQAAAAM"]
[Mon May 25 22:34:57.210969 2026] [:error] [pid 62428:tid 62498] [client 20.197.232.217:25484] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-signup.php"] [unique_id "ahReEZNosGBa7mui3VRzygAAAI4"]
[Mon May 25 22:34:57.942214 2026] [:error] [pid 62428:tid 62486] [client 20.197.232.217:27123] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/wp-signup.php"] [unique_id "ahReEZNosGBa7mui3VRz1QAAAII"]
[Mon May 25 22:34:58.958037 2026] [:error] [pid 62427:tid 62461] [client 20.197.232.217:21999] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "ahReEvMUa83fc4GDyByK1gAAAUQ"]
[Mon May 25 22:35:00.740163 2026] [:error] [pid 62515:tid 62522] [client 20.197.232.217:22975] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "ahReFBig0_XsOwmnrv9fEwAAAMU"]
[Mon May 25 22:35:02.286693 2026] [:error] [pid 62427:tid 62471] [client 20.197.232.217:14747] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "ahReFvMUa83fc4GDyByK_gAAAU4"]
[Mon May 25 22:35:03.359114 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:22004] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/languages/index.php"] [unique_id "ahReF0j3D3Mo8ANpTRAmdwAAAA0"]
[Mon May 25 22:35:04.652251 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:63398] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc.php"] [unique_id "ahReGAtZBEwA4fyFLKMDewAAAQ8"]
[Mon May 25 22:35:05.903482 2026] [:error] [pid 62428:tid 62487] [client 20.197.232.217:14190] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc.php"] [unique_id "ahReGZNosGBa7mui3VR0EwAAAIM"]
[Mon May 25 22:35:07.840284 2026] [:error] [pid 3698:tid 3708] [client 20.197.232.217:63383] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc.php"] [unique_id "ahReGwtZBEwA4fyFLKMDfwAAAQg"]
[Mon May 25 22:35:09.678959 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:35638] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cc.php"] [unique_id "ahReHUj3D3Mo8ANpTRAmjwAAAAA"]
[Mon May 25 22:35:10.318776 2026] [:error] [pid 53791:tid 53812] [client 20.197.232.217:11369] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/admin.php"] [unique_id "ahReHiCRhhNTD40Nf1UwkgAAAZM"]
[Mon May 25 22:35:11.413102 2026] [:error] [pid 53791:tid 53805] [client 20.197.232.217:35608] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/admin.php"] [unique_id "ahReHyCRhhNTD40Nf1UwlAAAAYw"]
[Mon May 25 22:35:12.596633 2026] [:error] [pid 62515:tid 62528] [client 20.197.232.217:34663] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/admin.php"] [unique_id "ahReIBig0_XsOwmnrv9fFgAAAMs"]
[Mon May 25 22:35:14.005156 2026] [:error] [pid 62515:tid 62518] [client 20.197.232.217:4772] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/css/admin.php"] [unique_id "ahReIhig0_XsOwmnrv9fGgAAAME"]
[Mon May 25 22:35:15.638721 2026] [:error] [pid 62722:tid 62724] [client 20.197.232.217:32025] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/"] [unique_id "ahReI6M6ssnLWYf6CVBZ_gAAAEA"]
[Mon May 25 22:35:18.265679 2026] [:error] [pid 62426:tid 62438] [client 20.197.232.217:42139] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/"] [unique_id "ahReJkj3D3Mo8ANpTRAmoAAAAAg"]
[Mon May 25 22:35:20.378601 2026] [:error] [pid 62722:tid 62731] [client 20.197.232.217:54366] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/"] [unique_id "ahReKKM6ssnLWYf6CVBaAQAAAEc"]
[Mon May 25 22:35:23.984999 2026] [:error] [pid 3698:tid 3724] [client 20.197.232.217:42132] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/certificates/"] [unique_id "ahReKwtZBEwA4fyFLKMDhwAAARg"]
[Mon May 25 22:35:24.892751 2026] [:error] [pid 62428:tid 62493] [client 20.197.232.217:54379] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/"] [unique_id "ahReLJNosGBa7mui3VR0egAAAIk"]
[Mon May 25 22:35:25.740902 2026] [:error] [pid 62426:tid 62442] [client 20.197.232.217:35119] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/"] [unique_id "ahReLUj3D3Mo8ANpTRAmrQAAAAw"]
[Mon May 25 22:35:26.462908 2026] [:error] [pid 62428:tid 62492] [client 20.197.232.217:37827] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/.well-known/pki-validation/"] [unique_id "ahReLpNosGBa7mui3VR0ewAAAIg"]
[Mon May 25 22:35:28.214856 2026] [autoindex:error] [pid 62427:tid 62474] [client 20.197.232.217:42134] AH01276: Cannot serve directory /home/switchcreative/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 22:35:28.609657 2026] [proxy_fcgi:error] [pid 62427:tid 62465] [client 20.197.232.217:42134] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:28.923436 2026] [:error] [pid 62427:tid 62463] [client 20.197.232.217:42134] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/about.php"] [unique_id "ahReMPMUa83fc4GDyByLJAAAAUY"]
[Mon May 25 22:35:30.475471 2026] [proxy_fcgi:error] [pid 62426:tid 62451] [client 20.197.232.217:44399] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:30.897504 2026] [proxy_fcgi:error] [pid 62426:tid 62438] [client 20.197.232.217:44399] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:31.871562 2026] [:error] [pid 62426:tid 62452] [client 20.197.232.217:44399] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/php-compat/index.php"] [unique_id "ahReM0j3D3Mo8ANpTRAmtwAAABY"]
[Mon May 25 22:35:33.468109 2026] [proxy_fcgi:error] [pid 62426:tid 62450] [client 20.197.232.217:44363] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:34.368044 2026] [proxy_fcgi:error] [pid 62426:tid 62445] [client 20.197.232.217:44363] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:35.851354 2026] [:error] [pid 62426:tid 62444] [client 20.197.232.217:44363] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "ahReN0j3D3Mo8ANpTRAmwAAAAA4"]
[Mon May 25 22:35:37.009734 2026] [:error] [pid 62722:tid 62728] [client 20.197.232.217:37833] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ahReOaM6ssnLWYf6CVBaBgAAAEQ"]
[Mon May 25 22:35:37.782229 2026] [:error] [pid 3698:tid 3709] [client 20.197.232.217:42745] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/block-supports/index.php"] [unique_id "ahReOQtZBEwA4fyFLKMDjQAAAQk"]
[Mon May 25 22:35:38.602076 2026] [proxy_fcgi:error] [pid 53791:tid 53794] [client 20.197.232.217:27012] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:35:38.998230 2026] [:error] [pid 53791:tid 53795] [client 20.197.232.217:27012] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "ahReOiCRhhNTD40Nf1UwuAAAAYI"]
[Mon May 25 22:35:40.441701 2026] [:error] [pid 62426:tid 62435] [client 20.197.232.217:26616] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "ahRePEj3D3Mo8ANpTRAmwQAAAAU"]
[Mon May 25 22:35:41.390218 2026] [:error] [pid 62426:tid 62441] [client 20.197.232.217:29674] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "ahRePUj3D3Mo8ANpTRAmwgAAAAs"]
[Mon May 25 22:35:42.170428 2026] [:error] [pid 62722:tid 62729] [client 20.197.232.217:45066] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/file2.php"] [unique_id "ahRePqM6ssnLWYf6CVBaDQAAAEU"]
[Mon May 25 22:35:42.865812 2026] [:error] [pid 62427:tid 62459] [client 20.197.232.217:54286] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/radio.php"] [unique_id "ahRePvMUa83fc4GDyByLKwAAAUI"]
[Mon May 25 22:35:43.535279 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:21491] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/radio.php"] [unique_id "ahReP0j3D3Mo8ANpTRAmxAAAAA0"]
[Mon May 25 22:35:44.216151 2026] [:error] [pid 62426:tid 62430] [client 20.197.232.217:27043] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/radio.php"] [unique_id "ahReQEj3D3Mo8ANpTRAmxQAAAAA"]
[Mon May 25 22:35:45.719263 2026] [:error] [pid 3698:tid 3713] [client 20.197.232.217:27064] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cgi-bin/radio.php"] [unique_id "ahReQQtZBEwA4fyFLKMDkQAAAQ0"]
[Mon May 25 22:35:47.417900 2026] [:error] [pid 62722:tid 62739] [client 20.197.232.217:5052] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "ahReQ6M6ssnLWYf6CVBaFwAAAE8"]
[Mon May 25 22:35:48.672365 2026] [:error] [pid 3698:tid 3711] [client 20.197.232.217:21495] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/api.php"] [unique_id "ahReRAtZBEwA4fyFLKMDkwAAAQs"]
[Mon May 25 22:35:49.738481 2026] [:error] [pid 3698:tid 3703] [client 20.197.232.217:4980] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/api.php"] [unique_id "ahReRQtZBEwA4fyFLKMDlgAAAQM"]
[Mon May 25 22:35:51.011953 2026] [:error] [pid 62515:tid 62539] [client 20.197.232.217:5026] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/api.php"] [unique_id "ahReRxig0_XsOwmnrv9fMgAAANY"]
[Mon May 25 22:35:52.329118 2026] [:error] [pid 62426:tid 62452] [client 20.197.232.217:24527] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/"] [unique_id "ahReSEj3D3Mo8ANpTRAmywAAABY"]
[Mon May 25 22:35:53.504567 2026] [:error] [pid 62515:tid 62523] [client 20.197.232.217:30069] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/"] [unique_id "ahReSRig0_XsOwmnrv9fNQAAAMY"]
[Mon May 25 22:35:54.502179 2026] [:error] [pid 53791:tid 53797] [client 20.197.232.217:29687] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/"] [unique_id "ahReSiCRhhNTD40Nf1UwwgAAAYQ"]
[Mon May 25 22:35:55.651518 2026] [:error] [pid 3698:tid 3721] [client 20.197.232.217:53041] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/Requests/library/"] [unique_id "ahReSwtZBEwA4fyFLKMDmQAAARU"]
[Mon May 25 22:35:57.060839 2026] [:error] [pid 3698:tid 3715] [client 20.197.232.217:4954] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ahReTQtZBEwA4fyFLKMDmgAAAQ8"]
[Mon May 25 22:35:58.557040 2026] [:error] [pid 3698:tid 3723] [client 20.197.232.217:5049] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ahReTgtZBEwA4fyFLKMDnAAAARc"]
[Mon May 25 22:36:01.067513 2026] [:error] [pid 62426:tid 62437] [client 20.197.232.217:5022] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ahReUUj3D3Mo8ANpTRAm2gAAAAc"]
[Mon May 25 22:36:02.968885 2026] [:error] [pid 62515:tid 62538] [client 20.197.232.217:53053] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/images/"] [unique_id "ahReUhig0_XsOwmnrv9fPAAAANU"]
[Mon May 25 22:36:05.864118 2026] [:error] [pid 62428:tid 62504] [client 20.197.232.217:4986] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahReVZNosGBa7mui3VR0ngAAAJQ"]
[Mon May 25 22:36:07.449263 2026] [:error] [pid 62427:tid 62462] [client 20.197.232.217:26586] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahReV_MUa83fc4GDyByLMAAAAUU"]
[Mon May 25 22:36:09.146885 2026] [:error] [pid 62428:tid 62499] [client 20.197.232.217:30041] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahReWZNosGBa7mui3VR0oQAAAI8"]
[Mon May 25 22:36:10.742629 2026] [:error] [pid 62427:tid 62463] [client 20.197.232.217:4967] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/x.php"] [unique_id "ahReWvMUa83fc4GDyByLMgAAAUY"]
[Mon May 25 22:36:12.750715 2026] [:error] [pid 62427:tid 62461] [client 20.197.232.217:24520] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahReXPMUa83fc4GDyByLNwAAAUQ"]
[Mon May 25 22:36:14.463732 2026] [:error] [pid 53791:tid 53799] [client 20.197.232.217:21892] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahReXiCRhhNTD40Nf1UwzQAAAYY"]
[Mon May 25 22:36:16.056646 2026] [:error] [pid 62426:tid 62440] [client 20.197.232.217:35695] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahReYEj3D3Mo8ANpTRAm3gAAAAo"]
[Mon May 25 22:36:17.063949 2026] [:error] [pid 62426:tid 62434] [client 20.197.232.217:53009] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/plugins/admin.php"] [unique_id "ahReYUj3D3Mo8ANpTRAm4AAAAAQ"]
[Mon May 25 22:36:17.907489 2026] [:error] [pid 62722:tid 62736] [client 20.197.232.217:4945] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "ahReYaM6ssnLWYf6CVBaOQAAAEw"]
[Mon May 25 22:36:19.831264 2026] [:error] [pid 3698:tid 3707] [client 20.197.232.217:47020] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "ahReYwtZBEwA4fyFLKMDtgAAAQc"]
[Mon May 25 22:36:22.396954 2026] [:error] [pid 62426:tid 62452] [client 20.197.232.217:52995] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "ahReZkj3D3Mo8ANpTRAm8wAAABY"]
[Mon May 25 22:36:25.149130 2026] [:error] [pid 62426:tid 62454] [client 20.197.232.217:35683] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/js/widgets/"] [unique_id "ahReaUj3D3Mo8ANpTRAnBgAAABg"]
[Mon May 25 22:36:26.979988 2026] [:error] [pid 53791:tid 53795] [client 20.197.232.217:38677] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/css.php"] [unique_id "ahReaiCRhhNTD40Nf1Uw9gAAAYI"]
[Mon May 25 22:36:28.241089 2026] [:error] [pid 53791:tid 53817] [client 20.197.232.217:54959] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ahRebCCRhhNTD40Nf1Uw_QAAAZg"]
[Mon May 25 22:36:29.697148 2026] [:error] [pid 62515:tid 62540] [client 20.197.232.217:46999] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ahRebRig0_XsOwmnrv9fegAAANc"]
[Mon May 25 22:36:30.478278 2026] [:error] [pid 62515:tid 62520] [client 20.197.232.217:53038] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ahRebhig0_XsOwmnrv9fgAAAAMM"]
[Mon May 25 22:36:32.975007 2026] [:error] [pid 62515:tid 62532] [client 20.197.232.217:21944] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gecko.php"] [unique_id "ahRecBig0_XsOwmnrv9fjAAAAM8"]
[Mon May 25 22:36:34.256700 2026] [:error] [pid 62428:tid 62493] [client 20.197.232.217:38717] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "ahRecpNosGBa7mui3VR01gAAAIk"]
[Mon May 25 22:36:35.238915 2026] [:error] [pid 62428:tid 62488] [client 20.197.232.217:53028] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "ahRec5NosGBa7mui3VR02QAAAIQ"]
[Mon May 25 22:36:35.999968 2026] [:error] [pid 53791:tid 53806] [client 20.197.232.217:21898] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "ahRecyCRhhNTD40Nf1UxCwAAAY0"]
[Mon May 25 22:36:36.678634 2026] [:error] [pid 62722:tid 62739] [client 20.197.232.217:35684] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/sky-pro/js.php"] [unique_id "ahRedKM6ssnLWYf6CVBaSgAAAE8"]
[Mon May 25 22:36:37.418858 2026] [:error] [pid 62722:tid 62728] [client 20.197.232.217:47037] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/pomo/"] [unique_id "ahRedaM6ssnLWYf6CVBaTQAAAEQ"]
[Mon May 25 22:36:39.686626 2026] [:error] [pid 62427:tid 62480] [client 20.197.232.217:4970] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ahRed_MUa83fc4GDyByLZQAAAVc"]
[Mon May 25 22:36:40.414653 2026] [proxy_fcgi:error] [pid 62426:tid 62438] [client 20.197.232.217:47009] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:36:40.736595 2026] [:error] [pid 62426:tid 62433] [client 20.197.232.217:47009] [client 20.197.232.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "switchcreative.net"] [uri "/wp-includes/customize/about.php"] [unique_id "ahReeEj3D3Mo8ANpTRAnLgAAAAM"]
[Mon May 25 22:36:43.772304 2026] [proxy_fcgi:error] [pid 62426:tid 62443] [client 20.197.232.217:38674] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:36:44.090627 2026] [proxy_fcgi:error] [pid 62426:tid 62433] [client 20.197.232.217:38674] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:36:44.424743 2026] [proxy_fcgi:error] [pid 62426:tid 62435] [client 20.197.232.217:38674] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:36:44.770421 2026] [proxy_fcgi:error] [pid 62426:tid 62431] [client 20.197.232.217:38674] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:36:45.747776 2026] [:error] [pid 62426:tid 62443] [client 20.197.232.217:38674] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ahRefUj3D3Mo8ANpTRAnTgAAAA0"]
[Mon May 25 22:36:47.679691 2026] [:error] [pid 62427:tid 62457] [client 20.197.232.217:24514] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ahRef_MUa83fc4GDyByLaQAAAUA"]
[Mon May 25 22:36:50.288158 2026] [:error] [pid 62515:tid 62524] [client 20.197.232.217:24532] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ahReghig0_XsOwmnrv9frwAAAMc"]
[Mon May 25 22:36:52.382787 2026] [:error] [pid 53791:tid 53817] [client 20.197.232.217:21941] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/inputs.php"] [unique_id "ahRehCCRhhNTD40Nf1UxJgAAAZg"]
[Mon May 25 22:36:55.846418 2026] [:error] [pid 62515:tid 62527] [client 20.197.232.217:44302] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahRehxig0_XsOwmnrv9fvQAAAMo"]
[Mon May 25 22:37:07.031096 2026] [:error] [pid 53791:tid 53795] [client 20.197.232.217:21895] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahRekyCRhhNTD40Nf1UxOwAAAYI"]
[Mon May 25 22:37:33.808063 2026] [:error] [pid 62426:tid 62448] [client 20.197.232.217:22442] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/index.php"] [unique_id "ahRerUj3D3Mo8ANpTRAnzAAAABI"]
[Mon May 25 22:38:58.614029 2026] [proxy_fcgi:error] [pid 62722:tid 62724] [client 20.197.232.217:4501] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:38:58.938147 2026] [proxy_fcgi:error] [pid 62722:tid 62745] [client 20.197.232.217:4501] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:38:59.282821 2026] [proxy_fcgi:error] [pid 62722:tid 62743] [client 20.197.232.217:4501] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:38:59.621004 2026] [proxy_fcgi:error] [pid 62722:tid 62733] [client 20.197.232.217:4501] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:39:21.000880 2026] [proxy_fcgi:error] [pid 62427:tid 62479] [client 20.197.232.217:30998] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:39:21.370506 2026] [proxy_fcgi:error] [pid 62427:tid 62476] [client 20.197.232.217:30998] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:39:22.404794 2026] [:error] [pid 62427:tid 62470] [client 20.197.232.217:30998] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "ahRfGvMUa83fc4GDyByL9QAAAU0"]
[Mon May 25 22:39:36.512730 2026] [:error] [pid 62428:tid 62489] [client 20.197.232.217:42197] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-admin/about.php"] [unique_id "ahRfKJNosGBa7mui3VR1pwAAAIU"]
[Mon May 25 22:40:06.320253 2026] [:error] [pid 3698:tid 3702] [client 20.197.232.217:14770] [client 20.197.232.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-content/themes/"] [unique_id "ahRfRgtZBEwA4fyFLKME4wAAAQI"]
[Mon May 25 22:40:35.514370 2026] [proxy_fcgi:error] [pid 62515:tid 62533] [client 20.197.232.217:24466] AH01071: Got error 'Primary script unknown'
[Mon May 25 22:40:36.748158 2026] [proxy_fcgi:error] [pid 62515:tid 62541] [client 20.197.232.217:24466] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:31:43.498280 2026] [:error] [pid 62722:tid 62733] [client 45.124.146.40:59349] [client 45.124.146.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.124.146.40, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahRrX6M6ssnLWYf6CVBimQAAAEk"]
[Mon May 25 23:31:43.510249 2026] [proxy_fcgi:error] [pid 62722:tid 62733] [client 45.124.146.40:59349] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:38:17.376362 2026] [:error] [pid 62428:tid 62484] [client 43.130.72.177:37536] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahRs6ZNosGBa7mui3VSCBAAAAIA"]
[Mon May 25 23:57:05.535191 2026] [proxy_fcgi:error] [pid 62427:tid 62463] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:05.750640 2026] [proxy_fcgi:error] [pid 62427:tid 62477] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:06.243159 2026] [proxy_fcgi:error] [pid 62427:tid 62464] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:06.459334 2026] [proxy_fcgi:error] [pid 62427:tid 62457] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:06.890763 2026] [proxy_fcgi:error] [pid 62427:tid 62465] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:07.167119 2026] [proxy_fcgi:error] [pid 62427:tid 62474] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:07.421409 2026] [proxy_fcgi:error] [pid 62427:tid 62462] [client 20.104.106.53:53441] AH01071: Got error 'Primary script unknown'
[Mon May 25 23:57:07.851349 2026] [:error] [pid 62427:tid 62473] [client 20.104.106.53:53441] [client 20.104.106.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "ahRxU_MUa83fc4GDyByWJQAAAVA"]
[Mon May 25 23:57:08.843963 2026] [:error] [pid 62427:tid 62460] [client 20.104.106.53:8552] [client 20.104.106.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "ahRxVPMUa83fc4GDyByWJgAAAUM"]
[Mon May 25 23:57:09.965045 2026] [:error] [pid 62426:tid 62433] [client 20.104.106.53:48390] [client 20.104.106.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "ahRxVUj3D3Mo8ANpTRBF2QAAAAM"]
[Mon May 25 23:57:11.237753 2026] [:error] [pid 62427:tid 62471] [client 20.104.106.53:16952] [client 20.104.106.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/randkeyword.PhP7"] [unique_id "ahRxV_MUa83fc4GDyByWJwAAAU4"]
[Tue May 26 00:27:12.312413 2026] [:error] [pid 62515:tid 62522] [client 45.81.252.13:4254] [client 45.81.252.13] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahR4YBig0_XsOwmnrv-AlgAAAMU"]
[Tue May 26 00:34:51.875034 2026] [:error] [pid 53791:tid 53800] [client 43.153.62.161:43950] [client 43.153.62.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahR6KyCRhhNTD40Nf1VIcgAAAYc"]
[Tue May 26 01:27:21.342588 2026] [:error] [pid 62722:tid 62729] [client 51.83.7.81:34004] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahSGeaM6ssnLWYf6CVBwEgAAAEU"]
[Tue May 26 01:27:23.316960 2026] [:error] [pid 62515:tid 62536] [client 51.83.7.81:42398] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahSGexig0_XsOwmnrv-ONAAAANM"]
[Tue May 26 01:27:25.326644 2026] [:error] [pid 62428:tid 62488] [client 51.83.7.81:42404] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahSGfZNosGBa7mui3VSYBwAAAIQ"]
[Tue May 26 01:27:27.332277 2026] [:error] [pid 62428:tid 62494] [client 51.83.7.81:42406] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahSGf5NosGBa7mui3VSYCQAAAIo"]
[Tue May 26 01:27:29.323672 2026] [:error] [pid 62428:tid 62484] [client 51.83.7.81:42420] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahSGgZNosGBa7mui3VSYDQAAAIA"]
[Tue May 26 01:27:31.353490 2026] [:error] [pid 62426:tid 62435] [client 51.83.7.81:42422] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahSGg0j3D3Mo8ANpTRBjDwAAAAU"]
[Tue May 26 01:27:33.210129 2026] [:error] [pid 62426:tid 62438] [client 51.83.7.81:36390] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahSGhUj3D3Mo8ANpTRBjEAAAAAg"]
[Tue May 26 01:27:35.236606 2026] [:error] [pid 62426:tid 62444] [client 51.83.7.81:36402] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahSGh0j3D3Mo8ANpTRBjEgAAAA4"]
[Tue May 26 01:27:39.269271 2026] [:error] [pid 62515:tid 62533] [client 51.83.7.81:36410] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSGixig0_XsOwmnrv-OQAAAANA"]
[Tue May 26 01:27:43.095218 2026] [:error] [pid 62722:tid 62738] [client 51.83.7.81:37728] [client 51.83.7.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSGj6M6ssnLWYf6CVBwGAAAAE4"]
[Tue May 26 01:57:32.648690 2026] [:error] [pid 62426:tid 62434] [client 119.91.20.139:48904] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahSNjEj3D3Mo8ANpTRBpLgAAAAQ"]
[Tue May 26 01:57:48.683833 2026] [:error] [pid 62426:tid 62444] [client 81.25.166.4:62711] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20slot.aspx"] [unique_id "ahSNnEj3D3Mo8ANpTRBpRQAAAA4"]
[Tue May 26 01:57:50.764356 2026] [:error] [pid 62722:tid 62730] [client 81.25.166.4:61146] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/joker%20vip.aspx"] [unique_id "ahSNnqM6ssnLWYf6CVByPwAAAEY"]
[Tue May 26 01:57:52.814785 2026] [:error] [pid 62427:tid 62472] [client 81.25.166.4:64440] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahSNoPMUa83fc4GDyBygVwAAAU8"]
[Tue May 26 01:57:54.793612 2026] [:error] [pid 62426:tid 62451] [client 81.25.166.4:59411] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahSNokj3D3Mo8ANpTRBpRwAAABU"]
[Tue May 26 01:57:56.767790 2026] [:error] [pid 53791:tid 53811] [client 81.25.166.4:59944] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahSNpCCRhhNTD40Nf1VUmAAAAZI"]
[Tue May 26 01:57:58.780837 2026] [:error] [pid 62515:tid 62528] [client 81.25.166.4:59902] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahSNphig0_XsOwmnrv-TUwAAAMs"]
[Tue May 26 01:58:00.738566 2026] [:error] [pid 62427:tid 62469] [client 81.25.166.4:59636] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahSNqPMUa83fc4GDyBygawAAAUw"]
[Tue May 26 01:58:02.569932 2026] [:error] [pid 53791:tid 53817] [client 81.25.166.4:59080] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker.aspx"] [unique_id "ahSNqiCRhhNTD40Nf1VUmwAAAZg"]
[Tue May 26 01:58:04.720697 2026] [:error] [pid 62427:tid 62471] [client 81.25.166.4:64738] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahSNrPMUa83fc4GDyBygdwAAAU4"]
[Tue May 26 01:58:06.835806 2026] [:error] [pid 62428:tid 62499] [client 81.25.166.4:63283] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahSNrpNosGBa7mui3VScDwAAAI8"]
[Tue May 26 01:58:08.819792 2026] [:error] [pid 62722:tid 62745] [client 81.25.166.4:64358] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahSNsKM6ssnLWYf6CVByRAAAAFU"]
[Tue May 26 01:58:10.778489 2026] [:error] [pid 53791:tid 53807] [client 81.25.166.4:61954] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahSNsiCRhhNTD40Nf1VUpAAAAY4"]
[Tue May 26 01:58:12.775058 2026] [:error] [pid 62426:tid 62441] [client 81.25.166.4:60458] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahSNtEj3D3Mo8ANpTRBpUQAAAAs"]
[Tue May 26 01:58:15.793753 2026] [:error] [pid 62427:tid 62472] [client 81.25.166.4:64987] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahSNt_MUa83fc4GDyBygiQAAAU8"]
[Tue May 26 01:58:17.353021 2026] [:error] [pid 62428:tid 62507] [client 81.25.166.4:62482] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSNuZNosGBa7mui3VScGwAAAJc"]
[Tue May 26 01:58:22.866029 2026] [:error] [pid 62515:tid 62528] [client 81.25.166.4:60476] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSNvhig0_XsOwmnrv-TXwAAAMs"]
[Tue May 26 01:58:27.499331 2026] [:error] [pid 62515:tid 62529] [client 81.25.166.4:61429] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahSNwxig0_XsOwmnrv-TZAAAAMw"]
[Tue May 26 01:58:30.075223 2026] [:error] [pid 3698:tid 3713] [client 81.25.166.4:63712] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahSNxgtZBEwA4fyFLKMgBwAAAQ0"]
[Tue May 26 01:58:32.128547 2026] [:error] [pid 62428:tid 62492] [client 81.25.166.4:62154] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/we88%20slot.aspx"] [unique_id "ahSNyJNosGBa7mui3VScHwAAAIg"]
[Tue May 26 01:58:34.771641 2026] [:error] [pid 3698:tid 3711] [client 81.25.166.4:61056] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahSNygtZBEwA4fyFLKMgEQAAAQs"]
[Tue May 26 01:58:37.412049 2026] [:error] [pid 62515:tid 62531] [client 81.25.166.4:61108] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ahSNzRig0_XsOwmnrv-TagAAAM4"]
[Tue May 26 01:58:39.320786 2026] [:error] [pid 62426:tid 62444] [client 81.25.166.4:59122] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSNz0j3D3Mo8ANpTRBpggAAAA4"]
[Tue May 26 01:58:43.351269 2026] [:error] [pid 62426:tid 62437] [client 81.25.166.4:62290] [client 81.25.166.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSN00j3D3Mo8ANpTRBphAAAAAc"]
[Tue May 26 02:39:12.132875 2026] [:error] [pid 62428:tid 62494] [client 147.135.213.27:38568] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahSXUJNosGBa7mui3VSjiQAAAIo"]
[Tue May 26 02:39:13.725096 2026] [:error] [pid 62427:tid 62479] [client 147.135.213.27:57760] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahSXUfMUa83fc4GDyBylbAAAAVY"]
[Tue May 26 02:39:15.595251 2026] [:error] [pid 62426:tid 62442] [client 147.135.213.27:52336] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahSXU0j3D3Mo8ANpTRB0WQAAAAw"]
[Tue May 26 02:39:18.227730 2026] [:error] [pid 53791:tid 53802] [client 147.135.213.27:48706] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahSXViCRhhNTD40Nf1VavAAAAYk"]
[Tue May 26 02:39:20.297889 2026] [:error] [pid 62515:tid 62534] [client 147.135.213.27:52344] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahSXWBig0_XsOwmnrv-a2AAAANE"]
[Tue May 26 02:39:22.790250 2026] [:error] [pid 62428:tid 62490] [client 147.135.213.27:48722] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahSXWpNosGBa7mui3VSjkAAAAIY"]
[Tue May 26 02:39:33.890669 2026] [:error] [pid 62426:tid 62438] [client 147.135.213.27:57758] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahSXZUj3D3Mo8ANpTRB0pwAAAAg"]
[Tue May 26 02:39:35.890286 2026] [:error] [pid 62428:tid 62508] [client 147.135.213.27:57772] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahSXZ5NosGBa7mui3VSjkgAAAJg"]
[Tue May 26 02:39:38.160185 2026] [:error] [pid 3698:tid 3713] [client 147.135.213.27:57782] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSXagtZBEwA4fyFLKMl1AAAAQ0"]
[Tue May 26 02:39:41.907451 2026] [:error] [pid 62426:tid 62441] [client 147.135.213.27:57788] [client 147.135.213.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahSXbUj3D3Mo8ANpTRB05QAAAAs"]
[Tue May 26 03:50:16.148913 2026] [:error] [pid 20125:tid 20133] [client 217.182.136.43:50328] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ahSn-Nk9jeWERFDLJc5akwAAAMY"]
[Tue May 26 03:50:18.288800 2026] [:error] [pid 55988:tid 56015] [client 217.182.136.43:35110] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahSn-v3kVIz2sql52scmGwAAARg"]
[Tue May 26 03:50:20.626223 2026] [:error] [pid 55988:tid 56005] [client 217.182.136.43:35112] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahSn_P3kVIz2sql52scmHwAAAQ4"]
[Tue May 26 03:50:23.512118 2026] [:error] [pid 55988:tid 56010] [client 217.182.136.43:43518] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20osaka.aspx"] [unique_id "ahSn__3kVIz2sql52scmIwAAARM"]
[Tue May 26 03:50:25.514350 2026] [:error] [pid 55988:tid 56006] [client 217.182.136.43:51044] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20168.aspx"] [unique_id "ahSoAf3kVIz2sql52scmJgAAAQ8"]
[Tue May 26 03:50:28.079226 2026] [:error] [pid 20026:tid 20096] [client 217.182.136.43:51052] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20auto.aspx"] [unique_id "ahSoBDXIXIr-5BZ8nR7GvQAAAIQ"]
[Tue May 26 03:50:30.855442 2026] [:error] [pid 55988:tid 56011] [client 217.182.136.43:51056] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahSoBv3kVIz2sql52scmLQAAARQ"]
[Tue May 26 03:50:33.449050 2026] [:error] [pid 55988:tid 55992] [client 217.182.136.43:51058] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahSoCf3kVIz2sql52scmMwAAAQE"]
[Tue May 26 03:50:36.022071 2026] [:error] [pid 20025:tid 20084] [client 217.182.136.43:60462] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahSoDH7k8Vts-JPOkgWKfwAAAFM"]
[Tue May 26 03:50:38.231796 2026] [:error] [pid 20025:tid 20073] [client 217.182.136.43:60474] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahSoDn7k8Vts-JPOkgWKhwAAAEg"]
[Tue May 26 03:50:41.137219 2026] [:error] [pid 55988:tid 56015] [client 217.182.136.43:52774] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahSoEf3kVIz2sql52scmQwAAARg"]
[Tue May 26 03:50:44.061401 2026] [:error] [pid 55988:tid 56001] [client 217.182.136.43:60490] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahSoFP3kVIz2sql52scmRwAAAQo"]
[Tue May 26 03:50:46.319069 2026] [:error] [pid 20026:tid 20116] [client 217.182.136.43:46638] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahSoFjXIXIr-5BZ8nR7G1gAAAJg"]
[Tue May 26 03:50:49.099389 2026] [:error] [pid 20025:tid 20073] [client 217.182.136.43:48330] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahSoGX7k8Vts-JPOkgWKjwAAAEg"]
[Tue May 26 03:50:51.475983 2026] [:error] [pid 20024:tid 20038] [client 217.182.136.43:46640] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ahSoG1dk7QtxEB93Npf0qQAAAAA"]
[Tue May 26 03:50:54.030464 2026] [:error] [pid 20025:tid 20070] [client 217.182.136.43:46654] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ahSoHn7k8Vts-JPOkgWKkwAAAEU"]
[Tue May 26 03:50:56.126168 2026] [:error] [pid 55988:tid 56005] [client 217.182.136.43:40382] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ahSoIP3kVIz2sql52scmUQAAAQ4"]
[Tue May 26 03:50:58.269698 2026] [:error] [pid 20125:tid 20132] [client 217.182.136.43:40386] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahSoItk9jeWERFDLJc5apAAAAMU"]
[Tue May 26 03:51:00.451767 2026] [:error] [pid 20125:tid 20128] [client 217.182.136.43:40396] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ahSoJNk9jeWERFDLJc5apQAAAME"]
[Tue May 26 03:51:03.344949 2026] [:error] [pid 20125:tid 20151] [client 217.182.136.43:40840] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahSoJ9k9jeWERFDLJc5aqwAAANg"]
[Tue May 26 03:51:05.448992 2026] [:error] [pid 20025:tid 20075] [client 217.182.136.43:43288] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahSoKX7k8Vts-JPOkgWKnAAAAEo"]
[Tue May 26 03:51:07.777601 2026] [:error] [pid 20025:tid 20087] [client 217.182.136.43:43296] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahSoK37k8Vts-JPOkgWKnwAAAFY"]
[Tue May 26 03:51:10.545576 2026] [:error] [pid 55988:tid 56013] [client 217.182.136.43:50454] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahSoLv3kVIz2sql52scmWQAAARY"]
[Tue May 26 03:51:12.857635 2026] [:error] [pid 20125:tid 20144] [client 217.182.136.43:43302] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahSoMNk9jeWERFDLJc5avgAAANE"]
[Tue May 26 03:51:39.562448 2026] [:error] [pid 20026:tid 20108] [client 217.182.136.43:51462] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahSoSzXIXIr-5BZ8nR7HAAAAAJA"]
[Tue May 26 03:51:41.898648 2026] [:error] [pid 20125:tid 20142] [client 217.182.136.43:43598] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahSoTdk9jeWERFDLJc5a6wAAAM8"]
[Tue May 26 03:51:44.521563 2026] [:error] [pid 20125:tid 20140] [client 217.182.136.43:42520] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20slot.aspx"] [unique_id "ahSoUNk9jeWERFDLJc5a7gAAAM0"]
[Tue May 26 03:51:47.750562 2026] [:error] [pid 20026:tid 20105] [client 217.182.136.43:42530] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20soft.aspx"] [unique_id "ahSoUzXIXIr-5BZ8nR7HDgAAAI0"]
[Tue May 26 03:51:50.230348 2026] [:error] [pid 55988:tid 55991] [client 217.182.136.43:42546] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20th.aspx"] [unique_id "ahSoVv3kVIz2sql52scmfAAAAQA"]
[Tue May 26 03:51:52.944352 2026] [:error] [pid 55988:tid 55998] [client 217.182.136.43:42550] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20thailand.aspx"] [unique_id "ahSoWP3kVIz2sql52scmgQAAAQc"]
[Tue May 26 03:51:55.505338 2026] [:error] [pid 20026:tid 20095] [client 217.182.136.43:59118] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20wallet.aspx"] [unique_id "ahSoWzXIXIr-5BZ8nR7HFQAAAIM"]
[Tue May 26 03:51:58.486723 2026] [:error] [pid 55988:tid 55995] [client 217.182.136.43:59132] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahSoXv3kVIz2sql52scmigAAAQQ"]
[Tue May 26 03:52:00.922781 2026] [:error] [pid 55988:tid 56006] [client 217.182.136.43:59144] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgslot%20login.aspx"] [unique_id "ahSoYP3kVIz2sql52scmjwAAAQ8"]
[Tue May 26 03:52:04.271157 2026] [:error] [pid 20025:tid 20068] [client 217.182.136.43:53086] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahSoZH7k8Vts-JPOkgWKvAAAAEM"]
[Tue May 26 03:52:06.612459 2026] [:error] [pid 55988:tid 56006] [client 217.182.136.43:53102] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahSoZv3kVIz2sql52scmlAAAAQ8"]
[Tue May 26 03:52:09.161568 2026] [:error] [pid 55988:tid 56013] [client 217.182.136.43:53112] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahSoaf3kVIz2sql52scmmQAAARY"]
[Tue May 26 03:52:11.774336 2026] [:error] [pid 20125:tid 20135] [client 217.182.136.43:53124] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahSoa9k9jeWERFDLJc5bEwAAAMg"]
[Tue May 26 03:52:14.199035 2026] [:error] [pid 20026:tid 20106] [client 217.182.136.43:53134] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahSobjXIXIr-5BZ8nR7HIQAAAI4"]
[Tue May 26 03:52:16.572399 2026] [:error] [pid 20025:tid 20080] [client 217.182.136.43:53792] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahSocH7k8Vts-JPOkgWKxgAAAE8"]
[Tue May 26 03:52:19.393480 2026] [:error] [pid 55988:tid 56003] [client 217.182.136.43:53796] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahSoc_3kVIz2sql52scmpQAAAQw"]
[Tue May 26 03:52:21.541521 2026] [:error] [pid 55988:tid 56002] [client 217.182.136.43:53810] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahSodf3kVIz2sql52scmrwAAAQs"]
[Tue May 26 03:52:23.806691 2026] [:error] [pid 20125:tid 20150] [client 217.182.136.43:53822] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahSod9k9jeWERFDLJc5bHQAAANc"]
[Tue May 26 03:52:25.783673 2026] [:error] [pid 55988:tid 55996] [client 217.182.136.43:54968] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahSoef3kVIz2sql52scmuwAAAQU"]
[Tue May 26 03:52:28.315138 2026] [:error] [pid 20125:tid 20146] [client 217.182.136.43:54974] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahSofNk9jeWERFDLJc5bIgAAANM"]
[Tue May 26 03:52:30.363082 2026] [:error] [pid 20026:tid 20093] [client 217.182.136.43:54980] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahSofjXIXIr-5BZ8nR7HMwAAAIE"]
[Tue May 26 03:52:32.577403 2026] [:error] [pid 20026:tid 20112] [client 217.182.136.43:54994] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahSogDXIXIr-5BZ8nR7HOAAAAJQ"]
[Tue May 26 03:52:35.463821 2026] [:error] [pid 55988:tid 55993] [client 217.182.136.43:39476] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahSog_3kVIz2sql52scmyQAAAQI"]
[Tue May 26 03:53:01.828142 2026] [:error] [pid 55988:tid 55998] [client 217.182.136.43:39484] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahSonf3kVIz2sql52scnAwAAAQc"]
[Tue May 26 03:53:04.192812 2026] [:error] [pid 20026:tid 20110] [client 217.182.136.43:51762] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahSooDXIXIr-5BZ8nR7HTwAAAJI"]
[Tue May 26 03:53:06.241861 2026] [:error] [pid 20026:tid 20099] [client 217.182.136.43:41646] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahSoojXIXIr-5BZ8nR7HUgAAAIc"]
[Tue May 26 03:53:08.198424 2026] [:error] [pid 55988:tid 55993] [client 217.182.136.43:41660] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahSopP3kVIz2sql52scnBQAAAQI"]
[Tue May 26 03:53:10.358815 2026] [:error] [pid 20025:tid 20075] [client 217.182.136.43:41664] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20vip.aspx"] [unique_id "ahSopn7k8Vts-JPOkgWK1AAAAEo"]
[Tue May 26 03:53:12.598329 2026] [:error] [pid 55988:tid 55992] [client 217.182.136.43:41674] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahSoqP3kVIz2sql52scnCQAAAQE"]
[Tue May 26 03:53:15.120667 2026] [:error] [pid 55988:tid 56012] [client 217.182.136.43:58536] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahSoq_3kVIz2sql52scnDwAAARU"]
[Tue May 26 03:53:17.129349 2026] [:error] [pid 20026:tid 20097] [client 217.182.136.43:58550] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%201668.aspx"] [unique_id "ahSorTXIXIr-5BZ8nR7HYAAAAIU"]
[Tue May 26 03:53:19.337766 2026] [:error] [pid 20026:tid 20111] [client 217.182.136.43:58556] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahSorzXIXIr-5BZ8nR7HZQAAAJM"]
[Tue May 26 03:53:21.660148 2026] [:error] [pid 55988:tid 56013] [client 217.182.136.43:58568] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahSosf3kVIz2sql52scnEgAAARY"]
[Tue May 26 03:53:23.710629 2026] [:error] [pid 20026:tid 20098] [client 217.182.136.43:58576] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahSoszXIXIr-5BZ8nR7HaAAAAIY"]
[Tue May 26 03:53:25.826805 2026] [:error] [pid 20024:tid 20050] [client 217.182.136.43:35438] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahSotVdk7QtxEB93Npf06wAAAAw"]
[Tue May 26 03:53:28.027581 2026] [:error] [pid 20125:tid 20135] [client 217.182.136.43:35444] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufabet%20wallet.aspx"] [unique_id "ahSouNk9jeWERFDLJc5bVQAAAMg"]
[Tue May 26 03:53:30.682033 2026] [:error] [pid 20025:tid 20085] [client 217.182.136.43:35452] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/w69%20slot.aspx"] [unique_id "ahSoun7k8Vts-JPOkgWK3wAAAFQ"]
[Tue May 26 03:53:32.951341 2026] [:error] [pid 20125:tid 20128] [client 217.182.136.43:35456] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/wallet%20slot.aspx"] [unique_id "ahSovNk9jeWERFDLJc5bWAAAAME"]
[Tue May 26 03:53:35.598048 2026] [:error] [pid 55988:tid 56002] [client 217.182.136.43:41946] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/www%20ufabet%20com.aspx"] [unique_id "ahSov_3kVIz2sql52scnFwAAAQs"]
[Tue May 26 03:53:37.719669 2026] [:error] [pid 20125:tid 20136] [client 217.182.136.43:41954] [client 217.182.136.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/xo%20slot.aspx"] [unique_id "ahSowdk9jeWERFDLJc5bXQAAAMk"]
[Tue May 26 05:04:04.429178 2026] [:error] [pid 20026:tid 20103] [client 51.83.6.238:54390] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahS5RDXIXIr-5BZ8nR7XpwAAAIs"]
[Tue May 26 05:04:06.266948 2026] [:error] [pid 20026:tid 20101] [client 51.83.6.238:46060] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahS5RjXIXIr-5BZ8nR7XqAAAAIk"]
[Tue May 26 05:04:08.840305 2026] [:error] [pid 20125:tid 20127] [client 51.83.6.238:40312] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "ahS5SNk9jeWERFDLJc5wewAAAMA"]
[Tue May 26 05:04:10.776817 2026] [:error] [pid 55988:tid 56011] [client 51.83.6.238:46202] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "ahS5Sv3kVIz2sql52sdFoAAAARQ"]
[Tue May 26 05:04:12.814306 2026] [:error] [pid 20025:tid 20079] [client 51.83.6.238:46206] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahS5TH7k8Vts-JPOkgWY4gAAAE4"]
[Tue May 26 05:04:15.233736 2026] [:error] [pid 20025:tid 20082] [client 51.83.6.238:40646] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/galaxy%20slot.aspx"] [unique_id "ahS5T37k8Vts-JPOkgWY5gAAAFE"]
[Tue May 26 05:04:17.712544 2026] [:error] [pid 20026:tid 20100] [client 51.83.6.238:40658] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/kingkong%20joker.aspx"] [unique_id "ahS5UTXIXIr-5BZ8nR7XtwAAAIg"]
[Tue May 26 05:04:20.335706 2026] [:error] [pid 20025:tid 20083] [client 51.83.6.238:35588] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lava%20slot.aspx"] [unique_id "ahS5VH7k8Vts-JPOkgWY6AAAAFI"]
[Tue May 26 05:04:22.825589 2026] [:error] [pid 55988:tid 55998] [client 51.83.6.238:35592] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mega%20slot.aspx"] [unique_id "ahS5Vv3kVIz2sql52sdFvwAAAQc"]
[Tue May 26 05:04:25.443424 2026] [:error] [pid 55988:tid 56003] [client 51.83.6.238:35608] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/metal%20slot.aspx"] [unique_id "ahS5Wf3kVIz2sql52sdFzQAAAQw"]
[Tue May 26 05:04:28.064685 2026] [:error] [pid 20125:tid 20151] [client 51.83.6.238:35624] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20168.aspx"] [unique_id "ahS5XNk9jeWERFDLJc5wkQAAANg"]
[Tue May 26 05:04:30.570397 2026] [:error] [pid 55988:tid 56001] [client 51.83.6.238:47430] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20auto.aspx"] [unique_id "ahS5Xv3kVIz2sql52sdF4AAAAQo"]
[Tue May 26 05:04:33.059138 2026] [:error] [pid 20024:tid 20048] [client 51.83.6.238:47440] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20betflik.aspx"] [unique_id "ahS5YVdk7QtxEB93NpcAkwAAAAo"]
[Tue May 26 05:04:35.677308 2026] [:error] [pid 55988:tid 55996] [client 51.83.6.238:47456] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game%20slot.aspx"] [unique_id "ahS5Y_3kVIz2sql52sdF9QAAAQU"]
[Tue May 26 05:04:38.048895 2026] [:error] [pid 20125:tid 20132] [client 51.83.6.238:47472] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20game.aspx"] [unique_id "ahS5Ztk9jeWERFDLJc5wmAAAAMU"]
[Tue May 26 05:04:40.650909 2026] [:error] [pid 55988:tid 56015] [client 51.83.6.238:40714] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20joker%20auto.aspx"] [unique_id "ahS5aP3kVIz2sql52sdGBAAAARg"]
[Tue May 26 05:04:43.155205 2026] [:error] [pid 20125:tid 20148] [client 51.83.6.238:40718] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20game.aspx"] [unique_id "ahS5a9k9jeWERFDLJc5wpAAAANU"]
[Tue May 26 05:04:45.663008 2026] [:error] [pid 20026:tid 20096] [client 51.83.6.238:40726] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vegas.aspx"] [unique_id "ahS5bTXIXIr-5BZ8nR7X3AAAAIQ"]
[Tue May 26 05:04:48.293730 2026] [:error] [pid 55988:tid 56010] [client 51.83.6.238:40730] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20vip.aspx"] [unique_id "ahS5cP3kVIz2sql52sdGGgAAARM"]
[Tue May 26 05:04:50.784003 2026] [:error] [pid 20125:tid 20139] [client 51.83.6.238:42828] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot%20wallet.aspx"] [unique_id "ahS5ctk9jeWERFDLJc5wwgAAAMw"]
[Tue May 26 05:04:53.262448 2026] [:error] [pid 55988:tid 55992] [client 51.83.6.238:42836] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot168.aspx"] [unique_id "ahS5df3kVIz2sql52sdGLQAAAQE"]
[Tue May 26 05:04:55.908755 2026] [:error] [pid 20026:tid 20115] [client 51.83.6.238:42846] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20slot99.aspx"] [unique_id "ahS5dzXIXIr-5BZ8nR7YAwAAAJc"]
[Tue May 26 05:04:57.709923 2026] [:error] [pid 20125:tid 20128] [client 51.83.6.238:56852] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahS5edk9jeWERFDLJc5wzQAAAME"]
[Tue May 26 05:05:00.287209 2026] [:error] [pid 20025:tid 20086] [client 51.83.6.238:49426] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pg%20world.aspx"] [unique_id "ahS5fH7k8Vts-JPOkgWZGAAAAFU"]
[Tue May 26 05:05:24.910484 2026] [:error] [pid 20125:tid 20148] [client 51.83.6.238:33976] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahS5lNk9jeWERFDLJc5xBAAAANU"]
[Tue May 26 05:05:26.728702 2026] [:error] [pid 20125:tid 20142] [client 51.83.6.238:40904] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahS5ltk9jeWERFDLJc5xBQAAAM8"]
[Tue May 26 05:05:28.711053 2026] [:error] [pid 20125:tid 20146] [client 51.83.6.238:33244] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20free.aspx"] [unique_id "ahS5mNk9jeWERFDLJc5xDAAAANM"]
[Tue May 26 05:05:30.574335 2026] [:error] [pid 55988:tid 55994] [client 51.83.6.238:48706] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahS5mv3kVIz2sql52sdGfwAAAQM"]
[Tue May 26 05:05:33.160006 2026] [:error] [pid 55988:tid 56011] [client 51.83.6.238:39892] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahS5nf3kVIz2sql52sdGhwAAARQ"]
[Tue May 26 05:05:35.093739 2026] [:error] [pid 55988:tid 56006] [client 51.83.6.238:48714] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20online.aspx"] [unique_id "ahS5n_3kVIz2sql52sdGigAAAQ8"]
[Tue May 26 05:05:36.991740 2026] [:error] [pid 55988:tid 56004] [client 51.83.6.238:48722] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20soft.aspx"] [unique_id "ahS5oP3kVIz2sql52sdGkgAAAQ0"]
[Tue May 26 05:05:39.435936 2026] [:error] [pid 20125:tid 20137] [client 51.83.6.238:39898] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20vip.aspx"] [unique_id "ahS5o9k9jeWERFDLJc5xGQAAAMo"]
[Tue May 26 05:05:41.394384 2026] [:error] [pid 55988:tid 55997] [client 51.83.6.238:33956] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "ahS5pf3kVIz2sql52sdGpQAAAQY"]
[Tue May 26 05:05:43.423482 2026] [:error] [pid 55988:tid 55994] [client 51.83.6.238:33964] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahS5p_3kVIz2sql52sdGrAAAAQM"]
[Tue May 26 05:05:45.297076 2026] [:error] [pid 20125:tid 20136] [client 51.83.6.238:33980] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahS5qdk9jeWERFDLJc5xHwAAAMk"]
[Tue May 26 05:05:47.871529 2026] [:error] [pid 20025:tid 20071] [client 51.83.6.238:32996] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahS5q37k8Vts-JPOkgWZYgAAAEY"]
[Tue May 26 05:05:49.802372 2026] [:error] [pid 20125:tid 20150] [client 51.83.6.238:39248] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahS5rdk9jeWERFDLJc5xLgAAANc"]
[Tue May 26 05:05:51.794717 2026] [:error] [pid 20125:tid 20130] [client 51.83.6.238:39262] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahS5r9k9jeWERFDLJc5xLwAAAMM"]
[Tue May 26 05:05:54.362249 2026] [:error] [pid 20025:tid 20068] [client 51.83.6.238:40720] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahS5sn7k8Vts-JPOkgWZaAAAAEM"]
[Tue May 26 05:05:56.314381 2026] [:error] [pid 20125:tid 20138] [client 51.83.6.238:39264] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahS5tNk9jeWERFDLJc5xMgAAAMs"]
[Tue May 26 05:05:58.890559 2026] [:error] [pid 20024:tid 20050] [client 51.83.6.238:40734] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spg%20slot.aspx"] [unique_id "ahS5tldk7QtxEB93NpcA8QAAAAw"]
[Tue May 26 05:06:00.937000 2026] [:error] [pid 20026:tid 20108] [client 51.83.6.238:48444] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahS5uDXIXIr-5BZ8nR7YcgAAAJA"]
[Tue May 26 05:06:03.504233 2026] [:error] [pid 20125:tid 20128] [client 51.83.6.238:36158] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahS5u9k9jeWERFDLJc5xOgAAAME"]
[Tue May 26 05:06:06.006912 2026] [:error] [pid 20026:tid 20115] [client 51.83.6.238:36168] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet%20777.aspx"] [unique_id "ahS5vjXIXIr-5BZ8nR7YgwAAAJc"]
[Tue May 26 05:06:08.495127 2026] [:error] [pid 20025:tid 20081] [client 51.83.6.238:36176] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahS5wH7k8Vts-JPOkgWZcgAAAFA"]
[Tue May 26 05:06:11.004801 2026] [:error] [pid 20026:tid 20094] [client 51.83.6.238:57066] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%207777.aspx"] [unique_id "ahS5wzXIXIr-5BZ8nR7YnwAAAII"]
[Tue May 26 05:06:13.631871 2026] [:error] [pid 20025:tid 20079] [client 51.83.6.238:57070] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "ahS5xX7k8Vts-JPOkgWZdgAAAE4"]
[Tue May 26 05:06:16.110853 2026] [:error] [pid 20125:tid 20130] [client 51.83.6.238:57078] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20auto.aspx"] [unique_id "ahS5yNk9jeWERFDLJc5xSgAAAMM"]
[Tue May 26 05:06:18.594356 2026] [:error] [pid 55988:tid 55998] [client 51.83.6.238:57090] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20net.aspx"] [unique_id "ahS5yv3kVIz2sql52sdG9AAAAQc"]
[Tue May 26 05:06:21.192088 2026] [:error] [pid 55988:tid 55996] [client 51.83.6.238:35700] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "ahS5zf3kVIz2sql52sdG-QAAAQU"]
[Tue May 26 05:06:43.059518 2026] [:error] [pid 55988:tid 56010] [client 51.83.6.238:57900] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20game%20666.aspx"] [unique_id "ahS54_3kVIz2sql52sdHLwAAARM"]
[Tue May 26 05:06:45.024026 2026] [:error] [pid 20024:tid 20054] [client 51.83.6.238:60854] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20wallet.aspx"] [unique_id "ahS55Vdk7QtxEB93NpcBAQAAABA"]
[Tue May 26 05:06:47.031880 2026] [:error] [pid 20024:tid 20057] [client 51.83.6.238:60860] [client 51.83.6.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahS551dk7QtxEB93NpcBAwAAABM"]
[Tue May 26 05:27:55.635016 2026] [:error] [pid 20025:tid 20075] [client 39.154.7.96:16211] [client 39.154.7.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||switchcreative.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahS-237k8Vts-JPOkgWd7wAAAEo"], referer: http://switchcreative.net/
[Tue May 26 06:14:28.766512 2026] [:error] [pid 20026:tid 20093] [client 43.130.74.193:59402] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahTJxDXIXIr-5BZ8nR7pXQAAAIE"]
[Tue May 26 07:04:48.752363 2026] [:error] [pid 55988:tid 56003] [client 45.92.1.243:61245] [client 45.92.1.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.1.243, incrementing ddos counter"] [hostname "switchcreative.net"] [uri "/xmlrpc.php"] [unique_id "ahTVkP3kVIz2sql52sd7QQAAAQw"]
[Tue May 26 07:04:48.763140 2026] [proxy_fcgi:error] [pid 55988:tid 56003] [client 45.92.1.243:61245] AH01071: Got error 'Primary script unknown'
[Tue May 26 07:04:51.528314 2026] [:error] [pid 55988:tid 56004] [client 45.92.1.243:61245] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ahTVk_3kVIz2sql52sd7TgAAAQ0"]
[Tue May 26 07:04:52.010630 2026] [:error] [pid 20024:tid 20049] [client 45.92.1.243:60756] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ahTVlFdk7QtxEB93NpcYPQAAAAs"]
[Tue May 26 07:04:52.527440 2026] [:error] [pid 20125:tid 20143] [client 45.92.1.243:54813] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "ahTVlNk9jeWERFDLJc6YUgAAANA"]
[Tue May 26 07:04:53.008878 2026] [:error] [pid 20024:tid 20044] [client 45.92.1.243:63058] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "ahTVlVdk7QtxEB93NpcYQgAAAAY"]
[Tue May 26 07:04:53.500613 2026] [:error] [pid 20024:tid 20057] [client 45.92.1.243:49855] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ahTVlVdk7QtxEB93NpcYRAAAABM"]
[Tue May 26 07:04:53.979079 2026] [:error] [pid 20025:tid 20077] [client 45.92.1.243:59860] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ahTVlX7k8Vts-JPOkgWzrwAAAEw"]
[Tue May 26 07:04:54.463526 2026] [:error] [pid 20025:tid 20087] [client 45.92.1.243:64946] [client 45.92.1.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "ahTVln7k8Vts-JPOkgWzsAAAAFY"]
[Tue May 26 07:18:45.227020 2026] [:error] [pid 20125:tid 20146] [client 43.140.37.167:51876] [client 43.140.37.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahTY1dk9jeWERFDLJc6e7wAAANM"]
[Tue May 26 07:22:00.028565 2026] [:error] [pid 20025:tid 20075] [client 43.156.202.34:42774] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahTZmH7k8Vts-JPOkgW4DwAAAEo"]
[Tue May 26 08:15:39.151031 2026] [:error] [pid 55988:tid 55999] [client 138.16.225.131:42774] [client 138.16.225.131] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/ogg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahTmK_3kVIz2sql52seXxwAAAQg"]
[Tue May 26 08:15:39.542551 2026] [:error] [pid 55988:tid 56008] [client 138.16.225.131:42774] [client 138.16.225.131] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||switchcreative.net|F|2"] [data "TX:0=application/ogg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahTmK_3kVIz2sql52seXzAAAARE"]
[Tue May 26 08:35:00.112398 2026] [:error] [pid 20024:tid 20048] [client 54.37.252.231:52266] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amb%20superslot.aspx"] [unique_id "ahTqtFdk7QtxEB93NpcoEQAAAAo"]
[Tue May 26 08:35:02.941729 2026] [:error] [pid 20026:tid 20106] [client 54.37.252.231:44118] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/apollo%20slot%20pg.aspx"] [unique_id "ahTqtjXIXIr-5BZ8nR4OfwAAAI4"]
[Tue May 26 08:35:05.667386 2026] [:error] [pid 55988:tid 55991] [client 54.37.252.231:55434] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20casino.aspx"] [unique_id "ahTquf3kVIz2sql52seecQAAAQA"]
[Tue May 26 08:35:08.452014 2026] [:error] [pid 20025:tid 20066] [client 54.37.252.231:55450] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20co.aspx"] [unique_id "ahTqvH7k8Vts-JPOkgXaOgAAAEE"]
[Tue May 26 08:35:11.298314 2026] [:error] [pid 55988:tid 56001] [client 54.37.252.231:55456] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20original.aspx"] [unique_id "ahTqv_3kVIz2sql52seegQAAAQo"]
[Tue May 26 08:35:13.854627 2026] [:error] [pid 55988:tid 56005] [client 54.37.252.231:55464] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20slot.aspx"] [unique_id "ahTqwf3kVIz2sql52seeiAAAAQ4"]
[Tue May 26 08:35:16.769738 2026] [:error] [pid 20026:tid 20111] [client 54.37.252.231:49340] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflik%20thailand.aspx"] [unique_id "ahTqxDXIXIr-5BZ8nR4OlAAAAJM"]
[Tue May 26 08:35:19.534284 2026] [:error] [pid 20125:tid 20143] [client 54.37.252.231:49348] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20auto.aspx"] [unique_id "ahTqx9k9jeWERFDLJc6yIAAAANA"]
[Tue May 26 08:35:22.398758 2026] [:error] [pid 20026:tid 20110] [client 54.37.252.231:49358] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20casino.aspx"] [unique_id "ahTqyjXIXIr-5BZ8nR4OmQAAAJI"]
[Tue May 26 08:35:24.983371 2026] [:error] [pid 20026:tid 20107] [client 54.37.252.231:56020] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20co.aspx"] [unique_id "ahTqzDXIXIr-5BZ8nR4OmgAAAI8"]
[Tue May 26 08:35:27.493898 2026] [:error] [pid 55988:tid 56009] [client 54.37.252.231:56024] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20slot.aspx"] [unique_id "ahTqz_3kVIz2sql52seesAAAARI"]
[Tue May 26 08:35:30.279651 2026] [:error] [pid 20024:tid 20062] [client 54.37.252.231:56034] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20thailand.aspx"] [unique_id "ahTq0ldk7QtxEB93NpcoLgAAABg"]
[Tue May 26 08:35:32.318798 2026] [:error] [pid 55988:tid 55996] [client 54.37.252.231:59044] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahTq1P3kVIz2sql52seevwAAAQU"]
[Tue May 26 08:35:34.879026 2026] [:error] [pid 20026:tid 20112] [client 54.37.252.231:41908] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/betflix%20wallet.aspx"] [unique_id "ahTq1jXIXIr-5BZ8nR4OnwAAAJQ"]
[Tue May 26 08:35:37.424585 2026] [:error] [pid 20025:tid 20071] [client 54.37.252.231:41910] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflik.aspx"] [unique_id "ahTq2X7k8Vts-JPOkgXaXQAAAEY"]
[Tue May 26 08:35:39.546007 2026] [:error] [pid 55988:tid 56003] [client 54.37.252.231:52252] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahTq2_3kVIz2sql52seeywAAAQw"]
[Tue May 26 08:35:42.496214 2026] [:error] [pid 20026:tid 20106] [client 54.37.252.231:41924] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20betflix.aspx"] [unique_id "ahTq3jXIXIr-5BZ8nR4OoQAAAI4"]
[Tue May 26 08:35:45.453002 2026] [:error] [pid 20025:tid 20088] [client 54.37.252.231:38658] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/casino%20wallet.aspx"] [unique_id "ahTq4X7k8Vts-JPOkgXaZwAAAFc"]
[Tue May 26 08:35:47.589526 2026] [:error] [pid 20125:tid 20137] [client 54.37.252.231:40788] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahTq49k9jeWERFDLJc6yPQAAAMo"]
[Tue May 26 08:35:50.580531 2026] [:error] [pid 55988:tid 56008] [client 54.37.252.231:38666] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/demon%20slot%20game.aspx"] [unique_id "ahTq5v3kVIz2sql52see4QAAARE"]
[Tue May 26 08:35:52.579536 2026] [:error] [pid 20026:tid 20108] [client 54.37.252.231:40798] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahTq6DXIXIr-5BZ8nR4OqAAAAJA"]
[Tue May 26 08:35:55.551925 2026] [:error] [pid 55988:tid 56001] [client 54.37.252.231:45194] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dg%20casino.aspx"] [unique_id "ahTq6_3kVIz2sql52see7QAAAQo"]
[Tue May 26 08:36:19.739383 2026] [:error] [pid 20024:tid 20050] [client 54.37.252.231:45204] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/pgzeed%20gold.aspx"] [unique_id "ahTrA1dk7QtxEB93NpcoTgAAAAw"]
[Tue May 26 08:36:22.506052 2026] [:error] [pid 20125:tid 20148] [client 54.37.252.231:51398] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahTrBtk9jeWERFDLJc6yaAAAANU"]
[Tue May 26 08:36:25.149398 2026] [:error] [pid 20025:tid 20074] [client 54.37.252.231:48522] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahTrCX7k8Vts-JPOkgXakQAAAEk"]
[Tue May 26 08:36:27.895380 2026] [:error] [pid 20025:tid 20081] [client 54.37.252.231:48534] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahTrC37k8Vts-JPOkgXamAAAAFA"]
[Tue May 26 08:36:30.733695 2026] [:error] [pid 20025:tid 20084] [client 54.37.252.231:48538] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahTrDn7k8Vts-JPOkgXaogAAAFM"]
[Tue May 26 08:36:33.715420 2026] [:error] [pid 55988:tid 56002] [client 54.37.252.231:48554] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahTrEf3kVIz2sql52sefHwAAAQs"]
[Tue May 26 08:36:36.375521 2026] [:error] [pid 20025:tid 20085] [client 54.37.252.231:54196] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahTrFH7k8Vts-JPOkgXatwAAAFQ"]
[Tue May 26 08:36:39.065258 2026] [:error] [pid 20026:tid 20094] [client 54.37.252.231:54198] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahTrFzXIXIr-5BZ8nR4OyQAAAII"]
[Tue May 26 08:36:41.687013 2026] [:error] [pid 55988:tid 56002] [client 54.37.252.231:54204] [client 54.37.252.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahTrGf3kVIz2sql52sefKgAAAQs"]
[Tue May 26 12:42:58.846543 2026] [:error] [pid 20125:tid 20137] [client 49.51.72.236:50936] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahUk0tk9jeWERFDLJc7zDQAAAMo"]
[Tue May 26 13:14:17.441450 2026] [:error] [pid 39336:tid 39348] [client 192.144.148.122:53596] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahUsKdwmp9MmyaRNgiAZ4wAAAUk"]
[Tue May 26 13:52:40.935867 2026] [:error] [pid 20024:tid 20060] [client 101.32.49.171:36054] [client 101.32.49.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.switchcreative.net"] [uri "/"] [unique_id "ahU1KFdk7QtxEB93Npdh0AAAABY"]
[Tue May 26 17:05:07.922626 2026] [:error] [pid 20025:tid 20089] [client 34.11.17.55:56567] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahViQ37k8Vts-JPOkgXPhgAAAFg"]
[Tue May 26 17:05:08.350335 2026] [:error] [pid 39336:tid 39359] [client 34.11.17.55:57408] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRNwmp9MmyaRNgiBzdQAAAVQ"]
[Tue May 26 18:34:35.811686 2026] [proxy_fcgi:error] [pid 43701:tid 43719] [client 213.202.253.4:58641] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:34:41.280953 2026] [proxy_fcgi:error] [pid 43701:tid 43706] [client 213.202.253.4:53821] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:12.085156 2026] [proxy_fcgi:error] [pid 33977:tid 34000] [client 213.202.253.4:62381] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:18.249216 2026] [proxy_fcgi:error] [pid 43701:tid 43717] [client 213.202.253.4:59236] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:25.636765 2026] [proxy_fcgi:error] [pid 33886:tid 33894] [client 213.202.253.4:65306] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:31.983874 2026] [proxy_fcgi:error] [pid 33977:tid 33985] [client 213.202.253.4:63957] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:38.676970 2026] [proxy_fcgi:error] [pid 33888:tid 33970] [client 213.202.253.4:51936] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Tue May 26 18:35:45.015898 2026] [:error] [pid 36497:tid 36510] [client 213.202.253.4:61101] [client 213.202.253.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/gdftps.php"] [unique_id "ahV3gbjKQWM1gBmBY4ig0gAAAMA"], referer: www.google.com
[Tue May 26 18:40:20.750740 2026] [:error] [pid 43701:tid 43724] [client 147.135.215.173:49488] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahV4lIWtVI_UGrhtwKAwSwAAAVU"]
[Tue May 26 18:40:22.731016 2026] [:error] [pid 33887:tid 33926] [client 147.135.215.173:36122] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahV4ltCOI_FV7meOxGcHmgAAAIc"]
[Tue May 26 18:40:24.630841 2026] [:error] [pid 33886:tid 33899] [client 147.135.215.173:36126] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahV4mLBYzgp5rPVdHcV1GwAAAEg"]
[Tue May 26 18:40:26.537937 2026] [:error] [pid 43701:tid 43703] [client 147.135.215.173:36130] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "ahV4moWtVI_UGrhtwKAwZAAAAUA"]
[Tue May 26 18:40:28.416757 2026] [:error] [pid 33977:tid 33983] [client 147.135.215.173:36132] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/slot1234%20pg.aspx"] [unique_id "ahV4nO9cnSDNAU9sYPigEQAAAAM"]
[Tue May 26 18:40:30.463055 2026] [:error] [pid 33888:tid 33959] [client 147.135.215.173:36142] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahV4njqzTeoxiinZsGHSMAAAAQ0"]
[Tue May 26 18:40:32.326750 2026] [:error] [pid 33977:tid 33984] [client 147.135.215.173:42962] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/ufabet%20100.aspx"] [unique_id "ahV4oO9cnSDNAU9sYPigGAAAAAQ"]
[Tue May 26 18:40:34.360088 2026] [:error] [pid 36497:tid 36511] [client 147.135.215.173:42964] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yakuza%20slot.aspx"] [unique_id "ahV4orjKQWM1gBmBY4iibQAAAME"]
[Tue May 26 18:40:37.614101 2026] [:error] [pid 33888:tid 33963] [client 147.135.215.173:42976] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahV4pTqzTeoxiinZsGHSOgAAARE"]
[Tue May 26 18:40:41.335653 2026] [:error] [pid 33886:tid 33912] [client 147.135.215.173:40172] [client 147.135.215.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/robots.txt"] [unique_id "ahV4qbBYzgp5rPVdHcV1MAAAAFU"]
[Tue May 26 19:01:34.255407 2026] [:error] [pid 33977:tid 33993] [client 49.51.180.2:57490] [client 49.51.180.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||switchcreative.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "switchcreative.net"] [uri "/"] [unique_id "ahV9ju9cnSDNAU9sYPipiwAAAA0"]
[Tue May 26 20:35:43.490405 2026] [proxy_fcgi:error] [pid 33977:tid 33982] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:43.801312 2026] [proxy_fcgi:error] [pid 33977:tid 34001] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:44.112660 2026] [proxy_fcgi:error] [pid 33977:tid 33983] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:44.423753 2026] [proxy_fcgi:error] [pid 33977:tid 33992] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:44.735170 2026] [proxy_fcgi:error] [pid 33977:tid 33980] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:45.046331 2026] [proxy_fcgi:error] [pid 33977:tid 33998] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:45.357558 2026] [proxy_fcgi:error] [pid 33977:tid 33996] [client 20.195.182.1:41505] AH01071: Got error 'Primary script unknown'
[Tue May 26 20:35:45.665672 2026] [:error] [pid 33977:tid 34004] [client 20.195.182.1:41505] [client 20.195.182.1] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "switchcreative.net"] [uri "/wp-config.php"] [unique_id "ahWToe9cnSDNAU9sYPjZAgAAABg"]
[Tue May 26 21:09:57.116022 2026] [:error] [pid 36497:tid 36533] [client 147.135.213.153:34120] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/pp%20slot.aspx"] [unique_id "ahWbpbjKQWM1gBmBY4gJaAAAANc"]
[Tue May 26 21:09:59.203484 2026] [:error] [pid 43701:tid 43724] [client 147.135.213.153:37814] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches666%20pg.aspx"] [unique_id "ahWbp4WtVI_UGrhtwKDMxQAAAVU"]
[Tue May 26 21:10:01.193326 2026] [:error] [pid 36497:tid 36534] [client 147.135.213.153:37816] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches777%20pg.aspx"] [unique_id "ahWbqbjKQWM1gBmBY4gJcQAAANg"]
[Tue May 26 21:10:03.350713 2026] [:error] [pid 36497:tid 36523] [client 147.135.213.153:37822] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/riches888%20pg.aspx"] [unique_id "ahWbq7jKQWM1gBmBY4gJdQAAAM0"]
[Tue May 26 21:10:05.415127 2026] [:error] [pid 43701:tid 43725] [client 147.135.213.153:37830] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/royal%20slot.aspx"] [unique_id "ahWbrYWtVI_UGrhtwKDM1QAAAVY"]
[Tue May 26 21:10:07.549497 2026] [:error] [pid 33888:tid 33963] [client 147.135.213.153:37838] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20auto.aspx"] [unique_id "ahWbrzqzTeoxiinZsGEO3AAAARE"]
[Tue May 26 21:10:09.671128 2026] [:error] [pid 33888:tid 33957] [client 147.135.213.153:49642] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/sbobet%20ca.aspx"] [unique_id "ahWbsTqzTeoxiinZsGEO3gAAAQs"]
[Tue May 26 21:10:11.816835 2026] [:error] [pid 43701:tid 43712] [client 147.135.213.153:49644] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20777.aspx"] [unique_id "ahWbs4WtVI_UGrhtwKDM8wAAAUk"]
[Tue May 26 21:10:13.698264 2026] [:error] [pid 33886:tid 33906] [client 147.135.213.153:49650] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20888.aspx"] [unique_id "ahWbtbBYzgp5rPVdHcWlOgAAAE8"]
[Tue May 26 21:10:15.589755 2026] [:error] [pid 33887:tid 33940] [client 147.135.213.153:49666] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%2099.aspx"] [unique_id "ahWbt9COI_FV7meOxGc8lQAAAJU"]
[Tue May 26 21:10:17.663080 2026] [:error] [pid 43701:tid 43707] [client 147.135.213.153:49682] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20auto.aspx"] [unique_id "ahWbuYWtVI_UGrhtwKDNCQAAAUQ"]
[Tue May 26 21:10:20.000511 2026] [:error] [pid 33888:tid 33965] [client 147.135.213.153:55440] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20demo.aspx"] [unique_id "ahWbuzqzTeoxiinZsGEO6gAAARM"]
[Tue May 26 21:10:21.965000 2026] [:error] [pid 43701:tid 43717] [client 147.135.213.153:55442] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20joker.aspx"] [unique_id "ahWbvYWtVI_UGrhtwKDNHQAAAU4"]
[Tue May 26 21:10:24.417944 2026] [:error] [pid 43701:tid 43710] [client 147.135.213.153:55448] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20super%20wallet.aspx"] [unique_id "ahWbwIWtVI_UGrhtwKDNLAAAAUc"]
[Tue May 26 21:10:26.378339 2026] [:error] [pid 36497:tid 36531] [client 147.135.213.153:55460] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20true%20wallet.aspx"] [unique_id "ahWbwrjKQWM1gBmBY4gJlAAAANU"]
[Tue May 26 21:10:28.431816 2026] [:error] [pid 33888:tid 33964] [client 147.135.213.153:48192] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "ahWbxDqzTeoxiinZsGEO8QAAARI"]
[Tue May 26 21:10:30.445639 2026] [:error] [pid 33887:tid 33934] [client 147.135.213.153:48204] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slot%20wallet.aspx"] [unique_id "ahWbxtCOI_FV7meOxGc8nAAAAI8"]
[Tue May 26 21:10:32.423539 2026] [:error] [pid 43701:tid 43709] [client 147.135.213.153:48206] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/slotxo%20wallet.aspx"] [unique_id "ahWbyIWtVI_UGrhtwKDNNAAAAUY"]
[Tue May 26 21:10:34.802635 2026] [:error] [pid 43701:tid 43708] [client 147.135.213.153:48214] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/spx%20slot.aspx"] [unique_id "ahWbyoWtVI_UGrhtwKDNPAAAAUU"]
[Tue May 26 21:10:37.002023 2026] [:error] [pid 33977:tid 33989] [client 147.135.213.153:48230] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20pg%201688.aspx"] [unique_id "ahWbze9cnSDNAU9sYPjwsQAAAAk"]
[Tue May 26 21:10:39.178899 2026] [:error] [pid 36497:tid 36529] [client 147.135.213.153:44308] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/super%20slot.aspx"] [unique_id "ahWbz7jKQWM1gBmBY4gJpwAAANM"]
[Tue May 26 21:10:41.097556 2026] [:error] [pid 36497:tid 36522] [client 147.135.213.153:44318] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "ahWb0bjKQWM1gBmBY4gJ1wAAAMw"]
[Tue May 26 21:10:43.172527 2026] [:error] [pid 43701:tid 43706] [client 147.135.213.153:44320] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20vip.aspx"] [unique_id "ahWb04WtVI_UGrhtwKDNSgAAAUM"]
[Tue May 26 21:10:45.300224 2026] [:error] [pid 36497:tid 36516] [client 147.135.213.153:44324] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "ahWb1bjKQWM1gBmBY4gJ4gAAAMY"]
[Tue May 26 21:10:47.339848 2026] [:error] [pid 33977:tid 34000] [client 147.135.213.153:44334] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot%20wallet.aspx"] [unique_id "ahWb1-9cnSDNAU9sYPjwwgAAABQ"]
[Tue May 26 21:10:49.689102 2026] [:error] [pid 36497:tid 36523] [client 147.135.213.153:42584] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/superslot168%20wallet.aspx"] [unique_id "ahWb2bjKQWM1gBmBY4gJ5wAAAM0"]
[Tue May 26 21:10:51.794303 2026] [:error] [pid 33887:tid 33940] [client 147.135.213.153:42600] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20sa.aspx"] [unique_id "ahWb29COI_FV7meOxGc8sAAAAJU"]
[Tue May 26 21:10:53.934567 2026] [:error] [pid 36497:tid 36522] [client 147.135.213.153:42614] [client 147.135.213.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.switchcreative.net"] [uri "/ufa%20slot.aspx"] [unique_id "ahWb3bjKQWM1gBmBY4gJ8QAAAMw"]
[Tue May 26 22:14:58.790710 2026] [proxy_fcgi:error] [pid 43701:tid 43722] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:14:58.989931 2026] [proxy_fcgi:error] [pid 43701:tid 43709] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:14:59.220557 2026] [proxy_fcgi:error] [pid 43701:tid 43718] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:14:59.412945 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:14:59.876271 2026] [proxy_fcgi:error] [pid 43701:tid 43720] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:15:00.266191 2026] [proxy_fcgi:error] [pid 43701:tid 43706] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:15:00.460461 2026] [proxy_fcgi:error] [pid 43701:tid 43716] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:15:00.730533 2026] [proxy_fcgi:error] [pid 43701:tid 43721] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:15:01.133669 2026] [proxy_fcgi:error] [pid 43701:tid 43715] [client 130.131.224.225:53875] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:15:01.324593 2026] [:error] [pid 43701:tid 43720] [client 130.131.224.225:53875] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ahWq5YWtVI_UGrhtwKAKogAAAVE"]
[Tue May 26 22:15:02.608824 2026] [:error] [pid 33887:tid 33923] [client 130.131.224.225:19873] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ahWq5tCOI_FV7meOxGdSPAAAAIQ"]
[Tue May 26 22:15:03.227831 2026] [:error] [pid 36497:tid 36529] [client 130.131.224.225:35588] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ahWq57jKQWM1gBmBY4g6GwAAANM"]
[Tue May 26 22:15:04.219476 2026] [:error] [pid 36497:tid 36518] [client 130.131.224.225:63711] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aboutc.php"] [unique_id "ahWq6LjKQWM1gBmBY4g6IQAAAMg"]
[Tue May 26 22:15:05.112871 2026] [:error] [pid 43701:tid 43709] [client 130.131.224.225:61072] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahWq6YWtVI_UGrhtwKAKwAAAAUY"]
[Tue May 26 22:15:06.200348 2026] [:error] [pid 33887:tid 33935] [client 130.131.224.225:24745] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahWq6tCOI_FV7meOxGdSQQAAAJA"]
[Tue May 26 22:15:07.444997 2026] [:error] [pid 43701:tid 43709] [client 130.131.224.225:58561] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahWq64WtVI_UGrhtwKAK0AAAAUY"]
[Tue May 26 22:15:08.897303 2026] [:error] [pid 33977:tid 33989] [client 130.131.224.225:26500] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-load.php"] [unique_id "ahWq7O9cnSDNAU9sYPgRVgAAAAk"]
[Tue May 26 22:15:09.613174 2026] [:error] [pid 33977:tid 34004] [client 130.131.224.225:34948] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahWq7e9cnSDNAU9sYPgRWQAAABg"]
[Tue May 26 22:15:10.973616 2026] [:error] [pid 43701:tid 43703] [client 130.131.224.225:34965] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahWq7oWtVI_UGrhtwKAK7AAAAUA"]
[Tue May 26 22:15:11.708019 2026] [:error] [pid 43701:tid 43715] [client 130.131.224.225:47960] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahWq74WtVI_UGrhtwKAK9QAAAUw"]
[Tue May 26 22:15:12.640423 2026] [:error] [pid 36497:tid 36515] [client 130.131.224.225:34424] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aevly.php"] [unique_id "ahWq8LjKQWM1gBmBY4g6XgAAAMU"]
[Tue May 26 22:15:14.352581 2026] [:error] [pid 33977:tid 33996] [client 130.131.224.225:34423] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahWq8u9cnSDNAU9sYPgRYQAAABA"]
[Tue May 26 22:15:16.063638 2026] [:error] [pid 36497:tid 36534] [client 130.131.224.225:63720] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahWq9LjKQWM1gBmBY4g6fQAAANg"]
[Tue May 26 22:15:17.402341 2026] [:error] [pid 33977:tid 33993] [client 130.131.224.225:19881] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahWq9e9cnSDNAU9sYPgRaQAAAA0"]
[Tue May 26 22:15:19.661704 2026] [:error] [pid 43701:tid 43713] [client 130.131.224.225:3320] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/atkno.php"] [unique_id "ahWq94WtVI_UGrhtwKALGwAAAUo"]
[Tue May 26 22:15:20.725846 2026] [:error] [pid 43701:tid 43718] [client 130.131.224.225:47965] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahWq-IWtVI_UGrhtwKALIgAAAU8"]
[Tue May 26 22:15:22.513375 2026] [:error] [pid 43701:tid 43715] [client 130.131.224.225:44188] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahWq-oWtVI_UGrhtwKALLQAAAUw"]
[Tue May 26 22:15:23.675147 2026] [:error] [pid 33886:tid 33910] [client 130.131.224.225:57220] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahWq-7BYzgp5rPVdHcW5mwAAAFM"]
[Tue May 26 22:15:25.199794 2026] [:error] [pid 33888:tid 33953] [client 130.131.224.225:59885] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mini.php"] [unique_id "ahWq_TqzTeoxiinZsGEnqQAAAQc"]
[Tue May 26 22:15:26.333340 2026] [:error] [pid 33888:tid 33967] [client 130.131.224.225:34403] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "ahWq_jqzTeoxiinZsGEnsAAAARU"]
[Tue May 26 22:15:27.719879 2026] [:error] [pid 33886:tid 33911] [client 130.131.224.225:17812] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "ahWq_7BYzgp5rPVdHcW5oAAAAFQ"]
[Tue May 26 22:15:29.692324 2026] [:error] [pid 33888:tid 33968] [client 130.131.224.225:54400] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "ahWrATqzTeoxiinZsGEnxAAAARY"]
[Tue May 26 22:15:31.327638 2026] [:error] [pid 33888:tid 33960] [client 130.131.224.225:23082] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-thi.php"] [unique_id "ahWrAzqzTeoxiinZsGEn0wAAAQ4"]
[Tue May 26 22:15:35.848047 2026] [:error] [pid 33887:tid 33923] [client 130.131.224.225:24822] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahWrB9COI_FV7meOxGdSfAAAAIQ"]
[Tue May 26 22:15:38.306795 2026] [:error] [pid 33888:tid 33961] [client 130.131.224.225:62461] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahWrCjqzTeoxiinZsGEn4wAAAQ8"]
[Tue May 26 22:15:41.872911 2026] [:error] [pid 43701:tid 43724] [client 130.131.224.225:44164] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahWrDYWtVI_UGrhtwKAL0wAAAVU"]
[Tue May 26 22:15:43.931714 2026] [:error] [pid 33977:tid 33986] [client 130.131.224.225:44221] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahWrD-9cnSDNAU9sYPgRqgAAAAY"]
[Tue May 26 22:15:46.620038 2026] [:error] [pid 43701:tid 43718] [client 130.131.224.225:23078] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ahWrEoWtVI_UGrhtwKAL_gAAAU8"]
[Tue May 26 22:15:57.430899 2026] [:error] [pid 33887:tid 33925] [client 130.131.224.225:28567] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amax.php"] [unique_id "ahWrHdCOI_FV7meOxGdSmAAAAIY"]
[Tue May 26 22:16:20.410428 2026] [proxy_fcgi:error] [pid 43701:tid 43722] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:20.601727 2026] [proxy_fcgi:error] [pid 43701:tid 43703] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:20.826997 2026] [proxy_fcgi:error] [pid 43701:tid 43721] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:21.031459 2026] [proxy_fcgi:error] [pid 43701:tid 43718] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:21.224899 2026] [proxy_fcgi:error] [pid 43701:tid 43726] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:21.449060 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:21.643243 2026] [proxy_fcgi:error] [pid 43701:tid 43708] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:21.834914 2026] [proxy_fcgi:error] [pid 43701:tid 43710] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:22.027374 2026] [proxy_fcgi:error] [pid 43701:tid 43703] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:22.561118 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:22.752321 2026] [proxy_fcgi:error] [pid 43701:tid 43711] [client 130.131.224.225:56677] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:16:22.959710 2026] [:error] [pid 43701:tid 43727] [client 130.131.224.225:56677] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahWrNoWtVI_UGrhtwKANBAAAAVg"]
[Tue May 26 22:16:28.193583 2026] [:error] [pid 33887:tid 33928] [client 130.131.224.225:45426] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahWrPNCOI_FV7meOxGdS4QAAAIk"]
[Tue May 26 22:16:32.543452 2026] [:error] [pid 33977:tid 34003] [client 130.131.224.225:31160] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahWrQO9cnSDNAU9sYPgSYAAAABc"]
[Tue May 26 22:16:35.125377 2026] [:error] [pid 33887:tid 33928] [client 130.131.224.225:45396] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/yellow.php"] [unique_id "ahWrQ9COI_FV7meOxGdS6wAAAIk"]
[Tue May 26 22:16:37.158340 2026] [:error] [pid 33886:tid 33899] [client 130.131.224.225:45395] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahWrRbBYzgp5rPVdHcW57gAAAEg"]
[Tue May 26 22:16:38.487619 2026] [:error] [pid 43701:tid 43724] [client 130.131.224.225:31145] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahWrRoWtVI_UGrhtwKANagAAAVU"]
[Tue May 26 22:16:39.944832 2026] [:error] [pid 36497:tid 36529] [client 130.131.224.225:20403] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahWrR7jKQWM1gBmBY4g7qQAAANM"]
[Tue May 26 22:16:42.659758 2026] [:error] [pid 33888:tid 33954] [client 130.131.224.225:17583] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/reze.php"] [unique_id "ahWrSjqzTeoxiinZsGEoqwAAAQg"]
[Tue May 26 22:16:45.882734 2026] [:error] [pid 33977:tid 33992] [client 130.131.224.225:45438] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahWrTe9cnSDNAU9sYPgSkAAAAAw"]
[Tue May 26 22:16:49.823175 2026] [:error] [pid 36497:tid 36515] [client 130.131.224.225:39049] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahWrUbjKQWM1gBmBY4g7_wAAAMU"]
[Tue May 26 22:16:54.196744 2026] [:error] [pid 36497:tid 36526] [client 130.131.224.225:46065] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahWrVrjKQWM1gBmBY4g8LQAAANA"]
[Tue May 26 22:16:57.789596 2026] [:error] [pid 36497:tid 36523] [client 130.131.224.225:31122] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wefile.php"] [unique_id "ahWrWbjKQWM1gBmBY4g8PQAAAM0"]
[Tue May 26 22:17:02.237010 2026] [:error] [pid 33977:tid 33989] [client 130.131.224.225:47935] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahWrXu9cnSDNAU9sYPgSqQAAAAk"]
[Tue May 26 22:17:03.955515 2026] [:error] [pid 33888:tid 33961] [client 130.131.224.225:63663] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahWrXzqzTeoxiinZsGEpCQAAAQ8"]
[Tue May 26 22:17:06.932847 2026] [:error] [pid 33888:tid 33968] [client 130.131.224.225:33054] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahWrYjqzTeoxiinZsGEpEAAAARY"]
[Tue May 26 22:17:08.690286 2026] [:error] [pid 43701:tid 43723] [client 130.131.224.225:47920] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xda.php"] [unique_id "ahWrZIWtVI_UGrhtwKAN5wAAAVQ"]
[Tue May 26 22:17:10.032708 2026] [:error] [pid 36497:tid 36520] [client 130.131.224.225:51953] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "ahWrZrjKQWM1gBmBY4g8hAAAAMo"]
[Tue May 26 22:17:15.436198 2026] [:error] [pid 36497:tid 36529] [client 130.131.224.225:35653] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "ahWra7jKQWM1gBmBY4g8tQAAANM"]
[Tue May 26 22:17:17.231509 2026] [:error] [pid 33886:tid 33909] [client 130.131.224.225:25623] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "ahWrbbBYzgp5rPVdHcW6RgAAAFI"]
[Tue May 26 22:17:21.623474 2026] [:error] [pid 33888:tid 33960] [client 130.131.224.225:45355] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/revealability.php"] [unique_id "ahWrcTqzTeoxiinZsGEpLAAAAQ4"]
[Tue May 26 22:17:23.711595 2026] [proxy_fcgi:error] [pid 36497:tid 36521] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:23.924506 2026] [proxy_fcgi:error] [pid 36497:tid 36515] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:24.438811 2026] [proxy_fcgi:error] [pid 36497:tid 36534] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:24.653229 2026] [proxy_fcgi:error] [pid 36497:tid 36513] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:24.984645 2026] [proxy_fcgi:error] [pid 36497:tid 36517] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:25.314378 2026] [proxy_fcgi:error] [pid 36497:tid 36522] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:25.505188 2026] [proxy_fcgi:error] [pid 36497:tid 36519] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:25.696421 2026] [proxy_fcgi:error] [pid 36497:tid 36526] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:26.426191 2026] [proxy_fcgi:error] [pid 36497:tid 36531] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:26.873731 2026] [proxy_fcgi:error] [pid 36497:tid 36533] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:27.077658 2026] [proxy_fcgi:error] [pid 36497:tid 36534] [client 130.131.224.225:19460] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:17:27.279245 2026] [:error] [pid 36497:tid 36516] [client 130.131.224.225:19460] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahWrd7jKQWM1gBmBY4g9HAAAAMY"]
[Tue May 26 22:17:37.380527 2026] [:error] [pid 33977:tid 34000] [client 130.131.224.225:3506] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/dropdown.php"] [unique_id "ahWrge9cnSDNAU9sYPgS_wAAABQ"]
[Tue May 26 22:17:49.565789 2026] [:error] [pid 33977:tid 33996] [client 130.131.224.225:48651] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-good.php"] [unique_id "ahWrje9cnSDNAU9sYPgTTAAAABA"]
[Tue May 26 22:18:05.337103 2026] [:error] [pid 36497:tid 36518] [client 130.131.224.225:39122] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahWrnbjKQWM1gBmBY4g99QAAAMg"]
[Tue May 26 22:18:08.519949 2026] [:error] [pid 36497:tid 36515] [client 130.131.224.225:61807] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahWroLjKQWM1gBmBY4g-FQAAAMU"]
[Tue May 26 22:18:10.752051 2026] [:error] [pid 33887:tid 33926] [client 130.131.224.225:39129] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahWrotCOI_FV7meOxGdTTgAAAIc"]
[Tue May 26 22:18:13.765244 2026] [:error] [pid 43701:tid 43709] [client 130.131.224.225:54506] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/mifta.php"] [unique_id "ahWrpYWtVI_UGrhtwKAPjQAAAUY"]
[Tue May 26 22:18:17.490111 2026] [:error] [pid 33977:tid 33989] [client 130.131.224.225:3395] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "ahWrqe9cnSDNAU9sYPgTgQAAAAk"]
[Tue May 26 22:18:19.368742 2026] [:error] [pid 43701:tid 43703] [client 130.131.224.225:59207] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "ahWrq4WtVI_UGrhtwKAPrwAAAUA"]
[Tue May 26 22:18:21.694385 2026] [:error] [pid 33977:tid 33995] [client 130.131.224.225:3218] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/amxloxxr.php"] [unique_id "ahWrre9cnSDNAU9sYPgTkAAAAA8"]
[Tue May 26 22:18:27.869015 2026] [proxy_fcgi:error] [pid 43701:tid 43703] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:28.076040 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:28.267629 2026] [proxy_fcgi:error] [pid 43701:tid 43717] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:28.716975 2026] [proxy_fcgi:error] [pid 43701:tid 43705] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:28.929292 2026] [proxy_fcgi:error] [pid 43701:tid 43727] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:29.354386 2026] [proxy_fcgi:error] [pid 43701:tid 43723] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:29.545554 2026] [proxy_fcgi:error] [pid 43701:tid 43711] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:29.737151 2026] [proxy_fcgi:error] [pid 43701:tid 43708] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:29.935602 2026] [proxy_fcgi:error] [pid 43701:tid 43705] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:30.169943 2026] [proxy_fcgi:error] [pid 43701:tid 43718] [client 130.131.224.225:61762] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:18:30.381448 2026] [:error] [pid 43701:tid 43712] [client 130.131.224.225:61762] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahWrtoWtVI_UGrhtwKAQPAAAAUk"]
[Tue May 26 22:18:41.862782 2026] [:error] [pid 33888:tid 33961] [client 130.131.224.225:29838] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/db.php"] [unique_id "ahWrwTqzTeoxiinZsGEp0QAAAQ8"]
[Tue May 26 22:19:06.700504 2026] [:error] [pid 33887:tid 33927] [client 130.131.224.225:29833] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "ahWr2tCOI_FV7meOxGdTngAAAIg"]
[Tue May 26 22:19:10.049866 2026] [:error] [pid 43701:tid 43706] [client 130.131.224.225:32316] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "ahWr3oWtVI_UGrhtwKAQ6wAAAUM"]
[Tue May 26 22:19:15.007639 2026] [:error] [pid 33888:tid 33960] [client 130.131.224.225:46627] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/sys.php"] [unique_id "ahWr4zqzTeoxiinZsGEp7AAAAQ4"]
[Tue May 26 22:19:27.432096 2026] [:error] [pid 33887:tid 33925] [client 130.131.224.225:33677] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "ahWr79COI_FV7meOxGdT9gAAAIY"]
[Tue May 26 22:19:29.345846 2026] [:error] [pid 33977:tid 33984] [client 130.131.224.225:51220] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/lala.php"] [unique_id "ahWr8e9cnSDNAU9sYPgUMQAAAAQ"]
[Tue May 26 22:19:30.755184 2026] [proxy_fcgi:error] [pid 43701:tid 43718] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:30.945661 2026] [proxy_fcgi:error] [pid 43701:tid 43722] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:31.136301 2026] [proxy_fcgi:error] [pid 43701:tid 43721] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:31.335370 2026] [proxy_fcgi:error] [pid 43701:tid 43724] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:31.648253 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:32.393408 2026] [proxy_fcgi:error] [pid 43701:tid 43706] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:32.775957 2026] [proxy_fcgi:error] [pid 43701:tid 43713] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:33.269246 2026] [proxy_fcgi:error] [pid 43701:tid 43719] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:33.459422 2026] [proxy_fcgi:error] [pid 43701:tid 43707] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:33.650650 2026] [proxy_fcgi:error] [pid 43701:tid 43705] [client 130.131.224.225:32258] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:19:33.839491 2026] [:error] [pid 43701:tid 43723] [client 130.131.224.225:32258] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahWr9YWtVI_UGrhtwKARtQAAAVQ"]
[Tue May 26 22:19:35.010665 2026] [:error] [pid 33887:tid 33925] [client 130.131.224.225:41972] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahWr99COI_FV7meOxGdUAgAAAIY"]
[Tue May 26 22:19:36.316146 2026] [:error] [pid 43701:tid 43705] [client 130.131.224.225:51240] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahWr-IWtVI_UGrhtwKARxgAAAUI"]
[Tue May 26 22:19:40.664546 2026] [:error] [pid 33888:tid 33964] [client 130.131.224.225:61766] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/cilus.php"] [unique_id "ahWr_DqzTeoxiinZsGEqBgAAARI"]
[Tue May 26 22:19:44.136954 2026] [:error] [pid 33888:tid 33957] [client 130.131.224.225:39123] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ahWsADqzTeoxiinZsGEqIQAAAQs"]
[Tue May 26 22:19:46.719482 2026] [:error] [pid 43701:tid 43718] [client 130.131.224.225:30339] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ahWsAoWtVI_UGrhtwKAR9gAAAU8"]
[Tue May 26 22:19:49.961499 2026] [:error] [pid 33887:tid 33920] [client 130.131.224.225:22352] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/a5.php"] [unique_id "ahWsBdCOI_FV7meOxGdUGgAAAIE"]
[Tue May 26 22:19:59.694992 2026] [:error] [pid 33977:tid 33991] [client 130.131.224.225:31664] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahWsD-9cnSDNAU9sYPgUcwAAAAs"]
[Tue May 26 22:20:01.381970 2026] [:error] [pid 43701:tid 43725] [client 130.131.224.225:63700] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahWsEYWtVI_UGrhtwKASUwAAAVY"]
[Tue May 26 22:20:03.071805 2026] [:error] [pid 43701:tid 43717] [client 130.131.224.225:24732] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahWsE4WtVI_UGrhtwKASZQAAAU4"]
[Tue May 26 22:20:04.168094 2026] [:error] [pid 33887:tid 33928] [client 130.131.224.225:33101] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/test.php"] [unique_id "ahWsFNCOI_FV7meOxGdUOgAAAIk"]
[Tue May 26 22:20:08.489600 2026] [:error] [pid 36497:tid 36519] [client 130.131.224.225:29160] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahWsGLjKQWM1gBmBY4g_4wAAAMk"]
[Tue May 26 22:20:11.477597 2026] [:error] [pid 36497:tid 36532] [client 130.131.224.225:57315] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahWsG7jKQWM1gBmBY4g_6AAAANY"]
[Tue May 26 22:20:12.971074 2026] [:error] [pid 43701:tid 43718] [client 130.131.224.225:60535] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahWsHIWtVI_UGrhtwKASxgAAAU8"]
[Tue May 26 22:20:14.128303 2026] [:error] [pid 33886:tid 33895] [client 130.131.224.225:4081] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/aa.php"] [unique_id "ahWsHrBYzgp5rPVdHcW7uAAAAEQ"]
[Tue May 26 22:20:15.517665 2026] [:error] [pid 36497:tid 36521] [client 130.131.224.225:29120] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ahWsH7jKQWM1gBmBY4g_7gAAAMs"]
[Tue May 26 22:20:16.923179 2026] [:error] [pid 43701:tid 43719] [client 130.131.224.225:60513] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ahWsIIWtVI_UGrhtwKAS9AAAAVA"]
[Tue May 26 22:20:18.840446 2026] [:error] [pid 33887:tid 33939] [client 130.131.224.225:31729] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ahWsItCOI_FV7meOxGdUWgAAAJQ"]
[Tue May 26 22:20:24.541826 2026] [:error] [pid 43701:tid 43727] [client 130.131.224.225:60498] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/term.php"] [unique_id "ahWsKIWtVI_UGrhtwKATMAAAAVg"]
[Tue May 26 22:20:44.021828 2026] [proxy_fcgi:error] [pid 43701:tid 43707] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:44.252334 2026] [proxy_fcgi:error] [pid 43701:tid 43724] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:44.479507 2026] [proxy_fcgi:error] [pid 43701:tid 43713] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:44.688194 2026] [proxy_fcgi:error] [pid 43701:tid 43726] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:44.914780 2026] [proxy_fcgi:error] [pid 43701:tid 43705] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:45.105996 2026] [proxy_fcgi:error] [pid 43701:tid 43727] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:45.335399 2026] [proxy_fcgi:error] [pid 43701:tid 43715] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:45.527142 2026] [proxy_fcgi:error] [pid 43701:tid 43718] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:46.021960 2026] [proxy_fcgi:error] [pid 43701:tid 43725] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:46.215187 2026] [proxy_fcgi:error] [pid 43701:tid 43708] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:46.409712 2026] [proxy_fcgi:error] [pid 43701:tid 43721] [client 130.131.224.225:33755] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:20:46.603413 2026] [:error] [pid 43701:tid 43704] [client 130.131.224.225:33755] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahWsPoWtVI_UGrhtwKAUBwAAAUE"]
[Tue May 26 22:20:48.540178 2026] [:error] [pid 36497:tid 36518] [client 130.131.224.225:28665] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahWsQLjKQWM1gBmBY4hAkgAAAMg"]
[Tue May 26 22:20:50.613903 2026] [:error] [pid 36497:tid 36516] [client 130.131.224.225:28656] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahWsQrjKQWM1gBmBY4hArAAAAMY"]
[Tue May 26 22:20:52.304376 2026] [:error] [pid 33888:tid 33956] [client 130.131.224.225:28667] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xxx.php"] [unique_id "ahWsRDqzTeoxiinZsGEq1AAAAQo"]
[Tue May 26 22:20:54.495283 2026] [:error] [pid 43701:tid 43713] [client 130.131.224.225:26548] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahWsRoWtVI_UGrhtwKAUIwAAAUo"]
[Tue May 26 22:20:55.779504 2026] [:error] [pid 43701:tid 43724] [client 130.131.224.225:29908] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahWsR4WtVI_UGrhtwKAULgAAAVU"]
[Tue May 26 22:20:57.329716 2026] [:error] [pid 33886:tid 33904] [client 130.131.224.225:25998] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahWsSbBYzgp5rPVdHcW8LQAAAE0"]
[Tue May 26 22:20:58.780118 2026] [:error] [pid 43701:tid 43714] [client 130.131.224.225:17473] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/new.php"] [unique_id "ahWsSoWtVI_UGrhtwKAUQgAAAUs"]
[Tue May 26 22:21:27.889849 2026] [:error] [pid 33887:tid 33933] [client 130.131.224.225:26556] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahWsZ9COI_FV7meOxGdU6gAAAI4"]
[Tue May 26 22:21:30.018740 2026] [:error] [pid 43701:tid 43705] [client 130.131.224.225:44269] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahWsaoWtVI_UGrhtwKAVMwAAAUI"]
[Tue May 26 22:21:31.816794 2026] [:error] [pid 33887:tid 33928] [client 130.131.224.225:35015] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahWsa9COI_FV7meOxGdU-QAAAIk"]
[Tue May 26 22:21:33.516637 2026] [:error] [pid 43701:tid 43724] [client 130.131.224.225:3634] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/txets.php"] [unique_id "ahWsbYWtVI_UGrhtwKAVTAAAAVU"]
[Tue May 26 22:21:34.229984 2026] [:error] [pid 36497:tid 36513] [client 130.131.224.225:58585] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "ahWsbrjKQWM1gBmBY4hBWwAAAMM"]
[Tue May 26 22:21:36.573306 2026] [:error] [pid 43701:tid 43721] [client 130.131.224.225:3188] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "ahWscIWtVI_UGrhtwKAVWQAAAVI"]
[Tue May 26 22:21:37.424208 2026] [:error] [pid 33888:tid 33961] [client 130.131.224.225:3889] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "ahWscTqzTeoxiinZsGErVAAAAQ8"]
[Tue May 26 22:21:38.321417 2026] [:error] [pid 43701:tid 43721] [client 130.131.224.225:17522] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/shell20211028.php"] [unique_id "ahWscoWtVI_UGrhtwKAVZAAAAVI"]
[Tue May 26 22:21:39.460445 2026] [:error] [pid 33977:tid 33994] [client 130.131.224.225:3854] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahWsc-9cnSDNAU9sYPgVjAAAAA4"]
[Tue May 26 22:21:41.090428 2026] [:error] [pid 43701:tid 43711] [client 130.131.224.225:17483] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahWsdYWtVI_UGrhtwKAVcAAAAUg"]
[Tue May 26 22:21:42.377003 2026] [:error] [pid 33977:tid 33987] [client 130.131.224.225:17512] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahWsdu9cnSDNAU9sYPgVlQAAAAc"]
[Tue May 26 22:21:44.038313 2026] [:error] [pid 43701:tid 43710] [client 130.131.224.225:58572] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-wz.php"] [unique_id "ahWseIWtVI_UGrhtwKAVhwAAAUc"]
[Tue May 26 22:21:45.584155 2026] [:error] [pid 33977:tid 34002] [client 130.131.224.225:26005] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/albin.php"] [unique_id "ahWsee9cnSDNAU9sYPgVmQAAABY"]
[Tue May 26 22:21:47.238835 2026] [proxy_fcgi:error] [pid 33977:tid 33980] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:47.430581 2026] [proxy_fcgi:error] [pid 33977:tid 33981] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:47.670948 2026] [proxy_fcgi:error] [pid 33977:tid 34001] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:48.307810 2026] [proxy_fcgi:error] [pid 33977:tid 33992] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:48.547811 2026] [proxy_fcgi:error] [pid 33977:tid 33983] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:48.882223 2026] [proxy_fcgi:error] [pid 33977:tid 33994] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:49.523610 2026] [proxy_fcgi:error] [pid 33977:tid 33984] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:49.787003 2026] [proxy_fcgi:error] [pid 33977:tid 33989] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:49.980916 2026] [proxy_fcgi:error] [pid 33977:tid 34003] [client 130.131.224.225:3880] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:21:50.298322 2026] [:error] [pid 33977:tid 33998] [client 130.131.224.225:3880] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conflg.php"] [unique_id "ahWsfu9cnSDNAU9sYPgVrAAAABI"]
[Tue May 26 22:21:53.748365 2026] [:error] [pid 33887:tid 33925] [client 130.131.224.225:27858] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conflg.php"] [unique_id "ahWsgdCOI_FV7meOxGdVAQAAAIY"]
[Tue May 26 22:21:54.605117 2026] [:error] [pid 33888:tid 33969] [client 130.131.224.225:26039] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conflg.php"] [unique_id "ahWsgjqzTeoxiinZsGEraAAAARc"]
[Tue May 26 22:21:56.835175 2026] [:error] [pid 43701:tid 43721] [client 130.131.224.225:17486] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-conflg.php"] [unique_id "ahWshIWtVI_UGrhtwKAWFAAAAVI"]
[Tue May 26 22:21:58.644387 2026] [:error] [pid 36497:tid 36529] [client 130.131.224.225:25988] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ahWshrjKQWM1gBmBY4hBzAAAANM"]
[Tue May 26 22:22:07.033861 2026] [:error] [pid 43701:tid 43704] [client 130.131.224.225:24785] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ahWsj4WtVI_UGrhtwKAWpwAAAUE"]
[Tue May 26 22:22:08.243535 2026] [:error] [pid 33888:tid 33954] [client 130.131.224.225:23557] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ahWskDqzTeoxiinZsGErgAAAAQg"]
[Tue May 26 22:22:11.937824 2026] [:error] [pid 33887:tid 33943] [client 130.131.224.225:3561] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp-update.php"] [unique_id "ahWsk9COI_FV7meOxGdVIQAAAJg"]
[Tue May 26 22:22:13.483544 2026] [:error] [pid 43701:tid 43710] [client 130.131.224.225:3520] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hello.php"] [unique_id "ahWslYWtVI_UGrhtwKAWyAAAAUc"]
[Tue May 26 22:22:15.769523 2026] [:error] [pid 36497:tid 36519] [client 130.131.224.225:29940] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hello.php"] [unique_id "ahWsl7jKQWM1gBmBY4hB7QAAAMk"]
[Tue May 26 22:22:18.208512 2026] [:error] [pid 43701:tid 43716] [client 130.131.224.225:33736] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hello.php"] [unique_id "ahWsmoWtVI_UGrhtwKAW0QAAAU0"]
[Tue May 26 22:22:21.139758 2026] [:error] [pid 43701:tid 43706] [client 130.131.224.225:40454] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/hello.php"] [unique_id "ahWsnYWtVI_UGrhtwKAW2QAAAUM"]
[Tue May 26 22:22:25.836043 2026] [:error] [pid 43701:tid 43710] [client 130.131.224.225:26024] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NewFile.php"] [unique_id "ahWsoYWtVI_UGrhtwKAW6QAAAUc"]
[Tue May 26 22:22:27.374732 2026] [:error] [pid 33886:tid 33892] [client 130.131.224.225:32345] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NewFile.php"] [unique_id "ahWso7BYzgp5rPVdHcW8hwAAAEE"]
[Tue May 26 22:22:29.190733 2026] [:error] [pid 33888:tid 33955] [client 130.131.224.225:27339] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NewFile.php"] [unique_id "ahWspTqzTeoxiinZsGErrAAAAQk"]
[Tue May 26 22:22:30.499427 2026] [:error] [pid 36497:tid 36514] [client 130.131.224.225:62446] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/NewFile.php"] [unique_id "ahWsprjKQWM1gBmBY4hCAgAAAMQ"]
[Tue May 26 22:22:34.084729 2026] [:error] [pid 33886:tid 33905] [client 130.131.224.225:62452] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "ahWsqrBYzgp5rPVdHcW8jgAAAE4"]
[Tue May 26 22:22:35.377167 2026] [:error] [pid 33977:tid 34003] [client 130.131.224.225:30434] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "ahWsq-9cnSDNAU9sYPgV3AAAABc"]
[Tue May 26 22:22:38.714961 2026] [:error] [pid 33977:tid 33996] [client 130.131.224.225:31735] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "ahWsru9cnSDNAU9sYPgV4gAAABA"]
[Tue May 26 22:22:40.595865 2026] [:error] [pid 43701:tid 43709] [client 130.131.224.225:3738] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/bless5.php"] [unique_id "ahWssIWtVI_UGrhtwKAXGAAAAUY"]
[Tue May 26 22:22:41.602358 2026] [:error] [pid 43701:tid 43714] [client 130.131.224.225:21800] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "ahWssYWtVI_UGrhtwKAXHgAAAUs"]
[Tue May 26 22:22:44.127076 2026] [:error] [pid 43701:tid 43714] [client 130.131.224.225:45974] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "ahWstIWtVI_UGrhtwKAXKwAAAUs"]
[Tue May 26 22:22:46.615994 2026] [:error] [pid 33977:tid 33995] [client 130.131.224.225:35591] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "ahWstu9cnSDNAU9sYPgV7QAAAA8"]
[Tue May 26 22:22:48.131575 2026] [:error] [pid 33888:tid 33954] [client 130.131.224.225:18245] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/v2.php"] [unique_id "ahWsuDqzTeoxiinZsGEr0QAAAQg"]
[Tue May 26 22:22:48.868925 2026] [:error] [pid 33977:tid 34002] [client 130.131.224.225:34397] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/wp4.php"] [unique_id "ahWsuO9cnSDNAU9sYPgV7gAAABY"]
[Tue May 26 22:22:51.556187 2026] [proxy_fcgi:error] [pid 43701:tid 43719] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:51.975101 2026] [proxy_fcgi:error] [pid 43701:tid 43724] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:52.247723 2026] [proxy_fcgi:error] [pid 43701:tid 43711] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:52.438380 2026] [proxy_fcgi:error] [pid 43701:tid 43707] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:52.629682 2026] [proxy_fcgi:error] [pid 43701:tid 43706] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:52.830257 2026] [proxy_fcgi:error] [pid 43701:tid 43719] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:53.149370 2026] [proxy_fcgi:error] [pid 43701:tid 43723] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:53.351753 2026] [proxy_fcgi:error] [pid 43701:tid 43724] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:53.542783 2026] [proxy_fcgi:error] [pid 43701:tid 43726] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:54.090574 2026] [proxy_fcgi:error] [pid 43701:tid 43721] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:54.722841 2026] [proxy_fcgi:error] [pid 43701:tid 43715] [client 130.131.224.225:44191] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:22:54.910851 2026] [:error] [pid 43701:tid 43713] [client 130.131.224.225:44191] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "ahWsvoWtVI_UGrhtwKAXWAAAAUo"]
[Tue May 26 22:22:56.273050 2026] [:error] [pid 43701:tid 43724] [client 130.131.224.225:57232] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "ahWswIWtVI_UGrhtwKAXXAAAAVU"]
[Tue May 26 22:22:57.855743 2026] [:error] [pid 36497:tid 36515] [client 130.131.224.225:23093] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "ahWswbjKQWM1gBmBY4hCPgAAAMU"]
[Tue May 26 22:22:59.058562 2026] [:error] [pid 33886:tid 33894] [client 130.131.224.225:63694] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/666.php"] [unique_id "ahWsw7BYzgp5rPVdHcW8oAAAAEM"]
[Tue May 26 22:23:01.052688 2026] [:error] [pid 36497:tid 36520] [client 130.131.224.225:24731] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoot.php"] [unique_id "ahWsxbjKQWM1gBmBY4hCRAAAAMo"]
[Tue May 26 22:23:03.144670 2026] [:error] [pid 33886:tid 33909] [client 130.131.224.225:50047] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoot.php"] [unique_id "ahWsx7BYzgp5rPVdHcW8qgAAAFI"]
[Tue May 26 22:23:05.445545 2026] [:error] [pid 43701:tid 43715] [client 130.131.224.225:24742] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoot.php"] [unique_id "ahWsyYWtVI_UGrhtwKAXhAAAAUw"]
[Tue May 26 22:23:06.181937 2026] [:error] [pid 43701:tid 43721] [client 130.131.224.225:23052] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/xoot.php"] [unique_id "ahWsyoWtVI_UGrhtwKAXiwAAAVI"]
[Tue May 26 22:23:07.326361 2026] [:error] [pid 43701:tid 43722] [client 130.131.224.225:33138] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vgtyu.php"] [unique_id "ahWsy4WtVI_UGrhtwKAXlAAAAVM"]
[Tue May 26 22:23:08.564192 2026] [:error] [pid 33887:tid 33931] [client 130.131.224.225:19480] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vgtyu.php"] [unique_id "ahWszNCOI_FV7meOxGdVawAAAIw"]
[Tue May 26 22:23:09.701891 2026] [:error] [pid 43701:tid 43714] [client 130.131.224.225:50020] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vgtyu.php"] [unique_id "ahWszYWtVI_UGrhtwKAXowAAAUs"]
[Tue May 26 22:23:13.709511 2026] [:error] [pid 33888:tid 33966] [client 130.131.224.225:44924] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/vgtyu.php"] [unique_id "ahWs0TqzTeoxiinZsGEr3gAAARQ"]
[Tue May 26 22:23:17.889479 2026] [:error] [pid 36497:tid 36512] [client 130.131.224.225:51963] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/06.php"] [unique_id "ahWs1bjKQWM1gBmBY4hCWwAAAMI"]
[Tue May 26 22:23:20.999906 2026] [:error] [pid 33887:tid 33938] [client 130.131.224.225:56668] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/06.php"] [unique_id "ahWs2NCOI_FV7meOxGdVegAAAJM"]
[Tue May 26 22:23:22.559000 2026] [:error] [pid 33886:tid 33908] [client 130.131.224.225:24384] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/06.php"] [unique_id "ahWs2rBYzgp5rPVdHcW8twAAAFE"]
[Tue May 26 22:23:24.367207 2026] [:error] [pid 36497:tid 36517] [client 130.131.224.225:19470] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/06.php"] [unique_id "ahWs3LjKQWM1gBmBY4hCZwAAAMc"]
[Tue May 26 22:23:29.679044 2026] [:error] [pid 33977:tid 33992] [client 130.131.224.225:44866] [client 130.131.224.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "switchcreative.net"] [uri "/erty.php"] [unique_id "ahWs4e9cnSDNAU9sYPgWKgAAAAw"]
[Tue May 26 22:24:15.606431 2026] [proxy_fcgi:error] [pid 33886:tid 33891] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:24:15.796914 2026] [proxy_fcgi:error] [pid 33886:tid 33912] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:24:15.987639 2026] [proxy_fcgi:error] [pid 33886:tid 33906] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:24:16.179511 2026] [proxy_fcgi:error] [pid 33886:tid 33897] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:24:16.371316 2026] [proxy_fcgi:error] [pid 33886:tid 33892] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'
[Tue May 26 22:24:16.666115 2026] [proxy_fcgi:error] [pid 33886:tid 33899] [client 130.131.224.225:48684] AH01071: Got error 'Primary script unknown'